A monitoring method, system, storage medium and server for an intelligent terminal of the Internet of Things

Abstract

The present application relates to the technical field of information security, and in particular to a monitoring method, system, storage medium and server for an intelligent terminal of the Internet of Things, wherein the method comprises: a database establishment step, an acquisition step, a screening step, an alarm step, a monitoring step, an abnormality judgment step and an incorporation step; wherein the system comprises: a database, an acquisition module, a screening module, a monitoring module, an abnormality judgment module, an alarm module and an incorporation module. The present application has the effect of improving the data security of the Internet of Things system.

Description

Technical Field

[0001] The present application relates to the technical field of information security, and in particular to a monitoring method, system, storage medium and server for an Internet of Things smart terminal. Background Art

[0002] At present, more and more on-board equipment is gradually being improved with intelligence and automatic control to form smart terminals of the Internet of Things, which include industrial Internet of Things, home Internet of Things or optimization of the application layer of Internet of Things protocols, and smart terminals of the Internet of Things are key devices in the Internet of Things. They can access the Internet of Things to realize data collection, processing, transmission and other functions, and may have a certain degree of intelligent decision-making ability; and can collect and calculate the operating information of these on-board equipment through a variety of homogeneous or heterogeneous networks, so as to obtain more convenient equipment automatic control in industrial or commercial fields; however, now a large number of smart terminal devices of the Internet of Things are directly exposed to the Internet, and there may be illegal personnel who simulate the Internet of Things terminals, invade the Internet of Things and obtain information from the end of the data chain, resulting in security risks such as device control, user privacy leakage, and cloud service data theft, which reduces the security of the Internet of Things system. Summary of the invention

[0003] In order to improve the data security of the Internet of Things system, the present application provides an Internet of Things smart terminal monitoring method, system, storage medium and server.

[0004] In the first aspect, the present application provides an IoT smart terminal monitoring method, which adopts the following technical solution:

[0005] A method for monitoring an IoT smart terminal comprises the following steps:

[0006] Establish a database: internally store all terminal information, terminal historical data, terminal identification list, and store all terminal information as the first information;

[0007] Acquiring: acquiring information of a new access terminal and storing the information as second information, wherein the second information includes a feature code of the new access terminal;

[0008] Identification: including virtual library construction steps, feature identification steps and isolation steps;

[0009] Virtual library construction: establish a virtual library to store virtual terminal data and fake user information internally;

[0010] Feature identification: determine whether the feature code of the newly connected terminal exists in the terminal identification list. If so, perform the isolation step; otherwise, perform the alarm step;

[0011] Isolation: Place the newly connected terminal in the virtual library and set the isolation time ,in, , and execute the monitoring step, and store the usage information in the virtual library to form pending information;

[0012] Alarm: Deny new terminals from accessing the IoT and send abnormal information to users or administrators;

[0013] Monitoring: Real-time monitoring of the behavior of newly connected terminals and execution of abnormality judgment steps;

[0014] Abnormal judgment: judge during the isolation period Whether there is abnormal traffic information in the data flow, if so, the alarm step is executed, otherwise, the merging step is executed;

[0015] Incorporate: Integrate new access terminals into the Internet of Things and store pending information in the database.

[0016] By adopting the above technical solution, the historical operation information, terminal information and user information of the terminal are stored in the database, and then the existing terminals are classified, wherein the logic of the classification is to judge and identify according to the importance of the information, and then obtain the terminal information of the newly accessed terminal, and then build a virtual library, and then judge whether the feature code of the newly accessed terminal exists in the terminal identification list according to the information of the newly accessed terminal. If it exists, it is isolated in the virtual library, otherwise, it is refused to join the Internet of Things and the user or administrator is informed; after the newly accessed terminal is placed in the virtual library, real-time monitoring is performed, and it is judged whether there is abnormal traffic information. If it exists, it is removed from the Internet of Things and the user or administrator is informed. If there is no abnormal traffic, it is incorporated into the Internet of Things and the data information is stored in the database; through the method of feature recognition and isolation monitoring, the newly accessed terminal is identified and judged, and the situation that illegal personnel simulate the Internet of Things terminal, invade the Internet of Things and obtain information from the end of the data chain is reduced, and the security risks such as user privacy leakage and cloud service end data theft are reduced, so that the security of the Internet of Things system is improved.

