Security risk assessment system and method based on Internet of Things

Abstract

The invention discloses a security risk assessment system and method based on the Internet of Things, and relates to the technical field of digital information transmission, and the method comprises the steps: detecting the working state of physical equipment, guaranteeing the normal operation of the physical equipment, then assessing the aggressiveness of a platform, collecting software protection data, and meanwhile, obtaining security operation deviation data and software security reference data; and performing comprehensive analysis in combination with the operation state index of the physical equipment to obtain a security risk assessment value, and comparing the assessment value with a preset standard to determine a security risk level. By comprehensively considering software and hardware factors, the accuracy and reliability of evaluation are improved, potential security threats can be found and prevented in advance, and the security of the Internet of Things system is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a security risk assessment system and method based on the Internet of Things. Background Art

[0002] With the rapid development and widespread application of Internet of Things (IoT) technology, smart homes, smart cities, industrial Internet and other fields have put forward higher requirements for the security of IoT platforms. In these scenarios, IoT devices must not only achieve efficient data collection and transmission, but also ensure data security and privacy protection. Therefore, there is a need for a method that can comprehensively evaluate the security risks of IoT platforms to help users promptly discover and resolve potential security risks and ensure the stable operation of the system.

[0003] At present, the solutions for IoT security risk assessment are mainly focused on the software level, evaluating the security of the system by monitoring network traffic, identifying abnormal behavior, etc. Although some solutions also involve checking the hardware status, they are usually simple and lack in-depth security assessment of physical devices. In addition, some assessment methods focus on post-event analysis, that is, investigating and handling security incidents after they occur, but lack effective preventive measures.

[0004] Existing security risk assessment methods often ignore the security status of the physical device itself, while hardware failure or malicious exploitation can also pose a serious threat to the entire IoT system. Secondly, existing assessment methods mostly rely on static data analysis and fail to fully consider the impact of the dynamically changing network environment on system security. Finally, most assessment methods lack a unified standard to quantify security risks, making it difficult to compare and evaluate different systems. Summary of the invention

[0005] In view of the deficiencies of the prior art, the present invention provides a security risk assessment system and method based on the Internet of Things, which solves the problem that it is difficult to combine multi-faceted assessments to timely discover equipment failures and potential security vulnerabilities in the prior art.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a security risk assessment method based on the Internet of Things, comprising the following steps: performing a security assessment on the physical devices of the Internet of Things platform to determine whether the physical devices can work normally, and if the physical devices cannot work normally, issuing an alarm notification; if the physical devices can work normally, evaluating the vulnerability of the Internet of Things platform; obtaining software protection data of the Internet of Things platform, evaluating the security risk of the Internet of Things platform, and obtaining a security risk level, the software protection data including the successful interception rate of the attack, the CPU occupancy rate when the platform recovers after the attack, the recovery time of the platform after the attack, and the average data loss after the attack; the obtaining of software protection data of the Internet of Things platform, evaluating the security risk of the Internet of Things platform, and obtaining a security risk level, comprising the following steps: obtaining safe operation deviation data, the safe operation deviation data The difference data includes the allowed deviation rate of successful interception of the attack and the CPU occupancy deviation when the platform recovers after the attack; the software security reference data stored in the database is obtained, and the software security reference data includes the reference interception rate of successful attack, the reference CPU occupancy when the platform recovers after the attack, the reference recovery time of the platform after the attack, and the average reference loss of data after the attack; the operation status index of the physical device is obtained; the operation status index of the physical device, the software security reference data and the software protection data stored in the database are comprehensively analyzed to obtain a security risk assessment value; the security risk assessment value is compared with each security risk matching assessment value stored in the database. If the security risk assessment value is equal to a security risk matching assessment value stored in the database, the security risk level corresponding to the security risk matching assessment value stored in the database is obtained as the security risk level of the security risk assessment value.

[0007] Furthermore, the security assessment of the physical devices of the Internet of Things platform to determine whether the physical devices can work normally includes the following steps: obtaining the actual location information of the physical device; comparing the obtained actual location information of the physical device with the set location information of the physical device stored in the database to determine whether the actual location information of the physical device is consistent with the set location information of the physical device stored in the database: if the actual location information of the physical device is inconsistent with the set location information of the physical device stored in the database, it is determined that the physical device cannot work normally and an alarm notification is issued; if the actual location information of the physical device is consistent with the set location information of the physical device stored in the database, the physical device is obtained. The operating data of the device includes the data flow rate flowing through the physical device within a set time, the operating temperature of the physical device and the power consumption of the physical device within the set time; obtaining the operating status index of the physical device based on the operating data of the physical device; comparing the operating status index of the physical device with the operating status evaluation threshold of the physical device stored in the database: if the operating status index of the physical device is greater than the operating status evaluation threshold of the physical device stored in the database, it is determined that the physical device cannot work normally and an alarm notification is issued; if the operating status index of the physical device is not greater than the operating status evaluation threshold of the physical device stored in the database, it is determined that the physical device can work normally.

