Heterogeneous communication network distributed gateway adaptive control method, device and equipment

Abstract

The invention discloses a heterogeneous communication network distributed gateway adaptive control method, device and equipment, and belongs to the technical field of gateway control. The method comprises the following steps: acquiring threat intensity of a heterogeneous communication network, vulnerability probability of the heterogeneous communication network, communication cost of the heterogeneous communication network, transmission speed of communication data of the heterogeneous communication network at any moment and transmission time corresponding to the transmission speed; calculating a communication data security risk according to the threat intensity, the vulnerability probability and the communication cost, and calculating a metric value of a data volume according to the transmission speed and the transmission time; and when the security risk of the communication data is higher than a preset risk value, or when the metric value is greater than the channel capacity of the passing network, executing an adaptive protection program. The packet loss rate of the heterogeneous communication network distributed gateway is reduced.

Description

Technical Field

[0001] The present invention relates to the field of gateway control, and in particular to a method, device and equipment for adaptively controlling distributed gateways in heterogeneous communication networks. Background Art

[0002] With the development of Internet technology, gateway protection, as the first line of defense in the field of network security, is mainly responsible for monitoring and controlling data packets entering and leaving the network, and filtering, checking and blocking data packets according to the set security policies. At present, the more mature gateway protection algorithms generally use gateway protection algorithms based on the BagR-CNN detection model. The main operating steps of the above-mentioned gateway protection algorithm based on the BagR-CNN detection model are: merging the relevant traffic sets into a data packet, and using the feature enhancement technology based on the information entropy correlation to improve the detection accuracy, using the feature expansion method of the similarity in the packet to deeply mine the hidden related information, and ensure the stability of the data in the packet under noise interference, and converting the aggregated packet into a one-dimensional vector through the feature compression algorithm of the Gaussian mixture model to train a concise convolutional neural network. According to the detection results of the network status, the corresponding protection operation is performed. However, the problem of the above-mentioned gateway protection algorithm based on the BagR-CNN detection model is that since the algorithm is based on the BagR-CNN detection model, sufficient computing resources are required for operation during the operation process. In the case of insufficient operating conditions, it will lead to the inability to guarantee the operation effect of the algorithm's protection, resulting in problems such as high packet loss rate.

[0003] The above contents are only used to assist in understanding the technical solution of the present invention and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of the present invention is to provide a method, device and equipment for adaptively controlling distributed gateways in heterogeneous communication networks, aiming to reduce the packet loss rate of distributed gateways in heterogeneous communication networks.

[0005] To achieve the above object, the present invention provides a method for adaptively controlling a distributed gateway in a heterogeneous communication network, the method comprising the following steps:

[0006] Obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed;

[0007] Calculating the communication data security risk according to the threat intensity, the vulnerability probability and the communication cost, and calculating the measurement value of the data volume according to the transmission speed and the transmission time;

[0008] When the communication data security risk is higher than a preset risk value, or when the metric value is greater than the capacity of the passing network channel, an adaptive protection program is executed.

[0009] Optionally, before the step of obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed, the step further includes:

[0010] Obtaining operational data of heterogeneous communication network operation processes and standard operational characteristics of network gateways under threat conditions;

[0011] Extracting operation characteristics of the operation process of the heterogeneous communication network according to the operation data;

[0012] determining whether the heterogeneous communication network is in a threat state according to the operational working characteristics and the standard working characteristics;

[0013] When a heterogeneous communication network is in a threat state, determine and execute steps to obtain the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed.

[0014] Optionally, the operation data includes: network communication data volume, and the step of extracting the operation work characteristics of the operation process of the heterogeneous communication network according to the operation data includes:

[0015] Calculate a first average value, a first peak value, and a first kurtosis feature of the network communication data volume according to the network communication data volume;

[0016] The operating performance characteristic is calculated based on the first average value, the first peak value, and the first kurtosis characteristic.

[0017] Optionally, there are multiple standard operating characteristics, and different standard operating characteristics correspond to different standard threat state types. The step of determining whether the heterogeneous communication network is in a threat state according to the operating operating characteristics and the standard operating characteristics includes:

[0018] Calculating the matching degree between each standard working characteristic and the running working characteristic respectively to obtain a plurality of matching degrees;

[0019] When there is a matching degree greater than a matching degree threshold, determining that the heterogeneous communication network is in a threat state, and determining that the standard threat state type corresponding to the matching degree being greater than the matching degree threshold is the threat state type of the current threat state of the heterogeneous communication network;

[0020] When there is no matching degree greater than the matching degree threshold, it is determined that the heterogeneous communication network is not in a threat state.

