A campus safety IoT perception system and method based on AI algorithm

Abstract

The present invention relates to the field of perception management technology, specifically a campus security Internet of Things perception system and method based on AI algorithm, the system includes a network behavior analysis module, an identity recognition module, a policy formulation module, a policy implementation monitoring module, a security event processing module and a network optimization module. In the present invention, by implementing AI algorithm in the campus security Internet of Things for real-time data analysis and event response, the response speed and accuracy of the campus Internet of Things are significantly improved, abnormal traffic and access frequency are automatically identified, and early warning is allowed before potential threats actually occur, and then the access control strategy is automatically adjusted. The classification and priority sorting of security events further ensures the protection of key resources, and the most critical threats are ensured to be handled first through intelligent analysis. The comprehensive security management strategy not only improves the security level of the campus Internet of Things, but also enhances the overall operating efficiency, making security management more accurate and timely.

Description

Technical Field

[0001] The present invention relates to the field of perception management technology, and in particular to a campus safety Internet of Things perception system and method based on AI algorithm. Background Art

[0002] The field of perception management technology involves the use of various sensors and data collection devices to monitor and analyze the status of the environment and system. In the Internet of Things (IoT) environment, perception management is not limited to the simple collection of data, but also includes real-time analysis of data to facilitate quick decision-making. Through advanced data analysis technologies such as machine learning and artificial intelligence (AI), patterns can be identified from massive amounts of data, events can be predicted, or responses can be automatically triggered. It has applications in many fields, especially in security monitoring, environmental monitoring, and smart home systems.

[0003] Among them, the campus security IoT perception system based on AI algorithm is a system that uses IoT technology combined with artificial intelligence algorithms to enhance campus security. It collects real-time data on campus (such as video surveillance, access control records, etc.) by deploying multiple sensors, and uses AI algorithms to analyze the data to identify potential security threats or abnormal behaviors. It can predict events and automatically alarm, effectively improving the campus's prevention capabilities and emergency response speed. Its main uses include improving the efficiency and accuracy of campus security monitoring and ensuring the safety of teachers and students.

[0004] Existing campus security IoT perception management technology is mainly limited to data collection and basic event response, lacking in-depth data analysis and prediction capabilities, making the system inflexible and in-time when dealing with complex security threats. For example, relying solely on basic data analysis, existing technologies are difficult to accurately identify and respond to complex security threats, such as distributed denial of service attacks (DDoS) or internal threats, resulting in the leakage of important data or long-term system interruptions. Existing technologies are also deficient in automated response measures, requiring manual intervention to adjust security policies, which not only increases operating costs but also prolongs response time. In actual operations, this leads to insufficient timely handling of security incidents, posing potential risks to campus security. Summary of the invention

[0005] The purpose of the present invention is to solve the shortcomings of the prior art and propose a campus safety Internet of Things perception system and method based on AI algorithm.

[0006] In order to achieve the above purpose, the present invention adopts the following technical solution: a campus safety IoT perception system based on AI algorithm includes:

[0007] The network behavior analysis module collects campus IoT access logs, identifies abnormal frequency access and abnormal traffic, uses AI algorithms to calculate IoT traffic peaks, and generates abnormal access indicators;

[0008] The identity recognition module uses an AI algorithm based on the abnormal access indicators to identify the access of unauthorized devices on campus and potential security threats, performs identity authentication on the access devices, and generates threat identification results;

[0009] The policy formulation module designs and implements campus device access rules and generates security policy solutions based on the threat identification results through access permission modification and network partitioning strategies;

[0010] The policy implementation monitoring module applies the security policy solution, automatically adjusts the campus IoT configuration, and implements access control, using monitoring policy execution, recording execution deviations, and generating execution monitoring records;

[0011] The security incident processing module identifies and classifies security incidents in policy execution based on the execution monitoring records and through AI algorithms, implements corresponding security response measures, and generates security response execution results by blocking illegal access;

[0012] The network optimization module evaluates the security response execution results, analyzes the effect of the security response execution and the handling of security incidents, and generates optimized security measures by designing adjustment strategies.

[0013] As a further solution of the present invention, the abnormal access indicators include access frequency, traffic anomalies and access time period anomalies, the threat identification results include device ID, access status and security rating, the security policy scheme includes access control list, network isolation area and device authority level, the execution monitoring records include policy execution logs, configuration change records and access control violations, the security response execution results include response action type, response time and impact assessment results, and the optimized security measures include policy adjustment schemes, performance optimization measures and risk adjustment schemes.

