Iot device anomaly detection method, device and apparatus, and computer storage medium

Abstract

The embodiment of the present application provides a kind of Internet of Things equipment exception detection method, device, equipment and computer storage medium.The basic information of multiple basic Internet of Things equipment is acquired according to the embodiment of the present application, and the basic information includes communication interface quantity value;According to the communication interface quantity value, the communication channel quantity value of the basic Internet of Things equipment is calculated;In the case where the communication channel quantity value of the basic Internet of Things equipment is greater than the preset channel quantity value, the basic Internet of Things equipment is regarded as the Internet of Things equipment to be detected;The first quantity value of the basic Internet of Things equipment and the second quantity value of the Internet of Things equipment to be detected are counted;According to the first quantity value and the second quantity value, channel acquisition coverage is calculated;In the case where the channel acquisition coverage is greater than the preset coverage, the Internet of Things equipment to be detected is abnormally detected.Reduce computing resources, improve detection efficiency.

Description

Technical Field

[0001] This application belongs to the technical field of Internet of Things (IoT) devices, and particularly relates to a method, apparatus, device, and computer storage medium for detecting anomalies in IoT devices. Background Technology

[0002] With the development of technology, modern society has entered the era of the Internet of Things, and IoT devices have emerged and developed rapidly, gradually becoming an indispensable part of people's daily lives.

[0003] Internet of Things (IoT) devices, which are interconnected devices, allow staff to remotely monitor their operational status. However, with prolonged use, IoT devices may experience security issues such as communication interruptions, data packet loss, unauthorized access, or attacks, or exhibit abnormal behaviors such as transmitting large amounts of data outside of working hours. Therefore, it is necessary to conduct periodic anomaly checks on IoT devices to ensure that the information they return is more accurate.

[0004] In related technologies, the large number of IoT devices and the numerous channels they occupy result in a massive amount of data that needs to be detected. This leads to a significant consumption of computing resources and low efficiency when performing anomaly detection on IoT devices. Summary of the Invention

[0005] This application provides an IoT device anomaly detection method, apparatus, device, and computer storage medium, which can reduce computing resources and improve detection efficiency.

[0006] In a first aspect, embodiments of this application provide a method for detecting anomalies in Internet of Things (IoT) devices, the method comprising:

[0007] Acquire basic information about multiple basic IoT devices, including the number of communication interfaces;

[0008] Calculate the number of communication channels of the basic IoT device based on the number of communication interfaces;

[0009] If the number of communication channels of the basic IoT device is greater than the preset number of channels, the basic IoT device will be designated as the IoT device to be detected.

[0010] The first quantity value of the basic IoT devices and the second quantity value of the IoT devices to be detected are calculated.

[0011] Calculate the channel acquisition coverage rate based on the first quantity value and the second quantity value;

[0012] If the channel acquisition coverage is greater than the preset coverage, anomaly detection is performed on the IoT device to be detected.

[0013] In one feasible implementation, obtaining the basic information of multiple IoT devices includes:

[0014] Obtain the network information of the Internet of Things (IoT) where the basic IoT device is located;

[0015] Draw a network topology diagram based on the network information;

[0016] The network topology is scanned to obtain basic information about each of the basic IoT devices.

[0017] In one feasible implementation, when the channel acquisition coverage is less than a preset coverage, the method further includes:

[0018] The basic IoT devices are sampled according to a preset sampling rule, the second quantity value is updated, and the step of calculating the channel collection coverage based on the first quantity value and the second quantity value is returned.

[0019] In one feasible implementation, the step of sampling the basic IoT devices according to a preset sampling rule and updating the second quantity value includes:

[0020] The basic IoT devices are sampled with equal probability to obtain sampled IoT devices. The equal probability sampling is a sampling method in which each of the basic IoT devices has the same probability of being sampled.

[0021] If the number of communication channels of the sampled IoT devices is not greater than the preset number of channels, the sampled IoT devices are classified as the IoT devices to be detected.

[0022] When the sampled IoT device is classified as the IoT device to be detected, the second quantity value is incremented by one.

[0023] In one feasible implementation, the anomaly detection of the IoT device under test includes:

[0024] Acquire the attribute information, transmitted data information, and received data information of the IoT device to be detected;

[0025] The attribute information, transmitted data information and received data information of the IoT device to be detected are vectorized to obtain the first feature vector of the IoT device to be detected.

[0026] The first feature vector is input into the anomaly detection model to obtain the anomaly detection result.

[0027] In one feasible implementation, the vectorization of the attribute information, transmitted data information, and received data information of the IoT device under test to obtain the first feature vector of the IoT device under test includes:

[0028] The attribute information, transmitted data information, and received data information of the IoT device under test are respectively encoded into characters to obtain encoded characters;

[0029] The encoded characters are sorted in a preset order to obtain a string;

[0030] The string is used as the first feature vector of the IoT device to be detected.

