Internet of Things (IoT) intrusion detection methods, devices, equipment, and readable storage media

Abstract

This application relates to the field of Internet of Things (IoT) security, and provides an IoT intrusion detection method, apparatus, device, and readable storage medium. The method is applied to an IoT intrusion detection system including IoT nodes; the method includes: upon detecting a registration request from a new node, calculating an aggregate trust value for the new node through the IoT nodes, where the IoT nodes include general nodes and dedicated nodes; if the aggregate trust value is greater than or equal to a first threshold, performing signature detection on the new node through a dedicated node to obtain detection information; if the trust value of the dedicated node sending the detection information is greater than or equal to a second threshold, performing network attack detection on the new node; and updating the trust ledger of the IoT nodes when a network attack is detected. Updating the trust ledger of the IoT nodes when a network attack is detected in the IoT promotes trust between IoT nodes, thereby effectively identifying network attacks from malicious nodes.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) security, specifically to an IoT intrusion detection method, apparatus, device, and readable storage medium. Background Technology

[0002] With the continuous development of IoT technology, its application scenarios are becoming increasingly widespread, placing higher demands on IoT security. In existing technologies, to improve IoT security, the following two methods have been proposed for intrusion detection:

[0003] Method 1: Install a trusted dataset evaluation model and a whitelist server containing a list of trusted devices on the master device of each micro-network. The master device uses the trusted dataset evaluation model based on the whitelist server to perform a trust assessment on the devices in the IoT to determine whether the IoT devices are under cyberattack. Method 2: A behavior-based distributed intrusion detection method that uses an LSTM-based ANN model to analyze and correlate network and device behavior for intrusion detection.

[0004] However, in Method 1, the main device needs to evaluate the trustworthiness of the devices in the Internet of Things (IoT) based on the trusted dataset evaluation model through the whitelist server to determine whether the IoT devices have been attacked. Thus, if the main device or the whitelist server is threatened, the intrusion detection of the IoT cannot be completed. In Method 2, since the ANN model needs to pre-assume a trusted environment, that is, to assume that there are no security threats between IoT devices, Method 2 cannot deal with internal attacks originating from within the devices. Summary of the Invention

[0005] This application provides an IoT intrusion detection method, apparatus, device, and readable storage medium to address the technical problem of low effectiveness in existing IoT intrusion detection methods.

[0006] In a first aspect, embodiments of this application provide an Internet of Things (IoT) intrusion detection method, wherein the IoT intrusion detection system includes IoT nodes, and the IoT intrusion detection method includes:

[0007] Upon detecting a new node's registration request, the aggregate trust value of the new node is calculated through the IoT node, which includes general-purpose nodes and dedicated nodes;

[0008] If the aggregated trust value is greater than or equal to the first threshold, the new node is signed and detected by the dedicated node to obtain detection information.

[0009] If the trust value of the dedicated node that sends the detection information is greater than or equal to the second threshold, network attack detection is performed on the new node.

[0010] If a cyberattack is detected, the trust ledger of the IoT node is updated.

[0011] In one embodiment, the IoT intrusion detection system further includes a trust management module, which includes a node registration engine, an update engine, and a blockchain interface; the calculation of the aggregate trust value of the new node through the IoT node includes:

[0012] Upon detecting a new node registration request, the new node is registered through the node registration engine;

[0013] The trust value of the newly registered node is calculated by the IoT node, and multiple trust values ​​are aggregated to obtain the aggregated trust value of the newly registered node.

[0014] In one embodiment, the IoT intrusion detection system further includes a signature detection engine; the step of performing signature detection on the new node through the dedicated node to obtain detection information includes:

[0015] When the signature detection engine receives the detection information sent by the dedicated node, it searches for the trust value of the dedicated node in the trust ledger of the dedicated node.

[0016] If the trust value of the dedicated node is greater than or equal to the second threshold, the IoT node that calculates the aggregate trust value of the new node is updated.

