POE (Power Over Ethernet)-driven multi-dimensional security monitoring and protection system for Internet of Things equipment

Abstract

The invention relates to the technical field of Internet of Things safety monitoring, in particular to a POE-driven Internet of Things equipment multi-dimensional safety monitoring and protection system. The system comprises a power supply and flow monitoring module, a flow data acquisition module, an abnormal flow detection module, a response and protection module, a visual management module and a data storage module. According to the system, the POE power supply and flow monitoring functions are integrated, so that fine granularity real-time monitoring of the Internet of Things equipment is realized, and the safety protection capability of the equipment end is effectively improved. The system can automatically identify and respond to abnormal traffic, and timely block potential network threats, so that the security risk is reduced. Meanwhile, the POE technology is utilized to simplify equipment power supply and monitoring deployment, and the cost is reduced. And the visual management module provides a visual safety monitoring interface, so that management personnel can quickly respond and adjust strategies, and the practicability and the safety of the system are further enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things security monitoring, and in particular to a multi-dimensional security monitoring and protection system for Internet of Things devices driven by POE. Background Art

[0002] With the popularity of IoT devices, the security of IoT devices has received increasing attention. IoT devices are often vulnerable to network attacks, especially when traffic is abnormal, which may be accompanied by malware, virus transmission or intrusion. Current IoT security monitoring mostly relies on centralized network traffic detection systems, but these systems lack fine-grained real-time monitoring of device-side traffic, making it difficult to effectively detect and defend against network threats targeting specific devices.

[0003] In recent years, with the development of POE technology, it has become increasingly common to power devices through network cables. This technology not only simplifies the layout of device power supply, but also adds additional monitoring capabilities to IoT devices, that is, it can realize real-time detection of data traffic while powering. However, existing technologies have not fully utilized the traffic monitoring function of POE devices to perform real-time security monitoring of IoT devices. Summary of the invention

[0004] In view of the above-mentioned technical deficiencies, the purpose of the present invention is to provide a POE-driven multi-dimensional security monitoring and protection system for IoT devices to solve the problems existing in the prior art of inability to provide accurate traffic monitoring on the device side, lack of support for POE devices, delays and untimely responses.

[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions: First, the multi-dimensional security monitoring and protection system of IoT devices driven by POE includes: A power supply and traffic monitoring module, which is used to connect the IoT device via a network cable and provide POE power supply, while monitoring the network traffic data of the IoT device; Traffic data collection module, used to obtain network traffic data from POE-powered IoT devices in real time, and perform preliminary filtering and classification; The abnormal traffic detection module uses a machine learning-based algorithm to build a normal behavior model using historical network traffic data, and compares the real-time network traffic data with the normal behavior model to detect abnormal behavior; The response and protection module is used to trigger the security policy when the abnormal traffic detection module detects abnormal behavior; Visual management module, used to view network traffic data, abnormal behavior data and security policies adopted by IoT devices; The data storage module is used to store network traffic data and system logs.

[0006] Preferably, in a possible implementation manner of the first aspect, the network traffic data includes an IP address, a protocol type, a traffic bandwidth, an IoT device identity information, and traffic classification information.

[0007] Preferably, in a possible implementation manner of the first aspect, the flow data acquisition module specifically includes: Obtain network traffic data of IoT devices powered by POE in real time; Classify network traffic data according to preset protocol types; Filter out network traffic data that is not relevant to monitoring.

[0008] Preferably, in a possible implementation manner of the first aspect, the abnormal traffic detection module specifically includes: Build normal behavior models using pre-set machine learning models and historical network traffic data; Compare real-time network traffic data to models of normal behavior; Determine whether there is abnormal behavior in the network traffic data based on the comparison results.

[0009] Preferably, in a possible implementation manner of the first aspect, the historical network traffic data includes historical IP addresses, historical protocol types, historical traffic bandwidth, historical IoT device identity information, historical traffic classification information, historical transmission time and historical abnormal behavior data.

