A pet safety monitoring system based on the Internet of Things

Abstract

The present invention relates to the technical field of data transmission security, and in particular to a pet safety monitoring system based on the Internet of Things, including an information acquisition module for acquiring historical network traffic data, network traffic data, device behavior data, key information and security information; a traffic analysis module for analyzing the abnormality of network traffic; a device behavior analysis module for analyzing the operating status of the device; a security warning module for providing a data transmission security warning to the user; an encryption analysis module for analyzing the abnormality of data encryption within a management cycle; a security management module for managing the key update cycle and firewall rule transmission cycle of the next transmission cycle; and a security monitoring module for optimizing the management process of the key update cycle of the next transmission cycle according to the number of security events acquired within the transmission cycle and the average response time of the security events. The present invention improves the security of pet data.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission security, and in particular to a pet safety monitoring system based on the Internet of Things. Background Art

[0002] With the rise of the pet economy, more and more families are starting to keep pets. In order to better take care of the health and safety of pets, IoT technology is widely used in pet monitoring systems. However, pet monitoring systems face problems with data security and privacy protection when collecting and transmitting pet data.

[0003] Chinese patent publication number CN114900513A discloses a remote pet safety alarm system, including a pet intelligent terminal device, a pet safety management platform and a pet safety alarm client; the pet intelligent device terminal includes a pet housework device and a data sensing and collecting device; the pet safety management platform includes a protocol conversion module, a multi-source data processing module and a judgment alarm module; the multi-source data processing module is used to store a variety of data transmitted by information sensors such as gravity sensors, infrared sensors, infrared sensors, etc., and uses a normalization processing method corresponding to each type of sensor to process the data, and then uses a multi-source data fusion algorithm to process the collected data, and finally passes the processed safety alarm comprehensive value to the judgment alarm module; the pet safety alarm client is used to view the information collected by the information sensor in the terminal device and obtain pet safety alarm information. The present invention monitors the safety status of the pet in real time when the pet is unattended; it can be seen that when the scheme transmits the pet data, it does not analyze the security of the pet data transmission, and there is a problem of low security of the pet data. Summary of the invention

[0004] To this end, the present invention provides a pet safety monitoring system based on the Internet of Things to overcome the problem of low pet data security in the prior art.

[0005] To achieve the above purpose, the present invention provides a pet safety monitoring system based on the Internet of Things, comprising:

[0006] Information acquisition module, used to obtain historical network traffic data, network traffic data, device behavior data, key information and security information;

[0007] Traffic analysis module, used to analyze the abnormality of network traffic based on the acquired historical network traffic data and the network traffic data acquired during the monitoring period;

[0008] The equipment behavior analysis module is used to analyze the operation status of the equipment based on the equipment behavior data obtained during the monitoring period;

[0009] The security warning module is used to provide data transmission security warnings to users based on the analysis results of network traffic anomalies and equipment operation status within the management cycle;

[0010] The encryption analysis module is used to analyze the abnormality of data encryption within the management period according to the key usage frequency and key usage times obtained within the management period;

[0011] The security management module is used to manage the key update cycle and firewall rule transmission cycle of the next transmission cycle according to the data security warning and data encryption abnormality analysis results provided to users during the transmission cycle;

[0012] The security monitoring module is used to optimize the management process of the key update cycle of the next transmission cycle according to the number of security events obtained in the transmission cycle and the average response time of the security events.

[0013] Furthermore, the traffic analysis module analyzes the abnormality of network traffic based on the acquired historical network traffic data and the network traffic data acquired during the monitoring period, wherein:

[0014] when When the traffic analysis module determines that the network traffic in the current monitoring period is normal;

[0015] when When the traffic analysis module determines that the network traffic in the current monitoring period is abnormal;

[0016] Wherein, X is the number of transmitted data packets obtained in the monitoring period, α is the preset abnormal threshold, μ is the average number of transmitted data packets in each historical monitoring period, and σ is the standard deviation of the number of transmitted data packets in each historical monitoring period.

[0017] Furthermore, the device behavior analysis module is provided with a first device analysis unit and a second device analysis unit, wherein the first device analysis unit is used to compare the device CPU usage c0 obtained during the monitoring period with the preset CPU usage c1, and analyze the abnormality of the device CPU usage according to the comparison result, wherein:

[0018] When c0≤c1, the first device analysis unit determines that the device CPU usage rate in the current monitoring period is normal;

[0019] When c0>c1, the first device analysis unit determines that the CPU usage of the device in the current monitoring period is abnormal;

[0020] The second device analysis unit is used to analyze the operation status of the device during the monitoring period according to the analysis result of the abnormality of the device CPU usage rate and the device memory usage rate n0 obtained during the monitoring period, wherein:

[0021] If the CPU usage rate of the device in the current monitoring period is normal, when n0≤n1, the second device analysis unit determines that the operation status of the device in the current monitoring period is normal; when n0>n1, the second device analysis unit determines that the operation status of the device in the current monitoring period is abnormal;

[0022] If the CPU usage rate of the device in the current monitoring period is abnormal, when n0≤n1×exp[-(c0-c1) / (c0+c1)], the second device analysis unit determines that the operation status of the device in the current monitoring period is normal; when n0>n1×exp[-(c0-c1) / (c0+c1)], the second device analysis unit determines that the operation status of the device in the current monitoring period is abnormal;

[0023] Among them, n1 is the preset memory usage.