[0017] In one embodiment, the step of looking up the trust value of the dedicated node in the trust ledger of the dedicated node after the signature detection engine receives the detection information sent by the dedicated node includes:

[0018] If the trust value of the dedicated node is less than the second threshold, the dedicated node is prevented from performing signature detection on the new node until the trust value of the dedicated node recovers to be greater than or equal to the second threshold.

[0019] In one embodiment, before calculating the aggregate trust value of the new node through the IoT node upon detecting a new node's registration request, the process includes:

[0020] Obtain a training dataset containing attacking nodes and normal network activity;

[0021] For nodes in the training dataset whose trust values ​​are below the third threshold, feature scaling and feature dimensionality reduction are performed sequentially.

[0022] A network attack detection model is trained based on the training dataset after feature dimensionality reduction, and the network attack detection model is used to detect network attacks on the new node.

[0023] In one embodiment, updating the trust ledger of the IoT node upon detecting a cyberattack includes:

[0024] If a network attack is detected, the IoT nodes will update each other and stop detecting network packets.

[0025] Send an update policy to the IoT node and convert the local trust of the IoT node into a global trust;

[0026] Update the trust ledger of all IoT nodes in the IoT intrusion detection system.

[0027] Secondly, embodiments of this application provide an Internet of Things (IoT) intrusion detection device, comprising:

[0028] The aggregate trust value calculation module is used to calculate the aggregate trust value of a new node through an IoT node when a registration request of a new node is detected. The IoT node includes general nodes and special nodes.

[0029] The signature detection module is used to perform signature detection on the new node through the dedicated node when the aggregated trust value is greater than or equal to the first threshold, and obtain detection information.

[0030] The network attack detection module is used to perform network attack detection on the new node when the trust value of the dedicated node that sends the detection information is greater than or equal to a second threshold.

[0031] The trust ledger update module is used to update the trust ledger of the IoT node when a network attack is detected.

[0032] Thirdly, embodiments of this application provide a device including a processor and a memory storing a computer program, wherein the processor executes the computer program to implement the IoT intrusion detection method described in the first aspect.

[0033] Fourthly, embodiments of this application provide a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the IoT intrusion detection method described in the first aspect.

[0034] Fifthly, embodiments of this application provide a computer program product, which, when executed by a processor, implements the Internet of Things intrusion detection method described in the first aspect.

[0035] The IoT intrusion detection method, apparatus, device, and readable storage medium provided in this application monitor the registration of new nodes, calculate the aggregate trust value of the new nodes based on the IoT nodes in the intrusion detection system, and further perform network attack detection on the new nodes when the aggregate trust value of the new nodes is greater than or equal to a first threshold and the trust value of the dedicated node that performs signature detection on the new nodes is also greater than or equal to a second threshold. Finally, when a network attack is detected in the IoT, the trust ledger of the IoT nodes is updated to promote the trust between IoT nodes, thereby effectively identifying network attacks by malicious nodes. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a schematic diagram of the framework of an IoT intrusion detection system in which the IoT intrusion detection method provided in this application is applied;

[0038] Figure 2 This is one of the flowcharts of the IoT intrusion detection method provided in the embodiments of this application;

[0039] Figure 3 This is a second schematic flowchart of the IoT intrusion detection method provided in the embodiments of this application;

[0040] Figure 4 This is a schematic diagram of the structure of the IoT intrusion detection device provided in the embodiments of this application;

[0041] Figure 5 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0043] Reference Figure 1 , Figure 1This is a schematic diagram of the framework of an IoT intrusion detection system applied in the embodiments of this application. The IoT intrusion detection system consists of a trusted IoT environment with two layers of IoT nodes, where layer 0 consists of general (IoT) nodes and layer 1 consists of dedicated (IoT) nodes. The core of this IoT intrusion detection system is to collaboratively detect malicious network attacks with the support of a distributed trust management module, thereby promoting trust among nodes within the IoT and identifying network attacks by malicious nodes.

