Industrial Internet of Things security threat anomaly detection method and device, and medium

Abstract

The invention discloses an industrial Internet of Things security threat anomaly detection method and device and a medium, relates to the field of Internet of Things security detection, and solves the problem that threats brought by network data packets cannot be effectively avoided. Analyzing the network data packet to obtain quintuple information corresponding to the network data packet; analyzing the quintuple information corresponding to the network data packet to obtain an abnormal signal or a security threat coefficient of the network data packet; historical network information of a user corresponding to the industrial Internet of Things and real-time network information of interaction between the industrial Internet and the network data packet are collected, and a real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things is calculated; calculating the network danger level of the network data packet through the real-time abnormal operation rate and the security threat coefficient of the network data packet; and setting a coping strategy according to the network danger level of the network data packet. According to the invention, the threat brought by the network data packet is safely avoided.

Description

Technical Field

[0001] The present invention relates to Internet of Things security detection technology, and specifically to an industrial Internet of Things security threat anomaly detection method, equipment and medium. Background Art

[0002] With the rapid development of IoT technology, more and more devices and sensors are connected to the Internet, forming a huge IoT ecosystem. This connectivity has brought unprecedented convenience and efficiency improvements to the industrial field, but it also provides more potential entry points and attack surfaces for attackers. Since IoT devices usually involve multiple systems, protocols and interfaces, and there may be compatibility and security issues between devices from different manufacturers, the industrial IoT system faces diverse security threats.

[0003] However, at present, when monitoring security threats of the Industrial Internet of Things, people often rely on known vulnerability libraries for scanning and detection, instead of analyzing the real-time access situation based on historical user access data and calculating the abnormal probability of the real-time access, thus failing to effectively avoid the threats brought by network data packets.

[0004] To this end, the present invention proposes an industrial Internet of Things security threat anomaly detection method, equipment and medium. Summary of the invention

[0005] The purpose of the present invention is to propose an industrial Internet of Things security threat anomaly detection method, device and medium to solve the problem that the threats brought by network data packets cannot be effectively avoided in the above-mentioned background technology.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A method for detecting anomaly of security threats in industrial Internet of Things, the method comprising:

[0008] Step S1, collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain quintuple information corresponding to the network data packets;

[0009] Step S2, analyzing the five-tuple information corresponding to the network data packet to obtain the security threat coefficient of the abnormal signal or network data packet;

[0010] Step S3, collecting historical network information of users corresponding to the industrial Internet of Things, as well as real-time network information of the interaction between the industrial Internet and network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things;

[0011] Step S4, calculating the network danger level of the corresponding network data packet through the real-time abnormal operation rate and the security threat coefficient of the network data packet;

[0012] Step S5, setting a corresponding response strategy according to the network risk level of the network data packet.

[0013] Furthermore, the five-tuple information is the source IP address, the source port number, the destination IP address, the destination port number and the transport layer protocol.

[0014] Furthermore, the step S2 includes the following sub-steps:

[0015] Step S21, verifying the five-tuple information in the network data packet and determining the integrity of the network data packet, that is, determining whether the network data packet simultaneously contains the five five-tuple elements corresponding to the source IP address, source port number, destination IP address, destination port number, and transport layer protocol;

[0016] Step S22, if the network data packet contains five quintuple elements at the same time, proceed to the next step;

[0017] If the quintuple in the network packet contains fewer than five elements, an exception signal is generated;

[0018] Step S23, obtaining the destination IP address and destination port number corresponding to the network data packet, and comparing the destination IP address with the local IP address, and comparing the destination port number with the local port number;

[0019] Step S24, if the local IP address is the same as the destination IP address, and the destination port number is the same as the local port number, proceed to the next step;

[0020] If the local IP address is different from the destination IP address or the destination port number is different from the local port number, an exception signal is generated;

[0021] Step S25, obtaining the source IP address corresponding to the network data packet, comparing the source port number of the network data packet with the blacklist IP address pre-stored in the database, and generating an abnormal signal if the source IP address is the same as the blacklist IP address; if the source IP address is different from the blacklist IP address, executing the next step;

[0022] Step S26, obtaining the transport layer protocol corresponding to the network data packet, analyzing the content of the network data packet and comparing it with the threat intelligence library, if it matches the threat intelligence library successfully, the value of the security threat coefficient is increased by one.

