Network security supervision system based on Internet of Things

Abstract

The invention relates to the technical field of network security, in particular to a network security supervision system based on Internet of Things, which comprises a data acquisition module used for acquiring power consumption data and network data of Internet of Things equipment; the network analysis module is used for analyzing the network security of the Internet of Things equipment; the power consumption monitoring module is used for judging the power consumption state of the Internet of Things equipment; the bandwidth management module is used for managing the bandwidth of the next security management period; the risk early warning module is used for carrying out Internet of Things equipment network security risk early warning on the user according to the analysis result of the network security state of the Internet of Things equipment in the risk management period; and the communication analysis module is used for adjusting the network security risk early warning process of the Internet of Things equipment according to the white list communication proportion, the black list communication proportion and the unknown communication proportion of the Internet of Things equipment acquired in the risk management period. According to the invention, the network security supervision efficiency of the Internet of Things equipment is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security monitoring system based on the Internet of Things. Background Art

[0002] With the rapid development of Internet of Things (IoT) technology, various IoT devices are becoming more and more popular in daily life and industrial applications. These devices are interconnected through the Internet, enabling real-time data collection, remote monitoring and operation, but also bringing increasingly serious network security issues. IoT devices are often the target of hacker attacks and malicious intrusions due to their diverse operating environments and complex protocols. Therefore, it is becoming increasingly important to develop and implement an effective network security supervision system.

[0003] Chinese patent publication number CN113301043A discloses a network security terminal based on 5G industrial Internet of Things, the network security terminal includes a network security system, the network security system includes an attacked data collection module, an attacked index calculation module, an Internet of Things device classification module and an attack situation judgment module, the attacked data collection module collects the attacked data information of each Internet of Things device in the recent period, assuming that the number of Internet of Things devices is M, M is a natural number, the attacked index calculation module calculates the attacked index of each Internet of Things device according to the attacked data information, the Internet of Things device classification module compares the attacked index of each Internet of Things device with the attacked index threshold, and judges whether the corresponding Internet of Things device is a restricted Internet of Things device or a semi-restricted Internet of Things device according to the size of the attacked index and the attacked index threshold; it can be seen that this scheme only analyzes the attacked data of the Internet of Things device to perform network security supervision on the network equipment, and there is a problem of low efficiency in network security supervision of the Internet of Things devices. Summary of the invention

[0004] The object of the present invention is to provide a network security supervision system based on the Internet of Things to solve at least one of the problems existing in the prior art.

[0005] To achieve the above object, the present invention adopts the following technical solutions:

[0006] A network security supervision system based on the Internet of Things, comprising:

[0007] Data acquisition module, used to collect power consumption data and network data of IoT devices;

[0008] A network analysis module is used to analyze the network security of IoT devices based on the network data of IoT devices collected during the monitoring period;

[0009] The power consumption monitoring module is used to judge the power consumption status of the IoT device based on the collected power consumption data of the IoT device;

[0010] The bandwidth management module is used to analyze the network security status of the IoT devices in the security management cycle according to the analysis results of the network security of the IoT devices in each monitoring period in the security management cycle, and manage the bandwidth of the next security management cycle according to the analysis results and the analysis results of the power consumption status of the IoT devices;

[0011] The risk warning module is used to provide users with network security risk warnings for IoT devices based on the analysis results of the network security status of IoT devices in each security management cycle within the risk management cycle;

[0012] The communication analysis module is used to adjust the network security risk warning process of IoT devices according to the whitelist communication ratio, blacklist communication ratio and unknown communication ratio of IoT devices collected during the risk management cycle.

[0013] Further, the network analysis module includes a traffic monitoring unit, which is used to compare the traffic rate k0 of the IoT device collected during the monitoring period with the traffic rate threshold k1 to analyze the abnormality of the traffic rate of the IoT device, and the abnormality of the traffic rate includes normal and abnormal;

[0014] The traffic monitoring unit analyzes the network traffic status according to the analysis results of the abnormality of the traffic rate of the IoT device during the monitoring period. The network traffic status includes normal and abnormal growth. If the network traffic status in the current monitoring period is abnormal growth, the traffic anomaly index is set to LY.