[0044] The main components and functions of an IoT intrusion detection system are as follows:

[0045] General-purpose IoT nodes: These can be devices such as sensors and actuators, capable of sending or receiving data to or from an IoT network. A general-purpose IoT node can run a trust computation engine, participating in the calculation of trust values ​​for other IoT nodes, and forwarding relevant updates to the blockchain (trust) ledger through the update engine and blockchain interface. Upon receiving any data within the IoT network, it verifies the trust value of the node sending the data from the blockchain trust ledger before initiating communication.

[0046] Dedicated IoT nodes: These are nodes with sufficient computing power in terms of power consumption, memory, and storage to run the signature verification engine. These dedicated IoT nodes are the most trusted devices in the IoT network. They can collaboratively control and manage decentralized trust management modules, perform activities such as new node registration and authorization, and participate in computing and updating the trust of other devices in the IoT environment. Dedicated IoT nodes can also collaboratively manage the blockchain signature database and the node's global trust value.

[0047] Trust Management Module: Primarily responsible for calculating, aggregating, and interpreting local and global trust values ​​in the IoT network. For example... Figure 1 As shown, the trust management module includes a node registration and authorization engine that confirms new node registration requests by providing an initial minimum trust level. The control module controls the blockchain's trust ledger or interface. This trust ledger contains the global trust value for all nodes in the IoT, as well as whether further communication with other nodes is allowed or denied. It also receives local trust values ​​from all nodes in the IoT and sends them to the trust calculation engine. The local trust values ​​are then normalized and aggregated to create global trust for each node, and the blockchain trust database is updated via the update engine.

[0048] Blockchain Trust Ledger: Leveraging the inherent security, immutability, and trustworthiness of blockchain technology, important information can be stored in a blockchain ledger. The blockchain trust ledger serves a dual purpose: maintaining the integrity of the trust database by protecting the trust values ​​(calculated by the trust computation engine); and maintaining the integrity of dedicated IoT nodes' ability to detect malicious signatures from malicious nodes by calculating the hash values ​​of two databases (the blockchain signature database and the blockchain trust database). Each node maintains a trust database containing global trust values ​​for other nodes in the network; the hash of the trust database is stored in the blockchain ledger to prevent corruption. Similarly, all dedicated IoT nodes maintain a signature database, and the underlying blockchain maintains the hash values ​​of the signature database.

[0049] The signature detection engine interacts with the trust management module via a blockchain interface to receive detection information sent by dedicated IoT nodes. This engine specifically includes a policy engine, an alarm association and update module, and a blockchain signature database. The alarm association and update module performs alarm aggregation, normalization, and log analysis. It correlates multiple generated alarms and event sequences, using predictive analytics to identify network attack events. Upon identifying a malicious network attack, it sends a recommendation back to the policy engine, which then enforces updated policies from the node to prevent the attack from spreading to other nodes. The policy engine can receive, interpret, and distribute rules (signatures) among dedicated IoT nodes. The policy engine controls the blockchain's signature database and is responsible for capturing, inspecting, and matching signatures with incoming traffic. Upon identifying abnormal traffic, it sends an alarm to the alarm association and update engine.

[0050] In this application, the collaboration between the aforementioned components is accomplished through a blockchain interface, which ensures the integrity of the signature and global trust between nodes.

[0051] Reference Figure 2 , Figure 2 This is one of the flowcharts illustrating the IoT intrusion detection method in the embodiments of this application. The IoT intrusion detection method provided in the embodiments of this application may include:

[0052] Step 100: Upon detecting a new node's registration request, calculate the aggregate trust value of the new node through the IoT node, which includes general-purpose nodes and dedicated nodes;

[0053] Specifically, based on Figure 1When a new node is detected joining the IoT network, i.e., when a registration request for the new node is received, the node registration engine of the trust management module is activated to implement the node registration process. At the same time, the trust value of the new node is calculated through all nodes in the IoT (including general IoT nodes and dedicated IoT nodes), and all the obtained trust values ​​are aggregated to obtain the aggregate trust value of the new node.

