Threat intelligence processing method, device and equipment of Internet of Things equipment and medium

Abstract

The invention discloses a threat intelligence processing method, device and equipment of Internet of Things equipment and a medium. The method comprises the following steps: acquiring Internet of Things equipment data uploaded by a data collection agent in real time, and converting the Internet of Things equipment data into a target data format; wherein each Internet of Things equipment end is configured with an independent data collection agent; matching the Internet of Things equipment data in the target data format with a pre-established threat intelligence database, and when at least one piece of threat information is determined according to a matching result, determining a threat intelligence type according to the threat information; and generating a first response strategy according to the threat intelligence type, and executing the first response strategy to perform threat defense on the Internet of Things device. By adopting the technical scheme, high-efficiency and real-time danger detection and response can be realized, the safety protection capability of the Internet of Things environment is enhanced, and the safety and reliability of the Internet of Things system are ensured.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to a threat intelligence processing method, device, equipment and medium for Internet of Things devices. Background Art

[0002] With the rapid development of IoT technology, more and more devices are connected to the network. While collecting and transmitting data, these devices have also become potential targets of attack. If IoT devices are attacked, it may lead to a series of problems such as the leakage of important data or personal privacy information, abnormal device function, etc.

[0003] In the existing technology, IoT threats are generally detected through firewalls or intrusion detection systems (IDS), but firewalls or IDS often rely on fixed rule sets and are difficult to cope with the ever-changing threat environment. In addition, due to the large number of devices in the IoT, existing threat detection technologies are difficult to achieve efficient security monitoring. Summary of the invention

[0004] The present invention provides a threat intelligence processing method, device, equipment and medium for IoT devices, which can achieve efficient and real-time danger detection and response, enhance the security protection capability of the IoT environment, and ensure the security and reliability of the IoT system.

[0005] According to one aspect of the present invention, a method for processing threat intelligence of an IoT device is provided, comprising:

[0006] Obtain IoT device data uploaded by a data collection agent in real time, and convert the IoT device data into a target data format; wherein each IoT device is configured with a separate data collection agent;

[0007] Matching the IoT device data in the target data format with a pre-established threat intelligence database, and when at least one piece of threat information is determined according to the matching result, determining the type of threat intelligence according to the threat information;

[0008] A first response strategy is generated according to the threat intelligence type, and the first response strategy is executed to perform threat defense on the IoT device.

[0009] Optionally, the IoT device data includes the asset content of the IoT device and the device operation information.

[0010] Optionally, match IoT device data in the target data format with a pre-established threat intelligence database, including:

[0011] Determine the current operation task of the IoT device according to the IoT device data, and determine the information comparison strategy according to the current operation task;

[0012] According to the information comparison strategy, the device operation information is compared with the threat intelligence data table in the threat intelligence database one by one, and when the target field in the device operation information hits the threat intelligence data table, the threat information corresponding to the target field is determined according to the target field and the information comparison strategy.

[0013] Optionally, after obtaining the IoT device data uploaded by the data collection agent in real time and converting the IoT device data into a target data format, the following is further included:

[0014] According to the asset content of the IoT device data, determine the device information table matching the IoT device in the threat intelligence database, and update the device information table according to the device operation information;

[0015] After determining at least one piece of threat information according to the matching result, the method further includes:

[0016] A threat information table is generated based on the asset content and threat information of the IoT device data, and the threat information table is stored in a threat intelligence database.

[0017] Optionally, after determining at least one piece of threat information according to the matching result, the method further includes:

[0018] Determine, according to the threat information and the device information table, a plurality of historical attack behaviors corresponding to the threat information, and determine, according to the time sequence of each historical attack behavior, a threat pattern matching the threat information;

[0019] A threat signature code is generated according to the threat pattern, and the threat signature code is stored in a threat intelligence database.

