Network security monitoring data processing method of Internet of Things server

Abstract

The invention discloses a network security monitoring data processing method for an internet of things server, which comprises the following steps of: calculating a dynamic characteristic empirical threshold by combining the load rate stability and the access intensity volatility of the server, and adaptively adjusting the empirical threshold by monitoring the disturbance characteristic of a network flow data point in real time, so as to realize the network security monitoring of the internet of things server. According to the method provided by the invention, the network security monitoring precision of the Internet of Things server under the conditions of large flow and high load can be effectively improved, the false alarm rate is reduced, and the robustness and accuracy of a monitoring system are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a network security monitoring data processing method for an Internet of Things server. Background Art

[0002] While connecting a large number of devices and sensors, IoT servers have also become a key target of cyber attacks, and network security is crucial to them. First, IoT devices are of various types and widely distributed, making security protection difficult. Once a server is hacked, it may lead to large-scale data leakage, or even cause physical devices to lose control, resulting in serious consequences. Second, IoT servers carry a large amount of sensitive data, such as personal information and production data. Once these data are tampered with or stolen, they will affect user privacy and corporate operational security. In addition, IoT servers are usually part of critical infrastructure, such as energy, transportation and other fields. Once they are attacked by cyber attacks, they may have a significant impact on society. With the popularization of the Internet of Things, the means of attack are becoming increasingly complex, and traditional security measures are difficult to cope with. Therefore, it is necessary to ensure the security of IoT servers through multi-level security protection measures, such as encrypted communication, access control, and anomaly detection. In addition, servers should also have real-time monitoring and emergency response capabilities to quickly respond to potential threats. Network security is no longer a single technical issue, but a systemic challenge that concerns the overall security of users, enterprises and society. Strengthening the network security of IoT servers has become a core task to ensure the stable operation of IoT systems.

[0003] Network security monitoring of IoT servers plays an important role in protecting the system from potential threats, but in practical applications, it often faces the problem of false alarms. These false alarms usually come from complex monitoring rules, algorithm misjudgments, or abnormal data fluctuations, rather than real security threats. Due to the wide variety of IoT devices and complex environments, the monitoring system can easily mistake normal network activities for abnormalities and trigger unnecessary alarms. This not only increases the complexity of system management, but also leads to a large waste of manpower, material resources and time, thus greatly reducing the efficiency of the monitoring system. In addition, frequent false alarms can easily lead to the "wolf cry" effect, making operation and maintenance personnel slow to react when real threats come. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In view of the above existing problems, the present invention is proposed. Therefore, the present invention provides a network security monitoring data processing method of an Internet of Things server to solve the problems raised in the background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a network security monitoring data processing method of an Internet of Things server, comprising:

[0007] Obtain network security monitoring data of the Internet of Things server, wherein the network security monitoring data includes a server load rate monitoring value, a server access intensity monitoring value, and a server network traffic monitoring value sampled in a time series;

[0008] According to the fluctuation of the server load rate monitoring value and the server access intensity monitoring value, the dynamic characteristics of the network security monitoring data are obtained, and according to the fluctuation of the server network traffic monitoring value and the dynamic characteristics, the disturbance characteristics of the network security monitoring data are obtained;

[0009] A network security monitoring curve is obtained from the network security monitoring data, and a plurality of isolated variables are obtained by sampling and analyzing the network security monitoring curve. A sampling reference deviation value of each isolated variable is obtained according to the distribution difference of different data points in each isolated variable, and the disturbance characteristic reliability of the network security monitoring data is obtained by using the sampling reference deviation value and the frequency characteristics of the data value of the network security monitoring data point in the network security monitoring curve;

[0010] The necessity of processing the network security monitoring data is obtained through the disturbance feature reliability and disturbance feature. If the processing necessity is greater than the set empirical threshold, the network security monitoring data is screened to obtain the network security monitoring data after the disturbance is removed. Otherwise, the network security monitoring data is abnormal and manual intervention is performed.