[0017] Optionally, a classification step and a time updating step are further provided between the feature identification step and the isolation step;

[0018] Classification: According to the permission level of the terminal in the first information and the permission level of the newly connected terminal in the second information, all terminals are divided into n levels, where the nth level corresponds to a weight average ;

[0019] Time update: The quarantine time is updated based on the classification information of the newly connected terminal. The updated calculation model is as follows:

[0020] , where The calculation model is as follows: ,in, .

[0021] By adopting the above technical scheme, through the grading step, the terminals are graded according to the terminal's authority level, and the weight of the level of the newly accessed terminal is determined according to the grading situation, and then the calculation model of the isolation time in the time update step is used to calculate the updated isolation time, and then the newly accessed terminal is isolated in the virtual library. Through the setting of the above steps, the isolation time is set according to the importance of the new access terminal, and the newly accessed terminal in isolation is observed and monitored in all directions, thereby reducing the mixing of unsafe terminals or forged virtual terminals into the Internet of Things, reducing the occurrence of illegal personnel simulating Internet of Things terminals, invading the Internet of Things and obtaining information from the end of the data chain, reducing the security risks such as user privacy leakage and cloud service data theft, and improving the security of the Internet of Things system.

[0022] Optionally, after the time updating step, a hierarchical sorting step and a time optimization step are further provided;

[0023] Hierarchical sorting: Each level is sorted according to the authority level, and the weight value is set according to the level and authority level. The higher the level, the higher the corresponding weight value average. The higher the authority level at the same level, the higher the corresponding weight value;

[0024] Time optimization: The isolation time is updated according to the classification information of the newly connected terminal. The updated calculation model is as follows:

[0025] , where The calculation model is as follows:

[0026] , where is the weight value of the new access terminal of the nth level and the jth priority level, is the mean of all terminal weights at level n.

[0027] By adopting the above technical solution, the permissions of all terminals in each level are compared to determine the location of the new access terminal, and then the weight value is re-assigned, and then it is determined whether the weight value of the new access terminal is greater than the weight average. If it is greater, the isolation time is increased. Update it again. Otherwise, the original isolation time of the location is updated again by obtaining the location and weight value of the new access terminal in the current classification, reducing the time for suspicious terminals to enter the Internet of Things, and isolating new access terminals with larger weight values ​​for a long time, reducing the probability of suspicious terminals mixing into the Internet of Things, improving the security of the Internet of Things, reducing security risks such as user privacy leakage and cloud service data theft, and improving the security of the Internet of Things system.

[0028] Optionally, a behavior identification step and an isolation time reduction step are further provided between the abnormality determination step and the incorporation step;

[0029] Behavior recognition: including behavior acquisition step, similarity calculation step and behavior judgment step;

[0030] Behavioral acquisition: During quarantine time In the time interval, extract the working status of a newly accessed terminal at time T and obtain the existing behavior information in the working status , obtain the historical operation behavior information of terminals of the same type or with the same permissions as the newly accessed terminal ;

[0031] Similarity calculation: Calculate existing behavior information Historical operation behavior information Similarity ;

[0032] Behavioral judgment: judging similarity Is there a similarity value less than the set threshold? , if yes, then execute the alarm step, otherwise, execute the isolation time reduction step;

[0033] Isolation time reduction: Reduce the remaining isolation time.

[0034] By adopting the above technical solution, during the isolation process, on the one hand, it is monitored whether there is abnormal traffic, and on the other hand, by obtaining the behavior information in the working state and the historical operation behavior of the same type of terminal or the same authority terminal, the similarity is calculated, and then the similarity is compared with the set similarity threshold. Through the behavior comparison, it is determined whether it is a forged or illegal simulated intrusion behavior, and the suspiciousness of the newly accessed terminal is further checked and screened, thereby reducing the probability of illegal intrusion, reducing the security risks such as user privacy leakage and cloud server data theft, and improving the security of the Internet of Things system.

