Internet of Things equipment safety intelligent monitoring method based on big data

Abstract

The invention discloses an internet of things equipment security intelligent monitoring method based on big data, which relates to the technical field of internet of things equipment security, and comprises the following steps: deploying edge nodes near internet of things equipment, receiving monitoring data of the internet of things equipment, encrypting and preprocessing the monitoring data, and sending the encrypted and preprocessed data to the internet of things equipment; the edge node transmits the encrypted monitoring data to the big data platform through the encryption channel; the big data platform uses a decryption key matched with the edge node to decrypt the data, and the decrypted data is classified according to different Internet of Things equipment types and data sources and stored in a distributed database; the big data platform performs multi-modal data fusion on data sources from different devices; the big data platform analyzes the data of the distributed database through an AI model, identifies a normal behavior mode of the equipment and predicts potential abnormal behaviors of the equipment; and when the AI model predicts an abnormal behavior, the severity of the abnormity is divided, and a corresponding response strategy is given.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things device security technology, and in particular to an Internet of Things device security intelligent monitoring method based on big data. Background Art

[0002] With the rapid development of IoT technology, more and more devices are connected to the network, forming a complex IoT ecosystem. IoT devices are usually widely distributed and of various types, covering multiple fields from smart homes, industrial control to medical equipment. These devices collect a large amount of data through sensors and cameras, and aggregate the data to the cloud through the network for processing and analysis. Due to the distributed characteristics of IoT devices and their real-time interaction with the external environment, ensuring their safe and stable operation has become the key to technological development. Traditional IoT monitoring methods rely on centralized cloud computing platforms. Data is first transmitted from devices to the cloud, and then uniformly processed and analyzed. However, with the surge in the number of IoT devices, the explosive growth in data volume, and the complexity of the environment in which the devices are located, traditional monitoring systems face problems such as data processing delays, bandwidth bottlenecks, and security risks.

[0003] There are several significant shortcomings in the existing IoT monitoring technology. First, data is vulnerable to network attacks during transmission between devices and the cloud, including man-in-the-middle attacks and data tampering, resulting in the security of device monitoring data not being fully guaranteed. Secondly, due to the high frequency of data collection and diverse data types (such as video streams and sensor data) of IoT devices, existing technologies are difficult to effectively process these multimodal data. Usually, only a single type of data is analyzed, and it is impossible to achieve fusion analysis of multiple data sources, resulting in insufficient accuracy and comprehensiveness of behavior detection. Furthermore, traditional monitoring is mainly based on passive response after anomaly detection, lacks the ability to predict potential risks of equipment, and cannot provide early warning, resulting in the equipment not responding in time when serious anomalies occur, which can easily cause safety accidents or equipment damage. Therefore, existing technologies need to be improved in terms of data security, real-time monitoring, and anomaly detection and prediction. Summary of the invention

[0004] In view of the above existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a method for intelligent security monitoring of IoT devices based on big data to solve the problem that data is vulnerable to network attacks, including man-in-the-middle attacks and data tampering, during transmission between devices and the cloud, resulting in the security of device monitoring data not being fully guaranteed.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for intelligent security monitoring of IoT devices based on big data, which comprises:

[0008] Deploy edge nodes near IoT devices to receive monitoring data from IoT devices, encrypt and pre-process the monitoring data, and transmit the encrypted monitoring data to the big data platform through an encrypted channel.

[0009] The big data platform decrypts the data using the decryption key that matches the edge node. The decrypted data is classified according to different IoT device types and data sources and stored in a distributed database.

[0010] The big data platform integrates multimodal data from different devices;

[0011] The big data platform uses AI models to analyze data from distributed databases, identify normal behavior patterns of devices, and predict potential abnormal behaviors of devices;

[0012] When the AI ​​model predicts abnormal behavior, it classifies the severity of the abnormal behavior based on the prediction results and gives a corresponding response strategy.

[0013] As a preferred solution of the IoT device security intelligent monitoring method based on big data described in the present invention, the edge nodes are deployed near the IoT devices, the monitoring data of the IoT devices are received, and the monitoring data are pre-processed. The specific steps are as follows:

[0014] Deploy edge nodes near IoT devices to directly receive video data and sensor data from monitoring devices;

[0015] Set the allowable range according to the requirements and filter out unreasonable abnormal data points. The expression is:

[0016] D clean =D content ·1(D min ≤D content ≤D max );

[0017] Among them, D clean represents the cleaned data, D content Represents the original data of the monitoring device, D min Indicates the minimum allowable value of the data, D max Indicates the maximum allowed value of the data, 1 is the indicator function;

[0018] The deep learning model CNN is used to convert video data into video feature vectors, and statistical feature extraction is used to convert sensor data into sensor feature vectors, which are then aggregated to obtain the comprehensive feature vector F. i, the expression is:

[0019] F i ={ID dev ,T stamp ,F video ,F sensor};

[0020] Among them, F i represents the i-th comprehensive feature vector, i represents the index variable, ID dev Indicates the device identifier, T stamp Indicates the timestamp, F video represents the video feature vector, F sensor represents the sensor feature vector.