[0024] Furthermore, the security warning module provides a data security warning to the user based on the analysis results of the network traffic anomaly and the equipment operation status within the management period, wherein:

[0025] When {exp[(i1 / i0)]-1} / 3(i1 / i0)×(π / 4)]+γ×i2 / i0≤p, the security warning module does not issue a data transmission security warning to the user;

[0026] When {exp[(i1 / i0)]-1} / 3(i1 / i0)×(π / 4)]+γ×i2 / i0>p, the security warning module issues a data transmission security warning to the user;

[0027] Among them, i1 is the number of monitoring cycles of abnormal network traffic within the management period, i2 is the number of monitoring cycles of abnormal device operation status within the management period, i0 is the number of monitoring cycles within the management period, γ is the preset adjustment coefficient, and p is the preset abnormal coefficient.

[0028] Further, the encryption analysis module is provided with a first encryption analysis unit, a second encryption analysis unit and an encryption anomaly analysis unit, wherein the first encryption analysis unit is used to compare the key usage frequency s0 obtained in the management period with the preset frequency s1, and analyze the frequency anomaly index according to the comparison result;

[0029] The second encryption analysis unit is used to compare the key usage times r0 obtained within the management period with the preset times r1, and analyze the usage times abnormality index according to the comparison result.

[0030] Further, the encryption anomaly analysis unit analyzes the anomaly of data encryption within the management period according to the analysis results of the key frequency anomaly index and the analysis results of the key usage count anomaly index within the management period, wherein:

[0031] When w1×key frequency abnormality index+w2×key usage times abnormality index≤u, the encryption abnormality analysis unit determines that the encryption of the current management period data is normal;

[0032] When w1×key frequency anomaly index+w2×key usage times anomaly index>u, the encryption anomaly analysis unit determines that the encryption of the current management period data is abnormal;

[0033] Among them, w1 is the frequency weight, w2 is the number weight, and u is the preset encryption anomaly coefficient.

[0034] Furthermore, the security management module is provided with a key update unit and a firewall update unit, and the key update unit is used to manage the key update cycle of the next transmission cycle according to the analysis results of the data security warning to the user and the analysis results of the data encryption abnormality during the transmission cycle, wherein:

[0035] When j1 / j0-lg(j2 / j0+1)≤β, the key update unit determines that the security status of the data in the current transmission cycle is normal, and sets the key update period of the next transmission cycle to Y1, and sets Y1=y0;

[0036] When j1 / j0-lg(j2 / j0+1)>β, the key update unit determines that the security status of the data in the current transmission period is abnormal, and sets the key update period of the next transmission period to Y2, setting Y2=y0×{1-exp{j1 / j0-lg(j2 / j0+1)-β} / (e-1)};

[0037] Among them, j1 is the number of management cycles of data encryption anomalies within the transmission cycle, j2 is the number of management cycles for issuing data security warnings to users within the transmission cycle, j0 is the number of management cycles within the transmission cycle, β is the preset state coefficient, and y0 is the preset key update cycle.

[0038] Furthermore, the firewall update unit is used to manage the transmission cycle of the next transmission cycle firewall rule according to the analysis result of the data encryption abnormality, wherein:

[0039] When j1 / j0≤E, the firewall update unit determines that the data encryption of the current transmission cycle is normal, and sets the transmission cycle of the firewall rule of the next transmission cycle to G1, and sets G1=g0;

[0040] When j1 / j0>E, the firewall update unit determines that the data encryption of the current transmission cycle is abnormal, and sets the transmission cycle of the firewall rule of the next transmission cycle to G2, setting G2=g0×[1-(j1 / j0-E) 2 ];

[0041] Among them, E is the preset proportional coefficient, and g0 is the preset firewall transmission period.

[0042] Furthermore, the security monitoring module is provided with an event monitoring unit and a response monitoring unit, and the event monitoring unit is used to compare the number of security events h0 obtained in the transmission period with the preset number of events h1, and optimize the management process of the key update period according to the comparison result, wherein:

[0043] When h0≤h1, the event monitoring unit determines that the number of security events in the current transmission period is normal and does not perform optimization;

[0044] When h0>h1, the event monitoring unit determines that the number of security events in the current monitoring period is abnormal, and optimizes the management process of the key update period, and sets the optimized preset state coefficient to β', setting β'=β×{1-ln[(h0-h1) / (h0+h1)+1] / ln2}.