[0031] In one feasible implementation, before inputting the first feature vector into the anomaly detection model to obtain the anomaly detection result, the method further includes:

[0032] Obtain historical sample data of the IoT device under test;

[0033] If the historical sample data includes normal sample data and abnormal sample data, the historical sample data is divided according to a preset allocation principle to obtain a test set and a training set.

[0034] The anomaly detection model is trained based on the test set and the training interface.

[0035] In one feasible implementation, the anomaly detection model includes a calculation unit, a sorting unit, a selection unit, and a determination unit. The step of inputting the first feature vector into the anomaly detection model to obtain the anomaly detection result includes:

[0036] The calculation unit processes the first feature vector to obtain multiple anomaly probabilities of the first feature vector in the anomaly model.

[0037] The anomaly probabilities are sorted by the sorting unit to obtain a sorting result;

[0038] The selection unit selects the output probability based on the sorting result;

[0039] The determining unit determines the IoT device to be detected as an abnormal device when the output probability is not less than a preset probability, and uses the determination that the IoT device to be detected is an abnormal device as an abnormal detection result.

[0040] Secondly, embodiments of this application provide an IoT device anomaly detection apparatus, the apparatus comprising:

[0041] The acquisition module is used to acquire basic information of multiple basic IoT devices, including the number of communication interfaces.

[0042] The first calculation module is used to calculate the number of communication channels for each of the basic IoT devices based on the number of communication interfaces.

[0043] The determination module is used to determine the basic IoT device as an IoT device to be detected when the number of communication channels of the basic IoT device is greater than a preset number of channels.

[0044] The statistics module is used to count the first quantity value of the basic IoT devices and the second quantity value of the IoT devices to be detected;

[0045] The second calculation module is used to calculate the channel acquisition coverage rate based on the first quantity value and the second quantity value;

[0046] An anomaly detection module is used to perform anomaly detection on the IoT device under test when the channel acquisition coverage is greater than a preset coverage.

[0047] Thirdly, embodiments of this application provide an electronic device, the device comprising:

[0048] A processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the Internet of Things device anomaly detection method as described in any one of the first aspects.

[0049] Fourthly, embodiments of this application provide a computer storage medium storing computer program instructions, which, when executed by a processor, implement the IoT device anomaly detection method as described in any one of the first aspects.

[0050] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed, implements the IoT device anomaly detection method described in any one of the first aspects.

[0051] The IoT device anomaly detection method, apparatus, device, and computer storage medium of this application embodiment, when detecting basic IoT devices, screens the basic IoT devices by using the number of communication channels, selecting representative IoT devices to be detected from a large number of basic IoT devices, and then adjusts the IoT devices to be detected by channel acquisition coverage, so as to make the IoT devices to be detected more representative and meet the detection requirements of basic IoT devices. That is, this solution can reduce the number of IoT devices to be detected while meeting the detection requirements of basic IoT devices, thereby reducing computing resources and improving the detection efficiency of basic IoT devices. Attached Figure Description

[0052] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0053] Figure 1 This is a flowchart illustrating an anomaly detection method for IoT devices provided in an embodiment of this application;

[0054] Figure 2 This is a flowchart of obtaining basic information provided in a specific embodiment of this application;

[0055] Figure 3 This is a flowchart of a sampling method provided in a specific embodiment of this application;

[0056] Figure 4 This is a flowchart of an anomaly detection method provided in a specific embodiment of this application;

[0057] Figure 5 This is a schematic diagram of the structure of an IoT device anomaly detection device provided in an embodiment of this application;

[0058] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0059] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0060] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0061] To address the problems in the prior art, embodiments of this application provide a method, apparatus, device, and computer storage medium for detecting anomalies in Internet of Things (IoT) devices.

[0062] This application, when testing basic IoT devices, filters them using the number of communication channels. Representative IoT devices to be tested are selected from a large pool of basic IoT devices. Then, the channel coverage is adjusted to make the IoT devices to be tested more representative, thus meeting the testing requirements of basic IoT devices. In other words, this solution reduces the number of IoT devices to be tested while still meeting the testing requirements, thereby reducing computing resources and improving the testing efficiency of basic IoT devices.

[0063] The following section first introduces a method for detecting anomalies in Internet of Things (IoT) devices provided in the embodiments of this application.

[0064] Figure 1 This illustration shows a flowchart of an anomaly detection method for IoT devices according to an embodiment of this application. Figure 1 As shown, the method may include the following steps S101-S106:

[0065] S101, obtain basic information of multiple basic IoT devices.

[0066] In this embodiment, the electronic device obtains basic information about multiple basic IoT devices under the IoT through the Internet or a preset database.

[0067] As an example, basic information may include the number of communication interfaces.

[0068] As another example, basic information may also include at least one of the device model and device label.

