Internet-of-things terminal password application analysis early warning system for abnormal Internet-of-things behavior monitoring

Abstract

The invention relates to the technical field of data processing, and discloses an Internet of Things terminal password application analysis early warning system for abnormal Internet of Things behavior monitoring. Comprising the following steps: acquiring basic behavior parameters of an Internet of Things terminal, judging whether to execute analysis and early warning operation, acquiring abnormal Internet of Things data of the Internet of Things terminal in a sub-interval, predicting an Internet of Things state value of a next sub-interval, judging whether to send out an early warning prompt, and formulating an Internet of Things optimization instruction corresponding to an early warning level; compared with the prior art, the method has the advantages that the data representing the initial operation state of the Internet of Things terminal can be accurately acquired, the acquisition quantity of the basic behavior parameters is effectively reduced, the data acquisition burden is reduced, the abnormal state of the password application of the Internet of Things terminal at the future moment can be accurately predicted in advance, and the application experience of the Internet of Things terminal is improved. The phenomenon that the password application of the Internet of Things terminal breaks down or even breaks down due to abnormal Internet of Things behaviors at the future moment is avoided, and the effect of early warning in advance is effectively achieved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and more specifically, to an IoT terminal password application analysis and early warning system for monitoring abnormal IoT behavior. Background Art

[0002] The IoT terminal password application is a strategy and tool for executing the management, use and security of passwords in IoT devices. The security of the IoT terminal password application directly affects the security of the entire IoT system. Since IoT devices are usually interconnected, once a device is attacked, the security of the entire IoT may be threatened. Therefore, security analysis and early warning of IoT terminal password applications are crucial to protecting user privacy, data security and device functions.

[0003] The patent application with reference publication number CN110727665A discloses a method and system for analyzing the quality of data reported by IoT devices. It combines IoT data quality analysis with machine learning, analyzes and compares the data reported by IoT devices, excludes dirty data, and enters qualified data into the database. After the database data becomes more and more accurate and complete, the sample library is updated through gradient descent calculation and sample size adjustment calculation according to the set learning rate β and the number of iterations. This is repeated continuously, and the accuracy of the calculated model becomes higher and higher. When the sample database matures, the accuracy, data missing ratio, and abnormal data proportion of the data collected by IoT devices are analyzed, and the integrity, consistency, and accuracy of the data are evaluated as a reference for data quality analysis. After the model processes abnormal values ​​and supplements missing values, the data periodicity and discrete analysis are statistically analyzed, and early warning and statistical processing can be effectively made. The data reported by IoT devices and the sample database data are labeled and sorted, and data entry can be checked.

[0004] When the existing IoT terminal early warning system performs security analysis on the IoT terminal password application, it collects a large amount of real-time abnormal behavior data during the operation of the IoT terminal password application, and analyzes the large amount of real-time abnormal behavior data with the standard abnormal behavior data one by one, and then performs real-time early warning on the security of the IoT terminal password application. Although the analysis and early warning effect of the IoT terminal password application can be achieved, this method requires uninterrupted acquisition of massive data of the IoT terminal password application in the running state, which not only increases the amount of data collection, analysis and calculation, but also increases the workload of analysis and early warning. At the same time, it can only perform real-time analysis and early warning on the current running state of the IoT terminal password application, and cannot make advance predictions and early warnings on the running state of the IoT terminal password application in the future, resulting in a lag in the analysis and early warning of the IoT terminal password application, which reduces the analysis and early warning effect.

[0005] In view of this, the present invention proposes an IoT terminal password application analysis and early warning system for monitoring abnormal IoT behavior to solve the above problems. Summary of the invention

[0006] In order to overcome the above-mentioned defects of the prior art and to achieve the above-mentioned purpose, the present invention provides the following technical solution: an IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring, applied to an IoT server, comprising:

[0007] The parameter acquisition module is used to mark the behavior period of the IoT behavior and obtain the basic behavior parameters of the IoT terminal within the behavior period. The basic behavior parameters include the behavior span duration and the behavior collection rate.

[0008] The analysis and determination module is used to identify the operating status of the IoT terminal based on the abnormal identification criteria, the operating status includes the normal status and the suspicious status, and determine whether to perform the analysis and early warning operation;

[0009] The data collection module is used to divide the warning period into sub-intervals and obtain abnormal IoT data of IoT terminals in the sub-intervals. The abnormal IoT behavior data includes invalid access frequency, traffic complexity value, ciphertext verification failure rate and asset data backup value;

[0010] The prediction and judgment module is used to input abnormal IoT data into the trained machine learning model, predict the IoT state value of the next sub-interval, which includes the normal state and abnormal state of IoT, and determine whether to issue an early warning prompt;

[0011] The optimization instruction module is used to divide the warning levels of IoT terminals into level one and level two, and formulate IoT optimization instructions corresponding to the warning levels. The IoT optimization instructions include data enhancement monitoring instructions and data defense monitoring instructions.

[0012] Furthermore, the method for marking the behavior period includes:

[0013] Query all behavioral events in the IoT terminal through the log management system and mark the behavioral characteristics of all behavioral events;

[0014] Record the behavior events with the behavior characteristics of access, authority, ciphertext, asset, security and level as IoT behaviors, and obtain i IoT behaviors;

[0015] The occurrence time of the first IoT behavior and the last IoT behavior are queried through the timestamp, and recorded as the start time and end time respectively;

[0016] Taking the start time as the first starting point, extend forward along the timeline by a duration corresponding to a preset unit time period to obtain the start time of the time period;

[0017] Taking the end time as the second starting point, extend the duration corresponding to a preset unit time period backward along the timeline to obtain the end time of the time period, and record the time period between the start time of the time period and the end time of the time period as the behavior time period.

