Information monitoring method and device applied to Internet of Things, equipment and computer medium

Abstract

The embodiment of the invention discloses an information monitoring method and device applied to the Internet of Things, equipment and a computer medium. A specific embodiment of the method comprises the following steps: in response to a received login request of an intelligent device in the Internet of Things, determining whether the intelligent device is a target intelligent device; in response to the fact that the intelligent equipment is not the target intelligent equipment, verifying the login request of the intelligent equipment; obtaining device resource information and resource relation chain information of the intelligent device in response to determining that the login request passes verification; inputting the incremental equipment resource information and the incremental resource relation chain aggregation information into a pre-trained resource relation abnormity identification model to obtain an abnormal resource relation identification result; and in response to determining that the abnormal resource relationship identification result represents that abnormity exists, performing abnormity warning processing on the intelligent equipment. According to the embodiment, the detection accuracy of the access information of the intelligent equipment is improved, and the network security is improved.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the computer field, and in particular to an information monitoring method, apparatus, device and computer medium applied to the Internet of Things. Background Art

[0002] IoT information monitoring can refer to the operation of identifying and detecting the information generated by smart device access. At present, the information monitoring applied to IoT is usually carried out by comparing features through an abnormal access feature library to identify abnormal access.

[0003] However, when using the above method, the following technical problems often occur: abnormal access features often have many forms of variants, and it is difficult to effectively identify the variant program access behavior using feature comparison, resulting in reduced accuracy in abnormal access identification and reduced network security.

[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0005] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0006] Some embodiments of the present disclosure propose information monitoring methods, devices, electronic devices, and computer-readable media applied to the Internet of Things to solve one or more of the technical problems mentioned in the above background technology section.

[0007] In a first aspect, some embodiments of the present disclosure provide an information monitoring method applied to the Internet of Things, the method comprising: in response to receiving a login request from a smart device in the Internet of Things, determining whether the smart device is a target smart device, wherein the target smart device is obtained by performing data analysis and detection through the set configuration information; in response to determining that the smart device is not the target smart device, verifying the login request of the smart device; in response to determining that the login request is verified, obtaining device resource information and resource relationship chain information of the smart device; performing data standardization processing on the device resource information to generate standardized device resource information; performing data aggregation processing on the resource relationship chain information to generate resource relationship chain aggregation information; performing incremental update processing on the standardized device resource information to generate incremental device resource information; performing incremental update processing on the resource relationship chain aggregation information to generate incremental resource relationship chain aggregation information; inputting the incremental device resource information and the incremental resource relationship chain aggregation information into a pre-trained resource relationship anomaly recognition model to obtain an abnormal resource relationship recognition result; in response to determining that the abnormal resource relationship recognition result indicates the existence of an abnormality, performing abnormal warning processing on the smart device.

[0008] In a second aspect, some embodiments of the present disclosure provide an information monitoring device applied to the Internet of Things, the device comprising: a determination unit, configured to, in response to receiving a login request from a smart device in the Internet of Things, determine whether the smart device is a target smart device, wherein the target smart device is obtained by performing data analysis and detection on the set configuration information; a verification unit, configured to, in response to determining that the smart device is not the target smart device, verify the login request of the smart device; an acquisition unit, configured to, in response to determining that the login request is verified, acquire device resource information and resource relationship chain information of the smart device; a standardization unit, configured to perform data standardization processing on the device resource information to generate standardized device resource information; Source information; an aggregation unit configured to perform data aggregation processing on the above-mentioned resource relationship chain information to generate resource relationship chain aggregation information; a first update unit configured to perform incremental update processing on the above-mentioned standardized device resource information to generate incremental device resource information; a second update unit configured to perform incremental update processing on the above-mentioned resource relationship chain aggregation information to generate incremental resource relationship chain aggregation information; an input unit configured to input the above-mentioned incremental device resource information and the above-mentioned incremental resource relationship chain aggregation information into a pre-trained resource relationship anomaly recognition model to obtain an abnormal resource relationship recognition result; a warning unit configured to perform abnormal warning processing on the above-mentioned smart device in response to determining that the above-mentioned abnormal resource relationship recognition result represents an abnormality.