[0015] Furthermore, the network analysis module also includes a request monitoring unit, which is used to compare the request frequency q0 of the IoT device collected during the monitoring period with the preset frequency q1, and analyze the abnormality of the request frequency of the IoT device based on the comparison result. The abnormality of the request frequency includes normal and abnormal. If the request frequency of the IoT device in the current monitoring period is abnormal, the request abnormality index is set to QY.

[0016] Furthermore, the network analysis module also includes a delay monitoring unit, which is used to compare the network delay t0 of the Internet of Things device collected during the monitoring period with the preset delay t1 to analyze the request response quality of the Internet of Things device. The request response quality includes normal and poor. If the request response quality of the Internet of Things device in the current monitoring period is poor, the network delay index is set to WY.

[0017] Furthermore, the network analysis module also includes a security analysis unit, which is used to analyze the network security of the Internet of Things device based on the analysis results of the network traffic status within the monitoring period, the analysis results of the abnormality of the request frequency of the Internet of Things device, and the analysis results of the request response quality of the Internet of Things device, and the network security includes normal and abnormal.

[0018] Furthermore, the power consumption monitoring module includes a feature extraction unit, which is used to extract a first feature parameter set as T1 and a second feature parameter set as T2 according to the power consumption of the IoT device in each historical monitoring period collected;

[0019] The power consumption monitoring module also includes a power consumption analysis unit, which is used to judge the power consumption state of the Internet of Things device according to the extraction result of the power consumption characteristic parameter and the power consumption h0 of the Internet of Things device collected during the security management period. The power consumption state includes normal and abnormal.

[0020] Further, the bandwidth management module is used to analyze the network security status of the IoT devices within the security management cycle according to the analysis results of the network security of the IoT devices in each monitoring period within the security management cycle, and the network security status includes normal and abnormal;

[0021] The bandwidth management module manages the bandwidth of the next security management cycle according to the analysis results of the network security status of the IoT device and the power consumption status of the IoT device within the security management cycle, wherein:

[0022] If the power consumption state of the IoT device in the current security management period is normal and the network security state of the IoT device is normal, the bandwidth management module sets the bandwidth of the next security management period to D1;

[0023] If the power consumption state of the IoT device in the current security management period is normal and the network security state of the IoT device is abnormal, the bandwidth management module sets the bandwidth of the next security management period to D2;

[0024] If the power consumption state of the IoT device in the current security management period is abnormal and the network security state of the IoT device is normal, the bandwidth management module sets the bandwidth of the next security management period to D3;

[0025] If the power consumption state of the IoT device in the current security management period is abnormal and the network security state of the IoT device is abnormal, the bandwidth management module sets the bandwidth of the next security management period to D4.

[0026] Furthermore, the risk warning module is used to provide the user with an Internet of Things device network security risk warning based on the analysis results of the network security status of the Internet of Things devices in each security management period within the risk management period, wherein:

[0027] If p1 / p0≤η, the risk warning module does not issue a network security risk warning for the IoT device to the user;

[0028] If p1 / p0>η, the risk warning module issues a network security risk warning to the user for the IoT device;

[0029] Among them, p1 is the number of security management cycles in which the network security status of the IoT device is abnormal within the risk management cycle, p0 is the number of security management cycles within the risk management cycle, and η is the preset abnormality ratio.

[0030] Furthermore, the communication analysis module includes a first communication analysis unit, which is used to compare the whitelist communication proportion b0 of the Internet of Things devices collected during the risk management period with the preset communication proportion b1, and analyze the communication status of the Internet of Things devices based on the comparison results. The communication status includes normal and abnormal. If the communication status of the Internet of Things during the risk management period is abnormal, the preset abnormal ratio is set to η1.

[0031] Furthermore, the communication analysis module also includes a second communication analysis unit, which is used to analyze the abnormality of the risk communication ratio based on the blacklist communication ratio hb and the unknown communication ratio wb collected during the risk management period. The abnormality of the risk communication ratio includes normal and abnormal. If the risk communication ratio is abnormal during the risk management period, the preset communication ratio is set to b1'.

[0032] The beneficial effects of the present invention are as follows: the present invention realizes comprehensive and real-time monitoring and analysis of IoT devices. The system can dynamically collect power consumption data, network traffic, request frequency and network delay of the device, thereby realizing accurate evaluation of the network behavior of the device. Through multi-dimensional analysis, abnormal behavior and potential security threats can be timely identified, so that the system can respond quickly and adjust security policies, significantly improving the overall network security.

