Internet of Things equipment networking security auditing method, system, equipment and medium

Abstract

The invention discloses an Internet of Things equipment networking security auditing method and system, equipment and a medium, and relates to the technical field of Internet of Things security, and the method comprises the steps: recognizing a normal behavior mode of the equipment according to acquired operation mode data and network flow data, and constructing a dynamic security baseline; analyzing the networking network flow of the target Internet of Things equipment by using a deep learning model, and evaluating the risk level of each data flow according to the dynamic security baseline; generating a security policy comparison table according to the risk level; acquiring a security policy adjustment reference range representing a security policy adjustment threshold, and generating a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table; acquiring current network flow data and inputting the current network flow data into the security policy adjustment model; adjusting the networking security policy of the target Internet of Things equipment based on the calculated equipment security risk data; the Internet of Things security auditing mechanism can adapt to a dynamic environment and new attacks, and the security early warning and response efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of Internet of Things security technology, and in particular to a method, system, device and medium for security auditing of Internet of Things device networking. Background Art

[0002] With the widespread application of IoT technology, the security issues of IoT devices have become increasingly prominent, especially the frequent illegal access and network attacks, which have affected the stable operation and data security of the IoT system. At present, IoT security protection technologies mainly include device identity authentication, encrypted transmission, access control and other measures, but in the large-scale heterogeneous device networking environment, there is a lack of effective security audit mechanism, making it difficult to monitor network status and abnormal behavior in real time.

[0003] Existing IoT devices generally use static security audit strategies based on rule matching, relying on preset security rules to detect potential threats. However, this static strategy is difficult to cope with the dynamically changing IoT environment and cannot detect new attack patterns in a timely manner, resulting in delayed security response and easily causing security risks.

[0004] In summary, the existing IoT security audit mechanism has poor flexibility and insufficient adaptability, making it difficult to effectively cope with complex and changing network environments and emerging attack methods, resulting in inefficient security warning and response, which urgently needs to be improved. Summary of the invention

[0005] In order to solve the problem that the existing IoT security audit mechanism is difficult to adapt to dynamic environments and new attacks and to improve the efficiency of security warning and response, the present application provides a method, system, device and medium for IoT device network security audit.

[0006] In the first aspect, the invention objective of the present application is achieved by adopting the following technical solutions: A method for security auditing of Internet of Things devices, comprising: Obtain the operation mode data and network traffic data of the devices in the target IoT device network; According to the operation mode data and network traffic data, a normal behavior mode of the device is identified, and a corresponding dynamic security baseline is constructed; Analyze the network traffic of the target IoT device network using a deep learning model, and evaluate the risk level of each data flow according to the dynamic security baseline; Generate a security policy comparison table for adjusting the security policy according to the risk level; and obtain a security policy adjustment reference range representing a security policy adjustment threshold, and generate a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table; Acquire current network traffic data, input the current network traffic data into the security policy adjustment model, calculate device security risk data of the entire target IoT device network, and adjust the security policy of the target IoT device network based on the device security risk data.

[0007] By adopting the above technical solution, the operation mode data of the device includes the operation status of the device and the containment parameters. The network traffic data is used to reflect the communication status between the devices in the target IoT device network. Through the operation mode data and network traffic data, we can fully understand the actual operation of the device in the network, identify the normal behavior mode of the device (also known as standard, typical behavior mode), build a dynamic security baseline, and provide a benchmark for the subsequent security assessment of IoT devices; by using deep learning models to analyze network traffic data, IoT device networks are analyzed in real time to identify abnormal behaviors, and the risk level of each data stream and data packet is evaluated through dynamic security baselines to timely discover potential security threats; by The risk level of the data flow is compared with the preset security policy to generate a security policy comparison table, which helps to clarify the specific security measures corresponding to different risk levels; then, by defining the threshold range for security policy adjustment and combining it with the security policy comparison table, a security policy adjustment model is generated to dynamically adjust the security policy according to real-time risk data to ensure that the system of the target IoT device network is in the best security protection state and improve the efficiency of security warning and response; thus, this application solves the problem that the existing IoT security audit mechanism is difficult to adapt to dynamic environments and new attacks through security audit prevention mechanisms such as comprehensive monitoring, dynamic security baselines, real-time analysis, flexible adjustment and efficient protection, thereby improving the efficiency of security warning and response.

[0008] In a preferred example of the present application, the current network traffic data is obtained, the current network traffic data is input into the security policy adjustment model, and the device security risk data of the entire target IoT device network is calculated, including: Acquire current network traffic data, and input the current network traffic data into the security policy adjustment model; In the security policy adjustment model, the audit scope is determined in combination with the network topology structure and basic device information of the target IoT network; Evaluate the device security performance of each IoT device based on the preset security audit factors to obtain the corresponding device security index; According to the device security index, combined with the device connection relationship in the network topology, the security risk data of the entire target Internet of Things network is analyzed and calculated.

[0009] By adopting the above technical solution, the current network traffic data is obtained in real time, ensuring the timeliness and accuracy of the data when conducting security audit analysis. The real-time data is analyzed using the security policy adjustment model to ensure the real-time and dynamic nature of the security audit. In addition, the network topology and basic equipment information are combined to identify the key areas and key equipment for the audit, thereby improving the pertinence and efficiency of the audit. Through the preset security audit factors, a comprehensive security performance assessment is conducted on each IoT device, and a detailed device security index is obtained. Then, based on a comprehensive multi-factor assessment, the reliability and practicality of the security management and risk assessment of IoT device networking are improved.

[0010] In a preferred example of the present application: the security risk data includes device behavior risk data and network traffic risk data; the security risk data of the entire target IoT network is analyzed and calculated based on the device security index and combined with the device connection relationship in the network topology structure, including: Generate multiple device behavior units in the IoT environment of the target IoT device network based on the device security index, the operation mode data, and the device connection relationship in the network topology structure; Taking each device behavior unit as a basic unit, performing device behavior analysis according to a preset first evaluation factor to obtain a corresponding device behavior score, and calculating corresponding device behavior risk data according to the device behavior score; Taking each device behavior unit as a basic unit, performing network traffic analysis according to a preset second evaluation factor to obtain a corresponding network traffic score, and calculating corresponding network traffic risk data according to the network traffic score; Based on the device behavior risk data and network traffic risk data corresponding to each of the device behavior units, a comprehensive security audit result is generated.

