An industrial Internet of Things security threat anomaly detection method, device and medium

Abstract

The present invention discloses a method, device and medium for detecting anomalies in security threats of the industrial Internet of Things, which relates to the field of security detection of the Internet of Things and solves the problem of being unable to effectively avoid threats brought by network data packets. The method comprises collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain five-tuple information corresponding to the network data packets; analyzing the five-tuple information corresponding to the network data packets to obtain an abnormal signal or a security threat coefficient of the network data packets; collecting historical network information of users corresponding to the industrial Internet of Things and real-time network information of the interaction between the industrial Internet and the network data packets, calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things; obtaining the network risk level of the network data packets by calculating the real-time abnormal operation rate and the security threat coefficient of the network data packets; and setting a response strategy according to the network risk level of the network data packets. The present invention realizes the safe avoidance of threats brought by the network data packets.

Description

Technical Field

[0001] The present invention relates to Internet of Things security detection technology, specifically to an industrial Internet of Things security threat anomaly detection method, equipment and medium. Background Art

[0002] With the rapid development of IoT technology, more and more devices and sensors are connected to the internet, forming a vast IoT ecosystem. This connectivity has brought unprecedented convenience and efficiency improvements to the industrial sector, but it also provides attackers with more potential entry points and attack surfaces. Because IoT devices often involve multiple systems, protocols, and interfaces, and devices from different manufacturers may have compatibility and security issues, industrial IoT systems face diverse security threats.

[0003] However, at present, when monitoring security threats in the Industrial Internet of Things, people often rely on known vulnerability libraries for scanning and detection, rather than analyzing real-time access based on historical user access data and calculating the probability of abnormal access in that real-time access. This makes it impossible to effectively avoid threats posed by network data packets.

[0004] To this end, the present invention proposes a method, device and medium for detecting anomaly of security threats in the industrial Internet of Things. Summary of the Invention

[0005] The purpose of the present invention is to propose an industrial Internet of Things security threat anomaly detection method, device and medium to solve the problem raised in the above background technology that the threats brought by network data packets cannot be effectively avoided.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A method for detecting anomaly of security threats in an industrial Internet of Things, the method comprising:

[0008] Step S1: collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain quintuple information corresponding to the network data packets;

[0009] Step S2, analyzing the five-tuple information corresponding to the network data packet to obtain the security threat coefficient of the abnormal signal or network data packet;

[0010] Step S3: Collect historical network information of users corresponding to the Industrial Internet of Things, as well as real-time network information of the interaction between the Industrial Internet and network data packets, and calculate the real-time abnormal operation rate in the real-time network information corresponding to the Industrial Internet of Things;

[0011] Step S4, calculating the network risk level of the corresponding network data packet by using the real-time abnormal operation rate of the network data packet and the security threat coefficient;

[0012] Step S5: setting a corresponding response strategy according to the network risk level of the network data packet.

[0013] Furthermore, the five-tuple information is the source IP address, source port number, destination IP address, destination port number and transport layer protocol.

[0014] Furthermore, step S2 includes the following sub-steps:

[0015] Step S21, verifying the five-tuple information in the network data packet and determining the integrity of the network data packet, that is, determining whether the network data packet contains the five five-tuple elements corresponding to the source IP address, source port number, destination IP address, destination port number, and transport layer protocol;

[0016] Step S22: If the network data packet contains five quintuple elements at the same time, proceed to the next step;

[0017] If the quintuple in the network packet contains fewer than five elements, an exception signal is generated;

[0018] Step S23, obtaining the destination IP address and destination port number corresponding to the network data packet, and comparing the destination IP address with the local IP address, and comparing the destination port number with the local port number;

[0019] Step S24: If the local IP address is the same as the destination IP address, and the destination port number is the same as the local port number, proceed to the next step;

[0020] If the local IP address is different from the destination IP address or the destination port number is different from the local port number, an exception signal is generated;

[0021] Step S25, obtaining the source IP address corresponding to the network data packet, comparing the source port number of the network data packet with the blacklist IP address pre-stored in the database, and generating an abnormal signal if the source IP address is the same as the blacklist IP address; if the source IP address is different from the blacklist IP address, executing the next step;

[0022] Step S26: Obtain the transport layer protocol corresponding to the network data packet, analyze the content of the network data packet and compare it with the threat intelligence library. If it matches the threat intelligence library, the value of the security threat coefficient is increased by one.