[0018] Furthermore, the method for obtaining the behavior span duration includes:

[0019] Query the time when i IoT behaviors occur one by one through the timestamp to obtain the i behavior time;

[0020] The duration between the i-th behavior moment and the i+1-th behavior moment is recorded as the subspan duration, and i-1 subspan durations are obtained;

[0021] The duration of the i-1 sub-spans is accumulated and averaged to obtain the duration of the behavior span;

[0022] The expression of behavior span duration is:

[0023]

[0024] Where XW kd is the behavior span duration, KD za is the duration of the ath subspan.

[0025] Furthermore, the method for obtaining the behavior collection rate includes:

[0026] The total amount of data in the database is counted at the start time of the time period and the end time of the time period to obtain the initial data value and the end data value;

[0027] After subtracting the ending data value from the initial data value, the data collection value is obtained;

[0028] The expression of the data collection value is:

[0029] SJ sl =SL zz -SL cs ;

[0030] In the formula, SJ sl is the data collection value, SL zz is the termination data value, SL cs is the initial data value;

[0031] The amount of data generated at each i-th behavior moment is counted through the gateway, and the i-th output value is obtained. After accumulating the i-th output value one by one, the total amount of data is obtained.

[0032] The expression of the total data value is:

[0033]

[0034] In the formula, SJzl is the total amount of data, SC zb is the output value of the bth number;

[0035] Compare the data collection value with the total data value to obtain the behavior collection rate;

[0036] The expression of behavior collection rate is:

[0037]

[0038] Where XW sl Behavior inclusion rate.

[0039] Furthermore, the anomaly identification criteria are: there is at least one suspicious parameter in the abnormal state;

[0040] Methods for identifying normal and suspicious states include:

[0041] Compare the behavior span duration with the standard span duration, and when the behavior span duration is less than the standard span duration, mark the behavior span duration as a suspicious parameter;

[0042] Compare the behavior collection rate with the standard collection rate, and when the behavior collection rate is less than the standard collection rate, mark the behavior collection rate as a suspicious parameter;

[0043] Count the number of parameters marked as suspicious in the basic behavior parameters to obtain suspicious values;

[0044] When the suspicious value is 0, the operation status of the IoT terminal is identified as a normal status;

[0045] When the suspicious value is 1 or 2, the operation status of the IoT terminal is identified as a suspicious status;

[0046] The determination methods for whether to perform analysis and warning operations include:

[0047] When the operation status of the IoT terminal is identified as a normal status, it is determined that the analysis and warning operation is not performed;

[0048] When the operating status of the IoT terminal is identified as a suspicious state, it is determined to perform analysis and early warning operations.

[0049] Furthermore, the method for obtaining the invalid access frequency includes:

[0050] In the s sub-intervals, all access logs in the security defense system are queried one by one, and the authorization status of all access logs is identified one by one;

[0051] The access logs with the authorization status of unauthorized and interrupted are recorded as invalid logs, and the number of invalid logs is counted;

[0052] After comparing the number of invalid logs in s subintervals with the duration of the subintervals, s invalid access frequencies are obtained;

[0053] The expression of invalid access frequency is:

[0054]

[0055] Where WX fws is the invalid access frequency of the sth subinterval, SL rzs is the number of invalid logs in the sth subinterval, SC qj is the duration of the subinterval.

[0056] Furthermore, the method for obtaining the ciphertext verification failure rate includes:

[0057] The time when the password management system receives the input password for the first time is the verification start time, and the time when the password management system receives the input password for the last time is the verification end time;

[0058] In the s sub-intervals, the duration from the verification start time to the verification end time is recorded as the verification duration, and s verification durations are obtained;

[0059] Query the ciphertext information of the input password received by the password management system during the S verification durations one by one, and mark the input characters of the ciphertext information;

[0060] The input characters that are inconsistent with the correct characters are recorded as abnormal characters, and the ciphertext status of the input password corresponding to the abnormal characters is marked as verification failure;

[0061] Count the number of input passwords whose ciphertext status is verification failure during s verification durations to obtain s verification failure values, and compare the s verification failure values ​​with the S verification durations to obtain S ciphertext verification failure rates;

[0062] The expression of ciphertext verification failure rate is:

[0063]

[0064] Where, MW sbs is the ciphertext verification failure rate of the sth subinterval, YZ sbs is the verification failure value of the Sth subinterval, YZ scs is the verification time of the s-th subinterval.

[0065] Furthermore, the method for obtaining the asset data backup value includes:

[0066] Mark the first moment and the last moment of s subintervals respectively, and obtain s first moments and s last moments;

[0067] The keywords of all backup data in the database are marked one by one through natural language processing technology, and the backup data with the keyword "asset" is recorded as asset data;

[0068] At S first moments and S last moments, the backup amount of asset data in the security backup system is counted respectively, and S initial backup values ​​and s termination backup values ​​are obtained;

[0069] Subtract the s termination backup values ​​from the s initial backup values ​​one by one to obtain S asset data backup values;

[0070] The expression of asset data backup value is:

[0071] ZC bfs =BF zzs -BF css ;

[0072] In the formula, ZC bfs is the asset data backup value of the sth subinterval, BF zzs is the termination backup value of the sth subinterval, BF css is the initial backup value of the sth subinterval.