[0014] As a further solution of the present invention, the network behavior analysis module includes:

[0015] The access log collection submodule collects campus IoT access logs, records the access time of campus IoT devices, filters access records with abnormal frequencies, and generates access frequency records by monitoring and collecting data from each access point;

[0016] The traffic comparison submodule uses the data obtained from the access frequency record to analyze the campus IoT traffic, detect traffic anomalies of the campus IoT, and generate abnormal traffic analysis results by comparing the real-time traffic data of multiple devices with the historical average value;

[0017] The peak calculation submodule analyzes the peaks and valleys in the abnormal traffic data according to the abnormal traffic analysis results, uses the AI ​​algorithm to perform statistical analysis and peak recognition on the traffic data, locates and tracks the moments of traffic anomalies, and generates abnormal access indicators.

[0018] As a further solution of the present invention, the identity recognition module includes:

[0019] Based on the abnormal access indicators, the device monitoring submodule monitors the device access points of the campus network in real time, records the MAC addresses and IP addresses of the devices, uses AI algorithms to detect device access modes, evaluates the security of access devices, and generates device access records;

[0020] The security threat analysis submodule compares the access device with known unauthorized device features and behavior patterns based on the device access record, and generates device access behavior analysis results by checking the device historical behavior and records in the campus security IoT database;

[0021] The identity authentication submodule performs identity authentication on unauthorized devices in the campus Internet of Things based on the device access behavior analysis results, including device certificate checking and access permission verification, allocates campus Internet of Things resources to authorized devices, and generates threat identification results.

[0022] As a further solution of the present invention, the strategy formulation module includes:

[0023] The permission modification submodule analyzes the access rights of the threatened device based on the threat identification result, adjusts the permission settings according to the security rating of the device, and generates adjusted access rights by restricting the campus IoT access of the target;

[0024] The network isolation submodule uses the adjusted access rights to divide network partitions for devices with different security levels, isolates the devices in differentiated campus IoT areas according to their security levels, isolates risky devices from key network areas, and generates a network partitioning strategy;

[0025] The rule implementation submodule updates the device access rules of the campus Internet of Things according to the network partitioning strategy, deploys new security rules to network devices, including routers and switches, and executes configuration updates and rule deployment plans to generate security policy solutions.

[0026] As a further solution of the present invention, the policy implementation monitoring module includes:

[0027] The parameter adjustment submodule adjusts the network device parameters of the campus Internet of Things based on the security policy solution, including the security settings of routers and switches, updates the security parameters of network access points, and generates configuration adjustment records;

[0028] The network access submodule uses the configuration adjustment record to implement the access control strategy, verify and restrict the network access of campus IoT devices and users, allocate key network resources to the devices that pass the verification, and generate the access control status;

[0029] The execution deviation recording submodule monitors the implementation of the access control policy according to the access control status, records behaviors and events that deviate from the preset security policy, including access by unauthorized devices and rule violations, and generates execution monitoring records.

[0030] As a further solution of the present invention, the security event processing module includes:

[0031] The event identification submodule uses a decision tree algorithm based on the execution monitoring records to monitor and identify abnormal behaviors and unauthorized access events in the campus Internet of Things, and initializes the abnormal behaviors by analyzing the access patterns and frequencies of the execution monitoring records to generate marked security events;

[0032] The formula of the decision tree algorithm is as follows:

[0033]

[0034] in, Nodes in the decision tree The impurity of the Gini coefficient is For Node Belongs to the category The sample proportion of is the total number of categories, is the entropy weight coefficient, For Class At the node The frequency, For Node The total number of samples, is the frequency weight coefficient, For Class The standard deviation of is the weight coefficient of the standard deviation.

[0035] The priority sorting submodule utilizes the marked security events to classify the security events through an AI algorithm, classifies the security events into differentiated security levels according to the nature and potential impact of the security events, analyzes the priorities of the security events, and generates classified security events;

[0036] The security measures submodule designs and implements related security measures based on the classified security events, including blocking illegal access and restricting the campus IoT permissions of unauthorized devices, and generating security response execution results.

[0037] As a further solution of the present invention, the network optimization module includes:

[0038] The response measures submodule evaluates the effect of the implemented security response measures based on the security response execution results, analyzes the speed and efficiency of the security response measures, and generates response effect evaluation results;

[0039] The policy adjustment submodule uses the response effect evaluation results to identify potential threat points in the security policy, adjust the security response mechanism and access control rules of the campus Internet of Things, match the real-time security response requirements, and generate a security response requirement plan;

[0040] The measures implementation submodule updates and implements new security measures according to the security response demand plan, including setting new network access rules, adjusting firewall settings and updating parameters of intrusion detection devices, deploying them to related campus IoT and devices, and generating optimized security measures.