[0033] In addition, the system also has intelligent bandwidth management and risk warning functions, which can optimize network resource configuration based on real-time analysis results to ensure stable operation of equipment. Overall, the system effectively improves the security management capabilities in the IoT environment, reduces potential risks, ensures the reliability and security of equipment, and provides users with strong security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0035] Figure 1 Schematic diagram of the structure of the Internet of Things-based network security supervision system of this embodiment.

[0036] Figure 2 Schematic diagram of the structure of the network analysis module of this embodiment.

[0037] Figure 3 Schematic diagram of the structure of the power consumption monitoring module in this embodiment.

[0038] Figure 4 Schematic diagram of the structure of the communication analysis module of this embodiment. DETAILED DESCRIPTION

[0039] In order to more clearly illustrate the present invention, the present invention is further described below in conjunction with preferred embodiments and accompanying drawings. Similar components in the accompanying drawings are represented by the same reference numerals. It should be understood by those skilled in the art that the content specifically described below is illustrative rather than restrictive, and should not be used to limit the scope of protection of the present invention.

[0040] It should be noted that, although the terms first, second, third, etc. may be used to describe in the embodiments of the present application, these descriptions should not be limited to these terms. These terms are only used to distinguish the descriptions. For example, without departing from the scope of the embodiments of the present application, the first may also be referred to as the second, and similarly, the second may also be referred to as the first.

[0041] See also Figure 1 As shown, it is a schematic diagram of the structure of the network security supervision system based on the Internet of Things in this embodiment, and the system includes:

[0042] A data acquisition module is used to collect power consumption data and network data of IoT devices. The power consumption data of IoT devices includes power consumption of IoT devices and historical power consumption data of IoT devices. The network data includes traffic rate, request frequency and network delay. The traffic rate is the network traffic generated by IoT devices in unit time, and the request frequency is the number of data requests initiated by IoT devices in unit time. In this embodiment, no specific limitation is made on the collection method of power consumption data and network data of IoT devices. Technical personnel in this field can set it freely as long as the collection requirements of power consumption data and network data of IoT devices are met. Among them, the power consumption of IoT devices can be collected through smart meters, the historical power consumption data of IoT devices can be obtained through interaction, the traffic rate can be collected through network traffic analysis tools, the request frequency can be collected by capturing network messages of IoT devices and counting request logs under HTTP, MQTT, CoAP and other protocols, and the network delay can be collected through Ping or Traceroute tools.

[0043] Please continue reading Figure 1As shown, the system also includes a network analysis module, which is used to analyze the network security of the Internet of Things devices according to the traffic rate, request frequency and network delay of the Internet of Things devices collected during the monitoring period, and the network analysis module is connected to the data acquisition module; in this embodiment, there is no specific limitation on the setting of the monitoring period, and technical personnel in this field can set it freely, as long as the setting requirements of the monitoring period are met, wherein the monitoring period can be set to 5 seconds.

[0044] See also Figure 2 As shown, the network analysis module includes:

[0045] The traffic monitoring unit is used to compare the traffic rate k0 of the IoT device collected during the monitoring period with the traffic rate threshold k1 to analyze the abnormality of the traffic rate of the IoT device and to quantitatively evaluate the traffic status, wherein:

[0046] If k0≤k1, the traffic monitoring unit determines that the network rate is normal, and if k0>k1, the traffic monitoring unit determines that the network traffic rate is abnormal;

[0047] The traffic monitoring unit analyzes the network traffic status according to the analysis results of the abnormality of the traffic rate of the IoT device within the monitoring period, and constructs a traffic anomaly index according to the analysis results, wherein:

[0048] If i 1 / i0≤u1, the traffic monitoring unit determines that the network traffic state in the current monitoring period is normal; if i1 / i0>u1, the traffic monitoring unit determines that the network traffic state in the current monitoring period is abnormal growth, and sets the traffic anomaly index to LY, setting LY=i 1 / i0-u1; by performing threshold analysis on the traffic rate, it is possible to judge the normal and abnormal states of the network traffic in real time, and by constructing the traffic anomaly index, it is convenient to quantitatively evaluate the traffic state and provide support for subsequent network security evaluation;

[0049] Among them, i1 is the duration of the abnormal traffic rate of the IoT device during the monitoring period, i0 is the duration of the monitoring period, and u1 is the first preset abnormal proportion.