[0023] Furthermore, the step S3 includes the following sub-steps:

[0024] Step S301, obtaining historical network information of multiple historical users in the industrial Internet of Things, obtaining the historical IP address, historical connection duration and historical interaction frequency of each historical user, the historical user is numbered n, n=1, 2, ... z, z is a positive integer;

[0025] Step S302: if the historical IP address of the historical user is not unique, extract the number of visits of the historical user corresponding to each historical IP address, and use the IP address with the largest number of visits as the candidate IP address;

[0026] Step S303, obtaining the access rate of the IP address to be selected by dividing the number of accesses of the IP address to be selected by the total number of accesses of all historical IP addresses of the corresponding historical user; comparing the access rate of the IP address to be selected with the access rate threshold, and if the access rate of the IP address to be selected is less than or equal to the access rate threshold, discarding the historical user;

[0027] Step S304: if the access rate is greater than the access rate threshold, the historical user is retained, and a historical access coordinate graph is drawn with the historical connection duration as the horizontal axis and the historical interaction frequency as the vertical axis, and the coordinate points are recorded as historical user coordinates.

[0028] Furthermore, the step S3 also includes the following sub-steps:

[0029] Step S305, adding up the historical connection durations of all historical users and taking the average value to obtain the average historical connection duration, adding up the historical interaction frequencies of all historical users and taking the average historical interaction frequency; recording the coordinate points corresponding to the average historical connection duration and the average historical interaction frequency as the historical access center coordinates;

[0030] Step S306, setting k preset mass points at a first preset distance from the historical access center coordinates, where k and the first preset distance are both constants; calculating the first Manhattan distance MHDkn between each historical user coordinate (YXn, YYn) and the k preset mass points (ZXk, ZYk), the calculation formula is as follows:

[0031] MHDkn=|ZXk-YXn|+|ZYk-YYn|;

[0032] Step S307, dividing the coordinate points corresponding to the n historical users into the kth particle radiation domain corresponding to the k preset particle points according to the Manhattan distance;

[0033] Step S308, for any particle radiation domain, calculate the mean of all historical user coordinates in the particle radiation domain as the updated particle corresponding to the k-th historical user coordinate radiation domain, and then calculate the second Manhattan distance between each historical user coordinate and the k updated particle points again, and divide each historical user coordinate into the corresponding k-th particle radiation domain.

[0034] Furthermore, when calculating the distances from n historical user coordinates to k updated mass points, the calculation process is optimized as follows:

[0035] The historical user coordinates are marked as point A, one updated point is marked as point B, and the other updated point is marked as point C; the distance between AB is marked as a, the distance between AC is marked as b, and the distance between BC is marked as c;

[0036] Using the fact that the sum of two sides of a triangle is greater than the third side, we know that:

[0037] Rule 1: a+b>c, ab<c; therefore b≥max{0,ac};

[0038] Rule 2: If 2×a≤c, then a≤b;

[0039] The above two rules can be used to simplify the calculation process from historical user coordinates to updated mass points.