[0008] Furthermore, the obtaining of the operating status index of the physical device based on the operating data of the physical device includes the following steps: obtaining operating reference data corresponding to the physical device stored in a database, the operating reference data including a reference flow rate of data flowing through the physical device within a set time, an operating reference temperature of the physical device, and a reference power consumption within a set range of the physical device; fusing and analyzing the operating data of the physical device with the operating reference data corresponding to the physical device stored in the database to obtain the operating status index of the physical device.

[0009] Furthermore, the calculation formula of the operating status index of the physical device is as follows: ; In the formula, is the operating status index, is the data flow through the physical device within a set time. is the operating temperature of the physical device, Set the power consumption of physical devices within a certain time interval. is the reference flow of data flowing through the physical device within the set time. is the operating reference temperature of the physical device, Set the reference power consumption for the physical device within a certain period. is a natural constant.

[0010] Furthermore, the vulnerability of the Internet of Things platform is evaluated, including the following steps: obtaining the attacked data of the Internet of Things platform, the attacked data including the attack frequency and the average attack duration within a set time; obtaining the attack definition data stored in the database, the attack definition data including the attack definition frequency and the average attack definition duration within a set time; fusing and analyzing the attacked data of the Internet of Things platform with the attack definition data stored in the database to obtain a vulnerability index; comparing the vulnerability index with each vulnerability matching index stored in the database, if the vulnerability index is equal to a certain vulnerability matching index stored in the database, obtaining the vulnerability level corresponding to the vulnerability matching index stored in the database as the vulnerability level of the Internet of Things platform.

[0011] Furthermore, the calculation formula of the vulnerability index is as follows: ; In the formula, is the vulnerability index, is the attack frequency within the set time. is the average attack duration, Define the frequency of being attacked within a set time. Define the average attack duration, is the attack frequency weight factor set in the database, It is the weight factor of the average attack duration set in the database.

[0012] Furthermore, the obtaining of safe operation deviation data comprises the following steps: comparing the vulnerability index with each safe operation deviation index stored in a database; if the vulnerability index is equal to a safe operation deviation index stored in the database, obtaining the safe operation deviation data corresponding to the safe operation deviation index stored in the database.

[0013] Furthermore, the calculation formula of the security risk assessment value is as follows: ; In the formula, is the security risk assessment value, is the successful interception rate of the attack, is the CPU usage when the platform recovers after being attacked. It is the time it takes for the platform to recover after being attacked. is the average amount of data lost after the attack, The allowed deviation rate for successful interception of the attack, It is the CPU usage deviation when the platform recovers after being attacked. The interception rate for successful attack is referenced by: It is the reference CPU usage when the platform recovers after being attacked. It is the reference recovery time of the platform after being attacked. is the average reference loss of data after the attack, is a natural constant, is the operating status index of the physical device, is the operating status index weight factor of the physical device set in the database, The software data weight factor set for the database.

[0014] A security risk assessment system based on the Internet of Things is applied to the above-mentioned security risk assessment method based on the Internet of Things, including a physical device assessment module, a vulnerability assessment module and a security risk assessment module, wherein: the physical device assessment module is used to perform a security assessment on the physical devices of the Internet of Things platform, to determine whether the physical devices can work normally, and to issue an alarm notification if the physical devices cannot work normally; the vulnerability assessment module is used to assess the vulnerability of the Internet of Things platform if the physical devices can work normally; the security risk assessment module is used to obtain software protection data of the Internet of Things platform, to assess the security risk of the Internet of Things platform, and to obtain a security risk level, wherein the software protection data includes a successful interception rate of attacks, a platform recovery time after attacks, and an average amount of data loss after attacks; the software protection data of the Internet of Things platform is obtained, the security risk of the Internet of Things platform is assessed, and the security risk level is obtained, including The following steps include: obtaining safe operation deviation data, the safe operation deviation data including the allowed deviation rate of successful interception of attacks and the deviation of CPU occupancy rate when the platform recovers after being attacked; obtaining software security reference data stored in a database, the software security reference data including the reference interception rate of successful attacks, the reference CPU occupancy rate when the platform recovers after being attacked, the reference recovery time of the platform after being attacked and the average reference amount of data lost after being attacked; obtaining the operation status index of the physical device; comprehensively analyzing the operation status index of the physical device, the software security reference data and the software protection data stored in the database to obtain a security risk assessment value; comparing the security risk assessment value with each security risk matching assessment value stored in the database, and if the security risk assessment value is equal to a certain security risk matching assessment value stored in the database, obtaining the security risk level corresponding to the security risk matching assessment value stored in the database as the security risk level of the security risk assessment value.