[0023] Furthermore, step S3 includes the following sub-steps:

[0024] Step S301: Obtain historical network information of multiple historical users in the industrial Internet of Things, and obtain the historical IP address, historical connection duration, and historical interaction frequency of each historical user. The historical user is numbered as n.

[0025] n=1, 2, ... z, where z is a positive integer;

[0026] Step S302: If the historical IP address of the historical user is not unique, the number of visits of the historical user corresponding to each historical IP address is extracted, and the IP address with the most visits is selected as the candidate IP address;

[0027] Step S303: The access rate of the candidate IP address is obtained by dividing the number of accesses of the candidate IP address by the total number of accesses of all historical IP addresses of the corresponding historical user; the access rate of the candidate IP address is compared with the access rate threshold. If the access rate of the candidate IP address is less than or equal to the access rate threshold, the historical user is discarded;

[0028] Step S304: If the access rate is greater than the access rate threshold, the historical user is retained, and a historical access coordinate graph is drawn with the historical connection duration as the horizontal axis and the historical interaction frequency as the vertical axis, and the coordinate points are recorded as historical user coordinates.

[0029] Furthermore, the step S3 further includes the following sub-steps:

[0030] Step S305: Add up the historical connection durations of all historical users and take the average value to obtain the average historical connection duration; add up the historical interaction frequencies of all historical users and take the average historical interaction frequency; record the coordinate point corresponding to the average historical connection duration and the average historical interaction frequency as the historical access center coordinates;

[0031] Step S306: Set k preset mass points at a first preset distance from the historical access center coordinates, where k and the first preset distance are both constants; calculate the first Manhattan distance MHDkn between each historical user coordinate (YXn, YYn) and the k preset mass points (ZXk, ZYk), using the following calculation formula:

[0032] MHDkn=|ZXk-YXn|+|ZYk-YYn|;

[0033] Step S307: dividing the coordinate points corresponding to the n historical users into the k-th particle radiation domain corresponding to the k preset particle points according to the Manhattan distance;

[0034] Step S308: For any particle radiation domain, calculate the mean of all historical user coordinates in the particle radiation domain as the updated particle corresponding to the k-th historical user coordinate radiation domain, and then calculate the second Manhattan distance between each historical user coordinate and the k updated particle points again, and divide each historical user coordinate into the corresponding k-th particle radiation domain.

[0035] Furthermore, when calculating the distance from n historical user coordinates to k updated mass points, the calculation process is optimized as follows:

[0036] The historical user coordinates are marked as point A, one updated point is marked as point B, and the other updated point is marked as point C; the distance between AB is marked as a, the distance between AC is marked as b, and the distance between BC is marked as c;

[0037] Using the fact that the sum of two sides of a triangle is greater than the third side, we know that:

[0038] Rule 1: a+b>c, ab<c; therefore b≥max{0,ac};

[0039] Rule 2: If 2×a≤c, then a≤b;

[0040] The above two rules can be used to simplify the calculation process from historical user coordinates to updated mass points.