[0011] As a preferred solution of the network security monitoring data processing method of the Internet of Things server described in the present invention, wherein: the dynamic characteristics of the network security monitoring data are obtained according to the fluctuation of the server load rate monitoring value and the server access intensity monitoring value, including:

[0012] Obtain a server load monitoring curve and a server access intensity curve according to server load rate monitoring values ​​and server access intensity monitoring values ​​sampled at different time series in network security monitoring data;

[0013] According to the server load monitoring curve and the server access intensity curve, obtain the stability of server load rate changes and the volatility of server access intensity of network security monitoring data;

[0014] The product of the inverse of the stability of the server load rate change of the network security monitoring data and the volatility of the server access intensity of the network security monitoring data is taken as the dynamic feature of the network security monitoring data.

[0015] As a preferred solution of the network security monitoring data processing method of the Internet of Things server of the present invention, wherein: the server load rate change stability and server access intensity volatility of the network security monitoring data obtained include:

[0016] The server load rate F1 is preset as a threshold value. For N random server load rate data points in the server load rate monitoring curve, the ratio of the server load rate monitoring value of the server load rate data point to the threshold server load rate is recorded as the N ratios of the server load rate data point. The average of the N ratios of all server load rate data points in the server load rate monitoring curve is taken as the stability of the server load rate change of the network security monitoring data.

[0017] Select a random pulse data point in the server access strength curve, divide the absolute value of the difference between the server access strength monitoring value of the pulse data point and the server access strength monitoring value of the next pulse data point by the absolute value of the time difference between the server access strength monitoring value of the pulse data point and the next pulse data point, and record it as the i-th difference absolute value of the pulse data point. Take the recursive average of the i-th difference absolute values ​​of all pulse data points in the server access strength curve as the server access strength volatility of the network security monitoring data.

[0018] As a preferred solution of the network security monitoring data processing method of the Internet of Things server described in the present invention, wherein: according to the dynamic characteristics and the fluctuation of the server network traffic monitoring value, the disturbance characteristics of the network security monitoring data are obtained, including:

[0019] With time series sampling as the horizontal axis and server network traffic monitoring value as the vertical axis, network security monitoring data is input into the horizontal and vertical coordinate system to obtain a number of network traffic data points, and all network traffic data points are fitted into a network traffic monitoring curve by the minimum ridge regression method;

[0020] The logarithmic loss of the network traffic monitoring curve and the server access intensity curve is recorded as the first logarithmic loss, and the product of the first logarithmic loss and the dynamic characteristics of the network security monitoring data is used as the disturbance feature of the network security monitoring data.

[0021] As a preferred solution of the network security monitoring data processing method of the Internet of Things server of the present invention, wherein: according to the distribution difference of different data points in each isolated variable, the sampling reference deviation value of each isolated variable is obtained, including:

[0022] A segmentation parameter k is preset, and for a random isolated variable, the isolated variable is evenly divided into k sub-regions;

[0023] For a random isolated variable, the reciprocal of the absolute value of the difference between the concentration value of the isolated variable and the concentration value of the zero-normal distribution is recorded as the first reciprocal;

[0024] For a random data point in a random sub-region of the isolated variable, the difference between the characteristic deviation coefficient of the data point and 1 is recorded as the second difference of the data point;

[0025] Recording the absolute value of the mean of the second differences of all data points in the sub-region as the smooth distribution of the sub-region;

[0026] The product of the mean of the smooth distribution of all sub-regions of the isolated variable and the first inverse is used as the sampling reference deviation value of the isolated variable.

[0027] As a preferred solution of the network security monitoring data processing method of the Internet of Things server of the present invention, wherein: using the sampling reference deviation value and the frequency characteristics of the data value of the network security monitoring data point in the network security monitoring curve to obtain the disturbance characteristic reliability of the network security monitoring data, it includes:

[0028] Obtaining the periodicity of network security monitoring data according to the frequency characteristics of the data values ​​of the network security monitoring data points in the network security monitoring curve;

[0029] The mean of the sampling benchmark deviation values ​​of all isolated variables of the network security monitoring curve is recorded as the second mean;

[0030] The product of the second mean and the periodicity of the network security monitoring data is used as the disturbance feature reliability of the network security monitoring data.

[0031] As a preferred solution of the network security monitoring data processing method of the Internet of Things server of the present invention, wherein: the periodicity of obtaining network security monitoring data includes:

[0032] Classify all network security monitoring data points in the network security monitoring curve according to data values ​​to obtain several data value categories;

[0033] Combine two random data value categories to obtain several combinations;

[0034] For each random combination, the difference in the number of network security monitoring data points between the first data value type and the second data value type in the combination is recorded as the distribution probability difference of the combination;

[0035] The mean of the distribution probability differences of all combinations is taken as the periodicity of network security monitoring data.