[0009] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.

[0010] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner of the above-mentioned first aspect is implemented.

[0011] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the information monitoring method applied to the Internet of Things in some embodiments of the present disclosure, the accuracy of detecting access information of smart devices is improved, and the network security is improved. Specifically, the reason for the reduction in the accuracy of abnormal access identification and the reduction in network security is that: abnormal access features often have multiple forms of variants, and it is difficult to effectively identify the variant program access behavior by feature comparison, resulting in a reduction in the accuracy of abnormal access identification and a reduction in network security. Based on this, the information monitoring method applied to the Internet of Things in some embodiments of the present disclosure, first, in response to receiving a login request of a smart device in the Internet of Things, determines whether the smart device is a target smart device. Among them, the target smart device is obtained by performing data analysis and detection through the set configuration information. Secondly, in response to determining that the smart device is not the target smart device, the login request of the smart device is verified. In response to determining that the login request is verified, the device resource information and resource relationship chain information of the smart device are obtained. Therefore, the relationship chain information can be summarized according to certain rules to identify important patterns and abnormal behaviors in the relationship chain. Then, the device resource information is subjected to data standardization processing to generate standardized device resource information. The resource relationship chain information is subjected to data aggregation processing to generate resource relationship chain aggregation information. Afterwards, the standardized device resource information is subjected to incremental update processing to generate incremental device resource information. The resource relationship chain aggregation information is subjected to incremental update processing to generate incremental resource relationship chain aggregation information. In this way, the status information of device resources and relationship chains can be dynamically updated. Then, the incremental device resource information and the incremental resource relationship chain aggregation information are input into a pre-trained resource relationship anomaly recognition model to obtain an abnormal resource relationship recognition result. Finally, in response to determining that the abnormal resource relationship recognition result indicates the existence of an abnormality, the above-mentioned smart device is subjected to abnormal warning processing. In this way, the accuracy of the detection of access information of smart devices is improved, and the network security is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar figure labels represent the same or similar elements. It should be understood that the drawings are schematic and that the components and elements are not necessarily drawn to scale.

[0013] Figure 1 is a flow chart of some embodiments of the information monitoring method applied to the Internet of Things according to the present disclosure;

[0014] Figure 2 is a flow chart of some embodiments of the information monitoring device applied to the Internet of Things according to the present disclosure;

[0015] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0016] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0017] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0018] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0019] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0020] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0021] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0022] Figure 11 is a flowchart of some embodiments of the information monitoring method applied to the Internet of Things according to the present disclosure. 100 of some embodiments of the information monitoring method applied to the Internet of Things according to the present disclosure is shown. The information monitoring method applied to the Internet of Things includes the following steps:

[0023] Step 101, in response to receiving a login request from a smart device in the Internet of Things, determining whether the smart device is a target smart device.

[0024] In some embodiments, the execution subject (e.g., computing device) of the information monitoring method applied to the Internet of Things can determine whether the above-mentioned smart device is a target smart device in response to receiving a login request from a smart device in the Internet of Things. Among them, the above-mentioned target smart device is obtained by data analysis and detection through the set configuration information. Each smart device in the Internet of Things can realize the flow and transmission of data or information through the Internet of Things. Among them, the smart devices in the Internet of Things may include: access terminals, control terminals, routers, smart terminals (such as computers, control panels), etc. In order to ensure the security of network information, smart devices in the Internet of Things generally need to send a login request to connect and log in to the Internet of Things. The login request here may generally include, for example, an account name, a password, and a device identifier. When the execution subject receives a login request from a smart device in the Internet of Things, it can first determine whether the smart device is a target smart device. Among them, the target smart device is generally obtained by data analysis and detection through the set configuration information. As an example, the execution subject can obtain a target smart device identification set to determine whether the identification of the smart device exists in the target smart device identification set. If it exists, it means that the smart device is the target smart device.

[0025] Step 102: in response to determining that the smart device is not the target smart device, verifying the login request of the smart device.