[0040] Furthermore, the step S3 also includes the following sub-steps:

[0041] Step S309, repeating steps S37-S38 m times, updating the coordinates of the preset mass point to obtain the corresponding determined coordinates, that is, converting the preset mass point into the final mass point, thereby obtaining the k mass point radiation domain corresponding to the k final mass points, and calculating the Euclidean distance OSkn between the final mass point (ZXk, ZYk) and each historical user coordinate (YXn, YYn) in the corresponding mass point radiation domain. The calculation process is as follows:

[0042] OSkn=√((ZXk-YXn) 2 +(ZYk-YYn) 2 );

[0043] Step S310: Assume that the radiation domain of each particle obeys the normal distribution (μ, σ 2 ), where μ=√(ZXk 2 +XYK 2 ), σ=max{OSkn};

[0046] Step S311, obtaining corresponding real-time network information, and obtaining the real-time connection duration and real-time interaction frequency of the corresponding network data packet;

[0047] Substitute the real-time connection duration and real-time interaction frequency of network data packets into the normal distribution (μ, σ 2 ) can calculate the real-time normal operation rate corresponding to the network data packet;

[0048] Subtract the real-time normal operation rate to obtain the corresponding real-time abnormal operation rate.

[0049] Furthermore, the step S4 includes the following sub-steps:

[0050] Step S41, obtaining the real-time abnormal operation rate YCL and security threat coefficient AWX of the network data packet;

[0051] Step S42, calculating the network risk value of the corresponding network data packet by formula:

[0052] WXZ = YCL × AWX;

[0053] Step S43, comparing the network danger value of the network data packet with the network danger threshold, if the network danger value of the network data packet is less than the first network danger threshold, then recording the network danger level of the network data packet as a first-level network danger;

[0054] Step S44, if the network danger value of the network data packet is greater than or equal to the first network danger threshold, and the network danger value of the network data packet is less than the second network danger threshold, the network danger level of the network data packet is recorded as a second-level network danger;

[0055] Step S45, if the network risk value of the network data packet is greater than or equal to the second network risk threshold, the network risk level of the network data packet is recorded as level three network risk;

[0056] Among them, the second network danger threshold is greater than the first network danger threshold, the danger level of network data packets corresponding to the third-level network danger is higher than the danger level of network data packets corresponding to the second-level network danger, and the danger level of network data packets corresponding to the second-level network danger is higher than the danger level of network data packets corresponding to the first-level network danger.

[0057] An electronic device, comprising:

[0058] A memory storing a computer program;

[0059] A processor is communicatively connected to the memory, and when the computer program is executed by the processor, the above method is implemented.

[0060] A computer-readable storage medium stores a computer program, which implements the above method when executed by a processor.

[0061] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0062] 1. The present invention first collects network data packets interacting with the industrial Internet of Things, parses the network data packets to obtain five-tuple information corresponding to the network data packets, and then analyzes the five-tuple information corresponding to the network data packets to obtain the abnormal signal or the security threat coefficient of the network data packets. The present invention performs a preliminary detection on the user situation of accessing the industrial Internet of Things and determines the corresponding risk situation of the user;

[0063] 2. The present invention first collects historical network information of users corresponding to the industrial Internet of Things, and then collects real-time network information of the interaction between the industrial Internet and network data packets. The historical network information is combined with the real-time network information to calculate the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things. The present invention combines the user's historical access situation and real-time access situation to accurately analyze the user's current abnormal operation level;

[0064] 3. The present invention calculates the network danger level of the corresponding network data packet through the real-time abnormal operation rate and security threat coefficient of the network data packet, and sets a corresponding response strategy based on the network danger level of the network data packet. The present invention combines the abnormal situation of user access and the security threat brought by the access to realize intelligent classification of the threats brought by the network data packet, and takes appropriate management and control measures based on the classified threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0066] Figure 1 The present invention is a flow chart of the method.

[0067] Figure 2 This is the historical access coordinate graph of the present invention.

[0068] Figure 3 Schematic diagram of the particle radiation domain corresponding to the preset particle in the present invention.

[0069] Figure 4 Schematic diagram of the updated particles of the present invention.

[0070] Figure 5 Schematic diagram of the particle radiation domain corresponding to the updated particle in the present invention.

[0071] Figure 6 It is a schematic diagram of simplifying the calculation process in the present invention.