[0021] Optionally, the step of executing the adaptive protection program includes:

[0022] The corresponding protection instructions are integrated into the protection strategy to obtain the target protection strategy, wherein the protection strategy includes protocol switching and access control;

[0023] Execute the target protection strategy.

[0024] Optionally, the threat intensity is positively correlated with the communication data security risk, the vulnerability probability is positively correlated with the communication data security risk, and the communication cost is positively correlated with the communication data security risk.

[0025] Optionally, before the step of obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed, the step further includes:

[0026] A communication data packet of a heterogeneous communication network is obtained according to a preset formula, and the threat intensity, the vulnerability probability and the communication cost are determined according to the communication data packet.

[0027] In addition, to achieve the above-mentioned purpose, the present invention also provides a heterogeneous communication network distributed gateway adaptive control device, the heterogeneous communication network distributed gateway adaptive control device comprising:

[0028] An acquisition module, used to acquire the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed;

[0029] an identification module, configured to calculate the communication data security risk according to the threat intensity, the vulnerability probability and the communication cost, and calculate a measurement value of the data volume according to the transmission speed and the transmission time;

[0030] The execution module is used to execute the adaptive protection program when the communication data security risk is higher than a preset risk value, or when the metric value is greater than the capacity of the passing network channel.

[0031] In addition, to achieve the above-mentioned purpose, the present invention also provides a heterogeneous communication network distributed gateway adaptive control device, the heterogeneous communication network distributed gateway adaptive control device comprising: a memory, a processor and a heterogeneous communication network distributed gateway adaptive control program stored in the memory and executable on the processor, the heterogeneous communication network distributed gateway adaptive control program is configured to implement the steps of the heterogeneous communication network distributed gateway adaptive control method described in any one of the above items

[0032] In addition, to achieve the above-mentioned purpose, the present invention also provides a storage medium, characterized in that a heterogeneous communication network distributed gateway adaptive control program is stored on the storage medium, and when the heterogeneous communication network distributed gateway adaptive control program is executed by the processor, the steps of the heterogeneous communication network distributed gateway adaptive control method described in any one of the above items are implemented.

[0033] The present invention proposes a method for adaptive control of distributed gateways in heterogeneous communication networks, which obtains the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data in the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed; and calculates the security risk of the communication data according to the threat intensity, the vulnerability probability and the communication cost, and calculates the measurement value of the data volume according to the transmission speed and the transmission time; it can improve the accuracy of the subsequent execution of the adaptive protection program, and then compared with the traditional protection algorithm, under the action of the optimized design protection algorithm, the gateway's own safety factor of the heterogeneous communication network is significantly increased. The test results of the two indicators of comprehensive packet loss rate and gateway's own safety factor can prove that the optimized design algorithm has a higher protection effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a structural diagram of a heterogeneous communication network distributed gateway adaptive control device in a hardware operating environment involved in an embodiment of the present invention;

[0035] Figure 2 A schematic diagram of a flow chart of a first embodiment of a method for adaptively controlling a distributed gateway in a heterogeneous communication network according to the present invention;

[0036] Figure 3 This is an Internet of Things information fusion technology diagram of the first embodiment of the heterogeneous communication network distributed gateway adaptive control method of the present invention;

[0037] Figure 4 A TCP / IP protocol structure diagram of a first embodiment of a method for adaptively controlling a distributed gateway in a heterogeneous communication network according to the present invention;

[0038] Figure 5The protocol conversion architecture of the distributed gateway of the heterogeneous communication network of the first embodiment of the adaptive control method of the distributed gateway of the heterogeneous communication network of the present invention;

[0039] Figure 6 This is a diagram showing the adaptive protection results of a distributed gateway in a heterogeneous communication network of a test experiment of the first embodiment of the adaptive control method for a distributed gateway in a heterogeneous communication network of the present invention;

[0040] Figure 7 A comparison result diagram of the safety factor test of the heterogeneous communication network gateway itself in the test experiment of the first embodiment of the heterogeneous communication network distributed gateway adaptive control method of the present invention;

[0041] Figure 8 A schematic diagram of a flow chart of a first embodiment of a method for adaptively controlling a distributed gateway in a heterogeneous communication network according to the present invention;

[0042] Fig. 9 This is a diagram showing the actual installation of the photoelectric sensor of the heterogeneous communication network distributed gateway adaptive control method of the present invention in a heterogeneous communication network.