[0026] In some embodiments, the execution subject may verify the login request of the smart device in response to determining that the smart device is not the target smart device. The login verification method may be set according to the actual situation. For example, it may be determined whether the account name and password of the smart device are correct. If they are correct, it may be determined that the verification is successful; otherwise, it may be determined that the verification fails.

[0027] Step 103, in response to determining that the login request verification is successful, obtaining device resource information and resource relationship chain information of the smart device.

[0028] In some embodiments, the above-mentioned execution entity may obtain the device resource information and resource relationship chain information of the above-mentioned smart device in response to determining that the above-mentioned login request verification is passed. Among them, the device resource information in the device resource information set may include: device resource information usage, device resource information performance indicators. The resource relationship chain information may include: performance data of resource relationship chain information, node information of resource relationship chain information. For example, resource information usage may be: CPU utilization, memory usage. Device resource information performance indicators may be: response time, throughput. The performance data of device resource relationship chain information may be: delay, error rate. The node information of resource relationship chain information may be: database, cache.

[0029] Step 104: perform data standardization processing on the above device resource information to generate standardized device resource information.

[0030] In some embodiments, the execution entity may perform data standardization processing on the device resource information to generate standardized device resource information.

[0031] In practice, the execution entity may perform data standardization processing on the device resource information by following the steps below:

[0032] The first step is to normalize the above device resource information to generate normalized device resource information. The above device resource information can be normalized by a normalization algorithm to generate normalized device resource information. For example, the normalization algorithm can be: decimal calibration method.

[0033] The second step is to perform data cleaning on the normalized device resource information to generate standardized device resource information. In practice, in response to determining that the normalized device resource information meets the preset missing condition, the execution subject may perform data cleaning on the normalized device resource information through a missing value algorithm to generate standardized device resource information. The preset missing condition may be: the normalized device resource information representation is empty. For example, the preset missing value algorithm may be: interpolation method.

[0034] Step 105: Perform data aggregation processing on the resource relationship chain information to generate resource relationship chain aggregation information.

[0035] In some embodiments, the execution entity may perform data aggregation processing on the resource relationship chain information to generate resource relationship chain aggregation information.

[0036] In practice, the above-mentioned execution entity can perform data aggregation processing on the above-mentioned resource relationship chain information through the following steps:

[0037] The first step is to perform relationship chain instantiation processing on the resource relationship chain information to generate relationship chain instantiation information. The resource relationship chain information can be instantiated by a chain instantiation algorithm to generate relationship chain instantiation information. For example, the chain instantiation algorithm can be: hierarchical instantiation method.

[0038] The second step is to instantiate the resource relationship chain information into relationship nodes to generate relationship node instantiation information. The resource relationship chain information can be instantiated into relationship nodes by using a node instantiation algorithm to generate relationship node instantiation information. For example, the node instantiation algorithm can be a depth-first search method.

[0039] The third step is to perform data aggregation processing on the relationship chain instantiation information and the relationship node instantiation information to generate resource relationship chain aggregation information. For example, the relationship chain instantiation information and the relationship node instantiation information can be combined into resource relationship chain aggregation information.

[0040] Step 106: perform incremental update processing on the standardized device resource information to generate incremental device resource information.

[0041] In some embodiments, the execution subject may perform incremental update processing on the standardized device resource information to generate incremental device resource information. For example, the standardized device resource information may be incrementally updated by a data format update algorithm to generate incremental device resource information. For example, the data format update algorithm may be: incremental update method.

[0042] Step 107: perform incremental update processing on the resource relationship chain aggregation information to generate incremental resource relationship chain aggregation information.

[0043] In some embodiments, the execution subject may perform incremental update processing on the resource relationship chain aggregation information to generate incremental resource relationship chain aggregation information. For example, the resource relationship chain aggregation information may be incrementally updated through a data format update algorithm to generate incremental resource relationship chain aggregation information. The data format update algorithm may be: incremental update method.

[0044] Step 108: input the incremental device resource information and the incremental resource relationship chain aggregation information into a pre-trained resource relationship anomaly recognition model to obtain an abnormal resource relationship recognition result.

