A method for evaluating supply chain relationships in the Internet of Things based on passive network traffic analysis

Abstract

The present invention relates to the technical field of Internet of Things analysis, and provides an Internet of Things supply chain relationship evaluation method based on passive network traffic analysis. The method comprises the following steps: automatically capturing traffic information of Internet of Things devices to obtain a data set of traffic data; extracting fingerprint information from the data set of traffic data to obtain a traffic fingerprint of the data set of traffic data; and performing fingerprint cross-analysis on the traffic fingerprint to obtain the supply chain relationship of Internet of Things devices. The present invention solves the problems of high complexity and high manpower consumption in traditional firmware-based third-party component analysis methods, and improves efficiency. The present invention reduces complexity and reduces manual intervention. In addition, the present invention can also reveal the sharing of components of Internet of Things devices, and further derive the supply chain relationship between Internet of Things devices.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things analysis, and in particular to an Internet of Things supply chain relationship evaluation method based on passive network traffic analysis. Background Art

[0002] If IoT data is not properly protected, it is vulnerable to cyber attacks. However, due to the short production cycle and limited capabilities of IoT devices, it is impossible to effectively defend against security risks such as unencrypted data transmission and unauthorized cross-border data transmission. Researchers actively explore IoT security risks and have discovered many vulnerabilities caused by device permission management or illegal data transmission.

[0003] It is worth noting that these vulnerabilities can also spread along the supply chain, but supply chain issues in the IoT field have not received enough attention.

[0004] There are also some works that directly target supply chain decision making. Kieras et al. proposed a simple graph-based model suitable for supply chain risk assessment and developed a case study to illustrate the types of uncertainty that may hinder the modeling process from being applied to a given system. The following year, they improved on their previous approach and proposed a framework for analyzing supply chain risks in IoT systems and supporting risk mitigation decisions, I-SCRAM, which helps select suppliers to mitigate supply chain risks. Most of these related articles come from the field of risk control. Their work focuses on assessing risks and proposing strategies and frameworks for managing these risks, and does not provide practical application techniques to demonstrate supply relationships between devices. Omitola et al. enumerated the threats and vulnerabilities faced by the supply chain, created a supply chain relationship diagram, and discussed the link measures for potential vulnerabilities in such supply chains. Although this work applies the method to specific examples, smartphones do not cover all types of IoT devices, and the behavior of mobile phones is also different from relatively low-power devices.

[0005] Some work also analyzes the component sharing between IoT devices. Considering that third-party library vulnerabilities will spread along the supply chain, a "multi-model" cross-architecture vulnerability detection solution PG-VulNet based on pseudocode and graph matching network is proposed. PG-VulNet extracts behavioral and structural features of pseudocode to build customized feature graphs, and then uses these graphs to detect supply chain vulnerabilities. Its essence is to compare the pseudocode of the decompiled code with the corresponding vulnerable code. By comparing the official documents of TPC (Third Party Component), the illegal use of TPC in binary IoT (Internet of Things) firmware is detected. First, the irrelevant API (Application Programming Interface) descriptions are filtered out from the TPC documents through a bidirectional long short-term memory network. Secondly, a dependency tree is built for each API specification according to the part of speech and the binary code is encoded as Datalog_facts. Finally, TPC violations in IoT firmware are detected. Another part uses grammatical features and control flow graph features to detect the use of TPC in firmware.

[0006] Although they have detected the sharing of IoT components to a certain extent, the firmware of actual IoT devices is not easy to obtain, and firmware analysis is costly and time-consuming. Moreover, they have not built the intrinsic connections between devices on a large scale to accurately infer possible supply chain relationships.

[0007] There have been attempts to detect the sharing of vulnerable components in IoT devices based on mobile companion applications in a black-box scenario. However, the nature of this work is limited to information obtained from the companion application, and in some cases the information obtained may not accurately reflect the situation of the IoT device. For example, the IoT device may have been patched for a vulnerability, and the patch changed the device interface. Therefore, the complete device components cannot be covered from the perspective of the IoT companion application. Summary of the invention

[0008] The present invention aims to solve at least one of the technical problems existing in the related art. To this end, the present invention provides an IoT supply chain relationship evaluation method based on passive network traffic analysis, which can reveal the sharing of IoT device components and further derive the supply chain relationship between IoT devices.