[0021] As a preferred solution of the big data-based intelligent security monitoring method for IoT devices of the present invention, the pre-processing of the monitoring data includes:

[0022] The lossless compression algorithm LZ77 is used to compress the comprehensive feature vector, and the compressed data is set as D comp ;

[0023] The compressed data is encrypted using the AES-256 encryption algorithm, and the encryption key K is dynamically generated based on the device identifier and timestamp. enc , the expression is:

[0024]

[0025] Where H represents the hash function, Represents an operation;

[0026] Using the encryption key K enc For the compressed data D comp Encrypt and get the encrypted data D enc ;

[0027] The edge node transmits the encrypted monitoring data to the big data platform through the TLS protocol encrypted channel.

[0028] As a preferred solution of the IoT device security intelligent monitoring method based on big data described in the present invention, the big data platform decrypts the data using a decryption key matching the edge node, and the decrypted data is classified according to different IoT device types and data sources, and stored in a distributed database. The specific steps are:

[0029] Based on the device identifier ID in the received data packet dev and timestamp T stamp Dynamically generate decryption key K dec , the expression is:

[0030]

[0031] Use the decryption key K dec For the encrypted data D enc Decrypt and use the inverse operation of the AES-256 encryption algorithm to obtain the original compressed data D comp , i.e. the decryption process;

[0032] Use the inverse process of the LZ77 lossless compression algorithm to decompress and restore the original comprehensive feature vector F i ;

[0033] The decompressed comprehensive feature vector F i The video data and sensor data are classified according to device identifiers and stored in a distributed database.

[0034] As a preferred solution of the IoT device security intelligent monitoring method based on big data described in the present invention, the big data platform performs multimodal data fusion on data sources from different devices, and the specific steps are as follows:

[0035] Set the time interval of video data and the time interval of sensor data, and use linear interpolation to align the timestamps of the two feature vectors;

[0036] The aligned video feature vector and sensor feature vector are normalized and then weighted fused. The expression is:

[0037]

[0038] Among them, F fusion represents the fused multimodal data feature vector, and They represent the normalized video feature vector and sensor feature vector respectively, and w video and w sensor They represent the weight coefficients of the normalized video feature vector and sensor feature vector respectively.

[0039] As a preferred solution of the IoT device security intelligent monitoring method based on big data described in the present invention, the big data platform analyzes the data of the distributed database through an AI model, identifies the normal behavior pattern of the device, and predicts the potential abnormal behavior of the device. The specific steps are:

[0040] Select the long short-term memory network model LSTM combined with the spatiotemporal feature convolution model ST-CNN as the AI ​​model;

[0041] The multimodal data feature vector F fusionAs input to AI models;

[0042] The spatiotemporal convolutional neural network ST-CNN is used to fused the multimodal data feature vector F fusion Perform deep extraction to capture feature changes in time and space and generate spatiotemporal feature vector F st ;

[0043] The extracted spatiotemporal feature vector is input into the fully connected layer, and after multiple layers of nonlinear transformation, the behavior pattern classification result C of the device is obtained. behavior , i.e., normal and abnormal behaviors of the device;

[0044] Use the long short-term memory network model LSTM to capture the long-term dependency of time series data, and input the spatiotemporal feature vector F at the current time t. s , output the predicted value of multiple time steps in the future, the expression is:

[0045] P future (t+k)=LSTM(F s (t),k);

[0046] Among them, P future represents the predicted value of the equipment state, and k represents the time step.

[0047] As a preferred solution of the IoT device security intelligent monitoring method based on big data described in the present invention, when the AI ​​model predicts abnormal behavior, the severity of the abnormality is divided according to the prediction result, specifically,

[0048] Predict the device status P by comparing future (t+k) and the device's behavior pattern classification result C behavior , calculate the anomaly score, the expression is:

[0049] D anomaly =∥P future (t+k)-C behavior ∥ 2 ;

[0050] Among them, D anomaly represents the abnormality score;

[0051] When the AI ​​model predicts abnormal behavior of the device, it generates a corresponding response strategy based on the severity of the abnormality. The response strategy is based on the abnormality score D anomaly Divide by size;

[0052] Set warning thresholds and danger thresholds;

[0053] When D anomaly It is within the warning threshold, indicating a slight abnormality;

[0054] When D anomaly Exceeding the warning threshold but within the danger threshold indicates moderate abnormality;

[0055] When D anomaly Exceeding the danger threshold indicates a serious abnormality.

[0056] As a preferred solution of the big data-based intelligent security monitoring method for IoT devices described in the present invention, the corresponding response strategy refers to:

[0057] When D anomaly If the device is within the warning threshold, it means that the device behavior is slightly different from the normal mode, but it will not affect the function and safety of the device. A mild alarm is generated to notify the device management personnel that there is a slight abnormality in the device, but no immediate action is required.

