Intelligent behavior analysis and anomaly detection system for Internet of Things security

Abstract

The invention relates to an intelligent behavior analysis and anomaly detection system for Internet of Things security, which is applied to the technical field of Internet of Things security, and comprises a data acquisition module, a data preprocessing module, a behavior modeling module and an anomaly detection module, the data preprocessing module cleans the data, the behavior modeling module generates a vector sequence of equipment behaviors through feature embedding and position coding, and the anomaly detection module analyzes time sequence association of the equipment behaviors by utilizing a self-attention mechanism and a multi-head attention mechanism and judges whether the equipment has abnormal behaviors or not. The cooperative defense module realizes cross-device cooperative defense through an edge detection unit and a cloud analysis unit, and the threat intelligence sharing module realizes sharing and updating of threat intelligence through a local intelligence database and an external intelligence interface. And the response module carries out automatic defense and notifies a system administrator through the automatic defense unit and the alarm unit when an abnormity is detected.

Description

Technical Field

[0001] The present invention relates to an intelligent behavior analysis and anomaly detection system for Internet of Things security, belonging to the field of Internet of Things security technology, and in particular to a technology for realizing security monitoring and defense of Internet of Things devices through data collection, intelligent behavior modeling, anomaly detection, collaborative defense and threat intelligence sharing. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, the large-scale deployment of IoT devices has brought great convenience. However, due to the wide variety, strong interconnectivity, and inconsistent security protection measures of IoT devices, they are vulnerable to various network attacks, such as DDoS attacks and malware propagation. Therefore, the security issues of IoT devices are becoming increasingly prominent. How to efficiently and accurately detect the abnormal behavior of IoT devices and quickly respond to defenses has become a key research direction in the field of technology.

[0003] Chinese invention patent CN116155694B discloses a management method, device and readable storage medium for IoT devices. The method obtains the operating data of IoT devices, generates alarm information according to preset alarm conditions, and removes false alarm information by analyzing the operating data of the target device to generate fused alarm information. This technology improves the accuracy of alarm information, reduces false alarms, and realizes linkage analysis between devices. However, this technology mainly focuses on the management and integration of alarm information, and still has limitations in cross-device linkage defense and detection of large-scale attacks.

[0004] Chinese invention patent CN116471124B discloses a network security prediction system based on big data analysis. The system identifies threats and generates threat assessment results by collecting network traffic, log information and user behavior data. This system provides accurate security predictions in the network environment, but it is mainly applicable to computer network environments, and lacks comprehensive support for real-time detection of heterogeneous IoT devices and cross-device collaborative defense.

[0005] Chinese invention patent CN117459323B proposes a threat modeling method for intelligent evolutionary IoT devices. It automatically matches mitigation measures and attack path libraries through semantic enhancement models, avoiding the high cost and low efficiency of manual threat modeling. However, this method mainly focuses on threat modeling and does not fully involve real-time behavior analysis and automated defense mechanisms during the operation of IoT devices.

[0006] Although the above technologies have made certain progress in alarm information fusion, threat modeling and big data analysis, they still have the following limitations: there is a lack of comprehensive mechanisms when dealing with collaborative detection and linkage defense of multiple devices, especially in complex IoT environments, where the anomaly of a single device may have a wide-ranging impact on the entire network. Some technical solutions rely on post-analysis and lack real-time detection and response when an attack occurs, and cannot meet the IoT devices' demand for immediate security response. The system focuses more on local alarms and analysis, lacks real-time linkage and updates with external threat intelligence platforms, and is difficult to respond to new and evolving security threats in a timely manner. Summary of the invention

[0007] In view of the above-mentioned prior art, the technical problem to be solved by the present invention is how to achieve cross-device collaborative defense, real-time detection and response, dynamic threat intelligence sharing and efficient automated defense of the Internet of Things.

[0008] To solve the above problems, the present invention provides an intelligent behavior analysis and anomaly detection system for IoT security, including a data acquisition module, a data preprocessing module, a behavior modeling module, an anomaly detection module, a collaborative defense module, a threat intelligence sharing module and a response module;

[0009] Data collection module, used to obtain device behavior data from IoT devices, including but not limited to device communication logs, network traffic, and sensor data;

[0010] The data preprocessing module is connected to the data acquisition module and is used to clean, denoise, serialize and standardize the collected device behavior data to form a unified feature sequence;

[0011] The behavior modeling module is connected to the data preprocessing module, and is used to convert the preprocessed device behavior data into a vector sequence through a feature embedding layer and position encoding, and perform long-term and short-term feature modeling on the device behavior pattern;

[0012] Anomaly detection module, including self-attention mechanism and multi-head attention mechanism based on Transformer model, which is used to analyze the correlation between device behavior sequences and generate anomaly scores for each sequence;

[0013] The collaborative defense module is connected to multiple IoT devices. The collaborative defense module includes an edge detection unit and a cloud analysis unit. It uses cross-device data sharing to analyze the behavioral associations between multiple devices, thereby achieving cross-device collaborative defense and global abnormal behavior analysis.