[0045] Furthermore, the response monitoring unit compares the average response time t0 of the security events obtained during the transmission period with the preset response time t1, and performs secondary optimization on the management process of the key update period according to the comparison result, wherein:

[0046] When t0≤t1, the response monitoring unit determines that the average response time of the security event in the current transmission period is normal and does not perform optimization;

[0047] When t0>t1, the response monitoring unit determines that the average response time of the security events in the current transmission cycle is abnormal, and performs secondary optimization on the management process of the key update cycle, and sets the optimized preset number of events to h1', and sets h1'=h1×[1-η×(t0-t1) / (t0+t1)], where η is the preset optimization coefficient.

[0048] Compared with the prior art, the beneficial effects of the present invention are that the traffic analysis module improves the accuracy of network traffic anomaly analysis by setting a preset anomaly threshold, thereby improving the accuracy of data transmission security warnings to users; the device behavior analysis module improves the accuracy of device CPU usage anomaly analysis by setting a preset CPU usage rate, and improves the accuracy of device memory usage anomaly analysis by setting a preset memory usage rate, thereby improving the accuracy of data transmission security warnings to users; the encryption analysis module improves the accuracy of frequency anomaly index analysis by setting a preset frequency, improves the accuracy of usage number anomaly index analysis by setting a preset number, and improves the accuracy of data encryption anomaly analysis by setting various weights and preset encryption anomaly coefficients, thereby improving the key update cycle and anti-virus protection. The accuracy of the firewall rule transmission cycle management, the security management module improves the accuracy of the key update cycle management of the next transmission cycle by setting a preset state coefficient and a preset key update cycle, thereby improving the security of pet data, and improves the accuracy of the firewall rule transmission cycle management of the next transmission cycle by setting a preset proportional coefficient and a preset firewall transmission cycle, thereby improving the security of pet data, the security monitoring module monitors the number of security events to reduce the impact of the abnormal number of security events on the key update cycle management, thereby improving the accuracy of the key update cycle management of the next transmission cycle, and monitors the security event response time to reduce the impact of the abnormal security event response time on the key update cycle management, thereby improving the accuracy of the key update cycle management of the next transmission cycle, thereby improving the security of pet data. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Schematic diagram of the structure of the pet safety monitoring system based on the Internet of Things in this embodiment.

[0050] Figure 2 Schematic diagram of the structure of the device behavior analysis module in this embodiment.

[0051] Figure 3 This is a schematic diagram of the structure of the encryption analysis module of this embodiment.

[0052] Figure 4 Schematic diagram of the structure of the security management module of this embodiment.

[0053] Figure 5 Schematic diagram of the structure of the safety monitoring module of this embodiment. DETAILED DESCRIPTION

[0054] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0055] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0056] It should be noted that in the description of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0057] See also Figure 1 As shown, it is a structural diagram of a pet safety monitoring system based on the Internet of Things in this embodiment, and the system includes:

[0058] An information acquisition module is used to obtain historical network traffic data, network traffic data, device behavior data, key information and security information. The historical network traffic data is the number of data packets transmitted by the pet data intelligent collection device to the cloud server in each historical monitoring period. The data packet is the basic unit in network communication. The network traffic data is the number of data packets transmitted by the pet data intelligent collection device to the cloud server. The device behavior data includes the CPU usage rate and device memory usage rate of the pet data intelligent collection device. The device CPU usage rate and device memory usage rate are the average CPU usage rate and average memory usage rate of all devices. The key information includes the key usage frequency and the number of key usage times. The key is the key used for the pet data intelligent collection device to transmit to the cloud server. The security information includes the number of security events and the average response time of security events. The security events include but are not limited to unauthorized access attempts, DDoS Attack, etc., the average response time of the security incident is the average time from detecting the security incident to taking action; in this embodiment, the setting of the historical monitoring period is not specifically limited, and technical personnel in this field can set it freely, and it only needs to meet the setting requirements of the historical monitoring period, wherein the historical monitoring period can be set to 30 seconds, 60 seconds, etc.; in this embodiment, the method for obtaining historical network traffic data, network traffic data, device behavior data, key information and security information is not specifically limited, and technical personnel in this field can set it freely, and it only needs to meet the requirements for obtaining historical network traffic data, network traffic data, device behavior data, key information and security information, wherein the historical network traffic data, network traffic data, key information and security information can be obtained through the cloud server, and the device behavior data can be obtained through the pet data intelligent collection device; in this embodiment, the pet data intelligent collection device is not specifically limited, and technical personnel in this field can set it freely, such as it can be set to a smart collar, etc.

[0059] Please continue reading Figure 1 As shown, the system also includes a traffic analysis module, which is used to analyze the abnormality of network traffic based on the acquired historical network traffic data and the network traffic data acquired during the monitoring period to improve the accuracy of data transmission security warning to users, and the traffic analysis module is connected to the information acquisition module;

[0060] The analysis process of network traffic anomalies is as follows:

[0061] when When the traffic analysis module determines that the network traffic in the current monitoring period is normal;

[0062] when When the traffic analysis module determines that the network traffic in the current monitoring period is abnormal;

[0063] Where X is the number of transmitted data packets obtained during the monitoring period, α is the preset abnormal threshold, and μ is the average number of transmitted data packets in each historical monitoring period. , mi is the number of data packets transmitted in the i-th historical monitoring period, I is the number of historical monitoring periods, σ is the standard deviation of the number of data packets transmitted in each historical monitoring period, The traffic analysis module analyzes network traffic anomalies to improve the accuracy of key update cycle and firewall rule transmission cycle management.