[0072] Figure 7 It is a schematic diagram of the structure of the electronic device in the present invention. DETAILED DESCRIPTION

[0073] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0074] Example 1: Please refer to Figure 1-Figure 6As shown, the technical solution provided by the present invention is: a method for detecting anomalies in security threats of industrial Internet of Things, the method is specifically as follows:

[0075] The scenario set in this embodiment is data interaction between network data packets and industrial Internet of Things;

[0076] Step S1, collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain quintuple information corresponding to the network data packets, wherein the quintuple information specifically includes:

[0077] Source IP address refers to the IP address of the computer that sends the network data packet, which is used to identify the source of the network data packet;

[0078] Source port number, which refers to the port number used by the computer that sends the network data packet;

[0079] Destination IP address, which refers to the IP address of the computer that receives the network data packet, is used to determine the destination of the data packet;

[0080] Destination port number refers to the port number used by the computer receiving the data packet;

[0081] Transport layer protocol refers to the protocol used when sending data packets, including TCP (Transmission Control Protocol) or UDP (User Datagram Protocol).

[0082] Step S2, analyzing the five-tuple information corresponding to the network data packet to obtain the security threat coefficient of the abnormal signal or network data packet;

[0083] The step S2 specifically includes the following sub-steps:

[0084] Step S21, verifying whether the network data packet contains complete five-tuple information, judging the integrity of the network data packet, that is, judging whether the network data packet contains five five-tuple elements corresponding to the source IP address, source port number, destination IP address, destination port number and transport layer protocol at the same time;

[0085] Step S22, if the network data packet contains five quintuple elements at the same time, proceed to the next step; if the network data packet contains less than five quintuple elements at the same time, generate an abnormal signal and disconnect the connection with the network data packet;

[0086] Step S23, obtaining the destination IP address and destination port number corresponding to the network data packet, and comparing the destination IP address with the local IP address, and comparing the destination port number with the local port number;

[0087] Among them, the local IP address and local port number are the local server to which the network data packet is transmitted;

[0088] Step S24, if the local IP address is the same as the destination IP address, and the destination port number is the same as the local port number, proceed to the next step; if the local IP address is different from the destination IP address or the destination port number is different from the local port number, generate an abnormal signal and disconnect the network data packet;

[0089] Step S25, obtaining the source IP address corresponding to the network data packet, comparing the source port number of the network data packet with the blacklist IP address pre-stored in the database, if the source IP address is the same as the blacklist IP address, generating an abnormal signal and disconnecting the network data packet; if the source IP address is different from the blacklist IP address, executing the next step;

[0090] Step S26, obtaining the transport layer protocol corresponding to the network data packet, deeply analyzing the content of the network data packet through deep packet inspection technology (DPI), identifying and classifying the specific data or code payload in the network data packet, and then comparing the specific data or code payload of the network data packet with the threat intelligence library. If the match is successful in the threat intelligence library, the value of the security threat coefficient is increased by one, wherein the initial value of the security threat coefficient is one; the threat database is a database specifically used to store and manage relevant information such as network threats, malware, and hacker attack methods;

[0091] Among them, the specific data can be the request header of the network data packet or the signature of the network data packet; the code payload can be the browsing request of the network data packet (such as GET or POST request), the data packet content (such as HTML, CSS, JavaScript, etc.), and the data submitted by the network data packet (such as form data, cookies, etc.).

[0092] Step S3, collecting historical network information of users corresponding to the industrial Internet of Things, as well as real-time network information of the interaction between the industrial Internet and network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things;

[0093] Among them, real-time network information includes the real-time connection duration and real-time interaction frequency between the industrial Internet and network data packets, and historical network information includes the historical IP address, historical connection duration, and historical interaction frequency of each historical user;

[0094] The step S3 further comprises the following sub-steps:

[0095] Step S301, obtaining historical network information of multiple historical users in the industrial Internet of Things, obtaining the historical IP address, historical connection duration and historical interaction frequency of each historical user, the historical user is numbered n, n=1, 2, ... z, z is a positive integer;