[0014] Threat intelligence sharing module, including local intelligence database and external intelligence interface, is used to synchronize the abnormal behavior information detected locally with the external threat intelligence platform to enhance the system's defense capabilities;

[0015] The response module is used to take automated defense measures when abnormal behavior is detected, including but not limited to blocking device network access, restricting device operations, and sending alarms.

[0016] In the above-mentioned intelligent behavior analysis and anomaly detection system for IoT security, the present invention implements local preliminary detection of devices by deploying edge detection units on IoT edge devices, and uploads the detection results to the cloud analysis unit for global anomaly analysis, thereby realizing collaborative defense among multiple devices. The system can integrate the behavior data of multiple devices, identify abnormal patterns across devices, and effectively respond to distributed attacks and large-scale device anomalies. It adopts the self-attention mechanism and multi-head attention mechanism based on the Transformer model, and can monitor the behavior data of IoT devices in real time, identify potential abnormal behaviors by quickly generating anomaly scores, and at the same time, the response module of the system can immediately take automated defense measures when an anomaly is detected. , reduce human intervention, ensure the real-time and response speed of the system, the threat intelligence sharing module stores known threat information through the local intelligence database, and synchronizes with the global threat intelligence platform through the external intelligence interface, realizing the dynamic sharing and updating of threat intelligence. The system can adjust the detection and defense strategies in time according to the latest threat intelligence information, enhance the protection capability of the system, especially when dealing with new threats. The response module can dynamically adjust the access control strategy of the device according to the detected abnormal behavior, block the network connection of the abnormal device or limit its functional access rights. In addition, the system can promptly notify the administrator of the abnormal detection results through the alarm unit to ensure that the administrator can grasp the device status in time and perform further processing when necessary.

[0017] As a further improvement of the present application, the data collection module includes a network traffic collection unit, a sensor data collection unit and a log collection unit;

[0018] A network traffic collection unit, used to collect communication data between IoT devices;

[0019] A sensor data acquisition unit, used to obtain real-time operation data from the sensors of the equipment;

[0020] The log collection unit is used to record and obtain the operation logs and operation records of the equipment.

[0021] As a further improvement of the present application, the data preprocessing module further includes a data cleaning unit and a data format conversion unit;

[0022] Data cleaning unit, used to remove noise and redundant data;

[0023] The data format conversion unit is used to standardize the format of heterogeneous data from different devices to form a unified feature sequence.

[0024] As a further improvement of the present application, the behavior modeling module further includes a feature embedding layer and a position encoding unit;

[0025] Feature embedding layer, used to convert the categorical features of the device into a low-dimensional vector representation;

[0026] The position encoding unit is used to add time and order information to the device behavior sequence to preserve the temporal characteristics of the behavior.

[0027] As another improvement of the present application, the anomaly detection module utilizes a multi-head attention mechanism to learn the multi-dimensional correlation of device behaviors through different attention heads, and calculates the correlation of each device behavior sequence through a self-attention mechanism to generate anomaly scores.

[0028] As another improved supplement of the present application, the collaborative defense module includes an edge detection unit and a cloud analysis unit;

[0029] Edge detection units, deployed on IoT edge devices, are used to initially detect abnormal behavior of devices and feed the results back to the cloud;

[0030] The cloud analysis unit is used to integrate the detection results from multiple edge devices to conduct global behavior analysis and formulate collaborative defense strategies.

[0031] As another improved supplement of the present application, the threat intelligence sharing module includes a local intelligence database and an external intelligence interface;

[0032] A local intelligence database to store threat patterns and historical attack records detected in the IoT system;

[0033] External intelligence interface, used to synchronize data with external threat intelligence platforms to obtain the latest global threat intelligence.

[0034] As another improvement of the present application, the response module includes an automatic defense unit and an alarm unit;

[0035] Automatic defense unit, used to take preset defense measures after detecting abnormal behavior, including but not limited to blocking the device's network connection, re-authenticating the device's identity, or limiting the device's operating permissions;

[0036] The alarm unit is used to send anomaly detection results and defense measures to system management through the notification mechanism.