[0045] In some embodiments, the above-mentioned execution subject may input the above-mentioned incremental device resource information and the above-mentioned incremental resource relationship chain aggregation information into a pre-trained resource relationship anomaly identification model to obtain an abnormal resource relationship identification result. For example, the resource relationship anomaly identification model may be a pre-trained neural network model that takes the incremental device resource information and the above-mentioned incremental resource relationship chain aggregation information as input and takes the abnormal resource relationship identification result as output. Among them, the abnormal resource relationship identification result may characterize: whether the correspondence between the device resource information usage mode, the device resource information and the resource relationship chain is consistent. The resource relationship anomaly identification model may be: a graph neural network (GNN) model, a long short-term memory network (LSTM) model. For example, if the correspondence between the device resource information usage mode, the device resource information and the resource relationship chain is inconsistent, the abnormal resource relationship identification result characterizes the existence of anomalies. For example, it can be determined whether the device resource information usage mode and each node in the device resource information are consistent with the nodes corresponding to the resource relationship chain.

[0046] Step 109 , in response to determining that the abnormal resource relationship identification result indicates the existence of an abnormality, performing abnormal warning processing on the intelligent device.

[0047] In some embodiments, the execution subject may perform abnormal warning processing on the smart device in response to determining that the abnormal resource relationship identification result indicates an abnormality. For example, a pre-set voice prompt device may be used to prompt the smart device that an abnormality exists.

[0048] Optionally, in response to detecting a network access request sent by a smart device, the network access request is intercepted.

[0049] In some embodiments, the execution entity may intercept the network access request in response to detecting the network access request sent by the smart device.

[0050] For example, the smart device can interact with the execution subject and can operate on the execution subject to obtain the required network data. For example, various application software can be installed on the execution subject. When the smart device clicks on the displayed application icon, a network request is initiated to the server of the application to obtain the page information of the application. At this time, if the execution subject detects that the smart device initiates a network access request, the network access request can be intercepted. For another example, the above network access request can be intercepted by a packet capture tool with data interception function, such as Fiddler.

[0051] Optionally, it is determined whether the network access request is a target network access request according to preset network access monitoring configuration information.

[0052] In some embodiments, the execution subject can determine whether the network access request is a target network access request based on preset network access monitoring configuration information. The network access monitoring configuration information is information used to configure the target network access data and network access monitoring policy to be monitored. The network access monitoring policy may include: collecting the data and time in the target network access request sent by the transmission interface for caching and recording; verifying the target field in the target network access request sent by the transmission interface according to the target rule; collecting the data and time in the network access response data of the received target network access request for caching and recording; replacing the value of the specified field in the network access response data of the received target network access request; verifying the specified field in the network access response data of the received target network access request according to the specified rule, etc. Here, the configuration method of the target network access data can be configured according to the transmission interface data (such as the interface name), and can also be configured according to the user identification (ID).

[0053] In practice, the execution subject may determine whether the network access request is a target network access request by following the steps below:

[0054] The first step is to determine whether the transmission interface of the communication connection between the smart device and the server is consistent with the transmission interface set in the network access monitoring configuration information. That is, to determine whether the transmission interface of the communication connection between the smart device and the server is the same as the transmission interface set in the network access monitoring configuration information.

[0055] In the second step, the response determines that the set transmission interface is consistent, and determines that the above network traffic request is a target network access request.

[0056] The third step is to determine whether the user ID of the above-mentioned smart device is consistent with the user ID set in the network access monitoring configuration information.

[0057] In a fourth step, in response to determining that the network access request is consistent with the user identifier set in the network access monitoring configuration information, determining that the network access request is a target network access request.

[0058] Optionally, in response to determining that the network access request is a target network access request, the network access request is access-marked to obtain a marked network access request, and the marked network access request is sent to the server through a corresponding transmission interface.

[0059] In some embodiments, the execution subject may, in response to determining that the network access request is a target network access request, perform an access tag on the network access request to obtain a tagged network access request, and send the tagged network access request to the server through a corresponding transmission interface. An access tag field may be added to the header information of the network access request.

[0060] Optionally, according to the network access monitoring policy in the network access monitoring configuration information, initial abnormal data detection processing is performed on the data of the network access request to obtain an initial abnormal data detection result.

