IoT router control method based on application scenario network environment adaptation

Abstract

The present invention discloses an Internet of Things router control method based on application scenario network environment adaptation, which relates to the technical field of network equipment, including: classifying suspicious traffic and reliable traffic; obtaining a set of access restriction indicators of a router; forming a suspicious value range of the access restriction indicator set; forming a reliable value range of the access restriction indicator set; dividing the suspicious traffic generated by the suspicious value interval into malicious traffic and unrecognizable traffic; forming at least one scheme to be banned, calculating the banning efficiency of the scheme to be banned, calculating the reliable data banning impact value of the scheme to be banned; obtaining the screening coefficient of the scheme to be banned; selecting the scheme to be banned with the largest screening coefficient as the target banning scheme. By selecting the scheme to be banned with the largest screening coefficient as the scheme for router access control, while considering the banning effect on malicious traffic and the impact on reliable traffic, the risk of the network controlled by the router is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network equipment, and in particular to an Internet of Things router control method based on application scenario network environment adaptation. Background Art

[0002] Router control involves many aspects, including router management, configuration, monitoring, and troubleshooting. Among them, access control to routers is particularly critical. Routers usually have firewall functions that can monitor and filter data packets in and out of the network to prevent unauthorized access and potential network attacks. However, malicious data is constantly changing, and the firewalls of existing routers cannot identify all malicious data, which can lead to network attacks. At the same time, the access control of routers is relatively fixed and cannot be adjusted in time according to environmental changes, resulting in greater risks in the network controlled by routers. Summary of the invention

[0003] In order to solve the above technical problems, a method for controlling an Internet of Things router based on application scenario network environment adaptation is provided. This technical solution solves the problems raised in the above background technology.

[0004] In order to achieve the above purpose, the technical solution adopted by the present invention is:

[0005] The IoT router control method based on application scenario network environment adaptation includes:

[0006] At preset intervals, in the network environment of the application scenario, the access data of the router is identified and classified into suspicious traffic and reliable traffic;

[0007] Get the access restriction index set of the router, which consists of IP address, MAC address, website address and domain name;

[0008] Based on the suspicious traffic, a suspicious value range of the access restriction indicator set is formed;

[0009] Based on reliable traffic, a reliable value range of the access restriction indicator set is formed;

[0010] Evenly divide the suspicious value range to obtain at least one suspicious value interval, and evenly divide the reliable value range to obtain at least one reliable value interval;

[0011] The suspicious traffic generated in the suspicious value range is divided into malicious traffic and unrecognizable traffic;

[0012] Use a firewall to block suspicious traffic generated in the suspicious value range. If the blocked suspicious traffic still attacks the data, the suspicious value range will be treated as a restricted area to be blocked. Otherwise, no action will be taken.

[0013] The damage caused by the blocked suspicious traffic to the data is regarded as characteristic damage, and the characteristic damage is matched with the restricted area to be blocked;

[0014] The amount of unrecognizable traffic generated in the restricted area to be blocked is obtained as the unrecognizable amount;

[0015] The number of reliable flows generated in the reliable value interval is obtained as the reliable number;

[0016] Based on the restricted area to be blocked, at least one blocking plan to be blocked is formed, the blocking efficiency of the blocking plan to be blocked is calculated, and the reliable data blocking impact value of the blocking plan to be blocked is calculated;

[0017] The blocking efficiency of the scheme to be blocked is compared with the blocking impact value of the reliable data to obtain the screening coefficient of the scheme to be blocked;

[0018] Select the to-be-banned plan with the largest screening coefficient as the target banning plan, and use the target banning plan to block traffic.

[0019] Preferably, the step of identifying the access data of the router and classifying the suspicious traffic and the reliable traffic comprises the following steps:

[0020] Use a firewall to identify the access data of the router, and divide the access data into identifiable data and unidentifiable data based on the identification of the firewall;

[0021] Evenly divide the identifiable data into at least one identifiable block. When the identifiable block contains malicious data, the identifiable block is a suspicious block. When the identifiable block does not contain malicious data, the identifiable block is a reliable block.

[0022] Reliable blocks are aggregated into reliable traffic, and suspicious blocks and unrecognizable data are aggregated into suspicious traffic.