[0064] Specifically, the duration of the monitoring period in this embodiment should be the same as the duration of the historical monitoring period. In this embodiment, no specific limitation is made on the setting of the preset abnormal threshold, and technical personnel in this field can set it freely as long as the setting requirements of the preset abnormal threshold are met. Among them, the optimal value of α is 3.

[0065] Please continue reading Figure 1 As shown, the system also includes a device behavior analysis module, which is used to analyze the operating status of the device according to the device behavior data obtained during the monitoring period. The device behavior analysis module is connected to the information acquisition module; please refer to Figure 2 As shown, the device behavior analysis module includes:

[0066] The first device analysis unit is used to compare the device CPU usage c0 obtained during the monitoring period with the preset CPU usage c1 to improve the accuracy of the abnormality analysis of the device CPU usage, and analyze the abnormality of the device CPU usage according to the comparison result.

[0067] The process of analyzing abnormal CPU usage of a device is as follows:

[0068] When c0≤c1, the first device analysis unit determines that the device CPU usage rate in the current monitoring period is normal;

[0069] When c0>c1, the first device analysis unit determines that the device CPU usage in the current monitoring period is abnormal; the first device analysis unit analyzes the operating status of the device to improve the accuracy of data transmission security warnings to users, thereby improving the accuracy of key update cycle and firewall rule transmission cycle management.

[0070] Specifically, the first device analysis unit does not impose any specific limitation on the setting of the preset CPU usage rate, and those skilled in the art can freely set it as long as the setting requirements of the preset CPU usage rate are met, wherein the optimal value of c1 is 0.7.

[0071] Please continue reading Figure 2As shown, the device behavior analysis module also includes a second device analysis unit, which is used to analyze the operating status of the device during the monitoring period according to the analysis result of the abnormality of the device CPU usage rate and the device memory usage rate n0 obtained during the monitoring period, so as to improve the accuracy of the abnormality analysis of the device memory usage rate, and the second device analysis unit is connected to the first device analysis unit;

[0072] The analysis process of the equipment's operating status during the monitoring period is as follows:

[0073] If the CPU usage rate of the device in the current monitoring period is normal, when n0≤n1, the second device analysis unit determines that the operation status of the device in the current monitoring period is normal; when n0>n1, the second device analysis unit determines that the operation status of the device in the current monitoring period is abnormal;

[0074] If the CPU usage rate of the device in the current monitoring period is abnormal, when n0≤n1×exp[-(c0-c1) / (c0+c1)], the second device analysis unit determines that the operation status of the device in the current monitoring period is normal; when n0>n1×exp[-(c0-c1) / (c0+c1)], the second device analysis unit determines that the operation status of the device in the current monitoring period is abnormal;

[0075] Among them, n1 is the preset memory usage rate; the second device analysis unit analyzes the operating status of the device to improve the accuracy of data transmission security warning to the user, thereby improving the accuracy of key update cycle and firewall rule transmission cycle management.

[0076] Specifically, the second device analysis unit does not impose any specific limitation on the setting of the preset memory usage rate, and those skilled in the art can freely set it as long as the setting requirements of the preset memory usage rate are met, wherein the best value of n1 is 0.6.

[0077] Please continue reading Figure 1 As shown, the system also includes a security warning module, which is used to provide a data transmission security warning to the user based on the analysis results of the abnormality of network traffic and the device operation status within the management period, so as to improve the accuracy of the data transmission security warning to the user, and the security warning module is connected with the traffic analysis module and the device behavior analysis module;

[0078] The analysis process of providing data transmission security warning to users is as follows:

[0079] When {exp[(i1 / i0)]-1} / 3+γ×i2 / i0≤p, the security warning module does not issue a data transmission security warning to the user;

[0080] When {exp[(i1 / i0)]-1} / 3(i1 / i0)×(π / 4)]+γ×i2 / i0>p, the security warning module issues a data transmission security warning to the user;

[0081] Among them, i1 is the number of monitoring cycles of abnormal network traffic within the management cycle, i2 is the number of monitoring cycles of abnormal device operation status within the management cycle, i0 is the number of monitoring cycles within the management cycle, γ is the preset adjustment coefficient, 0.5<γ<0.7, and p is the preset abnormality coefficient; the security warning module improves the accuracy of key update cycle and firewall rule transmission cycle management, thereby improving the security of pet data.