[0054] Step 200: If the aggregated trust value is greater than or equal to the first threshold, the new node is subjected to signature detection by the dedicated node to obtain detection information;

[0055] Specifically, when the signature detection engine receives detection information from a dedicated IoT node, it first checks the trust value of the sending agent (i.e., the dedicated IoT node that sent the detection information) in the blockchain's trust ledger. If the trust value of the dedicated IoT node that sent the detection information is greater than or equal to a second threshold, the signature detection engine accepts the detection information and updates the information for other participating nodes in the IoT network.

[0056] It should be noted that in this solution, IoT devices with sufficient resources can be used as dedicated IoT nodes and participate in the network detection process. IoT devices with sufficient resources refer to those whose peak memory, CPU utilization, local trust value, or global trust value exceeds a specified threshold.

[0057] Conversely, if the trust value falls below the second threshold, the dedicated IoT node is prevented from participating in network detection until its trust value returns to a level greater than or equal to the second threshold. However, it will continue to remain in the IoT network as a general-purpose IoT node.

[0058] Step 300: If the trust value of the dedicated node that sends the detection information is greater than or equal to the second threshold, perform network attack detection on the new node.

[0059] Specifically, in the embodiments provided in this application, after performing signature detection, network attack detection can be further performed. When performing network attack detection, attacks on the IoT network can be detected based on a preset machine learning intrusion detection model. Before detecting network attacks based on the preset machine learning intrusion detection model, the preset machine learning intrusion detection model is trained.

[0060] Step 400: If a network attack is detected, update the trust ledger of the IoT node.

[0061] Specifically, upon detecting a network intrusion, IoT nodes update each other to cease inspecting network packets and send updates to dedicated and general-purpose IoT nodes. These dedicated IoT nodes can also participate in aggregating local trust values, converting them into global trust values, and updating the trust ledger of each node in the IoT network. This collaboration among these dedicated IoT nodes creates a trusted environment and efficiently and effectively detects network attacks.

[0062] This embodiment monitors the registration of new nodes and calculates the aggregate trust value of the new nodes based on the IoT nodes in the intrusion detection system. If the aggregate trust value of the new node is greater than or equal to a first threshold, and the trust value of the dedicated node that performs signature detection on the new node is also greater than or equal to a second threshold, the new node is further subjected to network attack detection. Finally, when a network attack is detected in the IoT, the trust ledger of the IoT nodes is updated to promote the trust between IoT nodes, thereby effectively identifying network attacks by malicious nodes.

[0063] In one embodiment, the IoT intrusion detection method provided in this application may further include:

[0064] Step 110: Upon detecting a new node registration request, register the new node through the node registration engine;

[0065] Step 120: Calculate the trust value of the newly registered node using the IoT node, and aggregate multiple trust values ​​to obtain the aggregated trust value of the newly registered node.

[0066] Specifically, when a new node joins or registers in the IoT network, it needs to provide its initial trust level. The trust value of the new node is calculated by all IoT nodes in the network, and this trust value is aggregated across all IoT nodes. Then, the aggregated trust value is forwarded to the blockchain trust ledger via the update engine and blockchain interface. If the new node's aggregated trust value is below a certain threshold, the new node will be prevented from joining the IoT network; if the new node's aggregated trust value is greater than or equal to a certain threshold, the new node will be allowed to join the IoT network.

[0067] This embodiment calculates the aggregate trust value of the new node through all IoT nodes, providing data support for intrusion detection of the new node.

[0068] In one embodiment, the IoT intrusion detection method provided in this application may further include:

[0069] Step 500: When the signature detection engine receives the detection information sent by the dedicated node, it searches for the trust value of the dedicated node in the trust ledger of the dedicated node.

[0070] Step 600: If the trust value of the dedicated node is greater than or equal to the second threshold, update the IoT node that calculates the aggregate trust value of the new node.

[0071] The IoT intrusion detection method provided in this application embodiment may further include:

[0072] Step 700: If the trust value of the dedicated node is less than the second threshold, prevent the dedicated node from performing signature detection on the new node until the trust value of the dedicated node recovers to be greater than or equal to the second threshold.