[0023] Preferably, forming a suspicious value range of the access restriction indicator set based on suspicious traffic includes the following steps:

[0024] Aggregate the IP addresses that generate suspicious traffic to form a first IP address range;

[0025] Aggregate the MAC addresses that generate suspicious traffic to form a first MAC address range;

[0026] Aggregate the URLs that generate suspicious traffic to form a first URL range;

[0027] Aggregate the domain names that generate suspicious traffic to form a first domain name range;

[0028] The first IP address range, the first MAC address range, the first website address range and the first domain name range are aggregated into a suspicious value range.

[0029] Preferably, the forming of a reliable value range of the access restriction indicator set based on reliable traffic comprises the following steps:

[0030] Aggregate the IP addresses that generate reliable traffic to form a second IP address range;

[0031] Aggregate the MAC addresses that generate reliable traffic to form a second MAC address range;

[0032] Aggregate the URLs that generate reliable traffic to form a second URL range;

[0033] Aggregate the domain names that generate reliable traffic to form a second domain name range;

[0034] The second IP address range, the second MAC address range, the second website address range and the second domain name range are aggregated into a reliable value range.

[0035] Preferably, the step of classifying the suspicious traffic generated by the suspicious value interval into malicious traffic and unrecognizable traffic comprises the following steps:

[0036] Intersect the suspicious block with the suspicious traffic generated by the suspicious value interval to obtain the suspicious local block;

[0037] Suspicious local blocks are aggregated into malicious traffic, and the part of suspicious traffic generated in the suspicious value interval except malicious traffic is regarded as unrecognizable traffic.

[0038] Preferably, forming at least one blocking scheme based on the blocked area includes the following steps:

[0039] Randomly arrange the restricted areas to be sealed to form a sequence of restricted areas to be sealed;

[0040] A digital set is formed, the digital set is composed of at least one digital sequence, the digital sequence is randomly composed of 0 and 1, at least one digital sequence contains all possible combinations of 0 and 1, and the length of the digital sequence is equal to the length of the sequence of the restricted area to be sealed;

[0041] Assign the numbers in the digital sequence to the restricted areas to be sealed in sequence in order;

[0042] When the number assigned to the restricted area to be sealed is 1, the restricted area to be sealed will be used as the target restricted area, otherwise, no processing will be performed;

[0043] The target blocked areas formed by the single digital sequences are summarized as the blocking plan.

[0044] Preferably, the calculation of the blocking efficiency of the to-be-blocked solution comprises the following steps:

[0045] The characteristic damages of the restricted areas to be blocked are accumulated to obtain the total damages. The characteristic damages of the target restricted areas are divided by the total damages to obtain the weight of the unrecognizable traffic in the target restricted areas.

[0046] Accumulate the number of unrecognizable items in the restricted areas to be sealed to obtain the total number of unrecognizable items;

[0047] Use the comprehensive blocking formula to calculate the blocking efficiency of the solution to be blocked;

[0048] The comprehensive ban formula is as follows: ,

[0049] Among them, A is the blocking efficiency of the blocking scheme to be blocked, i is the subscript, and n is the total number of target blocking areas in the blocking scheme to be blocked. is the number of unrecognizable areas in the i-th target blocking area, is the weight of the unrecognizable traffic between the i-th target blocked areas, and B is the total unrecognizable volume.

[0050] Preferably, the calculating of the reliable data blocking impact value of the to-be-blocked solution comprises the following steps:

[0051] Establish a mechanism to identify data costs;

[0052] Take the intersection of at least one target blocked area in the blocking scheme and a single reliable value interval respectively and take the union of the intersection results to obtain a reliable blocked area, then each reliable value interval will form a corresponding reliable blocked area;

[0053] The reliable traffic generated by the reliable value interval is used in the data cost identification mechanism to obtain the data cost of the reliable value interval;

[0054] Evenly divide the reliable value interval into at least one calibration interval, and use the part of the reliable flow generated by the reliable value interval appearing in the calibration interval as characteristic data;

[0055] The calibration interval that appears in the reliable blocked area is used as the target calibration interval;

[0056] Accumulate the amount of characteristic data of the target calibration interval in the reliable blocked area to obtain the total amount of reliable blocked areas;

[0057] Use a reliable comprehensive formula to calculate the reliable data blocking impact value of the solution to be blocked;

[0058] The reliable comprehensive formula is as follows: ,

[0059] Among them, C is the reliable data blocking impact value of the blocking solution to be blocked, j is the subscript, and m is the total number of reliable blocking areas. is the total amount of reliable bans in the jth reliable value interval, is the data cost of the jth reliable value interval.