[0043] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0044] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0045] Reference Figure 1 , Figure 1 The present invention is a schematic diagram of the structure of a heterogeneous communication network distributed gateway adaptive control device in the hardware operating environment involved in the embodiment of the present invention.

[0046] like Figure 1As shown, the heterogeneous communication network distributed gateway adaptive control device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, an interactive device 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The interactive device 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the optional interactive device 1003 may also be connected to the communication bus through a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk memory. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0047] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation on the adaptive control device for distributed gateways in heterogeneous communication networks, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0048] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a data storage module, a network communication module, a user interface module, and a heterogeneous communication network distributed gateway adaptive control program.

[0049] exist Figure 1 In the heterogeneous communication network distributed gateway adaptive control device shown, the network interface 1004 is mainly used for data communication with other devices; the interactive device 1003 is mainly used for data interaction with users; the processor 1001 and the memory 1005 in the heterogeneous communication network distributed gateway adaptive control device of the present invention can be set in the heterogeneous communication network distributed gateway adaptive control device, and the heterogeneous communication network distributed gateway adaptive control device calls the heterogeneous communication network distributed gateway adaptive control program stored in the memory 1005 through the processor 1001, and executes the heterogeneous communication network distributed gateway adaptive control method provided in the embodiment of the present invention.

[0050] The embodiment of the present invention provides a distributed gateway adaptive control method for heterogeneous communication networks, referring to Figure 2 , Figure 2The present invention is a flowchart of a first embodiment of a method for adaptively controlling distributed gateways in a heterogeneous communication network.

[0051] In this embodiment, the heterogeneous communication network distributed gateway adaptive control method includes:

[0052] It should be noted that before step S1, it is necessary to collect heterogeneous communication network operation data based on IoT information perception. The heterogeneous communication network is generally composed of a bus, wireless sites and wireless gateways. The wired bus strictly follows the communication protocol standard to ensure the accuracy and stability of data transmission. The connection between the wireless site and the wired site depends on the wireless gateway, which is responsible for the smooth conversion between the wireless communication protocol and the wired communication protocol. The communication data transmitted in real time by the heterogeneous communication network here can be expressed by the following formula:

[0053]

[0054] Here N is the number of communication channels contained in the heterogeneous communication network, and K is s is the attenuation coefficient, f is the communication frequency, L is the channel length, δ is the impulse response coefficient at time t, x(n) is the input data of the nth channel, and y(n) is the output data of the corresponding channel. In addition, exemplarily, referring to Figure 3 , Figure 3 This is a technical diagram of information fusion in the Internet of Things. Specifically, the IoT devices are installed in a heterogeneous communication network, and data collection is completed through the operation of the IoT devices. The communication data collected by any sensing device in the IoT environment can be expressed by the following formula:

[0055] u(i)=κ w y(i),i∈n

[0056] Here u(i) is, and here k w is the working coefficient of the IoT device, where y(i) is the actual communication data of the ith IoT location in the heterogeneous communication network channel n. The final fusion result of the infinite information of the heterogeneous communication network is calculated as:

[0057]

[0058] Here In order to obtain the fusion coefficient corresponding to the communication data u(i), after executing the above steps multiple times, the collection results of the heterogeneous communication network operation data can be obtained.

[0059] Furthermore, since the heterogeneous communication network includes multiple networks with different topological structures, and the communication protocols used by different communication networks are significantly different, the specific communication protocols may include: one or more of the TCP / IP protocol, PROFIBUS-DP protocol, CAN bus protocol, and Post protocol, and optionally, other protocols other than the above communication protocols. Figure 4 , Figure 4 This is the TCP / IP protocol structure diagram. Figure 4 In the PROFIBUS-DP protocol, the communication protocol consists of two parts: TCP and IP. The TCP protocol, as a key protocol of the transport layer, focuses on ensuring the quality of service connection and closely monitors the data transmission process. Once the receiver fails to receive the data normally, the sender will start the retransmission mechanism until all the data arrives at the destination address accurately. The IP protocol focuses on assigning a unique IP address to each computer to ensure the unique identity of each device in the Internet. The TCP / IP protocol system can be divided into the application layer, transport layer, network layer and data link layer. Each layer is constructed by multiple protocols, and each layer has its own focus. This hierarchical design enables the TCP / IP protocol to run efficiently and stably. Each layer relies on the services provided by the next layer to achieve its specific functional requirements. Optionally, in the PROFIBUS-DP protocol, the RS485 standard needs to be strictly followed, and the transmission medium, physical connection, and electrical related characteristics need to be clearly specified. Furthermore, before the step of obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed, it also includes:

[0060] A communication data packet of a heterogeneous communication network is obtained according to a preset formula, and the threat intensity, the vulnerability probability and the communication cost are determined according to the communication data packet.