[0050] It can be understood that, in this embodiment, no specific limitation is made on the setting of the flow rate threshold and the first preset abnormality ratio, and those skilled in the art can set them freely, as long as the setting requirements of the flow rate threshold and the first preset abnormality ratio are met, wherein k1 can be set to 1.2-1.5 times the average flow rate of normal operation of the IoT device, and the optimal value of u1 is 0.06.

[0051] Please continue reading Figure 2 As shown, the network analysis module also includes:

[0052] The request monitoring unit is used to compare the request frequency q0 of the IoT device collected during the monitoring period with the preset frequency q1, and analyze the abnormality of the request frequency of the IoT device according to the comparison result, and construct the request abnormality index according to the analysis result to improve the system's anti-attack capability, where:

[0053] If q0≤q1, the request monitoring unit determines that the request frequency of the IoT device in the current monitoring period is normal;

[0054] If q0>q1, the request monitoring unit determines that the request frequency of the IoT device in the current monitoring period is abnormal, and sets the request anomaly index to QY, setting: QY=ln[8×(q0-q1) / (q0+q1)] / l n9; by comparing the request frequency, it is possible to quickly identify whether the request status of the device is abnormal, which provides a basis for timely detecting malicious requests, and by constructing the request anomaly index, it provides support for subsequent network security assessments, thereby improving the accuracy of network security analysis.

[0055] It can be understood that the setting of the preset frequency is not specifically limited in this embodiment, and those skilled in the art can set it freely as long as the setting requirements of the preset frequency are met. Among them, when the IoT device is a sensor, the optimal value of q1 is 20 times / min.

[0056] Please continue reading Figure 2 As shown, the network analysis module also includes:

[0057] The delay monitoring unit is used to compare the network delay t0 of the IoT device collected during the monitoring period with the preset delay t1, and analyze the request response quality of the IoT device according to the comparison result, and construct a network delay index according to the analysis result, wherein:

[0058] If t0≤t1, the delay monitoring unit determines that the request response quality of the IoT device in the current monitoring period is normal;

[0059] If t0>t1, the delay monitoring unit determines that the request response quality of the IoT device in the current monitoring period is poor, and sets the network delay index to WY, setting: WY=exp[3×(t0-t1)-3]; by comparing with the preset delay, the request response quality is judged, thereby increasing the focus on user experience. An effective delay monitoring mechanism can provide support for network security optimization and improve the accuracy of network security analysis.

[0060] It is understandable that the present embodiment does not specifically limit the setting of the preset delay, and those skilled in the art can freely set it as long as the setting requirements of the preset delay are met, wherein the best value of t1 is 100ms.

[0061] Specifically, the network delay of the Internet of Things device collected during the monitoring period is the average network delay.

[0062] Please continue reading Figure 2 As shown, the network analysis module also includes:

[0063] A security analysis unit connected to the traffic monitoring unit, the request monitoring unit, and the delay monitoring unit, the security analysis unit is used to analyze the network security of the IoT device according to the analysis results of the network traffic status within the monitoring period, the analysis results of the abnormality of the request frequency of the IoT device, and the analysis results of the request response quality of the IoT device, wherein:

[0064] If w1×LY+w2×QY+w3×WY≤E, the security analysis unit determines that the network security of the IoT device in the current monitoring period is normal;

[0065] If w1×LY+w2×QY+w3×WY>E, the security analysis unit determines that the network security of the IoT device in the current monitoring period is abnormal; by comprehensively analyzing the abnormalities of traffic, requests and delays, the overall network security of the IoT device can be quantified. By setting a reasonable safety factor, the system can accurately judge the network security status and improve the ability to identify potential security threats;

[0066] Among them, E is the preset safety factor, w1 is the traffic weight, w2 is the request weight, w3 is the delay weight, w1+w2+w3=1, if the network traffic status in the current monitoring period is normal, the value of LY is 0, if the request frequency of the IoT device in the current monitoring period is normal, the value of QY is 0, if the request response quality of the IoT device in the current monitoring period is normal, the value of WY is 0.

