Attack detection method and device for internet of things, storage medium and electronic equipment

Abstract

The application discloses an attack detection method and device for an Internet of Things, a storage medium and electronic equipment. It relates to the technical field of artificial intelligence. The method comprises the following steps: capturing a data packet in a first router to obtain a first data packet, wherein the first router comprises a router for data exchange between an Internet of Things subnetwork and an external network; analyzing the first data packet to obtain a first analysis result; inputting the first analysis result into a target detection model to output a detection result, wherein the detection result is used to indicate whether the first data packet has a network attack behavior on the Internet of Things subnetwork, and the target detection model comprises a model obtained by model training on a machine learning model by simulating a network environment of the Internet of Things subnetwork. The application solves the technical problem that, in the related art, due to poor training data quality, the detection result of detecting Internet of Things attacks by using a machine learning model to analyze traffic data is inaccurate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to an attack detection method and device for Internet of Things, a storage medium and an electronic device. BACKGROUND

[0002] The smart terminal of a financial institution belongs to a kind of Internet of Things equipment, which provides a variety of services to customers, including deposit, withdrawal, transfer, payment of bills, balance inquiry and so on, involving the safety of funds, so protecting the smart terminal is an important task. With the continuous upgrading of Internet of Things attacks, traditional security technologies have been unable to meet the needs of protecting the smart terminal. Therefore, researchers have begun to explore the use of machine learning technology to detect and defend against Internet of Things attacks. Industrial Internet Industrial scenarios often use traffic analysis and anomaly detection strategies to detect attacks through semi-supervised learning, reinforcement learning, distributed learning, and deep learning models.

[0003] However, the performance of machine learning models depends largely on the quality and quantity of training data, and the quality of training data in related technologies is poor, for example, the training data is insufficient or not diverse enough, which may prevent the model from capturing all possible attack patterns; if attackers can inject malicious data into training data, the machine learning model may misreport normal behavior as attack behavior, or misjudge attack as normal behavior; Internet of Things devices usually collect and store a large amount of user data, including sensitive physiological data, which may pose a threat to user privacy if used to train machine learning models; collecting and processing data generated by Internet of Things devices may cause device delays or blockages, affecting device performance and user experience.

[0004] To address the above problems, no effective solutions have been proposed so far. SUMMARY

[0005] The embodiments of the present application provide an attack detection method and device for Internet of Things, a storage medium and an electronic device to at least solve the technical problem that the detection result of detecting Internet of Things attacks by analyzing traffic data using a machine learning model is inaccurate due to poor quality of training data in related technologies.

[0006] According to an aspect of some embodiments of the present application, a method for attack detection for an Internet of Things is provided, comprising: capturing a packet in a first router to obtain a first packet, wherein the first router comprises a router for data exchange between an Internet of Things subnetwork and an external network, and the Internet of Things subnetwork comprises S Internet of Things devices connected by a network, S being an integer greater than 1; analyzing the first packet to obtain a first analysis result; inputting the first analysis result into a target detection model to output a detection result, wherein the detection result is used to indicate whether the first packet has a network attack behavior on the Internet of Things subnetwork, and the target detection model comprises a model obtained by model training of a machine learning model by simulating a network environment of the Internet of Things subnetwork.

[0007] Further, the target detection model is obtained by: building a target network simulating the network environment of the Internet of Things subnetwork, wherein the target network exchanges data with an external network through a second router; initiating a network attack on the target network by N network devices, and capturing all packets related to the network attack in the second router to obtain a packet set, wherein the N network devices are deployed outside the target network, and the packet set comprises M second packets, N being a positive integer and M being an integer greater than N; analyzing each second packet to obtain M second analysis results, and determining a target training sample based on the M second analysis results; and model training of the machine learning model based on the target training sample to obtain the target detection model.

[0008] Further, determining a target training sample based on the M second analysis results comprises: adding an attack identifier to each second analysis result, and forming a first training sample from the M second analysis results and the attack identifier of each second analysis result, wherein the attack identifier is used to represent that the second packet associated with the second analysis result is a packet with a network attack behavior; obtaining a second training sample, wherein the second training sample at least comprises an analysis result of a packet without a network attack behavior; and determining the target training sample based on the first training sample and the second training sample.

[0009] Further, after inputting the first analysis result into the target detection model to output the detection result, the method further comprises: storing the first analysis result and the detection result to a designated storage space; and retraining the target detection model based on the analysis result and the detection result stored in the designated storage space to obtain an updated target detection model.

[0010] Further, the target detection model comprises at least one of an encoder, a decoder, and a target algorithm, the target algorithm comprising a random forest algorithm, the first analysis result is input into the target detection model, and a detection result is output, comprising: inputting the first analysis result into the encoder, converting the data format of the first analysis result through the encoder to obtain a converted first analysis result; based on the converted first analysis result, determining the detection result by using the target algorithm, and outputting the detection result through the decoder.

[0011] Further, the manner of converting the data format of the first analysis result comprises at least one of: converting a numerical type string into an original numerical value, adjusting a numerical type string with a sign into a specified format and then converting it into a numerical value, converting data representing a physical address into data of a specified base and then converting it into a numerical value, and converting pure character type data into a vector using a preset data dictionary.

[0012] Further, the first data packet is parsed to obtain a first analysis result, comprising: determining the type of network protocol used by the first data packet to obtain a target protocol type, wherein the target protocol type comprises at least one of: a transmission control protocol, an application data packet protocol, and an application layer protocol; based on the target protocol type, the header of the first data packet and the data part of the first data packet are parsed respectively to obtain the first analysis result, wherein the first analysis result comprises at least one of: a source address, a destination address, and a port.