[0061] In some embodiments, the execution subject may perform initial abnormal data detection processing on the data of the network access request according to the network access monitoring policy in the network access monitoring configuration information to obtain an initial abnormal data detection result. For example, the detection process may include: verifying the specified field in the target network access request sent by the transmission interface according to the specified rules; replacing the value of the specified field in the network access response data of the received target network access request; verifying the specified field in the network access response data of the received target network access request according to the specified rules, etc. Here, there is no restriction on the setting of the rules. The initial abnormal data detection result may indicate that the network access request passed the verification or failed the verification.

[0062] Optionally, in response to determining that the initial abnormal data detection result meets the initial abnormal condition, a network access request information sequence of the smart device within a preset time period is read.

[0063] In some embodiments, the execution subject may read the network access request information sequence of the smart device within a preset time period in response to determining that the initial abnormal data detection result meets the initial abnormal condition. The initial abnormal condition may be: the initial abnormal data detection result indicates that the network access request fails verification.

[0064] Optionally, the network access request information sequence is input into a pre-trained network access request anomaly detection model to obtain a network access anomaly detection result.

[0065] In some embodiments, the execution subject may input the network access request information sequence into a pre-trained network access request anomaly detection model to obtain a network access anomaly detection result. The network access request information may include network access request and network access behavior information. The network access behavior information may represent various browsing behaviors, click behaviors, download behaviors, information transmission behaviors when the smart device accesses the application, as well as the domain name information and account information of the smart device.

[0066] The network access request anomaly detection model can be trained through the following steps:

[0067] The first step is to obtain a network access request training sample set. The network access request training samples in the network access request training sample set include: sample network access request information and abnormal network access labels. The abnormal network access labels can indicate whether the sample network access request letter has abnormal / malicious access behavior.

[0068] The second step is to determine the initial network access request anomaly detection model. The initial network access request anomaly detection model includes: initial classification network, first initial feature extraction network, second initial feature extraction network, third initial feature extraction network, initial fusion network, initial access behavior detection network. The first initial feature extraction network is divided into five layers, including: first embedding layer, second embedding layer, third embedding layer, convolution layer, and fully connected layer.

[0069] Here, the above-mentioned initial classification network may be a network that takes the sample network access request information as input and takes the initial access behavior classification information group as output. The initial access behavior classification information group may include initial access behavior information, initial domain name information, and initial access account information. For example, the initial classification network is used to: classify the initial access behavior information, initial domain name information, and initial access account information included in the sample network access request information.

[0070] The first initial feature extraction network may be a classification model that takes the initial access behavior classification information group as input and takes the initial access behavior information, initial domain name information and initial access account information as output. Here, the first initial feature extraction network may be divided into five layers:

[0071] The first layer, the first embedding layer, is used to: vectorize the initial access behavior information to generate the initial access behavior vectorized information. For example, the first embedding layer can be an Embedding layer model.

[0072] The second layer, the second embedding layer, is used to: vectorize the initial domain name information to generate initial domain name vectorized information. For example, the second embedding layer can be an Embedding layer model.

[0073] The third layer, the third embedding layer, is used to: vectorize the initial access account information to generate the initial access account vectorized information. For example, the third embedding layer can be an Embedding layer model.

[0074] The fourth layer, the convolution layer, includes: a first convolution model, a second convolution model and a third convolution model. Among them, the first convolution model is a convolution model that takes the initial access behavior vectorized information as input and the initial access behavior convolution information as output; the second convolution model is a convolution model that takes the initial domain name vectorized information as input and the initial domain name convolution information as output; the third convolution model is a convolution model that takes the initial access account vectorized information as input and the initial access account convolution information as output. For example, the first convolution model can be a convolution model with a convolution kernel of 9 and a step size of 1. The second convolution model can be a convolution model with a convolution kernel of 7 and a step size of 1. The third convolution model can be a convolution model with a convolution kernel of 5 and a step size of 1.

[0075] The fifth layer, the fully connected layer, is used to connect the initial access behavior convolution information, the initial domain name convolution information and the initial access account convolution information to generate the first initial feature information. For example, the fully connected layer can be a Denselayer (fully connected) model.