[0037] An intelligent behavior analysis and anomaly detection system for Internet of Things security, the working method of which comprises the following steps:

[0038] S1: Collect the behavior data of IoT devices through the data collection module;

[0039] S2: pre-process the collected data to form a standardized device behavior sequence;

[0040] S3: The device behavior sequence is feature embedded and position encoded through the behavior modeling module to generate a vector sequence;

[0041] S4: The anomaly detection module uses the multi-head attention mechanism and self-attention mechanism to analyze the temporal correlation of device behaviors and generate anomaly scores;

[0042] S5: Based on the anomaly score, cross-device collaborative defense is implemented through the collaborative defense module, including the following steps:

[0043] Conduct preliminary anomaly detection on IoT edge devices;

[0044] Upload the detection results of edge devices to the cloud for global analysis;

[0045] Based on the global analysis results, abnormal behavior information is shared among multiple devices to form a cross-device collaborative defense mechanism;

[0046] S6: Synchronize the latest threat intelligence with external platforms through the threat intelligence sharing module, including the following steps:

[0047] Upload locally detected threat intelligence to external threat intelligence platforms to obtain the latest global threat intelligence updates;

[0048] Adjust the device’s anomaly detection and defense strategies based on the latest intelligence information;

[0049] S7: When abnormal behavior is detected through the response module, automated defense measures are taken, including:

[0050] Dynamically adjust the access control policy of the device;

[0051] Adjust anomaly detection thresholds and defense response measures in real time based on the latest threat intelligence information;

[0052] Block the communication of suspicious devices at the network level or restrict their functional access rights;

[0053] The anomaly detection results and defense measures are sent to system administrators through the notification mechanism.

[0054] In summary, this application has the following beneficial effects:

[0055] 1. Comprehensive data collection and preprocessing to improve data accuracy and richness. Through diversified data collection modules, this system can collect multiple data sources such as communication logs, network traffic and sensor data of IoT devices to ensure comprehensive capture of device behavior information. The system not only covers various operating states of IoT devices, but also monitors the physical world interaction of devices (such as sensor data). The data preprocessing module effectively removes noise and redundancy in the data through data cleaning and standardization, ensuring the quality and consistency of input data, and providing high-quality basic data for subsequent behavior modeling and anomaly detection.

[0056] 2. Intelligent behavior modeling based on timing characteristics improves the accuracy of anomaly detection. The behavior modeling module in the system uses feature embedding and position encoding technology to perform timing feature modeling on the behavior of IoT devices. By retaining the time and sequence information of device behavior, the system can not only detect a single behavior of the device, but also conduct in-depth analysis based on the temporal correlation of the behavior and accurately identify potential abnormal behaviors. Intelligent behavior modeling based on timing characteristics greatly improves the accuracy of anomaly detection, especially in complex device behaviors and dynamic environments.

[0057] 3. Efficient anomaly detection mechanism to achieve accurate and real-time anomaly identification. By using the self-attention mechanism and multi-head attention mechanism in the Transformer model, the system can learn the multi-dimensional behavioral correlations of IoT devices in parallel. The self-attention mechanism helps the system capture the key correlations in the behavior sequence, while the multi-head attention mechanism can process multi-dimensional features in parallel, further improving the breadth and depth of detection. The efficient detection mechanism can quickly generate anomaly scores for each device behavior, ensuring that the system can detect abnormal behavior of the device in real time and accurately, which is especially suitable for large-scale IoT devices in complex networks.

[0058] 4. Cross-device collaborative defense enhances the overall defense capability of the system. The system implements a cross-device defense strategy in the IoT network through the collaborative defense module. The edge detection unit performs preliminary anomaly detection on the local device, combined with the global analysis of the cloud analysis unit. The system can coordinate the defense strategies of multiple devices in real time and implement a multi-level defense mechanism. The collaborative defense mechanism can effectively respond to distributed attacks and cross-device linkage attacks. By sharing abnormal behavior information among multiple devices, the system can block the expansion of attacks in a timely manner and improve the overall network security protection capabilities.

[0059] 5. Dynamic threat intelligence sharing and updating ensures the forward-looking nature of system defense. This patented system has a dynamic threat intelligence sharing function. It stores historical threat information through a local intelligence database and obtains the latest global threat intelligence in real time through an external intelligence interface. The system can use this intelligence information to promptly adjust anomaly detection rules and defense strategies. The sharing and updating of threat intelligence enables the system to always maintain sensitivity and foresight to new threats. By timely acquiring and applying the latest threat intelligence from external platforms, the system can effectively respond to the latest attack methods and ensure that the system is always in the best protection state.

[0060] 6. Automated response mechanism reduces manual intervention and response delays. The system implements automated defense measures through the response module. When abnormal behavior is detected, it can automatically adjust the access rights of the device, block the network connection of the abnormal device, and limit its functional operations. This automated defense mechanism greatly reduces the need for manual intervention and ensures that the system can respond quickly at the first time of the attack. At the same time, the system has a built-in alarm unit that can send abnormal behavior detection results and defense measures to the administrator in real time, ensuring that the administrator can grasp the system dynamics in a timely manner and reduce security risks caused by untimely human intervention.