[0013] Further, after inputting the first analysis result into the target detection model and outputting the detection result, further comprising: in the case that the detection result indicates that the first data packet does not have network attack behavior on the Internet of Things subnetwork, forwarding the first data packet to the inside of the Internet of Things subnetwork; in the case that the detection result indicates that the first data packet has network attack behavior on the Internet of Things subnetwork, intercepting the first data packet.

[0014] According to another aspect of the embodiments of the present application, an attack detection apparatus for an Internet of Things is also provided, comprising: a grabbing unit configured to grab a packet in a first router to obtain a first packet, wherein the first router comprises a router for data exchange between an Internet of Things subnetwork and an external network, and the Internet of Things subnetwork comprises S Internet of Things devices connected by a network, S being an integer greater than 1; an analyzing unit configured to analyze the first packet to obtain a first analysis result; and a processing unit configured to input the first analysis result into a target detection model to output a detection result, wherein the detection result is used to indicate whether the first packet has a network attack behavior on the Internet of Things subnetwork, and the target detection model comprises a model obtained by model training of a machine learning model by simulating a network environment of the Internet of Things subnetwork.

[0015] Further, the target detection model is obtained by the following sub-units: an environment building sub-unit configured to build a target network simulating a network environment of the Internet of Things subnetwork, wherein the target network exchanges data with an external network through the first router; a first processing sub-unit configured to initiate a network attack on the target network by N network devices and grab all packets related to the network attack in the first router to obtain a packet set, wherein the N network devices are deployed outside the target network, and the packet set comprises M second packets, N being a positive integer and M being an integer greater than N; a second processing sub-unit configured to analyze each second packet to obtain M second analysis results and determine a target training sample based on the M second analysis results; and a training sub-unit configured to train the machine learning model based on the target training sample to obtain the target detection model.

[0016] Further, the second processing sub-unit comprises: a processing module configured to add an attack identifier to each second analysis result, and to form a first training sample from the M second analysis results and the attack identifier of each second analysis result, wherein the attack identifier is used to represent that the second packet associated with the second analysis result is a packet with a network attack behavior; an obtaining module configured to obtain a second training sample, wherein the second training sample at least comprises an analysis result of a packet without a network attack behavior; and a determining module configured to determine the target training sample based on the first training sample and the second training sample.

[0017] Further, the attack detection apparatus for the Internet of Things further comprises: a storage unit, configured to store the first analysis result and the detection result to a specified storage space after inputting the first analysis result into the target detection model and outputting the detection result; and a training unit, configured to retrain the target detection model based on the analysis result and the detection result stored in the specified storage space, to obtain the updated target detection model.

[0018] Further, the target detection model comprises at least one of an encoder, a decoder and a target algorithm, the target algorithm comprising a random forest algorithm, and the processing unit comprises: a conversion subunit, configured to input the first analysis result into the encoder, convert the data format of the first analysis result by the encoder, and obtain the converted first analysis result; and a first determination subunit, configured to determine the detection result based on the converted first analysis result by using the target algorithm, and output the detection result by the decoder.

[0019] Further, the conversion of the data format of the first analysis result comprises at least one of: converting a numerical type string into an original numerical value, converting a numerical type string with a symbol into a specified format and then into a numerical value, converting data representing a physical address into data in a specified base and then into a numerical value, and converting pure character type data into a vector by using a preset data dictionary.

[0020] Further, the analysis unit comprises: a second determination subunit, configured to determine a target protocol type of a network protocol used by the first data packet, the target protocol type comprising at least one of a transmission control protocol, an application data packet protocol and an application layer protocol; and an analysis subunit, configured to analyze the header of the first data packet and the data part of the first data packet based on the target protocol type, to obtain the first analysis result, the first analysis result comprising at least one of a source address, a destination address and a port.

[0021] Further, the attack detection apparatus for the Internet of Things further comprises: a forwarding unit, configured to forward the first data packet to the inside of the Internet of Things subnetwork in a case where the detection result indicates that the first data packet does not have a network attack behavior on the Internet of Things subnetwork after inputting the first analysis result into the target detection model and outputting the detection result; and an intercepting unit, configured to intercept the first data packet in a case where the detection result indicates that the first data packet has a network attack behavior on the Internet of Things subnetwork.

[0022] According to another aspect of the embodiments of the present application, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the attack detection method for the Internet of Things according to any one of the above embodiments by executing the executable instructions.

[0023] According to another aspect of the embodiments of the present application, a computer readable storage medium storing a computer program is also provided, wherein the computer program controls the device where the computer readable storage medium is located to execute the attack detection method for the Internet of Things according to any one of the above embodiments when the computer program is running.

[0024] In the present application, the data packet in the first router is captured to obtain a first data packet, wherein the first router comprises a router for data exchange between an Internet of Things (IoT) subnet and an external network, and the IoT subnet comprises S IoT devices connected by a network, and S is an integer greater than 1; the first data packet is parsed to obtain a first parsing result; and the first parsing result is input into a target detection model to output a detection result, wherein the detection result is used to indicate whether the first data packet has a network attack behavior on the IoT subnet, and the target detection model comprises a model obtained by model training of a machine learning model by simulating a network environment of the IoT subnet. Thus, the technical problem that the detection result of the machine learning model for detecting the IoT attack is inaccurate due to poor quality of the training data is solved.

