Safety early warning method and device of Internet of Things terminal equipment

Abstract

The invention discloses a safety early warning method and device for Internet of Things terminal equipment. The method comprises the following steps: acquiring equipment basic information and equipment operation information corresponding to target terminal equipment in the Internet of Things; determining a safety evaluation coefficient corresponding to the target terminal equipment according to the equipment basic information, and determining an operation evaluation coefficient corresponding to the target terminal equipment according to the equipment operation information; determining a credible evaluation coefficient corresponding to the target terminal equipment according to the safety evaluation coefficient and the operation evaluation coefficient corresponding to the target terminal equipment; the equipment safety level corresponding to the target terminal equipment is determined according to the credible evaluation coefficient corresponding to the target terminal equipment, equipment safety early warning is carried out based on the equipment safety level, and comprehensive and real-time safety evaluation and early warning are provided by comprehensively evaluating the equipment basic information and the equipment operation information, so that the safety of the target terminal equipment is improved. The reliability and stability of the Internet of Things are improved, and security events are effectively prevented and quickly responded.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security early warning method and device for an Internet of Things terminal device. Background Art

[0002] In the IoT environment, the number of terminal devices is huge and the types are diverse. These terminal devices may face various security threats during operation, including but not limited to malicious attacks, performance bottlenecks, data leakage and other issues.

[0003] In related technologies, security assessment methods can often only provide single-dimensional assessment results, such as security vulnerabilities or performance indicators. This single-dimensional assessment method cannot fully reflect the security status and performance status of terminal devices. In addition, different types of devices face different security threats and performance requirements. There is a lack of comprehensive assessment capabilities for different types of devices, which cannot meet the needs of comprehensive assessment. Summary of the invention

[0004] The present invention provides a security early warning method and device for an Internet of Things terminal device, so as to solve the problem in the related art that the security dimension of the Internet of Things assessment is single and it is difficult to conduct a comprehensive assessment on different types of terminal devices.

[0005] According to one aspect of the present invention, a security early warning method for an Internet of Things terminal device is provided, the method comprising:

[0006] Obtaining basic device information and device operation information corresponding to a target terminal device in the Internet of Things; wherein the basic device information includes at least one of device type information, device attack information, and device tag information; and the device operation information includes performance indicator information and / or operation vulnerability information;

[0007] Determine a security assessment coefficient corresponding to the target terminal device according to the basic information of the device, and determine an operation assessment coefficient corresponding to the target terminal device according to the device operation information;

[0008] Determine a trustworthy assessment coefficient corresponding to the target terminal device according to the security assessment coefficient and the operation assessment coefficient corresponding to the target terminal device;

[0009] The device security level corresponding to the target terminal device is determined according to the trustworthy assessment coefficient corresponding to the target terminal device, and a device security warning is performed based on the device security level.

[0010] According to another aspect of the present invention, a security early warning device for an Internet of Things terminal device is provided, the device comprising:

[0011] An information acquisition module is used to acquire basic device information and device operation information corresponding to a target terminal device in the Internet of Things; wherein the basic device information includes at least one of device type information, device attack information, and device tag information; and the device operation information includes performance indicator information and / or operation vulnerability information;

[0012] An information processing module, used to determine a security assessment coefficient corresponding to the target terminal device according to the basic information of the device, and to determine an operation assessment coefficient corresponding to the target terminal device according to the device operation information;

[0013] A trusted evaluation module, used to determine a trusted evaluation coefficient corresponding to the target terminal device according to the security evaluation coefficient and the operation evaluation coefficient corresponding to the target terminal device;

[0014] The security warning module is used to determine the device security level corresponding to the target terminal device according to the trustworthy assessment coefficient corresponding to the target terminal device, and to issue a device security warning based on the device security level.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security warning method for the Internet of Things terminal device described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the security warning method for an Internet of Things terminal device described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program, and the computer program, when executed by a processor, implements the security warning method for an Internet of Things terminal device described in any embodiment of the present invention.

[0021] The technical solution of the embodiment of the present invention first obtains the basic device information and device operation information corresponding to the target terminal device in the Internet of Things. Since the basic device information includes at least one of the device type information, the device attack information and the device tag information, and the device operation information includes the performance index information and / or the operation vulnerability information, the basic device information and the device operation information can be comprehensively considered to provide a comprehensive evaluation result, which not only includes the operation vulnerability but also covers the performance index. The multi-dimensional evaluation method can more comprehensively reflect the security status and performance status of the terminal device; then, the security evaluation coefficient corresponding to the target terminal device is determined according to the basic device information, and the operation evaluation coefficient corresponding to the target terminal device is determined according to the device operation information. The security evaluation coefficient and the operation evaluation coefficient of the target terminal device can be determined by comprehensively considering the basic device information and the device operation information, and a comprehensive evaluation result can be provided. The target terminal device can obtain comprehensive and accurate evaluation results to achieve dynamic detection and evaluation; then, the trusted evaluation coefficient corresponding to the target terminal device is determined according to the security evaluation coefficient and the operation evaluation coefficient corresponding to the target terminal device, and the evaluation can be performed from the two perspectives of security and performance to ensure the comprehensiveness and accuracy of the evaluation results; finally, the device security level corresponding to the target terminal device is determined according to the trusted evaluation coefficient corresponding to the target terminal device, and a device security warning is performed based on the device security level, so that the technical staff can be notified in time to take corresponding measures to prevent the occurrence or spread of security incidents, which solves the problem that the security dimension of the Internet of Things evaluation in related technologies is single and it is difficult to comprehensively evaluate different types of terminal devices. By comprehensively evaluating the basic information of the equipment and the equipment operation information, a comprehensive and real-time security evaluation and warning are provided, which improves the reliability and stability of the Internet of Things, and effectively prevents and quickly responds to security incidents.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 This is a flow chart of a security early warning method for an Internet of Things terminal device provided according to Embodiment 1 of the present invention;

[0025] Figure 2This is a flow chart of a security early warning method for an Internet of Things terminal device provided according to Embodiment 2 of the present invention;

[0026] Figure 3 This is a flow chart of a security early warning method for an Internet of Things terminal device provided according to Embodiment 3 of the present invention;

[0027] Figure 4 This is a schematic diagram of the structure of a security early warning device for an Internet of Things terminal device provided according to a fourth embodiment of the present invention;

[0028] Figure 5 It is a structural schematic diagram of an electronic device for implementing the security early warning method for an Internet of Things terminal device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0032] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0033] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0034] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0035] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0036] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0037] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions.