[0073] Furthermore, the training method of the machine learning model includes:

[0074] Pre-collect abnormal IoT data of multiple groups of IoT devices in normal IoT state and abnormal IoT state;

[0075] The abnormal IoT data is converted into multiple feature vectors using a sliding window method. The IoT state value is converted into a label corresponding to the abnormal IoT data according to the sliding step size. The normal state of IoT is converted to 0, and the abnormal state of IoT is converted to 1. One feature vector corresponds to one label and constitutes a set of training data. Multiple sets of training data constitute a training set. The abnormal IoT data are arranged in the order of collection time, and the prediction time step size SB, sliding step size HB and sliding window length CB are preset.

[0076] The feature vector is used as the input of the machine learning model, and the IoT state value of the next subinterval after the predicted time step SB is used as the output. The subsequent IoT state value of each training set is used as the prediction target. The machine learning model is trained with the minimized sum of prediction errors as the training target to generate a machine learning model that predicts the IoT state value of the next subinterval based on the abnormal IoT data of the previous subinterval.

[0077] The methods for determining whether to issue an early warning include:

[0078] When the output of the machine learning model is 0, it is determined that no warning prompt will be issued;

[0079] When the output of the machine learning model is 1, a warning prompt is issued.

[0080] Furthermore, the division methods of the first level and the second level include:

[0081] Compare the invalid access frequency, traffic complexity value, ciphertext verification failure rate and asset data backup value with the access frequency standard value, traffic complexity standard value, verification failure standard value and data backup standard value respectively;

[0082] The invalid access frequency greater than the access frequency standard value, the traffic complexity value greater than the traffic complexity standard value, the ciphertext verification failure rate greater than the verification failure standard value, and the asset data backup value less than the data backup standard value are recorded as abnormal data, and the number of abnormal data is counted;

[0083] When the number of abnormal data is 1 or 2, the warning level of the IoT terminal is divided into level 1;

[0084] When the number of abnormal data is 3 or 4, the warning level of the IoT terminal is divided into the second level;

[0085] The method for formulating data enhancement monitoring instructions and data defense monitoring instructions includes:

[0086] When the warning level of the IoT terminal is level 1, formulate data enhanced monitoring instructions;

[0087] When the warning level of the IoT terminal is level 2, a data defense monitoring instruction is formulated.

[0088] The technical effects and advantages of the IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring of the present invention are as follows:

[0089] The present invention marks the behavior time period of IoT behavior, obtains the basic behavior parameters of the IoT terminal within the behavior time period, identifies the operation status of the IoT terminal based on the abnormal identification criteria, and determines whether to perform the analysis and warning operation, divides the warning period into sub-intervals, and obtains the abnormal IoT data of the IoT terminal in the sub-interval, inputs the abnormal IoT data into the trained machine learning model, predicts the IoT state value of the next sub-interval, and determines whether to issue a warning prompt, divides the IoT terminal into warning levels, and formulates IoT optimization instructions corresponding to the warning levels; compared with the prior art, by marking the behavior time period, it can be used as the collection time of the basic behavior parameters of the IoT terminal. The time limit can not only accurately collect data representing the initial operating status of the IoT terminal, but also effectively reduce the collection amount of basic behavior parameters, reduce the data collection burden, and by importing abnormal IoT data into the machine learning model for prediction, it can accurately and in advance predict the abnormal state of the IoT terminal password application in the future. After predicting the abnormal state, it can formulate optimization instructions corresponding to the abnormal IoT behavior in the IoT terminal password application, thereby avoiding the phenomenon that the IoT terminal password application will malfunction or even be paralyzed due to abnormal IoT behavior in the future, effectively achieving the effect of early warning and improving the operation security of the IoT terminal password application. BRIEF DESCRIPTION OF THE DRAWINGS

[0090] Figure 1 A schematic diagram of an IoT terminal password application analysis and early warning system for monitoring abnormal IoT behavior provided in the first embodiment of the present invention;

[0091] Figure 2 A flow chart of an IoT terminal password application analysis and early warning method for abnormal IoT behavior monitoring provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0092] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0093] Example 1: Please refer to Figure 1 As shown, the IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring described in this embodiment is applied to an IoT server, including:

[0094] The parameter acquisition module marks the behavior period of the IoT behavior and obtains the basic behavior parameters of the IoT terminal within the behavior period;

[0095] IoT behavior refers to the IoT-level operation behavior that can force the password application devices and programs of IoT terminals to change data and generate new data, and affect the password application of IoT terminals through IoT behavior;

[0096] When an IoT behavior occurs, the IoT terminal will generate change data corresponding to the IoT behavior. These change data can provide an initial warning of the operating status of the IoT terminal. When collecting the change data, it is first necessary to determine the collection time period of the change data, so as to provide an accurate time limit for the collection of the change data, that is, to mark the behavior time period;

[0097] Methods for marking behavioral periods include:

[0098] All behavior events in the IoT terminal are queried through the log management system, and the behavior characteristics of all behavior events are marked; behavior events refer to events in the IoT terminal password application that can record all IoT behaviors, thereby effectively recording the behavior data in the IoT terminal password application, and behavior characteristics are used to truly and accurately represent the IoT behaviors in the behavior events, thereby effectively distinguishing different types of behavior events;

[0099] Record the behavior events with the behavior characteristics of access, authority, ciphertext, asset, security and level as IoT behaviors, and obtain i IoT behaviors;

[0100] The occurrence time of the first IoT behavior and the last IoT behavior are queried through the timestamp, and recorded as the start time and end time respectively;

[0101] Taking the start time as the first starting point, extend the time corresponding to a preset unit period forward along the time line to obtain the time of the time period starting point; the preset unit period is used to represent the interval between the time of the time period starting point and the first starting point, so that the time of the time period starting point can be earlier than the time corresponding to the first starting point on the time line, ensuring that the data corresponding to the first IoT behavior can be fully collected;

[0102] Taking the end time as the second starting point, extend the duration corresponding to a preset unit time period backward along the timeline to obtain the end time of the time period, and record the time period between the start time of the time period and the end time of the time period as the behavior time period.