[0041] A campus security Internet of Things perception method based on an AI algorithm, wherein the campus security Internet of Things perception method based on an AI algorithm is performed based on the campus security Internet of Things perception system based on the AI ​​algorithm, and comprises the following steps:

[0042] S1: Collect campus IoT access logs, record device access time and traffic data, compare real-time traffic of multiple devices with historical data, analyze traffic peaks through AI algorithms, and generate abnormal access indicators;

[0043] S2: Based on the abnormal access indicators, monitor the MAC address and IP address of the device, compare them with the known unauthorized device features in the campus IoT database, evaluate the security of the device, allocate resources to legitimate devices, and generate threat identification results;

[0044] S3: Analyze the access rights of the threatened devices using the threat identification results, adjust the permission settings according to the security rating, divide the network into zones for devices with different security levels, isolate the risky devices, and generate a security policy solution;

[0045] S4: Implement the security policy solution, adjust security settings of network devices, including routers and switches, monitor the implementation of access control policies, record deviations from security policies, and generate execution monitoring records;

[0046] S5: Based on the execution monitoring records, identify unauthorized access and abnormal behavior in the campus Internet of Things, classify security incidents, design and implement corresponding security measures, block illegal access, and generate optimized security measures.

[0047] Compared with the prior art, the advantages and positive effects of the present invention are:

[0048] In the present invention, by implementing advanced AI algorithms in the campus security Internet of Things for real-time data analysis and event response, the response speed and accuracy of the campus Internet of Things are significantly improved. By continuously monitoring network behavior, abnormal traffic and access frequency are automatically identified, allowing early warning before potential threats actually occur, and then automatically adjusting access control policies to prevent potential risks. The automated threat detection and response mechanism reduces dependence on manual intervention and enhances the ability to handle security incidents. The classification and prioritization of security incidents further ensures the protection of key resources, and through intelligent analysis, ensures that the most critical threats are handled first. The comprehensive security management strategy not only improves the security level of the campus Internet of Things, but also enhances the overall operating efficiency, making security management more accurate and timely. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 is a system flow chart of the present invention;

[0050] Figure 2 It is a schematic diagram of the system framework of the present invention;

[0051] Figure 3 This is a flow chart of the network behavior analysis module of the present invention;

[0052] Figure 4 This is a flow chart of the identity recognition module of the present invention;

[0053] Figure 5 Develop a module flow chart for the strategy of the present invention;

[0054] Figure 6 It is a flow chart of the strategy implementation monitoring module of the present invention;

[0055] Figure 7 It is a flow chart of the security incident processing module of the present invention;

[0056] Figure 8 It is a flow chart of the network optimization module of the present invention;

[0057] Fig. 9 It is a schematic diagram of the method steps of the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0059] In the description of the present invention, it should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, in the description of the present invention, "multiple" means two or more, unless otherwise clearly and specifically defined.

[0060] Embodiment 1

[0061] See also Figure 1 to Figure 2 The present invention provides a technical solution, a campus safety Internet of Things perception system based on AI algorithm, comprising:

[0062] The network behavior analysis module collects campus IoT access logs, identifies abnormal frequency access and abnormal traffic, uses AI algorithms to analyze campus IoT traffic, calculates IoT traffic peaks, and generates abnormal access indicators;

[0063] The identity recognition module uses AI algorithms based on abnormal access indicators to identify unauthorized device access and potential security threats on campus, perform identity authentication on access devices, compare the behavior patterns of access devices and known unauthorized devices, and generate threat identification results;

[0064] The policy formulation module assigns differentiated access rights to differentiated devices based on threat identification results, isolates risky devices through network partitioning strategies, designs and implements device access rules on campus, and generates security policy solutions;

[0065] The policy implementation monitoring module applies security policy solutions, automatically adjusts the campus IoT configuration, and implements access control. It uses monitoring policy execution to record behaviors and events that deviate from the preset security policy and generate execution monitoring records.

[0066] The security incident processing module uses AI algorithms to identify and classify security incidents during policy execution based on execution monitoring records, implement corresponding security response measures, and generate security response execution results by blocking illegal access;

[0067] The network optimization module evaluates the results of security response execution, analyzes the effectiveness of security response execution and the handling of security incidents, and generates optimized security measures by designing adjustment strategies, including adjusting firewall settings and updating parameters of intrusion detection devices.

[0068] Abnormal access indicators include access frequency, traffic anomalies and access time anomalies. Threat identification results include device ID, access status and security rating. Security policy plans include access control lists, network isolation areas and device authority levels. Execution monitoring records include policy execution logs, configuration change records and access control violations. Security response execution results include response action type, response time and impact assessment results. Optimized security measures include policy adjustment plans, performance optimization measures and risk adjustment plans.