[0061] 7. Strong adaptability, able to flexibly respond to IoT applications of different scales and scenarios. The modular design of this system makes it highly adaptable and scalable. Whether it is a small-scale home IoT or a large-scale industrial IoT environment, the system can adapt to different application scenarios and network scales by flexibly configuring data collection, modeling and defense modules. The deployment method of the edge detection unit enables the system to cope with scenarios with high real-time requirements, while the cloud analysis unit enhances the system's computing power in large-scale, multi-device collaborative defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 This is the system architecture diagram of this application;

[0063] Figure 2 This is the system interaction diagram for this application;

[0064] Figure 3 This is a partial system architecture diagram of this application;

[0065] Figure 4 This is a working step diagram for this application. DETAILED DESCRIPTION

[0066] Three embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0067] Example 1

[0068] like Figures 1 to 4As shown, this embodiment relates to an intelligent behavior analysis and anomaly detection system for IoT security, and the system includes the following main modules:

[0069] Data acquisition module, which is used to obtain device behavior data from IoT devices. The data types include but are not limited to device communication logs, network traffic, sensor data, etc. According to the actual needs of the system, the data acquisition module can be further divided into network traffic acquisition unit, sensor data acquisition unit and log collection unit.

[0070] The network traffic collection unit is used to monitor and collect communication data between IoT devices, such as data traffic transmitted through protocols such as WiFi, ZigBee, and Bluetooth.

[0071] The sensor data acquisition unit is used to collect real-time data from various sensors (such as temperature sensors and pressure sensors) on IoT devices.

[0072] The log collection unit is used to obtain system logs, operation records and other information from the operating system of the IoT device. These data can reflect the operating status of the device.

[0073] Data preprocessing module: After collecting data, the system processes the data through the data preprocessing module, which includes a data cleaning unit and a data format conversion unit.

[0074] Data cleaning unit, which is used to remove noise and redundant data in the data to ensure the integrity and accuracy of the data. The noise may include erroneous data packets in network communication or abnormal data in sensors.

[0075] Data format conversion unit, since IoT devices may use different protocols and formats, the data format conversion unit is responsible for converting heterogeneous data from different devices into a standardized format to form a unified feature sequence to facilitate subsequent behavior analysis.

[0076] The behavior modeling module is connected to the data preprocessing module and is responsible for feature embedding and position encoding of the preprocessed device behavior data. The module further includes a feature embedding layer and a position encoding unit.

[0077] The feature embedding layer converts the device's categorical features (such as device ID, device type, etc.) into low-dimensional vector representations. The feature embedding layer can represent complex device behavior data as vectors, making it easier for machine learning models to process these data.

[0078] The position encoding unit is used to add time and order information to the device behavior sequence, so that the system can retain the timing characteristics of the device behavior. In this way, the system can understand the order and correlation of the device behavior, which is helpful for subsequent anomaly detection.

[0079] The anomaly detection module uses the self-attention mechanism and multi-head attention mechanism based on the Transformer model to analyze the vector sequence output by the behavior modeling module. Specifically, the anomaly detection module works in the following ways:

[0080] The self-attention mechanism is used to analyze the correlation between each data point in the device behavior sequence and other data points, helping to identify important behavioral features and potential anomalies in the sequence.

[0081] Multi-head attention mechanism, through multiple attention heads, the model can learn the multi-dimensional correlation of device behavior in parallel, and each head can focus on different behavioral features or patterns, thereby more accurately identifying abnormal behaviors.

[0082] Ultimately, the anomaly detection module will generate an anomaly score for each device behavior sequence, and determine whether the device behavior deviates from the normal pattern based on the score, thereby detecting potential anomalies.

[0083] Working process

[0084] First, the data acquisition module obtains the behavior data of the device from the IoT device. These data may include communication logs, network traffic, sensor data, etc. The network traffic acquisition unit monitors the communication behavior between devices, the sensor data acquisition unit records the physical status data of the device, and the log acquisition unit collects the operation log of the device.

[0085] After collecting the raw data, the data preprocessing module processes the data, the data cleaning unit removes noise and erroneous data to ensure the quality of the data, and the data format conversion unit converts the data of heterogeneous devices into a unified standard format to ensure that data from different devices can be processed consistently in subsequent stages.

[0086] The preprocessed data is sent to the behavior modeling module. The feature embedding layer converts the categorical features into low-dimensional vectors, and the position encoding unit adds timing information to the behavior data. Through these steps, the system can serialize the device behavior at different time points into vector representations and retain the timing characteristics of the behavior.

[0087] After the behavior modeling is completed, the anomaly detection module analyzes the generated behavior sequence. Through the self-attention mechanism, the model can calculate the correlation between each data point in the sequence and other data points, and discover abnormal features in the device behavior. At the same time, the multi-head attention mechanism helps the model learn the device behavior relationship in different dimensions and identify possible abnormal patterns. Finally, the anomaly detection module will generate an anomaly score for each device behavior sequence and identify potential abnormal behaviors.