[0041] Furthermore, the step S3 further includes the following sub-steps:

[0042] Step S309: Repeat steps S37 and S38 m times, update the coordinates of the preset mass point to obtain the corresponding determined coordinates, that is, convert the preset mass point into the final mass point, thereby obtaining the k-mass point radiation domain corresponding to the k final mass points, and calculate the Euclidean distance OSkn between the final mass point (ZXk, ZYk) and each historical user coordinate (YXn, YYn) in the corresponding mass point radiation domain. The calculation process is as follows:

[0043]

[0044] Step S310: Assume that the radiation domain of each particle obeys the normal distribution (μ, σ 2 ),in σ=max{OSkn};

[0045] Step S311, obtaining corresponding real-time network information, and obtaining the real-time connection duration and real-time interaction frequency of the corresponding network data packet;

[0046] Substitute the real-time connection duration and real-time interaction frequency of network data packets into the normal distribution (μ, σ 2 ) can calculate the real-time normal operation rate corresponding to the network data packet;

[0047] Subtract the real-time normal operation rate to obtain the corresponding real-time abnormal operation rate.

[0048] Furthermore, step S4 includes the following sub-steps:

[0049] Step S41, obtaining the real-time abnormal operation rate YCL and security threat coefficient AWX of the network data packet;

[0050] Step S42: Calculate the network risk value of the corresponding network data packet using the formula:

[0051] WXZ=YCL×AWX;

[0052] Step S43, comparing the network risk value of the network data packet with the network risk threshold value, if the network risk value of the network data packet is less than the first network risk threshold value, then recording the network risk level of the network data packet as level one network risk;

[0053] Step S44: If the network risk value of the network data packet is greater than or equal to the first network risk threshold, and the network risk value of the network data packet is less than the second network risk threshold, the network risk level of the network data packet is recorded as a level 2 network risk;

[0054] Step S45: If the network risk value of the network data packet is greater than or equal to the second network risk threshold, the network risk level of the network data packet is recorded as level three network risk;

[0055] Among them, the second network danger threshold is greater than the first network danger threshold, the danger level of the network data packets corresponding to the third-level network danger is higher than the danger level of the network data packets corresponding to the second-level network danger, and the danger level of the network data packets corresponding to the second-level network danger is higher than the danger level of the network data packets corresponding to the first-level network danger.

[0056] An electronic device, comprising:

[0057] a memory storing a computer program;

[0058] A processor is communicatively connected to the memory, and when the computer program is executed by the processor, the above method is implemented.

[0059] A computer-readable storage medium stores a computer program, which implements the above method when executed by a processor.

[0060] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0061] 1. The present invention first collects network data packets interacting with the Industrial Internet of Things, parses the network data packets to obtain quintuple information corresponding to the network data packets, and then analyzes the quintuple information corresponding to the network data packets to obtain abnormal signals or security threat coefficients of the network data packets. The present invention conducts preliminary detection of users accessing the Industrial Internet of Things and determines the corresponding risk status of the users;

[0062] 2. The present invention first collects historical network information of users corresponding to the Industrial Internet of Things, and then collects real-time network information of the interaction between the Industrial Internet and network data packets. The historical network information is combined with the real-time network information to calculate the real-time abnormal operation rate in the real-time network information corresponding to the Industrial Internet of Things. The present invention combines the user's historical access status and real-time access status to accurately analyze the user's current abnormal operation level;

[0063] 3. The present invention calculates the network danger level of the corresponding network data packet through the real-time abnormal operation rate and security threat coefficient of the network data packet, and sets a corresponding response strategy based on the network danger level of the network data packet. The present invention combines the abnormal conditions of user access and the security threats brought by the access to realize intelligent grading of the threats brought by the network data packet, and takes appropriate management and control measures based on the threats after grading. BRIEF DESCRIPTION OF THE DRAWINGS

[0064] To facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0065] Figure 1 Flow chart of the method of the present invention.

[0066] Figure 2 This is the historical access coordinate graph of the present invention.

[0067] Figure 3 Schematic diagram of the particle radiation domain corresponding to the preset particle in the present invention.

[0068] Figure 4 Schematic diagram of the updated mass point of the present invention.

[0069] Figure 5 Schematic diagram of the particle radiation domain corresponding to the updated particle in the present invention.

[0070] Figure 6 It is a schematic diagram of simplifying the calculation process in the present invention.