[0009] The present invention provides an Internet of Things supply chain relationship evaluation method based on passive network traffic analysis, comprising the following steps:

[0010] S1: Automatically capture the traffic information of IoT devices to obtain a data set of traffic data;

[0011] S2: Extracting fingerprint information from the data set of the traffic data to obtain a TLS traffic fingerprint and a DNS traffic fingerprint of the data set of the traffic data;

[0012] S3: Perform fingerprint cross-analysis on the TLS traffic fingerprint and the DNS traffic fingerprint to obtain a TLS mapping relationship and a DNS mapping relationship, and analyze the two mapping relationships to obtain a supply chain relationship of the IoT device.

[0013] According to the present invention, a method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis is provided, wherein step S1 comprises the following steps:

[0014] S11: Building a traffic data collection environment, which includes routers, IoT devices, and IoT device control modes;

[0015] S12: Automatically capture the traffic information of the IoT device in the data collection environment to obtain the traffic data of the IoT device;

[0016] S13: A data set of the traffic data is obtained by segmenting and storing the traffic data of the IoT device.

[0017] According to the present invention, a method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis is provided, wherein the traffic data collection environment includes users, Internet of Things devices controlled locally or remotely through mobile applications, and Internet of Things devices that communicate with remote users through cloud services and have wireless networks. The control modes of Internet of Things devices include: physical control, multimodal control, and local or remote control by applications.

[0018] According to the present invention, a method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis is provided, wherein step S12 comprises the following steps:

[0019] S121: Initializing a configuration file in a traffic data collection environment;

[0020] S122: Capture the traffic of the IoT devices in the traffic data collection environment to obtain the traffic data of the IoT devices.

[0021] According to the present invention, a method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis is provided, wherein step S121 comprises the following steps:

[0022] S1211: Performing environment configuration on the network components of the router; performing environment configuration on the packet capture program of the traffic collection software; and performing connection environment configuration on the command set toolbox and the router;

[0023] S1212: Classify IoT devices by type and stage, design measurement scheme configuration files, write packet capture and recording scripts, reset IoT devices, and install supporting applications.

[0024] According to the present invention, a method for evaluating an IoT supply chain relationship based on passive network traffic analysis is provided, wherein step S122 comprises: the IoT device traffic data comprises configuration phase data between IoT devices; interaction phase data between IoT devices; idle phase data of IoT devices; and deletion phase data of IoT devices.

[0025] According to the present invention, a method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis is provided, wherein step S3 comprises the following steps:

[0026] S31: Obtain a CSV file through the TLS traffic fingerprint and the DNS traffic fingerprint;

[0027] S32: Obtain IoT device-fingerprint mapping through the CSV file;

[0028] S33: Obtain a TLS mapping relationship and a DNS mapping relationship by adding associations between IoT devices in the IoT device-fingerprint mapping;

[0029] S34: Draw a relationship diagram through device nodes and device node mapping relationships to obtain the supply chain relationship of the IoT devices.

[0030] According to the present invention, a method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis is provided. When one of the TLS mapping relationship or the DNS mapping relationship between any two Internet of Things device nodes is related, it is determined that the two Internet of Things devices have a cross relationship in the Internet of Things supply chain;

[0031] When the TLS mapping relationship and DNS mapping relationship of any two IoT device nodes are exactly the same, it is determined that the two IoT devices are in the same IoT supply chain.

[0032] The above one or more technical solutions in the embodiments of the present invention have at least one of the following technical effects:

[0033] The present invention provides an IoT supply chain evaluation tool based on passive network traffic analysis, which automatically captures the traffic information of IoT devices to obtain a data set of traffic data; extracts fingerprint information from the data set of traffic data to obtain the traffic fingerprint of the data set of traffic data; and performs fingerprint cross-analysis on the traffic fingerprint to obtain the supply chain relationship of IoT devices. The present invention overcomes the shortcomings of traditional firmware-based third-party component analysis methods that are not only complex but also labor-intensive. At the same time, the present invention can reveal the common situation of IoT device components and further derive the supply chain relationship between IoT devices.

