Detection and analysis system based on block chain

Abstract

The invention discloses a detection and analysis system based on a block chain. An operation method of the system comprises the following steps: carrying out extraction control management on Internet of Things protocol message fields; carrying out optimization construction and data processing on an Internet of Things protocol state machine; performing anomaly detection analysis processing on the Internet of Things protocol message data; and carrying out transmission storage management on the detection result. The extraction control management of the Internet of Things protocol message field comprises the following steps: after characterizing the Internet of Things protocol message field through conditional entropy, splitting the Internet of Things protocol message into half bytes, and screening the message field through a set threshold value and extracting and merging the message field. The step of carrying out optimization construction and data processing on the Internet of Things protocol state machine comprises the following steps: controlling the initial Internet of Things protocol state machine not to have any protocol state conversion mapping, and then carrying out optimization construction management on the protocol state machine; the system has the characteristics of high safety and intelligent optimization management and control.

Description

Technical Field

[0001] The present invention relates to the field of detection and analysis technology, and specifically to a detection and analysis system based on blockchain. Background Art

[0002] With the rapid development of the Internet, the network has grown from a small network containing only a few devices to a complex network with billions of devices, providing network services to a large number of users. In today's network, in addition to common electronic products such as mobile phones and computers, more and more smart entities such as cameras, smart watches, smart air conditioners, sensors, etc. have also begun to access the network, and the Internet of Things has emerged. However, on the one hand, the Internet of Things facilitates human production and life, and on the other hand, it also brings great network security risks. A simple vulnerability may cause attackers to easily access and operate data on all devices, causing failures of the entire system and leakage of personal privacy, and the current existing technology has not yet been perfected. Therefore, it is necessary to design a blockchain-based detection and analysis system with high security and intelligent optimization control. Summary of the invention

[0003] The purpose of the present invention is to provide a detection and analysis system based on blockchain to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a detection and analysis method based on blockchain, comprising:

[0005] Perform extraction, control and management of IoT protocol message fields;

[0006] Optimize the construction and data processing of the IoT protocol state machine;

[0007] Perform anomaly detection and analysis on IoT protocol message data;

[0008] Transmit, store and manage the test results.

[0009] According to the above technical solution, the extraction control management of the Internet of Things protocol message field includes:

[0010] After characterizing the IoT protocol message fields through conditional entropy, the IoT protocol messages are split into half bytes, and the message fields are screened and extracted and merged through the set threshold.

[0011] According to the above technical solution, the optimization construction and data processing of the Internet of Things protocol state machine include:

[0012] After controlling that there is no protocol state transition mapping in the initial IoT protocol state machine, the protocol state machine is optimized and constructed and managed;

[0013] After filtering out the protocol messages belonging to the same session from the IoT protocol message data to be detected, the data of communication between different devices and the server is extracted, and after being processed by the extraction identifier of the message field, it waits for subsequent processing.

[0014] According to the above technical solution, the abnormality detection and analysis processing of the IoT protocol message data includes:

[0015] After obtaining the IoT protocol message data that has completed the extraction and identification processing of the message field, query the protocol tag attribute of the protocol data file in the database and perform corresponding control processing;

[0016] After receiving the protocol message data to be detected, the Shannon entropy is used to calculate and analyze the IP address entropy of the protocol message data source to perform distributed attack detection processing;

[0017] If no distributed attack behavior is detected, the protocol state transition probability value within the test time period is calculated using the Manhattan distance and then compared with the set threshold. If it is greater than the corresponding threshold, it is determined that a session attack behavior is detected, otherwise there is no attack behavior.

[0018] According to the above technical solution, the transmission, storage and management of the detection results include:

[0019] The detection results are recorded in a distributed blockchain storage as the result information of the attack, effectively preventing the result information from being tampered with or lost.

[0020] The test results will be transmitted to the corresponding work management personnel for review and analysis.

[0021] According to the above technical solution, a detection and analysis system based on blockchain includes:

[0022] Extraction and construction module, used for extraction control and construction optimization management of protocol message fields;

[0023] Detection and analysis module, used to perform abnormal detection and analysis on IoT protocol message data;

[0024] The storage and transmission module is used to transmit, store and manage the detection results.

[0025] According to the above technical solution, the extraction building block includes:

[0026] Field extraction module, used to extract and merge IoT protocol messages;

[0027] State machine construction module, used for optimizing construction and management of protocol state machines;

[0028] The data processing module is used to pre-process the protocol message data.

[0029] According to the above technical solution, the detection and analysis module includes:

[0030] Anomaly detection module, used for protocol message data anomaly detection and management;

[0031] Distributed attack module, used for distributed attack detection and processing;

[0032] The session attack module is used to perform session attack detection and processing.

[0033] According to the above technical solution, the storage transmission module includes:

[0034] A result storage module is used to store test result data;

[0035] The transmission notification module is used to notify the transmission of data information.