[0025] In the present application, the target detection model obtained by model training of the machine learning model by simulating the network environment of the IoT subnet is used to detect the parsing result of the data packet to determine whether the data packet has a network attack behavior on the IoT subnet. Thus, the situation that the model detection result of the IoT attack behavior is inaccurate due to poor quality of the model training data is avoided, and the technical effect of improving the accuracy of the detection result of the detection model for detecting the IoT attack behavior is achieved. BRIEF DESCRIPTION OF DRAWINGS

[0026] The accompanying drawings, which are included to provide a further understanding of the application and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the application. In the drawings:

[0027] Figure 1 is a flowchart of an optional attack detection method for the Internet of Things according to an embodiment of the present application;

[0028] Figure 2 is a schematic diagram of an optional target detection model according to an embodiment of the present application;

[0029] Figure 3is a field table after data packet analysis according to an embodiment of the application;

[0030] Figure 4 is a schematic diagram of an attack detection system for the Internet of Things according to an embodiment of the application;

[0031] Figure 5 is a flow chart of another optional attack detection method for the Internet of Things according to an embodiment of the application;

[0032] Figure 6 is a flow chart of model training according to an embodiment of the application;

[0033] Figure 7 is a schematic diagram of an attack detection apparatus for the Internet of Things according to an embodiment of the application;

[0034] Figure 8 is a schematic diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0035] In order to make the personnel in the art better understand the application scheme, the technical solutions in the embodiments of the application will be described clearly and completely below in conjunction with the drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor should belong to the scope of protection of the application.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the application and the above-mentioned drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence. It should be understood that the data used in this way can be exchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily limit to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.), collected information and data (including but not limited to data for analysis, stored data, displayed data, data packets, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards in relevant regions, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal.

[0038] For the convenience of description, some terms or names related to the embodiments of the present application are explained below.

[0039] Machine learning: a subfield of artificial intelligence (AI) that enables computer systems to learn through experience without explicit programming. In machine learning, algorithms automatically identify patterns in data and then use these patterns to make predictions or decisions. Machine learning has a wide range of applications, including image recognition, speech recognition, natural language processing, recommendation systems, medical diagnosis, financial forecasting, etc.

[0040] Internet of Things: covers a wide range of physical devices and objects connected through networks. These devices and objects can be anything from home appliances to industrial equipment, environmental sensors, etc. Internet of Things devices collect and share data to provide information about the environment, devices and users. The Internet of Things has a wide range of applications, including smart homes, smart cities, smart healthcare, smart transportation, etc.

[0041] Internet of Things attacks: malicious activities targeting Internet of Things systems, including attacks on devices, networks or data. Due to the widespread and popular nature of Internet of Things devices, Internet of Things attacks can have a serious impact on user privacy, device security and network stability. Forms of Internet of Things attacks include malware attacks, vulnerability exploitation, phishing, physical attacks, etc. The goal of Internet of Things attacks is usually the data collected and shared, including user personal information, device status and behavior data, etc.

[0042] Smart terminal: in the present application, it refers to the smart terminal of a bank branch, which is an innovative technical device integrating various financial institution services. These devices are usually located in the business outlets of financial institutions, and customers can perform a series of bank transactions at the business outlets, such as depositing, withdrawing, transferring, paying bills, checking balances, printing documents, etc.

[0043] Embodiment one

[0044] According to an embodiment of the present application, an optional attack detection method for the Internet of Things is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order.

[0045] Figure 1 is a flowchart of an optional attack detection method for the Internet of Things according to an embodiment of the present application, as shown in Figure 1 , the method comprises the following steps:

[0046] Step S101, capturing a data packet in a first router to obtain a first data packet, wherein the first router comprises a router for data exchange between an Internet of Things (IoT) subnetwork and an external network, and the IoT subnetwork comprises S IoT devices connected by a network, S being an integer greater than 1.

[0047] The IoT subnetwork described above can be an industrial IoT subnetwork, and the external traffic can access the IoT subnetwork through the first router. The data packets in the first router can be captured by a designated server to obtain the first data packet, i.e., the first data can include the data packets of the external traffic captured in the first router when the external traffic accesses the IoT subnetwork.

[0048] Step S102, parsing the first data packet to obtain a first parsing result.

[0049] In this embodiment, the data packet can be parsed to parse the data of each field in the data packet to obtain the first parsing result.

[0050] Step S103, inputting the first parsing result into a target detection model to output a detection result, wherein the detection result is used to indicate whether the first data packet has a network attack behavior on the IoT subnetwork, and the target detection model comprises a model obtained by model training of a machine learning model by simulating a network environment of the IoT subnetwork.

[0051] The target detection model described above comprises a model obtained by model training of a machine learning model using training data, wherein the training data is obtained by capturing, parsing and adding an attack identifier representing a network attack behavior to data packets generated during a simulation attack process of the network environment simulated by a plurality of network devices, and then mixing the data packets with normal data.

[0052] The network attack behavior described above can include an IoT attack. In this embodiment, the first parsing result can be input into the target detection model to determine whether the first data packet has a network attack behavior by the target detection model, and the detection result is output.

[0053] Through the above steps, in this embodiment, the target detection model obtained by model training of the machine learning model on the network environment simulating the Internet of Things subnetwork is used to detect the analysis result of the data packet to determine whether the data packet has network attack behavior on the Internet of Things subnetwork. The technical effect of improving the accuracy of the detection result of the detection model in detecting the Internet of Things attack behavior is achieved, avoiding the case that the model training data quality is poor in the related art, resulting in inaccurate detection result of the model in detecting the Internet of Things attack behavior. Further, the technical problem that the detection result of the detection model in detecting the Internet of Things attack is inaccurate due to poor training data quality in the related art is solved.

[0054] Optionally, the target detection model is obtained by: building a network environment simulating an Internet of Things subnetwork to obtain a target network, wherein the target network exchanges data with the outside of the target network through a second router; launching a network attack on the target network through N network devices, and capturing all data packets related to the network attack in the second router to obtain a data packet set, wherein the N network devices are deployed outside the target network, the data packet set includes M second data packets, N is a positive integer, and M is an integer greater than N; analyzing each second data packet to obtain M second analysis results, and determining a target training sample based on the M second analysis results; and model training of a machine learning model based on the target training sample to obtain the target detection model.