[0011] By adopting the above technical solution, combining the device security index, operation mode data and device connection relationship in the network topology structure, multiple device behavior units are generated, which ensures the accuracy and meticulousness of the device behavior analysis and can more comprehensively reflect the behavior mode of the device in actual operation; through the preset first evaluation factor, a comprehensive behavior analysis is performed on each device behavior unit to obtain a detailed device behavior score, which can evaluate the behavior risk of the device from multiple dimensions and ensure the comprehensiveness of the risk assessment; through the preset second evaluation factor, a comprehensive analysis is performed on the network traffic of each device behavior unit to obtain a detailed network traffic score, which can evaluate the risk of network traffic from multiple dimensions. The comprehensive security audit results provide a scientific basis for the security management and risk prevention and control of the Internet of Things system, thereby improving the overall security of the Internet of Things system.

[0012] In a preferred example of the present application, the generating of multiple device behavior units in the IoT environment of the target IoT device network based on the device security index, the operation mode data and the device connection relationship in the network topology structure specifically includes: Preprocessing the device operation mode data and the network topology data in the IoT environment to obtain preprocessed device operation mode data and device connection relationship data; generating a device behavior pattern diagram based on the preprocessed device operation mode data; According to the device behavior pattern diagram and the device connection relationship data, calculating the correlation data between the devices, and generating a device connection relationship diagram; Generate an initial device behavior unit according to the device connection relationship diagram and the preprocessed device operation mode data; The initial device behavior unit is modified according to the device safety index and the device connection relationship data to form a final device behavior unit.

[0013] By adopting the above technical solutions, data preprocessing eliminates noise and redundant data, ensuring the accuracy and efficiency of subsequent analysis; by generating a device behavior pattern diagram, the operation mode of the device is intuitively displayed, and the visualization method helps regulators and machine learning algorithms to quickly identify the normal behavior pattern and abnormal behavior of the device. Then, by generating an initial device behavior unit, the devices in the IoT environment are divided into multiple fine-grained behavior units, each of which contains a group of devices with similar behavior patterns, making the objects of security audits more specific and detailed, and improving the accuracy and efficiency of the audit; finally, by combining the device security index and device connection relationship data, the initial device behavior unit is corrected to ensure the accuracy and representativeness of each behavior unit. The final device behavior unit can better reflect the real behavior pattern of the device and provide a reliable basis for subsequent risk assessment.

[0014] In a preferred example of the present application, each device behavior unit is used as a basic unit, and device behavior analysis is performed according to a preset first evaluation factor to obtain a corresponding device behavior score, and corresponding device behavior risk data is calculated according to the device behavior score, specifically including: The first evaluation factor includes device type, device online time, device online duration, device communication frequency, device data transmission volume, and number of abnormal device behaviors; Divide the device behavior units in the Internet of Things environment evenly, determine all devices involved in a single device behavior unit, and assign a value to each device in the single device behavior unit according to a first evaluation factor to obtain a first device score; Taking the arithmetic average of the first device scores of all devices involved in a single device behavior unit, calculating the first evaluation factor discrimination score of the single device behavior unit, and using the first evaluation factor discrimination score and the comprehensive index method to calculate the device behavior score; Calculating corresponding device behavior risk data according to the device behavior score; and / or, The calculating corresponding device behavior risk data according to the device behavior score specifically includes: Acquire historical security event data, and acquire abnormal probability data of device behavior units based on the historical security event data; The device behavior risk data is calculated using the device behavior score and the abnormal probability data of the device behavior unit.

[0015] By adopting the above technical solution and introducing the first evaluation factors of multiple dimensions, the behavioral characteristics of the device can be comprehensively evaluated to ensure the accuracy and reliability of the device behavior analysis. The first evaluation factor covers the basic properties and behavioral characteristics of IoT devices and can effectively identify the normal and abnormal behaviors of the device. By evenly dividing the device behavior units, the number of devices in each unit is ensured to be moderate, which is convenient for refined analysis. Each device is assigned a value according to the first evaluation factor to obtain a first device score. The first evaluation factor discrimination score of the device behavior unit is calculated by arithmetic averaging, and the device behavior score is calculated by the comprehensive index method to ensure the scientificity and objectivity of the scoring result, so as to comprehensively consider the influence of multiple first evaluation factors and improve the accuracy of the scoring result. Furthermore, through the device behavior score, the device behavior risk data is calculated, which can quantitatively evaluate the risk level of the device behavior, help identify high-risk device behavior units, take preventive measures in advance, and reduce security risks.

[0016] In a preferred example of the present application, the network traffic analysis is performed based on each device behavior unit as a basic unit according to a preset second evaluation factor to obtain a corresponding network traffic score, and the corresponding network traffic risk data is calculated based on the network traffic score, specifically including: The second evaluation factor includes network traffic size, traffic peak time, traffic direction, protocol type, data packet length and abnormal traffic ratio; Evenly divide the device behavior units in the Internet of Things environment, determine all network connections involved in a single device behavior unit, and assign a value to each network connection in the single device behavior unit according to a second evaluation factor to obtain a second network connection score; Taking the arithmetic average of the second network connection scores of all network connections involved in a single device behavior unit, calculating the second evaluation factor discrimination score of the single device behavior unit, and using the second evaluation factor discrimination score and the comprehensive index method to calculate the network traffic score; Corresponding network traffic risk data is calculated according to the network traffic score.