[0036] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention, by providing an extraction construction module, a detection and analysis module, and a storage and transmission module, can make the message type identification analysis of the Internet of Things protocol more efficient and accurate, avoid the consumption of resources and time due to identification analysis of message types of different protocols, and at the same time avoid the situation in which when faced with a large amount of protocol data, the constructed protocol initial state machine is too large, resulting in a large amount of resource consumption and low efficiency in the subsequent processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0038] Figure 1 This is a flowchart of a detection and analysis method based on blockchain provided in Example 1 of the present invention;

[0039] Figure 2 This is a module structure diagram of a blockchain-based detection and analysis system provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] Embodiment 1: Figure 1 This is a flowchart of a detection and analysis method based on blockchain provided in Embodiment 1 of the present invention. This embodiment can be applied to a detection and analysis system. The method can be executed by a detection and analysis system based on blockchain provided in an embodiment of the present invention. The system is composed of multiple software and hardware modules, such as Figure 1 As shown, the method specifically comprises the following steps:

[0042] S101, performing extraction, control and management of Internet of Things protocol message fields;

[0043] Exemplarily, in an embodiment of the present invention, after characterizing the IoT protocol message field through conditional entropy, the IoT protocol message is split into half bytes, and the message field is screened and extracted and merged through a set threshold; since the control information of the protocol message is usually located in the header area of ​​the message, the status field of the protocol is relatively front in the message and is less affected by the variable length parts such as the payload, so through this step, the protocol message is split into half bytes, each half byte of the message is regarded as a field, and the message field that may become the status field is filtered out through the set threshold, and the protocol message word The conditional entropy of the segment is compared with the set threshold. When the conditional entropy of the protocol message field is less than the set threshold, the field is extracted as a state candidate field. After all fields are extracted, the adjacent fields are merged and determined. If the preceding adjacent field belongs to the state candidate field, the current field and the preceding field are merged. If the conditional entropy of the merged field is less than the larger value of the conditional entropy of the first two fields, the merged field is used to update the state candidate field. Through this processing, the message type identification analysis of the Internet of Things protocol can be made more efficient and accurate, avoiding the consumption of resources and time for identification analysis of message types of different protocols.

[0044] S102, optimizing the construction and data processing of the Internet of Things protocol state machine;

[0045] Exemplarily, in an embodiment of the present invention, after controlling that there is no protocol state transition mapping in the initial Internet of Things protocol state machine, the optimization construction management of the protocol state machine is performed; in this step, in the initial protocol state machine, it is made to contain only the initial state, and there is no protocol state transition mapping. After traversing each protocol session sequence in the protocol session flow to build a prefix tree, the state transition condition information in the protocol session sequence is observed at the same time. If it already exists in the state mapping of the protocol state machine, the state is merged, otherwise the new protocol state machine is optimized and constructed through the prefix tree protocol session flow, so that the initial session The protocol state transition sequence merges equivalent states when traversing the sequence, and at the same time establishes a state index table to store the mapping between states and transition conditions. Whenever it is determined that the current state forms an equivalent state with the state in the index table, the state transition mapping from the previous state to the current state is deleted, and a mapping to the equivalent state is established. Then, the state transition is performed according to the equivalent state to complete the update of the protocol state machine, thereby forming a complete protocol state machine. This avoids the situation in which the constructed protocol initial state machine is too large when faced with a large amount of protocol data, resulting in a large amount of resource consumption and low efficiency in the subsequent processing process.

[0046] After filtering out the protocol messages belonging to the same session from the IoT protocol message data to be detected, the data of communication between different devices and the server is extracted, and after being processed by the extraction identifier of the message field, it waits for subsequent processing.

[0047] S103, performing abnormal detection and analysis on the IoT protocol message data;

[0048] Exemplarily, in an embodiment of the present invention, after obtaining the Internet of Things protocol message data that has completed the extraction identification processing of the message field, the protocol tag attribute of the protocol data file is queried in the database to perform corresponding control processing; in this step, the tag attribute is a type identifier of the protocol in the data file, which is only used to determine whether the protocol categories in the two data files are the same, and whether the current protocol tag already has a corresponding protocol state machine in the database. If so, subsequent detection processing is performed, otherwise an error message is prompted.

[0049] After receiving the protocol message data to be detected, the Shannon entropy is used to calculate and analyze the entropy of the IP address of the protocol message data source, and distributed attack detection is performed; since the information that is most easily used to identify the source of the protocol message is the source IP address of each protocol message on the received protocol message, when the IoT device is working normally, the distribution of the source IP address is relatively stable, but when it is attacked by a distributed attack, a large amount of protocol traffic from different unknown IPs will be received. In this case, the degree of confusion of the source IP address of the received message in the network traffic can be used as a sign to identify whether it is under a distributed attack. Therefore, through this step, the network traffic is divided into time periods T, and the probability distribution of the source IP address of the protocol traffic is separately counted in each period and the corresponding Shannon entropy value is calculated. After counting the entropy value in each period, the 5 periods closest to the current one are selected as reference periods, and the average value of the result in each period is used as a reference value, which is compared with the calculation result of the next period to be detected, where the maximum Shannon entropy value in the 5 periods is represented as Y max , the minimum value is represented by Y min , the calculation result of Shannon entropy in the period to be detected is Y, through the formula The specified threshold X is calculated. If X is less than 0 or greater than 1, it is determined that a distributed attack behavior exists, otherwise further detection is required.