[0103] It should be noted that the duration corresponding to the behavior period can not only ensure that all IoT behaviors will be effectively recorded and collected, but also provide sufficient time for the generation of the first IoT behavior and the end of the last IoT behavior, further improving the rationality of the behavior period.

[0104] After the behavior period is obtained, the parameters representing the basic operation status of the IoT terminal can be collected within the behavior period, so it is necessary to collect basic behavior parameters;

[0105] The basic behavior parameters include behavior span duration and behavior collection rate; behavior span duration refers to the average duration span between two adjacent IoT behaviors within the behavior period, which can represent the duration span between two adjacent IoT behaviors in the IoT terminal;

[0106] Methods for obtaining behavior span duration include:

[0107] Query the time when i IoT behaviors occur one by one through the timestamp to obtain the i behavior time;

[0108] The duration between the i-th behavior moment and the i+1-th behavior moment is recorded as the subspan duration, and i-1 subspan durations are obtained;

[0109] The duration of the i-1 sub-spans is accumulated and averaged to obtain the duration of the behavior span;

[0110] The expression of behavior span duration is:

[0111]

[0112] Where XW kd is the behavior span duration, KD za is the duration of the ath subspan.

[0113] The behavior collection rate refers to the ratio between the number of behavior data that can be collected in the database and the total number within the behavior period, which can be used to indicate the strength of the data collection performance in the IoT terminal;

[0114] Methods for obtaining behavior collection rates include:

[0115] The total amount of data in the database is counted at the start time of the time period and the end time of the time period to obtain the initial data value and the end data value;

[0116] After subtracting the ending data value from the initial data value, the data collection value is obtained;

[0117] The expression of the data collection value is:

[0118] SJ sl =SL zz -SL cs ;

[0119] In the formula, SJ sl is the data collection value, SL zz is the termination data value, SL cs is the initial data value;

[0120] The amount of data generated at each i-th behavior moment is counted through the gateway, and the i-th output value is obtained. After accumulating the i-th output value one by one, the total amount of data is obtained.

[0121] The expression of the total data value is:

[0122]

[0123] In the formula, SJ zl is the total amount of data, SC zb is the output value of the bth number;

[0124] Compare the data collection value with the total data value to obtain the behavior collection rate;

[0125] The expression of behavior collection rate is:

[0126]

[0127] Where XW sl Behavior inclusion rate.

[0128] The analysis and judgment module identifies the operating status of the IoT terminal based on the abnormality recognition criteria and determines whether to perform the analysis and warning operation;

[0129] After the basic behavior parameters are obtained, the basic operation status of the IoT terminal can be identified and judged through the basic behavior parameters, and whether abnormal IoT behavior will occur in the future can be judged according to the basic operation status of the IoT terminal, and then subsequent analysis and early warning processing can be carried out;

[0130] When identifying and analyzing basic behavior parameters, it is necessary to ensure that the basic behavior parameters can be effectively and accurately identified based on the abnormal identification criteria, and display the results of the basic behavior parameter analysis and identification to obtain the operating status;

[0131] The anomaly identification criterion is: there is at least one suspicious parameter in the abnormal state; thus, the threshold for performing analysis and early warning operations can be lowered, and parameters that may be abnormal can be discovered in a timely manner;

[0132] The operation status includes normal status and suspicious status;

[0133] Methods for identifying normal and suspicious states include:

[0134] Compare the behavior span duration with the standard span duration; the standard span duration refers to the minimum value of the average span between two adjacent IoT behaviors of the IoT terminal under normal conditions, which can effectively identify whether the behavior span duration is a suspicious parameter;

[0135] When the behavior span duration is less than the standard span duration, the average duration span between two adjacent IoT behaviors is lower than the duration span under normal conditions, and the behavior span duration is marked as a suspicious parameter;

[0136] Compare the behavior collection rate with the standard collection rate; the standard collection rate refers to the minimum value of the ratio of the number of behavior data collected in the database under normal conditions of IoT terminals to the total number, which can effectively identify whether the behavior collection rate is a suspicious parameter;

[0137] When the behavior collection rate is less than the standard collection rate, the ratio of the number of behavior data collected in the database to the total number is lower than the collection rate under normal conditions, and the behavior collection rate is marked as a suspicious parameter;

[0138] Count the number of parameters marked as suspicious in the basic behavior parameters to obtain suspicious values;

[0139] When the suspicious value is 0, it means that the basic behavior parameters do not contain suspicious parameters, and the operation status of the IoT terminal is identified as a normal status;

[0140] When the suspicious value is 1 or 2, it means that the basic behavior parameters contain suspicious parameters, and the operating state of the IoT terminal is identified as a suspicious state.

[0141] When the operating status of the IoT terminal is obtained, it can be determined whether to issue an execution analysis warning operation according to the different operating statuses, so that the next step can be performed when the execution analysis warning operation is issued;

[0142] The determination methods for whether to perform analysis and warning operations include:

[0143] When the operation status of the IoT terminal is identified as a normal status, the probability of abnormal IoT behavior in the IoT terminal is low, and it is determined that the analysis and warning operation is not performed;

[0144] When the operating status of the IoT terminal is identified as a suspicious state, the probability of abnormal IoT behavior in the IoT terminal is high, and it is determined to perform an analysis and warning operation.