[0071] Figure 7 It is a structural schematic diagram of the electronic device in the present invention. DETAILED DESCRIPTION

[0072] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0073] Example 1: Please refer to Figures 1-6As shown, the technical solution provided by the present invention is: a method for detecting anomalies in security threats of industrial Internet of Things, the method is as follows:

[0074] The scenario set in this embodiment is data interaction between network data packets and the Industrial Internet of Things;

[0075] Step S1: collect network data packets interacting with the industrial Internet of Things, parse the network data packets to obtain quintuple information corresponding to the network data packets, wherein the quintuple information specifically includes:

[0076] Source IP address refers to the IP address of the computer that sends the network data packet, which is used to identify the source of the network data packet;

[0077] Source port number, which refers to the port number used by the computer that sends the network data packet;

[0078] Destination IP address, which refers to the IP address of the computer that receives the network data packet and is used to determine the destination of the data packet;

[0079] Destination port number, which refers to the port number used by the computer receiving the data packet;

[0080] Transport layer protocol refers to the protocol used when sending data packets, including TCP (Transmission Control Protocol) or UDP (User Datagram Protocol).

[0081] Step S2, analyzing the five-tuple information corresponding to the network data packet to obtain the security threat coefficient of the abnormal signal or network data packet;

[0082] The step S2 specifically includes the following sub-steps:

[0083] Step S21, verifying whether the network data packet contains complete five-tuple information, judging the integrity of the network data packet, that is, judging whether the network data packet contains the five five-tuple elements corresponding to the source IP address, source port number, destination IP address, destination port number and transport layer protocol at the same time;

[0084] Step S22: If the network data packet contains five quintuple elements at the same time, proceed to the next step; if the network data packet contains fewer than five quintuple elements at the same time, generate an abnormal signal and disconnect the network data packet;

[0085] Step S23, obtaining the destination IP address and destination port number corresponding to the network data packet, and comparing the destination IP address with the local IP address, and comparing the destination port number with the local port number;

[0086] Among them, the local IP address and local port number are the local server to which the network data packet is transmitted;

[0087] Step S24: If the local IP address is the same as the destination IP address, and the destination port number is the same as the local port number, proceed to the next step; if the local IP address is different from the destination IP address or the destination port number is different from the local port number, generate an abnormal signal and terminate the connection with the network data packet;

[0088] Step S25, obtaining the source IP address corresponding to the network data packet, comparing the source port number of the network data packet with the blacklist IP address pre-stored in the database, and if the source IP address is the same as the blacklist IP address, generating an abnormal signal and disconnecting the network data packet; if the source IP address is different from the blacklist IP address, executing the next step;

[0089] Step S26: Obtain the transport layer protocol corresponding to the network data packet, conduct in-depth analysis of the network data packet content through deep packet inspection (DPI) technology, identify and classify specific data or code payloads in the network data packet, and then compare the specific data or code payloads of the network data packet with the threat intelligence database. If a match is found in the threat intelligence database, the security threat coefficient is increased by one, where the initial value of the security threat coefficient is one. The threat database is a database specifically used to store and manage information related to network threats, malware, and hacker attack methods.

[0090] Among them, the specific data can be the request header of the network data packet or the signature of the network data packet; the code payload can be the browsing request of the network data packet (such as GET or POST request), the data packet content (such as HTML, CSS, JavaScript, etc.), and the data submitted by the network data packet (such as form data, cookies, etc.).

[0091] Step S3: Collect historical network information of users corresponding to the Industrial Internet of Things, as well as real-time network information of the interaction between the Industrial Internet and network data packets, and calculate the real-time abnormal operation rate in the real-time network information corresponding to the Industrial Internet of Things;

[0092] Among them, real-time network information includes the real-time connection duration and real-time interaction frequency between the Industrial Internet and network data packets, and historical network information specifically includes the historical IP address, historical connection duration, and historical interaction frequency of each historical user;

[0093] The step S3 further includes the following sub-steps:

[0094] Step S301: Obtain historical network information of multiple historical users in the industrial Internet of Things, and obtain the historical IP address, historical connection duration, and historical interaction frequency of each historical user. The historical user is numbered as n.