[0069] See also Figure 2 , 3 , the network behavior analysis module includes:

[0070] The access log collection submodule collects campus IoT access logs, records the access time of campus IoT devices, and filters access records with abnormal frequencies. By monitoring and collecting data from each access point, the execution process of generating access frequency records is as follows;

[0071] The access log collection submodule collects campus IoT access logs, records the access time of campus IoT devices, receives data packets from the network interface card, extracts metadata of each data packet, such as source IP address, destination IP address, timestamp, etc., and stores them in the log database. For each IoT device, the log recording interval is set to 10 seconds. Records that are frequently accessed beyond this interval will be marked as frequency anomalies. The system will traverse the log database, count the access intervals of each device, and generate a list of records containing device IDs and corresponding access frequencies. Using the set threshold, records that exceed the average access frequency by 20% are screened out and marked as anomalies. It not only involves data collection and storage, but also includes basic data processing and analysis, such as calculating averages and filtering operations to generate access frequency records. The formula is: ,in, For equipment The frequency of visits, For the The time between visits, is the total number of visits, The threshold is 1.2 times the average access frequency.

[0072] The traffic comparison submodule uses the data obtained from the access frequency records to analyze the campus IoT traffic and detect traffic anomalies of the campus IoT. By comparing the real-time traffic data of multiple devices with the historical average, the execution process of generating abnormal traffic analysis results is as follows;

[0073] The traffic comparison submodule uses the data obtained from the access frequency records to analyze the campus IoT traffic, detect traffic anomalies of the campus IoT, calculate the real-time traffic of each device, and compare it with the historical traffic data stored in the database. The system extracts the historical average traffic data of each device from the database and obtains the real-time traffic data from the network monitoring device. By calculating the percentage difference between the real-time data and the historical average, the system can identify which devices have abnormal traffic performance. If the real-time traffic exceeds 30% of the historical average traffic, it is recorded as an abnormal traffic event. It involves complex data comparison and calculation, and batch data points need to be accurately processed and analyzed. By comparing the real-time traffic data of multiple devices with the historical average, abnormal traffic analysis results are generated. The formula is: ,in, For equipment The flow difference, For real-time traffic, The historical average flow rate.

[0074] The peak calculation submodule analyzes the peaks and valleys in the abnormal traffic data based on the abnormal traffic analysis results, uses AI algorithms to perform statistical analysis and peak recognition on the traffic data, locates and tracks the moments of traffic anomalies, and generates the execution process of abnormal access indicators as follows;

[0075] The peak calculation submodule analyzes the peaks and valleys in the abnormal traffic data based on the abnormal traffic analysis results, and uses statistical methods to further analyze the data in the abnormal traffic events to identify the peak and valley moments of traffic. For each marked abnormal traffic event, the system will calculate the traffic peak and compare the peak with the set historical traffic peak threshold. If the traffic at a certain point in time exceeds the threshold, it will be recorded as the peak moment of the traffic anomaly. The system can effectively track and locate the specific moment of the traffic anomaly and generate abnormal access indicators. The formula is: ,in, For abnormal events The peak flow rate, For the moment of traffic, is the set of observation periods, is the peak flow threshold.

[0076] See also Figure 2 , 4 , the identity recognition module includes:

[0077] The device monitoring submodule monitors the device access points of the campus network in real time based on abnormal access indicators, records the MAC address and IP address of the device, uses AI algorithms to detect the device access mode, and evaluates the security of the access device. The execution process of generating device access records is as follows;

[0078] The device monitoring submodule monitors the device access points of the campus network in real time based on abnormal access indicators, records the MAC address and IP address of the device, and regularly captures data packets of all device access points through network scanning technology, extracts MAC addresses and IP addresses from them, and stores the data in a central database for subsequent processing. The timestamp of each data packet is also recorded to track access patterns. The access frequency and time of each device will be analyzed and compared with the abnormal access indicators to identify potential abnormal access behaviors. If the device access behavior matches the abnormal access indicators, the behavior is marked as suspicious and further analyzed for security. This includes using AI algorithms to analyze the behavior patterns of devices, such as the time period and frequency of device access, evaluate whether the behavior conforms to normal usage patterns, and generate device access records. The formula is: ,in, For equipment In time The behavioral score, For in time Behavior , is the number of behaviors, The risk behavior threshold is set.

[0079] The security threat analysis submodule compares the access device with the known unauthorized device characteristics and behavior patterns based on the device access record. By checking the device historical behavior and the records in the campus security IoT database, the execution process of generating the device access behavior analysis results is as follows;

[0080] The security threat analysis submodule compares the access devices with known unauthorized device features and behavior patterns based on device access records, and extracts all device information marked as suspicious from the device access records, including MAC address, IP address, access time, etc. The information is compared with the known unauthorized device features recorded in the campus security IoT database. The system analyzes the historical behavior of the device, such as access frequency and access time, and checks whether the behavior is consistent with the unauthorized device behavior pattern in the database. If a match is found, the device is listed as a potential security threat and the device access behavior analysis results are generated. The formula is: ,in, For equipment The security risk score of is the behavioral characteristics of the device, Behavioral characteristics of known unauthorized devices, is the feature matching function, is the total number of features.