[0034] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 A standard flow chart of an embodiment of an Internet of Things supply chain relationship evaluation method based on passive network traffic analysis provided by the present invention.

[0037] Figure 2 An IoT device TLS fingerprint relationship diagram of an embodiment of an IoT supply chain relationship evaluation method based on passive network traffic analysis provided by the present invention.

[0038] Figure 3 An Internet of Things device DNS fingerprint relationship diagram of an embodiment of an Internet of Things supply chain relationship evaluation method based on passive network traffic analysis provided by the present invention.

[0039] Reference numerals:

[0040] 1. The first device; 2. The second device; 3. The third device; 4. The fourth device; 5. The fifth device; 6. The sixth device; 7. The seventh device; 8. The eighth device; 9. The ninth device; 10. The tenth device; 11. The eleventh device. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme in the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention. The following embodiments are used to illustrate the present invention, but cannot be used to limit the scope of the present invention.

[0042] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0043] Example

[0044] The embodiment of the present invention provides an IoT supply chain relationship evaluation method based on passive network traffic analysis, comprising the following steps: Figure 1 As shown:

[0045] S1: Automatically capture the traffic information of IoT devices to obtain a data set of traffic data;

[0046] S2: Extracting fingerprint information from the data set of the traffic data to obtain a TLS traffic fingerprint and a DNS traffic fingerprint of the data set of the traffic data;

[0047] S3: Perform fingerprint cross-analysis on the TLS traffic fingerprint and the DNS traffic fingerprint to obtain a TLS mapping relationship and a DNS mapping relationship, and analyze the two mapping relationships to obtain a supply chain relationship of the IoT device.

[0048] The specific steps of the embodiment of the present invention in step S1 are:

[0049] S11: Traffic data collection environment is set up, including routers, devices and control modes. The traffic data collection environment includes devices that users can control locally or remotely through mobile applications; devices that can communicate with remote users through cloud services and support wireless networks; and smart gateways. Different devices use different control modes, including physical control, multi-modal control, and local or remote control by applications. In this embodiment, the following are used:

[0050] Router: used for network configuration of smart home devices, and uses tcpdump to collect traffic data and build a data set. When configuring the environment, uboot was set up on the router to run the OpenWrt system. The OpenWrt system has the advantages of strong scalability, timely update and maintenance, high security and open source. It can fully support the functions of tcpdump and facilitate experimental parameter configuration and command execution through remote SSH (Secure Shell) connection, thereby ensuring the purity of traffic data.

[0051] Computer: In this embodiment, it is mainly used to configure various instructions for the router and record each stage of the measurement process. It is used to connect to the router through the MobaXterm remote control tool.

[0052] IoT devices such as smart phones and smart home appliances: In this embodiment, more than 50 different IoT devices are selected for traffic measurement and data set construction.

[0053] S12: Automatically capture the traffic information of IoT devices in the data collection environment to obtain the traffic data of IoT devices:

[0054] The automatic traffic collection program mainly includes three modules: configuration file initialization, traffic capture and packet segmentation.

[0055] During the profile initialization phase, the system predefines profiles for different types of devices, where the devices include multiple different interaction modes and operation phases.

[0056] After initialization is complete, the program will start the traffic capture function. During this process, the system will prompt the user to perform corresponding device operations, such as "open the socket" or "wake up the speaker", etc. After the user completes the operation, the traffic capture program will automatically record the time point and duration of each operation.

[0057] After configuring the experimental environment, you can start tcpdump packet capture after the computer is remotely connected to the router through MobaXterm. While the packet capture is started, run the pre-written Python script through PyCharm on the computer. The script reads the pre-designed configuration file to determine the phase division of this experiment (such as network configuration, device interaction, device idle, etc.). The script records the start time, end time and duration of each phase based on the configuration file and user operations. These records are used to split the data packets in subsequent data packet analysis. The experiment is divided into four main phases: "configuration, interaction, idle and deletion".

[0058] Among them, the configuration stage is to bind with the mobile phone, including configuring the network for the device through the mobile phone application;

[0059] The interactive stage is the interaction between the user and the device: physical control means that the user directly controls the device; LAN control: local control through the mobile phone. When the mobile phone and the device are in the same LAN, the device and the mobile phone may communicate through the LAN protocol, that is, the local protocol; WAN control: when the user is out, the device is not around, so the control information when the user controls the device is transmitted to the device through the IoT cloud.