[0035] Optionally, after the behavior determination step, a mean value calculation step, a mean value determination step and an isolation release step are further provided;

[0036] Mean calculation: calculate a similarities The mean ;

[0037] Mean judgment: judge the mean Is it greater than , if yes, then execute the isolation release step, otherwise, execute the isolation time reduction step;

[0038] Isolation release: Release the isolation status of the newly connected terminal and perform intervention steps.

[0039] By adopting the above technical solution, the average of multiple similarities is calculated, and then the average is compared. When it is greater than the upper threshold of the similarity, the suspicion of the newly accessed terminal can be roughly eliminated, and then the isolation release step can be directly executed, and then it is included in the Internet of Things, and its historical work information is entered into the database. Through the above settings, the isolation time of the trusted terminal is shortened, resource waste is reduced, and the security and reliability of the Internet of Things are increased.

[0040] Optionally, a fluctuation determination step is further provided after the mean determination step;

[0041] Fluctuation judgment: Get the similarity fluctuation range. If the fluctuation range is less than the set threshold B, execute the isolation release step.

[0042] By adopting the above technical solution, when the similarity fluctuation range is less than the set threshold, the suspicion of the newly accessed terminal can be roughly eliminated, and then the isolation release step can be directly executed, and then it will be included in the Internet of Things, and its historical work information will be entered into the database. Through the above settings, the isolation time of the trusted terminal can be shortened, resource waste can be reduced, and the security and reliability of the Internet of Things can be increased.

[0043] In the second aspect, the present application provides an IoT smart terminal monitoring system, which adopts the following technical solutions:

[0044] An IoT intelligent terminal monitoring system includes the following modules:

[0045] Database: internally stores terminal historical data information, terminal information, and user information;

[0046] Acquisition module; used to obtain information of new access terminals;

[0047] Identification module: used to identify whether the new access terminal is in the feature identification list, build a virtual library, and isolate the new access terminal in the feature identification list;

[0048] Monitoring module: real-time monitoring of new access terminals in the virtual library;

[0049] Abnormal judgment module: judges the traffic of the newly accessed terminal under monitoring to determine whether there is any abnormality;

[0050] Alarm module: After judging the behavior and traffic flow, if a terminal is judged as suspicious, the user or administrator will be notified and the terminal will be denied access to the Internet of Things;

[0051] Incorporation module: Incorporate new access terminals without abnormalities into the Internet of Things, and store the generated data information in the database.

[0052] By adopting the above technical solution, a database is built to store terminal information and historical data information, and then the newly accessed terminal is monitored and terminal information is obtained by acquiring the terminal, and then the characteristics of the newly accessed terminal are identified by the identification module. When the characteristics exist in the characteristic identification list, they are isolated and aligned by the monitoring module for real-time monitoring, and the abnormal judgment module is executed to monitor the traffic of the newly accessed terminal under monitoring to determine whether there is abnormal traffic. If so, an alarm is executed, otherwise, the incorporation module is executed to incorporate it into the Internet of Things; through the setting of the above modules, by performing characteristic identification and traffic identification on the newly accessed terminal, the suspiciousness of the newly accessed terminal is screened out, the probability of illegal intrusion is reduced, and the security risks such as user privacy leakage and cloud service data theft are reduced, so that the security of the Internet of Things system is improved.

[0053] In a third aspect, the present application provides a storage medium, which adopts the following technical solution:

[0054] A storage medium stores a computer program, which, when executed by one or more processors, implements a method for monitoring an Internet of Things smart terminal.

[0055] In a fourth aspect, the present application provides a server, which adopts the following technical solution:

[0056] A server comprises a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, a method for monitoring an intelligent terminal of the Internet of Things is implemented.