[0015] The present invention has the following beneficial effects: This IoT-based security risk assessment method can timely detect equipment failures and potential security vulnerabilities through systematic hardware and software assessments. By judging the normal working status of physical equipment, it can effectively warn and reduce the occurrence of security incidents; and by analyzing software protection data, it can fully understand the platform's vulnerability, recovery capabilities and data security, thereby providing enterprises with scientific risk level assessments, helping them formulate corresponding security measures and optimization strategies, effectively reducing security risks, and protecting user data and privacy, aiming to improve the overall security of the IoT platform.

[0016] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 This is a flow chart of the security risk assessment method based on the Internet of Things of the present invention.

[0018] Figure 2 This is a flowchart of the security risk assessment system based on the Internet of Things of the present invention. DETAILED DESCRIPTION

[0019] The embodiments of the present application improve the overall security of the Internet of Things platform through a security risk assessment method and system based on the Internet of Things, and timely discover device failures and potential security vulnerabilities through systematic hardware and software evaluation.

[0020] See also Figure 1 The embodiment of the present invention provides a technical solution: a security risk assessment method based on the Internet of Things, comprising the following steps: Step S102, performing a security assessment on the physical devices of the IoT platform to determine whether the physical devices can work normally. If the physical devices cannot work normally, an alarm notification is issued; Step S104, if the physical device can work normally, then evaluate the vulnerability of the IoT platform; Step S106, obtaining software protection data of the Internet of Things platform, evaluating the security risk of the Internet of Things platform, and obtaining a security risk level, wherein the software protection data includes the successful interception rate of attacks, the CPU occupancy rate when the platform recovers after the attack, the platform recovery time after the attack, and the average amount of data lost after the attack.

[0021] The successful interception rate of attacks is obtained through the logs of security tools such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). The CPU usage rate when the platform recovers after the attack is recorded through monitoring logs and performance dashboards, and the peak CPU usage rate after the attack is recorded. The platform recovery time after the attack is recorded through monitoring and logging to ensure the timestamps of the start of the attack event and the completion of recovery. The average amount of data loss after the attack is calculated by monitoring and recording the amount of data lost due to the attack after the attack occurs, including the number of lost records or business indicators (such as transaction data), and then calculating the average loss.

[0022] The successful interception rate of attacks directly affects the security of the platform. If the interception rate is high, it means that the platform has good protection capabilities and reduces the probability of successful attacks, which will affect the complexity and resource consumption of subsequent recovery. The CPU usage rate when the platform recovers after being attacked is related to the successful interception rate of attacks. If the interception rate is high, the CPU usage rate may be low during the recovery process due to the successful interception of the attack; conversely, if the attack is successful, the system may consume more resources for recovery and repair. The recovery time of the platform after being attacked is related to the CPU usage rate when the platform recovers after being attacked. If the CPU usage rate is high, it often leads to a longer recovery time because the system needs more time to process related requests. The average amount of data lost after being attacked is closely related to the nature of the attack and the speed of recovery. If the interception rate is low and the recovery time is long, the data loss may be more serious. Therefore, these parameters can jointly reflect the security risk and recovery ability of the platform.

[0023] First of all, we should start from the hardware level and ensure that all devices are working properly. This is the basis for ensuring the security of the entire IoT platform. By monitoring the device status in real time, we can promptly discover potential faults and abnormal conditions and avoid the expansion of potential safety hazards. When the hardware is normal, we should focus on analyzing the security data at the software level, including the successful interception rate, recovery capability and data loss, so as to comprehensively assess the security risks of the platform. According to the assessment results, we can determine the security risk level and provide a basis for subsequent decision-making.

[0024] Specifically, the security assessment of the physical devices of the Internet of Things platform to determine whether the physical devices can work normally includes the following steps: obtaining the actual location information of the physical device; comparing the obtained actual location information of the physical device with the set location information of the physical device stored in the database to determine whether the actual location information of the physical device is consistent with the set location information of the physical device stored in the database: if the actual location information of the physical device is inconsistent with the set location information of the physical device stored in the database, it is determined that the physical device cannot work normally, and an alarm notification is issued.