[0069] See Figure 2 As an optional implementation of S101, S101 may include:

[0070] S1011. Obtain the network information of the Internet of Things (IoT) where the basic IoT device is located;

[0071] S1012. Draw a network topology diagram based on network information;

[0072] S1013. Scan the network topology to obtain basic information for each basic IoT device.

[0073] In one embodiment, the electronic device uses a network scanning tool to obtain network information of the Internet of Things (IoT) to which the basic IoT device is located via the Internet. The network information includes network connection information, device model, and device status information. The network scanning tool can be Nmap or Advanced IP Scanner. The network scanning tool is only one means of obtaining network information of the basic IoT device and will not be described in detail here.

[0074] By selecting the corresponding scan type using a network scanning tool, the number of communication interfaces of the basic IoT devices and the connection relationships between each basic IoT device are determined based on the obtained network connection information. At the same time, the working status of the devices is obtained through the device status information, which includes online status, connection status, and running status.

[0075] If the basic IoT devices are offline or have no connection with other devices, they can be observed directly, allowing for initial screening of the basic IoT devices.

[0076] After obtaining the network information of the basic IoT devices, a network topology diagram is drawn based on the network information using a generation tool. The electronic devices then scan the generated network topology diagram again to obtain the basic information of each basic IoT device. The network connection information, device model, and device status information of each IoT device can be displayed on the network topology diagram, making it easier for staff or electronic devices to scan and detect the basic IoT devices, thereby achieving rapid acquisition of the basic information of the basic IoT devices.

[0077] In another alternative implementation, staff can manually input the network topology diagram of the Internet of Things (IoT) where the basic IoT devices are located and the basic information of all basic IoT devices into the electronic device. The electronic device then establishes a preset database based on the manually input network topology diagram and basic information. When the electronic device performs basic IoT device detection, it obtains the basic information of the basic IoT devices through the preset database.

[0078] S102, calculate the number of communication channels of the basic IoT device based on the number of communication interfaces.

[0079] In one embodiment, the device model, number of communication interfaces, and device tag of the basic IoT device can be determined based on the obtained basic information. As an example, the electronic device can understand the function of the basic IoT device through the device model and the location of the basic IoT device through the device tag.

[0080] After determining the device model, the electronic device can learn the number of communication interfaces that the basic IoT device has, and then calculate the number of communication channels of the basic IoT device based on the number of communication interfaces.

[0081] For example, basic IoT device a has 3 communication interfaces, namely communication interface A, communication interface B and communication interface C. Among them, communication interface A has 2 communication channels, communication interface B has 3 communication channels and communication interface C has 5 communication channels. Therefore, the number of communication channels of basic IoT device a is 2+3+5=10.

[0082] It is worth noting that the number of communication interfaces and communication channels of basic IoT devices can be directly obtained by scanning the network topology diagram.

[0083] In one embodiment, the number of communication channels of the basic IoT device needs to be calculated regardless of whether the basic IoT device is connected to other devices through communication channels. For example, the basic IoT device a has 10 communication channels, but only 7 of them are used to connect to other IoT devices, leaving 3 communication channels unused. However, the number of the 3 unused communication channels still needs to be calculated.

[0084] S103, if the number of communication channels of the basic IoT device is greater than the preset number of channels, the basic IoT device is identified as the IoT device to be detected, and the process proceeds to step S104.

[0085] In one embodiment, when screening basic IoT devices, the basic IoT devices are screened by determining whether the number of communication channels of the basic IoT device is greater than a preset number of channels. That is, the more communication channels a basic IoT device has, the more other basic IoT devices are connected to it. If a basic IoT device malfunctions, more other basic IoT devices will be affected. Therefore, basic IoT devices with a number of communication channels greater than the preset number of channels should be selected as IoT devices to be tested, which can make the IoT devices to be tested more representative.

[0086] It is worth noting that the preset channel quantity value can be set according to the proportion of the number of communication channels of all basic IoT devices under the Internet of Things. For example, if there are a total of 100 basic IoT devices and the average number of communication channels of all basic IoT devices is 10, then the preset channel quantity value is set to 10. There is no limitation here. The preset channel quantity value can filter basic IoT devices with a large number of communication channels.

[0087] S104, count the first quantity of basic IoT devices and the second quantity of IoT devices to be tested.

[0088] In one embodiment, during the screening of basic IoT devices, it is necessary to count the number of basic IoT devices and the number of IoT devices to be tested, so as to determine whether the IoT devices to be tested are representative. The first quantity of basic IoT devices can be quickly determined by the IoT in which the basic IoT devices are located, and the second quantity of IoT devices to be tested can be counted by electronic devices while determining whether the basic IoT devices are IoT devices to be tested.

[0089] S105, calculate the channel acquisition coverage rate based on the first quantity value and the second quantity value.