[0067] It can be understood that the preset safety factor and the setting of each weight are not specifically limited in this embodiment, and those skilled in the art can set them freely as long as the setting requirements of the preset safety factor and each weight are met. Among them, the optimal value of w1 is 0.4, the optimal value of w2 is 0.3, the optimal value of w3 is 0.3, and the optimal value of E is 0.16.

[0068] Please continue reading Figure 1 As shown, the system also includes a power consumption monitoring module, which is used to extract power consumption characteristic parameters based on the power consumption of the Internet of Things devices collected in each historical monitoring period, and to judge the power consumption status of the Internet of Things devices based on the power consumption characteristic parameters and the power consumption of the Internet of Things devices collected in the monitoring period. The power consumption monitoring module is connected to the data acquisition module.

[0069] See also Figure 3 As shown, the power consumption monitoring module includes:

[0070] The feature extraction unit is used to extract the power consumption feature parameters according to the collected power consumption of IoT devices in each historical monitoring period, where:

[0071] The feature extraction unit sets the first feature parameter to T1, and sets:

[0072]

[0073] The feature extraction unit sets the second feature parameter to T2, setting:

[0074]

[0075] Among them, Hj is the power consumption of IoT devices collected in the jth historical monitoring period, and J is the number of historical monitoring periods.

[0076] Please continue reading Figure 3 As shown, the power consumption monitoring module also includes:

[0077] A power consumption analysis unit connected to the feature extraction unit, the power consumption analysis unit is used to judge the power consumption state of the IoT device according to the extraction result of the power consumption feature parameter and the IoT device power consumption h0 collected during the security management period, wherein:

[0078] If T1-3×T2≤h0≤T1+3×T2, the power consumption analysis unit determines that the power consumption state of the IoT device in the current security management cycle is normal;

[0079] If h0<T1-3×T2 or h0>T1+3×T2, the power consumption analysis unit determines that the power consumption state of the Internet of Things device in the current security management cycle is abnormal; the power consumption analysis unit can timely identify power consumption anomalies by comparing the extracted characteristic parameters with the real-time energy consumption, analyze the network security status in multiple dimensions, and improve the efficiency of network security supervision.

[0080] Please continue reading Figure 1 As shown, the system also includes a bandwidth management module, which is connected to the network analysis module and the power consumption monitoring module. The bandwidth management module is used to analyze the network security status of the IoT devices within the security management cycle according to the analysis results of the network security of the IoT devices in each monitoring period within the security management cycle, wherein:

[0081] When r1 / r0≤α, the bandwidth management module determines that the network security status of the IoT device in the current security management period is normal;

[0082] When r1 / r0>α, the bandwidth management module determines that the network security status of the IoT device in the current security management period is abnormal;

[0083] The bandwidth management module manages the bandwidth of the next security management cycle according to the analysis results of the network security status of the IoT device and the power consumption status of the IoT device within the security management cycle, wherein:

[0084] If the power consumption state of the IoT device in the current security management period is normal and the network security state of the IoT device is normal, the bandwidth management module sets the bandwidth of the next security management period to D1, setting: D1 = d0;

[0085] If the power consumption state of the IoT device in the current security management period is normal and the network security state of the IoT device is abnormal, the bandwidth management module sets the bandwidth of the next security management period to D2, setting D2 = d0-β1×d0×(r1 / r0-α) 2 / [1+(r1 / r0-α) 2 ];

[0086] If the power consumption state of the IoT device in the current security management period is abnormal and the network security state of the IoT device is normal, the bandwidth management module sets the bandwidth of the next security management period to D3, setting: D3 = d0;

[0087] If the power consumption state of the IoT device in the current security management period is abnormal and the network security state of the IoT device is abnormal, the bandwidth management module sets the bandwidth of the next security management period to D4, setting D2 = d0-β2×d0×(r1 / r0-α) 2 / [1+(r1 / r0-α) 2 ]; The bandwidth management module can dynamically adjust bandwidth allocation according to the results of the network security status analysis within the monitoring period, reduce the network security risks of the Internet of Things devices, and thus improve the network security supervision efficiency of the Internet of Things devices;

[0088] Wherein, d0 is the preset bandwidth, β1 is the first preset adjustment ratio, β2 is the second preset adjustment ratio, β1<β2, r1 is the number of monitoring cycles of network security anomalies of IoT devices within the security management cycle, r0 is the number of monitoring cycles within the security management cycle, and α is the preset anomaly ratio.