[0010] Preferably, in a possible implementation manner of the first aspect, specific circumstances in which abnormal behavior in network traffic data is determined include a sudden change in the IP address or port of device communication, a sudden increase or decrease in traffic bandwidth, and a change in the communication protocol.

[0011] Preferably, in a possible implementation manner of the first aspect, the abnormal behavior is divided into slightly abnormal traffic and seriously abnormal traffic, wherein: Minor abnormal traffic includes traffic peaks that do not exceed the preset time threshold and the peak traffic does not exceed the maximum threshold, bandwidth consumption gradually increases but the increase does not exceed the preset bandwidth usage threshold, and access frequency increases but does not trigger security alarms or abnormal detection mechanisms; Severe abnormal traffic includes continuous data transmission exceeding the preset time threshold and the data volume exceeding the normal threshold, access to unauthorized or unknown servers, use of non-standard or rare ports for communication, and network traffic data characteristics deviating from normal behavior patterns.

[0012] Preferably, in a possible implementation manner of the first aspect, the security policy is divided into a primary security policy, a secondary security policy and a tertiary security policy according to abnormal behavior conditions, wherein: The first-level security policy issues a first-level alarm for slightly abnormal traffic and records the abnormality in the system log; Secondary security policy: When traffic is detected to deviate from the preset threshold and reaches a level between minor and serious anomalies, a secondary alarm is issued and relevant personnel are notified through the management platform, email or SMS; The three-level security strategy will issue a three-level alarm when serious abnormal traffic is confirmed, initiate network isolation measures, sound and light alarms, notify relevant personnel through the management platform, email or text message, and automatically generate a traffic analysis report.

[0013] Preferably, in a possible implementation of the first aspect, the visualization management module displays the traffic status of all IoT devices, allows security policies and response rules to be adjusted through the platform, historical records to be viewed, and security reports to be generated.

[0014] Preferably, in a possible implementation manner of the first aspect, the visualization management module further provides a function of remote configuration of the device.

[0015] The beneficial effects of the present invention are: by integrating POE power supply and flow monitoring functions, fine-grained real-time monitoring of IoT devices is achieved, effectively improving the security protection capabilities of the device end. The system can automatically identify and respond to abnormal traffic, timely block potential network threats, and reduce security risks. At the same time, the use of POE technology simplifies the deployment of equipment power supply and monitoring, reducing costs. The visual management module provides an intuitive security monitoring interface, which facilitates managers to quickly respond and adjust policies, further enhancing the practicality and security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 A structural diagram of a multi-dimensional security monitoring and protection system for IoT devices driven by POE is provided for this application.

[0018] Explanation of the accompanying drawings: 1-power supply and flow monitoring module, 2-flow data acquisition module, 3-abnormal flow detection module, 4-response and protection module, 5-visualization management module, 6-data storage module. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Embodiment 1: Figure 1 As shown, the present invention provides a multi-dimensional security monitoring and protection system for Internet of Things devices driven by POE, including: The power supply and traffic monitoring module 1 is used to connect the IoT device via a network cable and provide POE power supply, while monitoring the network traffic data of the IoT device.

[0021] Specifically, the power supply and flow monitoring module 1 is mainly responsible for connecting IoT devices through network cables, providing POE functions for these devices, and ensuring the normal operation of the devices. At the same time, it has the ability to monitor the network flow data of IoT devices in real time, providing basic data for subsequent security analysis.

[0022] The hardware part of the module consists of a POE switch, a network interface card and a flow monitoring chip, and the software implementation part consists of a flow collection mechanism, a flow data integration mechanism and a data reporting mechanism.

[0023] POE switches not only support traditional network data transmission, but also have the function of providing power supply for connected devices. Through the network cable, POE switches can transmit data and power at the same time, simplifying the wiring requirements of IoT devices.

[0024] The network interface card is used to realize data transmission between the POE switch and the IoT device. NIC has high-speed and stable data transmission capabilities to ensure that the real-time monitoring of network traffic is not affected.