[0036] As a preferred solution of the network security monitoring data processing method of the Internet of Things server of the present invention, wherein: the necessity of processing the network security monitoring data is obtained through the disturbance feature reliability and disturbance feature, including:

[0037] The second-order norm between the disturbance characteristics and disturbance reliability of network security monitoring data is regarded as a necessity for processing network security monitoring data.

[0038] As a preferred solution of the network security monitoring data processing method of the Internet of Things server of the present invention, the empirical threshold includes:

[0039] The empirical threshold of dynamic characteristics is obtained based on the stability of server load rate and the volatility of access intensity.

[0040] As a preferred solution of the network security monitoring data processing method of the Internet of Things server of the present invention, it also includes:

[0041] By monitoring the disturbance characteristics of server network traffic data points, the empirical threshold is adaptively adjusted.

[0042] Compared with the prior art, the invention has the following beneficial effects:

[0043] 1. The present invention introduces random sampling and recursive averaging algorithms, so that the present invention can effectively capture the volatility characteristics of server load rate and access intensity, reduce the false alarm phenomenon caused by abnormal data fluctuations in traditional methods, greatly improve the accuracy of network security monitoring systems, and reduce the waste of system resources;

[0044] 2. Performing logarithmic loss analysis on the network traffic monitoring curve and the server access intensity curve successfully solved the processing bottleneck problem that is prone to occur in traditional methods when facing large-scale traffic fluctuations, effectively improving the system's ability to cope with sudden large traffic and high-intensity access, and making the system have stronger dynamic response capabilities;

[0045] 3. By analyzing the deviation between the concentration of isolated variables and the zero-one normal distribution, the instability problem caused by simple cumulative difference calculation is effectively avoided, the anti-interference ability to abnormal data fluctuations is improved, and the robustness of the data processing process is ensured, especially in a complex network environment, it can still maintain a high accuracy;

[0046] 4. Comprehensive analysis of the dynamic characteristics and disturbance characteristics of network security monitoring data can achieve efficient abnormal data screening and processing, ensure real-time processing capabilities in large-scale data monitoring environments, and significantly improve the overall operating efficiency of the system;

[0047] 5. The logarithmic loss of server network traffic and access intensity is multiplied to effectively avoid the limitations of traditional processing methods when facing large dynamic range data fluctuations, so that the system can maintain stable monitoring and analysis capabilities under extreme conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0049] Figure 1 This is an overall flow chart of a method for processing network security monitoring data of an Internet of Things server according to an embodiment of the present invention;

[0050] Figure 2 This is a diagram of an analysis of network security monitoring data of an Internet of Things server according to a method for processing network security monitoring data of an Internet of Things server described in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0052] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0053] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0054] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0055] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0056] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0057] Example 1

[0058] Reference Figure 1 , which is the first embodiment of the present invention, and provides a network security monitoring data processing method of an Internet of Things server, comprising:

[0059] S1. Obtain network security monitoring data of the IoT server, where the network security monitoring data includes server load rate monitoring values, server access intensity monitoring values, and server network traffic monitoring values ​​sampled in time series;

[0060] Further, according to the server load rate monitoring values ​​and server access intensity monitoring values ​​sampled at different time series in the network security monitoring data, a server load monitoring curve and a server access intensity curve are obtained;

[0061] Furthermore, through the server load monitoring curve and the server access intensity curve, the stability of server load rate changes and the volatility of server access intensity of network security monitoring data are obtained;

[0062] Furthermore, the product of the inverse of the stability of the server load rate change of the network security monitoring data and the volatility of the server access intensity is used as the dynamic feature of the network security monitoring data;

[0063] Specifically, the server load rate monitoring value evaluates whether the server is in an overloaded state by monitoring resources such as CPU usage, memory usage, and disk I / O;

[0064] Specifically, the server access intensity monitoring value refers to the intensity of network requests or accesses processed by the server per unit time, usually measured by the number of requests per second (RPS) or the number of connections. This value reflects the request load currently being processed by the server, including the network access volume issued by users or other devices;

[0065] Specifically, the server network traffic monitoring value is the total amount of data transmitted by the server through its network interface per unit time, including upload and download traffic;