[0038] Embodiment 1

[0039] Figure 1 A flowchart of a security warning method for an Internet of Things terminal device is provided for Embodiment 1 of the present invention. This embodiment is applicable to comprehensive security assessment and real-time warning of various types of devices in an Internet of Things environment. The method can be executed by a security warning device of the Internet of Things terminal device. The security warning device of the Internet of Things terminal device can be implemented in the form of hardware and / or software, and optionally, can be implemented by an electronic device, which can be a mobile terminal, a PC or a server, etc.

[0040] like Figure 1 As shown, the method may specifically include:

[0041] S110. Obtain basic device information and device operation information corresponding to a target terminal device in the Internet of Things; wherein the basic device information includes at least one of device type information, device attack information, and device tag information; and the device operation information includes performance indicator information and / or operation vulnerability information.

[0042] Among them, the target terminal device can be understood as a physical or virtual device selected for security detection. The target terminal device has networking capabilities and can communicate with other devices or systems through the network. The target terminal device may include but is not limited to a thermostat in a smart home, a security camera, or a pressure sensor in the industrial Internet of Things. The target terminal device includes basic device information and device operation information corresponding to the target terminal device. Specifically, the basic device information may include at least one of device type information, device attack information, and device tag information; the device operation information may include performance indicator information and / or operation vulnerability information. The device type information can be understood as information describing the device category or model, which is used to distinguish different types of devices, so as to facilitate corresponding configuration and operation according to the device characteristics during security detection. For example, a camera may be vulnerable to video stream hijacking attacks, while a router may become a target of distributed denial of service attacks. The device attack information can be understood as information recording security events suffered by the device, including but not limited to information such as the time, type, source, and result of the attack. The device attack information is used to help security managers evaluate the security status of the target terminal device and formulate effective protection strategies. The device tag information can be understood as information for marking the target terminal device. The device marking information may be in the form of text descriptions or labels, etc., used to identify the status or attributes of the target terminal device, etc., which helps to quickly locate and manage the target terminal device. The performance indicator information can be understood as information that reflects the working status or working efficiency of the device. By detecting the performance indicator information, the operating status of the target terminal device can be grasped, and problems that arise can be warned in advance to ensure that the target terminal device operates safely and efficiently. The operation vulnerability information can be understood as security defects exposed by the target terminal device during operation, which may be used by hackers to attack. It can be understood that regular detection and recording of operation vulnerability information can enable timely repair measures to reduce security risks and protect the target terminal device from malicious attacks.

[0043] S120. Determine a security assessment coefficient corresponding to the target terminal device according to the basic information of the device, and determine an operation assessment coefficient corresponding to the target terminal device according to the device operation information.

[0044] Among them, the security assessment coefficient can be understood as a quantitative indicator used to measure the security status of the target terminal device in the Internet of Things, and the basic information of the device can be determined based on the basic information of the device (such as device type information, device attack information and device tag information, etc.) to reflect the security risk level faced by the target terminal device. The operation assessment coefficient can be understood as a quantitative indicator used to measure the operating status and performance of the target terminal device in the Internet of Things. The operation assessment coefficient can be determined based on the device operation information (such as performance indicator information and operation vulnerability information, etc.), reflecting the health status and potential problems of the target terminal device.

[0045] For example, when the Internet of Things is a smart home system, the security assessment coefficient can help identify target terminal devices that are vulnerable to attack, thereby strengthening the security protection of the target terminal devices; the operation assessment coefficient can be used to detect the performance of the target terminal devices and ensure the stable operation of the smart home system. When the Internet of Things is an industrial Internet of Things, the security assessment coefficient can be used to identify key equipment on the production line, ensure the safety of the equipment, and avoid production interruptions; the operation assessment coefficient can be used to detect the operating status of the equipment, perform maintenance and optimization in a timely manner, and improve production efficiency.

[0046] S130. Determine a trustworthy assessment coefficient corresponding to the target terminal device according to the security assessment coefficient and the operation assessment coefficient corresponding to the target terminal device.

[0047] Among them, the trust evaluation coefficient can be understood as a quantitative indicator used to measure the overall trustworthiness of the target terminal device in the Internet of Things, which can be determined based on the security evaluation coefficient and the operation evaluation coefficient, reflecting the comprehensive performance of the target terminal device in terms of security and operation stability. It can be understood that the higher the trust evaluation coefficient, the higher the trustworthiness of the target terminal device in the Internet of Things, and vice versa, it means that the target terminal device has a greater security or performance risk.

[0048] S140: Determine a device security level corresponding to the target terminal device according to the trustworthy assessment coefficient corresponding to the target terminal device, and issue a device security warning based on the device security level.

[0049] Among them, the device security level can be understood as a classification or rating of the security status of the target terminal device, which is used to indicate the degree of security risk of the target terminal device. The device security level can be determined based on the trustworthy assessment coefficient, reflecting the security and credibility of the target terminal device in the Internet of Things. It can be understood that by setting different thresholds, the target terminal device can be divided into different security levels, so as to more intuitively understand the security status of the target terminal device and take corresponding security management measures. Exemplarily, the security management measures may include device security warnings for the target terminal device. The device security warning can be understood as a warning message issued when a security risk is detected in the target terminal device. The warning information may include, but is not limited to, the name, location, security level, existing security issues and recommended countermeasures of the target terminal device.

[0050] The technical solution of the embodiment of the present invention first obtains the basic device information and device operation information corresponding to the target terminal device in the Internet of Things. Since the basic device information includes at least one of the device type information, the device attack information and the device tag information, and the device operation information includes the performance index information and / or the operation vulnerability information, the basic device information and the device operation information can be comprehensively considered to provide a comprehensive evaluation result, which not only includes the operation vulnerability but also covers the performance index. The multi-dimensional evaluation method can more comprehensively reflect the security status and performance status of the terminal device; then, the security evaluation coefficient corresponding to the target terminal device is determined according to the basic device information, and the operation evaluation coefficient corresponding to the target terminal device is determined according to the device operation information. The security evaluation coefficient and the operation evaluation coefficient of the target terminal device can be determined by comprehensively considering the basic device information and the device operation information, and a comprehensive evaluation result can be provided. The target terminal device can obtain comprehensive and accurate evaluation results to achieve dynamic detection and evaluation; then, the trusted evaluation coefficient corresponding to the target terminal device is determined according to the security evaluation coefficient and the operation evaluation coefficient corresponding to the target terminal device, and the evaluation can be performed from the two perspectives of security and performance to ensure the comprehensiveness and accuracy of the evaluation results; finally, the device security level corresponding to the target terminal device is determined according to the trusted evaluation coefficient corresponding to the target terminal device, and a device security warning is performed based on the device security level, so that the technical staff can be notified in time to take corresponding measures to prevent the occurrence or spread of security incidents, which solves the problem that the security dimension of the Internet of Things evaluation in related technologies is single and it is difficult to comprehensively evaluate different types of terminal devices. By comprehensively evaluating the basic information of the equipment and the equipment operation information, a comprehensive and real-time security evaluation and warning are provided, which improves the reliability and stability of the Internet of Things, and effectively prevents and quickly responds to security incidents.