[0020] Optionally, after matching IoT device data in the target data format with a pre-established threat intelligence database, it also includes:

[0021] When it is determined that the IoT device data in the target data format does not match the threat intelligence database, a behavior feature code of the IoT device is determined based on the device operation information, and the behavior feature code is matched with each threat feature code pre-stored in the threat intelligence database;

[0022] When it is determined that the behavior feature code matches the target threat feature code, it is determined that an attack behavior exists on the IoT device, and a second response strategy matching the target threat feature code is executed to perform threat defense on the IoT device.

[0023] Optionally, the threat intelligence processing method for IoT devices also includes:

[0024] Whenever the preset database update node is reached, the threat intelligence data in the public intelligence data set is converted into the target data format, and the threat intelligence data table is updated;

[0025] Obtain the analysis results of each threat information table fed back by users, and update the threat intelligence data table based on the threat intelligence data in the analysis results of each threat information table.

[0026] According to another aspect of the present invention, a threat intelligence processing device for an Internet of Things device is provided, comprising:

[0027] The data collection module is used to obtain the IoT device data uploaded by the data collection agent in real time and convert the IoT device data into the target data format; wherein each IoT device end is configured with a separate data collection agent;

[0028] A threat detection module, configured to match IoT device data in a target data format with a pre-established threat intelligence database, and when at least one piece of threat information is determined based on the matching result, determine a type of threat intelligence based on the threat information;

[0029] The threat defense module is used to generate a first response strategy according to the threat intelligence type and execute the first response strategy to perform threat defense on the Internet of Things device.

[0030] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0031] at least one processor; and

[0032] a memory communicatively connected to the at least one processor; wherein,

[0033] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the threat intelligence processing method for an Internet of Things device described in any embodiment of the present invention.

[0034] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the threat intelligence processing method for an Internet of Things device described in any embodiment of the present invention when executed.

[0035] The technical solution of the embodiment of the present invention obtains the IoT device data uploaded by the data collection agent in real time, matches the IoT device data converted into the target data format with the pre-established threat intelligence database, and when at least one threat information is determined according to the matching result, determines the threat intelligence type according to the threat information, generates a first response strategy according to the threat intelligence type, and executes the first response strategy in a way of threat defense against IoT devices. It can provide a threat intelligence processing method with distributed characteristics for the particularity of IoT devices. By configuring a data collection agent on different IoT device ends, it can adopt an efficient intelligence collection mechanism and run on resource-constrained IoT devices, reducing the data transmission burden, improving the real-time and accuracy of intelligence collection, being easy to expand, and being able to adapt to IoT environments of different sizes and types. At the same time, the method can better process and integrate heterogeneous data from different IoT devices, improve the accuracy and efficiency of threat detection through advanced data analysis technology, have real-time response capabilities, and be able to take defensive measures immediately when threats are detected, thereby ensuring the security and reliability of the system itself and reducing the risk of being exploited by attackers.

[0036] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0038] Figure 1 This is a flowchart of a method for processing threat intelligence of an Internet of Things device provided in accordance with Embodiment 1 of the present invention;

[0039] Figure 2 is a flowchart of another method for processing threat intelligence of an Internet of Things device provided in accordance with Embodiment 2 of the present invention;

[0040] Figure 3 2 is a schematic diagram of the structure of a threat intelligence processing device for an Internet of Things device provided in accordance with Embodiment 3 of the present invention;

[0041] Figure 4 It is a structural schematic diagram of an electronic device that implements the threat intelligence processing method for an Internet of Things device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0043] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] Embodiment 1

[0045] Figure 1 This is a flowchart of a method for processing threat intelligence of an IoT device provided in the first embodiment of the present invention. This embodiment can be applied to the situation where threat detection is performed on IoT devices and timely response is performed when the IoT devices are attacked. The method can be executed by a threat intelligence processing device of an IoT device. The threat intelligence processing device of the IoT device can be implemented in the form of hardware and / or software, and can generally be configured in a computer or processor with data processing function in an IoT system. Figure 1 As shown, the method includes:

[0046] S110: Acquire IoT device data uploaded by a data collection agent in real time, and convert the IoT device data into a target data format.

[0047] Among them, each IoT device is configured with a separate data collection agent.