[0066] Furthermore, the server load rate F1 is preset as a threshold value, and for N random server load rate data points in the server load rate monitoring curve, the ratio of the server load rate monitoring value of the server load rate data point to the threshold server load rate is recorded as the N ratios of the server load rate data point, and the average of the N ratios of all server load rate data points in the server load rate monitoring curve is taken as the stability of the server load rate change of the network security monitoring data;

[0067] Furthermore, a pulse data point is randomly selected in the server access strength curve, and the absolute value of the difference between the server access strength monitoring value of the pulse data point and the server access strength monitoring value of the next pulse data point is divided by the absolute value of the time difference between the server access strength monitoring value of the pulse data point and the next pulse data point, which is recorded as the i-th absolute value of the difference of the pulse data point, and the recursive average of the i-th absolute values ​​of the differences of all the pulse data points in the server access strength curve is taken as the server access strength volatility of the network security monitoring data;

[0068] Specifically, the server access intensity volatility formula is as follows:

[0069]

[0070] Among them, |t i+1 -t i | is the absolute value of the time difference between the server access intensity monitoring value of a pulse data point and its next pulse data point, |x i+1 -x i | is the difference between the server access strength monitoring value of a pulse data point and the server access strength monitoring value of the next pulse data point, is the recursive average operator;

[0071] Specifically, the iterative formula of the recursive average is:

[0072]

[0073] Among them, the absolute value x of the ith difference of the pulse rate data point i , A n is the recursive average value, and the corresponding initialization value A0 is the random sampling average value of the absolute value of the difference between the pulse rate data points;

[0074] It should be noted that by iterating the recursive average, each time a new data point enters, the system only needs to use the previous average and the new data point to update the result, without having to reprocess all historical data, which greatly improves processing efficiency;

[0075] S2. According to the fluctuation of the server load rate monitoring value and the server access intensity monitoring value, the dynamic characteristics of the network security monitoring data are obtained, and according to the dynamic characteristics and the fluctuation of the server network traffic monitoring value, the disturbance characteristics of the network security monitoring data are obtained;

[0076] Furthermore, the disturbance characteristics of the network security monitoring data are obtained by taking the time series sampling as the horizontal coordinate and the server network traffic monitoring value as the vertical coordinate. The network security monitoring data is input into the horizontal and vertical coordinate system, and a number of network traffic data points are obtained. All network traffic data points are fitted into a network traffic monitoring curve by the minimum ridge regression method.

[0077] It should be explained that in network traffic monitoring, the network traffic data of the server may have highly correlated variables (i.e., multicollinearity); for example, multiple sensors or servers send and receive data at the same time, resulting in strong correlation between traffic variables. Traditional linear regression methods are prone to unstable coefficient estimation when dealing with multicollinearity, while minimum ridge regression effectively alleviates this problem by introducing a penalty term (L2 norm) in the objective function; and for data with a large dynamic range, minimum ridge regression limits the excessive growth of coefficients, allowing the system to handle these data fluctuations more smoothly, avoiding the instability of traditional regression methods in extreme data situations, because it can find the optimal solution in a multidimensional feature space (i.e., the multidimensional data in the solution of the present invention) without overfitting the data;

[0078] Specifically, the minimum ridge regression method is to minimize the minimum ridge regression function J(k) and obtain the minimum ridge regression slope curve k, then:

[0079]

[0080] Among them, x i Server network security monitoring data horizontal and vertical coordinates, y iThe server network traffic monitoring value is the ordinate, p is the dimension, usually set to [5,10]; λ is the control parameter of the regularization strength;

[0081] Furthermore, the logarithmic loss of the network traffic monitoring curve and the server access intensity curve is recorded as the first logarithmic loss, and the product of the first logarithmic loss and the dynamic characteristics of the network security monitoring data is used as the disturbance characteristics of the network security monitoring data;

[0082] It should be noted that by using logarithmic loss on the network traffic monitoring curve and the server access intensity curve, the system can be more robust in dealing with sudden large-scale traffic changes or abnormal access, and the monitoring system will not be distorted due to extreme values. In other words, logarithmic loss not only helps smooth these extreme fluctuations, but also enhances the robustness of the system in processing data in complex network environments;