[0095] n=1, 2, ... z, where z is a positive integer;

[0096] Step S302: If the historical IP address of the historical user is not unique, the number of visits of the historical user corresponding to each historical IP address is extracted, and the IP address with the most visits is selected as the candidate IP address;

[0097] Step S303: The access rate of the candidate IP address is obtained by dividing the number of accesses of the candidate IP address by the total number of accesses of all historical IP addresses of the corresponding historical user; the access rate of the candidate IP address is compared with the access rate threshold. If the access rate of the candidate IP address is less than or equal to the access rate threshold, the historical user is discarded;

[0098] Step S304: If the access rate is greater than the access rate threshold, the historical user is retained, and a historical access coordinate graph is plotted with the historical connection duration as the horizontal axis and the historical interaction frequency as the vertical axis. The coordinate points are recorded as historical user coordinates.

[0099] Step S305: Add up the historical connection durations of all historical users and take the average value to obtain the average historical connection duration; add up the historical interaction frequencies of all historical users and take the average historical interaction frequency; record the coordinate point corresponding to the average historical connection duration and the average historical interaction frequency as the historical access center coordinates;

[0100] Step S306: Set k preset mass points at a first preset distance from the historical access center coordinates, where k and the first preset distance are both constants; Figure 2 As shown, the first Manhattan distance MHDkn between each historical user coordinate (YXn, YYn) and k preset mass points (ZXk, ZYk) is calculated. The calculation formula is as follows:

[0101] MHDkn=|ZXk-YXn|+|ZYk-YYn|;

[0102] Step S307, as Figure 3 As shown, the coordinate points corresponding to n historical users are divided into the k-th particle radiation domain corresponding to k preset particles according to the Manhattan distance;

[0103] Step S308, as Figure 4-Figure 5 As shown, for any particle radiation domain, the mean value of all historical user coordinates in the particle radiation domain is calculated as the updated particle corresponding to the k-th historical user coordinate radiation domain, and then the second Manhattan distance between each historical user coordinate and the k updated particle points is calculated again, and each historical user coordinate is divided into the corresponding k-th particle radiation domain;

[0104] It should be noted that when calculating the distance from n historical user coordinates to k updated particles, the process can be simplified, such as Figure 6As shown, the historical user coordinates are marked as point A, one updated mass point is marked as point B, and the other updated mass point is marked as point C; the distance between AB is marked as a, the distance between AC is marked as b, and the distance between BC is marked as c;

[0105] Using the fact that the sum of two sides of a triangle is greater than the third side, we can know that:

[0106] Rule 1: a+b>c, ab<c; therefore b≥max{0,ac};

[0107] Rule 2: If 2×a≤c, then a≤b;

[0108] The above two rules can simplify the calculation process;

[0109] Step S309: Repeat steps S37 and S38 m times, update the coordinates of the preset mass point to obtain the corresponding determined coordinates, that is, convert the preset mass point into the final mass point, thereby obtaining the k-mass point radiation domain corresponding to the k final mass points, and calculate the Euclidean distance OSkn between the final mass point (ZXk, ZYk) and each historical user coordinate (YXn, YYn) in the corresponding mass point radiation domain. The calculation process is as follows:

[0110]

[0111] Step S310: Assume that the radiation domain of each particle obeys the normal distribution (μ, σ 2 ),in σ=max{OSkn};

[0112] Step S311, obtaining corresponding real-time network information, and obtaining the real-time connection duration and real-time interaction frequency of the corresponding network data packet;

[0113] Substitute the real-time connection duration and real-time interaction frequency of network data packets into the normal distribution (μ, σ 2 ) can calculate the real-time normal operation rate corresponding to the network data packet; and the corresponding real-time abnormal operation rate can be obtained by subtracting the real-time normal operation rate from one.