[0060] Preferably, the data cost identification mechanism is specifically as follows:

[0061] The flow of the input data cost identification mechanism is used as the flow to be identified, and features of the flow to be identified are extracted to obtain at least one key feature;

[0062] Using a clustering algorithm to merge the key features to obtain at least one key feature classification;

[0063] Randomly obtain key features in the key feature classification as sample key features;

[0064] Obtain the missing cost and data necessity of the sample key feature, multiply the missing cost and data necessity of the sample key feature to obtain the initial cost of the sample key feature, and assign the initial cost to the key feature category where the sample key feature belongs;

[0065] Use the comprehensive cost formula to calculate the data cost of the traffic to be identified;

[0066] The comprehensive cost formula is as follows: ,

[0067] Where D is the data cost of the traffic to be identified, k is the subscript, and q is the total number of key feature categories. is the initial cost of classifying the kth key feature, is the number of key features in the kth key feature classification;

[0068] The data necessity is obtained as follows:

[0069] The part of the reliable traffic except the traffic to be identified is used as the traffic to be evaluated;

[0070] Form at least one data-approximate feature for the key feature, where the data-approximate feature is a feature that has the same function and purpose as the key feature;

[0071] When the key feature or data approximation feature appears in the traffic to be evaluated, the data necessity is 0, otherwise, the data necessity is 1.

[0072] Preferably, the method of using a target blocking solution to block traffic includes the following steps:

[0073] When the target blocking zone of the target blocking scheme is generated by IP addresses, the IP addresses belonging to the target blocking zone are blocked;

[0074] When the target blocking zone of the target blocking scheme is generated by the MAC address, the MAC address belonging to the target blocking zone is blocked;

[0075] When the target blocking zone of the target blocking scheme is generated by a URL, the URL belonging to the target blocking zone is blocked;

[0076] When the target blocking zone of the target blocking scheme is generated by domain names, the domain names belonging to the target blocking zone are blocked.

[0077] Compared with the prior art, the present invention has the following beneficial effects:

[0078] By forming a suspicious value range and a reliable value range for the access restriction indicator set, and based on the suspicious value range and the reliable value range, the screening coefficient is calculated, and the to-be-banned scheme with the largest screening coefficient is selected as the router access control scheme. In this way, suspicious traffic that cannot be identified by the firewall can be blocked. Since the source of suspicious traffic also generates reliable traffic, in order to reduce the impact of blocking reliable traffic, when screening the schemes, the blocking effect on malicious traffic and the impact on reliable traffic are considered at the same time, so as to select a relatively reasonable scheme. Moreover, since the scheme is adjusted once at a preset interval, the access control of the router can be adjusted in time according to environmental changes, thereby reducing the risk of the network controlled by the router. BRIEF DESCRIPTION OF THE DRAWINGS

[0079] Figure 1 It is a flow chart of the method for controlling an Internet of Things router based on application scenario network environment adaptation of the present invention;

[0080] Figure 2 A schematic diagram of a process of identifying access data of a router and classifying suspicious traffic and reliable traffic according to the present invention;

[0081] Figure 3 A schematic diagram of a process for forming a suspicious value range of an access restriction indicator set based on suspicious traffic according to the present invention;

[0082] Figure 4 A schematic diagram of a process for forming a reliable value range of an access restriction indicator set based on reliable traffic according to the present invention;

[0083] Figure 5 A schematic diagram of a process for classifying suspicious traffic generated in a suspicious value interval into malicious traffic and unrecognizable traffic according to the present invention;

[0084] Figure 6 A schematic diagram of a flow chart of forming at least one to-be-blocked plan based on the to-be-blocked restricted area of ​​the present invention;

[0085] Figure 7 A schematic diagram of a flow chart of calculating the blocking efficiency of a solution to be blocked according to the present invention;

[0086] Figure 8A schematic diagram of a flow chart of calculating a reliable data blocking impact value of a to-be-blocked solution of the present invention;

[0087] Fig. 9 It is a flow chart of the data cost identification mechanism of the present invention;

[0088] Fig.10 A schematic diagram of the flow of traffic blocking using a target blocking solution according to the present invention. DETAILED DESCRIPTION

[0089] The following description is used to disclose the present invention so that those skilled in the art can implement the present invention. The preferred embodiments described below are only examples, and those skilled in the art may think of other obvious variations.