[0048] Optionally, the IoT device data includes the asset content of the IoT device and the device operation information.

[0049] Optionally, since there are a large number of IoT devices in the IoT system, if the data of each IoT device is not differentiated, it may be necessary to process a large amount of data from different sources at one time, so as to determine whether a specific IoT device is threatened in a large amount of data. The calculation efficiency is low, and the threat situation of the IoT device cannot be detected in time, which may cause the IoT device to be directly attacked.

[0050] Therefore, in this application, each IoT device is configured with a separate data collection agent, which can not only collect IoT device data and upload it, but also extract and upload the asset information of the IoT device, thereby reducing the amount of calculation in the subsequent threat detection process.

[0051] Optionally, the asset content covers various valuable elements related to the device itself, which may include hardware information, software information, network information, and data assets, but is not limited to this.

[0052] Optionally, IoT device data may include device operating status information, network communication information, user behavior information, and device logs, but is not limited to this.

[0053] Optionally, the target data format can be a preset data format. The target data format after the IoT device data is converted should be the same as the data format in the threat intelligence database, that is, each data in the threat intelligence database should also be stored in the target data format. The target data format can be JSON format, etc., but there is no limitation to this.

[0054] S120: Match the IoT device data in the target data format with a pre-established threat intelligence database, and when at least one piece of threat information is determined based on the matching result, determine the threat intelligence type based on the threat information.

[0055] Optionally, a threat intelligence data table is pre-stored in the threat intelligence database. The threat intelligence data table may include various information that has been identified as posing a threat, such as access IP address information, file hash values, and other information. If the IoT device data hits any piece of information in the threat intelligence data table, it is determined that the IoT device is currently under attack.

[0056] Optionally, threat information may refer to information in an IoT device that can be matched with a threat intelligence data table.

[0057] Optionally, the threat intelligence type may include asset intelligence, vulnerability intelligence, business intelligence, and threat intelligence.

[0058] Optionally, each threat intelligence type may correspond to a variety of threat information. Therefore, after determining the threat information, the threat intelligence type may be directly determined.

[0059] Optionally, a threat detection model may be pre-trained, and the IoT device data in the target data format may be matched with a pre-established threat intelligence database through the threat detection model, and the threat intelligence type may be determined based on the matching result.

[0060] Optionally, the threat intelligence data table in the threat intelligence database can be updated regularly according to a specified time period, and the data updated each time includes the threat intelligence data that can be obtained from the public website within the most recent target time period, as well as the threat intelligence data that has been analyzed by users within the target time period.

[0061] The advantage of this setting is that it can adapt to new types of IoT device attacks, effectively improve detection efficiency, and is not limited to fixed IoT device types. When the IoT system is expanded, it can still provide stable device threat detection.

[0062] S130. Generate a first response strategy based on the threat intelligence type, and execute the first response strategy to defend against threats to the IoT device.

[0063] Optionally, for different types of threat intelligence, there are corresponding response strategies. Executing the response strategies can solve the current threat security issues of IoT devices, such as isolating malicious traffic, updating firewall rules, etc.

[0064] Optionally, the first response strategy may refer to a response strategy determined according to the type of threat intelligence.

[0065] Optionally, the method can be installed in a computer or processor in the Internet of Things system in the form of software. The software can also provide a system management and configuration interface so that users can monitor the status of the Internet of Things system through a visualization page. Users can also actively issue corresponding policies through the visualization page, or perform operations such as modifying the system's configuration parameters.