[0096] Step S302: if the historical IP address of the historical user is not unique, extract the number of visits of the historical user corresponding to each historical IP address, and use the IP address with the largest number of visits as the candidate IP address;

[0097] Step S303, obtaining the access rate of the IP address to be selected by dividing the number of accesses of the IP address to be selected by the total number of accesses of all historical IP addresses of the corresponding historical user; comparing the access rate of the IP address to be selected with the access rate threshold, and if the access rate of the IP address to be selected is less than or equal to the access rate threshold, discarding the historical user;

[0098] Step S304: if the access rate is greater than the access rate threshold, the historical user is retained, and a historical access coordinate graph is drawn with the historical connection duration as the horizontal coordinate and the historical interaction frequency as the vertical coordinate, and the coordinate point is recorded as the historical user coordinate;

[0099] Step S305, adding up the historical connection durations of all historical users and taking the average value to obtain the average historical connection duration, adding up the historical interaction frequencies of all historical users and taking the average historical interaction frequency; recording the coordinate points corresponding to the average historical connection duration and the average historical interaction frequency as the historical access center coordinates;

[0100] Step S306, setting k preset mass points at a first preset distance from the historical access center coordinates, wherein k and the first preset distance are both constants; Figure 2 As shown, the first Manhattan distance MHDkn between each historical user coordinate (YXn, YYn) and k preset mass points (ZXk, ZYk) is calculated, and the calculation formula is as follows:

[0101] MHDkn=|ZXk-YXn|+|ZYk-YYn|;

[0102] Step S307, Figure 3 As shown, the coordinate points corresponding to n historical users are divided into the kth particle radiation domain corresponding to k preset particles according to the Manhattan distance;

[0103] Step S308, Figure 4-Figure 5 As shown, for any particle radiation domain, the mean value of all historical user coordinates in the particle radiation domain is calculated as the updated particle corresponding to the k-th historical user coordinate radiation domain, and then the second Manhattan distance between each historical user coordinate and the k updated particle points is calculated again, and each historical user coordinate is divided into the corresponding k-th particle radiation domain;

[0104] It should be noted that when calculating the distances from n historical user coordinates to k updated particles, the process can be simplified, such as Figure 6As shown, the historical user coordinates are marked as point A, one updated point is marked as point B, and the other updated point is marked as point C; the distance between AB is marked as a, the distance between AC is marked as b, and the distance between BC is marked as c;

[0105] Using the fact that the sum of two sides of a triangle is greater than the third side, we can know that:

[0106] Rule 1: a+b>c, ab<c; therefore b≥max{0,ac};

[0107] Rule 2: If 2×a≤c, then a≤b;

[0108] The above two rules can simplify the calculation process;

[0109] Step S309, repeating steps S37-S38 m times, updating the coordinates of the preset mass point to obtain the corresponding determined coordinates, that is, converting the preset mass point into the final mass point, thereby obtaining the k mass point radiation domain corresponding to the k final mass points, and calculating the Euclidean distance OSkn between the final mass point (ZXk, ZYk) and each historical user coordinate (YXn, YYn) in the corresponding mass point radiation domain. The calculation process is as follows:

[0110] OSkn=√((ZXk-YXn) 2 +(ZYk-YYn) 2 );

[0111] Step S310: Assume that the radiation domain of each particle obeys the normal distribution (μ, σ 2 ), where μ=√(ZXk 2 +XYK 2 ), σ=max{OSkn};

[0114] Step S311, obtaining corresponding real-time network information, and obtaining the real-time connection duration and real-time interaction frequency of the corresponding network data packet;

[0115] Substitute the real-time connection duration and real-time interaction frequency of network data packets into the normal distribution (μ, σ 2 ) can calculate the real-time normal operation rate corresponding to the network data packet; and the corresponding real-time abnormal operation rate can be obtained by subtracting the real-time normal operation rate from one.