[0051] Embodiment 2

[0052] Figure 2A flowchart of a security warning method for an Internet of Things terminal device provided in the second embodiment of the present invention. The technical solution of this embodiment further refines how to determine the security assessment coefficient corresponding to the target terminal device according to the basic information of the device on the basis of the above embodiment. Optionally, the security assessment coefficient corresponding to the target terminal device according to the basic information of the device includes: determining the actual severity score of the target terminal device under each attack according to the device attack information, and determining the attack assessment coefficient corresponding to the target terminal device according to the actual severity score under each attack; determining the type assessment coefficient corresponding to the target terminal device according to the device type information, and determining the number of device markings corresponding to the target terminal device according to the device marking information; determining the security assessment coefficient corresponding to the target terminal device according to the attack assessment coefficient, the type assessment coefficient and the number of device markings. For specific implementation methods, please refer to the description of this embodiment. Among them, the technical features that are the same or similar to the above embodiments are not repeated here.

[0053] like Figure 2 As shown, the method may specifically include:

[0054] S210. Obtain basic device information and device operation information corresponding to a target terminal device in the Internet of Things; wherein the basic device information includes at least one of device type information, device attack information, and device tag information; and the device operation information includes performance indicator information and / or operation vulnerability information.

[0055] S220. Determine an actual severity score of the target terminal device under each attack according to the device attack information, and determine an attack assessment coefficient corresponding to the target terminal device according to the actual severity score under each attack.

[0056] The actual severity score can be understood as an indicator used to quantify the actual degree of damage suffered by the target terminal device under each attack. It can be understood that the actual severity score can be related to the attack type, attack frequency, and attack duration. The attack assessment coefficient can be understood as a measure of the overall severity of all attacks suffered by the target terminal device, which can be determined based on the actual severity score of each attack, reflecting the overall security status of the target terminal device.

[0057] As an optional implementation of the embodiment of the present invention, the attack assessment coefficient corresponding to the target terminal device may be determined according to the actual severity score under each attack by the following formula:

[0058]

[0059] Among them, βattack represents the attack evaluation coefficient corresponding to the target terminal device, i represents the i-th attack suffered by the target terminal device, i=1,2,3...j, S i It is represented as the actual severity score corresponding to the i-th attack, S i ′ represents the standard severity score corresponding to the i-th attack, ω i It is expressed as the weight coefficient corresponding to the i-th attack.

[0060] The standard severity score can be understood as a standardized scoring indicator used to quantify the degree of damage suffered by the target terminal device under each attack. The standard severity score is used to compare the severity between different devices and different types of attacks to ensure that different devices and different types of attacks use the same scoring criteria when evaluating, thereby improving the objectivity and consistency of the evaluation.

[0061] The above scheme, by comprehensively considering the actual severity score and weight coefficient of each attack, can more accurately evaluate the overall security status of the target terminal device, timely discover and deal with potential security threats, and improve the security and stability of the target terminal device.

[0062] S230: Determine a type evaluation coefficient corresponding to the target terminal device according to the device type information, and determine a device marking number corresponding to the target terminal device according to the device marking information.

[0063] Among them, the type assessment coefficient can be understood as a quantitative indicator to measure the security of the target terminal device in its type, which can be determined based on the device type information and is used to reflect the relative importance or potential security risk of the target terminal device in the Internet of Things. For example, in the enterprise Internet of Things, since routers and servers are more critical to the stability and security of the network, the type assessment coefficients of routers and servers are usually higher. The number of device markings can be understood as the number of times the target terminal device is marked, which can be determined based on the device marking information and is used to identify a special state or attribute of the target terminal device. For example, in the industrial Internet of Things, if a target terminal device frequently has security failures, the target terminal device may be marked as "needing attention" multiple times, thereby increasing the number of device markings.

[0064] S240. Determine a security assessment coefficient corresponding to the target terminal device according to the attack assessment coefficient, the type assessment coefficient, and the number of device markings, and determine an operation assessment coefficient corresponding to the target terminal device according to the device operation information.

[0065] Among them, the security assessment coefficient can be understood as a quantitative indicator used to evaluate the security status of the target terminal device in the Internet of Things, which can be determined based on the attack assessment coefficient, the type assessment coefficient and the number of device markings to reflect the comprehensive security risk of the target interruption device.

[0066] As an optional implementation manner of an embodiment of the present invention, the attack assessment coefficient, the type assessment coefficient and the number assessment coefficient corresponding to the number of device marking times can be multiplied to obtain a security assessment coefficient corresponding to the target terminal device, wherein the number assessment coefficient is calculated by an exponential function with the natural constant e as the base and the number of device marking times as the power.

[0067] Specifically, the security assessment coefficient corresponding to the target terminal device is determined according to the attack assessment coefficient, the type assessment coefficient and the number of device markings by the following formula:

[0068] ψ=χ*βattack*en;

[0069] Where, ψ represents the security assessment coefficient corresponding to the target terminal device, χ represents the type assessment coefficient corresponding to the target terminal device, β attack represents the attack assessment coefficient corresponding to the target terminal device, n represents the number of device markings corresponding to the target terminal device, and e is a natural constant.

[0070] The above scheme, by comprehensively considering the type assessment coefficient, attack assessment coefficient and device marking times, uses exponential functions to calculate the security assessment coefficient, which can more comprehensively evaluate the security status of the target terminal device in the Internet of Things, help to accurately identify and manage target terminal devices with security risks, and ensure the stability and security of the Internet of Things.

[0071] On the basis of the above scheme, optionally, device marking information corresponding to the target terminal device in the Internet of Things is obtained, including: when the attack assessment coefficient corresponding to the target terminal device is greater than or equal to a preset attack assessment threshold, marking the target terminal device to obtain the device marking information corresponding to the target terminal device.

[0072] The attack assessment threshold can be understood as judging whether the attack assessment coefficient of the target terminal device reaches a preset value that needs to be marked. It is understandable that when the attack assessment coefficient of the target terminal device exceeds the attack assessment threshold, corresponding security measures will be taken, such as marking the target terminal device. The attack assessment threshold can be flexibly set according to the device type, application scenario and security requirements, and is not limited here.

[0073] The above scheme, by setting an attack assessment threshold and marking the target terminal device when the attack assessment coefficient exceeds the attack assessment threshold, can timely discover and handle target terminal devices with security risks, and the device marking information provides corresponding marking content to help quickly identify and handle security issues and ensure the stability and security of the Internet of Things.