[0066] The technical solution of the embodiment of the present invention obtains the IoT device data uploaded by the data collection agent in real time, matches the IoT device data converted into the target data format with the pre-established threat intelligence database, and when at least one threat information is determined according to the matching result, determines the threat intelligence type according to the threat information, generates a first response strategy according to the threat intelligence type, and executes the first response strategy in a way of threat defense against IoT devices. It can provide a threat intelligence processing method with distributed characteristics for the particularity of IoT devices. By configuring a data collection agent on different IoT device ends, it can adopt an efficient intelligence collection mechanism and run on resource-constrained IoT devices, reducing the data transmission burden, improving the real-time and accuracy of intelligence collection, being easy to expand, and being able to adapt to IoT environments of different sizes and types. At the same time, the method can better process and integrate heterogeneous data from different IoT devices, improve the accuracy and efficiency of threat detection through advanced data analysis technology, have real-time response capabilities, and be able to take defensive measures immediately when threats are detected, thereby ensuring the security and reliability of the system itself and reducing the risk of being exploited by attackers.

[0067] Embodiment 2

[0068] Figure 2 This is a flowchart of a method for processing threat intelligence of an Internet of Things device provided by Embodiment 2 of the present invention. Based on the above embodiments, this embodiment specifically describes a method for processing threat intelligence of an Internet of Things device. Figure 2 As shown, the method includes:

[0069] S210: Obtain IoT device data uploaded by the data collection agent in real time, and convert the IoT device data into a target data format.

[0070] The advantage of this setting is that it can better process and integrate heterogeneous data from different IoT devices, improving the accuracy and efficiency of threat detection.

[0071] Optionally, after obtaining the IoT device data uploaded by the data collection agent in real time and converting the IoT device data into a target data format, the following is further included:

[0072] According to the asset content of the IoT device data, a device information table matching the IoT device is determined in the threat intelligence database, and the device information table is updated according to the device operation information.

[0073] Optionally, in the threat intelligence database, a device information table can be maintained for each IoT device. The device information table can be identified by the asset information of the IoT device and store the device operation information of the IoT device at each time point for user viewing or subsequent threat pattern identification.

[0074] S220: Determine the current running task of the IoT device according to the IoT device data, and determine the information comparison strategy according to the current running task.

[0075] Optionally, different IoT devices and different tasks performed by IoT devices may be subject to different means of attack. Therefore, different information comparison strategies may be formulated. The information comparison strategy may include various target information that need to be compared, the comparison order between the target information, etc. Then, according to the information comparison strategy, the device operation information to be compared may be determined one by one.

[0076] S230: According to the information comparison strategy, the device operation information is compared with the threat intelligence data table in the threat intelligence database one by one.

[0077] Optionally, after matching IoT device data in the target data format with a pre-established threat intelligence database, it also includes:

[0078] When it is determined that the IoT device data in the target data format does not match the threat intelligence database, a behavior feature code of the IoT device is determined based on the device operation information, and the behavior feature code is matched with each threat feature code pre-stored in the threat intelligence database;

[0079] When it is determined that the behavior feature code matches the target threat feature code, it is determined that an attack behavior exists on the IoT device, and a second response strategy matching the target threat feature code is executed to perform threat defense on the IoT device.

[0080] It is understandable that for some uncommon attack methods, threat intelligence data matching these attack methods may not be provided on the public network, which makes the data pre-stored in the threat intelligence database incomplete. In order to solve the problem of inability to accurately identify threats in this situation, the threat intelligence database in this application also pre-stores threat signature codes. If the threat intelligence data table cannot be matched, it can be compared again based on the threat signature code independently extended by the user.

[0081] Optionally, a series of actions of the IoT device can be determined based on the device operation information of the IoT device, and a behavioral signature code can be generated based on the characteristics of these actions. When the behavioral signature code can match any pre-stored threat signature code, it is also determined that the IoT device is currently under attack. At this time, a second response strategy matching the threat signature code can be determined, and the attack currently suffered by the IoT can be resolved by executing the second response strategy.

[0082] S240: When the target field in the device operation information hits the threat intelligence data table, the threat information corresponding to the target field is determined according to the target field and the information comparison strategy.

[0083] S250: Determine the threat intelligence type according to the threat information.

[0084] Optionally, after determining at least one piece of threat information according to the matching result, the method further includes:

[0085] A threat information table is generated based on the asset content and threat information of the IoT device data, and the threat information table is stored in a threat intelligence database.

