Enhanced network security monitoring method for Internet of Things management platform

Abstract

The invention discloses an enhanced network security monitoring method for an Internet of Things management platform. The method comprises the following steps: S1, collecting a network data packet interacting with the Internet of Things management platform; s2, performing preliminary trust evaluation on the data packet by using a lightweight model A obtained by interactive knowledge sharing training; s3, if the evaluation result of the model A is abnormal, a depth anomaly detection model B obtained through interactive knowledge sharing training is used for reexamination; s4, if the reexamination result of the model B is abnormal, starting a trust decision and security response mechanism; and S5, manually auditing the abnormal network data packet, and carrying out incremental learning on the model A and the model B. The invention provides a set of advanced security solution for an intelligent Internet of Things system, and aims to effectively identify and intercept potential malicious communication data packets through a multi-stage intelligent evaluation and incremental learning mechanism, thereby meeting the requirements of high security and real-time performance of communication in a large-scale Internet of Things environment.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an enhanced network security monitoring method for an Internet of Things management platform. Background Art

[0002] With the rapid development of IoT technology, the large number and variety of untrusted terminals in the IoT environment pose a serious security threat to the IoT management platform. The communication security between IoT devices is receiving increasing attention. Traditional security protection methods are difficult to effectively deal with the increasingly complex and changeable network attacks and the exponential growth of IoT devices, especially targeted attacks on IoT management platforms. There is an urgent need for a real-time, accurate, efficient and adaptive intelligent security monitoring system. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide an enhanced network security monitoring method for the IoT management platform, ensuring that the communication in the large-scale IoT environment is not only safe and reliable, but also able to quickly identify various security threats and meet high security and real-time requirements. It aims to build an efficient and robust IoT communication security protection system to ensure the security and reliability of data transmission.

[0004] To achieve the above object, the present invention adopts the following technical solution: an enhanced network security monitoring method for an IoT management platform, comprising the following steps:

[0005] Step S1, collecting network data packets interacting with the IoT management platform;

[0006] Step S2, applying the lightweight model A obtained through interactive knowledge sharing training to perform preliminary trust assessment on the network data packets;

[0007] Step S3: If the evaluation result of the lightweight model A is abnormal, the deep anomaly detection model B trained by interactive knowledge sharing is used for review;

[0008] Step S4: If the review result of the deep anomaly detection model B is abnormal, start the trust decision and security response mechanism;

[0009] Step S5: Manually review abnormal network data packets and perform incremental learning on lightweight model A and deep anomaly detection model B.

[0010] In a preferred embodiment, in step S2, the lightweight model A is specifically a lightweight anomaly detection model; the interactive knowledge sharing training refers to the lightweight model A and the deep anomaly detection model B interactively learning from each other; the interactive knowledge sharing training of the lightweight model A has a loss function of:

[0011] LA (y,y A ,y B )=-[ylog(y A )+(1-y)log(1-y A )]+ω A |y A -y B |,

[0012] Where y is the true label, which takes the value of 0 or 1, indicating a negative example or a positive example, A ,y B are the probabilities predicted by the lightweight model A and the deep anomaly detection model B, that is, the probability of being a positive example, ranging between (0,1), ω A represents the trade-off parameter and log represents the natural logarithm.

[0013] In a preferred embodiment, in step S2, a lightweight model A obtained by interactive knowledge sharing training is used to perform a preliminary trust assessment on the data packet. If the lightweight model A determines that the data packet is trustworthy, it is allowed to communicate with the IoT management platform.

[0014] In a preferred embodiment, in step S3, if the evaluation result of the lightweight model A is abnormal, the deep anomaly detection model B obtained by interactive knowledge sharing training is used for review; the loss function of the deep anomaly detection model B is:

[0015] L B (y,y B ,y A )=-[ylog(y B )+(1-y)log(1-y B )]+ω B |y B -y A |,

[0016] Where y is the true label, which takes the value of 0 or 1, indicating a negative example or a positive example, A ,y B are the probabilities predicted by lightweight model A and deep anomaly detection model B, that is, the probability of being a positive example, ranging between (0,1), ω B represents the trade-off parameter and log represents the natural logarithm.

[0017] In a preferred embodiment, in step S3, if the evaluation result of the lightweight model A is abnormal, the deep anomaly detection model B obtained by interactive knowledge sharing training is used for review; if the deep anomaly detection model B confirms that the data packet is trustworthy, it is allowed to communicate with the IoT management platform.

[0018] In a preferred embodiment, the deep anomaly detection model B and the lightweight model A implement an interactive knowledge sharing training mechanism to alternately update and learn from each other's training results; that is, after the deep anomaly detection model B completes the initial training, the lightweight model A is trained under the knowledge sharing of the deep anomaly detection model B, and then the deep anomaly detection model B is trained under the knowledge sharing of the lightweight model A, and the interactive knowledge sharing is continuously iterated until both models converge.