[0057] In summary, the present application includes at least one of the following beneficial technical effects:

[0058] 1. Through feature recognition and isolation monitoring, new access terminals are identified and judged, reducing the number of illegal personnel who simulate IoT terminals and invade the IoT to obtain information from the end of the data chain, reducing security risks such as user privacy leakage and cloud service data theft, and improving the security of the IoT system;

[0059] 2. During the isolation process, on the one hand, monitor whether there is abnormal traffic, and on the other hand, obtain the behavior information in the working state and the historical operation behavior of the same type of terminal or the same authority terminal, perform similarity calculation, and then compare the similarity with the set similarity threshold. Through behavior comparison, determine whether it is a forged or illegal simulated intrusion behavior, and further screen out the suspiciousness of the newly accessed terminal, reduce the probability of illegal intrusion, reduce security risks such as user privacy leakage and cloud server data theft, and improve the security of the IoT system;

[0060] 3. When the similarity fluctuation is less than the set threshold, the suspicion of the newly connected terminal can be roughly eliminated, and then the isolation release step can be directly executed, and then it will be included in the Internet of Things, and its historical work information will be entered into the database. Through the above settings, the isolation time of the trusted terminal can be shortened, resource waste can be reduced, and the security and reliability of the Internet of Things can be increased. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 is a flowchart of the terminal monitoring method in Example 1 of the present application;

[0062] Figure 2 is a detailed flow chart of the identification step in Example 2 of the present application;

[0063] Figure 3 is a flow chart of the behavior identification and behavior judgment steps in Example 2 of the present application;

[0064] Figure 4 It is a system diagram of the monitoring system in the embodiment of the present application. DETAILED DESCRIPTION

[0065] The following combination Figures 1 to 4 This application is described in further detail.

[0066] This embodiment discloses a method for monitoring an IoT smart terminal.

[0067] Example 1: Reference Figure 1 , the Internet of Things intelligent terminal monitoring method comprises the following steps:

[0068] S1: Establish a database: internally store all terminal information, terminal historical data, and terminal identification list, and store all terminal information as first information;

[0069] Specifically, terminal information may include basic information: device model, serial number, manufacturer, operating system and version; hardware information: processor (CPU), memory (RAM), storage space, display, camera, network standard, battery; software information: installed applications, system update status, security software; location information: IP address, geographic location; network status: signal strength, connection status, network speed; usage statistics: battery usage, screen usage time, application usage; security information: device lock status, remote lock / erase capability, security patch level, work authority level and usage level, etc. The database also contains historical operation data and operation data of the running terminals, and a terminal identification list, where the terminal identification list stores the feature identification codes of terminals that have been connected to the network, the feature identification codes of terminal devices allowed to access the network, or the feature identification codes of registered terminal devices that are about to access the network.

[0070] S2: Acquisition: Acquisition of new access terminal information, and storage as second information, wherein the second information includes a feature code of the new access terminal;

[0071] S3: Identification: including virtual library building step S3-1, feature identification step S3-2 and isolation step S3-3;

[0072] S3-1: Virtual library construction: Establish a virtual library to store virtual terminal data and fake user information;

[0073] Specifically, the construction of the virtual library forms a small storage space in the database in isolation, in which the false information of each terminal device and the false information of the user are stored. The false information can be generated by software or compiled from non-important data.

[0074] S3-2: Feature identification: determine whether the feature code of the newly connected terminal exists in the terminal identification list. If so, perform the isolation step; otherwise, perform the alarm step;

[0075] S3-3: Isolation: Place the newly connected terminal in the virtual library and set the isolation time ,in, , and execute the monitoring step, and store the usage information in the virtual library to form pending information;

[0076] S4: Alarm: Deny new access terminals to the IoT and send abnormal information to users or administrators;

[0077] S5: Monitoring: Real-time monitoring of the behavior of the newly connected terminal and execution of abnormality judgment steps;

[0078] S6: Abnormal judgment: judge during the isolation period Whether there is abnormal traffic information in the data flow, if so, the alarm step is executed, otherwise, the merging step is executed;

[0079] S7: Incorporate: Integrate the new access terminal into the Internet of Things and store the pending information in the database.