[0081] The identity authentication submodule authenticates unauthorized devices of the campus IoT based on the device access behavior analysis results, including device certificate check and access permission verification, allocates campus IoT resources to authorized devices, and generates threat identification results. The execution process is as follows;

[0082] The identity authentication submodule authenticates unauthorized devices of the campus IoT based on the results of the device access behavior analysis, including device certificate checks and access rights verification. For each device marked as a potential threat, the system will verify the security certificate, including the digital signature and certificate validity period. At the same time, the system will check the device's access rights to ensure that only authorized resources can be accessed. If both the certificate and permission checks are verified, the device will be granted access to campus IoT resources. Otherwise, the device will be denied access and a threat identification result will be generated. The formula is: ,in, For equipment The verification results, is the certificate verification function, For device certificates, is the certificate validity status, Is the permission verification function, The permissions requested for the device, Resources authorized for the device.

[0083] See also Figure 2 , 5 , the strategy formulation module includes:

[0084] The permission modification submodule analyzes the access rights of the threatened device based on the threat identification results, adjusts the permission settings according to the security rating of the device, and generates the adjusted access rights by restricting the target's campus IoT access. The execution process is as follows;

[0085] The permission modification submodule analyzes the access rights of the threatened devices based on the threat identification results, adjusts the permission settings according to the security rating of the device, collects the threat identification results of each device, and evaluates the security rating of the corresponding device. For devices identified as high-risk, the system will automatically adjust the access rights to restrict access to sensitive network areas. The system will modify the device's permission profile to limit access to only non-sensitive information and services. Periodically re-evaluate the permission settings to adapt to changes in the network environment and updates to device behavior, and generate adjusted access rights. The formula is: ,in, For equipment Adjusted access permissions, Based on safety rating The calculated authority adjustment coefficient, The original permissions.

[0086] The network isolation submodule uses the adjusted access rights to divide network partitions for devices with different security levels, isolates devices in differentiated campus IoT areas according to their security levels, isolates risky devices from key network areas, and generates the execution process of the network partitioning strategy as follows;

[0087] The network isolation submodule uses the adjusted access rights to divide the network into zones for devices with different security levels, and determines the network zone to which it belongs by analyzing the security level of each device and the adjusted access rights. Devices will be assigned to different network zones based on security risk assessments to ensure that high-risk devices cannot access core network resources. The system will configure network infrastructure, such as virtual local area networks (VLANs) and access control lists (ACLs), to physically and logically isolate devices of different security levels and generate network partitioning strategies. The formula is: ,in, For equipment The network partition indicator, According to the security level and adjusted permissions The partition function to compute.

[0088] The rule implementation submodule updates the device access rules of the campus IoT according to the network partitioning strategy, deploys new security rules to network devices, including routers and switches, and executes configuration updates and rule deployment plans to generate the execution process of the security policy solution as follows;

[0089] The rule implementation submodule updates the device access rules of the campus IoT according to the network partitioning strategy. It is responsible for converting the network partitioning strategy into specific configuration updates and deploying them to network devices such as routers and switches. Through automated scripts or network management software, the system deploys new security rules to relevant devices, including updated access control rules and routing policies. Ensure that all device configurations are updated in a timely manner and comply with the latest security policies, and generate a security policy solution that includes all changes and newly deployed rules. The formula is: ,in, For equipment The rule configuration, According to the network partition index and the new configuration The rule implementation function for the calculation.

[0090] See also Figure 2 , 6 , the policy implementation monitoring module includes:

[0091] The parameter adjustment submodule adjusts the network device parameters of the campus IoT based on the security policy solution, including the security settings of routers and switches, updates the security parameters of network access points, and generates the execution process of configuration adjustment records as follows;

[0092] The parameter adjustment submodule adjusts the network device parameters of the campus IoT based on the security policy solution, including the security settings of routers and switches, and extracts necessary configuration parameters from the security policy solution, such as firewall rules, access control lists, and network protocol security settings. The system administrator or automated script deploys the parameters to the corresponding network devices to ensure that the configuration of each device is consistent with the latest security policy, and generates configuration adjustment records by recording in detail the device, time, and content of each parameter adjustment. The formula is: ,in, For equipment The parameter adjustment results are: For the original parameter settings, For new parameter settings, is the parameter adjustment factor calculated according to the security policy.

[0093] The network access submodule uses the configuration adjustment record to implement the access control policy, verify and restrict the network access of campus IoT devices and users, allocate key network resources to the devices that pass the verification, and generate the execution process of the access control status as follows;

[0094] The network access submodule uses configuration adjustment records to implement access control policies, analyzes configuration adjustment records, and confirms that the security settings of all network devices have been updated. The system implements detailed access control policies and decides whether to allow access to key network resources based on the verification results of devices and users. For devices that pass the verification, the necessary network resources and permissions are allocated. At the same time, access attempts that fail the verification are restricted and recorded, and access control status records are generated. The formula is: ,in, For equipment The access control verification result is is the verification status of the device, is the resource type requested, and They are verification function and resource allocation function respectively.