[0114] Step S4, calculating the network risk level of the corresponding network data packet by using the real-time abnormal operation rate of the network data packet and the security threat coefficient;

[0115] The step S4 further includes the following sub-steps:

[0116] Step S41, obtaining the real-time abnormal operation rate YCL and security threat coefficient AWX of the network data packet;

[0117] Step S42: Calculate the network risk value of the corresponding network data packet using the formula:

[0118] WXZ=YCL×AWX;

[0119] Step S43, comparing the network risk value of the network data packet with the network risk threshold value, if the network risk value of the network data packet is less than the first network risk threshold value, then recording the network risk level of the network data packet as level one network risk;

[0120] Step S44: If the network risk value of the network data packet is greater than or equal to the first network risk threshold, and the network risk value of the network data packet is less than the second network risk threshold, the network risk level of the network data packet is recorded as a level 2 network risk;

[0121] Step S45: If the network risk value of the network data packet is greater than or equal to the second network risk threshold, the network risk level of the network data packet is recorded as level three network risk;

[0122] Among them, the second network danger threshold is greater than the first network danger threshold, the danger level of the network data packets corresponding to the third-level network danger is higher than the danger level of the network data packets corresponding to the second-level network danger, and the danger level of the network data packets corresponding to the second-level network danger is higher than the danger level of the network data packets corresponding to the first-level network danger.

[0123] Step S5, setting a corresponding response strategy according to the network risk level of the network data packet;

[0124] In this embodiment, the response strategy in step S5 is specifically:

[0125] If it is a level one network risk, no action will be taken; if it is a level two network risk, the network data packet will be monitored in real time until the connection is terminated; if it is a level three network risk, the connection to the network data packet will be directly disconnected;

[0126] In this application, if a corresponding calculation formula appears, the above calculation formula is dimensionless and its numerical calculation is performed. The weight coefficient, proportional coefficient and other coefficients in the formula are set to a result value obtained by quantifying each parameter. Regarding the size of the weight coefficient and the proportional coefficient, as long as it does not affect the proportional relationship between the parameter and the result value, it is acceptable.

[0127] Example 2: Figure 7The present invention is a structural diagram of an electronic device, which may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus. The processor may call the logic instructions in the memory to execute an industrial Internet of Things security threat anomaly detection method, which includes: collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain five-tuple information corresponding to the network data packets; analyzing the five-tuple information corresponding to the network data packets to obtain an abnormal signal or a security threat coefficient of the network data packets; collecting historical network information of users corresponding to the industrial Internet of Things, as well as real-time network information of the interaction between the industrial Internet and the network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things; calculating the network risk level of the corresponding network data packets through the real-time abnormal operation rate and the security threat coefficient of the network data packets; and setting a corresponding response strategy based on the network risk level of the network data packets.

[0128] In addition, the logical instructions in the above-mentioned memory can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0129] Example 3: The present application also provides a computer program product, which includes a computer program stored on a computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute an industrial Internet of Things security threat anomaly detection method provided by the above methods, the method including: collecting network data packets that interact with the industrial Internet of Things, parsing the network data packets to obtain five-tuple information corresponding to the network data packets; analyzing the five-tuple information corresponding to the network data packets to obtain abnormal signals or security threat coefficients of network data packets; collecting historical network information of users corresponding to the industrial Internet of Things, and real-time network information of the interaction between the industrial Internet and the network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things; obtaining the network risk level of the corresponding network data packet through the real-time abnormal operation rate and security threat coefficient of the network data packet; setting corresponding response strategies according to the network risk level of the network data packet.

[0130] Example 4: The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute an industrial Internet of Things security threat anomaly detection method provided above, the method comprising: collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain five-tuple information corresponding to the network data packets; analyzing the five-tuple information corresponding to the network data packets to obtain abnormal signals or security threat coefficients of the network data packets; collecting historical network information of users corresponding to the industrial Internet of Things, as well as real-time network information of the interaction between the industrial Internet and the network data packets, and calculating the real-time abnormal operation rate in the real-time network information corresponding to the industrial Internet of Things; obtaining the network risk level of the corresponding network data packet through the real-time abnormal operation rate and security threat coefficient of the network data packet; and setting corresponding response strategies based on the network risk level of the network data packet.