[0073] Specifically, the signature detection engine receives detection information (obtained by dedicated IoT nodes performing signature detection on new nodes). Each time the signature detection engine receives detection information, it first looks up the trust value of the dedicated IoT node that sent the detection information in the blockchain's trust ledger. If the trust value of the dedicated IoT node that sent the detection information is greater than or equal to a second threshold, the signature detection engine accepts the detection information it sent and updates the local trust ledgers of other participating nodes in the IoT.

[0074] If the trust value of a dedicated IoT node sending detection information is less than a second threshold, that dedicated IoT node is not allowed to participate in the network detection process until, during a subsequent trust value update, the dedicated IoT node recovers to a value greater than or equal to the second threshold. If the trust value of a dedicated IoT node is less than the second threshold, that IoT node will remain in the IoT network as a general IoT node.

[0075] This embodiment ensures the effectiveness of signature detection by judging the trust value of the dedicated IoT node performing the signature detection.

[0076] In one embodiment, the IoT intrusion detection method provided in this application may further include:

[0077] Step 10: Obtain a training dataset containing attacking nodes and normal network activity;

[0078] Step 20: Perform feature scaling and feature dimensionality reduction sequentially on nodes in the training dataset whose trust values ​​are lower than the third threshold;

[0079] Step 30: Based on the training dataset after feature dimensionality reduction, a network attack detection model is trained, which is used to detect network attacks on the new node.

[0080] The training process of the above-mentioned intrusion detection model based on pre-defined machine learning is as follows:

[0081] Step 1: Based on the concept of min-max normalization on a pre-defined dataset, perform feature scaling on nodes with trust values ​​below a third threshold to limit information leakage on the test data. The pre-defined dataset is a mixture of historical network attacks and normal network traffic activity, including various attack types.

[0082] Step 2: Perform feature dimensionality reduction on nodes in the IoT with trust values ​​below the third threshold using principal component analysis (PCA). PCA can be used to compress the attribute space, selecting ten components to reduce the dimensionality of the preset dataset. The value of the first component is shown in Equation 1, where Y1 is the linear mixture of the principal attributes with the largest difference, L is the observation matrix with a mean of 0, and b1 is the vector with the largest variance (y), which can be calculated using Equation 2; where K is the covariance matrix after the observations, and m is the number of samples.

[0083] Y1 = Lb1; (1)

[0084]

[0085]

[0086]

[0087] When solving Formula 2 above, we can use Formulas 3 and 4. Here, v is the eigenvalue, and b is the eigenvector of D.

[0088] Step 3: Based on the pre-set dataset after feature dimensionality reduction, perform network attack analysis using multiple pre-set machine learning models. These pre-set machine learning models include K-Nearest Neighbor (KNN), Cat acceleration algorithm, extreme gradient boosting, support vector machine, quadratic discriminant analysis model, and Naive Bayes, among others.

[0089] This embodiment accurately and effectively identifies network attack behaviors through the network attack detection model obtained through training.

[0090] Reference Figure 3 , Figure 3 This is a second flowchart illustrating the IoT intrusion detection method in one embodiment of this application. In one embodiment, the IoT intrusion detection method provided in this application may further include:

[0091] Step 410: If a network attack is detected, the IoT nodes update each other and stop detecting network data packets;

[0092] Step 420: Send an update policy to the IoT node and convert the local trust of the IoT node into a global trust;

[0093] Step 430: Update the trust ledger of all IoT nodes in the IoT intrusion detection system.

[0094] Specifically, upon detecting intrusion behavior within the Internet of Things (IoT), the alarm association and update module can perform alarm aggregation, alarm normalization, and log analysis, and correlate multiple generated alarms and event sequences. Predictive analytics is then used to identify network attack events. After identifying specific malicious attack behavior, it can be sent back to the policy engine, which then enforces updated (trust ledger) policies to prevent any malicious traffic, malicious IPs, malicious ports, and malicious MAC addresses from spreading to other nodes. The engine can also notify the network administrator.