[0086] Optionally, the threat information table may include asset information of IoT devices that are determined to be threatening, as well as threat information of the IoT devices. A visual user-friendly control page may be provided on the user side, and threat prompt information may be generated based on the threat information table to achieve explainable threat intelligence display, so that non-professional users can also easily understand the security status, so that users can quickly determine the cause of the threat and quickly locate the vulnerability.

[0087] Optionally, after determining at least one piece of threat information according to the matching result, the method further includes:

[0088] Determine, according to the threat information and the device information table, a plurality of historical attack behaviors corresponding to the threat information, and determine, according to the time sequence of each historical attack behavior, a threat pattern matching the threat information;

[0089] A threat signature code is generated according to the threat pattern, and the threat signature code is stored in a threat intelligence database.

[0090] Optionally, the device information table stores historical behavioral actions generated by IoT devices, but when storing these actions, some actions may not be determined as attack actions. After the threat information is determined, a series of behaviors matching the device information can be inferred from the device information table based on the threat information. For example, when the threat information is an IP address, a series of behaviors of the IP address can be obtained from the device information table, and this series of behaviors can be used as historical attack behaviors.

[0091] Optionally, after obtaining the historical attack behaviors, the attack behaviors are sorted by time, and the sorting results are used as the threat mode of the attack. A threat signature code is generated based on the threat mode and stored for subsequent detection of IoT threats.

[0092] S260: When at least one piece of threat information is determined according to the matching result, determine the type of threat intelligence according to the threat information.

[0093] S270. Generate a first response strategy based on the type of threat intelligence, and execute the first response strategy to defend against threats to the IoT device.

[0094] Optionally, the threat intelligence processing method for IoT devices may also include:

[0095] Whenever the preset database update node is reached, the threat intelligence data in the public intelligence data set is converted into the target data format, and the threat intelligence data table is updated;

[0096] Obtain the analysis results of each threat information table fed back by users, and update the threat intelligence data table based on the threat intelligence data in the analysis results of each threat information table.

[0097] Optionally, the threat intelligence data table may include publicly collected threat intelligence data and may also include user analysis results of each threat.

[0098] Optionally, when a threat alert is sent to a user regarding a target IoT device, the user can analyze the threat to determine whether the target IoT device is actually under attack or whether there is a misjudgment.

[0099] The technical solution of the embodiment of the present invention obtains the IoT device data uploaded by the data collection agent in real time, matches the IoT device data converted into the target data format with the pre-established threat intelligence database, and when at least one threat information is determined according to the matching result, determines the threat intelligence type according to the threat information, generates a first response strategy according to the threat intelligence type, and executes the first response strategy in a way of threat defense against IoT devices. It can provide a threat intelligence processing method with distributed characteristics for the particularity of IoT devices. By configuring a data collection agent on different IoT device ends, it can adopt an efficient intelligence collection mechanism and run on resource-constrained IoT devices, reducing the data transmission burden, improving the real-time and accuracy of intelligence collection, being easy to expand, and being able to adapt to IoT environments of different sizes and types. At the same time, the method can better process and integrate heterogeneous data from different IoT devices, improve the accuracy and efficiency of threat detection through advanced data analysis technology, have real-time response capabilities, and be able to take defensive measures immediately when threats are detected, thereby ensuring the security and reliability of the system itself and reducing the risk of being exploited by attackers.

[0100] Embodiment 3

[0101] Figure 3 This is a schematic diagram of the structure of a threat intelligence processing device for an Internet of Things device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a data collection module 310, a threat detection module 320 and a threat defense module 330.

[0102] The data collection module 310 is used to obtain the IoT device data uploaded by the data collection agent in real time and convert the IoT device data into a target data format.

[0103] Among them, each IoT device is configured with a separate data collection agent.

[0104] The threat detection module 320 is used to match the IoT device data in the target data format with a pre-established threat intelligence database, and when at least one threat information is determined according to the matching result, determine the threat intelligence type according to the threat information.

[0105] The threat defense module 330 is used to generate a first response strategy according to the threat intelligence type and execute the first response strategy to perform threat defense on the IoT device.