[0080] Specifically, when feature recognition determines that it exists in the terminal identification list, it is placed in the virtual library for isolation and the isolation time is set. During the isolation process, the working status of the newly accessed terminal is monitored to see if there is abnormal traffic. If so, there may be abnormal data transmission, and it is a suspicious terminal. The alarm step is executed to inform the user or administrator, and the terminal is denied access to the Internet of Things and the database, and the possibility of obtaining the data link is reduced. When the feature code of the newly accessed terminal does not exist in the terminal feature list, the alarm step is directly executed to inform the user or administrator for screening.

[0081] The implementation principle of Example 1 of the present application is: by establishing a database, the terminal information of the newly accessed terminal is acquired, and the feature code of the newly accessed terminal is identified, and it is determined whether it exists in the terminal identification list. If so, it is placed in the virtual library to monitor the operation isolation time, monitor whether there is abnormal traffic, and screen and eliminate the suspiciousness of the newly accessed terminal. When the feature code does not exist in the terminal identification list and there is abnormal traffic, the alarm step is executed to inform the user or administrator for investigation to reduce data loss and privacy leakage.

[0082] Example 2: Reference Figure 2 The difference between this embodiment and embodiment 1 is that:

[0083] A classification step S3-4, a time updating step S3-5, a classification sorting step S3-6 and a time optimization step S3-7 are also provided between the feature identification step and the isolation step;

[0084] S3-4: Classification: According to the authority level of the terminal in the first information and the authority level of the newly connected terminal in the second information, all terminals are divided into n levels, where the nth level corresponds to a weight average ;

[0085] S3-5: Time update: The isolation time is updated according to the classification information of the newly accessed terminal. The updated calculation model is as follows:

[0086] , where The calculation model is as follows: ,in, .

[0087] Specifically, The value of is greater than 1, and Determined according to the authority level of the new access terminal, the higher the authority level, the corresponding is larger and less than 2, or is determined according to the number of levels and the hierarchical position of the new access terminal, wherein the more the number of levels is and the higher the hierarchical position of the new access terminal is, the The larger the value of .

[0088] S3-6: Hierarchical sorting: Each level is sorted according to the priority of permissions, and the weight value is set according to the level and priority. The higher the level, the higher the corresponding weight value average. The higher the priority at the same level, the higher the corresponding weight value;

[0089] S3-7: Time optimization: The isolation time is updated according to the classification information of the newly connected terminal. The updated calculation model is as follows:

[0090] , where The calculation model is as follows:

[0091] , where is the weight value of the new access terminal of the nth level and the jth priority level, is the mean of all terminal weights at level n.

[0092] Specifically, by dividing the levels of installed terminals and newly accessed terminals according to the authority level, one level may correspond to multiple terminals. The newly accessed terminal is located in a certain level, and all weight values ​​in the level are the weight average. ,according to as well as Calculate all isolation time bases of the current level, and then use them as the underlying algorithm for the subsequent time optimization step; for example, if all authority levels are divided into 1-10 in total, they can be divided into 5 levels or 10 levels. If there are 15 terminal devices in the current IoT environment, of which 14 are installed terminals and one is newly connected, the authority levels correspond to 1-6, which are divided into three levels, 1 and 2 are level 1, 3 and 4 are level 2, and 5 and 6 are level 3. Determine the average weight value of the current level based on the total number of terminals and the number of current levels. , and determine the location of the newly accessed terminal. For example, for terminals located in the second level with a permission level of 3, which is less than the permission level of 4, the weight value is determined according to the number of permission levels 3 and 4 in the current classification, and the mean value of the sum of all weight values ​​in the current classification corresponds to ,and , that is, the sum of all weight values ​​of the current classification and the sum of the weight values ​​of all classifications is 1; or the permission levels of all terminals in the current IoT environment can be summarized, each permission level corresponds to a weight value, and the sum of the weight values ​​corresponding to all permission levels is equal to 1; you can choose from the above two methods according to actual needs.