[0061] In the process of determining the communication protocol of the heterogeneous communication network, the collected communication data is taken as the processing object, and the specific method of determining the composition structure of the communication data packet can be based on the following formula:

[0062] Q(u)={L source ,L objective ,L Number ,L test}

[0063] Here Q(u) is the communication data packet, and L source is the source port in the communication data, where L objective is the destination port, where L Number is the serial number, where L testis the data length of the checksum. Optionally, the communication data packet may also include other types of data, such as data offset, window size, padding, etc.

[0064] Step S1, obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed;

[0065] It should be noted that the threat intensity, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time and the transmission speed are not obtained directly on the gateway, but are obtained by converting and calculating the communication data packets before step S1.

[0066] Step S2, calculating the communication data security risk according to the threat intensity, the vulnerability probability and the communication cost, and calculating the measurement value of the data volume according to the transmission speed and the transmission time;

[0067] Specifically, the measurement formula for communication data security risk and data volume is as follows:

[0068]

[0069] Here P threaten is the threat intensity, where R loophole is the vulnerability probability, where C net is the communication cost, where υ tran is the transmission speed, where Δt tran is the transmission time, F is the communication data security risk, and H is the measurement value of the data volume;

[0070] Step S3, when the communication data security risk is higher than a preset risk value, or when the metric value is greater than the capacity of the passing network channel, an adaptive protection program is executed.

[0071] Preferably, in this embodiment, the preset risk value is 0.6. Of course, the preset risk value can also be set by the network administrator. For heterogeneous communication networks in a threatened state, the gateway adaptive protection algorithm is started and a corresponding adaptive protection strategy is generated. The gateway adaptive protection strategy includes protocol switching, access control, etc. Figure 5 , Figure 5The protocol conversion architecture of the distributed gateway of the heterogeneous communication network. Specifically, according to the detection results of the threat status and type of the distributed gateway of the heterogeneous communication network, the gateway adaptive protection strategy is generated and executed. Assuming that the current heterogeneous communication network is detected to have a data theft threat, the execution result of the gateway's adaptive protection can be determined according to the following formula:

[0072] u encryption = Z(κ encryption ·u·K)

[0073] Here, κ encryption is the encryption coefficient of the communication data, where K is the encryption key of the communication data, where Z() is the generated adaptive protection strategy, and where u encryption The result of the adaptive protection of the gateway.

[0074] Furthermore, the anti-slip effect was tested. In the test experiment of this embodiment, the adaptive protection algorithm for the distributed gateway of the heterogeneous communication network selected the Linux system as the development tool. The Linux system consists of three parts: the hardware layer, the Linux kernel and the application program. It can simultaneously support the status detection of the heterogeneous communication network and the driving work of the Internet of Things. With the support of the development tool, the optimized design of the adaptive protection algorithm for the distributed gateway of the heterogeneous communication network under the information perception of the Internet of Things is converted into a program code that can be directly read and run by a computer. The deployed and configured heterogeneous communication network and the Internet of Things environment are connected to the protection program. Through the steps of gateway status detection and protection task generation, the adaptive protection result of the distributed gateway of the heterogeneous communication network is obtained. For details, refer to Figure 6 As shown, Figure 6 This is the result diagram of adaptive protection of distributed gateways in heterogeneous communication networks.

[0075] In the test experiment of this embodiment, the test indicators of the gateway protection security effect are the packet loss rate of the heterogeneous communication network and the network gateway's own security factor, where the packet loss rate refers to the proportion of data packets lost in the heterogeneous communication network during the communication process, and the network gateway's own security factor refers to the gateway device's ability to resist and the effectiveness of the protection mechanism when facing various security threats. The test result of the packet loss rate indicator is calculated according to the following formula:

[0076]

[0077] Here η is the packet loss rate indicator, and n send Send data for heterogeneous communication networks, where n receive Data is received for communications in a heterogeneous communications network.