[0116] Step S4, calculating the network danger level of the corresponding network data packet through the real-time abnormal operation rate and the security threat coefficient of the network data packet;

[0117] The step S4 also includes the following sub-steps:

[0118] Step S41, obtaining the real-time abnormal operation rate YCL and security threat coefficient AWX of the network data packet;

[0119] Step S42, calculating the network risk value of the corresponding network data packet by formula:

[0120] WXZ = YCL × AWX;

[0121] Step S43, comparing the network danger value of the network data packet with the network danger threshold, if the network danger value of the network data packet is less than the first network danger threshold, then recording the network danger level of the network data packet as a first-level network danger;

[0122] Step S44, if the network danger value of the network data packet is greater than or equal to the first network danger threshold, and the network danger value of the network data packet is less than the second network danger threshold, the network danger level of the network data packet is recorded as a second-level network danger;

[0123] Step S45, if the network risk value of the network data packet is greater than or equal to the second network risk threshold, the network risk level of the network data packet is recorded as level three network risk;

[0124] Among them, the second network danger threshold is greater than the first network danger threshold, the danger level of network data packets corresponding to the third-level network danger is higher than the danger level of network data packets corresponding to the second-level network danger, and the danger level of network data packets corresponding to the second-level network danger is higher than the danger level of network data packets corresponding to the first-level network danger.

[0125] Step S5, setting a corresponding response strategy according to the network risk level of the network data packet;

[0126] In this embodiment, the coping strategy in step S5 is specifically:

[0127] If it is a level 1 network risk, no action will be taken; if it is a level 2 network risk, the network data packet will be monitored in real time until the connection is terminated; if it is a level 3 network risk, the connection with the network data packet will be directly disconnected;

[0128] In this application, if corresponding calculation formulas appear, the above calculation formulas are all dimensionless and take their numerical calculations. The weight coefficients, proportional coefficients and other coefficients in the formulas are set to a result value obtained by quantifying each parameter. The size of the weight coefficient and the proportional coefficient can be determined as long as it does not affect the proportional relationship between the parameter and the result value.

[0129] Embodiment 2: Figure 7The invention is a structural diagram of an electronic device, which may include: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus. The processor may call the logic instructions in the memory to execute an industrial Internet of Things security threat anomaly detection method, which includes: collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain five-tuple information corresponding to the network data packets; analyzing the five-tuple information corresponding to the network data packets to obtain the security threat coefficient of the abnormal signal or the network data packets; collecting the historical network information of the users corresponding to the industrial Internet of Things, and the real-time network information of the interaction between the industrial Internet and the network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things; calculating the network danger level of the corresponding network data packets through the real-time abnormal operation rate and the security threat coefficient of the network data packets; setting the corresponding response strategy according to the network danger level of the network data packets.

[0130] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0131] Embodiment 3: The present application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute an industrial Internet of Things security threat anomaly detection method provided by the above methods, the method including: collecting network data packets that interact with the industrial Internet of Things, parsing the network data packets to obtain five-tuple information corresponding to the network data packets; analyzing the five-tuple information corresponding to the network data packets to obtain the security threat coefficient of the abnormal signal or the network data packet; collecting historical network information of users corresponding to the industrial Internet of Things, and real-time network information of the interaction between the industrial Internet and the network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things; calculating the network danger level of the corresponding network data packet through the real-time abnormal operation rate and the security threat coefficient of the network data packet; setting corresponding response strategies according to the network danger level of the network data packet.

[0132] Embodiment 4: The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute an industrial Internet of Things security threat anomaly detection method provided above, the method comprising: collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain five-tuple information corresponding to the network data packets; analyzing the five-tuple information corresponding to the network data packets to obtain the security threat coefficient of the abnormal signal or the network data packet; collecting historical network information of users corresponding to the industrial Internet of Things, as well as real-time network information of the interaction between the industrial Internet and the network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things; calculating the network danger level of the corresponding network data packet through the real-time abnormal operation rate and the security threat coefficient of the network data packet; and setting corresponding response strategies according to the network danger level of the network data packet.