[0095] This embodiment effectively prevents further intrusion by implementing a strategy after detecting intrusion behavior.

[0096] refer to Figure 4 , Figure 4 This is a schematic diagram of the structure of the IoT intrusion detection device in the embodiments of this application. The IoT intrusion detection device provided in the embodiments of this application is described below. The IoT intrusion detection device described below can be referred to in correspondence with the IoT intrusion detection method described above.

[0097] The aggregate trust value calculation module 401 is used to calculate the aggregate trust value of a new node through an IoT node when a registration request of a new node is detected. The IoT node includes general nodes and special nodes.

[0098] The signature detection module 402 is used to perform signature detection on the new node through the dedicated node when the aggregated trust value is greater than or equal to the first threshold, and obtain detection information.

[0099] The network attack detection module 403 is used to perform network attack detection on the new node when the trust value of the dedicated node that sends the detection information is greater than or equal to a second threshold.

[0100] The trust ledger update module 404 is used to update the trust ledger of the IoT node when a network attack is detected.

[0101] Optionally, the IoT intrusion detection system further includes a trust management module, which includes a node registration engine, an update engine, and a blockchain interface; the aggregated trust value calculation module includes:

[0102] The new node registration unit is used to register the new node through the node registration engine when a new node registration request is detected.

[0103] The aggregated trust value calculation unit is used to calculate the trust value of the newly registered node through the IoT node, and aggregate multiple trust values ​​to obtain the aggregated trust value of the newly registered node.

[0104] Optionally, the IoT intrusion detection system further includes a signature detection engine; the IoT intrusion detection device further includes:

[0105] The dedicated node trust value lookup module is used to look up the trust value of the dedicated node in the trust ledger of the dedicated node when the signature detection engine receives the detection information sent by the dedicated node.

[0106] The node update module is used to update the IoT node that calculates the aggregate trust value of the new node when the trust value of the dedicated node is greater than or equal to a second threshold.

[0107] Optionally, the IoT intrusion detection device further includes:

[0108] The signature detection blocking module is used to prevent the dedicated node from performing signature detection on the new node when the trust value of the dedicated node is less than a second threshold, until the trust value of the dedicated node recovers to be greater than or equal to the second threshold.

[0109] Optionally, the IoT intrusion detection device further includes:

[0110] The training dataset acquisition module is used to acquire a training dataset containing both attacking nodes and normal network activity.

[0111] The feature scaling and feature dimensionality reduction module is used to perform feature scaling and feature dimensionality reduction on nodes in the training dataset whose trust values ​​are lower than the third threshold in sequence.

[0112] The network attack detection model training module is used to train a network attack detection model based on the training dataset after feature dimensionality reduction. The network attack detection model is used to detect network attacks on the new node.

[0113] Optionally, the trust ledger update module includes:

[0114] The node mutual update unit is used to update the IoT nodes and stop detecting network data packets when a network attack is detected.

[0115] The update policy sending unit is used to send update policies to the IoT node and convert the local trust of the IoT node into global trust.

[0116] The trust ledger update unit is used to update the trust ledger of all IoT nodes in the IoT intrusion detection system.

[0117] Figure 5 An example is a schematic diagram of the physical structure of a device, such as... Figure 5 As shown, the device may include a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other via the communication bus 540. The processor 510 can call the computer program in the memory 530 to execute the steps of the Internet of Things intrusion detection method.

[0118] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0119] On the other hand, embodiments of this application also provide a non-transitory computer-readable storage medium storing a computer program thereon, wherein when the computer program is executed by a processor, the computer is able to perform the steps of the IoT intrusion detection method provided in the above embodiments.