[0025] The traffic monitoring chip is integrated inside the POE switch to capture and analyze network traffic data in real time. The chip can efficiently process a large number of data packets and extract key information such as source address, destination address, port number, packet size, etc.

[0026] The traffic collection mechanism, a software driver running on the POE switch, is responsible for obtaining the raw network traffic data from the traffic monitoring chip and converting it into a format that the system can recognize. The driver also has a preliminary data filtering function that can remove irrelevant or duplicate data packets to reduce the burden of subsequent processing.

[0027] The traffic data integration mechanism integrates and stores the collected network traffic data for subsequent analysis and processing. The integration process includes data packet reassembly, time stamp addition, and traffic statistics.

[0028] Data reporting mechanism, the power supply and flow monitoring module 1 reports the integrated network flow data to other modules in the system through the TCP / IP communication protocol for further analysis and processing.

[0029] In this embodiment, the IoT device is powered by POE, and power supply and data transmission are integrated into a single network cable. The IoT device obtains power through a POE switch, and at the same time acts as an intermediary device to collect and transmit data. No additional power supply equipment is required, thereby reducing wiring and equipment costs.

[0030] The network traffic data of IoT devices collected through POE includes IP address, protocol type, traffic bandwidth, IoT device identity information and traffic classification information.

[0031] The flow data collection module 2 is used to obtain network flow data from POE-powered IoT devices in real time, and perform preliminary filtering and classification to distinguish between regular flow and suspicious flow.

[0032] Specifically, in this embodiment, the traffic data collection module uses deep packet inspection technology to analyze data packets at the network layer and transport layer, capture basic information such as the source address, destination address, port number, etc. in the IP packet header, and also parses the application layer protocol and records the protocol type as a basis for analysis. The preliminary classifier classifies the traffic according to the protocol type (including HTTP, HTTPS, TCP, etc.) and filters out network traffic data that is not related to monitoring (such as internal communication traffic).

[0033] For IP information collection, the module collects the source IP, destination IP, network port used and protocol type (such as TCP, UDP) of each data packet in order to analyze the flow of data packets, communication relationships between devices, etc. Changes in IP addresses and port numbers can indicate whether the device is accessing unknown networks or abnormal services (such as accessing unauthorized external servers).

[0034] For video stream protocol acquisition, the module supports in-depth analysis of common video stream protocols (such as RTSP, HLS, SIP, etc.), captures metadata in the video stream (such as video format, frame rate, resolution, etc.) to monitor and analyze video transmission behavior. When an IoT device uses a video stream protocol to communicate with an external server or device, the system records and analyzes the duration of the communication, bandwidth consumption, and whether it conforms to the normal device behavior model.

[0035] The abnormal traffic detection module 3 adopts a machine learning-based algorithm, uses historical network traffic data to build a normal behavior model, and compares the real-time network traffic data with the normal behavior model to detect abnormal behavior.

[0036] Specifically, the module uses the K-means clustering algorithm and historical network traffic data to build a normal behavior model. It first compares the real-time network traffic data with the normal behavior model, and then determines whether the network traffic data has abnormal behavior based on the comparison results. When certain traffic patterns deviate from normal behavior, the system will identify and mark the behavior as suspicious and record it. Abnormal traffic includes DDoS attacks (such as a large number of repeated requests in a short period of time), malware propagation (such as devices accessing known malicious IPs or transmitting large amounts of data through uncommon ports), and lateral attacks (such as devices attempting to communicate abnormally with other devices on the same network).

[0037] In this embodiment, the process of building a normal behavior model includes data preprocessing and data cleaning stages. This stage aims to remove invalid, duplicate or abnormal data records to ensure the accuracy and consistency of the data. Next, the data is standardized and feature values ​​such as traffic bandwidth and data packet size are converted into values ​​between 0 and 1 for subsequent comparison and analysis.