[0131] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0132] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting anomaly of security threats in industrial Internet of Things, characterized in that: The method comprises: Step S1: collecting network data packets interacting with the industrial Internet of Things, parsing the network data packets to obtain quintuple information corresponding to the network data packets; Step S2, analyzing the five-tuple information corresponding to the network data packet to obtain the security threat coefficient of the abnormal signal or network data packet; Step S3: Collect historical network information of users corresponding to the Industrial Internet of Things, as well as real-time network information of the interaction between the Industrial Internet and network data packets, and calculate the real-time abnormal operation rate in the real-time network information corresponding to the Industrial Internet of Things; The step S3 includes the following sub-steps: Step S301: Obtain historical network information of multiple historical users in the industrial Internet of Things, and obtain the historical IP address, historical connection duration, and historical interaction frequency of each historical user. The historical user is numbered as n. n=1, 2, ... z, where z is a positive integer; Step S302: If the historical IP address of the historical user is not unique, the number of visits of the historical user corresponding to each historical IP address is extracted, and the IP address with the most visits is selected as the candidate IP address; Step S303: The access rate of the candidate IP address is obtained by dividing the number of accesses of the candidate IP address by the total number of accesses of all historical IP addresses of the corresponding historical user; the access rate of the candidate IP address is compared with the access rate threshold. If the access rate of the candidate IP address is less than or equal to the access rate threshold, the historical user is discarded; Step S304: If the access rate is greater than the access rate threshold, the historical user is retained, and a historical access coordinate graph is plotted with the historical connection duration as the horizontal axis and the historical interaction frequency as the vertical axis. The coordinate points are recorded as historical user coordinates. Step S305: Add up the historical connection durations of all historical users and take the average value to obtain the average historical connection duration; add up the historical interaction frequencies of all historical users and take the average historical interaction frequency; record the coordinate point corresponding to the average historical connection duration and the average historical interaction frequency as the historical access center coordinates; Step S306: Set k preset mass points at a first preset distance from the historical access center coordinates, where k and the first preset distance are both constants; calculate the first Manhattan distance MHDkn between each historical user coordinate (YXn, YYn) and the k preset mass points (ZXk, ZYk), using the following calculation formula: MHDkn=|ZXk-YXn|+|ZYk-YYn|; Step S307: dividing the coordinate points corresponding to the n historical users into the k-th particle radiation domain corresponding to the k preset particle points according to the Manhattan distance; Step S308: For any particle radiation domain, calculate the mean of all historical user coordinates within the particle radiation domain as the updated particle corresponding to the k-th historical user coordinate radiation domain, then calculate the second Manhattan distance between each historical user coordinate and the k updated particle points again, and divide each historical user coordinate into the corresponding k-th particle radiation domain; Step S309: Repeat steps S37 and S38 m times, update the coordinates of the preset mass point to obtain the corresponding determined coordinates, that is, convert the preset mass point into the final mass point, thereby obtaining the k-mass point radiation domain corresponding to the k final mass points, and calculate the Euclidean distance OSkn between the final mass point (ZXk, ZYk) and each historical user coordinate (YXn, YYn) in the corresponding mass point radiation domain. The calculation process is as follows: Step S310: Assume that the radiation domain of each particle obeys the normal distribution (μ, σ 2 ),in σ=max{OSkn}; Step S311, obtaining corresponding real-time network information, and obtaining the real-time connection duration and real-time interaction frequency of the corresponding network data packet; Substitute the real-time connection duration and real-time interaction frequency of network data packets into the normal distribution (μ, σ 2 ) can calculate the real-time normal operation rate corresponding to the network data packet; Subtract the real-time normal operation rate to obtain the corresponding real-time abnormal operation rate; Step S4, calculating the network risk level of the corresponding network data packet by using the real-time abnormal operation rate of the network data packet and the security threat coefficient; Step S5: setting a corresponding response strategy according to the network risk level of the network data packet.