[0088] Through multiple data collection units (such as network traffic collection unit, sensor data collection unit, log collection unit), this embodiment can collect device behavior data from multiple dimensions, provide a rich source of data, and enhance the system's behavior analysis capabilities.

[0089] Through the data preprocessing module, the system can effectively clean the data and standardize the data from different sources, ensuring the consistency and accuracy of the data during subsequent model processing, and reducing the false positives or omissions caused by data quality issues.

[0090] Through the combination of feature embedding and position encoding, the system can effectively capture the temporal characteristics of device behavior. In this way, the system can not only analyze individual behaviors, but also perform more accurate anomaly detection based on the temporal sequence of behaviors.

[0091] By using the self-attention mechanism and multi-head attention mechanism in the Transformer model, the system can quickly identify abnormal patterns in large-scale device behavior data and improve detection accuracy. This mechanism helps to process multi-dimensional device behavior and discover potential anomalies more comprehensively.

[0092] Due to the modular design, each part of the system can be independently expanded and optimized, especially the data acquisition module and anomaly detection module, which can be adapted according to different application scenarios to enhance the versatility and flexibility of the system.

[0093] The design of this embodiment builds a complete IoT device behavior analysis process from data collection to anomaly detection. The system can be widely used in security protection scenarios of various IoT devices and has the advantages of real-time monitoring and intelligent anomaly detection.

[0094] Example 2

[0095] like Figures 1 to 4 As shown, based on Example 1, this embodiment further introduces collaborative defense, threat intelligence sharing and automatic response mechanisms to achieve more advanced linkage defense, intelligence sharing and automatic response in the IoT security system. The system includes the following modules:

[0096] Collaborative defense module,The collaborative defense module is used to achieve coordinated defense across multiple IoT devices,preventing the security issues of a single device from spreading to the entire network.

[0097] The edge detection unit is deployed on the edge device of the Internet of Things and is used to perform preliminary abnormal behavior detection on the device side. It can run independently to reduce the delay problem of uploading data to the cloud.

[0098] Cloud analysis unit,The cloud analysis unit is used to integrate the detection results from multiple edge devices and perform global behavior analysis. It can perform large-scale abnormal pattern recognition across multiple devices and formulate collaborative defense strategies. The centralized computing power of the cloud allows more complex and in-depth analysis.

[0099] Threat intelligence sharing module: In order to improve the system's defense capabilities, the system has a threat intelligence sharing function. By sharing and updating the latest threat intelligence, the system can dynamically adjust detection and defense strategies.

[0100] A local intelligence database is used to store threat patterns and historical attack records detected in the IoT system. The system identifies repeated attack patterns and potential risks by analyzing local threat data.

[0101] External intelligence interface. Through the external intelligence interface, the system can synchronize data with the external threat intelligence platform, obtain the latest global threat intelligence, adjust defense strategies in a timely manner, and ensure that the protection system remains updated against new attack methods.

[0102] Response module: The response module is used to automatically take defensive measures and send alarms after detecting abnormal behavior. This module realizes the automatic response function of the system by combining the automatic defense unit and the alarm unit.

[0103] Automatic defense unit, which is used to automatically take defense measures after detecting abnormal behavior, including blocking the device network connection, re-authenticating the device identity or limiting the device's operating permissions. It can respond quickly as soon as the abnormality occurs to reduce the impact on the entire network.

[0104] Alarm unit, when abnormal behavior is detected or the system takes defensive measures, the alarm unit will send information to the system administrator through the notification mechanism to ensure that the administrator can understand the security status of the system in a timely manner.

[0105] Working process

[0106] With the deployment of edge detection units, each IoT device (such as sensors, smart home devices, etc.) can independently detect abnormal behavior, reducing latency and bandwidth requirements for data upload. The edge detection unit can identify basic anomalies of the device and send the detection results to the cloud.

[0107] After receiving data from multiple edge devices, the cloud analysis unit conducts a global analysis. By integrating the detection results of multiple devices, the system can discover the associated abnormal behaviors between multiple devices and formulate a global defense strategy. For example, if multiple devices exhibit abnormal communication behaviors at the same time, the cloud can determine that this may be a cross-device attack, triggering a linkage defense mechanism to prevent further attack propagation.

[0108] The threat intelligence sharing module records and stores threat patterns detected in the system through a local intelligence database to help identify repeated or progressive attacks. The system regularly analyzes these historical data to optimize anomaly detection and defense strategies.

[0109] At the same time, the external intelligence interface maintains real-time synchronization with the global threat intelligence platform to obtain the latest attack intelligence and defense strategies. When new threats are identified, the system will promptly adjust the detection rules and defense measures. For example, when a new malware attack pattern is detected, the system can update its defense strategy through the external intelligence interface and prepare for protection before the next attack.