[0074] S250, determining a trustworthy assessment coefficient corresponding to the target terminal device according to the security assessment coefficient and the operation assessment coefficient corresponding to the target terminal device;

[0075] S260: Determine a device security level corresponding to the target terminal device according to the trustworthy assessment coefficient corresponding to the target terminal device, and issue a device security warning based on the device security level.

[0076] The technical solution of the embodiment of the present invention can accurately reflect the attack threats faced by the device by calculating the severity score of each attack and determining the attack assessment coefficient. Secondly, the type assessment coefficient and the number of device markings are formed by combining the device type information and the device marking information to further refine the assessment results. Finally, the security assessment coefficient of the device is determined by combining the attack assessment coefficient, the type assessment coefficient and the number of device markings, providing a comprehensive assessment result, helping to quickly identify and deal with security issues, and ensuring the stability and security of the Internet of Things.

[0077] Embodiment 3

[0078] Figure 3A flowchart of a security warning method for an Internet of Things terminal device provided in Embodiment 2 of the present invention. The technical solution of this embodiment is based on the above-mentioned embodiment and further refines how to determine the operation evaluation coefficient corresponding to the target terminal device according to the device operation information. Optionally, the performance indicator data includes actual CPU usage, actual memory usage and actual disk input / output speed; the operation vulnerability information includes actual vulnerability score, actual number of affected functions and actual data leakage index; the operation evaluation coefficient corresponding to the target terminal device is determined according to the device operation information, including: determining the first evaluation coefficient corresponding to the target terminal device according to the actual CPU usage of the target terminal device, the reference CPU usage corresponding to the actual CPU usage, the actual memory usage, the reference memory usage corresponding to the actual memory usage, the actual disk input / output speed and the reference disk input / output speed corresponding to the actual disk input / output speed; determining the second evaluation coefficient corresponding to the target terminal device according to the actual vulnerability score of the target terminal device during operation, the reference vulnerability score corresponding to the actual vulnerability score, the actual number of affected functions, the reference number of affected functions corresponding to the actual number of affected functions, the actual data leakage index and the reference data leakage index corresponding to the actual data leakage index; determining the operation evaluation coefficient corresponding to the target terminal device according to the first evaluation coefficient and the second evaluation coefficient. For specific implementation, please refer to the description of this embodiment. Among them, the technical features that are the same or similar to the above-mentioned embodiments are not repeated here.

[0079] like Figure 3 As shown, the method may specifically include:

[0080] S310. Obtain basic device information and device operation information corresponding to the target terminal device in the Internet of Things; wherein the basic device information includes at least one of device type information, device attack information and device tag information; the device operation information includes performance indicator information and / or operation vulnerability information, and the performance indicator data includes actual central processing unit usage, actual memory usage and actual disk input / output speed; the operation vulnerability information includes actual vulnerability score, actual number of affected functions and actual data leakage index.

[0081] Among them, the actual CPU usage rate can be understood as the actual usage ratio of the CPU of the target terminal device, usually expressed as a percentage. The actual CPU usage rate reflects the load of the target terminal device. A high actual CPU usage rate indicates that the target terminal device is processing a large number of tasks, which may lead to performance degradation or slow response. For example, in an enterprise Internet of Things, if the CPU usage rate of a server is continuously higher than 80%, performance optimization or increased computing resources may be required. The actual memory usage rate can be understood as the actual usage ratio of the memory of the target terminal device, usually expressed as a percentage. The actual memory usage rate reflects the memory occupancy of the target terminal device. A high actual memory usage rate may lead to insufficient memory, affecting the performance and stability of the target terminal device. The actual disk input / output speed can be understood as the actual read and write speed of the disk of the target terminal device, usually expressed in bytes read and written per second (such as MB / s, etc.). The actual disk input / output speed reflects the disk access performance of the target terminal device. A low disk input / output speed may cause data processing delays, affecting the response time and performance of the target terminal device. The actual vulnerability score can be understood as a quantitative indicator to measure the severity of the security vulnerabilities existing in the target terminal device. The actual vulnerability score reflects the security risk level of the target terminal device. A high actual vulnerability score indicates that there are serious security vulnerabilities that need to be fixed as soon as possible. It is understandable that in the enterprise Internet of Things, if the actual vulnerability score of a server is high, it means that there are high-risk vulnerabilities and security updates need to be performed as soon as possible. The actual number of affected functions can be understood as the number of functions of the target terminal device affected by the security vulnerability, usually expressed as an integer. The actual number of affected functions reflects the scope of impact of the security vulnerability of the target terminal device on the function. The larger the actual number of affected functions, the greater the scope of impact of the vulnerability. The actual data leakage index can be understood as a quantitative indicator to measure the risk of data leakage caused by security vulnerabilities in the target terminal device, usually expressed in the form of a percentage or score. The actual data leakage index reflects the data security status of the target terminal device. A high actual data leakage index indicates that there is a high risk of data leakage and data protection measures need to be strengthened.

[0082] S320. Determine a security assessment coefficient corresponding to the target terminal device based on the basic information of the device, and determine a first assessment coefficient corresponding to the target terminal device based on an actual CPU usage of the target terminal device, a reference CPU usage corresponding to the actual CPU usage, an actual memory usage, a reference memory usage corresponding to the actual memory usage, an actual disk input / output speed, and a reference disk input / output speed corresponding to the actual disk input / output speed.

[0083] The reference CPU usage rate can be understood as the expected CPU usage rate of the target terminal device under normal working conditions, usually expressed as a percentage. The reference CPU usage rate is used to compare the actual CPU usage rate of the target terminal device to evaluate whether the performance of the target terminal device is normal. When the actual CPU usage rate is significantly higher than the reference CPU usage rate, it indicates that the target terminal device has a performance bottleneck or anomaly. The reference memory usage rate can be understood as the expected memory usage rate of the target terminal device under normal working conditions, usually expressed as a percentage. The reference memory usage rate is used to compare the actual memory usage rate of the target terminal device to evaluate whether the performance of the target terminal device is normal. When the actual memory usage rate is significantly higher than the reference memory usage rate, it may indicate that the target terminal device has a memory leak or anomaly. The reference disk input / output speed can be understood as the expected disk read / write speed of the target terminal device under normal working conditions, usually expressed as the number of bytes read and written per second (such as MB / s). The reference disk input / output speed is used to compare the actual disk input / output speed of the target terminal device to evaluate whether the performance of the target terminal device is normal. When the actual disk input / output speed is significantly lower than the reference disk input / output speed, it may indicate that the disk performance is degraded or there is a fault. The first evaluation coefficient can be understood as an indicator used to evaluate the performance status of the target terminal device during operation, and can be determined based on actual performance indicators (such as actual CPU usage, actual memory usage, and actual disk input / output speed) and corresponding reference values.