[0095] The execution deviation record submodule monitors the implementation of the access control policy according to the access control status, records the behaviors and events that deviate from the preset security policy, including the access of unauthorized devices and the violation of rules, and generates the execution monitoring record. The execution process is as follows;

[0096] The execution deviation record submodule monitors the implementation of access control policies based on the access control status. This module regularly checks all network access activities, compares the access control status records, and identifies behaviors and events that are inconsistent with the preset security policies, including unauthorized device access and violations of security rules. Through the integrated monitoring tool, deviations can be captured and recorded in real time to generate execution monitoring records. The formula is: ,in, For events The execution deviation The security status of the event. is the behavior type, is the deviation calculation function, The default security policy status.

[0097] See also Figure 2 , 7 , the security incident processing module includes:

[0098] The event identification submodule uses a decision tree algorithm based on execution monitoring records to monitor and identify abnormal behaviors and unauthorized access events in the campus Internet of Things. By analyzing the access patterns and frequencies of execution monitoring records, the abnormal behaviors are initialized and marked. The execution process of generating marked security events is as follows;

[0099] The event identification submodule uses a decision tree algorithm based on execution monitoring records to monitor and identify abnormal behaviors and unauthorized access events in the campus Internet of Things. It collects execution monitoring records, including the access time, access frequency, access type, and access results of each device. Using the data, the system builds a decision tree model to determine whether there is abnormal or unauthorized behavior based on the device's behavior pattern and access frequency. When a pattern is detected to be significantly different from the normal behavior template, the behavior is marked as abnormal and a marked security event is generated.

[0100] The formula for the decision tree algorithm is as follows:

[0101]

[0102] in, Nodes in the decision tree The impurity of the Gini coefficient is For Node Belongs to the category The sample proportion of is the total number of categories, is the entropy weight coefficient, For Class At the node The frequency, For Node The total number of samples, is the frequency weight coefficient, For Class The standard deviation of is the weight coefficient of the standard deviation.

[0103] The execution flow is as follows:

[0104] Calculate the frequency of occurrence of each category and standard deviation , according to the sample proportion of each class and total number of categories Calculate the impurity of the Gini coefficient for each category, add the entropy calculation results and frequency to the Gini coefficient calculation, and dynamically adjust , and The value of can optimize the response of the classifier. Methods for confirming the coefficient value include using the cross-validation method to determine the optimized weights to maximize the classification accuracy. By integrating all category information and calculating the impurity of the node, it not only improves the accuracy of classification, but also makes the decision tree model more sensitive and adaptable to different types of data changes.

[0105] The priority sorting submodule uses the marked security events and AI algorithms to classify the security events into differentiated security levels according to the nature and potential impact of the security events, and analyzes the priority of the security events. The execution process of generating classified security events is as follows;

[0106] The prioritization submodule uses the marked security events to classify them through AI algorithms, and applies machine learning techniques such as support vector machines (SVM) or neural networks to conduct detailed analysis of each marked security event, and classify the events according to the nature of the event (such as data leakage, service denial attack, etc.) and potential impact (such as scope of impact, degree of damage, etc.). Each event is assigned a security level, which corresponds to different emergency handling priorities, and generates a detailed classified security event list. The formula is: ,in, For security incidents The classification results, From the event The feature set extracted from is the weight set of the classification model, is a classification function.

[0107] The security measures submodule designs and implements related security measures based on the classified security events, including blocking illegal access and restricting the campus IoT permissions of unauthorized devices, and the execution process of generating security response execution results is as follows;

[0108] The security measures submodule designs and implements related security measures based on the classified security events, and formulates targeted response strategies based on the classification and priority of each security event, including blocking illegal access, limiting the campus IoT permissions of unauthorized devices, or reconfiguring the security settings of affected devices. During the implementation process, the module will record all measures taken and the execution results to ensure that each security event is properly handled and generate security response execution results. The formula is: ,in, For events The results of the security response performed, A set of safety measures to be implemented, is the priority of the event, Executes a function for the response.

[0109] See also Figure 2 , 8 , the network optimization module includes:

[0110] The response measures submodule evaluates the effectiveness of the implemented security response measures based on the security response execution results, analyzes the speed and efficiency of the security response measures, and generates the response effect evaluation results. The execution process is as follows;

[0111] The response measures submodule evaluates the effectiveness of the implemented security response measures based on the security response execution results, focusing on analyzing the speed and efficiency of the implemented security measures, such as the response time to block illegal access and the execution quality of unauthorized device access restrictions. By collecting data on the processing of relevant security incidents, the module evaluates the effectiveness of each measure and identifies the shortcomings and advantages in the response process. It covers the full cycle evaluation from event identification to response completion, using statistical analysis and effect comparison methods to generate response effect evaluation results. The formula is: ,in, In response to the evaluation results of the measures, is the response time, For the effectiveness of the measures, is the evaluation function.