[0050] If no distributed attack behavior is detected, the protocol state transition probability value within the test time period is calculated using the Manhattan distance and then compared with the set threshold. If it is greater than the corresponding threshold, it is determined that a session attack behavior is detected, otherwise there is no attack behavior.

[0051] S104, performing transmission, storage and management of the detection results;

[0052] Exemplarily, in an embodiment of the present invention, the detection result is recorded in a distributed blockchain storage as the result information of the attack, effectively preventing the result information from being tampered with or lost.

[0053] The test results will be transmitted to the corresponding work management personnel for review and analysis.

[0054] Embodiment 2: Embodiment 2 of the present invention provides a detection and analysis system based on blockchain. Figure 2 A schematic diagram of the module structure of a detection and analysis system based on blockchain provided in the second embodiment, as shown in FIG. Figure 2 As shown, the system includes:

[0055] Extraction and construction module, used for extraction control and construction optimization management of protocol message fields;

[0056] Detection and analysis module, used to perform abnormal detection and analysis on IoT protocol message data;

[0057] The storage and transmission module is used to transmit, store and manage the detection results.

[0058] In some embodiments of the invention, extracting the building blocks comprises:

[0059] Field extraction module, used to extract and merge IoT protocol messages;

[0060] State machine construction module, used for optimizing construction and management of protocol state machines;

[0061] The data processing module is used to pre-process the protocol message data.

[0062] In some embodiments of the present invention, the detection and analysis module includes:

[0063] Anomaly detection module, used for protocol message data anomaly detection and management;

[0064] Distributed attack module, used for distributed attack detection and processing;

[0065] The session attack module is used to perform session attack detection and processing.

[0066] In some embodiments of the present invention, the storage transmission module includes:

[0067] A result storage module is used to store test result data;

[0068] The transmission notification module is used to notify the transmission of data information.

[0069] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0070] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A detection and analysis method based on blockchain, characterized in that: include: Perform extraction, control and management of IoT protocol message fields; Optimize the construction and data processing of the IoT protocol state machine; Perform anomaly detection and analysis on IoT protocol message data; Transmission, storage and management of test results.

2. A detection and analysis method based on blockchain according to claim 1, characterized in that: The extraction, control and management of the Internet of Things protocol message field includes: After characterizing the IoT protocol message fields through conditional entropy, the IoT protocol messages are split into half bytes, and the message fields are screened and extracted and merged through the set threshold.

3. A detection and analysis method based on blockchain according to claim 1, characterized in that: The optimization construction and data processing of the Internet of Things protocol state machine include: After controlling that there is no protocol state transition mapping in the initial IoT protocol state machine, the protocol state machine is optimized and constructed and managed; After filtering out the protocol messages belonging to the same session from the IoT protocol message data to be detected, the data of communication between different devices and the server is extracted, and after being processed by the extraction identifier of the message field, it waits for subsequent processing.

4. A detection and analysis method based on blockchain according to claim 1, characterized in that: The abnormality detection and analysis processing of the Internet of Things protocol message data includes: After obtaining the IoT protocol message data that has completed the extraction and identification processing of the message field, query the protocol tag attribute of the protocol data file in the database and perform corresponding control processing; After receiving the protocol message data to be detected, the Shannon entropy is used to calculate and analyze the IP address entropy of the protocol message data source to perform distributed attack detection processing; If no distributed attack behavior is detected, the protocol state transition probability value within the test time period is calculated using the Manhattan distance and then compared with the set threshold. If it is greater than the corresponding threshold, it is determined that a session attack behavior is detected, otherwise there is no attack behavior.

5. A detection and analysis method based on blockchain according to claim 1, characterized in that: The transmission, storage and management of the detection results includes: The detection results are recorded in a distributed blockchain storage as the result information of the attack, effectively preventing the result information from being tampered with or lost. The test results will be transmitted to the corresponding work management personnel for review and analysis.

6. A detection and analysis system based on blockchain, characterized in that: include: Extraction and construction module, used for extraction control and construction optimization management of protocol message fields; Detection and analysis module, used to perform abnormal detection and analysis on IoT protocol message data; The storage and transmission module is used to transmit, store and manage the detection results.

7. A detection and analysis system based on blockchain according to claim 6, characterized in that: The extraction building block comprises: Field extraction module, used to extract and merge IoT protocol messages; State machine construction module, used for optimizing construction and management of protocol state machines; The data processing module is used to pre-process the protocol message data.

8. A detection and analysis system based on blockchain according to claim 6, characterized in that: The detection and analysis module comprises: Anomaly detection module, used for protocol message data anomaly detection and management; Distributed attack module, used for distributed attack detection and processing; The session attack module is used to perform session attack detection and processing.

9. A detection and analysis system based on blockchain according to claim 6, characterized in that: The storage transmission module includes: A result storage module is used to store test result data; The transmission notification module is used to notify the transmission of data information.

Images