[0090] In this embodiment, before performing anomaly detection on the IoT device under test, in order to ensure that the IoT device under test is more representative, it is also necessary to calculate the channel acquisition coverage rate. The channel acquisition coverage rate is used to determine whether the second quantity value of the IoT device under test meets the detection requirements.

[0091] In one alternative implementation, the channel acquisition coverage rate is the ratio of a first quantitative value to a second quantitative value, i.e.: ρ = m / M; where ρ is the channel acquisition coverage rate, m is the second quantitative value, and M is the first quantitative value.

[0092] In another optional implementation, after calculating the channel acquisition coverage rate, it is determined whether the channel acquisition coverage rate is greater than the preset coverage rate. If the channel acquisition coverage rate is greater than the preset coverage rate, the process proceeds to S106.

[0093] In one alternative implementation, if the channel acquisition coverage is not greater than the preset coverage, in order to make the detection of the IoT device under test more representative and meet the sampling requirements, it is necessary to sample the basic IoT according to the preset sampling rules, update the second quantity value, and return to S105.

[0094] Since the number of IoT devices to be tested is small and not representative, it is necessary to screen the basic IoT devices again if the channel collection coverage does not meet the preset coverage. This will ensure that the IoT devices to be tested can represent all basic IoT devices and improve the representativeness of the IoT devices to be tested.

[0095] See Figure 3 As an optional embodiment of S105, S105 may include:

[0096] S1051. Perform equal probability sampling on basic IoT devices to obtain sampled IoT devices.

[0097] S1052. When the number of communication channels of the sampled IoT device is not greater than the preset channel number threshold, the sampled IoT device is identified as the IoT device to be detected.

[0098] S1053. When a sampled IoT device is classified as an IoT device to be tested, the second quantity value is incremented by one.

[0099] In this embodiment, since basic IoT devices with a communication channel count greater than a preset channel count are selected as IoT devices to be detected, there are still basic IoT devices with a communication channel count less than the preset channel count. In order to meet the sampling requirements and make the anomaly detection of the IoT devices to be detected more representative, it is necessary to perform equal probability sampling on the basic IoT devices again to obtain sampled IoT devices. As an example, equal probability sampling is a sampling method in which each of the basic IoT devices has the same probability of being sampled.

[0100] In one feasible approach, equal probability sampling can be sampling with replacement. Sampling with replacement ensures that the basic IoT devices selected each time are independent of each other, and each basic IoT device has the same probability of being selected, thus ensuring the universality of the selected basic IoT devices. Moreover, equal probability sampling can well reflect the characteristics of the basic IoT devices, ensuring the accuracy and reliability of the sampling results.

[0101] Since the aforementioned steps have already identified basic IoT devices with a communication channel count greater than the preset channel count as IoT devices to be tested, this sampling process actually selects basic IoT devices with a communication channel count not greater than the preset channel count. If an IoT device to be tested is selected, resampling is performed. If the communication channel count of the sampled IoT devices is not greater than the preset channel count, the sampled IoT devices are classified as IoT devices to be tested. Because the sampled IoT devices are classified as IoT devices to be tested, the second quantity value of the IoT devices to be tested changes, so the second quantity value needs to be updated.

[0102] To ensure the accuracy of channel acquisition coverage, as an example, the channel acquisition coverage needs to be recalculated based on the updated second quantity value. Resampling is stopped if the channel acquisition coverage exceeds the preset coverage.

[0103] S106, Perform anomaly detection on the IoT device under test.

[0104] In this embodiment, after screening the basic IoT devices to obtain the IoT devices to be detected, anomaly detection is performed on the IoT devices to be detected. Compared with detecting all basic IoT devices, the number of IoT devices to be detected is less than the number of basic IoT devices, which can reduce computing resources. At the same time, screening the basic IoT devices in advance can improve detection efficiency.

[0105] When testing basic IoT devices, the number of communication channels is used to screen the devices, selecting representative IoT devices to be tested from a large pool. Then, the channel coverage is adjusted to make the IoT devices to be tested more representative, thus meeting the testing requirements of basic IoT devices. In other words, this solution can reduce the number of IoT devices to be tested while still meeting the testing requirements, thereby reducing computing resources and improving the testing efficiency of basic IoT devices.

[0106] To improve the detection efficiency of anomaly detection models, see [link to relevant documentation]. Figure 4 As an optional implementation of S106, S106 may include:

[0107] S1061. Obtain the attribute information of the IoT device to be detected, send data information, and receive data information;

[0108] S1062. Vectorize the attribute information, transmitted data information and received data information of the IoT device to be detected to obtain the first feature vector of the IoT device to be detected.

[0109] S1063. Input the first feature vector into the anomaly detection model to obtain the anomaly detection result.

[0110] In one embodiment, the attribute information may include MAC address, IP address, communication interface number, and communication protocol number; the data transmission information may include data packet size and data packet transmission time; and the data reception information may include the MAC address, IP address, and communication interface number of the underlying IoT device receiving the data.