[0055] In this embodiment, a plurality of microcomputers (for example, microcomputers only the size of a credit card) can be used to build an Internet of Things environment simulating the above-mentioned Internet of Things subnetwork, that is, to build a network environment simulating the Internet of Things subnetwork, and at the same time, a unified router (i.e., a second router) can be used to exchange data externally as a target network. A machine can also be accessed by bypassing the router, and a data packet capturing script and an analysis script can be deployed, wherein the data packet capturing script can be used to capture data packets in the second router, and the analysis script can be used to analyze the data packets.

[0056] Since the sample size of abnormal data is much smaller than that of normal data in general, a simulation attack data script can be used to send attack data to the target network through N network devices (e.g., personal computers and cloud servers), and the attack types of the attack data can include but are not limited to: Dos attack (i.e., denial of service attack), probe attack, U2R (unauthorized access from remote) attack and R2L (illegal superuser access) attack, etc., and the data packets in the second router are captured to obtain the second data packets, and the second data packets are parsed to obtain the parsing results corresponding to the second data packets (i.e., second parsing results). Then, based on the M second parsing results and normal data, the target training sample can be determined, and then the specified machine learning model can be trained through the target training sample to obtain the target detection model.

[0057] After obtaining the target detection model, the model can also be iterated continuously during the running of the model and the system using the collected attack data, which realizes the technical effect of improving the accuracy of the model detection result of the target detection model.

[0058] Optionally, based on the M second parsing results, the target training sample is determined, including: adding an attack identifier to each second parsing result, and the M second parsing results and the attack identifier of each second parsing result form a first training sample, and the attack identifier is used to represent that the second data packet associated with the second parsing result is a data packet with network attack behavior; obtaining a second training sample, wherein the second training sample at least includes: the parsing result of the data packet without network attack behavior; based on the first training sample and the second training sample, the target training sample is determined.

[0059] The second training sample at least includes the parsing result of the data packet without network attack behavior and the identifier representing normal data. In this embodiment, an identifier can be added to each second parsing result, and a flag of "attack data" (corresponding to attack representation) is added, and is mixed with normal data (corresponding to the second training sample) as the target training sample, which realizes the technical effect of improving the data quality of the training sample.

[0060] Optionally, after the first parsing result is input into the target detection model and the detection result is output, it further includes: storing the first parsing result and the detection result to a specified storage space; based on the parsing result and the detection result stored in the specified storage space, the target detection model is retrained to obtain an updated target detection model.

[0061] After the detection result, the first data packet can be labeled, that is, the first data packet is added with an identifier, for example, if the detection result indicates that the first data packet has network attack behavior to the Internet of Things subnetwork, the first data packet can be added with an identifier indicating "attack data", if the detection result indicates that the first data packet has network attack behavior to the Internet of Things subnetwork, the first data packet can be added with an identifier indicating "normal data" or no identifier, and the first analysis result and the identifier of the data packet can be sent to a specified storage space (for example, a server) for subsequent optimization training of the target detection model.

[0062] When the target detection model is optimized and trained, the training samples for optimizing and training the target detection model can be determined based on the analysis results and detection results stored in the specified storage space, for example, after a new attack means appears, or after a specified time, the attack data related to the attack means can be obtained, the attack data and the analysis results and detection results in the specified storage space are combined to form new training data, the target detection model is retrained to obtain an updated target detection model, so as to optimize the target detection model, and the purpose of continuously updating the target detection model is achieved, which ensures that the target detection model can accurately detect various attack means.

[0063] Optionally, the target detection model comprises at least one of an encoder, a decoder and a target algorithm, the target algorithm comprising a random forest algorithm, the first analysis result is input into the target detection model to output the detection result, comprising: inputting the first analysis result into the encoder, converting the data format of the first analysis result through the encoder to obtain the converted first analysis result; based on the converted first analysis result, the target algorithm is used to determine the detection result, and the detection result is output through the decoder.

[0064] Figure 2 is a schematic diagram of an optional target detection model according to an embodiment of the application, as shown in Figure 2 two pre-encoders, a decoder and a random forest model (corresponding to a random forest algorithm) are included, wherein the encoder can be used to convert the input data into a data format that can be understood by the random forest model. The decoder can be used to convert the output result of the random forest algorithm into the final judgment result, and the identifier of the data packet is attached. The random forest can be used to calculate the detection result, and the training result of the random forest can be controlled by controlling parameters such as the number of decision trees, the number of features and the maximum depth of the decision tree.

[0065] In the embodiment, the first analysis result can be input into an encoder, the data format of the first analysis result is converted by the encoder, converted into a data format that can be understood by the target algorithm, and a converted first analysis result is obtained. Then, based on the converted first analysis result, the target algorithm is used to determine a detection result, and the detection result is output through a decoder, so as to accurately detect whether the data flowing into the Internet of Things subnetwork is attack data.

[0066] Optionally, the conversion of the data format of the first analysis result includes at least one of the following: converting a numerical type string into an original numerical value, converting a numerical type string with a symbol into a numerical value after adjusting the numerical type string with a symbol into a specified format, converting data representing a physical address into data in a specified base and then converting the data into a numerical value, and converting pure character type data into a vector using a preset data dictionary.

[0067] Since the data in the first analysis result is mostly in a string format, the data can be converted into a vector format, and a numerical type string can be directly converted into an original numerical value. For a numerical type string with a symbol, the symbol in the numerical value can be removed, for example, the string "ip address 127.0.0.1" and the like, the "." can be deleted and expanded into a standard format and then converted into a numerical value. For a MAC address (i.e., a physical address), the 16-bit hexadecimal can be converted into a specified base (for example, 10) and then converted into a numerical value. For pure character data, a fixed data dictionary can be set for the data, and the data can be converted into a numerical vector according to the data dictionary. For data without a data dictionary, the data can not be processed, and can not need to participate in detection of the target detection model. By converting the data format of the first analysis result, the recognition efficiency of the target detection model and the accuracy of the recognition result can be improved.