[0093] The average weight value of the level of the newly accessed terminal and the location of the new access terminal, calculate the weight value of the new access terminal, and then calculate the model as well as , calculate the updated isolation time, and update the isolation time of the current newly accessed terminal. The higher the authority level, the longer the corresponding isolation time, which reduces the theft of important data.

[0094] Reference Figure 3 In other embodiments, a behavior identification step S8, an isolation time reduction step S9, and an isolation release step S10 are further provided between the abnormality determination step and the incorporation step;

[0095] S8: Behavior recognition: including behavior acquisition step, similarity calculation step, behavior judgment step, mean calculation step and mean judgment step;

[0096] S8-1: Behavioral Acquisition: During Isolation Time In the time interval, extract the working status of a newly accessed terminal at time T and obtain the existing behavior information in the working status , obtain the historical operation behavior information of terminals of the same type or with the same permissions as the newly accessed terminal ;

[0097] S8-2: Similarity calculation: Calculate existing behavior information Historical operation behavior information Similarity ;

[0098] S8-4: Behavior judgment: judging similarity Is there a similarity value less than the set threshold? , if yes, then execute the alarm step, otherwise, execute the mean value calculation step;

[0099] S8-5: Mean calculation: Calculate a similarities The mean ;

[0100] S8-6: Mean judgment: judge the mean Is it greater than , if yes, then execute the isolation release step, otherwise, execute the isolation time reduction step;

[0101] S9: Isolation time reduction: Reduce the remaining isolation time.

[0102] S10: Isolation release: release the isolation state of the newly accessed terminal and perform intervention steps.

[0103] Specifically, simply by whether or not abnormal traffic is generated, it is not possible to completely identify suspicious terminals. In the isolation time, multiple segments of time T are extracted, where , then similarity calculation is performed based on the existing behavior in a single segment and the historical behavior of terminals of the same type or level of authority, wherein the similarity calculation can be performed by building a vector space model, and then calculating the similarity between two vectors by cosine similarity or Euclidean distance, etc.; or by Pearson correlation coefficient, or Jaccard similarity, etc., and the present embodiment preferably uses a vector space model, and uses cosine similarity to calculate the similarity; then by comparing with the similarity threshold To determine whether the alarm step needs to be executed, when the similarity is greater than the set similarity threshold, the average of multiple similarities is calculated, and then the average is determined. Is it greater than If so, the isolation release step is executed. Otherwise, the isolation time shortening step is executed to shorten the isolation time. The isolation time can be shortened by multiples. The specific setting can be set according to the importance of the authority to set the reduction ratio.

[0104] Reference Figure 3 In other embodiments, a fluctuation determination step is further provided after the mean determination step;

[0105] S11: Fluctuation judgment: obtain the similarity fluctuation amplitude. If the fluctuation amplitude is less than the set threshold B, execute the isolation release step.

[0106] Specifically, the fluctuation amplitude is calculated by calculating the standard deviation. The threshold value B can be determined based on historical data or directly defined. When it is less than the set threshold value B, the isolation release step is executed to directly release the current isolation, and then it is added to the Internet of Things and connected to the database.

[0107] The implementation principle of Example 2 of the present application is as follows: hierarchical division is performed according to the authority levels of the new access terminal and the installed terminals, and then the level of the new access terminal is determined, and then the level is sorted, the position of the new access terminal is determined, the weight value of the new access terminal and the average weight value of the level to which the new access terminal belongs are determined, and then the isolation time of the current level is calculated according to the calculation model, and then the corresponding isolation time is calculated according to the weight value of the new access terminal, and then the new access terminal is added to the virtual library for isolation, and the behavior is monitored during isolation, and the similarity with the historical behavior of terminals of the same type or the same authority level is calculated, and then the similarity is initially compared with the similarity threshold to determine whether it is necessary to execute the alarm step. If the alarm step is not required, it is determined whether the average is greater than the similarity upper threshold. When it is greater than the upper threshold, the isolation release step is executed. Otherwise, the isolation time is shortened to reduce the isolation time.