[0111] Vectorizing the attribute information, transmitted data information, and received data information of the IoT device to be detected can convert the scalar form of attribute information, transmitted data information, and received data information into vector code, thereby improving computational efficiency, accelerating the detection of anomaly detection models, and reducing the computational resources and memory usage.

[0112] As an optional implementation of S1062, S1062 may include

[0113] The IoT device under test encodes its attribute information, transmitted data information, and received data information into encoded characters.

[0114] The encoded characters are sorted according to a preset order to obtain a string;

[0115] The string is used as the first feature vector of the IoT device to be detected.

[0116] In one embodiment, when vectorizing the attribute information, transmitted data information, and received data information of the IoT device to be detected, the attribute information, transmitted data information, and received data information need to be encoded into characters to obtain the encoded characters corresponding to each piece of information. The encoded characters can be quickly concatenated into a first feature vector so that the anomaly detection model can quickly detect through the first feature vector, thereby improving detection efficiency.

[0117] For example, the MAC address, IP address, communication interface number, and communication protocol number in the attribute information are each character-encoded. The MAC address corresponds to a separate first encoded character, the IP address corresponds to a separate second encoded character, the communication interface number corresponds to a separate third encoded character, the communication protocol number corresponds to a separate fourth encoded character, the data packet size corresponds to a separate fifth encoded character, the data packet sending time corresponds to a separate sixth encoded character, the MAC address of the IoT device receiving the data corresponds to a separate seventh encoded character, the IP address of the IoT device receiving the data corresponds to a separate eighth encoded character, and the communication interface number of the IoT device receiving the data corresponds to a separate ninth encoded character. Then, the first, second, third, fourth, fifth, sixth, seventh, eighth, and ninth encoded characters are sorted in a preset order and concatenated.

[0118] It is worth noting that the preset order is set manually, and the electronic device only needs to be able to recognize it; no restrictions are required.

[0119] For example, the first feature vector can be sorted and concatenated in the order of the first coded character, the second coded character, the third coded character, the fourth coded character, the fifth coded character, the sixth coded character, the seventh coded character, the eighth coded character, and the ninth coded character. The order can also be shuffled. In addition, the above is just an example. The first feature vector can also be obtained by concatenating two first coded characters, two fifth coded characters, and two seventh coded characters. This is not limited here.

[0120] In this embodiment, the first encoded character, the second encoded character, the third encoded character, the fourth encoded character, the fifth encoded character, the sixth encoded character, the seventh encoded character, the eighth encoded character, and the ninth encoded character are concatenated in that order.

[0121] In another optional implementation, to ensure that the anomaly detection model is trained more comprehensively, the following steps are included before S1063:

[0122] Acquire historical sample data of the IoT device under test;

[0123] Given that the historical sample data includes both normal and abnormal sample data, the historical sample data is divided according to a preset allocation principle to obtain the test set and the training set.

[0124] The anomaly detection model is trained based on the test set and the training set.

[0125] In this optional embodiment, after obtaining the first feature vector, before inputting the first feature vector into the anomaly detection model, the anomaly detection model is first trained to improve the anomaly detection efficiency. The anomaly detection model can be a random forest model.

[0126] When selecting training and testing sets for training, it is necessary to ensure that there are anomalous samples in the training and testing sets. By obtaining historical sample data of the IoT devices to be tested, the presence of anomalous samples in the training and testing sets can be guaranteed to the greatest extent possible.

[0127] After obtaining the historical sample data, the training set and test set are divided according to a preset allocation ratio. As an example, the preset allocation ratio can be 80% of the historical sample data as the training set and 20% of the historical sample data as the test set. As another example, the preset allocation ratio can also be 60% of the historical sample data as the training set and 40% of the historical sample data as the test set. No limitation is made here.

[0128] It is worth noting that in this optional implementation, if only normal sample data exists in the historical sample data, it is necessary to obtain abnormal sample data as a test set through other detection methods such as log analysis, port scanning, or using machine learning to identify abnormal traffic. The above-mentioned other detection methods are existing technical means and will not be elaborated here.

[0129] In another optional embodiment, the anomaly detection model includes a calculation unit, a sorting unit, a selection unit, and a determination unit, and S1063 may include:

[0130] The calculation unit performs calculations on the first feature vector to obtain multiple anomaly probabilities of the first feature vector in the anomaly model.

[0131] The sorting unit sorts the anomaly probabilities to obtain the sorting result;

[0132] The selected unit selects the output probability based on the sorting results;

[0133] The determination unit determines that the IoT device to be detected is an abnormal device if the output probability is not less than the preset probability, and takes the determination that the IoT device to be detected is an abnormal device as the abnormal detection result.