[0068] Optionally, the first data packet is parsed to obtain the first analysis result, including: determining a type of a network protocol used by the first data packet to obtain a target protocol type, wherein the target protocol type includes at least one of the following: a transmission control protocol, an application data packet protocol, and an application layer protocol; based on the target protocol type, the header of the first data packet and the data part of the first data packet are parsed respectively to obtain the first analysis result, wherein the first analysis result includes at least one of the following: a source address, a destination address, and a port.

[0069] In order to improve the accuracy of the detection result of the target detection model, in the embodiment, the first data packet can be parsed, for example: the header of TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) can be parsed first, the ip address, port, various protocol information, etc. are separated, then the MAC address (i.e. physical address) is separated, finally if there is an application layer protocol, the application layer protocol can be parsed, and the application layer protocol that cannot be parsed can be regarded as garbage data.

[0070] The source address can include a source MAC and a source IP address, the destination address can include a destination MAC address and a destination IP address, and the port can include a source port and a destination port.

[0071] Figure 3 is a schematic diagram of a field table after data packet parsing according to an embodiment of the application, as shown in Figure 3 The field name, i.e. the Chinese meaning, is included, for example: source_ip (source ip), source_mac (original mac address (source MAC address)), target_ip (destination ip), target_mac (destination mac address), source_port (source port), starget_port (destination port), arp_opcode (arp protocol operation code), DLL_type (data link layer protocol type), IP_type (IP layer protocol type), TL_type (transport layer protocol type), AL_type (application layer protocol type), duration (data packet duration), login (whether logged in), icmp_type (icmp protocol type), icmp_code (icmp protocol operation code), root (whether root is logged in), server_count (number of data packets of the same service), number (identification of associated data packets), and flag (state identification in tcp service), etc. It should be noted that the content of the field in the first parsing result can be included. Figure 3

[0072] ​In an optional example, during the parsing of the first data packet, the destination MAC address and the source MAC address are hexadecimal data, which can be converted into a decimal numerical string; the source IP address and the destination IP address can be expanded into a standard format and then the "." is removed, and then spliced into a 12-bit number; in addition, some fields such as the icmp_type and icmp_code fields are unique fields of the ICMP (Internet Control Message Protocol) protocol, and different protocols have different unique fields, and the unique fields of the data packet protocol are uniformly defaulted to a preset character, for example, the unique fields of the data packet protocol are uniformly defaulted to -1; for some cases, the user will try to remotely send commands, which involves whether to log in and whether to issue sensitive commands, so we use a series of related fields to count whether the super user (root) accesses and whether a sensitive command is issued. Here, the sensitive command has different commands for different Internet of Things terminals, so the parsing script can make a judgment on the specific command. Some data packets have relevance, such as the three-way handshake of the TCP protocol, so we will count the associated data packets in the past little time. The associated data packets can refer to the data packets with the same source IP, source MAC address, and source port.

[0073] Optionally, after inputting the first parsing result into the target detection model and outputting the detection result, it further includes: in the case that the detection result indicates that the first data packet does not have a network attack behavior on the Internet of Things subnetwork, forwarding the first data packet to the inside of the Internet of Things subnetwork; in the case that the detection result indicates that the first data packet has a network attack behavior on the Internet of Things subnetwork, intercepting the first data packet.

[0074] In order to improve the security of the Internet of Things subnetwork, in the case that the detection result indicates that the first data packet does not have a network attack behavior on the Internet of Things subnetwork, the first router can be allowed to forward the first data packet to the inside of the Internet of Things subnetwork, and in the case that the detection result indicates that the first data packet has a network attack behavior on the Internet of Things subnetwork, the first data packet can be intercepted.

[0075] An optional attack detection system for the Internet of Things can be used to execute the attack detection method for the Internet of Things provided in the present embodiment. Figure 4 is a schematic diagram of an optional attack detection system for the Internet of Things according to an embodiment of the present application, as Figure 4 shown, including: an Internet of Things local area network (corresponding to the above-mentioned Internet of Things subnetwork), a router (corresponding to the first router), a model server, and a storage server.

[0076] When the network of the intelligent terminal (i.e., the Internet of Things subnetwork) is attacked from outside, a bypass server can be accessed in the router (such as Figure 4The model server in the step S403) performs analysis filtering on the router traffic (for example, the first data packet in the router).

[0077] The Internet of Things subnetwork can exchange data with the outside world (that is, the Internet) through several fixed routers. The edge router (corresponding to the first router) refers to the unified entrance and exit of data between the Internet of Things subnetwork and the outside world, and the bypass server can refer to a server loaded with a target detection model and a data analysis script, which can analyze and judge, classify the data packet of the router, and the bypass server can be provided with a storage server for storing all the labeled data packets passing through the router for subsequent model optimization of the target detection model.

[0078] In the embodiment, attacks on the Internet of Things can be effectively filtered without additional access to the Internet of Things, and the scheme can be iteratively updated during use without fear of the gradual update of attack means. Because the attacker will further study and crack after the attack is intercepted, the target detection model can be further strengthened after being attacked by the attack data. For various attack means, scripts and models, the characteristic values of the multiple fields in the analysis result are guaranteed to represent different attack means and identify them. Finally, the embodiment can also be applicable to network attacks in ordinary environments outside the Internet of Things subnetwork, and only needs to convert the analysis of the private protocol into the analysis of the public protocol.