[0017] By adopting the above technical solution and introducing the second evaluation factors of multiple dimensions, the characteristics of network traffic can be comprehensively evaluated to ensure the accuracy and comprehensiveness of network traffic analysis. Multiple second evaluation factors cover the basic properties and abnormal characteristics of network traffic and can effectively identify normal traffic and abnormal traffic. By evenly dividing the network connections within the device behavior unit, the number of network connections in each unit is ensured to be moderate, which is convenient for refined analysis. Each network connection is assigned a value according to the second evaluation factor to obtain a second network connection score. The second evaluation factor discrimination score of the device behavior unit is calculated by arithmetic averaging, and the network traffic score is calculated by the comprehensive index method to ensure the scientificity and objectivity of the scoring results. Through the network traffic score, the network traffic risk data is calculated, which can quantitatively evaluate the risk level of the network traffic.

[0018] In a preferred example of the present application: the generating of a comprehensive security audit result based on the device behavior risk data and the network traffic risk data corresponding to each of the device behavior units specifically includes: Taking each device behavior unit as the basic unit, the corresponding device behavior risk data is used as the row vector data, and the corresponding network traffic risk data is used as the column vector data, which are input into the preset security risk discrimination matrix to obtain the corresponding security risk level data; Based on the security risk level data corresponding to each device behavior unit, a comprehensive security audit result of the Internet of Things network is generated.

[0019] In the second aspect, the invention objective of the present application is achieved by adopting the following technical solutions: A security audit system for Internet of Things devices, the system comprising: A data acquisition module is used to acquire the operation mode data and network flow data of the devices in the target IoT device network; A dynamic security baseline building module, used to identify the normal behavior mode of the device according to the operation mode data and the network traffic data, and build a corresponding dynamic security baseline; A risk assessment module, used to analyze the network traffic of the target IoT device network using a deep learning model, and assess the risk level of each data flow according to the dynamic security baseline; A security policy generation module, configured to generate a security policy comparison table for adjusting the security policy according to the risk level, obtain a security policy adjustment reference range representing a security policy adjustment threshold, and generate a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table; The security audit module is used to obtain current network traffic data, input the current network traffic data into the security policy adjustment model, calculate the device security risk data of the entire target Internet of Things device network, and adjust the security policy of the target Internet of Things device network based on the device security risk data.

[0020] In the third aspect, the invention objective of the present application is achieved by adopting the following technical solutions: A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned method for security auditing of Internet of Things devices are implemented.

[0021] In a fourth aspect, the invention objective of the present application is achieved by adopting the following technical solutions: A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned method for security auditing of Internet of Things devices.

[0022] In summary, the present application includes at least one of the following beneficial technical effects: 1. By comparing the risk level of each data flow with the preset security policy, a security policy comparison table is generated. The security policy comparison table helps to clarify the specific security measures corresponding to different risk levels. Then, by defining the threshold range for security policy adjustment and combining it with the security policy comparison table, a security policy adjustment model is generated to dynamically adjust the security policy according to real-time risk data, ensuring that the target IoT device networking system is in the best security protection state and improving security warning and response efficiency. 2. Inputting the device behavior risk data and network traffic risk data as row vectors and column vectors into the preset security risk judgment matrix respectively can systematically evaluate the security risk of each device behavior unit. The security risk judgment matrix can calculate the security risk level data of each device behavior unit based on the device behavior risk data and network traffic risk data. The security risk level data can reflect the risk level of each device behavior unit in detail, providing an accurate basis for subsequent security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a flow chart of a method for security auditing of IoT devices in one embodiment of the present application; Figure 2 This is a flowchart of step S5 in a method for security auditing of an Internet of Things device network in one embodiment of the present application; Figure 3 It is a schematic diagram of a device in an embodiment of the present application. DETAILED DESCRIPTION

[0024] The present application is further described in detail below in conjunction with the accompanying drawings.

[0025] In one embodiment, if Figure 1 As shown, the present application discloses a method for security auditing of IoT device networking, which specifically includes the following steps: S1: Obtain the operation mode data and network traffic data of the devices in the target IoT device network.

[0026] In this embodiment, the operating mode data includes information such as the working status, operation log, and device configuration of the IoT device; the network traffic data includes information such as the data transmission volume, transmission time, and transmission frequency between IoT devices and between IoT devices and external networks.

[0027] Specifically, use network monitoring tools and log management systems to collect device operation mode data, and capture network flow data through network traffic analysis tools (such as Wireshark, NetFlow, etc.).

[0028] S2: Based on the operation mode data and network traffic data, identify the normal behavior pattern of the device and build the corresponding dynamic security baseline.

[0029] In this embodiment, the normal behavior pattern is a typical behavior pattern and a regular behavior pattern of an IoT device, and the dynamic security baseline is a benchmark for subsequent security assessment and anomaly detection.

[0030] Specifically, statistical analysis methods (such as mean, standard deviation, etc.) and time series analysis methods (such as ARIMA model) are used to identify the normal behavior patterns of equipment; combined with machine learning algorithms (such as clustering algorithms, decision trees, etc.) to further optimize the identification of normal behavior patterns.

[0031] S3: Use deep learning models to analyze the network traffic of the target IoT device network and evaluate the risk level of each data flow based on the dynamic security baseline.

[0032] In this embodiment, the security policy adjustment model is used to guide how to adjust the security policy according to the risk level. Specifically, select a suitable deep learning model (such as LSTM, CNN, etc.) for network traffic analysis. When training the model, use known normal traffic and abnormal traffic data as the training set, set the risk assessment standard according to the dynamic security baseline, for example, the greater the deviation from the baseline, the higher the risk level, use the model to evaluate real-time network traffic, and output the risk level of each data flow. S4: Generate a security policy comparison table for adjusting the security policy according to the risk level; and obtain a security policy adjustment reference range representing the security policy adjustment threshold, and generate a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table.

[0033] In this embodiment, the security policy comparison table is a tool for comparing and verifying security policies of different versions or between different organizations to ensure the consistency and integrity of the security policies.

[0034] Specifically, data flows are classified into different levels (such as low risk, medium risk, and high risk) according to risk levels, corresponding security policy adjustment measures are defined for each risk level, a security policy comparison table is generated, and security policy adjustment thresholds are set. For example, when the proportion of high-risk data flows exceeds a certain threshold, security policy adjustment is triggered.