[0108] The similarity of multiple adjacent time periods is obtained through time series, and the fluctuation range is calculated by standard deviation. Then, when the similarity fluctuation range is small, the isolation is lifted and the generated data is stored in the database.

[0109] The embodiment of the present application also discloses a monitoring system.

[0110] Reference Figure 4 , monitoring system, including the following modules:

[0111] Database: internally stores terminal historical data information, terminal information, and user information;

[0112] Specifically, the historical data information includes the operation information, execution information, fault information, and working status information of all terminals under the Internet of Things. The terminal information includes the terminal model specifications, authority level, intelligence, etc. The user information includes user account, user name, user registration information, user level, related information, etc.

[0113] Acquisition module; used to obtain information of new access terminals;

[0114] Identification module: used to identify whether the new access terminal is in the feature identification list, build a virtual library, and isolate the new access terminal in the feature identification list;

[0115] Monitoring module: real-time monitoring of new access terminals in the virtual library;

[0116] Abnormal judgment module: judges the traffic of the newly accessed terminal under monitoring to determine whether there is any abnormality;

[0117] Alarm module: After judging the behavior and traffic flow, if a terminal is judged as suspicious, the user or administrator will be notified and the terminal will be denied access to the Internet of Things;

[0118] Incorporation module: Incorporate new access terminals without abnormalities into the Internet of Things, and store the generated data information in the database.

[0119] Specifically, the identification module identifies and matches the feature code of the newly accessed terminal, and places it in the virtual library for isolation after the feature code matches successfully. During isolation, the isolation time is adjusted according to the authority level. During isolation, whether the terminal is allowed is determined by obtaining whether there is abnormal traffic. When the traffic is normal, the behavior of the terminal is monitored, the similarity is calculated with the same type of terminals, and then compared to determine whether the isolation time needs to be shortened and whether the isolation needs to be lifted.

[0120] The implementation principle of a monitoring system in an embodiment of the present application is as follows: a database is established to summarize and collect information of all terminals under the Internet of Things, information of newly accessed terminals is acquired through an acquisition module, and then an identification module is executed. The identification module obtains feature codes of newly accessed terminals and then matches them to determine whether they exist, and then a virtual library is built to isolate terminals in the identification list. During isolation, the isolation time is adjusted by obtaining the permission level, and then during isolation, traffic and daily behavior are monitored to determine whether the newly accessed terminal is suspicious, and whether it is necessary to continue isolation or deny access to the Internet of Things.

[0121] The embodiment of the present application also discloses a storage medium.

[0122] A storage medium stores a computer program, which, when executed by one or more processors, implements an Internet of Things smart terminal monitoring method.

[0123] The embodiment of the present application also discloses a server.

[0124] The server includes a memory and a processor. The memory stores a computer program. When the computer program is executed by the processor, a method for monitoring an intelligent terminal of the Internet of Things is implemented.

[0125] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for monitoring an IoT intelligent terminal, characterized in that: The following steps are involved: Establish a database: internally store all terminal information, terminal historical data, terminal identification list, and store all terminal information as the first information; Acquiring: acquiring information of a new access terminal and storing the information as second information, wherein the second information includes a feature code of the new access terminal; Identification: including virtual library construction steps, feature identification steps and isolation steps; Virtual library construction: establish a virtual library to store virtual terminal data and fake user information internally; Feature identification: determine whether the feature code of the newly connected terminal exists in the terminal identification list. If so, perform the isolation step; otherwise, perform the alarm step; Isolation: Place the newly connected terminal in the virtual library and set the isolation time ,in, , and execute the monitoring step, and store the usage information in the virtual library to form pending information; Alarm: Deny new terminals from accessing the IoT and send abnormal information to users or administrators; Monitoring: Real-time monitoring of the behavior of newly connected terminals and execution of abnormality judgment steps; Abnormal judgment: judge during the isolation period Whether there is abnormal traffic information in the data flow, if so, the alarm step is executed, otherwise, the merging step is executed; Incorporate: Integrate new access terminals into the Internet of Things and store pending information in the database.