2. The method for detecting anomaly of security threats in industrial Internet of Things according to claim 1, characterized in that: The five-tuple information is the source IP address, source port number, destination IP address, destination port number and transport layer protocol.

3. The method for detecting anomaly of security threats in industrial Internet of Things according to claim 1, characterized in that: The step S2 includes the following sub-steps: Step S21, verifying the five-tuple information in the network data packet and determining the integrity of the network data packet, that is, determining whether the network data packet contains the five five-tuple elements corresponding to the source IP address, source port number, destination IP address, destination port number, and transport layer protocol; Step S22: If the network data packet contains five quintuple elements at the same time, proceed to the next step; If the quintuple in the network packet contains fewer than five elements, an exception signal is generated; Step S23, obtaining the destination IP address and destination port number corresponding to the network data packet, and comparing the destination IP address with the local IP address, and comparing the destination port number with the local port number; Step S24: If the local IP address is the same as the destination IP address, and the destination port number is the same as the local port number, proceed to the next step; If the local IP address is different from the destination IP address or the destination port number is different from the local port number, an exception signal is generated; Step S25, obtaining the source IP address corresponding to the network data packet, comparing the source port number of the network data packet with the blacklist IP address pre-stored in the database, and generating an abnormal signal if the source IP address is the same as the blacklist IP address; if the source IP address is different from the blacklist IP address, executing the next step; Step S26: Obtain the transport layer protocol corresponding to the network data packet, analyze the content of the network data packet and compare it with the threat intelligence library. If it matches the threat intelligence library, the value of the security threat coefficient is increased by one.

4. The method for detecting anomaly of security threats in industrial Internet of Things according to claim 1, characterized in that: When calculating the distance from n historical user coordinates to k updated mass points, the calculation process is optimized as follows: The historical user coordinates are marked as point A, one updated point is marked as point B, and the other updated point is marked as point C; the distance between AB is marked as a, the distance between AC is marked as b, and the distance between BC is marked as c; Using the fact that the sum of two sides of a triangle is greater than the third side, we know that: Rule 1: a+b>c, ab<c; therefore b≥max{0,ac}; Rule 2: If 2×a≤c, then a≤b; The above two rules can be used to simplify the calculation process from historical user coordinates to updated mass points.

5. The method for detecting anomaly of security threats in industrial Internet of Things according to claim 1, characterized in that: The step S4 includes the following sub-steps: Step S41, obtaining the real-time abnormal operation rate YCL and security threat coefficient AWX of the network data packet; Step S42: Calculate the network risk value of the corresponding network data packet using the formula: WXZ=YCL×AWX; Step S43, comparing the network risk value of the network data packet with the network risk threshold value, if the network risk value of the network data packet is less than the first network risk threshold value, then recording the network risk level of the network data packet as level one network risk; Step S44: If the network risk value of the network data packet is greater than or equal to the first network risk threshold, and the network risk value of the network data packet is less than the second network risk threshold, the network risk level of the network data packet is recorded as a level 2 network risk; Step S45: If the network risk value of the network data packet is greater than or equal to the second network risk threshold, the network risk level of the network data packet is recorded as level three network risk; Among them, the second network danger threshold is greater than the first network danger threshold, the danger level of the network data packets corresponding to the third-level network danger is higher than the danger level of the network data packets corresponding to the second-level network danger, and the danger level of the network data packets corresponding to the second-level network danger is higher than the danger level of the network data packets corresponding to the first-level network danger.

6. An electronic device, characterized in that: The electronic device comprises: a memory storing a computer program; A processor is communicatively connected to the memory, and when the computer program is executed by the processor, the method according to any one of claims 1 to 5 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images