[0082] Specifically, in this embodiment, there is no specific limitation on the setting of the management period, and those skilled in the art can set it freely, as long as the setting requirements of the management period are met. The setting of the management period should be greater than the setting of the monitoring period, and the management period can be set to 2h, 3h, etc.; in this embodiment, there is no specific limitation on the setting of the preset adjustment coefficient and the preset abnormality coefficient, and those skilled in the art can set it freely, as long as the setting requirements of the preset adjustment coefficient and the preset abnormality coefficient are met. The optimal value of γ is 0.53, and the optimal value of p is 0.26.

[0083] Please continue reading Figure 1 As shown, the system also includes an encryption analysis module, which is used to analyze the abnormality of data encryption within the management period according to the key usage frequency and the number of key usages obtained within the management period. The encryption analysis module is connected to the security warning module, see Figure 3 As shown, the encryption analysis module includes:

[0084] The first encryption analysis unit is used to compare the key usage frequency s0 obtained in the management period with the preset frequency s1 to improve the accuracy of the frequency anomaly index analysis, and analyze the frequency anomaly index according to the comparison result;

[0085] The analysis process of frequency anomaly index is as follows:

[0086] When s0≤s1, the first encryption analysis unit determines that the usage frequency of the key in the current management period is normal, and sets the frequency abnormality index of the key to K1, setting K1=0;

[0087] When s0>s1, the first encryption analysis unit determines that the usage frequency of the key in the current management period is abnormal, and sets the frequency abnormality index of the key to K2, setting:

[0088] K2=exp[lg(s0-s1) / (s0+s1)]; The first encryption unit analyzes the frequency anomaly index to improve the accuracy of data encryption anomaly analysis, thereby improving the accuracy of key update cycle and firewall rule transmission cycle management, and ultimately improving the security of pet data.

[0089] Specifically, the setting of the preset frequency is not specifically limited in this embodiment, and those skilled in the art can set it freely as long as the setting requirements of the preset frequency are met. Among them, the best value of s1 is 400 times / hour.

[0090] Please continue reading Figure 3 As shown, the encryption analysis module also includes a second encryption analysis unit, which is used to compare the number of key usages r0 obtained in the management period with the preset number of times r1 to improve the accuracy of the usage anomaly index analysis, and analyze the usage anomaly index according to the comparison result;

[0091] The analysis process of the usage frequency abnormality index is as follows:

[0092] When r0≤r1, the second encryption analysis unit determines that the number of times the key is used in the current management period is normal, and sets the abnormal index of the number of times the key is used to D1, setting D1=0;

[0093] When r0>r1, the second encryption analysis unit determines that the number of times the key is used in the current management period is abnormal, and sets the abnormal index of the number of times the key is used to D2, setting D2=ln[1+(r0-r1) / (r0+r1)]; the second encryption analysis unit analyzes the abnormal index of the number of times used to improve the accuracy of data encryption abnormality analysis, thereby improving the accuracy of key update cycle and firewall rule transmission cycle management.

[0094] Specifically, in this embodiment, there is no specific limitation on the setting of each weight and the preset encryption anomaly coefficient. Those skilled in the art can set it freely as long as the setting requirements of each weight and the preset encryption anomaly coefficient are met. Among them, the best value of w1 is 0.34, the best value of w2 is 0.66, and the best value of u is 0.216.

[0095] Please continue reading Figure 3 As shown, the encryption analysis module also includes an encryption anomaly analysis unit, which analyzes the anomaly of data encryption within the management period according to the analysis results of the key frequency anomaly index and the key usage count anomaly index within the management period to improve the accuracy of data encryption anomaly analysis, and the encryption anomaly analysis unit is connected to the first encryption analysis unit and the second encryption analysis unit;

[0096] The abnormality analysis process of data encryption within the management cycle is as follows:

[0097] When w1×key frequency abnormality index+w2×key usage times abnormality index≤u, the encryption abnormality analysis unit determines that the encryption of the current management period data is normal;

[0098] When w1×key frequency anomaly index+w2×key usage times anomaly index>u, the encryption anomaly analysis unit determines that the encryption of the current management period data is abnormal;

[0099] Among them, w1 is the frequency weight, w2 is the number weight, w1+w2=1, w1≤w2, u is the preset encryption anomaly coefficient, 0.183<u<0.285; the encryption anomaly analysis unit improves the accuracy of key update cycle and firewall rule transmission cycle management, and at the same time improves the security of pet data.

[0100] Specifically, in this embodiment, there is no specific limitation on the setting of each weight and the preset encryption anomaly coefficient. Those skilled in the art can set it freely as long as the setting requirements of each weight and the preset encryption anomaly coefficient are met. Among them, the best value of w1 is 0.34, the best value of w2 is 0.66, and the best value of u is 0.216.