[0145] It should be noted that when it is determined not to perform the analysis and warning operation, it is necessary to repeatedly collect and identify the basic behavior parameters so as to achieve continuous and uninterrupted analysis and warning operation effects on the IoT terminal. When it is determined to perform the analysis and warning operation, subsequent analysis and warning operations can be performed to further process the IoT terminal.

[0146] The data collection module divides the warning period into sub-intervals and obtains abnormal IoT data of IoT terminals in the sub-intervals. The abnormal IoT behavior data includes invalid access frequency, traffic complexity value, ciphertext verification failure rate and asset data backup value;

[0147] The warning period refers to the corresponding duration for the IoT terminal to detect and analyze the overall abnormal IoT behavior. The sub-interval is a time period used to further divide the warning period. The warning period with a longer time span can be divided into multiple continuous and equal S sub-intervals. The warning period in this embodiment can be days or hours. For example, when the warning period is 1 day, the sub-interval is 1 hour, and when the warning period is 1 hour, the sub-interval is 5 minutes.

[0148] Abnormal IoT data refers to data showing changes in password application caused by abnormal IoT behavior of IoT terminals within a sub-interval, which can be used to represent the change phenomenon of abnormal IoT behavior of IoT terminals and serve as the data basis for subsequent analysis and early warning of IoT terminals;

[0149] Abnormal IoT data includes invalid access frequency, traffic complexity value, ciphertext verification failure rate, and asset data backup value;

[0150] The invalid access frequency refers to the number of invalid accesses that occur in the password application of the IoT terminal per unit time in the subinterval, which can be used to represent the number of unauthorized and unsecured accesses that the password application of the IoT terminal receives per unit time. The greater the invalid access frequency, the greater the number of invalid accesses that occur in the password application of the IoT terminal per unit time in the subinterval, and the worse the security of the password application of the IoT terminal.

[0151] Methods for obtaining invalid access frequency include:

[0152] In the S sub-intervals, all access logs in the security defense system are queried one by one, and the authorization status of all access logs is identified one by one; the authorization status is used to indicate whether the access log is effectively authorized by the security defense system, which can effectively distinguish whether each access log is authorized or not; the authorization status includes unauthorized, authorization interrupted and authorized;

[0153] The access logs with the authorization status of unauthorized and interrupted are recorded as invalid logs, and the number of invalid logs is counted;

[0154] After comparing the number of invalid logs in S subintervals with the duration of the subintervals, S invalid access frequencies are obtained;

[0155] The expression of invalid access frequency is:

[0156]

[0157] Where WX fws is the invalid access frequency of the sth subinterval, SL rzs is the number of invalid logs in the sth subinterval, SC qjis the duration of the subinterval.

[0158] The traffic complexity value refers to the number of different types of password applications of the IoT terminal when transmitting data, which can be used to indicate the complexity of the types of password applications of the IoT terminal. The larger the traffic complexity value, the more different types of password applications of the IoT terminal transmit data in a sub-interval, and the worse the security of the password application of the IoT terminal. The traffic complexity value is obtained by querying the number of data with different structures in the structure database.

[0159] The ciphertext verification failure rate refers to the ratio between the number of ciphertexts that fail to be verified per unit time in the subinterval of the password application of the IoT terminal and the total number, which can be used to indicate the number of incorrect ciphertext inputs that occur in the password application of the IoT terminal per unit time. The greater the ciphertext verification failure rate, the greater the number of ciphertext inputs that fail to be verified per unit time in the password application of the IoT terminal, and the worse the security of the password application of the IoT terminal;

[0160] Methods for obtaining the ciphertext verification failure rate include:

[0161] The moment when the password management system receives the input password for the first time is the start time of verification, and the moment when the password management system receives the input password for the last time is the end time of verification. By marking the time of the first and last reception, the span of the verification time can be accurately limited to ensure that every input password can be effectively recorded.

[0162] In the s subintervals, the duration from the verification start time to the verification end time is recorded as the verification duration, and S verification durations are obtained;

[0163] The ciphertext information of the input password received by the password management system during the s verification time is queried one by one, and the input characters of the ciphertext information are marked; the ciphertext information is used to represent the real content of the input password, and the input characters are used to represent the ciphertext information digitally, so that the cumbersome input password can be represented briefly and accurately;

[0164] Input characters that are inconsistent with correct characters are recorded as abnormal characters, and the ciphertext status of the input password corresponding to the abnormal characters is marked as verification failure; correct characters refer to characters corresponding to the ciphertext information pre-stored in the password management system that can correctly unlock and access the IoT terminal password application, and are used as the basis for comparison with the input characters;

[0165] Count the number of input passwords whose ciphertext status is verification failure during s verification durations to obtain s verification failure values, and compare the s verification failure values ​​with the s verification durations to obtain s ciphertext verification failure rates;

[0166] The expression of ciphertext verification failure rate is:

[0167]

[0168] Where, MW sbs is the ciphertext verification failure rate of the sth subinterval, YZ sbs is the verification failure value of the sth subinterval, YZ scs is the verification time of the s-th subinterval.

[0169] The asset data backup value refers to the amount of asset data that has been securely backed up by the password application of the IoT terminal in the sub-interval, which can be used to indicate the amount of asset data that has been securely backed up by the password application of the IoT terminal. The larger the asset data backup value, the more asset data that has been securely backed up by the password application of the IoT terminal in the sub-interval, and the better the security of the password application of the IoT terminal.