[0025] If the actual location information of the physical device is consistent with the set location information of the physical device stored in the database, the operation data of the physical device is obtained, and the operation data includes the data flow through the physical device within the set time, the operating temperature of the physical device, and the power consumption of the physical device within the set time. The data flow through the physical device within the set time monitors the amount of data transmitted by the device within the set time through a network interface (such as Ethernet, Wi-Fi, cellular network, etc.). The data flow can be recorded using a network monitoring tool or the built-in statistical function of the device. The operating temperature of the physical device monitors the temperature inside or outside the device in real time through a temperature sensor (such as a thermocouple, thermistor, etc.). The sensor is usually connected to the control unit of the device and can transmit temperature data to the monitoring system in real time. The power consumption of the physical device within the set time monitors the power consumption of the device through a current sensor and a voltage sensor. Devices such as power meters or smart sockets can be used to record the total power consumption of the device within the set time.

[0026] Generally speaking, the greater the data flow of a device, the higher the power consumption will be. This is because the device consumes more power when processing and transmitting data. Especially under high load conditions, the CPU and network module of the device will increase the work intensity, resulting in increased power consumption. There is also a certain relationship between the operating temperature of the device and power consumption. Generally speaking, when the device is in a high temperature state, it may cause the cooling system (such as fans) to work extra, thereby increasing power consumption. In addition, high temperature may affect the performance of the device, causing it to require more power to maintain normal operation. The operating temperature of the device may affect its ability to process data. Under high temperature conditions, the device may enter a frequency reduction mode, resulting in a decrease in the data processing speed, thereby affecting data flow. At the same time, excessively high temperatures may cause the device to malfunction, directly affecting its normal operation and data flow.

[0027] An operation status index of the physical device is obtained based on the operation data of the physical device; the operation status index of the physical device is compared with an operation status evaluation threshold of the physical device stored in a database: if the operation status index of the physical device is greater than the operation status evaluation threshold of the physical device stored in the database, it is determined that the physical device cannot work normally, and an alarm notification is issued; if the operation status index of the physical device is not greater than the operation status evaluation threshold of the physical device stored in the database, it is determined that the physical device can work normally.

[0028] The operating status assessment thresholds of the physical equipment stored in the database are obtained by analyzing historical data. This process includes statistics and modeling of key performance indicators of the equipment in normal operation and failure state to identify the normal range and trend of each indicator. Regression analysis is performed using historical data to extract thresholds that reflect the health status of the equipment. These thresholds serve as the basis for subsequent monitoring and early warning, so as to timely discover potential problems and take maintenance measures.

[0029] In this implementation scheme, first, the actual location information of the physical device is obtained through GPS, network or other positioning technologies. This is the first step to ensure that the device is working normally at the predetermined location. The actual location information obtained is compared with the set location information stored in the database. If the two are inconsistent, it means that the device may have been moved or physically attacked, and it is judged to be abnormal, and an alarm notification is issued. If the location information is consistent, the operating data of the device continues to be obtained, including the data flow of the physical device, the operating temperature of the physical device, and the power consumption of the physical device within the set time. Data flow: reflects the workload and network activity of the device. Operating temperature: monitors the thermal state of the device, which may affect its performance. Power consumption: evaluates the energy efficiency and working status of the device.

[0030] Based on the collected operation data, the operation status index of the physical device is calculated. This index is a comprehensive evaluation of the performance and health of the device. The calculated operation status index is compared with the evaluation threshold stored in the database. If the operation status index is greater than the evaluation threshold, it means that the device may be abnormal and an alarm notification needs to be issued. If the operation status index is not greater than the evaluation threshold, it is determined that the device can work normally, otherwise it is abnormal.

[0031] By real-time monitoring of the location information and operating status of equipment, potential security risks can be discovered in a timely manner and the risk of being attacked or tampered with can be reduced. The collected operating data can provide a basis for subsequent maintenance and optimization, helping companies to formulate more reasonable equipment management strategies. By implementing a strict security assessment mechanism, users' trust in the IoT platform can be enhanced, thereby improving user experience and satisfaction.

[0032] Specifically, the operation status index of the physical device is obtained based on the operation data of the physical device, including the following steps: obtaining the operation reference data corresponding to the physical device stored in the database, the operation reference data including the data reference flow rate flowing through the physical device within the set time, the operation reference temperature of the physical device and the reference power consumption within the set time of the physical device; fusing and analyzing the operation data of the physical device with the operation reference data corresponding to the physical device stored in the database to obtain the operation status index of the physical device. The operation reference data is established by long-term monitoring and recording the operation data of the equipment, including the flow rate, temperature and power consumption of the equipment under different working conditions, and performing statistical analysis on the historical data to calculate the average value or median under normal operating conditions. These values ​​are usually regarded as reference values.

[0033] The calculation formula of the operating status index of the physical device is as follows: ; In the formula, is the operating status index, is the data flow through the physical device within a set time. is the operating temperature of the physical device, Set the power consumption of physical devices within a certain time interval. is the reference flow of data flowing through the physical device within the set time. is the operating reference temperature of the physical device, Set the reference power consumption for the physical device within a certain period. is a natural constant.