[0076] The second initial feature extraction network may be a neural network model that takes the initial domain name information as input and the initial domain name feature information as output. The second initial feature extraction network may include three layers:

[0077] The first layer, the embedding layer, is used to vectorize the initial domain name information to generate initial domain name vectorized information. For example, the embedding layer can be an Embedding layer model.

[0078] The second layer, the convolution layer, includes: a first convolution model and a second convolution model, wherein the first convolution model is a convolution model that takes the initial domain name vectorization information as input and the first initial domain name convolution information as output, and the second convolution model is a convolution model that takes the first initial domain name convolution information as input and the second initial domain name convolution information as output. For example, the first convolution model can be a convolution model with a convolution kernel of 7 and a step size of 1. The second convolution model can be a convolution model with a convolution kernel of 5 and a step size of 1.

[0079] The third layer, the fully connected layer, is used to convert the second initial domain name convolution information to generate initial domain name feature information. For example, the fully connected layer can be a Dense layer (fully connected) model.

[0080] The third initial feature extraction network may be a neural network model that takes the initial access account information as input and takes the initial access account feature information as output. For example, the third initial feature extraction network may be a convolutional neural network model.

[0081] The third step is to select a target network access request training sample from the network access request training sample set. A network access request training sample can be randomly selected from the network access request training sample set as the target network access request training sample.

[0082] In the fourth step, the sample network access request information included in the target network access request training sample is input into the initial network access request anomaly detection model to obtain the initial network access anomaly detection result.

[0083] The fourth step may include the following sub-steps:

[0084] The first sub-step is to input the sample network access request information included in the target network access request training sample into the initial classification network to obtain an initial access behavior classification information group, wherein the initial access behavior classification information group includes: initial access behavior information, initial domain name information and initial access account information.

[0085] The second sub-step is to input the above-mentioned initial access behavior information into the first initial feature extraction network included in the above-mentioned initial abnormal network access behavior detection model to obtain the initial access behavior feature information.

[0086] The third sub-step is to input the above-mentioned initial domain name information into the second initial feature extraction network included in the above-mentioned initial abnormal network access behavior detection model to obtain the initial domain name feature information.

[0087] The fourth sub-step is to input the above-mentioned initial access account information into the third initial feature extraction network included in the above-mentioned initial abnormal network access behavior detection model to obtain the initial access account feature information.

[0088] The fifth sub-step is to input the above-mentioned initial access behavior feature information, the above-mentioned initial domain name feature information and the above-mentioned initial access account feature information into the initial fusion network included in the initial abnormal network access behavior detection model to obtain the initial network access behavior feature fusion information. The above-mentioned initial fusion network can be a model that takes the initial access behavior feature information, the above-mentioned initial domain name feature information and the above-mentioned initial access account feature information as input and takes the initial network access behavior feature fusion information as output. For example, the initial fusion network can be a Densenet convolutional network, a Resnet deep residual network, or a CBP (Compact Bilinear Pooling) network.

[0089] In a sixth sub-step, the initial network access behavior feature fusion information is input into the initial access behavior detection network included in the initial abnormal network access behavior detection model to obtain the initial network access anomaly detection result. The initial access behavior detection network may be a neural network model that takes the initial network access behavior feature fusion information as input and takes the initial network access anomaly detection result as output. For example, the initial access behavior detection network may be a support vector machine (SVM) model.

[0090] The fifth step is to determine the error value between the initial network access anomaly detection result and the corresponding abnormal network access label. The preset loss function may be, but is not limited to, mean square error loss function (MSE), hinge loss function (SVM), cross entropy loss function (CrossEntropy), 0-1 loss function, absolute value loss function, etc.

[0091] In a sixth step, in response to determining that the error value is less than or equal to a preset error value, the initial network access request anomaly detection model is determined as a trained network access request anomaly detection model.