[0019] In a preferred embodiment, in step S4, if the review result of the deep anomaly detection model B is abnormal, a trust decision and a security response mechanism are initiated; the trust decision is to discard the network data packet, and the security response mechanism includes adding the device corresponding to the abnormal network data packet to the blacklist of the IoT management platform to prohibit it from communicating with the IoT management platform; the blacklist can only be removed after the device is manually reviewed to be trustworthy.

[0020] In a preferred embodiment, in step S5, abnormal network data packets are manually reviewed, and lightweight model A and deep anomaly detection model B are incrementally learned; the incremental learning specifically refers to: based on the manual review results, a certain number of network data packets marked as abnormal or normal are collected; the marked data are added as new training samples to the original training data set; and the lightweight model A and deep anomaly detection model B are retrained using the updated training data set to improve the detection accuracy and robustness of the model.

[0021] In a preferred embodiment, the lightweight model A and the deep anomaly detection model B are neural network models.

[0022] Compared with the prior art, the present invention has the following beneficial effects: the present invention provides a more real-time, efficient, accurate and adaptive security control solution for the Internet of Things management platform through advanced technologies such as a double-layer trust assessment model, an interactive knowledge sharing dual-model training architecture and incremental learning, effectively responding to the increasingly severe security challenges in the Internet of Things environment, and improving communication security without affecting real-time performance. Through a comprehensive data acquisition module, all key communication data packets of the Internet of Things management platform are captured; a two-stage anomaly detection model is innovatively adopted, that is, a lightweight model A is first applied to perform a preliminary trust assessment on the data packet, and then a deep anomaly detection model B is used to review it, forming a double-layer protection network to effectively identify complex and subtle abnormal behaviors; a manual review process is introduced to collect network data packets marked as abnormal or normal, and these cases are fed back to the model training process, and the model parameters are continuously updated through incremental learning to adapt to new threat forms and improve the generalization ability and adaptability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1The present invention is a flowchart of an enhanced network security monitoring method for an IoT management platform according to a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0025] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0026] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0027] The basic idea of ​​the present invention is to collect network data packets that interact with the IoT management platform; use lightweight model A obtained through interactive knowledge sharing training to perform preliminary trust assessment on the data packets; if the assessment result of model A is abnormal, use deep anomaly detection model B obtained through interactive knowledge sharing training for review; if the review result of model B is abnormal, start the trust decision and security response mechanism; manually review abnormal network data packets, and perform incremental learning on model A and model B. Construct an analysis model system from shallow to deep, including fast initial screening model A and deep anomaly detection model B. This layered strategy ensures the accuracy of anomaly detection while ensuring efficiency.

[0028] like Figure 1 As shown, the present invention provides an enhanced network security monitoring method for an IoT management platform, comprising the following steps:

[0029] S1, collect network data packets that interact with the IoT management platform;

[0030] Capture all network communication packets interacting with the IoT management platform.

[0031] S2, apply the lightweight model A obtained through interactive knowledge sharing training to perform preliminary trust assessment on the data packet;

[0032] The lightweight model A requires less storage and computing resources, quickly filters out abnormal network data packets, and meets the real-time requirements; the interactive knowledge sharing training architecture refers to model A and model B, interactively learning from each other; model B and model A implement an interactive knowledge sharing training mechanism, alternately updating and learning each other's training results. That is, after model B completes the initial training, model A is trained under the knowledge sharing of model B, and then model B is trained under the knowledge sharing of model A, and the interactive knowledge sharing is continuously iterated until both models converge.

[0033] The loss function of interactive knowledge sharing training of model A is:

[0034] L A (y,y A ,y B )=-[ylog(y A )+(1-y)log(1-y A )]+ω A |y A -y B |,

[0035] Where y is the true label, which takes the value of 0 or 1, indicating a negative example or a positive example, A ,y B are the probabilities predicted by model A and model B, that is, the probability of being a positive example, ranging between (0,1), ω A represents the trade-off parameter and log represents the natural logarithm.

[0036] If model A determines that the data packet is credible, it is allowed to communicate with the IoT management platform; if the evaluation result of model A is abnormal, it goes to step S3.

[0037] S3. If the evaluation result of model A is abnormal, the deep anomaly detection model B trained by interactive knowledge sharing is used for review;

[0038] The deep anomaly detection model B has a more complex structure, contains more model parameters, and has a more accurate trust evaluation, but its computing resource overhead and time overhead are much higher than those of the model A. In the interactive knowledge sharing training architecture, the loss function of model B is:

[0039] L B (y,y B ,y A )=-[ylog(y B )+(1-y)log(1-y B )]+ω B |y B -y A |,

[0040] Where y is the true label, which takes the value of 0 or 1, indicating a negative example or a positive example, A ,y B are the probabilities predicted by model A and model B, that is, the probability of being a positive example, ranging between (0,1), ω B represents the trade-off parameter and log represents the natural logarithm.

[0041] If model B confirms that the data packet is trustworthy, it is allowed to communicate with the IoT management platform; if the review and evaluation result of model B is abnormal, it proceeds to step S4.