[0112] The policy adjustment submodule uses the response effect evaluation results to identify potential threat points in the security policy, adjust the security response mechanism and access control rules of the campus Internet of Things, match the real-time security response requirements, and generate the execution process of the security response requirement plan as follows;

[0113] The policy adjustment submodule uses the response effect evaluation results to identify potential threat points in the security policy. Based on the evaluation results, it analyzes the weaknesses and deficiencies of the existing security policy and adjusts the security response mechanism and access control rules of the campus IoT to better match the real-time security needs. The adjustment process includes updating firewall rules, adjusting access control lists, and optimizing security policies to enhance flexibility and response speed. Adjust the decision-making process based on data-driven to ensure that security measures can effectively respond to emerging threats and vulnerabilities and generate security response demand plans. The formula is: ,in, Adjust the results for the strategy, To evaluate the data, For the current strategy, Adjust the function for the policy.

[0114] The measures implementation submodule updates and implements new security measures according to the security response demand plan, including setting new network access rules, adjusting firewall settings and updating parameters of intrusion detection devices, and deploying them to the associated campus IoT and devices. The execution process of the generated optimized security measures is as follows;

[0115] The measures implementation submodule updates and implements new security measures according to the security response requirements plan, and is responsible for converting the results of policy adjustments into actual operations, including setting new network access rules, adjusting firewall settings, and updating the parameters of intrusion detection devices. By updating parameters, it ensures that all security measures meet the latest security requirements and deploys the updated measures to the associated campus IoT and devices. It includes technical implementation and subsequent monitoring to ensure the effectiveness of new measures and generate optimized security measures. The formula is: ,in, The results of the implementation of new measures, For new security settings, For the target device, Implement a function for the measure.

[0116] See also Fig. 9 , a campus security Internet of Things perception method based on AI algorithm, the campus security Internet of Things perception method based on AI algorithm is executed based on the above-mentioned campus security Internet of Things perception system based on AI algorithm, and includes the following steps:

[0117] S1: Collect campus IoT access logs, record device access time and traffic data, compare real-time traffic of multiple devices with historical data, analyze traffic peaks through AI algorithms, and generate abnormal access indicators;

[0118] S2: Based on abnormal access indicators, monitor the MAC address and IP address of the device, compare them with the characteristics of known unauthorized devices in the campus IoT database, evaluate the security of the device, allocate resources to legitimate devices, and generate threat identification results;

[0119] S3: Using the threat identification results, analyze the access rights of the threatened devices, adjust the permission settings according to the security rating, divide the network into different security levels for devices, isolate the risky devices, and generate security policy solutions;

[0120] S4: Implement security policy solutions, adjust security settings of network devices, including routers and switches, monitor implementation of access control policies, record deviations from security policies, and generate execution monitoring records;

[0121] S5: Based on the execution monitoring records, identify unauthorized access and abnormal behavior in the campus Internet of Things, classify security incidents, design and implement corresponding security measures, block illegal access, and generate optimized security measures.