[0034] In this embodiment, Indicates the difference between the actual data flow rate SL of the device and the reference data flow rate cSL. , which emphasizes the impact of flow differences. The larger the difference, the higher the operating status index, indicating that there may be problems with the equipment. The relationship between the difference in operating temperature and power consumption and the reference value is considered. The difference in temperature and power consumption is normalized to ensure that the relative importance of these two factors in the status assessment is reasonably reflected. The natural logarithm is used to convert the above comprehensive indicators into a more understandable scale and avoid the influence of extreme values ​​on the results, making the index value smoother.

[0035] This formula provides a comprehensive assessment of the device's operating status by simultaneously considering data flow, temperature, and power consumption, and can more accurately reflect the health of the device. The square and exponential operations of flow differences in the formula design make it very sensitive to small deviations, and can promptly detect potential problems and reduce the risk of failures. The calculated operating status index can serve as the basis for an early warning mechanism, helping operation and maintenance personnel to take timely measures to optimize equipment operation and reduce maintenance costs.

[0036] Specifically, evaluating the vulnerability of an Internet of Things platform includes the following steps: obtaining the attacked data of the Internet of Things platform, the attacked data including the attack frequency and the average attack duration within a set time; obtaining the attack definition data stored in a database, the attack definition data including the attack definition frequency and the average attack definition duration within a set time; fusing and analyzing the attacked data of the Internet of Things platform with the attack definition data stored in the database to obtain a vulnerability index; comparing the vulnerability index with each vulnerability matching index stored in the database, if the vulnerability index is equal to a certain vulnerability matching index stored in the database, obtaining the vulnerability level corresponding to the vulnerability matching index stored in the database as the vulnerability level of the Internet of Things platform.

[0037] The attack frequency within a set time is obtained by recording the number of attacks on the IoT platform within a set time range, which can be obtained through monitoring system logs, intrusion detection systems (IDS) and other tools. The average attack duration is obtained by calculating the average duration of each attack, usually by analyzing the start and end time of the attack event. The frequency of attack events within a set time is extracted from the database. These events include identified attack patterns, vulnerability exploits, etc., and the average duration of these defined events is calculated.

[0038] A high frequency of attacks usually means that the attacker is interested in the system and may show its potential value or vulnerability. If a system is frequently attacked, its security strategy should be given priority. If the attack event lasts for a long time, it may indicate that the attacker has successfully penetrated the primary defense measures and is active inside the system, which usually indicates a more serious security risk. For example, a long attack may lead to more serious data leakage or system damage. A high frequency of attacks and a short average attack duration may mean that the attacker is trying to use quick and temporary attack methods, which may reflect the rapidity and breadth of the attack behavior, but lacks deep penetration. On the other hand, if the attack frequency is low but the average attack duration is long, it may indicate that the attacker is quietly lurking in the system and deeply penetrating, which may lead to more serious security incidents. The combination of these two parameters helps to analyze specific patterns. For example, if a certain type of attack is attacked frequently but the attack duration is short, it may mean that the attack is easy to detect and prevent, thereby providing the security team with a direction for defense.

[0039] The acquired attacked data and the attacked definition data are integrated, and weighted average, standardization and other methods may be used to comprehensively consider the impact of the two, and a comprehensive vulnerability index is obtained. The calculated vulnerability index is compared with each vulnerability matching index stored in the database, and an equal matching index is found to obtain the corresponding vulnerability level (for example, the vulnerability matching indexes stored in the database are 1, 2 and 3, where 1 corresponds to level 1, 2 corresponds to level 2, and 3 corresponds to level 3. When the vulnerability index is 2, the obtained vulnerability level is level 2). Based on the comparison results, the vulnerability level of the IoT platform is determined to help decision makers evaluate security.

[0040] The calculation formula of the vulnerability index is as follows: ; In the formula, is the vulnerability index, is the attack frequency within the set time. is the average attack duration, Define the frequency of being attacked within a set time. Define the average attack duration, is the attack frequency weight factor set in the database, It is the weight factor of the average attack duration set in the database.

[0041] Weight Factor and It is obtained from the database and the weight factor is established through the historical measurement of attack frequency and average attack duration. and The mapping set of the attack frequency and the average attack duration in the current set time is obtained. and .