[0089] It can be understood that, in this embodiment, no specific limitation is made on the setting of the security management period, and those skilled in the art can set it freely, and it only needs to meet the setting requirements of the security management period, wherein the setting of the security management period should be greater than the setting of the monitoring period, and the security management period can be set to 5 minutes, 10 minutes, etc.; in this embodiment, no specific limitation is made on the setting of the preset abnormality proportion, each preset adjustment ratio and the preset bandwidth, and those skilled in the art can set it freely, and it only needs to meet the setting requirements of the preset abnormality proportion, each preset adjustment ratio and the preset bandwidth, wherein d0 can be set through user interaction, the optimal value of β1 is 0.2, the optimal value of β2 is 0.3, and the optimal value of α is 0.1.

[0090] Please continue reading Figure 1 As shown, the system also includes a risk warning module, which is connected to the bandwidth management module. The risk warning module is used to provide a network security risk warning of the Internet of Things device to the user based on the analysis results of the network security status of the Internet of Things devices in each security management period within the risk management period, wherein:

[0091] If p1 / p0≤η, the risk warning module does not issue a network security risk warning for the IoT device to the user;

[0092] If p1 / p0>η, the risk warning module will issue a network security risk warning to the user of the IoT device; the risk warning module will issue an alarm to the user based on the analysis results of the security status, which will help the user to take timely measures to reduce potential network security risks. This function enhances the user's risk management ability and improves the overall security protection level;

[0093] Among them, p1 is the number of security management cycles in which the network security status of the IoT device is abnormal within the risk management cycle, p0 is the number of security management cycles within the risk management cycle, and η is the preset abnormality ratio.

[0094] It can be understood that in this embodiment, the setting of the risk management cycle is not specifically limited, and those skilled in the art can set it freely, as long as the setting requirements of the risk management cycle are met, wherein the setting of the risk management cycle should be greater than the setting of the safety management cycle, and the risk management cycle can be set to 60 minutes, 90 minutes, etc.; in this embodiment, the setting of the preset abnormal ratio is not specifically limited, and those skilled in the art can set it freely, as long as the setting requirements of the preset abnormal ratio are met, wherein the optimal value of η is 0.08.

[0095] Please continue reading Figure 1As shown, the system also includes a communication analysis module, which is connected to the risk warning module, and the communication analysis module is used to adjust the network security risk warning process of the Internet of Things device according to the whitelist communication ratio, blacklist communication ratio and unknown communication ratio of the Internet of Things devices collected during the risk management cycle.

[0096] Specifically, the whitelist communication ratio described in this embodiment is the access frequency covered by the whitelist, that is, the ratio of the whitelist hit count to the total access count, the blacklist communication ratio is the ratio of the blacklist access hit count to the total access count, and the unknown communication ratio is the ratio of the unknown IP access hit count to the total access count. The whitelist is a set of legal IP addresses that the IoT devices are allowed to communicate with, and the blacklist is a set of IP addresses of known malicious servers or suspicious external hosts. In this embodiment, the collection method of the whitelist communication ratio, blacklist communication ratio and unknown communication ratio of the IoT devices is not specifically limited, and technical personnel in this field can set it freely, as long as the collection requirements of the whitelist communication ratio, blacklist communication ratio and unknown communication ratio of the IoT devices are met, among which the whitelist communication ratio, blacklist communication ratio and unknown communication ratio of the IoT devices can be collected through the firewall.

[0097] See also Figure 4 As shown, the communication analysis module includes:

[0098] The first communication analysis unit is used to compare the whitelist communication proportion b0 of the IoT devices collected during the risk management period with the preset communication proportion b1, and analyze the communication status of the IoT devices according to the comparison results, and adjust the IoT device network security risk early warning process according to the analysis results, so as to adjust the communication status of the system in real time and optimize network access security, wherein:

[0099] If b0≤b1, the first communication analysis unit determines that the communication state of the Internet of Things within the risk management period is abnormal, and sets the preset abnormality ratio to η1, setting η1=η×[1-(e b1-b0 -1) / (e-1)], where e is the natural logarithm;

[0100] If b0>b1, the first communication analysis unit determines that the communication status of the Internet of Things is normal within the risk management period and does not make any adjustments; the first communication analysis unit can make real-time adjustments to the communication status of the system according to the changes in the proportion of whitelist communications to optimize network access security. Such a monitoring and adjustment mechanism can significantly improve the effectiveness of the authorization mechanism and enhance the security protection of the device.