[0035] S5: Obtain current network traffic data, input the current network traffic data into the security policy adjustment model, calculate the device security risk data of the entire target IoT device network; and adjust the security policy of the target IoT device network based on the device security risk data.

[0036] In this embodiment, the adjustment measures may include but are not limited to adding firewall rules, restricting access rights of certain devices, updating device firmware, etc.

[0037] In one embodiment, if Figure 2 As shown, in step S5, the current network traffic data is obtained, the current network traffic data is input into the security policy adjustment model, and the device security risk data of the entire target IoT device network is calculated, including: S51: Acquire current network traffic data, and input the current network traffic data into a security policy adjustment model.

[0038] In this embodiment, the current network traffic data includes information such as the amount of data transmitted between devices, the transmission time, and the transmission frequency.

[0039] S52: In the security policy adjustment model, the audit scope is determined based on the network topology and basic device information of the target IoT network.

[0040] In this embodiment, the network topology diagram of the target IoT network is obtained, the connection relationship between devices is understood, and the basic information of each device is collected. The basic information of the device includes the device type, model, operating system, firmware version, etc. According to the network topology and basic information of the device, the devices and network connection scope that need to be security audited are determined, and the determined audit scope is input into the security policy adjustment model for subsequent analysis and evaluation.

[0041] S53: Evaluate the device security performance of each IoT device according to the preset security audit factor to obtain a corresponding device security index.

[0042] In this embodiment, the security audit factors include, but are not limited to, the device's firmware version, security patch status, network connection security, encryption method, data privacy, and access control policy, etc., which can be customized according to specific needs.

[0043] Specifically, after determining several security review factors that affect the security of IoT devices, a scoring standard is designed for each security audit factor, and the evaluation results of each factor are quantified into scores. The scoring standard can be divided into several levels, for example: Excellent (5 points): Fully complies with security requirements and has no known vulnerabilities.

[0044] Good (4 points): Most of the security requirements are met, with a few minor vulnerabilities.

[0045] General (3 points): basically meets security requirements, but has some moderate vulnerabilities.

[0046] Poor (2 points): Partially meets security requirements but has many serious vulnerabilities.

[0047] Poor (1 point): Does not meet security requirements and has major vulnerabilities.

[0048] Next, collect device-related information of the IoT device, including but not limited to device model and manufacturer, firmware version, current configuration, usage environment, known security issues and vulnerabilities, and then calculate the comprehensive security index of the device based on the determined security audit factors and scoring criteria. The weighted average method can be used to calculate the corresponding device security index.

[0049] S54: Based on the device security index and in combination with the device connection relationship in the network topology, the security risk data of the entire target IoT network is analyzed and calculated.

[0050] In this embodiment, the security risk data reflects the security status and potential risks of the entire network; the security index of each device is mapped to the network topology to form a device security index graph, the device connection relationship is analyzed, the critical paths and high-risk nodes are identified, and graph theory algorithms (such as the shortest path algorithm, the maximum flow algorithm, etc.) are used to analyze the connectivity and security of the network. The security risk data of the entire network is calculated by combining the device security index and the network connection relationship. The security risk data may include the overall risk score of the network, the risk score of the critical path, the risk score of the high-risk node, etc.

[0051] In this embodiment, the security audit method includes performing a detailed audit on each device according to the determined security audit factors and scoring criteria, and recording the audit results. The audit result recording format is as follows: Device Name Security Audit Factor score Problem Description Device A Authentication mechanisms 4 Password complexity requirements are low Device A Encryption 5 Use the latest encryption algorithms Device A Access Control 3 Some users have too much permissions Device B Firmware Security 2 The firmware version is too old and has known vulnerabilities Device B Physical Security 4 Anti-disassembly function is effective Device C Logging and Monitoring 5 Full logging and real-time monitoring Device C Cybersecurity 3 Some ports are not closed In one embodiment, in step S54, the security risk data includes device behavior risk data and network traffic risk data; according to the device security index, combined with the device connection relationship in the network topology structure, the security risk data of the entire target Internet of Things network is analyzed and calculated, including: S541: Generate multiple device behavior units in an IoT environment of a target IoT device network based on a device security index, operation mode data, and a device connection relationship in a network topology structure.

[0052] In this embodiment, a device behavior unit refers to a group of devices with the same or similar behavioral characteristics in an IoT environment. In order to cope with the situation where there are massive IoT devices in the target IoT device network and improve the audit effect of security audits, this application will classify several IoT devices with the same or similar characteristics in the IoT environment into a device behavior unit.

[0053] Specifically, according to the device safety index, operation mode data and device connection relationship in the network topology, clustering algorithms (such as K-means, DBSCAN, etc.) are used to group the devices and generate multiple device behavior units.

[0054] S542: Taking each device behavior unit as a basic unit, perform device behavior analysis according to a preset first evaluation factor to obtain a corresponding device behavior score, and calculate corresponding device behavior risk data according to the device behavior score.

[0055] In this embodiment, the first evaluation factor includes device type, device online time, device online duration, device communication frequency (referring to the number of times the device communicates within a certain period of time), device data transmission volume and the number of abnormal behaviors of the device (referring to the number of abnormal behaviors of the device within a certain period of time, such as frequent restarts, communication interruptions, etc.).

[0056] Specifically, statistical analysis methods (such as mean, standard deviation, etc.) and time series analysis methods (such as ARIMA model) are used to analyze the equipment behavior of each equipment behavior unit, and each equipment behavior unit is scored according to the preset first evaluation factor weight and scoring criteria.

[0057] For example, you can perform statistical analysis on the collected device behavior data, such as calculating the mean and standard deviation of each device behavior data (the standard deviation evaluates the volatility of the data), drawing a histogram or box plot, and observing the distribution of the data; use time series analysis methods (such as the ARIMA model) to conduct in-depth analysis of the device behavior data: select appropriate ARIMA model parameters (p, d, q), model the device behavior data, use historical data to train the ARIMA model, and use the trained model to predict future behavior data.