[0101] Please continue reading Figure 1 As shown, the system also includes a security management module, which is used to manage the key update cycle and firewall rule transmission cycle of the next transmission cycle according to the data security warning and data encryption abnormality analysis results provided to the user during the transmission cycle. The security management module is connected to the security warning module and the encryption analysis module; please refer to Figure 4 As shown, the security management module includes:

[0102] A key update unit is used to manage the key update period of the next transmission period according to the analysis results of the data security warning to the user and the analysis results of the data encryption abnormality during the transmission period, so as to improve the accuracy of the key update period management of the next transmission period;

[0103] The key update cycle is managed as follows:

[0104] When j1 / j0-lg(j2 / j0+1)≤β, the key update unit determines that the security status of the data in the current transmission cycle is normal, and sets the key update period of the next transmission cycle to Y1, and sets Y1=y0;

[0105] When j1 / j0-lg(j2 / j0+1)>β, the key update unit determines that the security status of the data in the current transmission period is abnormal, and sets the key update period of the next transmission period to Y2, setting Y2=y0×{1-exp{j1 / j0-lg(j2 / j0+1)-β} / (e-1)}, where e is a natural logarithm;

[0106] Among them, j1 is the number of management cycles of data encryption anomalies within the transmission cycle, j2 is the number of management cycles for issuing data security warnings to users within the transmission cycle, j0 is the number of management cycles within the transmission cycle, β is the preset state coefficient, 0<β<0.13, y0 is the preset key update cycle; the key update unit analyzes the key update cycle of the next transmission cycle to improve the security of pet data.

[0107] Specifically, in this embodiment, there is no specific limitation on the setting of the transmission period, and those skilled in the art can set it freely, as long as the design requirements of the transmission period are met. Among them, the setting of the transmission period should be greater than the setting of the management period, and the transmission period can be set to 60 days, 80 days, etc.; in this embodiment, the firewall rules are the firewall rules of the cloud server, and the firewall rules of the cloud server are a set of security measures for controlling the network traffic in and out of the server. In this embodiment, there is no specific limitation on the setting of the firewall rules of the cloud server, and those skilled in the art can set it freely, as long as the setting requirements of the firewall rules of the cloud server are met. Among them, the firewall rules of the cloud server should include but are not limited to access control rules, NAT rules, QoS rules, application layer rules, state detection rules, DDoS protection rules, etc.; in this embodiment, there is no specific limitation on the setting of the preset state coefficient and the preset key update period, and those skilled in the art can set it freely, as long as the setting requirements of the preset state coefficient and the preset key update period are met, and the optimal value of β is 0.1, and the optimal value of y0 is 10 days.

[0108] Please continue reading Figure 4 As shown, the security management module also includes a firewall update unit, which is used to manage the transmission cycle of the firewall rule of the next transmission cycle according to the analysis result of the data encryption abnormality, so as to improve the accuracy of the transmission cycle management of the firewall rule of the next transmission cycle, and the firewall update unit is connected to the key update unit;

[0109] The transmission cycle of firewall rules is managed as follows:

[0110] When j1 / j0≤E, the firewall update unit determines that the data encryption of the current transmission cycle is normal, and sets the transmission cycle of the firewall rule of the next transmission cycle to G1, and sets G1=g0;

[0111] When j1 / j0>E, the firewall update unit determines that the data encryption of the current transmission cycle is abnormal, and sets the transmission cycle of the firewall rule of the next transmission cycle to G2, setting G2=g0×[1-(j1 / j0-E)2];

[0112] Wherein, E is a preset proportional coefficient, and g0 is a preset firewall transmission period; the firewall update unit manages the transmission period of the firewall rules of the next transmission period to improve the security of the pet data.

[0113] Specifically, in this embodiment, there is no specific limitation on the setting of the preset proportional coefficient and the preset firewall transmission period. Those skilled in the art can set them freely as long as the setting requirements of the preset proportional coefficient and the preset firewall transmission period are met. Among them, the optimal value of E is 0.28, and the optimal value of g0 is 14 days.

[0114] Please continue reading Figure 1 As shown, the system also includes a security monitoring module, which is used to optimize the management process of the key update cycle of the next transmission cycle according to the number of security events obtained in the transmission cycle and the average response time of the security events. The security monitoring module is connected to the security management module. Please refer to Figure 5 As shown, the security monitoring module includes an event monitoring unit, which is used to compare the number of security events h0 obtained during the transmission period with the preset number of events h1, and optimize the management process of the key update period according to the comparison result to reduce the impact of the abnormal number of security events on the key update period management;

[0115] The process of optimizing the management process of the key update cycle is as follows:

[0116] When h0≤h1, the event monitoring unit determines that the number of security events in the current transmission period is normal and does not perform optimization;

[0117] When h0>h1, the event monitoring unit determines that the number of security events in the current monitoring cycle is abnormal, and optimizes the management process of the key update cycle, and sets the optimized preset state coefficient to β', setting β'=β×{1-ln[(h0-h1) / (h0+h1)+1] / ln2}; the event monitoring unit analyzes the abnormality of the number of security events in the current monitoring cycle to improve the accuracy of the key update cycle management in the next transmission cycle, thereby improving the security of pet data.