[0106] The technical solution of the embodiment of the present invention obtains the IoT device data uploaded by the data collection agent in real time, matches the IoT device data converted into the target data format with the pre-established threat intelligence database, and when at least one threat information is determined according to the matching result, determines the threat intelligence type according to the threat information, generates a first response strategy according to the threat intelligence type, and executes the first response strategy in a way of threat defense against IoT devices. It can provide a threat intelligence processing method with distributed characteristics for the particularity of IoT devices. By configuring a data collection agent on different IoT device ends, it can adopt an efficient intelligence collection mechanism and run on resource-constrained IoT devices, reducing the data transmission burden, improving the real-time and accuracy of intelligence collection, being easy to expand, and being able to adapt to IoT environments of different sizes and types. At the same time, the method can better process and integrate heterogeneous data from different IoT devices, improve the accuracy and efficiency of threat detection through advanced data analysis technology, have real-time response capabilities, and be able to take defensive measures immediately when threats are detected, thereby ensuring the security and reliability of the system itself and reducing the risk of being exploited by attackers.

[0107] Based on the above embodiments, the IoT device data includes the asset content and device operation information of the IoT device.

[0108] Based on the above embodiments, the threat detection module 320 may be specifically used for:

[0109] Determine the current operation task of the IoT device according to the IoT device data, and determine the information comparison strategy according to the current operation task;

[0110] According to the information comparison strategy, the device operation information is compared with the threat intelligence data table in the threat intelligence database one by one, and when the target field in the device operation information hits the threat intelligence data table, the threat information corresponding to the target field is determined according to the target field and the information comparison strategy.

[0111] Based on the above embodiments, a device information table updating module may be further included, which is used to:

[0112] According to the asset content of the IoT device data, a device information table matching the IoT device is determined in the threat intelligence database, and the device information table is updated according to the device operation information.

[0113] Based on the above embodiments, a threat information table updating module may be further included, which is used to:

[0114] A threat information table is generated based on the asset content and threat information of the IoT device data, and the threat information table is stored in a threat intelligence database.

[0115] Based on the above embodiments, a threat signature generation module may be further included, which is used to:

[0116] Determine, according to the threat information and the device information table, a plurality of historical attack behaviors corresponding to the threat information, and determine, according to the time sequence of each historical attack behavior, a threat pattern matching the threat information;

[0117] A threat signature code is generated according to the threat pattern, and the threat signature code is stored in a threat intelligence database.

[0118] On the basis of the above embodiments, an attack behavior response module may also be included, which is used to:

[0119] When it is determined that the IoT device data in the target data format does not match the threat intelligence database, a behavior feature code of the IoT device is determined based on the device operation information, and the behavior feature code is matched with each threat feature code pre-stored in the threat intelligence database;

[0120] When it is determined that the behavior feature code matches the target threat feature code, it is determined that an attack behavior exists on the IoT device, and a second response strategy matching the target threat feature code is executed to perform threat defense on the IoT device.

[0121] Based on the above embodiments, a threat intelligence data maintenance module may also be included, which is used to:

[0122] Whenever the preset database update node is reached, the threat intelligence data in the public intelligence data set is converted into the target data format, and the threat intelligence data table is updated;

[0123] Obtain the analysis results of each threat information table fed back by users, and update the threat intelligence data table based on the threat intelligence data in the analysis results of each threat information table.

[0124] The threat intelligence processing device for an Internet of Things device provided in an embodiment of the present invention can execute the threat intelligence processing method for an Internet of Things device provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0125] Embodiment 4

[0126] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0127] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0128] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0129] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the threat intelligence processing method for the IoT device described in the embodiment of the present invention. That is:

[0130] Obtain IoT device data uploaded by a data collection agent in real time, and convert the IoT device data into a target data format; wherein each IoT device is configured with a separate data collection agent;

[0131] Matching the IoT device data in the target data format with a pre-established threat intelligence database, and when at least one piece of threat information is determined according to the matching result, determining the type of threat intelligence according to the threat information;

[0132] A first response strategy is generated according to the threat intelligence type, and the first response strategy is executed to perform threat defense on the IoT device.