[0083] S3. Obtain a network security monitoring curve from network security monitoring data, obtain several isolated variables by sampling and analyzing the network security monitoring curve, obtain a sampling benchmark deviation value of each isolated variable according to the distribution difference of different data points in each isolated variable, and obtain the disturbance characteristic reliability of the network security monitoring data by using the sampling benchmark deviation value and the frequency characteristics of the data value of the network security monitoring data point in the network security monitoring curve;

[0084] Furthermore, a segmentation parameter k is preset, and for a random isolated variable, the isolated variable is evenly divided into k sub-regions;

[0085] Furthermore, for a random isolated variable, the reciprocal of the absolute value of the difference between the concentration value of the isolated variable and the concentration value of the zero-one normal distribution is recorded as the first reciprocal;

[0086] Furthermore, for a random data point in a random sub-region of the isolated variable, the difference between the characteristic deviation coefficient of the data point and 1 is recorded as the second difference of the data point;

[0087] Specifically, the characteristic deviation coefficient here refers to the deviation of a data point from the ideal state (i.e., 1), and the difference is calculated to evaluate the degree of deviation of each data point from the ideal state;

[0088] Furthermore, the absolute value of the mean of the second differences of all data points in the sub-region is recorded as the smooth distribution of the sub-region;

[0089] Furthermore, the product of the mean of the smooth distribution of all sub-regions of the isolated variable and the first inverse is taken as the sampling base deviation value of the isolated variable;

[0090] It should be explained that by comparing isolated variables with the standard normal distribution, the degree of deviation of the variables can be identified, and taking the reciprocal of the difference as the first reciprocal can enhance the sensitivity to the deviation, especially when the deviation is large, the value of the first reciprocal is small, which can highlight these areas with large deviations; in this way, the system can more accurately identify variables that are significantly different from the normal state and help better detect anomalies; in addition, the difference between the characteristic deviation coefficient of the data point and 1 can help the system quantify the degree of abnormality of each data point, especially in each sub-area, by calculating the difference of all data points, the overall degree of abnormality in the area can be further understood; in this way, the system can not only detect a single abnormal point, but also identify a larger problem that a group of abnormal data points may represent;

[0091] Further, according to the frequency characteristics of the data values ​​of the network security monitoring data points in the network security monitoring curve, the periodicity of the network security monitoring data is obtained;

[0092] Further, the periodicity of obtaining network security monitoring data is to classify all network security monitoring data points in the network security monitoring curve according to data values ​​to obtain several data value categories;

[0093] Furthermore, two random data value categories are combined to obtain several combinations;

[0094] Furthermore, for each random combination, the difference in the number of network security monitoring data points between the first data value type and the second data value type in the combination is recorded as the distribution probability difference of the combination;

[0095] Specifically, by combining two random data value categories, the difference in the number of data points in the two categories can be compared. After combining the categories, comparing their distribution differences can reveal the temporal distribution patterns of different data categories, especially the periodic differences. For example, when the data points of a certain category are relatively sparse within a certain period of time, while the data points of another category are relatively concentrated, it means that some network activities have irregular periodic fluctuations, which helps to more accurately discover abnormal behaviors or potential threats.

[0096] Furthermore, the mean of the distribution probability differences of all combinations is used as the periodicity of network security monitoring data;

[0097] Furthermore, the mean of the sampling baseline deviation values ​​of all isolated variables of the network security monitoring curve is recorded as the second mean;

[0098] It should be explained that because the second mean is obtained by averaging the sampling base deviation values ​​of all isolated variables, it reflects the overall deviation of the isolated variables in the system; the larger the sampling base deviation value, the more significant the deviation of the variables in the system from the normal state;

[0099] Furthermore, the product of the second mean and the periodicity of the network security monitoring data is used as the disturbance feature reliability of the network security monitoring data;

[0100] Specifically, when fluctuations occur in the network, the periodicity and the second mean can be combined to determine whether the fluctuations are normal periodic fluctuations or abnormal non-periodic fluctuations. If the fluctuations conform to the periodic law, it is considered to be a normal phenomenon; if the fluctuations do not conform to the periodicity and the second mean is large, it is considered to be abnormal;

[0101] It should be noted that combining the second mean with periodicity can evaluate the overall security status of the system at different levels, improving the speed and accuracy of responding to sudden security threats;

[0102] S4. Obtain the processing necessity of the network security monitoring data through the disturbance feature reliability and disturbance feature. If the processing necessity is greater than the set empirical threshold, the network security monitoring data is screened to obtain the network security monitoring data after the disturbance is removed. Otherwise, the network security monitoring data is abnormal and manual intervention is performed.