[0090] Reference Figure 1 As shown, the IoT router control method based on application scenario network environment adaptation includes:

[0091] At preset intervals, in the network environment of the application scenario, the access data of the router is identified and classified into suspicious traffic and reliable traffic;

[0092] Get the access restriction index set of the router, which consists of IP address, MAC address, website address and domain name;

[0093] Based on the suspicious traffic, a suspicious value range of the access restriction indicator set is formed;

[0094] Based on reliable traffic, a reliable value range of the access restriction indicator set is formed;

[0095] Evenly divide the suspicious value range to obtain at least one suspicious value interval, and evenly divide the reliable value range to obtain at least one reliable value interval;

[0096] The suspicious traffic generated in the suspicious value range is divided into malicious traffic and unrecognizable traffic;

[0097] Use a firewall to block suspicious traffic generated in the suspicious value range. If the blocked suspicious traffic still attacks the data, the suspicious value range will be treated as a restricted area to be blocked. Otherwise, no action will be taken.

[0098] The damage caused by the blocked suspicious traffic to the data is regarded as characteristic damage, and the characteristic damage is matched with the restricted area to be blocked;

[0099] The amount of unrecognizable traffic generated in the restricted area to be blocked is obtained as the unrecognizable amount;

[0100] The number of reliable flows generated in the reliable value interval is obtained as the reliable number;

[0101] Based on the restricted area to be blocked, at least one blocking plan to be blocked is formed, the blocking efficiency of the blocking plan to be blocked is calculated, and the reliable data blocking impact value of the blocking plan to be blocked is calculated;

[0102] The blocking efficiency of the scheme to be blocked is compared with the blocking impact value of the reliable data to obtain the screening coefficient of the scheme to be blocked;

[0103] Select the to-be-banned plan with the largest screening coefficient as the target banning plan, and use the target banning plan to block traffic.

[0104] In this scheme, considering that malicious data is constantly changing, and the identification update of the firewall will lag behind for a period of time, the firewall will inevitably fail to identify a very small part of the attack data. Although this part of the unrecognizable data accounts for a small proportion, it can still cause greater harm. Therefore, in order to further reduce this harm, in this scheme, the data of these addresses are blocked according to the source address of the attack data. However, since these addresses will also generate reliable traffic, the reliable traffic will be blocked simultaneously when the ban is performed, which will cause certain adverse effects. Therefore, in this scheme, a balance is made between the two situations, that is, a scheme is formed to block the attack data while ensuring that the impact of the blocking on the reliable traffic is as small as possible. It should be noted that the blocking of the attack data here is not a complete ban.

[0105] Reference Figure 2 As shown, identifying the access data of the router and classifying the suspicious traffic and reliable traffic includes the following steps:

[0106] Use a firewall to identify the access data of the router, and divide the access data into identifiable data and unidentifiable data based on the identification of the firewall;

[0107] Evenly divide the identifiable data into at least one identifiable block. When the identifiable block contains malicious data, the identifiable block is a suspicious block. When the identifiable block does not contain malicious data, the identifiable block is a reliable block.

[0108] Reliable blocks are aggregated into reliable traffic, and suspicious blocks and unrecognizable data are aggregated into suspicious traffic.

[0109] Some of the access data to the router can be identified, while some cannot. Suspicious traffic is composed of malicious data and unidentifiable data. Malicious data is data that can be identified by the firewall, so it will be blocked in a targeted manner. Reliable traffic is identifiable data that will not cause attacks, so access can be allowed. However, for unidentifiable data, there is a greater possibility that it will cause attacks, so it needs to be processed in a targeted manner later.

[0110] Reference Figure 3As shown, based on suspicious traffic, forming a suspicious value range of an access restriction indicator set includes the following steps:

[0111] Aggregate the IP addresses that generate suspicious traffic to form a first IP address range;

[0112] Aggregate the MAC addresses that generate suspicious traffic to form a first MAC address range;

[0113] Aggregate the URLs that generate suspicious traffic to form a first URL range;

[0114] Aggregate the domain names that generate suspicious traffic to form a first domain name range;

[0115] The first IP address range, the first MAC address range, the first website address range and the first domain name range are aggregated into a suspicious value range.

[0116] Reference Figure 4 As shown, based on reliable traffic, forming a reliable value range of the access restriction indicator set includes the following steps:

[0117] Aggregate the IP addresses that generate reliable traffic to form a second IP address range;

[0118] Aggregate the MAC addresses that generate reliable traffic to form a second MAC address range;

[0119] Aggregate the URLs that generate reliable traffic to form a second URL range;

[0120] Aggregate the domain names that generate reliable traffic to form a second domain name range;

[0121] The second IP address range, the second MAC address range, the second website address range and the second domain name range are aggregated into a reliable value range.