[0133] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0134] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting anomaly of security threats in industrial Internet of Things, characterized in that: The method comprises: Step S1, collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain five-tuple information corresponding to the network data packets; Step S2, analyzing the five-tuple information corresponding to the network data packet to obtain the security threat coefficient of the abnormal signal or network data packet; Step S3, collecting historical network information of users corresponding to the industrial Internet of Things, as well as real-time network information of the interaction between the industrial Internet and network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things; Step S4, calculating the network danger level of the corresponding network data packet through the real-time abnormal operation rate and the security threat coefficient of the network data packet; Step S5, setting a corresponding response strategy according to the network risk level of the network data packet.

2. The method for detecting anomaly security threats in industrial Internet of Things according to claim 1 is characterized in that: The five-tuple information is the source IP address, source port number, destination IP address, destination port number and transport layer protocol.

3. The method for detecting anomaly security threats in industrial Internet of Things according to claim 1 is characterized in that: The step S2 includes the following sub-steps: Step S21, verifying the five-tuple information in the network data packet and determining the integrity of the network data packet, that is, determining whether the network data packet simultaneously contains the five five-tuple elements corresponding to the source IP address, source port number, destination IP address, destination port number, and transport layer protocol; Step S22, if the network data packet contains five quintuple elements at the same time, proceed to the next step; If the quintuple in the network packet contains fewer than five elements, an exception signal is generated; Step S23, obtaining the destination IP address and destination port number corresponding to the network data packet, and comparing the destination IP address with the local IP address, and comparing the destination port number with the local port number; Step S24, if the local IP address is the same as the destination IP address, and the destination port number is the same as the local port number, proceed to the next step; If the local IP address is different from the destination IP address or the destination port number is different from the local port number, an exception signal is generated; Step S25, obtaining the source IP address corresponding to the network data packet, comparing the source port number of the network data packet with the blacklist IP address pre-stored in the database, and generating an abnormal signal if the source IP address is the same as the blacklist IP address; if the source IP address is different from the blacklist IP address, executing the next step; Step S26, obtaining the transport layer protocol corresponding to the network data packet, analyzing the content of the network data packet and comparing it with the threat intelligence library, if it matches the threat intelligence library successfully, the value of the security threat coefficient is increased by one.

4. The method for detecting anomaly of security threats in industrial Internet of Things according to claim 1, characterized in that: The step S3 includes the following sub-steps: Step S301, obtaining historical network information of multiple historical users in the industrial Internet of Things, obtaining the historical IP address, historical connection duration and historical interaction frequency of each historical user, the historical user is numbered n, n=1, 2, ... z, z is a positive integer; Step S302: if the historical IP address of the historical user is not unique, extract the number of visits of the historical user corresponding to each historical IP address, and use the IP address with the largest number of visits as the candidate IP address; Step S303, obtaining the access rate of the IP address to be selected by dividing the number of accesses of the IP address to be selected by the total number of accesses of all historical IP addresses of the corresponding historical user; comparing the access rate of the IP address to be selected with the access rate threshold, and if the access rate of the IP address to be selected is less than or equal to the access rate threshold, discarding the historical user; Step S304: if the access rate is greater than the access rate threshold, the historical user is retained, and a historical access coordinate graph is drawn with the historical connection duration as the horizontal axis and the historical interaction frequency as the vertical axis, and the coordinate points are recorded as historical user coordinates.