[0058] According to the preset first evaluation factor weight and scoring criteria, each device behavior unit is scored. First, the weight is set: assign weights to each evaluation factor, for example: device type: 0.1, device online time: 0.1, device online time: 0.2, device communication frequency: 0.2, device data transmission volume: 0.2, number of device abnormal behavior: 0.2; then set scoring criteria for each evaluation factor, for example: device type: common device types get 1 point, special device types get 2 points, device online time: online time of more than 1 year gets 1 point, less than 1 year gets 0.5 points; device online time: average online time greater than 10 hours gets 2 points, 5-10 hours gets 1 point, less than 5 hours gets 0.5 points; device communication frequency: communication per minute. 2 points will be awarded if the number of messages is greater than 10 times, 1 point will be awarded if it is 5-10 times, and 0.5 point will be awarded if it is less than 5 times; device data transmission volume: 2 points will be awarded if the daily data transmission volume is greater than 1MB, 1 point will be awarded if it is 500KB-1MB, and 0.5 point will be awarded if it is less than 500KB; number of abnormal device behaviors: 2 points will be awarded if the number of abnormal behaviors per month is less than 5 times, 1 point will be awarded if it is 5-10 times, and 0.5 point will be awarded if it is more than 10 times; then, the score of each device behavior unit is calculated based on the weight and scoring criteria: the device behavior score is equal to the sum of the scores of each first evaluation factor and the corresponding weight coefficient multiplied together; finally, based on the device behavior score, the corresponding device behavior risk data is calculated; the device behavior risk data of device A is equal to the device behavior score of device A divided by the total score of a group of devices in the entire device behavior unit.

[0059] S543: Taking each device behavior unit as a basic unit, perform network traffic analysis according to a preset second evaluation factor to obtain a corresponding network traffic score, and calculate corresponding network traffic risk data according to the network traffic score.

[0060] In this embodiment, the second evaluation factor includes network traffic size, traffic peak time, traffic direction, protocol type, data packet length and abnormal traffic ratio.

[0061] Specifically, a network traffic analysis tool (such as Wireshark, NetFlow, etc.) is used to analyze the network traffic of each device behavior unit, and then each device behavior unit is scored according to the preset second evaluation factor weight and scoring criteria (the network traffic scoring method of each device behavior unit is the same as the device behavior scoring method, and the calculation of the network traffic risk data of each device behavior unit is the same as the device behavior risk data, which will not be repeated here).

[0062] S544: Generate a comprehensive security audit result based on the device behavior risk data and network traffic risk data corresponding to each device behavior unit.

[0063] In this embodiment, calculations are performed based on the device behavior risk data and network traffic risk data of each device behavior unit, and a weighted average method is used to calculate a comprehensive score for each device behavior unit. According to the comprehensive score, the device behavior units are divided into different risk levels (such as low risk, medium risk, and high risk), and a comprehensive security audit report is generated, including the comprehensive score, risk level, main risk points, and recommended improvement measures for each device behavior unit.

[0064] In one embodiment, in step S541, multiple device behavior units are generated in the IoT environment of the target IoT device network based on the device security index, the operation mode data, and the device connection relationship in the network topology structure, specifically including: S5411: Preprocess the device operation mode data and network topology data in the IoT environment to obtain preprocessed device operation mode data and device connection relationship data.

[0065] In this embodiment, the device operation mode data includes the operation mode data obtained by collecting the device's operation status, communication frequency, data transmission volume, and number of abnormal behaviors from sources such as device logs, sensor data, and network traffic; the network topology structure data refers to the connection relationship data between devices collected from sources such as network configuration files, routing tables, and topology maps.

[0066] S5412: Generate device behavior pattern diagram based on preprocessed device operation mode data Specifically, the statistical indicators such as the mean and standard deviation of the operation mode data of each device are calculated, and the devices with similar behavior patterns are grouped using the K-means or DBSCAN clustering algorithm.

[0067] S5413: Calculate the correlation data between devices based on the device behavior pattern diagram and the device connection relationship data, and generate a device connection relationship diagram.

[0068] In this embodiment, the cosine similarity or Jaccard similarity method is used to calculate the behavioral similarity between devices, and the connection strength between devices is calculated based on the network topology data, for example, through indicators such as path length and bandwidth. Then, a graph theory method is used to construct a device connection relationship diagram, in which nodes represent devices and edges represent connection relationships between devices. A graphical tool (such as Gephi, NetworkX) is used to display the device connection relationship diagram.

[0069] S5414: Generate an initial device behavior unit according to the device connection relationship diagram and the processed device operation mode data.

[0070] In this embodiment, a unique identifier and description information, i.e., a device tag, is generated for each initial device behavior unit, and then key attributes of each behavior unit are extracted, such as the number of devices, behavior patterns, connection relationships, etc., and devices with similar behavior patterns and close connection relationships are divided into the same initial device behavior unit.

[0071] S5415: Modify the initial device behavior unit according to the device safety index and the device connection relationship data to form a final device behavior unit.

[0072] In this embodiment, the overall security of each initial device behavior unit is evaluated based on the device security index, and devices with lower security indexes are identified, separated from the current behavior unit, and managed separately to complete the security index verification; then the division of the behavior units is optimized based on the device connection relationship data to ensure that the device connection relationship within the unit is closer, the boundaries of the behavior units are adjusted, and devices are removed or added to complete the connection relationship verification, confirm the members and attributes of each final device behavior unit, and generate a detailed device behavior unit report, including a unit member list, behavior pattern, connection relationship, and security assessment results.

[0073] In one embodiment, in step S542, each device behavior unit is used as a basic unit, and device behavior analysis is performed according to a preset first evaluation factor to obtain a corresponding device behavior score, and corresponding device behavior risk data is calculated according to the device behavior score, specifically including: S5241: Divide the device behavior units in the IoT environment evenly, determine all devices involved in a single device behavior unit, assign a value to each device in the single device behavior unit according to a first evaluation factor, and obtain a first device score.