[0122] Here we only summarize and do not merge the ranges because they are different types of ranges.

[0123] Reference Figure 5 As shown, classifying suspicious traffic generated in the suspicious value interval into malicious traffic and unrecognizable traffic includes the following steps:

[0124] Intersect the suspicious block with the suspicious traffic generated by the suspicious value interval to obtain the suspicious local block;

[0125] Suspicious local blocks are aggregated into malicious traffic, and the part of suspicious traffic generated in the suspicious value interval except malicious traffic is regarded as unrecognizable traffic.

[0126] The traffic generated by the suspicious value interval is composed of malicious traffic and unrecognizable traffic. Therefore, the firewall needs to block the malicious traffic generated by the suspicious value interval, and screen the suspicious value interval according to the effect after blocking, and use the suspicious value interval that still generates attacks as the restricted area to be blocked. This means that there is unrecognizable malicious data in the unrecognizable traffic corresponding to the restricted area to be blocked. Since the proportion of unrecognizable traffic is small and difficult to identify, indiscriminate blocking is the most economical way.

[0127] Reference Figure 6 As shown, based on the restricted area to be blocked, forming at least one to-be-blocked scheme includes the following steps:

[0128] Randomly arrange the restricted areas to be sealed to form a sequence of restricted areas to be sealed;

[0129] A digital set is formed, the digital set is composed of at least one digital sequence, the digital sequence is randomly composed of 0 and 1, at least one digital sequence contains all possible combinations of 0 and 1, and the length of the digital sequence is equal to the length of the sequence of the restricted area to be sealed;

[0130] Assign the numbers in the digital sequence to the restricted areas to be sealed in sequence in order;

[0131] When the number assigned to the restricted area to be sealed is 1, the restricted area to be sealed will be used as the target restricted area, otherwise, no processing will be performed;

[0132] The target blocked areas formed by the single digital sequences are summarized as the blocking plan.

[0133] Here, assuming that the length of the digital sequence is L, at least one digital sequence contains all possible combinations of 0 and 1 sequences of length L. Thus, all possible blocking possibilities for at least one restricted area to be blocked can be generated, thereby forming at least one blocking plan. By subsequently screening at least one blocking plan, the desired plan can be obtained.

[0134] Reference Figure 7 As shown, calculating the blocking efficiency of the to-be-blocked solution includes the following steps:

[0135] The characteristic damages of the restricted areas to be blocked are accumulated to obtain the total damages. The characteristic damages of the target restricted areas are divided by the total damages to obtain the weight of the unrecognizable traffic in the target restricted areas.

[0136] Accumulate the number of unrecognizable items in the restricted areas to be sealed to obtain the total number of unrecognizable items;

[0137] Use the comprehensive blocking formula to calculate the blocking efficiency of the solution to be blocked;

[0138] The comprehensive ban formula is as follows: ,

[0139] Among them, A is the blocking efficiency of the blocking scheme to be blocked, i is the subscript, and n is the total number of target blocking areas in the blocking scheme to be blocked. is the number of unrecognizable areas in the i-th target blocking area, is the weight of the unrecognizable traffic between the i-th target blocked areas, and B is the total unrecognizable volume.

[0140] The blocking efficiency is an estimate of the proportion of blocked data to be blocked. When calculating the blocking efficiency, the weight of unrecognizable traffic is also taken into account. This weight is proportional to the attack capability of unrecognizable traffic. Therefore, the blocking efficiency calculated by the comprehensive blocking formula can better reflect the blocking effect of the blocking plan.

[0141] Reference Figure 8 As shown, calculating the reliable data blocking impact value of the to-be-blocked solution includes the following steps:

[0142] Establish a mechanism to identify data costs;

[0143] Take the intersection of at least one target blocked area in the blocking scheme and a single reliable value interval respectively and take the union of the intersection results to obtain a reliable blocked area, then each reliable value interval will form a corresponding reliable blocked area;

[0144] The reliable traffic generated by the reliable value interval is used in the data cost identification mechanism to obtain the data cost of the reliable value interval;

[0145] Evenly divide the reliable value interval into at least one calibration interval, and use the part of the reliable flow generated by the reliable value interval appearing in the calibration interval as characteristic data;

[0146] The calibration interval that appears in the reliable blocked area is used as the target calibration interval;

[0147] Accumulate the amount of characteristic data of the target calibration interval in the reliable blocked area to obtain the total amount of reliable blocked areas;

[0148] Use a reliable comprehensive formula to calculate the reliable data blocking impact value of the solution to be blocked;

[0149] The reliable comprehensive formula is as follows: ,

[0150] Among them, C is the reliable data blocking impact value of the blocking solution to be blocked, j is the subscript, and m is the total number of reliable blocking areas. is the total amount of reliable bans in the jth reliable value interval, is the data cost of the jth reliable value interval.