5. The method for detecting anomaly of security threats in industrial Internet of Things according to claim 4 is characterized in that: The step S3 further comprises the following sub-steps: Step S305, adding up the historical connection durations of all historical users and taking the average value to obtain the average historical connection duration, and adding up the historical interaction frequencies of all historical users and taking the average historical interaction frequency; The coordinate points corresponding to the average historical connection duration and the average historical interaction frequency are recorded as the historical access center coordinates; Step S306, setting k preset mass points at a first preset distance from the historical access center coordinates, where k and the first preset distance are both constants; calculating the first Manhattan distance MHDkn between each historical user coordinate (YXn, YYn) and the k preset mass points (ZXk, ZYk), the calculation formula is as follows: MHDkn=|ZXk-YXn|+|ZYk-YYn|; Step S307, dividing the coordinate points corresponding to the n historical users into the kth particle radiation domain corresponding to the k preset particle points according to the Manhattan distance; Step S308, for any particle radiation domain, calculate the mean of all historical user coordinates in the particle radiation domain as the updated particle corresponding to the k-th historical user coordinate radiation domain, and then calculate the second Manhattan distance between each historical user coordinate and the k updated particle points again, and divide each historical user coordinate into the corresponding k-th particle radiation domain.

6. The method for detecting anomaly of security threats in industrial Internet of Things according to claim 5 is characterized in that: When calculating the distances from n historical user coordinates to k updated mass points, the calculation process is optimized as follows: The historical user coordinates are marked as point A, one updated point is marked as point B, and the other updated point is marked as point C; the distance between AB is marked as a, the distance between AC is marked as b, and the distance between BC is marked as c; Using the fact that the sum of two sides of a triangle is greater than the third side, we know that: Rule 1: a+b>c, ab<c; therefore b≥max{0,ac}; Rule 2: If 2×a≤c, then a≤b; The above two rules can be used to simplify the calculation process from historical user coordinates to updated mass points.

7. The method for detecting anomaly security threats in industrial Internet of Things according to claim 5 is characterized in that: The step S3 further comprises the following sub-steps: Step S309, repeating steps S37-S38 m times, updating the coordinates of the preset mass point to obtain the corresponding determined coordinates, that is, converting the preset mass point into the final mass point, thereby obtaining the k mass point radiation domain corresponding to the k final mass points, and calculating the Euclidean distance OSkn between the final mass point (ZXk, ZYk) and each historical user coordinate (YXn, YYn) in the corresponding mass point radiation domain. The calculation process is as follows: OSkn=√((ZXk-YXn) 2 +(YK-YYN) 2 ): Step S310: Assume that the radiation domain of each particle obeys the normal distribution (μ, σ 2 ), where μ = √2 2 (ZXk+XYK), σ=max{OSkn}; Step S311, obtaining corresponding real-time network information, and obtaining the real-time connection duration and real-time interaction frequency of the corresponding network data packet; Substitute the real-time connection duration and real-time interaction frequency of network data packets into the normal distribution (μ, σ 2 ) can calculate the real-time normal operation rate corresponding to the network data packet; Subtract the real-time normal operation rate to obtain the corresponding real-time abnormal operation rate.

8. The method for detecting anomaly of security threats in industrial Internet of Things according to claim 1, characterized in that: The step S4 includes the following sub-steps: Step S41, obtaining the real-time abnormal operation rate YCL and security threat coefficient AWX of the network data packet; Step S42, calculating the network risk value of the corresponding network data packet by formula: WXZ = YCL × AWX; Step S43, comparing the network danger value of the network data packet with the network danger threshold, if the network danger value of the network data packet is less than the first network danger threshold, then recording the network danger level of the network data packet as a first-level network danger; Step S44, if the network danger value of the network data packet is greater than or equal to the first network danger threshold, and the network danger value of the network data packet is less than the second network danger threshold, the network danger level of the network data packet is recorded as a second-level network danger; Step S45, if the network risk value of the network data packet is greater than or equal to the second network risk threshold, the network risk level of the network data packet is recorded as level three network risk; Among them, the second network danger threshold is greater than the first network danger threshold, the danger level of network data packets corresponding to the third-level network danger is higher than the danger level of network data packets corresponding to the second-level network danger, and the danger level of network data packets corresponding to the second-level network danger is higher than the danger level of network data packets corresponding to the first-level network danger.

9. An electronic device, characterized in that: The electronic device comprises: A memory storing a computer program; A processor is communicatively connected to the memory, and when the computer program is executed by the processor, the method described in any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images