[0101] It can be understood that the present embodiment does not specifically limit the setting of the preset communication ratio, and those skilled in the art can freely set it as long as the setting requirements of the preset communication ratio are met, wherein the best value of b1 is 0.9.

[0102] Please continue reading Figure 4 As shown, the communication analysis module also includes:

[0103] A second communication analysis unit is connected to the first communication analysis unit, and the second communication analysis unit analyzes the abnormality of the risk communication proportion according to the blacklist communication proportion hb and the unknown communication proportion wb collected during the risk management period, and adjusts the analysis process of the communication status of the Internet of Things device according to the analysis result to automatically optimize the analysis process of the risk communication status, wherein:

[0104] If hb / (hb+wb)≤γ, the second communication analysis unit determines that the risk communication ratio within the risk management period is normal and does not make any adjustments, and γ is the preset risk ratio;

[0105] If hb / (hb+wb)>γ, the second communication analysis unit determines that the risk communication ratio within the risk management period is abnormal, and sets the preset communication ratio to b1', and sets b1'=b1×{1-[hb / (hb+wb)-γ]+[hb / (hb+wb)-γ]×{1-[hb / (hb+wb)-γ]}}; the second communication analysis unit can automatically optimize the analysis process of the risk communication status by analyzing the blacklist and the unknown communication ratio, and further enhance the system's ability to identify unknown threats. This dynamic adjustment helps to improve the accuracy of security monitoring and reduce security risks.

[0106] It can be understood that the setting of the preset risk ratio is not specifically limited in this embodiment, and those skilled in the art can freely set it as long as the setting requirements of the preset risk ratio are met, wherein the optimal value of γ is 0.2.

[0107] Specifically, the system described in this embodiment is applied to industrial control, smart home, smart city and other fields under the Internet of Things environment. In the face of increasingly severe network security situation, it provides multi-level and dynamic security monitoring and protection for Internet of Things devices to ensure the safety of enterprise production and user life.

[0108] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, and are not limitations on the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is impossible to list all the embodiments here. All obvious changes or modifications derived from the technical solution of the present invention are still within the protection scope of the present invention.

Claims

1. A network security supervision system based on the Internet of Things, characterized in that: include: Data acquisition module, used to collect power consumption data and network data of IoT devices; A network analysis module is used to analyze the network security of IoT devices based on the network data of IoT devices collected during the monitoring period; The power consumption monitoring module is used to judge the power consumption status of the IoT device based on the collected power consumption data of the IoT device; The bandwidth management module is used to analyze the network security status of the IoT devices in the security management cycle according to the analysis results of the network security of the IoT devices in each monitoring period in the security management cycle, and manage the bandwidth of the next security management cycle according to the analysis results and the analysis results of the power consumption status of the IoT devices; The risk warning module is used to provide users with network security risk warnings for IoT devices based on the analysis results of the network security status of IoT devices in each security management cycle within the risk management cycle; The communication analysis module is used to adjust the network security risk warning process of IoT devices according to the whitelist communication ratio, blacklist communication ratio and unknown communication ratio of IoT devices collected during the risk management cycle.

2. The network security supervision system based on the Internet of Things according to claim 1 is characterized in that: The network analysis module includes a traffic monitoring unit, which is used to compare the traffic rate k0 of the IoT device collected during the monitoring period with the traffic rate threshold k1 to analyze the abnormality of the traffic rate of the IoT device, and the abnormality of the traffic rate includes normal and abnormal; The traffic monitoring unit analyzes the network traffic status according to the analysis results of the abnormality of the traffic rate of the IoT device during the monitoring period. The network traffic status includes normal and abnormal growth. If the network traffic status in the current monitoring period is abnormal growth, the traffic anomaly index is set to LY.