[0118] Specifically, in this embodiment, there is no specific limitation on the setting of the preset number of events, and those skilled in the art can set it freely, as long as the setting requirements of the preset number of events are met. Among them, when the management cycle is 60 days, the best value of h1 is 100.

[0119] Please continue reading Figure 5 As shown, the security monitoring module also includes a response monitoring unit, which is used to compare the average response time t0 of the security event obtained within the transmission period with the preset response time t1, and perform secondary optimization on the management process of the key update period according to the comparison result, so as to reduce the impact of the abnormal response time of the security event on the key update period management, and the response monitoring unit is connected to the event monitoring unit;

[0120] The process of secondary optimization of the management process of the key update cycle is as follows:

[0121] When t0≤t1, the response monitoring unit determines that the average response time of the security event in the current transmission period is normal and does not perform optimization;

[0122] When t0>t1, the response monitoring unit determines that the average response time of the security event of the current transmission cycle is abnormal, and performs secondary optimization on the management process of the key update cycle, and sets the optimized preset number of events to h1', and sets h1'=h1×[1-η×(t0-t1) / (t0+t1)], where η is the preset optimization coefficient, 0.2<η<0.36; the response monitoring unit performs secondary optimization on the management process of the key update cycle to improve the accuracy of the key update cycle management of the next transmission cycle, thereby improving the security of the pet data.

[0123] Specifically, those skilled in the art can set it freely as long as the setting requirements of the preset response time and the preset optimization coefficient are met. Among them, when the management cycle is 60 days, the optimal value of t1 is 120 seconds, and the optimal value of η is 0.3.

[0124] Specifically, the IoT-based pet safety monitoring system described in this embodiment is applied to a cloud server. It monitors network traffic and abnormal device behavior, provides data security warnings to users, and manages the key update cycle and firewall rule transmission cycle based on the analysis results of encryption anomalies, thereby improving the security of pet data.

[0125] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

Claims

1. A pet safety monitoring system based on the Internet of Things, characterized in that: include, Information acquisition module, used to obtain historical network traffic data, network traffic data, device behavior data, key information and security information; Traffic analysis module, used to analyze the abnormality of network traffic based on the acquired historical network traffic data and the network traffic data acquired during the monitoring period; The equipment behavior analysis module is used to analyze the operation status of the equipment based on the equipment behavior data obtained during the monitoring period; The security warning module is used to provide data transmission security warnings to users based on the analysis results of network traffic anomalies and equipment operation status within the management cycle; The encryption analysis module is used to analyze the abnormality of data encryption within the management period according to the key usage frequency and key usage times obtained within the management period; The security management module is used to manage the key update cycle and firewall rule transmission cycle of the next transmission cycle according to the data security warning and data encryption abnormality analysis results provided to users during the transmission cycle; A security monitoring module is used to optimize the management process of the key update cycle of the next transmission cycle according to the number of security events obtained during the transmission cycle and the average response time of security events; The security management module is provided with a key update unit and a firewall update unit, and the key update unit is used to manage the key update cycle of the next transmission cycle according to the analysis results of the data security warning to the user and the analysis results of the data encryption abnormality during the transmission cycle, wherein: When j1 / j0-lg(j2 / j0+1)≤β, the key update unit determines that the security status of the data in the current transmission cycle is normal, and sets the key update period of the next transmission cycle to Y1, and sets Y1=y0; When j1 / j0-lg(j2 / j0+1)>β, the key update unit determines that the security status of the data in the current transmission period is abnormal, and sets the key update period of the next transmission period to Y2, setting Y2=y0×{1-exp{j1 / j0-lg(j2 / j0+1)-β} / (e-1)}; Wherein, j1 is the number of management cycles of data encryption anomalies within the transmission cycle, j2 is the number of management cycles of data security warnings to users within the transmission cycle, j0 is the number of management cycles within the transmission cycle, β is the preset state coefficient, and y0 is the preset key update cycle; The firewall update unit is used to manage the transmission cycle of the next transmission cycle firewall rule according to the analysis result of the data encryption abnormality, wherein: When j1 / j0≤E, the firewall update unit determines that the data encryption of the current transmission cycle is normal, and sets the transmission cycle of the firewall rule of the next transmission cycle to G1, and sets G1=g0; When j1 / j0>E, the firewall update unit determines that the data encryption of the current transmission cycle is abnormal, and sets the transmission cycle of the firewall rule of the next transmission cycle to G2, setting G2=g0×[1-(j1 / j0-E) 2 ]; Among them, E is the preset proportional coefficient, and g0 is the preset firewall transmission period.

2. The pet safety monitoring system based on the Internet of Things according to claim 1 is characterized in that: The traffic analysis module analyzes the abnormality of network traffic based on the acquired historical network traffic data and the network traffic data acquired during the monitoring period, wherein: when When the traffic analysis module determines that the network traffic in the current monitoring period is normal; when When the traffic analysis module determines that the network traffic in the current monitoring period is abnormal; Wherein, X is the number of transmitted data packets obtained in the monitoring period, α is the preset abnormal threshold, μ is the average number of transmitted data packets in each historical monitoring period, and σ is the standard deviation of the number of transmitted data packets in each historical monitoring period.