[0103] Furthermore, the second-order norm between the disturbance characteristics and the disturbance reliability of network security monitoring data is taken as the necessity for processing network security monitoring data;

[0104] Furthermore, the empirical threshold of dynamic features is obtained from the stability of server load rate and the volatility of access intensity;

[0105] Specifically, the stability of the server load rate S load for:

[0106]

[0107] Among them, σ load is the standard deviation of the server load rate, ∈ is a small positive number used to prevent the denominator from being zero;

[0108] Specifically, the volatility of access intensity V access for:

[0109] V access =σ access

[0110] Among them, σ access is the standard deviation of the server access intensity;

[0111] Specifically, the empirical threshold formula for dynamic features is:

[0112]

[0113] Among them, γ is the relative weight of adjusting the stability of load rate and the volatility of access intensity;

[0114] Furthermore, by monitoring the disturbance characteristics of the server network traffic data points, the empirical threshold is adaptively adjusted;

[0115] Specifically, the disturbance characteristics of the monitoring server network traffic data points are obtained by the logarithmic loss of the network traffic monitoring curve and the server access intensity curve and the dynamic characteristics of the network security monitoring data;

[0116] Specifically, the disturbance characteristics of the calculated network traffic are:

[0117]

[0118] Among them, Δ flow is the instantaneous rate of change of network traffic, μ flow It is the average network traffic over a period of time;

[0119] Specifically, by monitoring the disturbance characteristics D of network traffic flow The empirical threshold T for dynamic features dyn The adaptive adjustments are as follows:

[0120] T adj =T dyn (1+D flow ×δ flow )

[0121] Among them, δ flow To control the influence coefficient of network traffic fluctuation on the adjustment of empirical threshold;

[0122] Furthermore, the adaptation adjustment rules are as follows:

[0123] Rule 1: Maintain stability during normal fluctuations, that is, when the server load rate and access intensity fluctuate slightly and the disturbance characteristics of network traffic are D flow When it is close to zero, the system is in normal operation, in which case the empirical threshold does not change significantly:

[0124] if D flow ≤∈1:T adj =T dyn

[0125] Among them, ∈1 represents the range of small disturbances, and values ​​below this value are considered normal fluctuations;

[0126] Rule 2: Dynamic threshold increases to cope with traffic fluctuations. That is, when a large disturbance characteristic (such as an instantaneous traffic surge) is detected in the network traffic, the system threshold needs to be increased according to the magnitude of the traffic fluctuation to adapt to abnormalities or potential network attacks:

[0127] if D flow >∈1 and D flow ≤∈2:T adj =T dyn (1+D flow ×δ flow )

[0128] Among them, ∈2 is the upper limit of flow disturbance, and anything exceeding this upper limit is considered as a large fluctuation;

[0129] Rule 3: Further increase the threshold when there is a sharp fluctuation. That is, when the monitored network traffic fluctuates sharply (such as DDoS attacks or a large number of abnormal requests), the system needs to significantly increase the threshold to cope with possible sudden abnormalities or attacks:

[0130] if D flow >∈2:T adj =T dyn (1+D flow ×δ flow +(D flow -∈2))

[0131] Rule 4: The threshold is lowered when the disturbance returns to normal, that is, when the network traffic returns to normal, the disturbance feature D flow When it gradually decreases to a level close to the normal range, the system can gradually restore the threshold to its initial state to ensure that it is not over-protected, thereby maintaining system performance:

[0132] if D flow ≤∈1 and T adj >T dyn :T adj =T adj -(T adj +T dyn ) 2

[0133] Rule 5: Set a minimum safety limit for the empirical threshold, that is, to ensure that the system maintains safe operation under any circumstances, set a minimum empirical threshold:

[0134] T adj ≥min(T dyn )

[0135] It should be noted that by designing adaptive adjustment rules, the system can flexibly adjust the empirical threshold according to the disturbance characteristics of the network traffic data points monitored in real time, ensuring sufficient protection when the network environment changes, and appropriately lowering the threshold when the load returns to normal to maintain the balance of system performance.