[0042] In this implementation scheme, the relative vulnerability of the system can be evaluated by comparing the attack frequency and attack duration with the benchmark value. If Ps and Ts are higher than the benchmark value, the vulnerability index Ysg will increase, otherwise it will decrease. The weight factor allows the system to adjust the importance of the attack frequency and attack duration according to the specific situation. This means that in some environments, frequent small-scale attacks may be more important, while in other environments, a small number of but continuous attacks may be more worthy of attention. Using the tanh function can limit the calculation results to a reasonable range, which is convenient for subsequent analysis and decision-making, and avoids excessively extreme values ​​from affecting the judgment.

[0043] The formula comprehensively considers two key factors: attack frequency and attack duration, and provides a comprehensive vulnerability assessment indicator. By monitoring and analyzing the vulnerability index, potential security risks can be identified in a timely manner, preventive measures can be taken, and the possibility and impact of attacks can be reduced.

[0044] Specifically, the software protection data of the IoT platform is obtained, the security risk of the IoT platform is evaluated, and the security risk level is obtained, including the following steps: obtaining safe operation deviation data, the safe operation deviation data is obtained from the database, and by deploying IDS, the activities of the network and system can be monitored in real time, and potential security vulnerabilities or violations can be detected. IDS can identify activities that are different from the normal operation mode, thereby generating deviation data. The safe operation deviation data includes the deviation rate allowed by the successful interception of the attack and the deviation of the CPU occupancy rate when the platform recovers after the attack; obtaining the software security reference data stored in the database, the software security reference data includes the successful reference interception rate of the attack, the reference CPU occupancy rate when the platform recovers after the attack, the reference recovery time of the platform after the attack, and the average reference amount of data lost after the attack. The software security reference data is obtained by analyzing historical attack events, using performance monitoring tools, performing recovery tests and data integrity monitoring. Specifically, the successful interception rate can be obtained by the intrusion detection system and firewall records, the CPU occupancy rate during recovery is counted by the performance monitoring tool, and the recovery time and data loss are evaluated by disaster recovery testing and log analysis. In addition, industry reports and laboratory tests also provide valuable references for relevant data. These combined approaches contribute to comprehensive safety performance indicators.

[0045] Obtain the operation status index of the physical device; conduct a comprehensive analysis on the operation status index of the physical device, the safe operation deviation data, the software safety reference data and the software protection data stored in the database to obtain a security risk assessment value; compare the security risk assessment value with each security risk matching assessment value stored in the database; if the security risk assessment value is equal to a security risk matching assessment value stored in the database, obtain the security risk level corresponding to the security risk matching assessment value stored in the database as the security risk level of the security risk assessment value.

[0046] Obtain the allowable deviation rate involving successful interception of attacks and the deviation of CPU occupancy when the platform recovers after an attack. Obtain key software security reference data from the database, including the reference interception rate of successful attacks, the reference CPU occupancy when the platform recovers after an attack, the reference recovery time of the platform after an attack, and the average reference loss of data after an attack. These data are used to set a benchmark to facilitate the comparison of the gap between actual performance and theoretical expectations. Comprehensively analyze the security operation deviation data and the reference data to form a security risk assessment value. Compare the calculated security risk assessment value with the security risk matching assessment values ​​stored in the database. If a security risk assessment value is found to be equal to a known assessment value, the security risk level corresponding to the assessment value can be obtained. This step ensures the standardization and repeatability of risk assessment.

[0047] By regularly acquiring and analyzing data, real-time monitoring of the security status of the IoT platform can be achieved, and potential security risks can be discovered in a timely manner. The security risk assessment value obtained through data analysis provides a basis for decision makers, so that security strategies and emergency responses can be based on objective data rather than relying solely on subjective judgment. By comparing with the security risk matching assessment value in the database, it can ensure that the assessment results of different cases are consistent and comparable, and help effective communication between different teams or systems.

[0048] The obtaining of the safe operation deviation data comprises the following steps: comparing the vulnerability index with each safe operation deviation index stored in a database; if the vulnerability index is equal to a safe operation deviation index stored in the database, obtaining the safe operation deviation data corresponding to the safe operation deviation index stored in the database.

[0049] The calculation formula of the security risk assessment value is as follows: ; In the formula, is the security risk assessment value, is the successful interception rate of the attack, is the CPU usage when the platform recovers after being attacked. It is the time it takes for the platform to recover after being attacked. is the average amount of data lost after the attack, The allowed deviation rate for successful interception of the attack, It is the CPU usage deviation when the platform recovers after being attacked. The interception rate for successful attack is referenced by: It is the reference CPU usage when the platform recovers after being attacked. It is the reference recovery time of the platform after being attacked. is the average reference loss of data after the attack, is a natural constant, is the operating status index of the physical device, is the operating status index weight factor of the physical device set in the database, The software data weight factor set for the database.

[0050] and It is obtained from the database and established through historically measured software data and operating status index. and The mapping set of the current software data and the corresponding running status index is obtained. and .