[0110] When the edge detection unit or cloud analysis unit identifies abnormal behavior, the system will automatically react through the response module, and the automatic defense unit will take appropriate defense measures according to the preset strategy, such as blocking the device's network connection to prevent it from becoming a springboard for attack.

[0111] When the defense measures are initiated, the alarm unit will notify the system administrator of the abnormal detection results and the defense measures taken. The administrator can timely understand the current status of the system through the alarm mechanism and further take necessary manual intervention or analysis.

[0112] By deploying edge detection units on the device side, the system can achieve localized preliminary detection, reducing data transmission delays and central computing loads. Edge devices can quickly identify and respond to anomalies, which is particularly suitable for application scenarios with real-time requirements, such as smart manufacturing and smart homes.

[0113] The cloud analysis unit can centrally process the detection data of multiple devices, identify complex attack patterns across devices, and formulate global defense strategies. This collaborative defense mechanism can effectively respond to distributed attacks and improve the overall security of the system.

[0114] The threat intelligence sharing module can obtain and update the latest global threat intelligence in real time through the combination of local intelligence database and external intelligence interface. The system can not only optimize defense based on local historical data, but also respond to new attacks in a timely manner, improving the protection effect and sustainability of the system.

[0115] Through the automatic defense function of the response module, the system can take defensive measures in the first place to reduce the impact of abnormal behavior on the entire IoT network. The automatic defense function can independently prevent abnormal operation of the equipment and reduce the need for manual intervention. The alarm unit can ensure that the administrator can grasp the system dynamics in a timely manner, providing convenience for further security management.

[0116] The system can be expanded according to actual needs, increasing the number of edge detection units or enhancing the computing power of cloud analysis units to adapt to large-scale IoT networks. In addition, the system can be connected to different threat intelligence platforms to ensure that the system is always in the latest security status.

[0117] Example 3

[0118] like Figures 1 to 4 As shown, this embodiment, based on Embodiment 1 and Embodiment 2, combines the overall workflow of the IoT security intelligent behavior analysis and anomaly detection system, and describes in detail the complete working method from data collection to the final collaborative defense, threat intelligence sharing and response mechanism. This embodiment further elaborates on the working steps of the system, including data collection, preprocessing, behavior modeling, anomaly detection, collaborative defense, threat intelligence sharing and response mechanism and other links.

[0119] The working method of the system includes the following steps:

[0120] S1: Data Collection

[0121] The system first collects behavioral data from IoT devices through the data collection module, including device communication logs, network traffic, and sensor data. The data collection module is further divided into:

[0122] The network traffic collection unit is used to collect communication data between IoT devices.

[0123] The sensor data acquisition unit is used to collect real-time physical data from sensors of IoT devices.

[0124] The log collection unit is used to collect the operation logs and system status of the device.

[0125] S2: Data preprocessing

[0126] The collected data is sent to the data preprocessing module, which processes the data through the following steps:

[0127] The data cleaning unit removes noise, redundancy and abnormal data in the data to ensure data quality.

[0128] The data format conversion unit standardizes and converts heterogeneous data formats from different devices to form a unified feature sequence.

[0129] S3: Behavioral Modeling

[0130] The preprocessed and standardized data is fed into the behavior modeling module, which performs the following processing on the device's behavior data:

[0131] The feature embedding layer embeds categorical features (such as device ID, device type, etc.) into a low-dimensional vector space to form a vector representation of device behavior.

[0132] The position encoding unit adds time and order information to the behavior sequence data to ensure that the temporal characteristics of the behavior are preserved.

[0133] S4: Anomaly Detection

[0134] After the behavior modeling is completed, the anomaly detection module uses the following two mechanisms to analyze the device behavior:

[0135] The self-attention mechanism analyzes the correlation between each data point in the behavior sequence and other data points, helping to discover abnormal behavior characteristics in the sequence.

[0136] The multi-head attention mechanism learns the multi-dimensional features of device behavior through multiple attention heads in parallel, and then generates anomaly scores for each sequence. Based on these scores, the system can determine whether the behavior of the device is abnormal.

[0137] S5: Coordinated Defense

[0138] When a device is detected to be abnormal, the system will implement cross-device collaborative defense through the collaborative defense module. The specific steps include:

[0139] Edge detection, performs preliminary anomaly detection on IoT edge devices. The edge detection unit can independently detect device behavior and preliminarily determine whether there is an anomaly, reducing latency and improving real-time performance.

[0140] Cloud Analysis,The results of the edge detection unit will be uploaded to the cloud analysis unit, which is responsible for integrating the detection results from multiple edge devices, performing global analysis, and determining the extent of the abnormal behavior.