[0084] As an optional implementation of the embodiment of the present invention, the first evaluation coefficient corresponding to the target terminal device can be determined according to the actual CPU usage of the target terminal device, the reference CPU usage corresponding to the actual CPU usage, the actual memory usage, the reference memory usage corresponding to the actual memory usage, the actual disk input / output speed, and the reference disk input / output speed corresponding to the actual disk input / output speed by the following formula:

[0085]

[0086] Among them, a xn represents the first evaluation coefficient corresponding to the target terminal device, Cpu, Mem, and Io represent the actual CPU usage, actual memory usage, and actual disk input / output speed corresponding to the target terminal device, respectively, Cpu′, Mem′, and Io′ represent the reference CPU usage, reference memory usage, and reference disk input / output speed corresponding to the target terminal device, respectively, a 1 、a 2 、a 3They respectively represent preset weight coefficients, and e is a natural constant.

[0087] The preset weight coefficient can be understood as the weight assigned to each performance indicator when determining the first evaluation coefficient, which is used to balance the influence of different performance indicators on the first evaluation coefficient. The preset weight coefficient can be adjusted according to specific needs to reflect the importance of different performance indicators, which is not limited here.

[0088] The above scheme, by considering the actual performance index and the reference performance index to determine the first evaluation coefficient, can comprehensively evaluate the performance status of the target terminal device, help to timely discover and deal with performance problems, and ensure the stable operation of the target terminal device.

[0089] S330. Determine a second evaluation coefficient corresponding to the target terminal device based on an actual vulnerability score of the target terminal device during operation, a reference vulnerability score corresponding to the actual vulnerability score, an actual number of affected functions, a reference number of affected functions corresponding to the actual number of affected functions, the actual data leakage index, and a reference data leakage index corresponding to the actual data leakage index.

[0090] Among them, the reference vulnerability score can be understood as the expected vulnerability score of the target terminal device under normal working conditions. The reference vulnerability score is used to compare the actual vulnerability score of the target terminal device and evaluate whether the security status of the target terminal device is normal. If the actual vulnerability score is significantly higher than the reference vulnerability score, it may indicate that the target terminal device has serious security issues. The reference number of affected functions can be understood as the expected number of affected functions of the target terminal device under normal working conditions. The reference number of affected functions is used to compare the actual number of affected functions of the target terminal device and evaluate whether the security status of the target terminal device is normal. If the actual number of affected functions is significantly higher than the reference number of affected functions, it may indicate that the target terminal device has serious security issues. The reference data leakage index can be understood as the index of the expected data leakage risk of the target terminal device under normal security conditions. The reference data leakage index is used to compare the actual data leakage index of the target terminal device and evaluate whether the data security status of the target terminal device is normal. If the actual data leakage index is significantly higher than the reference data leakage index, it may indicate that the target terminal device has serious data leakage risks. The second evaluation coefficient can be understood as an indicator for evaluating the security vulnerabilities and their impacts existing in the operation of the target terminal device, and can be determined based on the actual vulnerability score, the actual number of affected functions, the actual data leakage index and their corresponding reference values.

[0091] As an optional implementation of the embodiment of the present invention, the second evaluation coefficient corresponding to the target terminal device can be determined according to the actual vulnerability score, the actual number of affected functions and the actual data leakage index of the target terminal device during operation by the following formula:

[0092]

[0093] Among them, b ld represents the second evaluation coefficient corresponding to the target terminal device, Ld represents the actual vulnerability score of the target terminal device during operation, Gn represents the actual number of affected functions of the target terminal device during operation, Sj represents the actual data leakage index of the target terminal device during operation, Ld′ represents the reference vulnerability score of the target terminal device during operation, Gn′ represents the reference number of affected functions of the target terminal device during operation, Sj′ represents the reference data leakage index of the target terminal device during operation, and e is a natural constant.

[0094] The above scheme determines the second evaluation coefficient by comprehensively considering the actual operation vulnerability information (actual vulnerability score, actual number of affected functions and actual data leakage index) and reference values ​​(reference vulnerability score, reference number of affected functions and reference data leakage index). It can comprehensively evaluate the security status of the target terminal device, help to promptly discover and deal with potential security issues, and ensure the stability and security of the equipment.

[0095] S340. Determine an operation evaluation coefficient corresponding to the target terminal device according to the first evaluation coefficient and the second evaluation coefficient.

[0096] As an optional implementation of the embodiment of the present invention, the first evaluation coefficient and the second evaluation coefficient may be weightedly summed to obtain an operation evaluation coefficient corresponding to the target terminal device.

[0097] Specifically, the operation evaluation coefficient corresponding to the target terminal device may be determined according to the first evaluation coefficient and the second evaluation coefficient by the following formula:

[0098] μ=axn*c1+bld*c2;

[0099] Among them, μ represents the operation evaluation coefficient corresponding to the target terminal device, a xn represents the first evaluation coefficient corresponding to the target terminal device, b ld represents the second evaluation coefficient corresponding to the target terminal device, c 1 and c 2 They are respectively represented as preset weight coefficients corresponding to the first evaluation coefficient and the second evaluation coefficient.

[0100] S350: Determine a trustworthy assessment coefficient corresponding to the target terminal device according to the security assessment coefficient and the operation assessment coefficient corresponding to the target terminal device.

[0101] As an optional implementation of the embodiment of the present invention, the security assessment coefficient and the operation assessment coefficient corresponding to the target terminal device may be weightedly summed to obtain a trustworthy assessment coefficient corresponding to the target terminal device.

[0102] Specifically, the trustworthiness assessment coefficient corresponding to the target terminal device may be determined according to the security assessment coefficient and the operation assessment coefficient corresponding to the target terminal device by the following formula:

[0103] γ=ψ*r1+μ*r2;

[0104] Wherein, γ represents the trust evaluation coefficient corresponding to the target terminal device, ψ represents the security evaluation coefficient corresponding to the target terminal device, μ represents the operation evaluation coefficient corresponding to the target terminal device, and r 1 and r 2 They are respectively represented as preset weight coefficients corresponding to the trustworthy assessment coefficient and the safety assessment coefficient.

[0105] S360: Determine a device security level corresponding to the target terminal device according to the trustworthy assessment coefficient corresponding to the target terminal device, and issue a device security warning based on the device security level.