[0051] In this implementation, the use of logarithmic and hyperbolic tangent functions, as well as exponential functions in the formula, allows for a smoother response to changes in various variables, avoiding over-amplification of small changes. The formula integrates a variety of relevant indicators (such as interception rate, CPU occupancy, recovery time, and data loss) to form a comprehensive risk assessment, helping to more accurately identify system weaknesses. By allowing for deviations, the formula can flexibly adapt to different environments and needs, enhancing flexibility in practical applications. By considering the hardware operating status and corresponding weights, the evaluation can provide a more accurate analysis of the performance of specific devices, extending the simple software data analysis to the performance of the entire platform.

[0052] A security risk assessment system based on the Internet of Things is applied to the above-mentioned security risk assessment method based on the Internet of Things, such as Figure 2As shown, it includes a physical device assessment module 10, a vulnerability assessment module 20 and a security risk assessment module 30, wherein: the physical device assessment module is used to perform a security assessment on the physical devices of the Internet of Things platform to determine whether the physical devices can work normally, and if the physical devices cannot work normally, an alarm notification is issued; the vulnerability assessment module is used to assess the vulnerability of the Internet of Things platform if the physical devices can work normally; the security risk assessment module is used to obtain the software protection data of the Internet of Things platform, assess the security risks of the Internet of Things platform, and obtain the security risk level, wherein the software protection data includes the successful interception rate of the attack, the platform recovery time after the attack, and the average data loss after the attack.

[0053] An electronic device includes: a processor and a memory, wherein computer program instructions are stored in the memory, and when the computer program instructions are executed by the processor, the processor executes the security risk assessment method based on the Internet of Things as described above.

[0054] A computer-readable storage medium is used to store a program, and when the program is executed by a processor, the security risk assessment method based on the Internet of Things as described above is implemented.

[0055] In summary, this application has at least the following effects: Through systematic hardware and software evaluation, equipment failures and potential security vulnerabilities can be discovered in a timely manner. By judging the normal working status of physical equipment, it can effectively warn and reduce the occurrence of security incidents; and through the analysis of software protection data, it can fully understand the platform's vulnerability, recovery capabilities and data security, thereby providing enterprises with scientific risk level assessments, helping them to formulate corresponding security measures and optimization strategies, effectively reducing security risks, protecting user data and privacy, and aiming to improve the overall security of the IoT platform.

[0056] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0057] The present invention is described with reference to flowcharts and / or block diagrams of systems, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0058] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0059] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0060] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0061] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A security risk assessment method based on the Internet of Things, characterized in that: include: Conduct security assessments on the physical devices of the IoT platform to determine whether the physical devices can work normally. If the physical devices cannot work normally, issue alarm notifications. If the physical device works properly, assess the vulnerability of the IoT platform; The software protection data of the IoT platform is obtained, and the security risk of the IoT platform is evaluated in combination with the physical device status of the IoT platform to obtain the security risk level. The software protection data includes the successful interception rate of attacks, the CPU occupancy rate when the platform recovers after the attack, the platform recovery time after the attack, and the average data loss after the attack.

2. The security risk assessment method based on the Internet of Things according to claim 1 is characterized in that: The software protection data of the IoT platform is obtained, and the security risk of the IoT platform is evaluated in combination with the physical device status of the IoT platform to obtain the security risk level, including: Acquire safe operation deviation data, wherein the safe operation deviation data includes an allowable deviation rate of successful interception of an attack and a CPU occupancy rate deviation when the platform recovers after the attack; Obtain software security reference data stored in a database, wherein the software security reference data includes a reference interception rate of successful attacks, a reference CPU occupancy rate when the platform recovers after an attack, a reference recovery time of the platform after an attack, and an average reference amount of data loss after an attack; Get the running status index of the physical device; Comprehensively analyze the operation status index of physical equipment, safe operation deviation data, software safety reference data and software protection data stored in the database to obtain a safety risk assessment value; The security risk assessment value is compared with each security risk matching assessment value stored in the database. If the security risk assessment value is equal to a security risk matching assessment value stored in the database, the security risk level corresponding to the security risk matching assessment value stored in the database is obtained as the security risk level of the security risk assessment value.