[0141] Sharing abnormal behavior information: The cloud analysis unit shares this information in the IoT network based on the correlation of abnormal behaviors of multiple devices, forming a cross-device collaborative defense mechanism to prevent attacks from spreading among multiple devices.

[0142] S6: Threat Intelligence Sharing

[0143] The system keeps the threat intelligence synchronized with the external platform through the threat intelligence sharing module. The specific steps include:

[0144] Upload local threat intelligence and upload locally detected threat intelligence to external threat intelligence platforms. The system uploads previously detected threat patterns to facilitate external platforms to share and update global threat intelligence.

[0145] Obtain global threat intelligence updates and obtain the latest global threat intelligence from external platforms. The system adjusts internal anomaly detection rules and defense strategies in a timely manner based on this intelligence information to respond to new attacks.

[0146] S7: Automated response mechanism

[0147] After detecting an anomaly, the system will take automated defense measures through the response module. The specific steps include:

[0148] Dynamically adjust access control policies. Based on detected anomalies, the system automatically adjusts device access permissions to prevent further attacks on the device or to expand attack behaviors.

[0149] Adjust the anomaly detection threshold. Based on the latest threat intelligence information, the system dynamically adjusts the anomaly detection threshold and defense measures to ensure that the defense strategy remains adapted to the latest threats.

[0150] Block communications or restrict functional access. In extremely serious cases, the system will block the device's network communications or restrict its functional access rights to prevent the attack from spreading further.

[0151] Send an alarm notification. Finally, the system sends the abnormal detection results and defense measures to the system administrator through the alarm unit through the notification mechanism, ensuring that the administrator can grasp the system's operating status in a timely manner and make necessary adjustments.

[0152] Working process

[0153] Collect behavioral data from IoT devices through the data collection module.

[0154] The collected data is cleaned and standardized through the data preprocessing module.

[0155] The behavior modeling module generates feature vectors of device behavior and preserves timing characteristics.

[0156] The anomaly detection module analyzes the correlation of behavior sequences, generates anomaly scores, and detects abnormal behaviors.

[0157] After detecting an anomaly, the system performs edge detection and cloud analysis through the collaborative defense module, and shares abnormal behavior information among multiple devices to achieve cross-device collaborative defense.

[0158] The system uploads locally detected threat intelligence through the threat intelligence sharing module, obtains the latest threat intelligence from external platforms, and adjusts the system's defense strategy.

[0159] The system takes automated defense measures through the response module, including dynamically adjusting device access rights, blocking network communications of abnormal devices, and notifying system administrators of abnormal detection results.

[0160] This embodiment realizes a multi-level defense system from edge devices to the cloud by combining edge detection and cloud analysis. The edge devices can independently perform preliminary anomaly detection, reduce latency, and improve real-time performance, while the cloud analysis unit can perform cross-device collaborative defense to improve global security.

[0161] The system keeps in sync with external platforms through the threat intelligence sharing module. It can not only defend based on local historical data, but also dynamically adjust defense strategies according to the latest intelligence from external platforms, ensuring that the system can always respond to the latest attack patterns.

[0162] The system has an automated defense mechanism that can respond immediately once abnormal behavior is detected, automatically adjusting access permissions or blocking communications of abnormal devices, thereby reducing the need for human intervention and improving the system's response speed.

[0163] Through the alarm mechanism, administrators can understand the security status of the system in a timely manner and take corresponding countermeasures based on system feedback. This real-time alarm mechanism ensures that administrators can effectively grasp the security situation of the IoT system.

[0164] This embodiment realizes the linked defense and rapid response of the IoT security system through collaborative defense, threat intelligence sharing and automated response mechanisms, and is particularly suitable for security protection of large-scale distributed IoT systems.

[0165] In view of current practical needs, the above-mentioned implementation mode adopted in this application is not limited to the scope of protection. Various changes made within the knowledge scope of technical personnel in this field without departing from the concept of this application still fall within the scope of protection of the present invention.

Claims

1. An intelligent behavior analysis and anomaly detection system for IoT security, characterized by: It includes data collection module, data preprocessing module, behavior modeling module, anomaly detection module, collaborative defense module, threat intelligence sharing module and response module; The data acquisition module is used to obtain device behavior data from IoT devices, including but not limited to device communication logs, network traffic, and sensor data; The data preprocessing module is connected to the data acquisition module and is used to clean, denoise, serialize and standardize the collected device behavior data to form a unified feature sequence; The behavior modeling module is connected to the data preprocessing module, and is used to convert the preprocessed device behavior data into a vector sequence through a feature embedding layer and position encoding, and perform long-term and short-term feature modeling on the device behavior pattern; The anomaly detection module includes a self-attention mechanism and a multi-head attention mechanism based on a Transformer model, which is used to analyze the correlation between the device behavior sequences and generate an anomaly score for each sequence; The collaborative defense module is connected to multiple IoT devices. The collaborative defense module includes an edge detection unit and a cloud analysis unit. It uses cross-device data sharing to analyze the behavioral associations between multiple devices to achieve cross-device collaborative defense and global abnormal behavior analysis. The threat intelligence sharing module includes a local intelligence database and an external intelligence interface, which is used to synchronize the abnormal behavior information detected locally with the external threat intelligence platform to enhance the defense capability of the system; The response module is used to take automated defense measures when abnormal behavior is detected, including but not limited to blocking device network access, restricting device operations and sending alarms.