[0060] The idle phase is to check whether the device is connected to the user. If not, it enters the idle phase.

[0061] Deletion phase: After the device detects that the user has been disconnected for a period of time, it deletes the user data.

[0062] In particular, in this embodiment, the traffic capture of each device is repeated three times; if the device is updated, the data capture is performed twice before and after the update.

[0063] S13: The traffic data dataset is obtained by segmenting and storing the traffic data of IoT devices:

[0064] The data packet segmentation module segments and stores the traffic data at different stages according to the configuration file, simulating the complete cycle of a user using the device. After completing the traffic collection, the acquired data is filtered, classified, and split as necessary to finally complete the construction of the data set.

[0065] Step S2 is to extract fingerprint information from the data set of the traffic data to obtain the traffic fingerprint of the data set of the traffic data, wherein the traffic fingerprint of the data set of the traffic data is obtained by performing transport layer security fingerprint extraction, domain name system fingerprint extraction and hypertext transfer protocol fingerprint extraction on the data set of the traffic data.

[0066] The embodiment of the present invention uses TLS (Transport Layer Security) and DNS (Domain Name System) as the main features of fingerprint analysis.

[0067] 1. TLS fingerprint extraction

[0068] The TLS protocol is an encryption protocol used to provide secure communications on computer networks. It ensures confidentiality and integrity of data transmission between clients and servers through data encryption, data integrity verification, and identity authentication. The TLS protocol negotiates encryption parameters, exchanges keys, and establishes encrypted conversations through a handshake process to prevent data from being eavesdropped, tampered with, and forged, thereby protecting the security and privacy of network communications.

[0069] The embodiment of the present invention refers to and improves the classic JA3 fingerprint to extract the device TLS fingerprint. The JA3 method collects the byte decimal values ​​of the following fields in the client's "ClientHello" data packet: version, accepted ciphers, extension list, elliptic curve and its format. These values ​​are then connected together in sequence, with each field separated by ",", and each value in each field separated by "-". In this embodiment, the combination of these fields is optimized, and the SNI (ServerName Indication) field information is added as part of the fingerprint identification. Finally, the TLS fingerprint is composed of several fields "TLSVersion", "SNI", "Cipher", "SSLExtension", "EllipticCurve", and "EllipticCurvePointFormat" in a specific format, and the final fingerprint is obtained through MD5 hashing.

[0070] After determining the information to be extracted, the embodiment of the present invention uses the traffic analysis library DPKT to screen and filter the traffic data and extract the required TLS information. DPKT is a Python library for fast and concise decoding and encoding of network packets, especially suitable for traffic analysis. The library is designed with high performance and ease of use, and can efficiently process large-scale network data packets. The TLS fingerprints of some devices are shown in Table 1:

[0071] Table 1 TLS fingerprint table of some devices

[0072]

[0073] 2. DNS fingerprinting

[0074] In the IoT environment, each device usually communicates with the network through DNS. The basic principle of DNS is to convert user-friendly domain names into computer-readable IP addresses, enabling devices to connect and communicate with each other. DNS acts as the "phone book" of the Internet, resolving the domain name it requests into the corresponding IP address when the device needs to access a specific resource. In the operation of IoT devices, DNS query is a key link, and each device will frequently request a specific DNS domain name to access the required network resources.

[0075] The main reasons for choosing DNS domain name as device fingerprint are as follows: First, each IoT device is usually associated with specific services and applications, and these associations are reflected in the device's DNS query. Specific devices tend to query specific domain names, which remain unchanged for a long time, thus providing stable identification features. Second, compared with other fingerprinting technologies, the extraction and analysis of DNS domain names consumes less system resources. DNS query records are part of network traffic, and analyzing these records does not significantly increase the additional processing burden. Third, DNS query is the basic operation for normal communication of devices and is difficult to forge or hide through simple means. Therefore, the fingerprint extracted through the DNS domain name has a high degree of credibility and anti-counterfeiting. Fourth, different domain names correspond to different services, which is also one of the important reasons why DNS can be used as a fingerprint of device components.