[0106] On the basis of the above scheme, optionally, the device security level corresponding to the target terminal device is determined according to the trusted assessment coefficient corresponding to the target terminal device, and a device security warning is performed based on the device security level, including: when the trusted assessment coefficient corresponding to the target terminal device is less than a first trusted assessment threshold, the device security level corresponding to the target terminal device is determined as a first-level warning signal, and a first-level warning signal corresponding to the first-level warning signal is displayed; when the trusted assessment coefficient corresponding to the target terminal device is greater than or equal to the first trusted assessment threshold and less than or equal to the second trusted assessment threshold, the device security level corresponding to the target terminal device is determined as a second-level warning signal, and a second-level warning signal corresponding to the second-level warning signal is displayed.

[0107] Among them, the first trusted assessment threshold can be understood as a preset value, which is used to distinguish whether the trusted assessment coefficient of the target terminal device meets the standard for generating a first-level warning signal. The first-level warning signal can be understood as a warning signal of the highest level of security warning, which is used to indicate that the current security level of the target terminal device is low, there are serious security risks or performance problems, and measures need to be taken. The second trusted assessment threshold can be understood as a preset value, which is used to distinguish whether the trusted assessment coefficient of the target terminal device meets the standard for generating a second-level warning signal. The second-level warning signal can be understood as a warning signal of a medium-level security warning, which is used to indicate that the target terminal device has a medium degree of security risk or performance problem, which requires attention and processing. Among them, the warning level of the first-level warning signal is greater than the warning level of the second-level warning signal.

[0108] On the basis of the above scheme, the device security level corresponding to the target terminal device is determined according to the trusted assessment coefficient corresponding to the target terminal device, and a device security warning is performed based on the device security level, and also includes: when the trusted assessment coefficient corresponding to the target terminal device is greater than a second trusted assessment threshold, the device security level corresponding to the target terminal device is determined as a safety signal, and the safety signal is displayed.

[0109] It can be understood that, when the trust evaluation coefficient corresponding to the target terminal device is greater than the second trust evaluation threshold, it indicates that the security level of the target terminal device is determined to be high, and no collection measures are required.

[0110] In an optional implementation, the trust evaluation coefficient γ corresponding to the target terminal device is compared with a preset trust evaluation threshold interval [γ 1 ,γ 2 ] for comparison. When the trust evaluation coefficient γ<γ 1 , it is determined that the security level of the target terminal device is low, and a first-level warning signal is output; when the trust evaluation coefficient γ corresponding to the target terminal device is in [γ 1 ,γ 2 ], the security level of the target terminal device is determined to be medium, and a level 2 warning signal is output, wherein the warning level of the level 1 warning signal is greater than that of the level 2 warning signal; when the trustworthy assessment coefficient γ corresponding to the target terminal device is greater than γ 2 , it is determined that the security level of the target terminal device is high, and no collection measures are required.

[0111] The above scheme determines the first evaluation coefficient by calculating the ratio of the actual CPU usage, memory usage and disk input / output speed to the reference value, so as to accurately reflect the performance status of the target terminal device. Secondly, the second evaluation coefficient is determined by calculating the ratio of the actual vulnerability score, the number of affected functions and the data leakage index to the reference value, so as to comprehensively evaluate the security status of the device. Finally, the operation evaluation coefficient is determined by combining the first evaluation coefficient and the second evaluation coefficient, and a comprehensive evaluation result is provided. By setting the threshold of the trusted evaluation coefficient, the device security level is divided into the first and second level warning signals to ensure timely and accurate security warnings, which can quickly respond to and handle potential security and performance issues and improve the overall reliability and stability of the Internet of Things.

[0112] Embodiment 4

[0113] Figure 4 This is a schematic diagram of the structure of a security warning device for an Internet of Things terminal device provided by Embodiment 4 of the present invention. Figure 4 As shown, the device includes: an information acquisition module 410, an information processing module 420, a trusted evaluation module 430, and a security warning module 440. The information acquisition module 410 acquires basic device information and device operation information corresponding to the target terminal device in the Internet of Things; wherein the basic device information includes at least one of device type information, device attack information, and device tag information; the device operation information includes performance indicator information and / or operation vulnerability information; the information processing module 420 is used to determine the security evaluation coefficient corresponding to the target terminal device according to the basic device information, and to determine the operation evaluation coefficient corresponding to the target terminal device according to the device operation information; the trusted evaluation module 430 is used to determine the trusted evaluation coefficient corresponding to the target terminal device according to the security evaluation coefficient and the operation evaluation coefficient corresponding to the target terminal device; the security warning module 440 is used to determine the device security level corresponding to the target terminal device according to the trusted evaluation coefficient corresponding to the target terminal device, and to perform device security warning based on the device security level.

[0114] The technical solution of the embodiment of the present invention is as follows: first, the basic device information and device operation information corresponding to the target terminal device in the Internet of Things are obtained through the information acquisition module 410. Since the basic device information includes at least one of the device type information, the device attack information and the device tag information, and the device operation information includes the performance index information and / or the operation vulnerability information, the basic device information and the device operation information can be comprehensively considered to provide a comprehensive evaluation result, which not only includes the operation vulnerability but also covers the performance index. The multi-dimensional evaluation method can more comprehensively reflect the security status and performance status of the terminal device; then, the security evaluation coefficient corresponding to the target terminal device is determined according to the basic device information through the information processing module 420, and the operation evaluation coefficient corresponding to the target terminal device is determined according to the device operation information. The security evaluation coefficient and the operation evaluation coefficient of the target terminal device can be determined by comprehensively considering the basic device information and the device operation information to provide Comprehensive and accurate evaluation results are achieved to realize dynamic detection and evaluation; then, the trusted evaluation coefficient corresponding to the target terminal device is determined according to the security evaluation coefficient and the operation evaluation coefficient corresponding to the target terminal device through the trusted evaluation module 430, and evaluation can be performed from the two perspectives of security and performance to ensure the comprehensiveness and accuracy of the evaluation results; finally, the device security level corresponding to the target terminal device is determined according to the trusted evaluation coefficient corresponding to the target terminal device through the security warning module 440, and a device security warning is performed based on the device security level, which can promptly notify technical personnel to take corresponding measures to prevent the occurrence or spread of security incidents, and solve the problem that the security dimension of the Internet of Things assessment in related technologies is single and it is difficult to comprehensively evaluate different types of terminal devices. By comprehensively evaluating the basic information of the equipment and the equipment operation information, it provides comprehensive and real-time security assessment and warning, improves the reliability and stability of the Internet of Things, and effectively prevents and quickly responds to security incidents.