[0133] In some embodiments, the threat intelligence processing method for an IoT device may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the threat intelligence processing method for the IoT device described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the threat intelligence processing method for the IoT device in any other appropriate manner (e.g., by means of firmware).

[0134] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0135] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0136] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0137] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0138] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0139] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0140] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0141] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for processing threat intelligence of an Internet of Things device, characterized in that: include: Obtain IoT device data uploaded by a data collection agent in real time, and convert the IoT device data into a target data format; wherein each IoT device is configured with a separate data collection agent; Matching the IoT device data in the target data format with a pre-established threat intelligence database, and when at least one piece of threat information is determined according to the matching result, determining the type of threat intelligence according to the threat information; A first response strategy is generated according to the threat intelligence type, and the first response strategy is executed to perform threat defense on the IoT device.

2. The method according to claim 1, characterized in that The IoT device data includes the asset content of the IoT device and the device operation information.

3. The method according to claim 2, characterized in that Match IoT device data in the target data format with pre-established threat intelligence databases, including: Determine the current operation task of the IoT device according to the IoT device data, and determine the information comparison strategy according to the current operation task; According to the information comparison strategy, the device operation information is compared with the threat intelligence data table in the threat intelligence database one by one, and when the target field in the device operation information hits the threat intelligence data table, the threat information corresponding to the target field is determined according to the target field and the information comparison strategy.

4. The method according to claim 2, characterized in that: After obtaining the IoT device data uploaded by the data collection agent in real time and converting the IoT device data into the target data format, it also includes: According to the asset content of the IoT device data, determine the device information table matching the IoT device in the threat intelligence database, and update the device information table according to the device operation information; After determining at least one piece of threat information according to the matching result, the method further includes: A threat information table is generated based on the asset content and threat information of the IoT device data, and the threat information table is stored in a threat intelligence database.

5. The method according to claim 4, characterized in that After determining at least one piece of threat information according to the matching result, the method further includes: Determine, according to the threat information and the device information table, a plurality of historical attack behaviors corresponding to the threat information, and determine, according to the time sequence of each historical attack behavior, a threat pattern matching the threat information; A threat signature code is generated according to the threat pattern, and the threat signature code is stored in a threat intelligence database.

6. The method according to claim 5, characterized in that After matching IoT device data in the target data format with the pre-established threat intelligence database, it also includes: When it is determined that the IoT device data in the target data format does not match the threat intelligence database, a behavior feature code of the IoT device is determined based on the device operation information, and the behavior feature code is matched with each threat feature code pre-stored in the threat intelligence database; When it is determined that the behavior feature code matches the target threat feature code, it is determined that an attack behavior exists on the IoT device, and a second response strategy matching the target threat feature code is executed to perform threat defense on the IoT device.

7. The method according to claim 4, characterized in that Also includes: Whenever the preset database update node is reached, the threat intelligence data in the public intelligence data set is converted into the target data format, and the threat intelligence data table is updated; Obtain the analysis results of each threat information table fed back by users, and update the threat intelligence data table based on the threat intelligence data in the analysis results of each threat information table.

8. A threat intelligence processing device for an Internet of Things device, characterized in that: include: The data collection module is used to obtain the IoT device data uploaded by the data collection agent in real time and convert the IoT device data into the target data format; wherein each IoT device end is configured with a separate data collection agent; A threat detection module, configured to match IoT device data in a target data format with a pre-established threat intelligence database, and when at least one piece of threat information is determined based on the matching result, determine a type of threat intelligence based on the threat information; The threat defense module is used to generate a first response strategy according to the threat intelligence type and execute the first response strategy to perform threat defense on the Internet of Things device.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the threat intelligence processing method for an Internet of Things device according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the threat intelligence processing method for an Internet of Things device according to any one of claims 1 to 7 when executed.

Images