3. The network security supervision system based on the Internet of Things according to claim 2 is characterized in that: The network analysis module also includes a request monitoring unit, which is used to compare the request frequency q0 of the IoT device collected during the monitoring period with the preset frequency q1, and analyze the abnormality of the request frequency of the IoT device based on the comparison result. The abnormality of the request frequency includes normal and abnormal. If the request frequency of the IoT device in the current monitoring period is abnormal, the request abnormality index is set to QY.

4. The network security supervision system based on the Internet of Things according to claim 3 is characterized in that: The network analysis module also includes a delay monitoring unit, which is used to compare the network delay t0 of the IoT device collected during the monitoring period with the preset delay t1 to analyze the request response quality of the IoT device. The request response quality includes normal and poor. If the request response quality of the IoT device in the current monitoring period is poor, the network delay index is set to WY.

5. The network security supervision system based on the Internet of Things according to claim 4 is characterized in that: The network analysis module also includes a security analysis unit, which is used to analyze the network security of the Internet of Things device based on the analysis results of the network traffic status within the monitoring period, the analysis results of the abnormality of the request frequency of the Internet of Things device, and the analysis results of the request response quality of the Internet of Things device, and the network security includes normal and abnormal.

6. The network security supervision system based on the Internet of Things according to claim 5 is characterized in that: The power consumption monitoring module includes a feature extraction unit, which is used to extract a first feature parameter set as T1 and a second feature parameter set as T2 according to the power consumption of the IoT device in each historical monitoring period collected; The power consumption monitoring module also includes a power consumption analysis unit, which is used to judge the power consumption state of the Internet of Things device according to the extraction result of the power consumption characteristic parameter and the power consumption h0 of the Internet of Things device collected during the security management period. The power consumption state includes normal and abnormal.

7. The network security supervision system based on the Internet of Things according to claim 6 is characterized in that: The bandwidth management module is used to analyze the network security status of the IoT devices within the security management cycle according to the analysis results of the network security of the IoT devices in each monitoring period within the security management cycle, and the network security status includes normal and abnormal; The bandwidth management module manages the bandwidth of the next security management cycle according to the analysis results of the network security status of the IoT device and the power consumption status of the IoT device within the security management cycle, wherein: If the power consumption state of the IoT device in the current security management period is normal and the network security state of the IoT device is normal, the bandwidth management module sets the bandwidth of the next security management period to D1; If the power consumption state of the IoT device in the current security management period is normal and the network security state of the IoT device is abnormal, the bandwidth management module sets the bandwidth of the next security management period to D2; If the power consumption state of the IoT device in the current security management period is abnormal and the network security state of the IoT device is normal, the bandwidth management module sets the bandwidth of the next security management period to D3; If the power consumption state of the IoT device in the current security management period is abnormal and the network security state of the IoT device is abnormal, the bandwidth management module sets the bandwidth of the next security management period to D4.

8. The network security supervision system based on the Internet of Things according to claim 7 is characterized in that: The risk warning module is used to provide the user with an Internet of Things device network security risk warning based on the analysis results of the network security status of the Internet of Things devices in each security management period within the risk management period, wherein: If p1 / p0≤η, the risk warning module does not issue a network security risk warning for the IoT device to the user; If p1 / p0>η, the risk warning module issues a network security risk warning to the user for the IoT device; Among them, p1 is the number of security management cycles in which the network security status of the IoT device is abnormal within the risk management cycle, p0 is the number of security management cycles within the risk management cycle, and η is the preset abnormality ratio.

9. The network security supervision system based on the Internet of Things according to claim 8 is characterized in that: The communication analysis module includes a first communication analysis unit, which is used to compare the whitelist communication proportion b0 of the Internet of Things devices collected during the risk management period with the preset communication proportion b1, and analyze the communication status of the Internet of Things devices according to the comparison results. The communication status includes normal and abnormal. If the communication status of the Internet of Things during the risk management period is abnormal, the preset abnormal proportion is set to η1.

10. The network security supervision system based on the Internet of Things according to claim 9 is characterized in that: The communication analysis module also includes a second communication analysis unit, which is used to analyze the abnormality of the risk communication ratio based on the blacklist communication ratio hb and the unknown communication ratio wb collected during the risk management period. The abnormality of the risk communication ratio includes normal and abnormal. If the risk communication ratio is abnormal during the risk management period, the preset communication ratio is set to b1'.

Images