[0170] Methods for obtaining asset data backup values ​​include:

[0171] Mark the first moment and the last moment of s subintervals respectively, and obtain s first moments and s last moments;

[0172] Through natural language processing technology, the keywords of all backup data in the database are marked one by one, and the backup data with the keyword "asset" is recorded as asset data; the keyword is used to concisely express the true meaning of the backup data, so that the backup data with longer content can be concisely expressed;

[0173] At s first moments and S last moments, the backup amount of asset data in the security backup system is counted respectively, and S initial backup values ​​and S termination backup values ​​are obtained;

[0174] Subtract the s termination backup values ​​from the S initial backup values ​​one by one to obtain S asset data backup values;

[0175] The expression of asset data backup value is:

[0176] ZC bfs =BF zzs -BF css ;

[0177] In the formula, ZC bfs is the asset data backup value of the sth subinterval, BF zzs is the termination backup value of the sth subinterval, BF css is the initial backup value of the sth subinterval.

[0178] The prediction and judgment module inputs abnormal IoT data into the trained machine learning model, predicts the IoT status value of the next sub-interval, and determines whether to issue an early warning prompt;

[0179] When abnormal IoT data is obtained, it can be input into the machine learning model that has been trained in advance, and the IoT status value of the next sub-interval can be predicted based on the abnormal IoT data of the previous sub-interval, so that the IoT status value can represent the good or bad password application status of the IoT terminal to meet the subsequent analysis and early warning needs;

[0180] The IoT status value includes the IoT normal status and the IoT abnormal status; the IoT normal status means that the password application status of the IoT terminal is good and no abnormal phenomenon occurs, and the IoT abnormal status means that the password application status of the IoT terminal is poor and abnormal phenomenon occurs; the IoT status value is obtained by collecting a large number of historical invalid access frequencies, traffic complexity values, ciphertext verification failure rates and asset data backup values ​​corresponding to the IoT normal status and IoT abnormal status;

[0181] Methods for training machine learning models include:

[0182] Pre-collect abnormal IoT data of multiple groups of IoT devices in normal IoT state and abnormal IoT state;

[0183] The abnormal IoT data is converted into multiple feature vectors using a sliding window method. The IoT state value is converted into a label corresponding to the abnormal IoT data according to the sliding step size. The normal state of IoT is converted to 0, and the abnormal state of IoT is converted to 1. One feature vector corresponds to one label and constitutes a set of training data. Multiple sets of training data constitute a training set. The abnormal IoT data are arranged in the order of collection time, and the prediction time step size SB, sliding step size HB and sliding window length CB are preset.

[0184] The feature vector is used as the input of the machine learning model, and the IoT state value of the next sub-interval after the predicted time step SB is used as the output. The subsequent IoT state value of each training set is used as the prediction target. The machine learning model is trained with the minimized sum of prediction errors as the training target to generate a machine learning model that predicts the IoT state value of the next sub-interval based on the abnormal IoT data of the previous sub-interval.

[0185] Exemplarily, the machine learning model is any one of CNN or AlexNet;

[0186] The calculation formula for the prediction error is:

[0187] zk=(ak-wk) 2 ;

[0188] Where zk is the prediction error, k is the group number of the feature vector; ak is the predicted state value corresponding to the kth group of feature vectors, and wk is the actual state value corresponding to the kth group of training data;

[0189] In the machine learning model, the feature vector is the abnormal IoT data, and the state value is the IoT state value;

[0190] Other model parameters of the machine learning model, target loss value, optimization algorithm, training set test set validation set ratio, and loss function optimization are all achieved through actual engineering implementation and continuous experimental tuning.

[0191] Early warning refers to the prompt information that needs to be issued when the password application of the IoT terminal is about to have an abnormal phenomenon in the future. It can represent the prediction results of the machine learning model and serve as the basis for subsequent optimization of the password application of the IoT terminal;

[0192] The methods for determining whether to issue an early warning include:

[0193] When the output of the machine learning model is 0, it means that the IoT state value of the next sub-interval is the normal state of IoT. At this time, the probability of abnormal phenomena occurring in the password application of the IoT terminal is low, and it is determined that no warning prompt will be issued;

[0194] When the output of the machine learning model is 1, it means that the IoT state value of the next sub-interval is an abnormal IoT state. At this time, the probability of abnormal phenomena occurring in the password application of the IoT terminal is high, and a warning prompt is issued.

[0195] The optimization instruction module divides the IoT terminals into warning levels and formulates IoT optimization instructions corresponding to the warning levels;

[0196] The warning level is used to classify the severity of abnormal IoT behavior of IoT terminals when the IoT terminals issue warning prompts, providing a basis for the formulation of subsequent IoT optimization instructions;

[0197] The warning levels include level 1 and level 2. Level 1 corresponds to a less severe abnormal IoT behavior of an IoT terminal, while level 2 corresponds to a more severe abnormal IoT behavior of an IoT terminal.