[0122] The above are only preferred embodiments of the present invention and are not intended to limit the present invention in other forms. Any technician familiar with the profession may use the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes and apply them to other fields. However, any simple modification, equivalent change and modification made to the above embodiments based on the technical essence of the present invention without departing from the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A campus safety IoT perception system based on AI algorithm, characterized in that: The system comprises: The network behavior analysis module collects campus IoT access logs, identifies abnormal frequency access and abnormal traffic, uses AI algorithms to calculate IoT traffic peaks, and generates abnormal access indicators; The network behavior analysis module includes: The access log collection submodule collects campus IoT access logs, records the access time of campus IoT devices, filters access records with abnormal frequencies, and generates access frequency records by monitoring and collecting data from each access point; The traffic comparison submodule uses the data obtained from the access frequency record to analyze the campus IoT traffic, detect traffic anomalies of the campus IoT, and generate abnormal traffic analysis results by comparing the real-time traffic data of multiple devices with the historical average value; The peak calculation submodule analyzes the peaks and valleys in the abnormal traffic data according to the abnormal traffic analysis results, uses the AI ​​algorithm to perform statistical analysis and peak recognition on the traffic data, locates and tracks the time of traffic anomalies, and generates abnormal access indicators; The identity recognition module uses an AI algorithm based on the abnormal access indicators to identify the access of unauthorized devices on campus and potential security threats, performs identity authentication on the access devices, and generates threat identification results; The identity recognition module comprises: Based on the abnormal access indicators, the device monitoring submodule monitors the device access points of the campus network in real time, records the MAC addresses and IP addresses of the devices, uses AI algorithms to detect device access modes, evaluates the security of access devices, and generates device access records; The security threat analysis submodule compares the access device with known unauthorized device features and behavior patterns based on the device access record, and generates device access behavior analysis results by checking the device historical behavior and records in the campus security IoT database; The identity authentication submodule performs identity authentication on unauthorized devices of the campus IoT according to the device access behavior analysis results, including device certificate checking and access permission verification, allocates campus IoT resources to authorized devices, and generates threat identification results; The policy formulation module designs and implements campus device access rules and generates security policy solutions based on the threat identification results through access permission modification and network partitioning strategies; The strategy formulation module includes: The permission modification submodule analyzes the access rights of the threatened device based on the threat identification result, adjusts the permission settings according to the security rating of the device, and generates adjusted access rights by restricting the campus IoT access of the target; The network isolation submodule uses the adjusted access rights to divide network partitions for devices with different security levels, isolates the devices in differentiated campus IoT areas according to their security levels, isolates risky devices from key network areas, and generates a network partitioning strategy; The rule implementation submodule updates the device access rules of the campus IoT according to the network partitioning strategy, generates a security policy solution by deploying new security rules to network devices, including routers and switches, and executing configuration updates and rule deployment plans; The policy implementation monitoring module applies the security policy solution, automatically adjusts the campus IoT configuration, and implements access control, using monitoring policy execution, recording execution deviations, and generating execution monitoring records; The security incident processing module identifies and classifies security incidents in policy execution based on the execution monitoring records and through AI algorithms, implements corresponding security response measures, and generates security response execution results by blocking illegal access; The security incident processing module includes: The event identification submodule uses a decision tree algorithm based on the execution monitoring records to monitor and identify abnormal behaviors and unauthorized access events in the campus Internet of Things, and initializes the abnormal behaviors by analyzing the access patterns and frequencies of the execution monitoring records to generate marked security events; The formula of the decision tree algorithm is as follows: in, Nodes in the decision tree The impurity of the Gini coefficient is For Node Belongs to the category The sample proportion of is the total number of categories, is the entropy weight coefficient, For Class At the node The frequency, For Node The total number of samples, is the frequency weight coefficient, For Class The standard deviation of is the weight coefficient of standard deviation; The priority sorting submodule utilizes the marked security events to classify the security events through an AI algorithm, classifies the security events into differentiated security levels according to the nature and potential impact of the security events, analyzes the priorities of the security events, and generates classified security events; The security measures submodule designs and implements related security measures according to the classified security events, including blocking illegal access and restricting the campus IoT permissions of unauthorized devices, and generating security response execution results; The network optimization module evaluates the security response execution results, analyzes the effect of the security response execution and the handling of security incidents, and generates optimized security measures by designing adjustment strategies; The network optimization module includes: The response measures submodule evaluates the effect of the implemented security response measures based on the security response execution results, analyzes the speed and efficiency of the security response measures, and generates response effect evaluation results; The policy adjustment submodule uses the response effect evaluation results to identify potential threat points in the security policy, adjust the security response mechanism and access control rules of the campus Internet of Things, match the real-time security response requirements, and generate a security response requirement plan; The measures implementation submodule updates and implements new security measures according to the security response demand plan, including setting new network access rules, adjusting firewall settings and updating parameters of intrusion detection devices, deploying them to related campus IoT and devices, and generating optimized security measures.

2. According to the AI ​​algorithm-based campus safety IoT perception system of claim 1, it is characterized in that: The abnormal access indicators include access frequency, traffic anomalies and access time anomalies, the threat identification results include device ID, access status and security rating, the security policy scheme includes access control list, network isolation area and device authority level, the execution monitoring record includes policy execution log, configuration change record and access control violation, the security response execution result includes response action type, response time and impact assessment result, and the optimized security measures include policy adjustment plan, performance optimization measures and risk adjustment plan.

3. According to the AI ​​algorithm-based campus safety IoT perception system of claim 1, it is characterized in that: The strategy implementation monitoring module includes: The parameter adjustment submodule adjusts the network device parameters of the campus Internet of Things based on the security policy solution, including the security settings of routers and switches, updates the security parameters of network access points, and generates configuration adjustment records; The network access submodule uses the configuration adjustment record to implement the access control strategy, verify and restrict the network access of campus IoT devices and users, allocate key network resources to the devices that pass the verification, and generate the access control status; The execution deviation recording submodule monitors the implementation of the access control policy according to the access control status, records behaviors and events that deviate from the preset security policy, including access by unauthorized devices and rule violations, and generates execution monitoring records.

Images