[0092] Therefore, the initial access behavior information, initial domain name information and initial access account information can be divided by training the initial classification network. Then, the feature information in the initial access behavior information, initial domain name information and initial access account information can be more accurately extracted by training the feature extraction network including the embedding layer, convolution layer and full connection layer. Therefore, a more accurate access behavior detection result can be identified by the initial network access behavior feature fusion information to determine whether the access behavior is abnormal.

[0093] Optionally, in response to determining that the network access anomaly detection result meets the anomaly detection condition, the smart device is disabled.

[0094] In some embodiments, the execution entity may disable the smart device in response to determining that the network access anomaly detection result satisfies an anomaly detection condition.

[0095] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of an information monitoring device applied to the Internet of Things. These embodiments of the information monitoring device applied to the Internet of Things are similar to Figure 1 Corresponding to the method embodiments shown, the information monitoring device applied to the Internet of Things can be specifically applied to various electronic devices.

[0096] like Figure 2As shown, some embodiments of the information monitoring device 200 applied to the Internet of Things include: a determination unit 201, a verification unit 202, an acquisition unit 203, a standardization unit 204, an aggregation unit 205, a first update unit 206, a second update unit 207, an input unit 208 and a warning unit 209. The determination unit 201 is configured to, in response to receiving a login request from a smart device in the Internet of Things, determine whether the smart device is a target smart device, wherein the target smart device is obtained by performing data analysis and detection through the set configuration information; the verification unit 202 is configured to, in response to determining that the smart device is not the target smart device, verify the login request of the smart device; the acquisition unit 203 is configured to, in response to determining that the login request is verified, obtain the device resource information and resource relationship chain information of the smart device; the standardization unit 204 is configured to perform data standardization processing on the device resource information to generate standardized device resource information; the aggregation unit 205 is configured to The resource relationship chain information is subjected to data aggregation processing to generate resource relationship chain aggregation information; the first update unit 206 is configured to perform incremental update processing on the above-mentioned standardized device resource information to generate incremental device resource information; the second update unit 207 is configured to perform incremental update processing on the above-mentioned resource relationship chain aggregation information to generate incremental resource relationship chain aggregation information; the input unit 208 is configured to input the above-mentioned incremental device resource information and the above-mentioned incremental resource relationship chain aggregation information into a pre-trained resource relationship anomaly recognition model to obtain an abnormal resource relationship recognition result; the warning unit 209 is configured to perform abnormal warning processing on the above-mentioned smart device in response to determining that the above-mentioned abnormal resource relationship recognition result represents the existence of an abnormality.

[0097] It is understandable that the units recorded in the information monitoring device 200 applied to the Internet of Things are similar to those in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the information monitoring device 200 applied to the Internet of Things and the units contained therein, and will not be repeated here.

[0098] Reference below Figure 3 , which shows a schematic diagram of the structure of an electronic device (e.g., a computing device) 300 suitable for implementing some embodiments of the present disclosure. The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (e.g., vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 3The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0099] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0100] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0101] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0102] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0103] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0104] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: in response to receiving a login request from a smart device in the Internet of Things, determines whether the smart device is a target smart device, wherein the target smart device is obtained by performing data analysis and detection through the set configuration information; in response to determining that the smart device is not the target smart device, verifies the login request of the smart device; in response to determining that the login request is verified, obtains the device resource information and resource relationship chain information of the smart device; performs data standardization processing on the device resource information to generate standardized device resource information; performs data aggregation processing on the resource relationship chain information to generate resource relationship chain aggregation information; performs incremental update processing on the standardized device resource information to generate incremental device resource information; performs incremental update processing on the resource relationship chain aggregation information to generate incremental resource relationship chain aggregation information; inputs the incremental device resource information and the incremental resource relationship chain aggregation information into a pre-trained resource relationship anomaly recognition model to obtain an abnormal resource relationship recognition result; in response to determining that the abnormal resource relationship recognition result indicates the existence of an abnormality, performs abnormal warning processing on the smart device.

[0105] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0106] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0107] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor comprising: a determination unit, a verification unit, an acquisition unit, a standardization unit, an aggregation unit, a first update unit, a second update unit, an input unit, and a warning unit. Among them, the names of these units do not constitute a limitation on the unit itself under certain circumstances. For example, a blocking unit may also be described as "a unit that blocks the above-mentioned target user in response to determining that the above-mentioned information monitoring result applied to the Internet of Things represents abnormal access."