[0136] Example 2

[0137] Reference Figure 2 , which is the second embodiment of the present invention, and this embodiment provides a method for processing network security monitoring data of an Internet of Things server, including: This simulation experiment is intended to verify the effectiveness of the method for processing network security monitoring data of an Internet of Things server of the present invention in reducing false alarms and improving accuracy, and by comparing with the prior art method and the method without any processing, evaluate the change in error rate when the number of alarms is within 100 times;

[0138] The simulation experiments were conducted in three ways and compared as follows:

[0139] The method of the present invention: based on the stability of server load rate, the volatility of access intensity and the disturbance characteristics of network traffic, an adaptively adjusted dynamic characteristic empirical threshold is adopted;

[0140] Prior art methods: Use a traditional fixed threshold monitoring system to perform fixed threshold detection on the server load rate and access intensity without adaptive adjustment;

[0141] No processing: No intervention is made to the server network traffic and load rate, and only the raw data is monitored;

[0142] Among them, the threshold of the method of the present invention is dynamically calculated through an adaptive adjustment formula; the prior art method adopts a fixed server load rate and access intensity threshold, and triggers an alarm when the CPU utilization rate exceeds 80% and the access intensity exceeds 5000 requests / second; the method without any processing does not set a threshold, but only monitors the number of alarms and error rates;

[0143] Specifically, the error rate ER formula is:

[0144]

[0145] Among them, FA is the number of false alarms, and AF is the total number of alarms;

[0146] refer to Figure 2 , the method of the present invention (solid circle points) shows the lowest error rate. As the number of alarms increases, the error rate of the method of the present invention remains at a low level before the number of alarms reaches 90, and the error rate is significantly lower than that of the prior art method and the method without any processing, which shows that the method of the present invention can effectively reduce false alarms and improve the accuracy of the monitoring system;

[0147] In summary, the method of the present invention can effectively cope with complex network environments and load changes through an adaptive threshold adjustment mechanism, significantly reduce the error rate, and improve the long-term stability and accuracy of the monitoring system. Compared with the prior art methods, the method of the present invention is particularly suitable for Internet of Things servers in dynamic network environments, suitable for long-term operation and can effectively cope with various abnormal network traffic.

[0148] Those skilled in the art will appreciate that the embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program codes. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0149] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0150] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0151] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1The steps for the functions specified in one or more boxes.

[0152] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0153] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network security monitoring data processing method for an Internet of Things server, characterized in that: include: Obtain network security monitoring data of the Internet of Things server, wherein the network security monitoring data includes a server load rate monitoring value, a server access intensity monitoring value, and a server network traffic monitoring value sampled in a time series; According to the fluctuation of the server load rate monitoring value and the server access intensity monitoring value, the dynamic characteristics of the network security monitoring data are obtained, and according to the fluctuation of the server network traffic monitoring value and the dynamic characteristics, the disturbance characteristics of the network security monitoring data are obtained; A network security monitoring curve is obtained from the network security monitoring data, and a plurality of isolated variables are obtained by sampling and analyzing the network security monitoring curve. A sampling reference deviation value of each isolated variable is obtained according to the distribution difference of different data points in each isolated variable, and the disturbance characteristic reliability of the network security monitoring data is obtained by using the sampling reference deviation value and the frequency characteristics of the data value of the network security monitoring data point in the network security monitoring curve; The necessity of processing the network security monitoring data is obtained through the disturbance feature reliability and disturbance feature. If the processing necessity is greater than the set empirical threshold, the network security monitoring data is screened to obtain the network security monitoring data after the disturbance is removed. Otherwise, the network security monitoring data is abnormal and manual intervention is performed.

2. The network security monitoring data processing method of the Internet of Things server according to claim 1, characterized in that: The method of obtaining the dynamic characteristics of the network security monitoring data according to the fluctuation of the server load rate monitoring value and the server access intensity monitoring value includes: According to the server load rate monitoring values ​​and server access intensity monitoring values ​​sampled at different time series in the network security monitoring data, a server load monitoring curve and a server access intensity curve are obtained; Obtain the stability of server load rate changes and the volatility of server access intensity of network security monitoring data through the server load monitoring curve and the server access intensity curve; The product of the inverse of the stability of the server load rate change of network security monitoring data and the volatility of the server access intensity is taken as the dynamic feature of the network security monitoring data.