[0115] On the basis of the above scheme, optionally, the information processing module may include: an attack assessment coefficient determination submodule, a device marking times determination submodule, and a security assessment coefficient determination submodule. Among them, the attack assessment coefficient determination submodule is used to determine the actual severity score of the target terminal device under each attack according to the device attack information, and determine the attack assessment coefficient corresponding to the target terminal device according to the actual severity score under each attack; the device marking times determination submodule is used to determine the type assessment coefficient corresponding to the target terminal device according to the device type information, and determine the device marking times corresponding to the target terminal device according to the device marking information; the security assessment coefficient determination submodule is used to determine the security assessment coefficient corresponding to the target terminal device according to the attack assessment coefficient, the type assessment coefficient and the device marking times.

[0116] Based on the above solution, optionally, the attack assessment coefficient determination submodule can be used to determine the attack assessment coefficient corresponding to the target terminal device according to the severity score under each attack through the following formula:

[0117]

[0118] Among them, β attack represents the attack evaluation coefficient corresponding to the target terminal device, i represents the i-th attack suffered by the target terminal device, i=1,2,3...j, S i ′ represents the severity score corresponding to the i-th attack, ω i It is expressed as the weight coefficient corresponding to the i-th attack.

[0119] On the basis of the above scheme, optionally, the security assessment coefficient determination submodule can be used to determine the security assessment coefficient corresponding to the target terminal device according to the attack assessment coefficient, the type assessment coefficient and the number of device markings through the following formula:

[0120] ψ=χ*βattack*en;

[0121] Where, ψ represents the security assessment coefficient corresponding to the target terminal device, χ represents the type assessment coefficient corresponding to the target terminal device, β attack represents the attack assessment coefficient corresponding to the target terminal device, n represents the number of device markings corresponding to the target terminal device, and e is a natural constant.

[0122] Based on the above solution, optionally, the information acquisition module may include: a device tag information acquisition submodule.

[0123] Among them, the device tag information acquisition submodule is used to mark the target terminal device when the attack assessment coefficient corresponding to the target terminal device is greater than or equal to a preset attack assessment threshold, so as to obtain the device tag information corresponding to the target terminal device.

[0124] Based on the above scheme, optionally, the performance indicator data includes actual CPU usage, actual memory usage and actual disk input / output speed; the operation vulnerability information includes actual vulnerability score, actual number of affected functions and actual data leakage index; the information processing module may include: a first evaluation coefficient determination submodule, a second evaluation coefficient determination submodule, and an operation evaluation coefficient determination submodule.

[0125] Among them, the first evaluation coefficient determination submodule is used to determine the first evaluation coefficient corresponding to the target terminal device according to the actual CPU usage of the target terminal device, the reference CPU usage corresponding to the actual CPU usage, the actual memory usage, the reference memory usage corresponding to the actual memory usage, the actual disk input / output speed, and the reference disk input / output speed corresponding to the actual disk input / output speed; the second evaluation coefficient determination submodule is used to determine the second evaluation coefficient corresponding to the target terminal device according to the actual vulnerability score of the target terminal device during operation, the reference vulnerability score corresponding to the actual vulnerability score, the actual number of affected functions, the reference number of affected functions corresponding to the actual number of affected functions, the actual data leakage index, and the reference data leakage index corresponding to the actual data leakage index; the operation evaluation coefficient determination submodule is used to determine the operation evaluation coefficient corresponding to the target terminal device according to the first evaluation coefficient and the second evaluation coefficient.

[0126] On the basis of the above scheme, optionally, the first evaluation coefficient determination submodule is specifically used to determine the first evaluation coefficient corresponding to the target terminal device according to the actual CPU usage of the target terminal device, the reference CPU usage corresponding to the actual CPU usage, the actual memory usage, the reference memory usage corresponding to the actual memory usage, the actual disk input / output speed, and the reference disk input / output speed corresponding to the actual disk input / output speed through the following formula:

[0127]

[0128] Among them, a xn represents the first evaluation coefficient corresponding to the target terminal device, Cpu, Mem, and Io represent the actual CPU usage, actual memory usage, and actual disk input / output speed corresponding to the target terminal device, respectively, Cpu′, Mem′, and Io′ represent the reference CPU usage, reference memory usage, and reference disk input / output speed corresponding to the target terminal device, respectively, a 1 、a 2 、a 3 They respectively represent preset weight coefficients, and e is a natural constant.

[0129] Based on the above solution, optionally, the second evaluation coefficient determination submodule is specifically used to determine the second evaluation coefficient corresponding to the target terminal device according to the actual vulnerability score, the actual number of affected functions and the actual data leakage index of the target terminal device during operation through the following formula:

[0130]

[0131] Among them, b ld represents the second evaluation coefficient corresponding to the target terminal device, Ld represents the actual vulnerability score of the target terminal device during operation, Gn represents the actual number of affected functions of the target terminal device during operation, Sj represents the actual data leakage index of the target terminal device during operation, Ld′ represents the reference vulnerability score of the target terminal device during operation, Gn′ represents the reference number of affected functions of the target terminal device during operation, Sj′ represents the reference data leakage index of the target terminal device during operation, and e is a natural constant.

[0132] On the basis of the above scheme, optionally, the security warning module includes: a first-level warning signal display submodule and a second-level warning signal display submodule. Wherein, the first-level warning signal display submodule is used to determine the device security level corresponding to the target terminal device as a first-level warning signal when the trustworthy assessment coefficient corresponding to the target terminal device is less than the first trustworthy assessment threshold, and display the first-level warning signal corresponding to the first-level warning signal; the second-level warning signal display submodule is used to determine the device security level corresponding to the target terminal device as a second-level warning signal when the trustworthy assessment coefficient corresponding to the target terminal device is greater than or equal to the first trustworthy assessment threshold and less than or equal to the second trustworthy assessment threshold, and display the second-level warning signal corresponding to the second-level warning signal; wherein, the warning degree of the first-level warning signal is greater than the warning degree of the second-level warning signal.

[0133] A security warning device for an Internet of Things terminal device provided in an embodiment of the present invention can execute the security warning method for an Internet of Things terminal device provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0134] Embodiment 5

[0135] Figure 5 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0136] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0137] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0138] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a security early warning method for an IoT terminal device.

[0139] In some embodiments, a security early warning method for an Internet of Things terminal device may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the security early warning method for an Internet of Things terminal device described above may be executed. Alternatively, in other embodiments, the processor 11 may be configured to execute a security early warning method for an Internet of Things terminal device in any other appropriate manner (e.g., by means of firmware).