[0074] In this embodiment, the first evaluation factor is a series of important indicators for evaluating the behavior of IoT devices, including device type, device online time (the time when the device is first connected to the IoT), device online time, device communication frequency, device data transmission volume, and number of abnormal device behaviors; the device behavior score is a score obtained after a comprehensive evaluation of the device behavior, reflecting the normality of the device behavior; the device behavior risk data is data calculated based on the device behavior score, reflecting the risk level of the device behavior.

[0075] S5242: Take the arithmetic average of the first device scores of all devices involved in a single device behavior unit, calculate the first evaluation factor discrimination score of the single device behavior unit, and use the first evaluation factor discrimination score and the comprehensive index method to calculate the device behavior score.

[0076] Specifically, all device behavior units are evenly divided into several groups, each group contains a certain number of devices; the first evaluation factor data of each device is collected from sources such as device logs, sensor data, network traffic, etc., and a corresponding score is assigned to each evaluation factor according to the pre-set scoring rules, for example: Equipment Type: Different types of equipment are assigned different scores.

[0077] Equipment online time: The earlier the online time, the higher the score may be.

[0078] Device online time: The longer the online time, the higher the score may be.

[0079] Device communication frequency: The communication frequency is moderate, and the score may be high.

[0080] Device data transfer volume: The data transfer volume is moderate, and the score may be higher.

[0081] Number of abnormal device behaviors: The fewer the number of abnormal behaviors, the higher the score is likely to be.

[0082] Then, according to the weighted summation method, the total score of each device is calculated according to the weight of each evaluation factor. First, the first device scores of all devices in a single device behavior unit are arithmetic averaged to obtain the first evaluation factor discrimination score of the unit. Then, weights are assigned to each evaluation factor to reflect its importance in the evaluation. The comprehensive index method is used to combine the first evaluation factor discrimination score and weight to calculate the device behavior score.

[0083] S5243: Calculate corresponding device behavior risk data based on the device behavior score.

[0084] In this embodiment, device behavior risk data refers to quantitative data reflecting the potential risk of device behavior calculated by comprehensively evaluating the behavioral characteristics and historical security events of IoT devices. It is used to evaluate the security status of devices in a specific time period, helping administrators identify potential security threats and take corresponding preventive measures; setting thresholds for different risk levels, such as low risk (0-30 points), medium risk (31-60 points), and high risk (61-100 points), and then dividing device behavior units into different risk levels according to the device behavior score to obtain device behavior risk data.

[0085] Specifically, in step S5243, the corresponding device behavior risk data is calculated according to the device behavior score, which specifically includes: S52431: Obtain historical security event data, and obtain abnormal probability data of device behavior units based on the historical security event data.

[0086] S52432: Calculate device behavior risk data using device behavior scores and abnormal probability data of device behavior units.

[0087] In this example, assume that we have a device behavior unit that contains the following devices (as shown in the following table): Device Name Device Type Online time Online time (hours) Communication frequency (times / minute) Data Transfer Volume (MB / Day) Number of abnormal behaviors (times / month) Device A common 2022 / 1 / 1 12 8 1.2 3 Device B special 2022 / 6 / 1 8 12 0.8 7 Device C common 2021 / 12 / 1 15 5 1.5 2 Assignment rules: Device type: 1 point for common devices, 2 points for special devices. Online time: 1 point for online time of more than 1 year, 0.5 point for less than 1 year. Online time: 2 points for online time of more than 10 hours, 1 point for 5-10 hours, and 0.5 point for less than 5 hours. Communication frequency: 2 points for more than 10 communications per minute, 1 point for 5-10 times, and 0.5 point for less than 5 times. Data transmission volume: 2 points for daily data transmission volume greater than 1MB, 1 point for 500KB-1MB, and 0.5 point for less than 500KB. Number of abnormal behaviors: 2 points for less than 5 abnormal behaviors per month, 1 point for 5-10 times, and 0.5 points for more than 10 times.

[0088] Calculation score: Device A: 1×0.1+1×0.1+2×0.2+1×0.2+2×0.2+1×0.2=1.4; Device B: 2×0.1+0.5×0.1+1×0.2+2×0.2+0.5×0.2+1×0.2=1.45; Device C: 1×0.1+1×0.1+2×0.2+0.5×0.2+2×0.2+2×0.2=1.6; Arithmetic mean: Device behavior unit score: (1.4+1.45+1.6) / 3=1.483.

[0089] Step 2: Calculate the abnormal probability data of the device behavior unit Assume that the number of abnormal events in the device behavior unit in the past year is 12 times, and the total number of devices in the unit is 3. Calculate the abnormal probability: 12 times / (3 devices × 12 months) = 0.333.

[0090] Step 3: Calculate device behavior risk data Weight setting: Assume that the weight of the device behavior score is 0.7 and the weight of the abnormal probability data is 0.3.

[0091] Device behavior risk data: (1.483×0.7)+(0.333×0.3)=1.0821.

[0092] Through the above steps, we obtain the device behavior risk data of the device behavior unit as 1.0821, which reflects the comprehensive risk level of the device behavior unit.

[0093] Specifically, the device behavior score is 1.483, indicating that the device behavior is relatively normal; the abnormal probability is 0.333, indicating that the device behavior unit has a certain probability of abnormal behavior in the past year; the device behavior risk data is 1.0821, which comprehensively considers the device behavior score and abnormal probability, reflecting the overall risk level of the device behavior unit.

[0094] In one embodiment, in step S544, based on the device behavior risk data and network traffic risk data corresponding to each device behavior unit, a comprehensive security audit result is generated, specifically including: S5441: Taking each device behavior unit as the basic unit, the corresponding device behavior risk data is used as the row vector data, and the corresponding network traffic risk data is used as the column vector data, and they are input into the preset security risk judgment matrix to obtain the corresponding security risk level data.