[0058] When D anomaly Exceeding the warning threshold but within the danger threshold means that the behavior of the equipment is significantly different from the normal mode, affecting the function of the equipment, but the risk has not yet reached a serious level. Downgrade the equipment operating status, reduce the load or reduce the operating time;

[0059] When D anomaly Exceeding the danger threshold indicates that the behavior of the device is significantly different from the normal mode, which may cause serious failure of the device and even endanger the safe operation of the device. The emergency shutdown procedure is immediately triggered to shut down the abnormal device and send an emergency alarm notification to the device manager and safety manager to inform them that a serious abnormality has occurred in the device and needs to be handled immediately.

[0060] In a second aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the method for intelligent security monitoring of Internet of Things devices based on big data as described in the first aspect of the present invention is implemented.

[0061] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the method for intelligent security monitoring of Internet of Things devices based on big data as described in the first aspect of the present invention.

[0062] The beneficial effects of the present invention are as follows: the present invention significantly improves the real-time and security of data processing through the collaboration of edge nodes and big data platforms. The edge nodes are responsible for local preprocessing, encryption and compression of data to ensure the efficiency and security of transmission; the big data platform realizes accurate identification of device behavior and prediction of potential anomalies through multimodal data fusion and intelligent analysis of AI models, can classify and store different types of data, and improve the reliability of data management through distributed databases. Through a hierarchical response mechanism, corresponding strategies are provided according to the severity of the anomaly to ensure the safety and stability of device operation. On the whole, this method enhances the monitoring accuracy, data security and response capability of IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0064] Figure 1 This is a flow chart of the method for intelligent security monitoring of IoT devices based on big data in Example 1.

[0065] Figure 2 This is an interval diagram of the response strategy in Example 1. DETAILED DESCRIPTION

[0066] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0067] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0068] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0069] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a method for intelligent security monitoring of IoT devices based on big data, comprising the following steps:

[0070] S1. Deploy edge nodes near IoT devices, receive monitoring data from IoT devices, encrypt and pre-process the monitoring data, and transmit the encrypted monitoring data to the big data platform through an encrypted channel.

[0071] Deploy edge nodes near IoT devices to directly receive video data and sensor data from monitoring devices;

[0072] Set the allowable range according to the requirements and filter out unreasonable abnormal data points. The expression is:

[0073] D clean =D content ·1(D min ≤D content ≤D max );

[0074] Among them, D clean represents the cleaned data, D content Represents the original data of the monitoring device, D min Indicates the minimum allowable value of the data, D max Indicates the maximum allowed value of the data, 1 is the indicator function;

[0075] This step effectively solves the problem of high noise in collected data in the IoT environment, and can filter out abnormal data points caused by device failure or external interference. This data cleaning operation is crucial in the monitoring scenario of IoT devices because it can significantly improve the accuracy of subsequent data analysis and avoid the negative impact of abnormal data on the prediction results of AI models.

[0076] The deep learning model CNN is used to convert video data into video feature vectors, and statistical feature extraction is used to convert sensor data into sensor feature vectors, which are then aggregated to obtain a comprehensive feature vector F. i , the expression is:

[0077] F i ={ID dev ,T stamp ,F video ,F sensor};

[0078] Among them, F i represents the i-th comprehensive feature vector, i represents the index variable, and its values ​​are 1, 2, 3, and 4, corresponding to ID dev ,T stamp ,F video ,F sensor , ID dev Indicates the device identifier, T stamp Indicates the timestamp, F videorepresents the video feature vector, F sensor represents the sensor feature vector;

[0079] The design of this step is highly creative, because traditional IoT monitoring often only processes a single type of data (such as sensor data), while the present invention can capture the operating status of the device more comprehensively by combining video with multimodal sensor data; in particular, the application of the CNN model in video feature extraction can deeply mine the dynamic information in the video, providing a more reliable basis for intelligent judgment of the device status;

[0080] The lossless compression algorithm LZ77 is used to compress the comprehensive feature vector, and the compressed data is set as D comp ;

[0081] The compressed data is encrypted using the AES-256 encryption algorithm, and the encryption key K is dynamically generated based on the device identifier and timestamp. enc , the expression is:

[0082]

[0083] Where H represents the hash function, Represents an operation;

[0084] Using the encryption key K enc For the compressed data D comp Encrypt and get the encrypted data D enc , the expression is:

[0085] D enc =AES-256(D comp ,K enc );

[0086] The encrypted data D enc Temporarily stored locally at the edge node, waiting for subsequent transmission. To ensure the integrity and security of the data, the edge node uses the CRC32 checksum algorithm to generate a checksum for each data packet. The checksum will be verified after data transmission and decryption to ensure the integrity of the data and that it has not been tampered with during transmission.