[0134] In this embodiment, a trained anomaly detection model is used to detect the first feature vector. Since a random forest model is used as the anomaly detection model, when the first feature vector is input into the anomaly detection model, the first feature vector is detected in each decision tree of the random forest model, so multiple anomaly probabilities can be obtained. Since the anomaly detection model needs to output the most representative anomaly probability, the anomaly probabilities need to be selected so that the anomaly detection model can detect the IoT device to be detected based on the anomaly probability.

[0135] In one example, multiple anomaly probabilities can be sorted. For instance, they can be sorted in descending order or in ascending order, without any limitation, to obtain the sorting result.

[0136] After sorting the anomaly probabilities, a representative anomaly probability is selected as the output probability. As an example, the selection can be made in a statistical manner, such as selecting the median of the anomaly probabilities, the mode, or the weighted average. There are no restrictions here. Any method of sampling to represent the whole population in statistics can be used. In this embodiment, the average value is used as the output probability.

[0137] After obtaining the output probability, determine whether the output probability is less than the preset probability.

[0138] If the output probability is not less than the preset probability, the IoT device to be detected is determined to be an abnormal device.

[0139] If the output probability is less than the preset probability, the IoT device under test is determined to be a normal device.

[0140] As an example, both "the IoT device under test is an abnormal device" and "the IoT device under test is a normal device" are abnormal detection results.

[0141] When using an anomaly detection model to detect anomalies in IoT devices, a random forest model is used to detect the first feature vector. The first feature vector is calculated multiple times in the decision tree of the computing unit to make the first feature vector more comprehensively reflect the situation of the IoT device under test. Finally, the unit outputs the most accurate anomaly probability. Based on the output probability, the unit can more accurately determine whether the IoT device under test has an anomaly, and the output anomaly detection result is more accurate.

[0142] In another optional implementation, when the IoT device to be tested is determined to be an abnormal device, in order to complete the testing of the IoT device to be tested as soon as possible, it can be determined whether there are any abnormalities between the IoT device to be tested and other IoT devices to be tested.

[0143] Specifically, the first feature vector of the abnormal device is used for feature parsing to obtain the MAC address, IP address, and communication interface number of the IoT device receiving the data. Then, the relevant IoT devices are identified based on the MAC address, IP address, and communication interface number of the IoT device receiving the data. The relevant IoT devices are those connected to the abnormal device. The attribute information, transmitted data information, and received data information of the relevant IoT devices are then converted into a second feature vector, which is input into the anomaly detection model to determine whether the relevant IoT devices have malfunctioned, thus improving detection efficiency.

[0144] When an anomaly detection model detects an IoT device as an anomalous device, further detection is required. At least one anomaly detection method can be used, such as feature importance analysis, anomaly pattern recognition, correlation analysis, anomaly event clustering, and threat intelligence comparison, to perform anomaly analysis and ultimately determine the anomaly status of the IoT device under test.

[0145] 1. Feature Importance Analysis: For IoT devices identified as anomalous by the anomaly detection model, feature importance analysis can be performed on the first feature vector of the anomalous device. This is achieved by examining the importance indices of each feature in the anomaly detection model (such as Gini importance and average impurity reduction). Features with higher importance often indicate potential anomaly threats.

[0146] 2. Abnormal Pattern Recognition: Based on the first feature vector of the abnormal device, perform abnormal pattern recognition analysis, such as viewing the combination pattern of the first feature vector of the abnormal device, the time and frequency of abnormal occurrence, etc., in order to identify possible abnormal patterns and behaviors.

[0147] 3. Association Analysis: By using association rule mining technology, association analysis can be performed on the features in the first feature vector of abnormal devices to discover the relationships between features and further analyze the source of abnormal features and potential threats.

[0148] 4. Abnormal event clustering: Cluster analysis groups anomalous data points with similar characteristics together to form anomalous event clusters, which can help understand the distribution of anomalous data and identify the types and characteristics of anomalous events.

[0149] 5. Threat Intelligence Comparison: Compare and analyze the first feature vector of the abnormal device with known threat intelligence to find out if there are known threat characteristics or behavioral patterns, which helps to quickly identify known threats and take corresponding countermeasures.

[0150] The above methods are all existing technologies and will not be elaborated further here. They are sufficient to further analyze the anomalies of abnormal devices.

[0151] Figure 5 This is a schematic diagram of the structure of an IoT device anomaly detection device 500 provided in an embodiment of this application.

[0152] like Figure 5 As shown, the device may include

[0153] The acquisition module 501 is used to acquire basic information of multiple basic IoT devices, including the number of communication interfaces.

[0154] The first calculation module 502 is used to calculate the number of communication channels for each basic IoT device based on the number of communication interfaces.

[0155] The determination module 503 is used to determine the basic IoT device as the IoT device to be detected when the number of communication channels of the basic IoT device is greater than the preset number of channels.

[0156] The statistics module 504 is used to count the first quantity value of basic IoT devices and the second quantity value of IoT devices to be detected.