[0038] After entering the model building phase, the following features are selected from the preprocessed data to build a normal behavior model: the first three digits of the IP address, the protocol type, the traffic bandwidth, and the traffic classification information. Set the K value to 5, and cluster the network traffic data into 5 normal behavior patterns. During initialization, 5 data points are randomly selected as cluster centers. Then the Euclidean distance from each data point to the 5 cluster centers is calculated, and the data points are assigned to the nearest cluster center. Then the position of the cluster center is updated, and the above process is repeated until the position of the cluster center no longer changes significantly or reaches the preset number of iterations (such as 100 times). Finally, 5 clusters are obtained, each cluster represents a normal network traffic behavior pattern.

[0039] Based on the K-means clustering results, a normal behavior model was constructed, which consists of the coordinates of the five cluster centers (i.e., the mean of the feature vector) and the distribution characteristics of the data points in each cluster (e.g., standard deviation).

[0040] To determine whether the traffic pattern deviates from normal behavior, the module uses the following method: First, the real-time network traffic data is compared with the normal behavior model. The traffic pattern is considered to be deviated if the following situations are found: the IP address or port of the device communication suddenly changes, especially accessing unknown or abnormal external servers; the traffic bandwidth suddenly increases or decreases significantly, such as transmitting a large amount of data during non-working hours; the communication protocol changes, especially some devices suddenly use different protocols (such as switching from HTTP to HTTPS, or a device that originally only used RTSP suddenly starts using SIP, etc.). Finally, the deviation is calculated statistically, and when abnormal behavior occurs, if the deviation exceeds 70%, the traffic pattern will be considered to be deviated.

[0041] The level of abnormal traffic is determined by analyzing the degree of traffic deviation, duration, packet size, and device behavior impact, and is divided into slight abnormal traffic and severe abnormal traffic.

[0042] Minor abnormal traffic includes situations where the duration does not exceed 5 minutes and the peak traffic does not exceed 1.5 times the normal peak of the IoT device, the bandwidth consumption gradually increases but the increase does not exceed 2 times the normal use of the preset bandwidth, and the access frequency increases but does not trigger security alarms or abnormal detection mechanisms. For example, an IoT device requests too many external resources within a specific time period or initiates multiple repeated requests in a short period of time. For minor abnormal traffic, the system will issue a warning and record the behavior in the log, but will not take further restrictive measures, and the device will remain in normal operation.

[0043] Severe abnormal traffic includes continuous data transmission for more than 30 minutes and the data volume exceeds 5 times the normal data volume, access to unauthorized or unknown servers, use of non-standard or rare ports for communication, and network traffic data characteristics deviating from normal behavior patterns by 90%. For example, large amounts of DDoS attack traffic, devices accessing malicious servers, or large-scale data leaks. For severe abnormal traffic, the system will immediately trigger the device isolation mechanism, restrict the device's network access rights, and issue an audible and visual alarm.

[0044] The response and protection module 4 is used to trigger the security policy when the abnormal traffic detection module detects abnormal behavior.

[0045] Specifically, when the abnormal traffic detection module detects abnormal behavior, the module automatically triggers the security policy, which is divided into level one security policy, level two security policy and level three security policy according to the abnormal behavior.

[0046] Level 1 security strategy: When the abnormal traffic detection module 3 identifies slightly abnormal traffic, such as a short increase in traffic but not exceeding the set threshold, or a slightly higher access frequency but not triggering other security mechanisms, the response and protection module 4 will issue a level 1 alarm, which will be displayed on the system interface with a low priority, and the detailed information of the abnormal behavior will be recorded in the system log, including the time when the abnormality occurred, the IoT devices involved, the abnormality type, etc. This will remind managers to pay attention to potential security risks and collect data for subsequent analysis.