[0087] After the encrypted data is transmitted to the big data platform, it is decrypted through the inverse operation of AES-256, and the integrity of the data packet is verified using the CRC32 check algorithm. The design of this series of steps solves the problem of tampering or damage that may occur to the data during transmission. AES-256 is a widely used advanced encryption standard with extremely high security. Decryption through this algorithm can ensure the confidentiality of the data. At the same time, the CRC32 check algorithm can quickly detect errors or tampering in data transmission to ensure the integrity of the transmitted data. Only when the check is passed will the subsequent data processing process continue to prevent erroneous data from entering, further improving the stability and security of data processing.

[0088] The edge node transmits the encrypted monitoring data to the big data platform through the TLS protocol encrypted channel.

[0089] S2. The big data platform decrypts the data using the decryption key that matches the edge node. The decrypted data is classified according to different IoT device types and data sources and stored in a distributed database.

[0090] Based on the device identifier ID in the received data packet dev and timestamp T stamp Dynamically generate decryption key K dec , the expression is:

[0091]

[0092] Use the decryption key K dec For the encrypted data D enc Decrypt and use the inverse operation of the AES-256 encryption algorithm to obtain the original compressed data D comp , i.e. the decryption process;

[0093] By formula Dynamically generate decryption keys; The innovation of this step lies in the dynamic generation of keys, which not only strengthens the security of data transmission, but also solves the problem that traditional static keys are easily cracked; Traditional static keys may increase the risk of leakage in long-term use, while this dynamic key generation method based on device identifiers and timestamps ensures that the encryption key of each data packet is different, thereby greatly improving the ability to resist attacks; This step ensures that even if the data is intercepted during data transmission, attackers cannot easily crack the key;

[0094] After decryption is completed, the big data platform uses the CRC32 checksum algorithm to verify the checksum of the received data packet to ensure that the data has not been tampered with during transmission. Only when the check is successful will the next step of data processing be continued;

[0095] Use the inverse process of the LZ77 lossless compression algorithm to decompress and restore the original comprehensive feature vector F i ;

[0096] The decompressed comprehensive feature vector F i Classify based on device identifiers, video data, and sensor data and store in a distributed database;

[0097] After decompression, it is restored to the original comprehensive feature vector F i Finally, the big data platform classifies the data according to the device identifier, video data, and sensor data, and stores them in a distributed database; this step not only ensures the orderly storage of data, but also facilitates subsequent data query and analysis; dev and timestamp T stamp , which can accurately classify data from different devices and at different times into corresponding database tables; this distributed storage method improves scalability, especially in application scenarios with a large number of IoT devices and huge amounts of data, which can effectively disperse storage pressure and improve response speed and data access efficiency;

[0098] S3, the big data platform integrates multimodal data from data sources of different devices;

[0099] Set the time interval of video data and the time interval of sensor data, and use linear interpolation to align the timestamps of the two feature vectors to ensure that the video features and sensor features at the same time point can be processed synchronously. The expression is:

[0100] F aligned (T stamp )=αF video (T i )+(1-α)F sensor (T i );

[0101] Among them, F aligned Indicates the timestamp T stamp The integrated feature vector after alignment, α represents the interpolation coefficient, ranging from 0 to 1, which represents the weight of the video feature vector in the alignment process, F video (T i ) represents the video feature vector in the i-th comprehensive feature vector, F sensor (T i ) represents the sensor feature vector in the i-th comprehensive feature vector;

[0102] The innovation of this step is that it solves the problem of asynchrony between video data and sensor data. Different data sources of IoT devices (such as video and sensor) often have different sampling frequencies or time intervals, which makes it impossible to directly synchronize them. Through the linear interpolation method, the data can be aligned in the time dimension to ensure multimodal feature fusion at the same time point. This alignment method can effectively reduce the deviation caused by data asynchrony and improve the accuracy of subsequent data processing. Compared with direct discarding or uniform sampling, linear interpolation can more finely retain the temporal characteristics of the data, ensuring that the aligned feature vector can better reflect the timing information of the original data.

[0103] The aligned video feature vector and sensor feature vector are normalized and then weighted fused. The expression is:

[0104]

[0105] Among them, F fusion represents the fused multimodal data feature vector, and They represent the normalized video feature vector and sensor feature vector respectively, and w video and w sensor Respectively represent the weight coefficients of the normalized video feature vector and sensor feature vector;

[0106] The design of normalization processing improves the comparability between different data sources; video features and sensor features are often in different numerical ranges. If normalization is not performed, one type of feature data will dominate the fusion process and affect the final fusion result; through normalization, the numerical scales of different feature vectors can be unified, thereby avoiding data deviation problems caused by scale differences.