[0076] In the process of extracting DNS domain name features, the embodiment of the present invention selects the Scapy library as a tool for extracting device DNS information. It should be noted that the influence of CDN (content delivery network) must be excluded during analysis. CDN is a network architecture that accelerates content transmission, improves access speed and stability by deploying servers in multiple geographical locations and distributing content to servers closest to users. CDN servers reduce the load on original servers and optimize the user's access experience by caching content and distributing static resources (such as pictures, videos, scripts, etc.). However, in the network communication of IoT devices, DNS queries may resolve to the domain names of CDN servers, which are irrelevant to the characteristics of the device itself and cannot be used for effective device fingerprint identification. Therefore, the embodiment of the present invention excludes such CDN domain name servers as much as possible through regular expressions to ensure the accuracy of fingerprint analysis.

[0077] Some of the extracted DNS domain name information is shown in Table 2:

[0078] Table 2 Partially extracted DNS domain name information table

[0079]

[0080] In step S2, applying a variety of different fingerprint information extraction methods can obtain more connections between devices, and can obtain the connection relationship between various devices in the Internet of Things from different angles.

[0081] S3: Perform fingerprint cross-analysis on the traffic fingerprint to obtain the supply chain relationship of the IoT device. Step S3 includes the following steps:

[0082] Step S3 includes the following steps:

[0083] S31: Obtain a CSV (Comma Separated Values) file through the TLS traffic fingerprint and the DNS traffic fingerprint:

[0084] S32: Obtain device-fingerprint mapping through the CSV file;

[0085] S33: Obtain a TLS mapping relationship and a DNS mapping relationship by adding associations between IoT devices in the IoT device-fingerprint mapping;

[0086] S34: Draw a relationship diagram through device nodes and device node mapping relationships to obtain the supply chain relationship of the IoT devices.

[0087] The CSV file in step S31 is obtained by directly outputting the traffic fingerprint.

[0088] In steps S32 and S33, through the CSV file, a mapping relationship is established between the related devices in the CSV file. For example, a device may have multiple TLS fingerprints. If one of its TLS fingerprints intersects with that of other devices, a line is drawn. And then the association between devices is added to it, and the mapping relationship between device nodes and device nodes can be obtained.

[0089] In step S34, the relationship between devices is plotted using the graph_tool tool. Through these steps, a graph showing the cross-relationship of device fingerprints can be created, so as to intuitively analyze the association between devices and obtain the supply chain relationship of IoT devices. The result is as follows: Figures 2 to 3 As shown:

[0090] Figure 2 This is a TLS fingerprint relationship diagram of the Internet of Things devices of the first device 1, the second device 2, the third device 3, the fourth device 4, the fifth device 5, the sixth device 6, the seventh device 7, the eighth device 8, the ninth device 9, the tenth device 10, and the eleventh device 11.

[0091] Figure 3 It is a DNS fingerprint relationship diagram of the Internet of Things devices from the first device 1 to the eleventh device 11. Figure 3 It can be obtained that the first device to the eleventh device 11 all have a DNS fingerprint intersection relationship.

[0092] When there is a correlation between the TLS mapping relationship or the DNS mapping relationship of any two IoT device nodes in the device node and device node mapping relationship, it is determined that the two IoT devices have a cross relationship in the IoT supply chain;

[0093] When the TLS mapping relationship and the DNS mapping relationship of any two IoT device nodes in the device node and device node mapping relationship are exactly the same, it is determined that the two IoT devices are in the same IoT supply chain.

[0094] according to Figure 2 It can be obtained that there is a TLS fingerprint cross-connection between the first device 1, the second device 2, the third device 3, the fourth device 4, the fifth device 5, the sixth device 6 and the seventh device 7, and there is a TLS fingerprint cross-connection between the eighth device 8, the ninth device 9, the tenth device 10 and the eleventh device 11, but there is no TLS fingerprint connection between the two parts. According to the above judgment criteria, it can be determined that there is an IoT cross-relationship between the first device 1, the second device 2, the third device 3, the fourth device 4, the fifth device 5, the sixth device 6 and the seventh device 7 at the TLS protocol level, and similarly, there is an IoT cross-relationship between the eighth device 8, the ninth device 9, the tenth device 10 and the eleventh device 11 at the TLS protocol level. There is no IoT cross-relationship between the two parts at the TLS protocol level.