[0079] Embodiment Two

[0080] The embodiment two of the application provides another alternative attack detection method for the Internet of Things. Figure 5 The flowchart of the alternative attack detection method for the Internet of Things according to the embodiment of the application is shown in Figure 5 The external data enters, the traffic is captured, the data packet is analyzed, the model is judged, the data is stored, in the case of attack data, the data packet is discarded, and in the case of non-attack data, the data packet is released.

[0081] Specifically, in step S501, external traffic enters the industrial Internet of Things subnetwork (corresponding to the Internet of Things subnetwork in the embodiment one) through a unified router (corresponding to the first router in the embodiment one).

[0082] In step S502, the bypass server captures the traffic in the router.

[0083] Step S503: The server parses the captured data packet (corresponding to the first data packet). First, the TCP or UDP header is parsed, and the IP address, port, various protocol information, etc. are separated, and then the MAC address is separated, and finally if there is an application layer protocol, the application layer protocol is parsed, and the application layer protocol that cannot be parsed is regarded as garbage data.

[0084] Step S504: After parsing, the parsing result is sent into the trained machine learning model (corresponding to the target detection model in Embodiment I). The machine learning model parses the data and returns the judgment result (corresponding to the detection result in Embodiment I);

[0085] Step S505: After parsing the result, the result and the corresponding data packet identifier are sent into the router, and the data is marked and sent into the storage server for subsequent optimization training of the model.

[0086] Step S506: The data packet judged as normal data is passed, and the data packet judged as attack data is intercepted.

[0087] The trained machine learning model can include two pre-encoders, a decoder, and a random forest algorithm. The encoder can convert the input data into a data format understandable by the random forest. The input data is mostly in string format, which needs to be converted to vector format. The numerical type string is directly converted to the original numerical value. For numerical value strings with symbols, such as IP address 127.0.0.1, the “.” is deleted and expanded to the standard format before being converted to a numerical value. For mac addresses, the hexadecimal is converted to decimal and then to numerical value. For pure character data, the data usually has a fixed data dictionary, which can be converted to a numerical vector according to the data dictionary. For data without a data dictionary, we do not process it and do not put it into the model. The decoder can be used to convert the output result of the random forest into the final judgment result and attach the identifier of the data packet. The random forest algorithm can control the training result of the random forest by controlling the number of decision trees, the number of features, and the maximum depth of the decision tree.

[0088] Figure 6 is an optional model training flowchart according to an embodiment of the application, as shown in Figure 6 including: building an environment, deploying a server, simulating an attack, data processing, model training, data collection and model deployment.

[0089] Specifically, step S601: use multiple microcomputers to build a simulated Internet of Things environment, and exchange data with an external router as a target network.

[0090] Step S602: the router bypasses access to a machine, deploys a data packet capture script and a parsing script;

[0091] Step S603: since the sample size of abnormal data is much smaller than that of normal data in general cases, the simulated attack data script is used to send attack data to the target Internet of Things through multiple personal computers and cloud servers, and the attack types include Dos attack, probe attack, U2R attack and R2L attack;

[0092] Step S604: the parsed data in the bypass server is extracted, and a "attack data" flag is added, and is mixed into normal data as training data into the model;

[0093] Step S605: model training, the machine learning model is trained;

[0094] Step S606: during the model and system running process, the collected attack data is used to continuously iterate the model regularly;

[0095] Step S607: model deployment.

[0096] In the embodiment, the attacks on the Internet of Things can be effectively filtered without additional access to the Internet of Things, and the scheme can be iteratively updated during use, without fear of the increasing update of attack means, because the attacker will further study and crack after the attack is intercepted, and when attacked, the target detection model can be further strengthened through the attack data. For various attack means, scripts and models, according to the multiple fields in the parsing result, the characteristic values can be ensured to represent different attack means and be identified.

[0097] Embodiment three

[0098] The embodiment three of the application provides an optional attack detection device for the Internet of Things, and each implementation unit in the attack detection device corresponds to each implementation step in the embodiment one.

[0099] Figure 7 It is a schematic diagram of an optional attack detection device for the Internet of Things according to the embodiment of the application, as shown in Figure 7 The attack detection device for the Internet of Things includes a capture unit 71, a parsing unit 72 and a processing unit 73.

[0100] The capture unit 71 is used to capture the data packet in the first router to obtain the first data packet, wherein the first router includes a router for data exchange between the Internet of Things subnetwork and the external network, and the Internet of Things subnetwork includes S Internet of Things devices connected by a network, and S is an integer greater than 1.

[0101] The analysis unit 72 is configured to analyze the first data packet to obtain a first analysis result.

[0102] The processing unit 73 is configured to input the first analysis result into a target detection model to output a detection result, wherein the detection result is used to indicate whether the first data packet has network attack behavior on the Internet of Things subnetwork, and the target detection model comprises a model obtained by model training on a machine learning model by simulating a network environment of the Internet of Things subnetwork.

[0103] In the attack detection device for the Internet of Things provided in the third embodiment of the present application, the data packet in the first router can be obtained by the grabbing unit 71, wherein the first router comprises a router for data exchange between the Internet of Things subnetwork and an external network, and the Internet of Things subnetwork comprises S Internet of Things devices connected by a network, and S is an integer greater than 1. The first analysis result is obtained by analyzing the first data packet by the analysis unit 72. The detection result is output by inputting the first analysis result into the target detection model by the processing unit 73, wherein the detection result is used to indicate whether the first data packet has network attack behavior on the Internet of Things subnetwork, and the target detection model comprises a model obtained by model training on a machine learning model by simulating a network environment of the Internet of Things subnetwork. Thus, the technical problem that the detection result of detecting the Internet of Things attack by using the machine learning model to analyze the traffic data is inaccurate due to poor quality of the training data in the related art is solved.