[0078] φ=(s×ζ1)+(q×ζ2)-(n loophole×ζ3)

[0079] Here S is the network gateway performance, here q is the encryption strength of the network gateway, and here n loophole is the number of vulnerabilities contained in the distributed gateway, where are the measurement coefficients of the gateway working parameters, and where ζ1, ζ2 and ζ3 are the security factors of the network gateway itself. The experimental results are shown in the following table:

[0080]

[0081] The above table is a test result table of packet loss rate index of heterogeneous communication network. By calculating η, i.e. packet loss rate index, the data in the above table can be obtained: Figure 7 , Figure 7 This is a comparison chart of the safety factor test results of heterogeneous communication network gateways.

[0082] In this embodiment, by obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed; and calculating the communication data security risk according to the threat intensity, the vulnerability probability and the communication cost, and calculating the data volume measurement value according to the transmission speed and the transmission time; it can improve the accuracy of the subsequent execution of the adaptive protection program, and then compared with the traditional protection algorithm, under the action of the optimized design protection algorithm, the gateway's own security factor of the heterogeneous communication network is significantly increased. The test results of the two indicators of comprehensive packet loss rate and gateway's own security factor can prove that the optimized design algorithm has a higher protection effect.

[0083] Further, based on the first embodiment, a second embodiment of the method for adaptively controlling a distributed gateway in a heterogeneous communication network of the present invention is proposed. In this embodiment, referring to Figure 8 , before the step of obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed, it also includes:

[0084] Step S01, obtaining operation data of the operation process of the heterogeneous communication network and standard operation characteristics of the network gateway under the threat state;

[0085] Step S02, extracting operation characteristics of the operation process of the heterogeneous communication network according to the operation data;

[0086] Step S03, determining whether the heterogeneous communication network is in a threat state according to the operating working characteristics and the standard working characteristics;

[0087] Step S04, when the heterogeneous communication network is in a threat state, determine to execute the step of obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed.

[0088] It should be noted that before step S1, it is also necessary to determine whether the current heterogeneous communication network is in a threat state. Steps S01, S02, and S03 are used to determine whether the current heterogeneous communication network is in a threat state. During the operation of the distributed gateway of the heterogeneous communication network, the distributed gateway first receives data packets from different networks and performs preliminary processing according to preset rules and policies. These rules may include operations such as filtering, forwarding, and conversion of data packets, aiming to achieve interconnection between networks. Next, the gateway will perform security checks on the data packets, including identifying malicious traffic, blocking illegal access, etc., to ensure the security of the network. The distributed gateway will intelligently select the best path to forward the data packet according to the network status and load conditions. This dynamic routing mechanism can optimize network performance and improve the efficiency of data transmission. During the forwarding process, the gateway may also further convert and process the data to adapt to the protocol differences and data format requirements between different networks. The distributed gateway will send the processed data packets to the target network and continuously monitor the network status and data traffic. Once an abnormal situation or security threat is found, the gateway will immediately take corresponding measures, such as isolating malicious traffic, alarm notification, etc., to ensure the stable operation of the network. By using feature extraction and matching, it is determined whether the current gateway is in a threat state and the threat type is determined. The threat types of heterogeneous communication network gateways include: data theft threat, data modification threat, buffer overflow threat, gateway program modification threat and DDoS threat. Specifically, in this embodiment, the standard working characteristics of the network gateway under different threat states are β b (i) Matching the running working characteristics with the standard working characteristics to determine whether it is in a threat state. In this embodiment, by judging the threat state, the accuracy of the subsequent generation of the adaptive protection strategy of the heterogeneous communication network distributed gateway can be facilitated.

[0089] Further, the operation data includes: network communication data volume, and the step of extracting the operation work characteristics of the operation process of the heterogeneous communication network according to the operation data includes:

[0090] Calculate a first average value, a first peak value, and a first kurtosis feature of the network communication data volume according to the network communication data volume;

[0091] The operating performance characteristic is calculated based on the first average value, the first peak value, and the first kurtosis characteristic.