[0095] according to Figure 3 It can be obtained that there is a DNS fingerprint intersection relationship between the first device 1 to the eleventh device 11. Therefore, it can be obtained that there is an IoT intersection relationship between the first device 1 to the eleventh device 11 at the DNS communication level.

[0096] In summary, combined with the above analysis process, it can be determined that the first device 1 to the eleventh device 11 have an IoT cross-relationship, and the first device 1, the second device 2, the third device 3, the fourth device 4, the fifth device 5, the sixth device 6 and the seventh device 7 are determined to be the same IoT supply chain; the eighth device 8, the ninth device 9, the tenth device 10 and the eleventh device 11 are determined to be the same IoT supply chain.

[0097] In summary, by analyzing the cross-relationships of IoT devices in different dimensions of TLS and DNS, we can effectively infer the possible supply relationships between devices while reducing manpower consumption. This method provides researchers with a powerful tool to further analyze vulnerable devices and evaluate the impact of the spread of vulnerabilities in the supply chain.

[0098] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis, characterized in that: The following steps are involved: S1: Automatically capture the traffic information of IoT devices to obtain a data set of traffic data; S2: Extracting fingerprint information from the data set of the traffic data to obtain a TLS traffic fingerprint and a DNS traffic fingerprint of the data set of the traffic data; S3: Perform fingerprint cross-analysis on the TLS traffic fingerprint and the DNS traffic fingerprint to obtain a TLS mapping relationship and a DNS mapping relationship, and analyze the two mapping relationships to obtain a supply chain relationship of the IoT device, including: S31: Obtain a CSV file through the TLS traffic fingerprint and the DNS traffic fingerprint; S32: Obtain IoT device-fingerprint mapping through the CSV file; S33: Obtain a TLS mapping relationship and a DNS mapping relationship by adding associations between IoT devices in the IoT device-fingerprint mapping; S34: Draw a relationship diagram through device nodes and device node mapping relationships to obtain the supply chain relationship of the IoT devices; When there is a correlation between the TLS mapping relationship or the DNS mapping relationship between any two IoT device nodes, it is determined that the two IoT devices have a cross relationship in the IoT supply chain; When the TLS mapping relationship and DNS mapping relationship of any two IoT device nodes are exactly the same, it is determined that the two IoT devices are in the same IoT supply chain.

2. According to claim 1, a method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis is characterized in that: Step S1 includes the following steps: S11: Building a traffic data collection environment, which includes routers, IoT devices, and IoT device control modes; S12: Automatically capture the traffic information of the IoT device in the data collection environment to obtain the traffic data of the IoT device; S13: A data set of the traffic data is obtained by segmenting and storing the traffic data of the IoT device.

3. The method for evaluating the relationship of the Internet of Things supply chain based on passive network traffic analysis according to claim 2 is characterized in that: The flow data collection environment includes users, IoT devices controlled locally or remotely through mobile applications; IoT devices that communicate with remote users through cloud services and have wireless networks. IoT device control modes include: physical control, multi-modal control, application local or remote control.

4. According to claim 2, a method for evaluating the relationship of an Internet of Things supply chain based on passive network traffic analysis is characterized in that: Step S12 includes the following steps: S121: Initializing a configuration file in a traffic data collection environment; S122: Capture the traffic of the IoT devices in the traffic data collection environment to obtain the traffic data of the IoT devices.

5. The method for evaluating the relationship of the supply chain of the Internet of Things based on passive network traffic analysis according to claim 4 is characterized in that: Step S121 includes the following steps: S1211: Performing environment configuration on the network components of the router; performing environment configuration on the packet capture program of the traffic collection software; and performing connection environment configuration on the command set toolbox and the router; S1212: Classify IoT devices by type and stage, design measurement scheme configuration files, write packet capture and recording scripts, reset IoT devices, and install supporting applications.

6. The method for evaluating the relationship of the supply chain of the Internet of Things based on passive network traffic analysis according to claim 4 is characterized in that: Step S122 includes: The IoT device traffic data includes configuration phase data between IoT devices; interaction phase data between IoT devices; idle phase data of IoT devices; and deletion phase data of IoT devices.

Images