[0042] S4. If the review result of model B is abnormal, the trust decision and security response mechanism is initiated;

[0043] For network data packets whose review results of model B are abnormal, a trust decision is executed to discard the network data packet; a security response mechanism is initiated to add the device corresponding to the abnormal network data packet to the blacklist of the IoT management platform, prohibiting it from communicating with the IoT management platform. Only after the device is manually reviewed and found to be trustworthy can the blacklist be removed, allowing the device to communicate with the IoT management platform.

[0044] S5. Manually review abnormal network data packets and perform incremental learning on Model A and Model B.

[0045] Based on the manual review results, a certain number of network data packets marked as abnormal or normal are collected; the marked data are used as new training samples and added to the original training data set; the updated training data set is used to retrain Model A and Model B to improve the detection accuracy and robustness of the model.

[0046] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An enhanced network security monitoring method for an IoT management platform, characterized in that: The following steps are involved: Step S1, collecting network data packets interacting with the IoT management platform; Step S2, applying the lightweight model A obtained through interactive knowledge sharing training to perform preliminary trust assessment on the network data packets; Step S3: If the evaluation result of the lightweight model A is abnormal, the deep anomaly detection model B trained by interactive knowledge sharing is used for review; Step S4: If the review result of the deep anomaly detection model B is abnormal, start the trust decision and security response mechanism; Step S5: Manually review abnormal network data packets and perform incremental learning on lightweight model A and deep anomaly detection model B.

2. The enhanced network security monitoring method for the IoT management platform according to claim 1, characterized in that: In step S2, the lightweight model A is specifically a lightweight anomaly detection model; the interactive knowledge sharing training refers to the lightweight model A and the deep anomaly detection model B interactively learning from each other; the interactive knowledge sharing training of the lightweight model A has a loss function of: L A (and,and A ,and B )=-[ylog(y A )+(1-y)log(1-y A )]+ω A |and A -and B |, Where y is the true label, which takes the value of 0 or 1, indicating a negative example or a positive example, A ,y B are the probabilities predicted by the lightweight model A and the deep anomaly detection model B, that is, the probability of being a positive example, ranging between (0,1), ω A represents the trade-off parameter and log represents the natural logarithm.

3. The enhanced network security monitoring method for the IoT management platform according to claim 1, characterized in that: In step S2, a lightweight model A obtained through interactive knowledge sharing training is used to perform a preliminary trust assessment on the data packet. If the lightweight model A determines that the data packet is trustworthy, it is allowed to communicate with the IoT management platform.

4. The enhanced network security monitoring method for the IoT management platform according to claim 1, characterized in that: In step S3, if the evaluation result of the lightweight model A is abnormal, the deep anomaly detection model B obtained by interactive knowledge sharing training is used for review; the loss function of the deep anomaly detection model B is: L B (and,and B ,and A )=-[ylog(y B )+(1-y)log(1-y B )]+ω B |and B -and A |, Where y is the true label, which takes the value of 0 or 1, indicating a negative example or a positive example, A ,y B are the probabilities predicted by lightweight model A and deep anomaly detection model B, that is, the probability of being a positive example, ranging between (0,1), ω B represents the trade-off parameter and log represents the natural logarithm.

5. The enhanced network security monitoring method for the IoT management platform according to claim 1, characterized in that: In step S3, if the evaluation result of the lightweight model A is abnormal, the deep anomaly detection model B obtained by interactive knowledge sharing training is used for review; If the deep anomaly detection model B confirms that the data packet is trustworthy, it is allowed to communicate with the IoT management platform.

6. The enhanced network security monitoring method for the IoT management platform according to claim 2 or 5, characterized in that: The deep anomaly detection model B and the lightweight model A implement an interactive knowledge sharing training mechanism to alternately update and learn from each other's training results; that is, after the deep anomaly detection model B completes the initial training, the lightweight model A is trained under the knowledge sharing of the deep anomaly detection model B, and then the deep anomaly detection model B is trained under the knowledge sharing of the lightweight model A, and the interactive knowledge sharing is continuously iterated until both models converge.

7. The enhanced network security monitoring method for the IoT management platform according to claim 1, characterized in that: In step S4, if the review result of the deep anomaly detection model B is abnormal, the trust decision and security response mechanism are started; the trust decision is to discard the network data packet, and the security response mechanism includes adding the device corresponding to the abnormal network data packet to the blacklist of the IoT management platform to prohibit it from communicating with the IoT management platform; The blacklist can only be removed after the device is manually verified to be credible.

8. The enhanced network security monitoring method for the IoT management platform according to claim 1, characterized in that: In step S5, abnormal network data packets are manually reviewed, and the lightweight model A and the deep anomaly detection model B are incrementally learned; the incremental learning specifically refers to: based on the manual review results, after a certain number of network data packets marked as abnormal or normal are collected; the marked data are used as new training samples and added to the original training data set; The lightweight model A and the deep anomaly detection model B are retrained using the updated training dataset to improve the detection accuracy and robustness of the models.

9. The enhanced network security monitoring method for the IoT management platform according to claim 1, characterized in that: The lightweight model A and the deep anomaly detection model B are neural network models.

Images