2. The intelligent behavior analysis and anomaly detection system for Internet of Things security according to claim 1 is characterized in that: The data collection module includes a network traffic collection unit, a sensor data collection unit and a log collection unit; The network traffic collection unit is used to collect communication data between IoT devices; The sensor data acquisition unit is used to obtain real-time operation data from the sensor of the device; The log collection unit is used to record and obtain the operation log and operation record of the device.

3. The intelligent behavior analysis and anomaly detection system for Internet of Things security according to claim 1 is characterized in that: The data preprocessing module further includes a data cleaning unit and a data format conversion unit; The data cleaning unit is used to remove noise and redundant data; The data format conversion unit is used to perform format standardization processing on heterogeneous data from different devices to form a unified feature sequence.

4. The intelligent behavior analysis and anomaly detection system for Internet of Things security according to claim 1, characterized in that: The behavior modeling module further includes a feature embedding layer and a position encoding unit; The feature embedding layer is used to convert the category features of the device into a low-dimensional vector representation; The position encoding unit is used to add time and order information to the device behavior sequence to retain the temporal characteristics of the behavior.

5. The intelligent behavior analysis and anomaly detection system for Internet of Things security according to claim 1, characterized in that: The anomaly detection module uses a multi-head attention mechanism to learn the multi-dimensional association of device behaviors through different attention heads, and calculates the correlation of each device behavior sequence through a self-attention mechanism to generate anomaly scores.

6. The intelligent behavior analysis and anomaly detection system for IoT security according to claim 1, characterized in that: The collaborative defense module includes an edge detection unit and a cloud analysis unit; The edge detection unit is deployed on the IoT edge device to preliminarily detect abnormal behavior of the device and feed the results back to the cloud; The cloud analysis unit is used to integrate the detection results from multiple edge devices, conduct global behavior analysis and formulate collaborative defense strategies.

7. The intelligent behavior analysis and anomaly detection system for IoT security according to claim 1, characterized in that: The threat intelligence sharing module includes a local intelligence database and an external intelligence interface; The local intelligence database is used to store threat patterns and historical attack records detected in the IoT system; The external intelligence interface is used to synchronize data with an external threat intelligence platform to obtain the latest global threat intelligence.

8. The intelligent behavior analysis and anomaly detection system for Internet of Things security according to claim 1, characterized in that: The response module includes an automatic defense unit and an alarm unit; The automatic defense unit is used to take preset defense measures after detecting abnormal behavior, including but not limited to blocking the network connection of the device, re-authenticating the device identity or limiting the operation authority of the device; The alarm unit is used to send the abnormal detection results and defense measures to the system management through the notification mechanism.

9. An intelligent behavior analysis and anomaly detection system for Internet of Things security according to any one of claims 1 to 8, characterized in that: Its working method includes the following steps: S1: Collect the behavior data of IoT devices through the data collection module; S2: pre-process the collected data to form a standardized device behavior sequence; S3: The device behavior sequence is feature embedded and position encoded through the behavior modeling module to generate a vector sequence; S4: The anomaly detection module uses the multi-head attention mechanism and self-attention mechanism to analyze the temporal correlation of device behaviors and generate anomaly scores; S5: Based on the anomaly score, cross-device collaborative defense is implemented through the collaborative defense module, including the following steps: Conduct preliminary anomaly detection on IoT edge devices; Upload the detection results of edge devices to the cloud for global analysis; Based on the global analysis results, abnormal behavior information is shared among multiple devices to form a cross-device collaborative defense mechanism; S6: Synchronize the latest threat intelligence with external platforms through the threat intelligence sharing module, including the following steps: Upload locally detected threat intelligence to external threat intelligence platforms to obtain the latest global threat intelligence updates; Adjust the device’s anomaly detection and defense strategies based on the latest intelligence information; S7: When abnormal behavior is detected through the response module, automated defense measures are taken, including: Dynamically adjust the access control policy of the device; Adjust anomaly detection thresholds and defense response measures in real time based on the latest threat intelligence information; Block the communication of suspicious devices at the network level or restrict their functional access rights; The anomaly detection results and defense measures are sent to system administrators through the notification mechanism.

Images