[0120] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0121] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the IoT intrusion detection method described in various embodiments or some parts of embodiments.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An Internet of Things (IoT) intrusion detection method, characterized in that, The IoT intrusion detection method is applied to an IoT intrusion detection system, which includes IoT nodes, and the IoT intrusion detection method includes: Upon detecting a new node's registration request, the aggregate trust value of the new node is calculated through the IoT node, which includes general IoT nodes and dedicated IoT nodes; the general IoT node is a device capable of sending or receiving data to or from the IoT network; the dedicated IoT node is an IoT device whose peak memory, CPU utilization, local trust value, or global trust value is greater than a specified threshold. If the aggregated trust value is greater than or equal to the first threshold, the new node is subjected to signature detection by the dedicated IoT node to obtain detection information. If the trust value of the dedicated IoT node that sends the detection information is greater than or equal to the second threshold, network attack detection is performed on the new node. If a cyberattack is detected, the trust ledger of the IoT node is updated.

2. The IoT intrusion detection method according to claim 1, characterized in that, The IoT intrusion detection system also includes a trust management module, which includes a node registration engine, an update engine, and a blockchain interface. The calculation of the aggregate trust value of the new node through the IoT node includes: Upon detecting a new node registration request, the new node is registered through the node registration engine; The trust value of the newly registered node is calculated by the IoT node, and multiple trust values ​​are aggregated to obtain the aggregated trust value of the newly registered node.

3. The IoT intrusion detection method according to claim 1, characterized in that, The IoT intrusion detection system further includes a signature detection engine; the step of performing signature detection on the new node through the dedicated IoT node to obtain detection information includes: When the signature detection engine receives the detection information sent by the dedicated IoT node, it searches for the trust value of the dedicated IoT node in the trust ledger of the dedicated IoT node. If the trust value of the dedicated IoT node is greater than or equal to the second threshold, the IoT node that calculates the aggregate trust value of the new node is updated.

4. The IoT intrusion detection method according to claim 3, characterized in that, The step of searching for the trust value of the dedicated IoT node in the trust ledger of the dedicated IoT node after the signature detection engine receives the detection information sent by the dedicated IoT node includes: If the trust value of the dedicated IoT node is less than the second threshold, the dedicated IoT node is prevented from performing signature detection on the new node until the trust value of the dedicated IoT node recovers to be greater than or equal to the second threshold.

5. The IoT intrusion detection method according to claim 1, characterized in that, Before calculating the aggregate trust value of the new node through the IoT node upon detecting a new node's registration request, the process includes: Obtain a training dataset containing attacking nodes and normal network activity; For nodes in the training dataset whose trust values ​​are below the third threshold, feature scaling and feature dimensionality reduction are performed sequentially. A network attack detection model is trained based on the training dataset after feature dimensionality reduction, and the network attack detection model is used to detect network attacks on the new node.

6. The IoT intrusion detection method according to claim 1, characterized in that, The step of updating the trust ledger of the IoT node upon detecting a network attack includes: If a network attack is detected, the IoT nodes will update each other and stop detecting network packets. Send an update policy to the IoT node and convert the local trust of the IoT node into a global trust; Update the trust ledger of all IoT nodes in the IoT intrusion detection system.

7. An Internet of Things (IoT) intrusion detection device, characterized in that, include: The aggregate trust value calculation module is used to calculate the aggregate trust value of a new node through an IoT node when a registration request of a new node is detected. The IoT node includes general IoT nodes and dedicated IoT nodes. The general IoT node is a device that can send or receive data to or from the IoT network. The dedicated IoT node is an IoT device whose peak memory, CPU utilization, local trust value, or global trust value is greater than a specified threshold. The signature detection module is used to perform signature detection on the new node through the dedicated IoT node when the aggregated trust value is greater than or equal to a first threshold, and obtain detection information. The network attack detection module is used to perform network attack detection on the new node when the trust value of the dedicated IoT node that sends the detection information is greater than or equal to a second threshold. The trust ledger update module is used to update the trust ledger of the IoT node when a network attack is detected.

8. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the Internet of Things intrusion detection method according to any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the Internet of Things intrusion detection method as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the Internet of Things intrusion detection method according to any one of claims 1 to 6.

Images