[0108] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0109] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. An information monitoring method applied to the Internet of Things, comprising: In response to receiving a login request from a smart device in the Internet of Things, determining whether the smart device is a target smart device, wherein the target smart device is obtained by performing data analysis and detection on the set configuration information; In response to determining that the smart device is not a target smart device, verifying a login request of the smart device; In response to determining that the login request is authenticated, acquiring device resource information and resource relationship chain information of the smart device; Performing data standardization processing on the device resource information to generate standardized device resource information; Performing data aggregation processing on the resource relationship chain information to generate resource relationship chain aggregation information; Performing incremental update processing on the standardized device resource information to generate incremental device resource information; Performing incremental update processing on the resource relationship chain aggregation information to generate incremental resource relationship chain aggregation information; Inputting the incremental device resource information and the incremental resource relationship chain aggregation information into a pre-trained resource relationship anomaly recognition model to obtain an abnormal resource relationship recognition result; In response to determining that the abnormal resource relationship identification result indicates the existence of an abnormality, abnormal warning processing is performed on the smart device.

2. The method according to claim 1, wherein: The performing data standardization processing on the device resource information to generate standardized device resource information includes: Normalizing the device resource information to generate normalized device resource information; The normalized device resource information is subjected to data cleaning processing to generate standardized device resource information.

3. The method according to claim 1, wherein: The performing data aggregation processing on the resource relationship chain information to generate resource relationship chain aggregate information includes: Performing relationship chain instantiation processing on the resource relationship chain information to generate relationship chain instantiation information; Performing relationship node instantiation processing on the resource relationship chain information to generate relationship node instantiation information; Data aggregation processing is performed on the relationship chain instantiation information and the relationship node instantiation information to generate resource relationship chain aggregation information.

4. The method according to claim 1, wherein: The method further comprises: In response to detecting a network access request sent by a smart device, intercepting the network access request; Determining whether the network access request is a target network access request according to preset network access monitoring configuration information, wherein the network access monitoring configuration information is information used to configure the target network access data to be monitored and the network access monitoring policy; In response to determining that the network access request is a target network access request, performing an access tag on the network access request to obtain a marked network access request, and sending the marked network access request to the server through a corresponding transmission interface; According to the network access monitoring policy in the network access monitoring configuration information, initial abnormal data detection processing is performed on the data of the network access request to obtain an initial abnormal data detection result; In response to determining that the initial abnormal data detection result meets the initial abnormal condition, reading a sequence of network access request information of the smart device within a preset time period; Inputting the network access request information sequence into a pre-trained network access request anomaly detection model to obtain a network access anomaly detection result; In response to determining that the network access anomaly detection result meets an anomaly detection condition, disabling processing is performed on the smart device.

5. An information monitoring device applied to the Internet of Things, comprising: A determination unit is configured to, in response to receiving a login request from a smart device in the Internet of Things, determine whether the smart device is a target smart device, wherein the target smart device is obtained by performing data analysis and detection on the set configuration information; a verification unit configured to verify a login request of the smart device in response to determining that the smart device is not a target smart device; An acquiring unit, configured to acquire device resource information and resource relationship chain information of the smart device in response to determining that the login request verification is passed; a standardization unit configured to perform data standardization processing on the device resource information to generate standardized device resource information; an aggregation unit, configured to perform data aggregation processing on the resource relationship chain information to generate resource relationship chain aggregation information; A first updating unit is configured to perform incremental update processing on the standardized device resource information to generate incremental device resource information; A second updating unit is configured to perform incremental update processing on the resource relationship chain aggregation information to generate incremental resource relationship chain aggregation information; An input unit is configured to input the incremental device resource information and the incremental resource relationship chain aggregation information into a pre-trained resource relationship anomaly recognition model to obtain an abnormal resource relationship recognition result; The warning unit is configured to perform abnormal warning processing on the smart device in response to determining that the abnormal resource relationship identification result represents the existence of an abnormality.

6. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4.

7. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images