[0151] When using the scheme to be blocked for blocking, the address corresponding to at least one target blocked area in the scheme to be blocked will be blocked. According to the method of selecting reliable blocked areas, the reliable blocked areas will also be blocked. However, the addresses corresponding to these intervals will generate reliable traffic, which will affect normal data transmission. Therefore, it is necessary to calculate the reliable data blocking impact value of the scheme to be blocked, and estimate the impact of the reliable data blocking impact value on the reliable data blocking. When calculating, the total amount of reliable blocking is taken into account, but since the data value of the total amount of reliable blocking in different reliable blocking areas is different, it cannot be directly superimposed, and it is necessary to form a weight for the total amount of reliable blocking. The weight here is the data cost of the reliable value interval, because the total amount of reliable blocking is generated by the reliable value interval. Therefore, it is reasonable to set up such data calculation.

[0152] Reference Fig. 9 As shown in the figure, the data cost identification mechanism is as follows:

[0153] The flow of the input data cost identification mechanism is used as the flow to be identified, and features of the flow to be identified are extracted to obtain at least one key feature;

[0154] Using a clustering algorithm to merge the key features to obtain at least one key feature classification;

[0155] Randomly obtain key features in the key feature classification as sample key features;

[0156] Obtain the missing cost and data necessity of the sample key feature, multiply the missing cost and data necessity of the sample key feature to obtain the initial cost of the sample key feature, and assign the initial cost to the key feature category where the sample key feature belongs;

[0157] Use the comprehensive cost formula to calculate the data cost of the traffic to be identified;

[0158] The comprehensive cost formula is as follows: ,

[0159] Where D is the data cost of the traffic to be identified, k is the subscript, and q is the total number of key feature categories. is the initial cost of classifying the kth key feature, is the number of key features in the kth key feature classification;

[0160] The data necessity is obtained as follows:

[0161] The part of the reliable traffic except the traffic to be identified is used as the traffic to be evaluated;

[0162] Form at least one data-approximate feature for the key feature, where the data-approximate feature is a feature that has the same function and purpose as the key feature;

[0163] When the key feature or data approximation feature appears in the traffic to be evaluated, the data necessity is 0, otherwise, the data necessity is 1.

[0164] The role of the sample key features is to reduce the number of times the initial cost is obtained, because the initial costs of similar key features are approximate, and therefore, they can be approximately replaced. When obtaining data necessity, the data approximation characteristics of the key features need to be considered. The key features cannot be deemed irreplaceable when they do not appear. However, when their data approximation characteristics appear, they are equivalent to the key features, and therefore, they are replaceable. Therefore, the data necessity is set to 0, because the replaceability of the key features will not lead to data loss. Otherwise, the data necessity needs to be set to 1.

[0165] Reference Fig.10 As shown in the figure, traffic blocking using the target blocking solution includes the following steps:

[0166] When the target blocking zone of the target blocking scheme is generated by IP addresses, the IP addresses belonging to the target blocking zone are blocked;

[0167] When the target blocking zone of the target blocking scheme is generated by the MAC address, the MAC address belonging to the target blocking zone is blocked;

[0168] When the target blocking zone of the target blocking scheme is generated by a URL, the URL belonging to the target blocking zone is blocked;

[0169] When the target blocking zone of the target blocking scheme is generated by domain names, the domain names belonging to the target blocking zone are blocked.

[0170] Furthermore, the present solution also proposes a storage medium on which a computer-readable program is stored. When the computer-readable program is called, the above-mentioned IoT router control method based on application scenario network environment adaptation is executed.

[0171] It is understandable that the storage medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; an optical medium, such as a DVD; or a semiconductor medium, such as a solid state drive (SSD).

[0172] In summary, the advantages of the present invention are: by forming a suspicious value range and a reliable value range for the access restriction indicator set, and based on the suspicious value range and the reliable value range, a screening coefficient is calculated, and the to-be-banned scheme with the largest screening coefficient is selected as the router access control scheme, thereby, suspicious traffic that cannot be identified by the firewall can be blocked, because the source of suspicious traffic also generates reliable traffic, therefore, in order to reduce the impact of blocking reliable traffic, when screening the scheme, the blocking effect on malicious traffic and the impact on reliable traffic are considered at the same time, so as to select a relatively reasonable scheme, and because the scheme is adjusted once every preset time interval, the access control of the router can be adjusted in time according to environmental changes, thereby reducing the risk of the network controlled by the router.