[0107] S4. The big data platform uses AI models to analyze the data in the distributed database, identify the normal behavior patterns of the equipment, and predict the potential abnormal behavior of the equipment;

[0108] Select the long short-term memory network model LSTM combined with the spatiotemporal feature convolution model ST-CNN as the AI ​​model;

[0109] The multimodal data feature vector F fusion As input to AI models;

[0110] The spatiotemporal convolutional neural network ST-CNN is used to fused the multimodal data feature vector F fusion Perform deep extraction to capture feature changes in time and space and generate spatiotemporal feature vector F st , the expression is;

[0111] F s =ST-CNN(F fusion );

[0112] The present invention adopts spatiotemporal feature convolutional network (ST-CNN) to multimodal data feature vector F fusion Perform deep extraction to generate spatiotemporal feature vector F s ; The innovation of this step is that ST-CNN can capture the changes of data in both time and space dimensions, while traditional convolutional neural networks (CNN) usually only focus on spatial features; for data analysis of IoT devices, the state of the device is not only affected by the current moment, but also related to its previous state; ST-CNN can effectively capture the spatiotemporal correlation of the device during operation and extract richer features; compared with existing technologies, this step significantly improves the model's ability to perceive complex device behaviors and is suitable for dynamic and time-varying IoT environments;

[0113] The extracted spatiotemporal feature vector is input into the fully connected layer, and after multiple layers of nonlinear transformation, the behavior pattern classification result C of the device is obtained. behavior , that is, the normal behavior and abnormal behavior of the device, the classification formula is:

[0114] C behavior =softmax(W·F s + b);

[0115] Among them, C behavior represents the classification result of device behavior, W and b are the weight matrix and bias vector of the fully connected layer respectively, and softmax is the softmax function, which is used to convert the output into a probability distribution to identify the normal or abnormal behavior of the device;

[0116] Use the long short-term memory network model LSTM to capture the long-term dependency of time series data, and input the spatiotemporal feature vector F at the current time t. s , output the predicted value of multiple time steps in the future, the expression is:

[0117] P future (t+k)=LSTM(F s (t),k);

[0118] Among them, P future represents the predicted value of the equipment state, and k represents the time step;

[0119] The long short-term memory network (LSTM) model is used to process the spatiotemporal feature vectors, capture the long-term dependencies of the time series, and predict the future device status. The introduction of the LSTM network solves the problem that traditional neural networks are difficult to handle long-term dependencies. The operating status of IoT devices usually has obvious time series characteristics, and the future behavior of the device is often closely related to its historical status. The LSTM model can effectively capture these long-term dependencies and generate the predicted value P of the future time step k. future Compared with existing technologies, the use of LSTM models significantly improves the accuracy of equipment status prediction, especially before potential abnormalities occur during equipment operation, it can detect problems in advance and issue early warnings.

[0120] S5. When the AI ​​model predicts abnormal behavior, the severity of the abnormal behavior is classified according to the prediction results, and a corresponding response strategy is given.

[0121] Predict the device status P by comparing future (t+k) and the device's behavior pattern classification result C behavior , calculate the anomaly score, the expression is:

[0122] D anomaly =∥P future (t+k)-C behavior ∥ 2 ;

[0123] Among them, D anomaly represents the anomaly score, which indicates the difference between the predicted behavior and the normal behavior;

[0124] The innovation of this step is that by comparing the predicted behavior of the device with the current classified behavior, the abnormality of the device can be quantified; traditional anomaly detection methods often rely on static thresholds or single feature anomalies, while the present invention can identify potential anomalies in advance by predicting the future device status; this dynamic anomaly detection method greatly improves the sensitivity and can provide timely warnings before serious equipment failures occur; compared with the prior art, this step not only considers the current device status, but also introduces a prediction mechanism, making anomaly detection more comprehensive and accurate;

[0125] When the AI ​​model predicts abnormal behavior of the device, it generates a corresponding response strategy based on the severity of the abnormality. The response strategy is based on the abnormality score D anomaly Divide by size;

[0126] Set warning thresholds and danger thresholds;

[0127] When D anomaly It is within the warning threshold, indicating a slight abnormality;

[0128] When Danomaly Exceeding the warning threshold but within the danger threshold indicates moderate abnormality;

[0129] When D anomaly Exceeding the danger threshold indicates a serious abnormality;

[0130] This step solves the problem of lack of hierarchical processing of device abnormal response in the prior art; currently, many processing of device abnormality is often binary (such as normal or abnormal), while the present invention divides device abnormality into three situations of mild, moderate and severe by setting warning threshold and danger threshold, and further refines the response strategy;

[0131] When D anomaly If the device is within the warning threshold, it means that the device behavior is slightly different from the normal mode, but it will not affect the function and safety of the device. A mild alarm is generated to notify the device management personnel that there is a slight abnormality in the device, but no immediate action is required.