[0095] Specifically, the behavioral characteristic data of the equipment is collected from sources such as equipment logs, sensor data, and network traffic, and is evaluated according to the preset first evaluation factor (such as equipment type, equipment online time, equipment online time, equipment communication frequency, equipment data transmission volume, and number of equipment abnormal behaviors), and the behavior score of each device is calculated. Combined with the abnormal probability data, the equipment behavior risk data of each equipment behavior unit is calculated; network traffic data is collected from sources such as network traffic logs and intrusion detection systems (IDS), and according to the preset second evaluation factors (such as network traffic size, traffic peak time, traffic direction, protocol type, data packet length, and abnormal traffic ratio), the network traffic characteristics are analyzed using traffic analysis tools to identify abnormal traffic, and the traffic characteristics (such as traffic size, traffic frequency, protocol type, source IP address, destination IP address, etc.) are evaluated to calculate the network traffic risk data of each device behavior unit.

[0096] In this embodiment, the device behavior risk data of each device behavior unit is used as a row vector, and the network traffic risk data of each device behavior unit is used as a column vector to construct a security risk discrimination matrix. The number of rows in the matrix is ​​equal to the number of device behavior units, and the number of columns is also equal to the number of device behavior units. Then, weights are set for the device behavior risk data and the network traffic risk data, respectively. For example, the weight of the device behavior risk data is 0.7, and the weight of the network traffic risk data is 0.3. The weighted average method is used to calculate the comprehensive risk value of each device behavior unit. Then, according to the range of the comprehensive risk value, different risk level thresholds are set, such as low risk (0-0.5), medium risk (0.51-1.0), and high risk (1.01-1.5), and the comprehensive risk value of each device behavior unit is mapped to the corresponding risk level.

[0097] S5442: Generate comprehensive security audit results for the Internet of Things network based on the security risk level data corresponding to each device behavior unit.

[0098] In this embodiment, the comprehensive security audit results can be output in the form of a comprehensive security audit report. The generated comprehensive security audit report includes the name of the device behavior unit, device behavior risk data, device traffic risk data, comprehensive risk value and security risk level, etc., and then uses charts (such as bar charts and pie charts) to show the distribution of different risk levels, and based on the security audit results, put forward corresponding security management suggestions and improvement measures.

[0099] It should be understood that the serial numbers of the steps in the above embodiments do not imply a sequence of execution. The execution sequence of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0100] In one embodiment, a security audit system for networking of Internet of Things devices is provided, and the security audit system for networking of Internet of Things devices corresponds to a security audit method for networking of Internet of Things devices in the above-mentioned embodiment.

[0101] An IoT device networking security audit system includes a data acquisition module, a dynamic security baseline construction module, a risk assessment module, a security policy generation module, and a security audit module. The detailed description of each functional module is as follows: A data acquisition module is used to acquire the operation mode data and network flow data of the devices in the target IoT device network; Dynamic security baseline building module, used to identify the normal behavior mode of the device based on the operation mode data and network traffic data, and build the corresponding dynamic security baseline; The risk assessment module is used to analyze the network traffic of the target IoT device network using a deep learning model and evaluate the risk level of each data flow based on the dynamic security baseline; A security policy generation module is used to generate a security policy comparison table for adjusting the security policy according to the risk level, obtain a security policy adjustment reference range representing the security policy adjustment threshold, and generate a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table; The security audit module is used to obtain the current network traffic data, input the current network traffic data into the security policy adjustment model, calculate the device security risk data of the entire target IoT device network, and adjust the security policy of the target IoT device network based on the device security risk data.

[0102] For the specific limitations of the IoT device network security audit system, please refer to the limitations of an IoT device network security audit method mentioned above, which will not be repeated here; each module in the above-mentioned IoT device network security audit system can be implemented in whole or in part through software, hardware and a combination thereof; each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each of the above modules.

[0103] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 3 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store operating mode data, network traffic data, and security policy adjustment models, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for security auditing of Internet of Things devices is implemented.

[0104] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the computer program: S1: Obtain the operation mode data and network traffic data of the devices in the target IoT device network; S2: Identify the normal behavior patterns of devices based on operation mode data and network traffic data, and build the corresponding dynamic security baseline; S3: Use deep learning models to analyze the network traffic of the target IoT device network and assess the risk level of each data flow based on the dynamic security baseline; S4: Generate a security policy comparison table for adjusting the security policy according to the risk level; and obtain a security policy adjustment reference range representing the security policy adjustment threshold, and generate a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table; S5: Obtain current network traffic data, input the current network traffic data into the security policy adjustment model, calculate the device security risk data of the entire target IoT device network; and adjust the security policy of the target IoT device network based on the device security risk data.

[0105] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: S1: Obtain the operation mode data and network traffic data of the devices in the target IoT device network; S2: Identify the normal behavior patterns of devices based on operation mode data and network traffic data, and build the corresponding dynamic security baseline; S3: Use deep learning models to analyze the network traffic of the target IoT device network and assess the risk level of each data flow based on the dynamic security baseline; S4: Generate a security policy comparison table for adjusting the security policy according to the risk level; and obtain a security policy adjustment reference range representing the security policy adjustment threshold, and generate a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table; S5: Obtain current network traffic data, input the current network traffic data into the security policy adjustment model, calculate the device security risk data of the entire target IoT device network; and adjust the security policy of the target IoT device network based on the device security risk data.

[0106] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0107] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0108] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, it should be understood by those skilled in the art that the technical solutions described in the aforementioned embodiments may still be modified, or some of the features thereof may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A method for security auditing of Internet of Things devices, characterized in that: include: Obtain the operation mode data and network traffic data of the devices in the target IoT device network; According to the operation mode data and network traffic data, a normal behavior mode of the device is identified, and a corresponding dynamic security baseline is constructed; Analyze the network traffic of the target IoT device network using a deep learning model, and evaluate the risk level of each data flow according to the dynamic security baseline; generating a security policy comparison table for adjusting the security policy according to the risk level; and obtaining a security policy adjustment reference range representing a security policy adjustment threshold, and generating a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table; Acquire current network traffic data, input the current network traffic data into the security policy adjustment model, and calculate device security risk data of the entire target IoT device network; The security policy of the target IoT device networking is adjusted based on the device security risk data.