[0104] In the present embodiment, the target detection model obtained by model training on a machine learning model by simulating a network environment of the Internet of Things subnetwork is used to detect the analysis result of the data packet to determine whether the data packet has network attack behavior on the Internet of Things subnetwork. Thus, the situation that the detection result of detecting the Internet of Things attack by the model is inaccurate due to poor quality of the model training data in the related art is avoided, thereby achieving the technical effect of improving the accuracy of the detection result of detecting the Internet of Things attack behavior by the detection model.

[0105] Optionally, in the attack detection device for the Internet of Things provided in Embodiment Three of the present application, the target detection model is obtained through the following sub-units: an environment building sub-unit, configured to build a network environment simulating a sub-network of the Internet of Things to obtain a target network, wherein the target network exchanges data with the outside of the target network through a first router; a first processing sub-unit, configured to initiate a network attack on the target network through N network devices deployed outside the target network and capture all data packets related to the network attack in the first router to obtain a data packet set, wherein the data packet set includes M second data packets, N is a positive integer, and M is an integer greater than N; a second processing sub-unit, configured to analyze each second data packet to obtain M second analysis results and determine a target training sample based on the M second analysis results; and a training sub-unit, configured to perform model training on a machine learning model based on the target training sample to obtain the target detection model.

[0106] Optionally, in the attack detection device for the Internet of Things provided in Embodiment Three of the present application, the second processing sub-unit includes: a processing module, configured to add an attack identifier to each second analysis result and form a first training sample from the M second analysis results and the attack identifier of each second analysis result, wherein the attack identifier is used to represent that the second data packet associated with the second analysis result is a data packet with network attack behavior; an acquisition module, configured to acquire a second training sample, wherein the second training sample at least includes an analysis result of a data packet without network attack behavior; and a determination module, configured to determine the target training sample based on the first training sample and the second training sample.

[0107] Optionally, in the attack detection device for the Internet of Things provided in Embodiment Three of the present application, the attack detection device for the Internet of Things further includes: a storage unit, configured to store the first analysis result and the detection result to a designated storage space after the first analysis result is input into the target detection model and the detection result is output; and a training unit, configured to retrain the target detection model based on the analysis result and the detection result stored in the designated storage space to obtain an updated target detection model.

[0108] Optionally, in the attack detection device for the Internet of Things provided in Embodiment Three of the present application, the target detection model includes at least one of the following: an encoder, a decoder and a target algorithm, and the target algorithm includes a random forest algorithm, and the processing unit includes: a conversion sub-unit, configured to input the first analysis result into the encoder to convert the data format of the first analysis result through the encoder to obtain a converted first analysis result; and a first determination sub-unit, configured to determine the detection result based on the converted first analysis result by using the target algorithm and output the detection result through the decoder.

[0109] Optionally, in the attack detection apparatus for the Internet of Things provided in Embodiment Three of the present application, the manner of converting the data format of the first analysis result comprises at least one of the following: converting a numerical type string into an original numerical value, converting a numerical type string with a symbol into a numerical value in a specified format, converting data representing a physical address into data in a specified base and then into a numerical value, and converting pure character type data into a vector using a preset data dictionary.

[0110] Optionally, in the attack detection apparatus for the Internet of Things provided in Embodiment Three of the present application, the analysis unit comprises: a second determination subunit configured to determine the type of network protocol used by the first data packet to obtain a target protocol type, wherein the target protocol type comprises at least one of the following: a transmission control protocol, an application data packet protocol, and an application layer protocol; and an analysis subunit configured to analyze the header of the first data packet and the data part of the first data packet based on the target protocol type to obtain the first analysis result, wherein the first analysis result comprises at least one of the following: a source address, a destination address, and a port.

[0111] Optionally, in the attack detection apparatus for the Internet of Things provided in Embodiment Three of the present application, the attack detection apparatus for the Internet of Things further comprises: a forwarding unit configured to, after the first analysis result is input into the target detection model and a detection result is output, forward the first data packet to the inside of the Internet of Things subnetwork in a case where the detection result indicates that the first data packet does not have a network attack behavior on the Internet of Things subnetwork; and an interception unit configured to intercept the first data packet in a case where the detection result indicates that the first data packet has a network attack behavior on the Internet of Things subnetwork.

[0112] The attack detection apparatus for the Internet of Things described above can further comprise a processor and a memory, and the above-described grabbing unit 71, analysis unit 72, and processing unit 73 are all stored in the memory as program units, and the corresponding functions are realized by the processor executing the above-described program units stored in the memory.

[0113] The processor described above comprises a core, and the core retrieves the corresponding program units from the memory. The core can be set to one or more, and the target detection model obtained by model training of the machine learning model on the network environment of the Internet of Things subnetwork is used to detect the analysis result of the data packet to determine whether the data packet has a network attack behavior on the Internet of Things subnetwork. This avoids the situation in the related art that the model training data quality is poor, resulting in inaccurate detection results of the model detecting the attack behavior of the Internet of Things, thereby realizing the technical effect of improving the accuracy of the detection results of the detection model detecting the attack behavior of the Internet of Things.

[0114] The memory can include a non-transitory memory in a computer readable medium, random access memory (RAM) and / or non-volatile memory such as read-only memory (ROM) or flash memory, and the memory includes at least one memory chip.

[0115] According to another aspect of the embodiments of the present application, an electronic device is also provided, which includes a processor and a memory for storing executable instructions of the processor, wherein the processor is configured to perform the attack detection method for the Internet of Things according to any one of the above aspects by executing the executable instructions.

[0116] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which stores a computer program, wherein the computer readable storage medium controls the device where the computer readable storage medium is located to perform the attack detection method for the Internet of Things according to any one of the above aspects when the computer program is running.

[0117] Figure 8 is a schematic diagram of an electronic device according to an embodiment of the present application, as Figure 8 shown, the embodiments of the present application provide an electronic device 80, which includes a processor, a memory, and a program stored in the memory and executable on the processor, and the processor implements the attack detection method for the Internet of Things according to any one of the above aspects when executing the program.