[0132] When D anomaly Exceeding the warning threshold but within the danger threshold means that the behavior of the equipment is significantly different from the normal mode, affecting the function of the equipment, but the risk has not yet reached a serious level. Downgrade the equipment operating status, reduce the load or reduce the operating time;

[0133] When D anomaly If the danger threshold is exceeded, it means that the behavior of the device is significantly different from the normal mode, which may cause serious failure of the device and even endanger the safe operation of the device. The emergency shutdown procedure is immediately triggered to shut down the abnormal device and send an emergency alarm notification to the device manager and the safety manager to inform them that the device has a serious abnormality and needs to be handled immediately.

[0134] The hierarchical response strategy of the present invention shows significant innovation in the prior art; traditional device exception handling is usually a hard processing based on a single threshold, while the present invention makes the device's exception response more flexible and intelligent through hierarchical processing of exception scores; in particular, through the setting of warning thresholds and danger thresholds, different levels of response measures can be taken according to the degree of abnormality, thereby avoiding overreaction or untimely processing; this hierarchical response design is particularly important in the management of IoT devices, and can improve operating efficiency and the timeliness of fault handling.

[0135] This embodiment also provides a computer device, which is suitable for the case of a security intelligent monitoring method for Internet of Things devices based on big data, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the security intelligent monitoring method for Internet of Things devices based on big data as proposed in the above embodiment.

[0136] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0137] The present embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for realizing the intelligent security monitoring of Internet of Things devices based on big data proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, disk or optical disk.

[0138] In summary, the present invention significantly improves the real-time and security of data processing through: the collaboration of edge nodes and big data platforms, the edge nodes are responsible for local preprocessing, encryption and compression of data to ensure the efficiency and security of transmission; the big data platform realizes accurate identification of device behavior and prediction of potential anomalies through multimodal data fusion and intelligent analysis of AI models, can classify and store different types of data, and improve the reliability of data management through distributed databases. Through the hierarchical response mechanism, corresponding strategies are provided according to the severity of the anomaly to ensure the safety and stability of device operation. On the whole, this method enhances the monitoring accuracy, data security and response capability of IoT devices.

[0139] Example 2, referring to Table 1, is the second example of the present invention. To further verify the technical solution of the present invention, experimental simulation data of a security intelligent monitoring method for IoT devices based on big data is provided.

[0140] This experiment aims to verify the effectiveness of the prediction of abnormal behavior of equipment and its response strategy through AI models. The experiment uses the operating data of a certain industrial equipment, including sensor data and video data, with a time span of 6 months. In the experimental environment, the equipment runs 24 hours a day, and the total data volume is about 50TB, including multimodal data (video + sensor). The goal of the experiment is to predict the abnormal behavior of the equipment through AI models and generate corresponding response strategies according to the severity of the abnormal behavior.

[0141] The experiment is divided into two parts: one part uses the existing anomaly detection method based on single-modal data, and the other part uses multimodal data fusion technology and the prediction mechanism of AI model. The existing technology mainly relies on sensor data and uses a simple threshold judgment method to judge equipment anomalies. In contrast, the present invention uses the feature vector F after multimodal data fusion to detect equipment anomalies. fusion As the input of AI model, it is combined with ST-CNN and LSTM models to analyze and predict the data;

[0142] First, the multimodal data of the device, including video data and sensor data, is collected and preprocessed. The video data is sampled in 5 seconds, while the sensor data is sampled in 1 second. The timestamps of the two data are aligned by linear interpolation to generate feature vectors. Then, the fused feature vector F is constructed using a spatiotemporal convolutional neural network (ST-CNN). fusion Perform deep extraction to generate spatiotemporal feature vector F st ;

[0143] During the training phase of the AI ​​model, the historical normal operation data and abnormal data of the equipment were used; the ST-CNN model was used to capture the changes in the spatiotemporal characteristics of the equipment during operation, and the LSTM model was used to capture the long-term dependencies on the time series; after the model training was completed, the behavior classification results of the equipment were generated, and the behavior of the equipment was classified through the Softmax function; the model can also predict the future status of the equipment;

[0144] In the anomaly detection part, by comparing P future (t+k) and C behavior , calculate the anomaly score D anomaly , and classify them; according to the size of the anomaly score, set the warning threshold and danger threshold respectively, so as to classify the severity of the abnormal behavior and generate the corresponding response strategy;

[0145] During the entire experiment, the performance of the AI ​​model in predicting abnormal device behavior and generating response strategies was compared with the existing technology. The experiment focused on observing the following key parameters: the accuracy of anomaly detection, the timeliness of the response strategy, the accuracy of the abnormal response, and the effect of adjusting the operating status of the device. By comparing the experimental results of the existing technology with those of the present invention, the advantages of the present invention in anomaly detection and response strategies were further verified.