[0047] Secondary security strategy: when the abnormal traffic detection module 3 finds that the traffic pattern deviates from normal behavior more and more, but has not yet reached the standard of serious abnormality, such as continuous abnormal fluctuations in traffic, access to unknown or high-risk IP addresses, etc., the response and protection module 4 triggers a secondary alarm, and the alarm level is increased. It is displayed in a pop-up window through the visual management module 5, and an alarm notification is sent to the preset manager's email or mobile phone text message at the same time to ensure that the manager can obtain abnormal information immediately; at the same time, the response and protection module 4 automatically starts further monitoring and increases the traffic sampling frequency of the IoT device to analyze abnormal behavior more carefully. The purpose is to notify managers in a timely manner and strengthen monitoring efforts to quickly respond to and investigate potential security threats.

[0048] In the three-level security strategy, the abnormal traffic detection module 3 confirms the existence of serious abnormal traffic, such as continuous DDoS attacks, malware propagation, unauthorized access attempts, etc. These behaviors seriously deviate from the normal behavior model and have extremely high potential risks. The response and protection module 4 quickly initiates network isolation measures to cut off the communication between abnormal IoT devices and other devices in the network to prevent the spread of threats; emits obvious sound and light alarms in the physical environment to attract the attention of on-site personnel; and urgently notifies managers and security teams through management platforms, emails, text messages, and other methods; the response and protection module 4 automatically generates a detailed traffic analysis report based on abnormal traffic data, including the characteristics of abnormal behavior, the scope of impact, possible attack types, and recommended repair steps and emergency response guidelines. The purpose is to quickly contain threats and ensure the overall security of the network, while providing managers with clear action guidelines to quickly and effectively solve problems.

[0049] The visualization management module 5 is used to view the network traffic data, abnormal behavior data and the security policies adopted by the IoT devices.

[0050] Specifically, the module provides a dynamic real-time traffic monitoring interface that displays the current network traffic data of all IoT devices in real time. The data is presented in the form of a line graph, which allows users to quickly identify traffic trends and any anomalies. Users can use the filtering and sorting functions on the interface to deeply analyze traffic data by device, specific time period or protocol type.

[0051] When the abnormal traffic detection module 3 detects abnormal behavior, the visualization management module 5 will immediately display the abnormal information in red on the interface. At the same time, the module will provide detailed abnormal behavior information, including the type of abnormality, the exact time of occurrence, the IoT devices involved, and the abnormal traffic data. Users can also query and replay historical abnormal behaviors to gain a more comprehensive understanding of past abnormal situations.

[0052] In terms of security policy management, the Visual Management Module 5 allows users to adjust security policies and response rules directly through the interface. For example, users can set specific abnormal traffic thresholds and define different levels of security alerts and corresponding response measures. In addition, the module also provides a policy simulation function, allowing users to preview the possible effects of policy adjustments without actually triggering security policies. Users can also easily export and import policies for sharing and reuse between different systems or devices.

[0053] Visual management module 5 also has the function of generating history records and reports. It can store and display the network traffic data, abnormal behavior data and the history records of implemented security policies of all IoT devices. Users can export the data into CSV format through the interface for further analysis and processing. At the same time, the module supports automatic generation of security reports, which cover multiple aspects such as traffic analysis, abnormal behavior statistics and security policy execution. Users can customize the report template and generation cycle as needed.

[0054] In terms of user rights management, the visual management module 5 provides a user rights management function. The administrator can assign specific access rights and operation rights to different users through the interface. This module supports multiple users to operate online at the same time, ensuring the availability and security of the system.

[0055] The data storage module 6 is used to store network flow data and system logs.

[0056] Specifically, the module uses a database structure to store various types of data, and uses distributed database technology to improve data reading and writing speed and storage efficiency. At the same time, the module regularly backs up the database and provides verification and recovery functions for backup data. In order to ensure the confidentiality and security of the data, the data storage module 6 encrypts the stored data and uses an access control mechanism to limit illegal access and operations to the data. In addition, the module also regularly cleans up expired or invalid data to free up storage space, and archives important data. In terms of data interface and integration, the data storage module 6 provides a RESTful API data interface, allowing other modules or systems to easily access and integrate stored data.