3. The security risk assessment method based on the Internet of Things according to claim 1 is characterized in that: The security assessment of the physical devices of the IoT platform to determine whether the physical devices can work normally includes: Get the actual location information of the physical device; Compare the acquired actual location information of the physical device with the set location information of the physical device stored in the database to determine whether the actual location information of the physical device is consistent with the set location information of the physical device stored in the database: If the actual location information of the physical device is inconsistent with the set location information of the physical device stored in the database, it is determined that the physical device cannot work normally and an alarm notification is issued; If the actual location information of the physical device is consistent with the set location information of the physical device stored in the database, then the operation data of the physical device is obtained, wherein the operation data includes the data flow rate flowing through the physical device within the set time, the operating temperature of the physical device, and the power consumption of the physical device within the set time; Acquire an operation status index of the physical device based on the operation data of the physical device; Compare the operating status index of the physical device with the operating status assessment threshold of the physical device stored in the database: If the operation status index of the physical device is greater than the operation status evaluation threshold of the physical device stored in the database, it is determined that the physical device cannot work normally and an alarm notification is issued; If the operating status index of the physical device is not greater than the operating status evaluation threshold of the physical device stored in the database, it is determined that the physical device can operate normally.

4. The security risk assessment method based on the Internet of Things according to claim 3 is characterized in that: The obtaining the operation status index of the physical device based on the operation data of the physical device includes: Acquire operation reference data corresponding to the physical device stored in a database, wherein the operation reference data includes a reference flow rate of data flowing through the physical device within a set time, an operation reference temperature of the physical device, and a reference power consumption within a set time of the physical device; The operation data of the physical device is integrated and analyzed with the operation reference data corresponding to the physical device stored in the database to obtain the operation status index of the physical device.

5. The security risk assessment method based on the Internet of Things according to claim 4 is characterized in that: The calculation formula of the operating status index of the physical device is as follows: ； In the formula, is the operating status index, is the data flow through the physical device within a set time. is the operating temperature of the physical device, Set the power consumption of physical devices within a certain time interval. is the reference flow of data flowing through the physical device within the set time. is the operating reference temperature of the physical device, Set the reference power consumption for the physical device within a certain period. is a natural constant.

6. The security risk assessment method based on the Internet of Things according to claim 1 is characterized in that: Assess the vulnerability of the IoT platform, including: Obtaining attack data of the IoT platform, wherein the attack data includes the attack frequency and average attack duration within a set time; Acquire the attack definition data stored in the database, wherein the attack definition data includes the attack definition frequency and the average attack definition duration within a set time; The attacked data of the IoT platform is integrated and analyzed with the attacked definition data stored in the database to obtain the vulnerability index; The vulnerability index is compared with each vulnerability matching index stored in the database. If the vulnerability index is equal to a certain vulnerability matching index stored in the database, the vulnerability level corresponding to the vulnerability matching index stored in the database is obtained as the vulnerability level of the Internet of Things platform.

7. The security risk assessment method based on the Internet of Things according to claim 6 is characterized in that: The calculation formula of the vulnerability index is as follows: ； In the formula, is the vulnerability index, is the attack frequency within the set time. is the average attack duration, Define the frequency of being attacked within a set time. Define the average attack duration, is the attack frequency weight factor set in the database, It is the weight factor of the average attack duration set in the database.

8. The security risk assessment method based on the Internet of Things according to claim 2 is characterized in that: The step of obtaining the safe operation deviation data comprises the following steps: The vulnerability index is compared with each safe operation deviation index stored in the database. If the vulnerability index is equal to a safe operation deviation index stored in the database, the safe operation deviation data corresponding to the safe operation deviation index stored in the database is obtained.

9. The security risk assessment method based on the Internet of Things according to claim 1 is characterized in that: The calculation formula of the security risk assessment value is as follows: ； In the formula, is the security risk assessment value, is the successful interception rate of the attack, is the CPU usage when the platform recovers after being attacked. It is the time it takes for the platform to recover after being attacked. is the average amount of data lost after the attack, The allowed deviation rate for successful interception of the attack, It is the CPU usage deviation when the platform recovers after being attacked. The interception rate is a reference to the successful attack. It is the reference CPU usage when the platform recovers after being attacked. It is the reference recovery time of the platform after being attacked. is the average reference loss of data after the attack, is a natural constant, is the operating status index of the physical device, is the operating status index weight factor of the physical device set in the database, The software data weight factor set for the database.

10. A security risk assessment system based on the Internet of Things, applied to the security risk assessment method based on the Internet of Things according to any one of claims 1 to 8, characterized in that: It includes physical equipment assessment module, vulnerability assessment module and security risk assessment module, among which: The physical device assessment module is used to perform a security assessment on the physical devices of the IoT platform to determine whether the physical devices can work normally. If the physical devices cannot work normally, an alarm notification is issued; The vulnerability assessment module is used to assess the vulnerability of the IoT platform if the physical device can work normally; The security risk assessment module is used to obtain software protection data of the Internet of Things platform, evaluate the security risks of the Internet of Things platform, and obtain the security risk level. The software protection data includes the successful interception rate of attacks, the platform recovery time after attacks, and the average data loss after attacks.

Images