[0146] The details are shown in Table 1 below:

[0147] Table 1 Experimental record table

[0148]

[0149] Through the comparison of experimental data, it can be clearly seen that the advantages of the present invention in anomaly detection and response strategy are specifically reflected in the following aspects:

[0150] Improvement of anomaly detection accuracy: Experimental results show that the anomaly detection accuracy of the existing technology is 78%, while the detection accuracy of the present invention is significantly improved to 95% through the fusion of multimodal data and the prediction of AI models. This is mainly due to the joint use of ST-CNN and LSTM models. The former can fully capture the spatiotemporal characteristics of the equipment during operation, while the latter can effectively handle the long-term dependencies during the equipment operation, thereby accurately identifying the abnormal behavior of the equipment. In contrast, the existing technology only relies on sensor data and uses simple threshold judgment, which cannot fully utilize the multidimensional information during the equipment operation, resulting in relatively low detection accuracy.

[0151] Prolonged anomaly detection lead time: The present invention can detect potential anomalies of equipment 20 seconds in advance, while the existing technology can only detect them 5 seconds in advance; this gap reflects the advantage of AI prediction models in time series data processing; by predicting the future equipment status through the LSTM model, the present invention can accurately predict the possibility of anomalies before they occur, which buys more reaction time for equipment managers and avoids the suddenness of equipment failures;

[0152] Accuracy and timeliness of response strategy: The response strategy triggering accuracy of the present invention reaches 93%, while the prior art is only 70%. This gap is mainly due to the fact that the present invention can trigger the response strategy based on the abnormal score D anomaly The size of the abnormality is refined, the severity of the abnormality is refined, and a corresponding response strategy is generated; in contrast, the response strategy of the prior art is relatively simple and cannot make an accurate response according to the different degrees of the abnormality; in addition, the response time of the present invention for moderate and severe abnormalities is 10 seconds and 8 seconds respectively, while the prior art is 15 seconds and 30 seconds respectively; this shows that the response strategy of the present invention is more timely and can effectively reduce the operation risk of the equipment;

[0153] Reduction in equipment downtime: Experimental results show that the equipment of the present invention has 6 downtimes, while the prior art has 12 downtimes. Through accurate prediction of abnormal behavior and graded response strategy, the present invention avoids unnecessary downtime in the case of minor abnormalities and only takes appropriate measures in the case of moderate or severe abnormalities, thereby significantly reducing equipment downtime and improving overall efficiency.

[0154] Improved operating efficiency: The present invention improves the overall operating efficiency by 15%; this improvement is mainly due to the accuracy of anomaly detection and the timeliness of response strategies; by reducing the number of unnecessary downtimes of equipment and improving the stability of equipment operation, the present invention can maximize the operating efficiency of equipment while ensuring equipment safety;

[0155] In summary, the present invention has significant advantages over the prior art in terms of accuracy of anomaly detection, precision of response strategy, and operational efficiency; these data fully demonstrate the innovation and practicality of the present invention in device anomaly detection and response strategy.

[0156] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for intelligent security monitoring of IoT devices based on big data, characterized in that: include, Deploy edge nodes near IoT devices to receive monitoring data from IoT devices, encrypt and pre-process the monitoring data, and transmit the encrypted monitoring data to the big data platform through an encrypted channel. The big data platform decrypts the data using the decryption key that matches the edge node. The decrypted data is classified according to different IoT device types and data sources and stored in a distributed database. The big data platform integrates multimodal data from different devices; The big data platform uses AI models to analyze data from distributed databases, identify normal behavior patterns of devices, and predict potential abnormal behaviors of devices; When the AI ​​model predicts abnormal behavior, it classifies the severity of the abnormal behavior based on the prediction results and gives a corresponding response strategy.

2. The method for intelligent security monitoring of IoT devices based on big data according to claim 1, characterized in that: Deploy edge nodes near IoT devices, receive monitoring data from IoT devices, and pre-process the monitoring data. The specific steps are: Deploy edge nodes near IoT devices to directly receive video data and sensor data from monitoring devices; Set the allowable range according to the requirements and filter out unreasonable abnormal data points. The expression is: D clean =D content ·1(D min ≤D content ≤D max ); Among them, D clean represents the cleaned data, D content Represents the original data of the monitoring device, D min Indicates the minimum allowable value of the data, D max Indicates the maximum allowed value of the data, 1 is the indicator function; The deep learning model CNN is used to convert video data into video feature vectors, and statistical feature extraction is used to convert sensor data into sensor feature vectors, which are then aggregated to obtain a comprehensive feature vector F. i , the expression is: F i ={ID dev ,T stamp ,F video ,F sensor }; Among them, F i represents the i-th comprehensive feature vector, i represents the index variable, ID dev Indicates the device identifier, T stamp Indicates the timestamp, F video represents the video feature vector, F sensor represents the sensor feature vector.