[0157] The second calculation module 505 is used to calculate the channel acquisition coverage rate based on the first quantity value and the second quantity value;

[0158] The anomaly detection module 506 is used to perform anomaly detection on the IoT device under test when the channel acquisition coverage is greater than the preset coverage.

[0159] In one optional implementation of this embodiment, the acquisition module 501 is specifically used to acquire the network information of the Internet of Things (IoT) where the basic IoT device is located; draw a network topology diagram based on the network information; and scan the network topology diagram to obtain the basic information of each basic IoT device.

[0160] As an optional implementation of this embodiment, the IoT device anomaly detection device may further include:

[0161] The sampling module is used to sample basic IoT devices according to a preset sampling rule when the channel acquisition coverage is less than the preset coverage, update the second quantity value, and return the steps of calculating the channel acquisition coverage based on the first quantity value and the second quantity value.

[0162] As an optional implementation of this embodiment, the sampling module is further specifically used to sample basic IoT devices according to a preset sampling rule, and update the second quantity value includes: performing equal probability sampling on the basic IoT devices to obtain sampled IoT devices, wherein equal probability sampling is a sampling method in which each basic IoT device has the same probability of being sampled; when the number of communication channels of the sampled IoT devices is not greater than a preset channel number value, classifying the sampled IoT devices as IoT devices to be detected; when the sampled IoT devices are classified as IoT devices to be detected, incrementing the second quantity value by one.

[0163] As an optional implementation of this embodiment, the anomaly detection module 506 is specifically used to acquire the attribute information, transmitted data information, and received data information of the IoT device to be detected; to vectorize the attribute information, transmitted data information, and received data information of the IoT device to be detected to obtain a first feature vector of the IoT device to be detected; and to input the first feature vector into the anomaly detection model to obtain the anomaly detection result.

[0164] As an optional implementation of this embodiment, the anomaly detection module 506 is further specifically used to encode the attribute information, transmitted data information and received data information of the IoT device to be detected into characters to obtain encoded characters; sort the encoded characters in a preset order to obtain a string; and use the string as the first feature vector of the IoT device to be detected.

[0165] As an optional implementation of this embodiment, the anomaly detection module 506 is further specifically used to acquire historical sample data of the IoT device to be detected; when the historical sample data includes normal sample data and abnormal sample data, the historical sample data is divided according to a preset allocation principle to obtain a test set and a training set; and the anomaly detection model is trained based on the test set and the training set.

[0166] As an optional implementation of this embodiment, the anomaly detection module 506 includes a calculation unit, a sorting unit, a selection unit, and a determination unit. The calculation unit is specifically used to calculate and process the first feature vector to obtain multiple anomaly probabilities of the first feature vector in the anomaly model. The sorting unit is specifically used to sort the anomaly probabilities to obtain a sorting result. The selection unit is specifically used to select an output probability based on the sorting result. The determination unit is specifically used to determine that the IoT device to be detected is an abnormal device when the output probability is not less than a preset probability, and to use the fact that the IoT device to be detected is an abnormal device as the anomaly detection result.

[0167] Figure 6 A schematic diagram of the hardware structure of the electronic device provided in an embodiment of this application is shown.

[0168] An electronic device may include a processor 601 and a memory 302 storing computer program instructions.

[0169] Specifically, the processor 601 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0170] Memory 602 may include mass storage for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. In one instance, memory 602 may include removable or non-removable (or fixed) media, or memory 602 may be non-volatile solid-state memory. Memory 602 may be internal or external to the integrated gateway disaster recovery device.

[0171] In one instance, memory 602 may be read-only memory (ROM). In one instance, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0172] Memory 602 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the IoT device anomaly detection method according to the first aspect of this disclosure.

[0173] The processor 601 reads and executes computer program instructions stored in the memory 602 to achieve... Figure 1 An IoT device anomaly detection method is shown in the embodiment.

[0174] In one example, the electronic device may also include a communication interface 603 and a bus 604. Wherein, as... Figure 6 As shown, the processor 601, memory 602, and communication interface 603 are connected through bus 604 and complete communication with each other.

[0175] The communication interface 603 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0176] Bus 604 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Extended Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 604 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, this application contemplates any suitable bus or interconnect.

[0177] The electronic device can execute the IoT device anomaly detection method in the embodiments of this application, thereby achieving a combination of Figures 1-4 The described method and apparatus for detecting anomalies in Internet of Things (IoT) devices.

[0178] Furthermore, in conjunction with the IoT device anomaly detection methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the IoT device anomaly detection methods in the above embodiments.

[0179] In an optional embodiment, in conjunction with the IoT device anomaly detection method in the above embodiments, this application embodiment can provide a computer program product to implement it. The instructions in the computer program product are executed by the processor of the electronic device, enabling the electronic device to implement any of the IoT device anomaly detection methods in the above embodiments.