[0092] The specific formula for calculating the first average value, the first peak value and the first kurtosis feature of the network communication data volume according to the network communication data volume is as follows:

[0093]

[0094] Here β avg is the first average value of the network communication data volume, where β peak is the first peak value of the network communication data volume, where β Kurtosis is the first kurtosis feature of the network communication data volume, where and is the fusion weight of the above feature components. And the running work characteristics are calculated according to the following formula:

[0095]

[0096] Furthermore, the number of the standard operating characteristics is multiple, and different standard operating characteristics correspond to different standard threat state types. The step of determining whether the heterogeneous communication network is in a threat state according to the operating operating characteristics and the standard operating characteristics includes:

[0097] Calculating the matching degree between each standard working characteristic and the running working characteristic respectively to obtain a plurality of matching degrees;

[0098] When there is a matching degree greater than a matching degree threshold, determining that the heterogeneous communication network is in a threat state, and determining that the standard threat state type corresponding to the matching degree being greater than the matching degree threshold is the threat state type of the current threat state of the heterogeneous communication network;

[0099] When there is no matching degree greater than the matching degree threshold, it is determined that the heterogeneous communication network is not in a threat state.

[0100] Specifically, the formula for calculating the matching degree is as follows:

[0101]

[0102] Here p is the matching degree, and β b (i) is the standard working characteristic of the network gateway, and β here is the operating working characteristic.

[0103] In this embodiment, the matching degree can be accurately determined and calculated by the above formula, so that the operating characteristics of different threat status types currently in use can be identified.

[0104] Further, based on any of the above embodiments, a third embodiment of the method for adaptively controlling a distributed gateway in a heterogeneous communication network of the present invention is proposed. In this embodiment, the step of executing the adaptive protection program includes:

[0105] The corresponding protection instructions are integrated into the protection strategy to obtain the target protection strategy, wherein the protection strategy includes protocol switching and access control;

[0106] Execute the target protection strategy.

[0107] In this embodiment, photoelectric sensors, sound sensors and other devices are installed in the configured heterogeneous communication network. Fig. 9 , Fig. 9 This is a diagram of the actual installation of photoelectric sensors in a heterogeneous communication network. The Linux system is used as the development platform for the IoT gateway. The platform consists of three parts: BootLoader, kernel, and file system. During the development process, the kernel is copied from Flash to the preset location in the memory to complete the basic initialization process of the CPU and hardware. The kernel is then started and the parameters are configured. The program jumps to the kernel startup address to start the Linux system. After the system is started, various IoT devices in the heterogeneous communication network are successfully connected to the platform to achieve a comprehensive deployment of the IoT in a heterogeneous communication environment. In order to ensure the normal operation of the heterogeneous communication network, it is necessary to set the gateway and protocol in the network environment, including IP address, subnet mask, etc. The specific settings are shown in the following table.

[0108]

[0109] In the experiment based on the first embodiment, multiple threat attack programs can be added to the deployed heterogeneous communication network, and the threat attack types and intensities are different, so as to adjust the heterogeneous communication network gateway to a threat state.

[0110] In addition, an embodiment of the present invention further provides a heterogeneous communication network distributed gateway adaptive control device, the heterogeneous communication network distributed gateway adaptive control device comprising:

[0111] An acquisition module, used to acquire the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed;

[0112] an identification module, configured to calculate the communication data security risk according to the threat intensity, the vulnerability probability and the communication cost, and calculate a measurement value of the data volume according to the transmission speed and the transmission time;

[0113] The execution module is used to execute the adaptive protection program when the communication data security risk is higher than a preset risk value, or when the metric value is greater than the capacity of the passing network channel.

[0114] In addition, an embodiment of the present invention also proposes a heterogeneous communication network distributed gateway adaptive control device, the heterogeneous communication network distributed gateway adaptive control device comprising: a memory, a processor, and a heterogeneous communication network distributed gateway adaptive control program stored on the memory and executable on the processor, the heterogeneous communication network distributed gateway adaptive control program being configured to implement the steps of the heterogeneous communication network distributed gateway adaptive control method described in any one of the above items.

[0115] In addition, an embodiment of the present invention also proposes a storage medium, on which a heterogeneous communication network distributed gateway adaptive control program is stored. When the heterogeneous communication network distributed gateway adaptive control program is executed by a processor, the steps of the heterogeneous communication network distributed gateway adaptive control method described in any one of the above items are implemented.