3. The network security monitoring data processing method of the Internet of Things server according to claim 2, characterized in that: The acquisition of network security monitoring data includes: The server load rate F1 is preset as a threshold value. For N random server load rate data points in the server load rate monitoring curve, the ratio of the server load rate monitoring value of the server load rate data point to the threshold server load rate is recorded as the N ratios of the server load rate data point. The average of the N ratios of all server load rate data points in the server load rate monitoring curve is taken as the stability of the server load rate change of the network security monitoring data. Select a random pulse data point in the server access strength curve, divide the absolute value of the difference between the server access strength monitoring value of the pulse data point and the server access strength monitoring value of the next pulse data point by the absolute value of the time difference between the server access strength monitoring value of the pulse data point and the next pulse data point, and record it as the i-th difference absolute value of the pulse data point. Take the recursive average of the i-th difference absolute values ​​of all pulse data points in the server access strength curve as the server access strength volatility of the network security monitoring data.

4. The network security monitoring data processing method of the Internet of Things server according to claim 2 or 3, characterized in that: According to the dynamic characteristics and the fluctuation of the server network traffic monitoring value, the disturbance characteristics of the network security monitoring data are obtained, including: With time series sampling as the horizontal axis and server network traffic monitoring value as the vertical axis, network security monitoring data is input into the horizontal and vertical coordinate system, a number of network traffic data points are obtained, and all network traffic data points are fitted into a network traffic monitoring curve by the minimum ridge regression method; The logarithmic loss of the network traffic monitoring curve and the server access intensity curve is recorded as the first logarithmic loss, and the product of the first logarithmic loss and the dynamic characteristics of the network security monitoring data is used as the disturbance feature of the network security monitoring data.

5. The network security monitoring data processing method of the Internet of Things server according to claim 1, characterized in that: According to the distribution differences of different data points in each isolated variable, the sampling benchmark deviation value of each isolated variable is obtained, including: A segmentation parameter k is preset, and for a random isolated variable, the isolated variable is evenly divided into k sub-regions; For a random isolated variable, the reciprocal of the absolute value of the difference between the concentration value of the isolated variable and the concentration value of the zero-normal distribution is recorded as the first reciprocal; For a random data point in a random sub-region of the isolated variable, the difference between the characteristic deviation coefficient of the data point and 1 is recorded as the second difference of the data point; Recording the absolute value of the mean of the second differences of all data points in the sub-region as the smooth distribution of the sub-region; The product of the mean of the smooth distribution of all sub-regions of the isolated variable and the first inverse is used as the sampling reference deviation value of the isolated variable.

6. The network security monitoring data processing method of the Internet of Things server according to claim 5, characterized in that: The disturbance characteristic reliability of the network security monitoring data is obtained by using the sampling reference deviation value and the frequency characteristics of the data value of the network security monitoring data point in the network security monitoring curve, including: Obtaining the periodicity of network security monitoring data according to the frequency characteristics of the data values ​​of the network security monitoring data points in the network security monitoring curve; The mean of the sampling benchmark deviation values ​​of all isolated variables of the network security monitoring curve is recorded as the second mean; The product of the second mean and the periodicity of the network security monitoring data is used as the disturbance feature reliability of the network security monitoring data.

7. The network security monitoring data processing method of the Internet of Things server according to claim 6, characterized in that: The periodicity of obtaining network security monitoring data includes: Classify all network security monitoring data points in the network security monitoring curve according to data values ​​to obtain several data value categories; Combine two random data value categories to obtain several combinations; For each random combination, the difference in the number of network security monitoring data points between the first data value type and the second data value type in the combination is recorded as the distribution probability difference of the combination; The mean of the distribution probability differences of all combinations is taken as the periodicity of network security monitoring data.

8. The method for processing network security monitoring data of an Internet of Things server according to claim 1, characterized in that: Through the disturbance feature reliability and disturbance feature, the necessity of processing network security monitoring data is obtained, including: The second-order norm between the disturbance characteristics and disturbance reliability of network security monitoring data is taken as the necessity for processing network security monitoring data.

9. The network security monitoring data processing method of the Internet of Things server according to claim 1, characterized in that: The empirical thresholds include: The empirical threshold of dynamic characteristics is obtained based on the stability of server load rate and the volatility of access intensity.

10. The network security monitoring data processing method of the Internet of Things server according to claim 9, characterized in that: Also includes: By monitoring the disturbance characteristics of server network traffic data points, the empirical threshold is adaptively adjusted.

Images