[0140] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0141] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0142] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0143] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0144] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0145] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0146] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0147] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A security early warning method for an Internet of Things terminal device, characterized in that: include: Obtaining basic device information and device operation information corresponding to a target terminal device in the Internet of Things; wherein the basic device information includes at least one of device type information, device attack information, and device tag information; and the device operation information includes performance indicator information and / or operation vulnerability information; Determine a security assessment coefficient corresponding to the target terminal device according to the basic information of the device, and determine an operation assessment coefficient corresponding to the target terminal device according to the device operation information; Determine a trustworthy assessment coefficient corresponding to the target terminal device according to the security assessment coefficient and the operation assessment coefficient corresponding to the target terminal device; The device security level corresponding to the target terminal device is determined according to the trustworthy assessment coefficient corresponding to the target terminal device, and a device security warning is performed based on the device security level.

2. The method according to claim 1, characterized in that The determining the security assessment coefficient corresponding to the target terminal device according to the basic information of the device includes: Determine the actual severity score of the target terminal device under each attack according to the device attack information, and determine the attack assessment coefficient corresponding to the target terminal device according to the actual severity score under each attack; Determine a type evaluation coefficient corresponding to the target terminal device according to the device type information, and determine a device marking number corresponding to the target terminal device according to the device marking information; A security assessment coefficient corresponding to the target terminal device is determined according to the attack assessment coefficient, the type assessment coefficient and the number of device marking times.

3. The method according to claim 2, characterized in that The attack assessment coefficient corresponding to the target terminal device is determined according to the actual severity score under each attack by the following formula: Among them, β attack represents the attack evaluation coefficient corresponding to the target terminal device, i represents the i-th attack suffered by the target terminal device, i=1,2,3...j, S i It is represented as the actual severity score corresponding to the i-th attack, S i ′ represents the standard severity score corresponding to the i-th attack, ω i It is expressed as the weight coefficient corresponding to the i-th attack.

4. The method according to claim 2, characterized in that: The security assessment coefficient corresponding to the target terminal device is determined according to the attack assessment coefficient, the type assessment coefficient and the number of device markings by the following formula: ψ=χ*βattack*en; Where, ψ represents the security assessment coefficient corresponding to the target terminal device, χ represents the type assessment coefficient corresponding to the target terminal device, β attack represents the attack assessment coefficient corresponding to the target terminal device, n represents the number of device markings corresponding to the target terminal device, and e is a natural constant.

5. The method according to claim 2, characterized in that: Get the device tag information corresponding to the target terminal device in the Internet of Things, including: When the attack assessment coefficient corresponding to the target terminal device is greater than or equal to a preset attack assessment threshold, the target terminal device is marked to obtain device marking information corresponding to the target terminal device.

6. The method according to claim 1, characterized in that The performance indicator information includes actual CPU usage, actual memory usage and actual disk input / output speed; the operation vulnerability information includes actual vulnerability score, actual number of affected functions and actual data leakage index; The determining, according to the device operation information, an operation evaluation coefficient corresponding to the target terminal device includes: Determine a first evaluation coefficient corresponding to the target terminal device according to an actual CPU usage rate of the target terminal device, a reference CPU usage rate corresponding to the actual CPU usage rate, an actual memory usage rate, a reference memory usage rate corresponding to the actual memory usage rate, an actual disk input / output speed, and a reference disk input / output speed corresponding to the actual disk input / output speed; Determine a second evaluation coefficient corresponding to the target terminal device according to an actual vulnerability score of the target terminal device during operation, a reference vulnerability score corresponding to the actual vulnerability score, an actual number of affected functions, a reference number of affected functions corresponding to the actual number of affected functions, the actual data leakage index, and a reference data leakage index corresponding to the actual data leakage index; An operation evaluation coefficient corresponding to the target terminal device is determined according to the first evaluation coefficient and the second evaluation coefficient.

7. The method according to claim 6, characterized in that The first evaluation coefficient corresponding to the target terminal device is determined by the following formula according to the actual CPU usage of the target terminal device, the reference CPU usage corresponding to the actual CPU usage, the actual memory usage, the reference memory usage corresponding to the actual memory usage, the actual disk input / output speed, and the reference disk input / output speed corresponding to the actual disk input / output speed: Among them, a xn It represents the first evaluation coefficient corresponding to the target terminal device, Cpu, Mem, Io respectively represent the actual CPU usage, actual memory usage and actual disk input / output speed corresponding to the target terminal device, Cpu′, Mem′, Io′ respectively represent the reference CPU usage, reference memory usage and reference disk input / output speed corresponding to the target terminal device, a1, a2, a3 respectively represent preset weight coefficients, and e is a natural constant.

8. The method according to claim 6, characterized in that The second evaluation coefficient corresponding to the target terminal device is determined by the following formula according to the actual vulnerability score, the actual number of affected functions and the actual data leakage index of the target terminal device during operation: Among them, b ld represents the second evaluation coefficient corresponding to the target terminal device, Ld represents the actual vulnerability score of the target terminal device during operation, Gn represents the actual number of affected functions of the target terminal device during operation, Sj represents the actual data leakage index of the target terminal device during operation, Ld′ represents the reference vulnerability score of the target terminal device during operation, Gn′ represents the reference number of affected functions of the target terminal device during operation, Sj′ represents the reference data leakage index of the target terminal device during operation, and e is a natural constant.

9. The method according to claim 1, characterized in that: The determining, according to the trustworthy assessment coefficient corresponding to the target terminal device, a device security level corresponding to the target terminal device, and performing a device security warning based on the device security level, includes: When the trust evaluation coefficient corresponding to the target terminal device is less than a first trust evaluation threshold, determining the device security level corresponding to the target terminal device as a first-level warning signal, and displaying a first-level warning signal corresponding to the first-level warning signal; When the trustworthy assessment coefficient corresponding to the target terminal device is greater than or equal to the first trustworthy assessment threshold and less than or equal to the second trustworthy assessment threshold, the device security level corresponding to the target terminal device is determined as a second-level warning signal, and a second-level warning signal corresponding to the second-level warning signal is displayed; wherein the warning level of the first-level warning signal is greater than the warning level of the second-level warning signal.

10. A security warning device for an Internet of Things terminal device, characterized in that: include: An information acquisition module is used to acquire basic device information and device operation information corresponding to a target terminal device in the Internet of Things; wherein the basic device information includes at least one of device type information, device attack information, and device tag information; and the device operation information includes performance indicator information and / or operation vulnerability information; An information processing module, used to determine a security assessment coefficient corresponding to the target terminal device according to the basic information of the device, and to determine an operation assessment coefficient corresponding to the target terminal device according to the device operation information; A trusted evaluation module, used to determine a trusted evaluation coefficient corresponding to the target terminal device according to the security evaluation coefficient and the operation evaluation coefficient corresponding to the target terminal device; The security warning module is used to determine the device security level corresponding to the target terminal device according to the trustworthy assessment coefficient corresponding to the target terminal device, and to issue a device security warning based on the device security level.

Images