[0180] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0181] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, read-only memory (ROM), flash memory, erasable read-only memory (EROM), floppy disks, compact disc read-only memory (CD-ROM), optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0182] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0183] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0184] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for detecting anomalies in Internet of Things (IoT) devices, characterized in that, include: Acquire basic information about multiple basic IoT devices, including the number of communication interfaces; Calculate the number of communication channels of the basic IoT device based on the number of communication interfaces; If the number of communication channels of the basic IoT device is greater than the preset number of channels, the basic IoT device will be designated as the IoT device to be detected. The first quantity value of the basic IoT devices and the second quantity value of the IoT devices to be detected are calculated. Calculate the channel acquisition coverage rate based on the first quantity value and the second quantity value; If the channel acquisition coverage is greater than the preset coverage, anomaly detection is performed on the IoT device to be detected.

2. The method according to claim 1, characterized in that, The acquisition of basic information from multiple IoT devices includes: Obtain the network information of the Internet of Things (IoT) where the basic IoT device is located; Draw a network topology diagram based on the network information; The network topology is scanned to obtain basic information about each of the basic IoT devices.

3. The method according to claim 1 or 2, characterized in that, When the channel coverage is less than a preset coverage, the method further includes: The basic IoT devices are sampled according to a preset sampling rule, the second quantity value is updated, and the step of calculating the channel collection coverage based on the first quantity value and the second quantity value is returned.

4. The method according to claim 3, characterized in that, The step of sampling the basic IoT devices according to a preset sampling rule and updating the second quantity value includes: The basic IoT devices are sampled with equal probability to obtain sampled IoT devices. The equal probability sampling is a sampling method in which each of the basic IoT devices has the same probability of being sampled. If the number of communication channels of the sampled IoT devices is not greater than the preset number of channels, the sampled IoT devices are classified as the IoT devices to be detected. When the sampled IoT device is classified as the IoT device to be detected, the second quantity value is incremented by one.

5. The method according to claim 1, characterized in that, The anomaly detection of the IoT device under test includes: Acquire the attribute information, transmitted data information, and received data information of the IoT device to be detected; The attribute information, transmitted data information and received data information of the IoT device to be detected are vectorized to obtain the first feature vector of the IoT device to be detected. The first feature vector is input into the anomaly detection model to obtain the anomaly detection result.

6. The method according to claim 5, characterized in that, The step of vectorizing the attribute information, transmitted data information, and received data information of the IoT device under test to obtain the first feature vector of the IoT device under test includes: The attribute information, transmitted data information, and received data information of the IoT device under test are respectively encoded into characters to obtain encoded characters; The encoded characters are sorted in a preset order to obtain a string; The string is used as the first feature vector of the IoT device to be detected.

7. The method according to claim 5, characterized in that, Before inputting the first feature vector into the anomaly detection model to obtain the anomaly detection result, the method further includes: Obtain historical sample data of the IoT device under test; If the historical sample data includes normal sample data and abnormal sample data, the historical sample data is divided according to a preset allocation principle to obtain a test set and a training set. The anomaly detection model is trained based on the test set and the training interface.

8. The method according to claim 5, characterized in that, The anomaly detection model includes a calculation unit, a sorting unit, a selection unit, and a determination unit. The step of inputting the first feature vector into the anomaly detection model to obtain the anomaly detection result includes: The calculation unit processes the first feature vector to obtain multiple anomaly probabilities of the first feature vector in the anomaly model. The anomaly probabilities are sorted by the sorting unit to obtain a sorting result; The selection unit selects the output probability based on the sorting result; The determining unit determines the IoT device to be detected as an abnormal device when the output probability is not less than a preset probability, and uses the determination that the IoT device to be detected is an abnormal device as an abnormal detection result.

9. An IoT device anomaly detection device, characterized in that, The device includes: The acquisition module is used to acquire basic information of multiple basic IoT devices, including the number of communication interfaces. The first calculation module is used to calculate the number of communication channels for each of the basic IoT devices based on the number of communication interfaces. The determination module is used to determine the basic IoT device as an IoT device to be detected when the number of communication channels of the basic IoT device is greater than a preset number of channels. The statistics module is used to count the first quantity value of the basic IoT devices and the second quantity value of the IoT devices to be detected; The second calculation module is used to calculate the channel acquisition coverage rate based on the first quantity value and the second quantity value; An anomaly detection module is used to perform anomaly detection on the IoT device under test when the channel acquisition coverage is greater than a preset coverage.

10. An electronic device, characterized in that, The device includes: a processor and a memory storing computer program instructions; the processor reads and executes the computer program instructions to implement the IoT device anomaly detection method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer storage medium stores computer program instructions, which, when executed by a processor, implement the IoT device anomaly detection method as described in any one of claims 1-8.

12. A computer program product, characterized in that, The method includes a computer program that, when executed, implements the IoT device anomaly detection method according to any one of claims 1-8.

Images