[0118] The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0119] In the above embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0120] In several embodiments provided in the present application, it should be understood that the disclosed technical contents can be implemented by other ways. Among them, the above-mentioned device embodiments are only schematic, for example, the division of the units can be a logical function division, and actual implementation can have another division way, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or modules shown or discussed can be indirect coupling or communication connection through some interfaces, units or modules, which can be electrical or other forms.

[0121] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on multiple units. According to actual needs, part or all of the units can be selected to achieve the purpose of the present embodiment scheme.

[0122] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0123] When the integrated unit is realized in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in part, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various other media that can store program codes.

[0124] The above description is only the preferred embodiments of the present application, and it should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. An attack detection method for the Internet of Things, characterized in that, include: Capture data packets from the first router to obtain the first data packet. The first router includes a router for exchanging data between the IoT subnet and the external network. The IoT subnet includes S IoT devices connected by a network, where S is an integer greater than 1. The first data packet is parsed to obtain the first parsing result; The first parsing result is input into the target detection model, and the detection result is output. The detection result is used to indicate whether the first data packet has a network attack behavior on the Internet of Things subnet. The target detection model includes a model obtained by training a machine learning model by simulating the network environment of the Internet of Things subnet. The target detection model is obtained through the following steps: A network environment simulating the IoT subnet is constructed to obtain a target network, wherein the target network exchanges data with the outside world through a second router; a network attack is launched on the target network using N network devices, and all data packets related to the network attack are captured in the second router to obtain a data packet set, wherein the N network devices are deployed outside the target network, and the data packet set includes M second data packets, where N is a positive integer and M is an integer greater than N; each second data packet is parsed to obtain M second parsing results, and target training samples are determined based on the M second parsing results; the machine learning model is trained based on the target training samples to obtain the target detection model.

2. The attack detection method according to claim 1, characterized in that, Based on M of the second parsing results, the target training samples are determined, including: An attack identifier is added to each of the second parsing results, and a first training sample is composed of M second parsing results and the attack identifier of each second parsing result, wherein the attack identifier is used to characterize that the second data packet associated with the second parsing result is a data packet with network attack behavior; Obtain a second training sample, wherein the second training sample includes at least the parsing results of data packets that do not exhibit network attack behavior; The target training sample is determined based on the first training sample and the second training sample.

3. The attack detection method according to claim 1, characterized in that, After inputting the first parsing result into the target detection model and outputting the detection result, the method further includes: Store the first parsing result and the detection result in the designated storage space; Based on the parsing and detection results stored in the specified storage space, the target detection model is retrained to obtain the updated target detection model.

4. The attack detection method according to claim 1, characterized in that, The target detection model includes at least one of the following: an encoder, a decoder, and a target algorithm. The target algorithm includes a random forest algorithm. The first parsing result is input into the target detection model, and the output detection result includes: The first parsing result is input into the encoder, and the encoder converts the data format of the first parsing result to obtain the converted first parsing result; Based on the first parsing result after conversion, the target algorithm is used to determine the detection result, and the detection result is output through the decoder.

5. The attack detection method according to claim 4, characterized in that, The data format conversion of the first parsing result includes at least one of the following: converting a numeric string to the original numeric value, adjusting a signed numeric string to a specified format and then converting it to a numeric value, converting data representing a physical address to data in a specified base and then converting it to a numeric value, or using a preset data dictionary to convert pure character data to a vector.

6. The attack detection method according to claim 1, characterized in that, The first data packet is parsed to obtain a first parsing result, including: The type of network protocol used by the first data packet is determined to obtain the target protocol type, wherein the target protocol type includes at least one of the following: Transmission Control Protocol, Application Datagram Protocol, and application layer protocol; Based on the target protocol type, the header and data portion of the first data packet are parsed to obtain the first parsing result, wherein the first parsing result includes at least one of the following: source address, destination address, and port.

7. The attack detection method according to claim 1, characterized in that, After inputting the first parsing result into the target detection model and outputting the detection result, the method further includes: If the detection result indicates that the first data packet does not constitute a network attack on the IoT subnet, the first data packet is forwarded to the interior of the IoT subnet. If the detection result indicates that the first data packet constitutes a network attack on the IoT subnet, the first data packet is intercepted.

8. An attack detection device for the Internet of Things, characterized in that, include: The capture unit is used to capture data packets in the first router to obtain the first data packet. The first router includes a router for exchanging data between the IoT subnet and the external network. The IoT subnet includes S IoT devices connected by a network, where S is an integer greater than 1. A parsing unit is used to parse the first data packet to obtain a first parsing result; The processing unit is configured to input the first parsing result into the target detection model and output the detection result, wherein the detection result is used to indicate whether the first data packet constitutes a network attack on the IoT subnet, and the target detection model includes: a model obtained by training a machine learning model by simulating the network environment of the IoT subnet; The target detection model is obtained through the following sub-units: an environment setup sub-unit, used to build a network environment simulating the IoT subnet to obtain a target network, wherein the target network exchanges data with the outside of the target network through a second router; a first processing sub-unit, used to launch a network attack on the target network through N network devices and capture all data packets related to the network attack in the second router to obtain a data packet set, wherein the N network devices are deployed outside the target network, and the data packet set includes M second data packets, where N is a positive integer and M is an integer greater than N; a second processing sub-unit, used to parse each second data packet to obtain M second parsing results, and determine target training samples based on the M second parsing results; and a training sub-unit, used to train the machine learning model based on the target training samples to obtain the target detection model.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the attack detection method for the Internet of Things as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the attack detection method for the Internet of Things as described in any one of claims 1 to 7.

Images