3. The method for intelligent security monitoring of IoT devices based on big data as claimed in claim 2, characterized in that: The monitoring data is preprocessed, include, The lossless compression algorithm LZ77 is used to compress the comprehensive feature vector, and the compressed data is set as D comp ; The compressed data is encrypted using the AES-256 encryption algorithm, and the encryption key K is dynamically generated based on the device identifier and timestamp. enc , the expression is: Where H represents the hash function, Represents an operation; Using the encryption key K enc For the compressed data D comp Encrypt and get the encrypted data D enc ; The edge node transmits the encrypted monitoring data to the big data platform through the TLS protocol encrypted channel.

4. The method for intelligent security monitoring of IoT devices based on big data as claimed in claim 3, characterized in that: The big data platform uses the decryption key that matches the edge node to decrypt the data. The decrypted data is classified according to different IoT device types and data sources and stored in a distributed database. The specific steps are: Based on the device identifier ID in the received data packet dev and timestamp T stamp Dynamically generate decryption key K dec , the expression is: Use the decryption key K dec For the encrypted data D enc Decrypt and use the inverse operation of the AES-256 encryption algorithm to obtain the original compressed data D comp ; Use the inverse process of the LZ77 lossless compression algorithm to decompress and restore the original comprehensive feature vector F i ; The decompressed comprehensive feature vector F i The video data and sensor data are classified according to device identifiers and stored in a distributed database.

5. The method for intelligent security monitoring of IoT devices based on big data as claimed in claim 4, characterized in that: The big data platform performs multimodal data fusion on data sources from different devices. The specific steps are as follows: Set the time interval of video data and the time interval of sensor data, and use linear interpolation to align the timestamps of the two feature vectors; The aligned video feature vector and sensor feature vector are normalized and then weighted fused. The expression is: Among them, F fusion represents the fused multimodal data feature vector, and They represent the normalized video feature vector and sensor feature vector respectively, and w video and w sensor They represent the weight coefficients of the normalized video feature vector and sensor feature vector respectively.

6. The method for intelligent security monitoring of IoT devices based on big data as claimed in claim 5, characterized in that: The big data platform uses an AI model to analyze the data in the distributed database, identify the normal behavior patterns of the equipment, and predict the potential abnormal behavior of the equipment. The specific steps are: Select the long short-term memory network model LSTM combined with the spatiotemporal feature convolution model ST-CNN as the AI ​​model; The multimodal data feature vector F fusion As input to AI models; The spatiotemporal convolutional neural network ST-CNN is used to fused the multimodal data feature vector F fusion Perform deep extraction to capture feature changes in time and space and generate spatiotemporal feature vector F st ; The extracted spatiotemporal feature vector is input into the fully connected layer, and after multiple layers of nonlinear transformation, the behavior pattern classification result C of the device is obtained. behavior ; Use the long short-term memory network model LSTM to capture the long-term dependency of time series data, and input the spatiotemporal feature vector F at the current time t. s , output the predicted value of multiple time steps in the future, the expression is: P future (t+k)=LSTM(F s (t),k); Among them, P future represents the predicted value of the equipment state, and k represents the time step.

7. The method for intelligent security monitoring of IoT devices based on big data as claimed in claim 6, characterized in that: When the AI ​​model predicts abnormal behavior, the severity of the abnormal behavior is classified according to the prediction result, specifically, Predict the device status P by comparing future (t+k) and the device's behavior pattern classification result C behavior , calculate the anomaly score, the expression is: D anomaly =∥P future (t+k)-C behavior ∥ 2 ; Among them, D anomaly represents the abnormality score; When the AI ​​model predicts abnormal behavior of the device, it generates a corresponding response strategy based on the severity of the abnormality. The response strategy is based on the abnormality score D anomaly Divide by size; Set warning thresholds and danger thresholds; When D anomaly It is within the warning threshold, indicating a slight abnormality; When D anomaly Exceeding the warning threshold but within the danger threshold indicates moderate abnormality; When D anomaly Exceeding the danger threshold indicates a serious abnormality.

8. The method for intelligent security monitoring of IoT devices based on big data as claimed in claim 7, characterized in that: The corresponding response strategy refers to: When D anomaly If the device is within the warning threshold, it means that the device behavior is slightly different from the normal mode, but it will not affect the function and safety of the device. A mild alarm is generated to notify the device management personnel that there is a slight abnormality in the device, but no immediate action is required. When D anomaly Exceeding the warning threshold but within the danger threshold means that the behavior of the equipment is significantly different from the normal mode, affecting the function of the equipment, but the risk has not yet reached a serious level. Downgrade the equipment operating status, reduce the load or reduce the operating time; When D anomaly Exceeding the danger threshold indicates that the behavior of the device is significantly different from the normal mode, which may cause serious failure of the device and even endanger the safe operation of the device. The emergency shutdown procedure is immediately triggered to shut down the abnormal device and send an emergency alarm notification to the device manager and safety manager to inform them that a serious abnormality has occurred in the device and needs to be handled immediately.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for intelligent security monitoring of Internet of Things devices based on big data described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for intelligent security monitoring of Internet of Things devices based on big data described in any one of claims 1 to 7 are implemented.

Images