[0057] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. POE-driven multi-dimensional security monitoring and protection system for IoT devices, characterized by: include: A power supply and traffic monitoring module, which is used to connect the IoT device via a network cable and provide POE power supply, while monitoring the network traffic data of the IoT device; Traffic data collection module, used to obtain network traffic data from POE-powered IoT devices in real time, and perform preliminary filtering and classification; The abnormal traffic detection module uses a machine learning-based algorithm to build a normal behavior model using historical network traffic data, and compares the real-time network traffic data with the normal behavior model to detect abnormal behavior; The response and protection module is used to trigger the security policy when the abnormal traffic detection module detects abnormal behavior; Visual management module, used to view network traffic data, abnormal behavior data and security policies adopted by IoT devices; The data storage module is used to store network traffic data and system logs.

2. The multi-dimensional security monitoring and protection system for Internet of Things devices according to claim 1, characterized in that: The network traffic data includes IP address, protocol type, traffic bandwidth, IoT device identity information and traffic classification information.

3. The multi-dimensional security monitoring and protection system for Internet of Things devices according to claim 1, characterized in that: The flow data collection module specifically includes: Obtain network traffic data of IoT devices powered by POE in real time; Classify network traffic data according to preset protocol types; Filter out network traffic data that is not relevant to monitoring.

4. The multi-dimensional security monitoring and protection system for Internet of Things devices according to claim 1, characterized in that: The abnormal traffic detection module specifically includes: Build normal behavior models using pre-set machine learning models and historical network traffic data; Compare real-time network traffic data to models of normal behavior; Determine whether there is abnormal behavior in the network traffic data based on the comparison results.

5. The multi-dimensional security monitoring and protection system for Internet of Things devices as claimed in claim 4, characterized in that: The historical network traffic data includes historical IP addresses, historical protocol types, historical traffic bandwidth, historical IoT device identity information, historical traffic classification information, historical transmission time and historical abnormal behavior data.

6. The multi-dimensional security monitoring and protection system for Internet of Things devices as claimed in claim 4, characterized in that: Specific circumstances in which abnormal behavior in network traffic data is determined include sudden changes in the IP address or port of device communication, sudden increases or decreases in traffic bandwidth, and changes in communication protocols.

7. The multi-dimensional security monitoring and protection system for Internet of Things devices according to claim 6, characterized in that: The abnormal behavior is divided into minor abnormal traffic and major abnormal traffic, where: Minor abnormal traffic includes traffic peaks that do not exceed the preset time threshold and the peak traffic does not exceed the maximum threshold, bandwidth consumption gradually increases but the increase does not exceed the preset bandwidth usage threshold, and access frequency increases but does not trigger security alarms or abnormal detection mechanisms; Severe abnormal traffic includes continuous data transmission exceeding the preset time threshold and the data volume exceeding the normal threshold, access to unauthorized or unknown servers, use of non-standard or rare ports for communication, and network traffic data characteristics deviating from normal behavior patterns.

8. The multi-dimensional security monitoring and protection system for Internet of Things devices as claimed in claim 7, characterized in that: The security policy is divided into primary security policy, secondary security policy and tertiary security policy according to abnormal behavior, where: The first-level security policy issues a first-level alarm for slightly abnormal traffic and records the abnormality in the system log; Secondary security policy: When traffic is detected to deviate from the preset threshold and reaches a level between minor and serious anomalies, a secondary alarm is issued and relevant personnel are notified through the management platform, email or SMS; The three-level security strategy will issue a three-level alarm when serious abnormal traffic is confirmed, initiate network isolation measures, sound and light alarms, notify relevant personnel through the management platform, email or text message, and automatically generate a traffic analysis report.

9. The multi-dimensional security monitoring and protection system for Internet of Things devices according to claim 1, characterized in that: The visual management module displays the traffic status of all IoT devices, allows the platform to adjust security policies and response rules, view historical records, and generate security reports.

10. The multi-dimensional security monitoring and protection system for Internet of Things devices according to claim 9, characterized in that: The visual management module further provides a function of remote configuration of the device.

Images