[0173] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions only describe the principles of the present invention. The present invention may be subject to various changes and improvements without departing from the spirit and scope of the present invention. These changes and improvements fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the attached claims and their equivalents.

Claims

1. An IoT router control method based on application scenario network environment adaptation, characterized in that: include: At preset intervals, in the network environment of the application scenario, the access data of the router is identified and classified into suspicious traffic and reliable traffic; Get the access restriction index set of the router, which consists of IP address, MAC address, website address and domain name; Based on the suspicious traffic, a suspicious value range of the access restriction indicator set is formed; Based on reliable traffic, a reliable value range of the access restriction indicator set is formed; Evenly divide the suspicious value range to obtain at least one suspicious value interval, and evenly divide the reliable value range to obtain at least one reliable value interval; The suspicious traffic generated in the suspicious value range is divided into malicious traffic and unrecognizable traffic; Use a firewall to block suspicious traffic generated in the suspicious value range. If the blocked suspicious traffic still attacks the data, the suspicious value range will be treated as a restricted area to be blocked. Otherwise, no action will be taken. The damage caused by the blocked suspicious traffic to the data is regarded as characteristic damage, and the characteristic damage is matched with the restricted area to be blocked; The amount of unrecognizable traffic generated in the restricted area to be blocked is obtained as the unrecognizable amount; The number of reliable flows generated in the reliable value interval is obtained as the reliable number; Based on the restricted area to be blocked, at least one blocking plan to be blocked is formed, the blocking efficiency of the blocking plan to be blocked is calculated, and the reliable data blocking impact value of the blocking plan to be blocked is calculated; The blocking efficiency of the scheme to be blocked is compared with the blocking impact value of the reliable data to obtain the screening coefficient of the scheme to be blocked; Select the to-be-banned plan with the largest screening coefficient as the target banning plan, and use the target banning plan to block traffic.

2. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 1 is characterized in that: The step of identifying the access data of the router and classifying the suspicious traffic and the reliable traffic comprises the following steps: Use a firewall to identify the access data of the router, and divide the access data into identifiable data and unidentifiable data based on the identification of the firewall; Evenly divide the identifiable data into at least one identifiable block. When the identifiable block contains malicious data, the identifiable block is a suspicious block. When the identifiable block does not contain malicious data, the identifiable block is a reliable block. Reliable blocks are aggregated into reliable traffic, and suspicious blocks and unrecognizable data are aggregated into suspicious traffic.

3. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 2 is characterized in that: The forming of the suspicious value range of the access restriction indicator set based on the suspicious traffic comprises the following steps: Aggregate the IP addresses that generate suspicious traffic to form a first IP address range; Aggregate the MAC addresses that generate suspicious traffic to form a first MAC address range; Aggregate the URLs that generate suspicious traffic to form a first URL range; Aggregate the domain names that generate suspicious traffic to form a first domain name range; The first IP address range, the first MAC address range, the first website address range and the first domain name range are aggregated into a suspicious value range.

4. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 3 is characterized in that: The forming of a reliable value range of the access restriction indicator set based on the reliable traffic comprises the following steps: Aggregate the IP addresses that generate reliable traffic to form a second IP address range; Aggregate the MAC addresses that generate reliable traffic to form a second MAC address range; Aggregate the URLs that generate reliable traffic to form a second URL range; Aggregate the domain names that generate reliable traffic to form a second domain name range; The second IP address range, the second MAC address range, the second website address range and the second domain name range are aggregated into a reliable value range.

5. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 4 is characterized in that: The method of classifying the suspicious traffic generated in the suspicious value interval into malicious traffic and unrecognizable traffic comprises the following steps: Intersect the suspicious block with the suspicious traffic generated by the suspicious value interval to obtain the suspicious local block; Suspicious local blocks are aggregated into malicious traffic, and the part of suspicious traffic generated in the suspicious value interval except malicious traffic is regarded as unrecognizable traffic.

6. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 5 is characterized in that: The forming of at least one blocking scheme based on the blocked area includes the following steps: Randomly arrange the restricted areas to be sealed to form a sequence of restricted areas to be sealed; A digital set is formed, the digital set is composed of at least one digital sequence, the digital sequence is randomly composed of 0 and 1, at least one digital sequence contains all possible combinations of 0 and 1, and the length of the digital sequence is equal to the length of the sequence of the restricted area to be sealed; Assign the numbers in the digital sequence to the restricted areas to be sealed in sequence in order; When the number assigned to the restricted area to be sealed is 1, the restricted area to be sealed will be used as the target restricted area, otherwise, no processing will be performed; The target blocked areas formed by the single digital sequences are summarized as the blocking plan.

7. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 6 is characterized in that: The calculation of the blocking efficiency of the to-be-blocked solution comprises the following steps: The characteristic damages of the restricted areas to be blocked are accumulated to obtain the total damages. The characteristic damages of the target restricted areas are divided by the total damages to obtain the weight of the unrecognizable traffic in the target restricted areas. Accumulate the number of unrecognizable items in the restricted areas to be sealed to obtain the total number of unrecognizable items; Use the comprehensive blocking formula to calculate the blocking efficiency of the solution to be blocked; The comprehensive ban formula is as follows: , Among them, A is the blocking efficiency of the blocking scheme to be blocked, i is the subscript, and n is the total number of target blocking areas in the blocking scheme to be blocked. is the number of unrecognizable areas in the i-th target blocking area, is the weight of the unrecognizable traffic between the i-th target blocked areas, and B is the total unrecognizable volume.

8. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 7 is characterized in that: The calculation of the reliable data blocking impact value of the to-be-blocked solution comprises the following steps: Establish a mechanism to identify data costs; Take the intersection of at least one target blocked area in the blocking scheme and a single reliable value interval respectively and take the union of the intersection results to obtain a reliable blocked area, then each reliable value interval will form a corresponding reliable blocked area; The reliable traffic generated by the reliable value interval is used in the data cost identification mechanism to obtain the data cost of the reliable value interval; Evenly divide the reliable value interval into at least one calibration interval, and use the part of the reliable flow generated by the reliable value interval appearing in the calibration interval as characteristic data; The calibration interval that appears in the reliable blocked area is used as the target calibration interval; Accumulate the amount of characteristic data of the target calibration interval in the reliable blocked area to obtain the total amount of reliable blocked areas; Use a reliable comprehensive formula to calculate the reliable data blocking impact value of the solution to be blocked; The reliable comprehensive formula is as follows: , Among them, C is the reliable data blocking impact value of the blocking solution to be blocked, j is the subscript, and m is the total number of reliable blocking areas. is the total amount of reliable bans in the jth reliable value interval, is the data cost of the jth reliable value interval.

9. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 8 is characterized in that: The data cost identification mechanism is as follows: The flow of the input data cost identification mechanism is used as the flow to be identified, and features of the flow to be identified are extracted to obtain at least one key feature; Using a clustering algorithm to merge the key features to obtain at least one key feature classification; Randomly obtain key features in the key feature classification as sample key features; Obtain the missing cost and data necessity of the sample key feature, multiply the missing cost and data necessity of the sample key feature to obtain the initial cost of the sample key feature, and assign the initial cost to the key feature category where the sample key feature belongs; Use the comprehensive cost formula to calculate the data cost of the traffic to be identified; The comprehensive cost formula is as follows: , Where D is the data cost of the traffic to be identified, k is the subscript, and q is the total number of key feature categories. is the initial cost of classifying the kth key feature, is the number of key features in the kth key feature classification; The data necessity is obtained as follows: The part of the reliable traffic except the traffic to be identified is used as the traffic to be evaluated; Form at least one data-approximate feature for the key feature, where the data-approximate feature is a feature that has the same function and purpose as the key feature; When the key feature or data approximation feature appears in the traffic to be evaluated, the data necessity is 0, otherwise, the data necessity is 1.

10. The method for controlling an Internet of Things router based on application scenario network environment adaptation according to claim 9, characterized in that: The method of using the target blocking solution to block traffic includes the following steps: When the target blocking zone of the target blocking scheme is generated by IP addresses, the IP addresses belonging to the target blocking zone are blocked; When the target blocking zone of the target blocking scheme is generated by the MAC address, the MAC address belonging to the target blocking zone is blocked; When the target blocking zone of the target blocking scheme is generated by a URL, the URL belonging to the target blocking zone is blocked; When the target blocking zone of the target blocking scheme is generated by domain names, the domain names belonging to the target blocking zone are blocked.

Images