2. According to claim 1, a method for security auditing of Internet of Things devices is characterized in that: The obtaining of current network traffic data, inputting the current network traffic data into the security policy adjustment model, and calculating the device security risk data of the entire target IoT device network includes: Acquire current network traffic data, and input the current network traffic data into the security policy adjustment model; In the security policy adjustment model, the audit scope is determined in combination with the network topology structure and basic device information of the target IoT network; Evaluate the device security performance of each IoT device based on the preset security audit factors to obtain the corresponding device security index; According to the device security index, combined with the device connection relationship in the network topology, the security risk data of the entire target Internet of Things network is analyzed and calculated.

3. According to claim 2, a method for security auditing of Internet of Things devices is characterized in that: The security risk data includes device behavior risk data and network traffic risk data; The security risk data of the entire target Internet of Things network is analyzed and calculated based on the device security index and the device connection relationship in the network topology, including: Generate multiple device behavior units in the IoT environment of the target IoT device network based on the device security index, the operation mode data, and the device connection relationship in the network topology structure; Taking each device behavior unit as a basic unit, performing device behavior analysis according to a preset first evaluation factor to obtain a corresponding device behavior score, and calculating corresponding device behavior risk data according to the device behavior score; Taking each device behavior unit as a basic unit, performing network traffic analysis according to a preset second evaluation factor to obtain a corresponding network traffic score, and calculating corresponding network traffic risk data according to the network traffic score; Based on the device behavior risk data and network traffic risk data corresponding to each of the device behavior units, a comprehensive security audit result is generated.

4. According to claim 3, a method for security auditing of Internet of Things devices is characterized in that: The generating of a plurality of device behavior units in the IoT environment of the target IoT device network based on the device security index, the operation mode data and the device connection relationship in the network topology structure specifically includes: Preprocessing the device operation mode data and the network topology data in the IoT environment to obtain preprocessed device operation mode data and device connection relationship data; generating a device behavior pattern diagram based on the preprocessed device operation mode data; According to the device behavior pattern diagram and the device connection relationship data, calculating the correlation data between the devices, and generating a device connection relationship diagram; generating an initial device behavior unit according to the device connection relationship diagram and the preprocessed device operation mode data; The initial device behavior unit is modified according to the device safety index and the device connection relationship data to form a final device behavior unit.

5. According to claim 3, a method for security auditing of Internet of Things devices is characterized in that: The method takes each device behavior unit as a basic unit, performs device behavior analysis according to a preset first evaluation factor, obtains a corresponding device behavior score, and calculates corresponding device behavior risk data according to the device behavior score, specifically including: The first evaluation factor includes device type, device online time, device online duration, device communication frequency, device data transmission volume, and number of abnormal device behaviors; Divide the device behavior units in the Internet of Things environment evenly, determine all devices involved in a single device behavior unit, and assign a value to each device in the single device behavior unit according to a first evaluation factor to obtain a first device score; Taking the arithmetic average of the first device scores of all devices involved in a single device behavior unit, calculating the first evaluation factor discrimination score of the single device behavior unit, and using the first evaluation factor discrimination score and the comprehensive index method to calculate the device behavior score; Calculating corresponding device behavior risk data according to the device behavior score; and / or, The calculating corresponding device behavior risk data according to the device behavior score specifically includes: Acquire historical security event data, and acquire abnormal probability data of device behavior units based on the historical security event data; The device behavior risk data is calculated using the device behavior score and the abnormal probability data of the device behavior unit.

6. According to claim 3, a method for security auditing of Internet of Things devices is characterized in that: The method takes each device behavior unit as a basic unit, performs network traffic analysis according to a preset second evaluation factor, obtains a corresponding network traffic score, and calculates corresponding network traffic risk data according to the network traffic score, specifically including: The second evaluation factor includes network traffic size, traffic peak time, traffic direction, protocol type, data packet length and abnormal traffic ratio; Evenly divide the device behavior units in the Internet of Things environment, determine all network connections involved in a single device behavior unit, and assign a value to each network connection in the single device behavior unit according to a second evaluation factor to obtain a second network connection score; Taking the arithmetic average of the second network connection scores of all network connections involved in a single device behavior unit, calculating the second evaluation factor discrimination score of the single device behavior unit, and using the second evaluation factor discrimination score and the comprehensive index method to calculate the network traffic score; Corresponding network traffic risk data is calculated according to the network traffic score.

7. A method for security auditing of Internet of Things devices according to claim 3, characterized in that: The generating of a comprehensive security audit result based on the device behavior risk data and the network traffic risk data corresponding to each of the device behavior units specifically includes: Taking each device behavior unit as the basic unit, the corresponding device behavior risk data is used as the row vector data, and the corresponding network traffic risk data is used as the column vector data, which are input into the preset security risk discrimination matrix to obtain the corresponding security risk level data; Based on the security risk level data corresponding to each device behavior unit, a comprehensive security audit result of the Internet of Things network is generated.

8. An Internet of Things device networking security audit system, characterized in that: The system comprises: A data acquisition module is used to acquire the operation mode data and network flow data of the devices in the target IoT device network; A dynamic security baseline building module, used to identify the normal behavior mode of the device according to the operation mode data and the network traffic data, and build a corresponding dynamic security baseline; A risk assessment module, used to analyze the network traffic of the target IoT device network using a deep learning model, and assess the risk level of each data flow according to the dynamic security baseline; A security policy generation module, configured to generate a security policy comparison table for adjusting the security policy according to the risk level, obtain a security policy adjustment reference range representing a security policy adjustment threshold, and generate a security policy adjustment model according to the security policy adjustment reference range and the security policy comparison table; The security audit module is used to obtain current network traffic data, input the current network traffic data into the security policy adjustment model, calculate the device security risk data of the entire target Internet of Things device network, and adjust the security policy of the target Internet of Things device network based on the device security risk data.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method for security auditing of Internet of Things devices network as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, the steps of a method for security auditing a network of Internet of Things devices as described in any one of claims 1 to 7 are implemented.

Images