3. The pet safety monitoring system based on the Internet of Things according to claim 2 is characterized in that: The device behavior analysis module is provided with a first device analysis unit and a second device analysis unit. The first device analysis unit is used to compare the device CPU usage c0 obtained during the monitoring period with the preset CPU usage c1, and analyze the abnormality of the device CPU usage according to the comparison result, wherein: When c0≤c1, the first device analysis unit determines that the device CPU usage rate in the current monitoring period is normal; When c0>c1, the first device analysis unit determines that the CPU usage of the device in the current monitoring period is abnormal; The second device analysis unit is used to analyze the operation status of the device during the monitoring period according to the analysis result of the abnormality of the device CPU usage rate and the device memory usage rate n0 obtained during the monitoring period, wherein: If the CPU usage rate of the device in the current monitoring period is normal, when n0≤n1, the second device analysis unit determines that the operation status of the device in the current monitoring period is normal; when n0>n1, the second device analysis unit determines that the operation status of the device in the current monitoring period is abnormal; If the CPU usage rate of the device in the current monitoring period is abnormal, when n0≤n1×exp[-(c0-c1) / (c0+c1)], the second device analysis unit determines that the operation status of the device in the current monitoring period is normal; when n0>n1×exp[-(c0-c1) / (c0+c1)], the second device analysis unit determines that the operation status of the device in the current monitoring period is abnormal; Among them, n1 is the preset memory usage.

4. The pet safety monitoring system based on the Internet of Things according to claim 3 is characterized in that: The security warning module issues a data security warning to the user based on the analysis results of network traffic anomalies and the analysis results of the device operation status within the management period, wherein: When {exp[(i1 / i0)]-1} / 3(i1 / i0)×(π / 4)]+γ×i2 / i0≤p, the security warning module does not issue a data transmission security warning to the user; When {exp[(i1 / i0)]-1} / 3(i1 / i0)×(π / 4)]+γ×i2 / i0>p, the security warning module issues a data transmission security warning to the user; Among them, i1 is the number of monitoring cycles of abnormal network traffic within the management period, i2 is the number of monitoring cycles of abnormal device operation status within the management period, i0 is the number of monitoring cycles within the management period, γ is the preset adjustment coefficient, and p is the preset abnormal coefficient.

5. The pet safety monitoring system based on the Internet of Things according to claim 4 is characterized in that: The encryption analysis module is provided with a first encryption analysis unit, a second encryption analysis unit and an encryption anomaly analysis unit, wherein the first encryption analysis unit is used to compare the key usage frequency s0 obtained in the management period with the preset frequency s1, and analyze the frequency anomaly index according to the comparison result; The second encryption analysis unit is used to compare the key usage times r0 obtained within the management period with the preset times r1, and analyze the usage times abnormality index according to the comparison result.

6. The pet safety monitoring system based on the Internet of Things according to claim 5 is characterized in that: The encryption anomaly analysis unit analyzes the anomaly of data encryption within the management period according to the analysis results of the key frequency anomaly index and the analysis results of the key usage count anomaly index within the management period, wherein: When w1×key frequency abnormality index+w2×key usage times abnormality index≤u, the encryption abnormality analysis unit determines that the encryption of the current management period data is normal; When w1×key frequency anomaly index+w2×key usage times anomaly index>u, the encryption anomaly analysis unit determines that the encryption of the current management period data is abnormal; Among them, w1 is the frequency weight, w2 is the number weight, and u is the preset encryption anomaly coefficient.

7. The pet safety monitoring system based on the Internet of Things according to claim 1 is characterized in that: The security monitoring module is provided with an event monitoring unit and a response monitoring unit. The event monitoring unit is used to compare the number of security events h0 obtained in the transmission period with the preset number of events h1, and optimize the management process of the key update period according to the comparison result, wherein: When h0≤h1, the event monitoring unit determines that the number of security events in the current transmission period is normal and does not perform optimization; When h0>h1, the event monitoring unit determines that the number of security events in the current monitoring period is abnormal, and optimizes the management process of the key update period, and sets the optimized preset state coefficient to β', setting β'=β×{1-ln[(h0-h1) / (h0+h1)+1] / ln2}.

8. The pet safety monitoring system based on the Internet of Things according to claim 7 is characterized in that: The response monitoring unit compares the average response time t0 of the security events obtained within the transmission period with the preset response time t1, and performs secondary optimization on the management process of the key update period according to the comparison result, wherein: When t0≤t1, the response monitoring unit determines that the average response time of the security event in the current transmission period is normal and does not perform optimization; When t0>t1, the response monitoring unit determines that the average response time of the security events in the current transmission cycle is abnormal, and performs secondary optimization on the management process of the key update cycle, and sets the optimized preset number of events to h1', and sets h1'=h1×[1-η×(t0-t1) / (t0+t1)], where η is the preset optimization coefficient.

Images