[0116] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

[0117] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0118] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0119] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A distributed gateway adaptive control method for heterogeneous communication networks, characterized in that: The heterogeneous communication network distributed gateway adaptive control method comprises the following steps: Obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed; Calculating the communication data security risk according to the threat intensity, the vulnerability probability and the communication cost, and calculating the measurement value of the data volume according to the transmission speed and the transmission time; When the communication data security risk is higher than a preset risk value, or when the metric value is greater than the capacity of the passing network channel, an adaptive protection program is executed.

2. The method for adaptively controlling a distributed gateway in a heterogeneous communication network according to claim 1, characterized in that: Before the step of obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed, the step further includes: Obtaining operational data of heterogeneous communication network operation processes and standard operational characteristics of network gateways under threat conditions; Extracting operation characteristics of the operation process of the heterogeneous communication network according to the operation data; Determining whether the heterogeneous communication network is in a threat state according to the operational working characteristics and the standard working characteristics; When a heterogeneous communication network is in a threat state, determine and execute steps to obtain the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed.

3. The method for adaptively controlling a distributed gateway in a heterogeneous communication network as claimed in claim 2, characterized in that: The operation data includes: network communication data volume, and the step of extracting the operation work characteristics of the operation process of the heterogeneous communication network according to the operation data includes: Calculate a first average value, a first peak value, and a first kurtosis feature of the network communication data volume according to the network communication data volume; The operating performance characteristic is calculated based on the first average value, the first peak value, and the first kurtosis characteristic.

4. The method for adaptively controlling a distributed gateway in a heterogeneous communication network according to claim 2, wherein: The number of the standard working characteristics is multiple, and different standard working characteristics correspond to different standard threat state types. The step of determining whether the heterogeneous communication network is in a threat state according to the operating working characteristics and the standard working characteristics includes: Calculating the matching degree between each standard working characteristic and the running working characteristic respectively to obtain a plurality of matching degrees; When there is a matching degree greater than a matching degree threshold, determining that the heterogeneous communication network is in a threat state, and determining that the standard threat state type corresponding to the matching degree being greater than the matching degree threshold is the threat state type of the current threat state of the heterogeneous communication network; When there is no matching degree greater than the matching degree threshold, it is determined that the heterogeneous communication network is not in a threat state.

5. The method for adaptively controlling a distributed gateway in a heterogeneous communication network according to claim 1, characterized in that: The steps of executing the adaptive protection program include: The corresponding protection instructions are integrated into the protection strategy to obtain the target protection strategy, wherein the protection strategy includes protocol switching and access control; Execute the target protection strategy.

6. The method for adaptively controlling a distributed gateway in a heterogeneous communication network according to claim 1, characterized in that: The threat intensity is positively correlated with the communication data security risk, the vulnerability probability is positively correlated with the communication data security risk, and the communication cost is positively correlated with the communication data security risk.

7. The method for adaptively controlling a distributed gateway in a heterogeneous communication network according to any one of claims 1 to 6, characterized in that: Before the step of obtaining the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed, the method further includes: A communication data packet of a heterogeneous communication network is obtained according to a preset formula, and the threat intensity, the vulnerability probability and the communication cost are determined according to the communication data packet.

8. A distributed gateway adaptive control device for heterogeneous communication networks, characterized in that: The heterogeneous communication network distributed gateway adaptive control device comprises: An acquisition module, used to acquire the threat intensity of the heterogeneous communication network, the vulnerability probability of the heterogeneous communication network, the communication cost of the heterogeneous communication network, the transmission speed of the communication data of the heterogeneous communication network at any time, and the transmission time corresponding to the transmission speed; an identification module, configured to calculate the communication data security risk according to the threat intensity, the vulnerability probability and the communication cost, and calculate a measurement value of the data volume according to the transmission speed and the transmission time; The execution module is used to execute the adaptive protection program when the communication data security risk is higher than a preset risk value, or when the metric value is greater than the capacity of the passing network channel.

9. A distributed gateway adaptive control device for heterogeneous communication networks, characterized in that: The heterogeneous communication network distributed gateway adaptive control device includes: a memory, a processor, and a heterogeneous communication network distributed gateway adaptive control program stored in the memory and executable on the processor, wherein the heterogeneous communication network distributed gateway adaptive control program is configured to implement the steps of the heterogeneous communication network distributed gateway adaptive control method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium stores a heterogeneous communication network distributed gateway adaptive control program, and when the heterogeneous communication network distributed gateway adaptive control program is executed by the processor, the steps of the heterogeneous communication network distributed gateway adaptive control method as described in any one of claims 1 to 7 are implemented.

Images