2. The method for monitoring an IoT smart terminal according to claim 1, characterized in that: A classification step and a time updating step are also provided between the feature identification step and the isolation step; Classification: According to the permission level of the terminal in the first information and the permission level of the newly connected terminal in the second information, all terminals are divided into n levels, where the nth level corresponds to a weight average , is the weight value of the new access terminal of the nth level and the jth priority level; Time update: The quarantine time is updated based on the classification information of the newly connected terminal. The updated calculation model is as follows: , where The calculation model is as follows: ,in, .

3. The method for monitoring an IoT smart terminal according to claim 2, characterized in that: After the time updating step, a hierarchical sorting step and a time optimization step are also provided; Hierarchical sorting: Each level is sorted according to the authority level, and the weight value is set according to the level and authority level. The higher the level, the higher the corresponding weight value average. The higher the authority level at the same level, the higher the corresponding weight value; Time optimization: The isolation time is updated according to the classification information of the newly connected terminal. The updated calculation model is as follows: , where The calculation model is as follows: , where is the weight value of the new access terminal of the nth level and the jth priority level, is the mean of all terminal weights at level n.

4. The method for monitoring an Internet of Things intelligent terminal according to claim 2 or 3, characterized in that: A behavior recognition step and an isolation time reduction step are also provided between the abnormality determination step and the incorporation step; Behavior recognition: including behavior acquisition step, similarity calculation step and behavior judgment step; Behavioral acquisition: During quarantine time In the time interval, extract the working status of a newly accessed terminal at time T and obtain the existing behavior information in the working status , obtain the historical operation behavior information of terminals of the same type or with the same permissions as the newly accessed terminal ; Similarity calculation: Calculate existing behavior information Historical operation behavior information Similarity ; Behavioral judgment: judging similarity Is there a similarity value less than the set threshold? , if yes, then execute the alarm step, otherwise, execute the isolation time reduction step; Isolation time reduction: Reduce the remaining isolation time.

5. The method for monitoring an IoT smart terminal according to claim 4, characterized in that: After the behavior judgment step, there are also a mean value calculation step, a mean value judgment step and an isolation release step; Mean calculation: calculate a similarities The mean ; Mean judgment: judge the mean Is it greater than , if yes, then execute the isolation release step, otherwise, execute the isolation time reduction step; Isolation release: Release the isolation status of the newly connected terminal and perform intervention steps.

6. The method for monitoring an IoT smart terminal according to claim 5, characterized in that: A fluctuation judgment step is also provided after the mean judgment step; Fluctuation judgment: Get the similarity fluctuation range. If the fluctuation range is less than the set threshold B, execute the isolation release step.

7. A system for implementing the method for monitoring an IoT smart terminal according to any one of claims 1 to 6, characterized in that: Includes the following modules: Database: internally stores terminal historical data information, terminal information, and user information; Get module; Used to obtain information of new access terminals; Identification module: used to identify whether the new access terminal is in the feature identification list, build a virtual library, and isolate the new access terminal in the feature identification list; Monitoring module: real-time monitoring of new access terminals in the virtual library; Abnormal judgment module: judges the traffic of the newly accessed terminal under monitoring to determine whether there is any abnormality; Alarm module: After judging the behavior and traffic flow, if a terminal is judged as suspicious, the user or administrator will be notified and the terminal will be denied access to the Internet of Things; Incorporation module: Incorporate new access terminals without abnormalities into the Internet of Things, and store the generated data information in the database.

8. A storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by one or more processors, the method for monitoring an Internet of Things smart terminal as described in any one of claims 1 to 6 is implemented.

9. A server, characterized in that: It includes a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the method for monitoring an Internet of Things smart terminal as described in any one of claims 1 to 6 is implemented.

Images