[0198] The division methods of primary and secondary levels include:

[0199] Compare the invalid access frequency, traffic complexity value, ciphertext verification failure rate and asset data backup value with the access frequency standard value, traffic complexity standard value, verification failure standard value and data backup standard value respectively; the access frequency standard value, traffic complexity standard value and ciphertext verification failure rate refer to the maximum values ​​of the invalid access frequency, traffic complexity value and ciphertext verification failure rate when an abnormal phenomenon occurs in the password application of the IoT terminal, and the data backup standard value refers to the minimum value of the asset data backup value when an abnormal phenomenon occurs in the password application of the IoT terminal, so as to provide a data comparison basis for whether the invalid access frequency, traffic complexity value, ciphertext verification failure rate and asset data backup value are marked as abnormal data, and ensure the accuracy of the subsequent identification mark of abnormal data;

[0200] The invalid access frequency greater than the access frequency standard value, the traffic complexity value greater than the traffic complexity standard value, the ciphertext verification failure rate greater than the verification failure standard value, and the asset data backup value less than the data backup standard value are recorded as abnormal data, and the number of abnormal data is counted;

[0201] When the number of abnormal data is 1 or 2, it means that the password application of the IoT terminal needs a low-level warning, and the warning level of the IoT terminal is divided into the first level;

[0202] When the number of abnormal data is 3 or 4, it means that the password application of the IoT terminal requires a high-level warning, and the warning level of the IoT terminal is divided into two levels.

[0203] After the warning levels of IoT terminals are divided, corresponding IoT optimization instructions can be formulated according to the different warning levels, so as to optimize the abnormal situations in the password application of IoT terminals, avoid the abnormal failure phenomena that are about to occur in IoT terminals, and thus play a role in early protection and risk avoidance for the password application security of IoT terminals;

[0204] The IoT optimization instructions include data reinforcement monitoring instructions and data defense monitoring instructions; the data reinforcement monitoring instructions refer to further strengthening monitoring of the data in the password application of the IoT terminal. Specifically, the interval of data monitoring can be shortened, and the sampling rate of data monitoring can be increased; the data defense monitoring instructions refer to further defense monitoring of the data in the password application of the IoT terminal, so that the security defense system of the IoT terminal can always be in the strongest defense state;

[0205] The method for formulating data enhancement monitoring instructions and data defense monitoring instructions includes:

[0206] When the warning level of the IoT terminal is level 1, it is necessary to perform enhanced monitoring operations on the IoT terminal, and a data enhanced monitoring instruction is formulated;

[0207] When the warning level of the IoT terminal is level 2, security defense operations need to be performed on the IoT terminal, and a data defense monitoring instruction is formulated.

[0208] In this embodiment, by marking the behavior time period of the IoT behavior, and obtaining the basic behavior parameters of the IoT terminal within the behavior time period, the operating status of the IoT terminal is identified based on the abnormal identification criteria, and it is determined whether to perform the analysis and warning operation, the warning period is divided into sub-intervals, and the abnormal IoT data of the IoT terminal in the sub-interval is obtained, the abnormal IoT data is input into the trained machine learning model, the IoT state value of the next sub-interval is predicted, and it is determined whether to issue a warning prompt, the IoT terminal is divided into warning levels, and IoT optimization instructions corresponding to the warning levels are formulated; compared with the prior art, by marking the behavior time period, it can be used as a collection of basic behavior parameters of the IoT terminal. The time limit can not only accurately collect data representing the initial operating status of the IoT terminal, but also effectively reduce the collection amount of basic behavior parameters, reduce the data collection burden, and by importing abnormal IoT data into the machine learning model for prediction, it can accurately and in advance predict the abnormal state of the IoT terminal password application in the future. After predicting the abnormal state, it can formulate optimization instructions corresponding to the abnormal IoT behavior in the IoT terminal password application, thereby avoiding the phenomenon that the IoT terminal password application fails or even paralyzed due to abnormal IoT behavior in the future, effectively achieving the effect of early warning and improving the operation security of the IoT terminal password application.

[0209] Example 2: Please refer to Figure 2 As shown, the part not described in detail in this embodiment is described in the first embodiment, and an IoT terminal password application analysis and early warning method for abnormal IoT behavior monitoring is provided, which is applied to an IoT server and implemented based on an IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring, including:

[0210] S1: Mark the behavior period of the IoT behavior, and obtain the basic behavior parameters of the IoT terminal within the behavior period. The basic behavior parameters include the behavior span duration and the behavior collection rate;

[0211] S2: Based on the abnormal identification criteria, identify the operating status of the IoT terminal, which includes normal status and suspicious status, and determine whether to perform analysis and warning operations; if the analysis and warning operations are performed, execute S3; if the analysis and warning operations are not performed, repeat S1-S2;

[0212] S3: Divide the warning period into sub-intervals, and obtain abnormal IoT data of IoT terminals in the sub-intervals. The abnormal IoT behavior data includes invalid access frequency, traffic complexity value, ciphertext verification failure rate, and asset data backup value.

[0213] S4: Input the abnormal IoT data into the trained machine learning model, predict the IoT state value of the next sub-interval, which includes the normal state and abnormal state of IoT, and determine whether to issue an early warning prompt; if an early warning prompt is issued, execute S4; if no early warning prompt is issued, repeat S3-S4;

[0214] S5: The IoT terminals are divided into warning levels, including level 1 and level 2, and IoT optimization instructions corresponding to the warning levels are formulated. The IoT optimization instructions include data enhancement monitoring instructions and data defense monitoring instructions.

[0215] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring is applied to IoT servers, which is characterized by: include: The parameter acquisition module is used to mark the behavior period of the IoT behavior and obtain the basic behavior parameters of the IoT terminal within the behavior period. The basic behavior parameters include the behavior span duration and the behavior collection rate. The analysis and determination module is used to identify the operating status of the IoT terminal based on the abnormal identification criteria, the operating status includes the normal status and the suspicious status, and determine whether to perform the analysis and early warning operation; The data collection module is used to divide the warning period into sub-intervals and obtain abnormal IoT data of IoT terminals in the sub-intervals. The abnormal IoT behavior data includes invalid access frequency, traffic complexity value, ciphertext verification failure rate and asset data backup value; The prediction and judgment module is used to input abnormal IoT data into the trained machine learning model, predict the IoT state value of the next sub-interval, which includes the normal state and abnormal state of IoT, and determine whether to issue an early warning prompt; The optimization instruction module is used to divide the warning levels of IoT terminals into level one and level two, and formulate IoT optimization instructions corresponding to the warning levels. The IoT optimization instructions include data enhancement monitoring instructions and data defense monitoring instructions.

2. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 1 is characterized in that: The marking method of the behavior period includes: Query all behavioral events in the IoT terminal through the log management system and mark the behavioral characteristics of all behavioral events; Record the behavior events with the behavior characteristics of access, authority, ciphertext, asset, security and level as IoT behaviors, and obtain i IoT behaviors; The occurrence time of the first IoT behavior and the last IoT behavior are queried through the timestamp, and recorded as the start time and end time respectively; Taking the start time as the first starting point, extend forward along the timeline by a duration corresponding to a preset unit time period to obtain the start time of the time period; Taking the end time as the second starting point, extend the duration corresponding to a preset unit time period backward along the timeline to obtain the end time of the time period, and record the time period between the start time of the time period and the end time of the time period as the behavior time period.

3. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 2 is characterized in that: The method for obtaining the behavior span duration includes: Query the time when i IoT behaviors occur one by one through the timestamp to obtain the i behavior time; The duration between the i-th behavior moment and the i+1-th behavior moment is recorded as the subspan duration, and i-1 subspan durations are obtained; The duration of the i-1 sub-spans is accumulated and averaged to obtain the duration of the behavior span; The expression of behavior span duration is: Where XW kd is the behavior span duration, KD za is the duration of the ath subspan.

4. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 3 is characterized in that: The method for obtaining the behavior collection rate includes: The total amount of data in the database is counted at the start time of the time period and the end time of the time period to obtain the initial data value and the end data value; After subtracting the ending data value from the initial data value, the data collection value is obtained; The expression of the data collection value is: SJ sl =SL zz -SL CS ; In the formula, SJ sl is the data collection value, SL zz is the termination data value, SL cs is the initial data value; The amount of data generated at each i-th behavior moment is counted through the gateway, and the i-th output value is obtained. After accumulating the i-th output value one by one, the total amount of data is obtained. The expression of the total data value is: In the formula, SJ zl is the total amount of data, SC zb is the output value of the bth number; Compare the data collection value with the total data value to obtain the behavior collection rate; The expression of behavior collection rate is: Where XW sl Behavior inclusion rate.

5. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 4 is characterized in that: The abnormality identification criteria are: there is at least one suspicious parameter in the abnormal state; Methods for identifying normal and suspicious states include: Compare the behavior span duration with the standard span duration, and when the behavior span duration is less than the standard span duration, mark the behavior span duration as a suspicious parameter; Compare the behavior collection rate with the standard collection rate, and when the behavior collection rate is less than the standard collection rate, mark the behavior collection rate as a suspicious parameter; Count the number of parameters marked as suspicious in the basic behavior parameters to obtain suspicious values; When the suspicious value is 0, the operation status of the IoT terminal is identified as a normal status; When the suspicious value is 1 or 2, the operation status of the IoT terminal is identified as a suspicious status; The determination methods for whether to perform analysis and warning operations include: When the operation status of the IoT terminal is identified as a normal status, it is determined that the analysis and warning operation is not performed; When the operating status of the IoT terminal is identified as a suspicious state, it is determined to perform analysis and early warning operations.

6. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 5 is characterized in that: The method for acquiring the invalid access frequency includes: In the S sub-intervals, all access logs in the security defense system are queried one by one, and the authorization status of all access logs is identified one by one; The access logs with the authorization status of unauthorized and interrupted are recorded as invalid logs, and the number of invalid logs is counted; After comparing the number of invalid logs in S subintervals with the duration of the subintervals, S invalid access frequencies are obtained; The expression of invalid access frequency is: Where WX fws is the invalid access frequency of the sth subinterval, SL rzs is the number of invalid logs in the sth subinterval, SC qj is the duration of the subinterval.

7. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 6 is characterized in that: The method for obtaining the ciphertext verification failure rate includes: The time when the password management system receives the input password for the first time is the verification start time, and the time when the password management system receives the input password for the last time is the verification end time; In the s sub-intervals, the duration from the verification start time to the verification end time is recorded as the verification duration, and s verification durations are obtained; Query the ciphertext information of the input password received by the password management system during the s verification durations one by one, and mark the input characters of the ciphertext information; The input characters that are inconsistent with the correct characters are recorded as abnormal characters, and the ciphertext status of the input password corresponding to the abnormal characters is marked as verification failure; Count the number of input passwords whose ciphertext status is verification failure during s verification durations to obtain s verification failure values, and compare the s verification failure values ​​with the s verification durations to obtain s ciphertext verification failure rates; The expression of ciphertext verification failure rate is: Where, MW sbs is the ciphertext verification failure rate of the sth subinterval, YZ sbs is the verification failure value of the sth subinterval, YZ scs is the verification time of the s-th subinterval.

8. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 7 is characterized in that: The method for obtaining the asset data backup value includes: Mark the first moment and the last moment of s subintervals respectively, and obtain s first moments and s last moments; The keywords of all backup data in the database are marked one by one through natural language processing technology, and the backup data with the keyword "asset" is recorded as asset data; At s first moments and s last moments, the backup amount of asset data in the security backup system is counted respectively, and s initial backup values ​​and s termination backup values ​​are obtained; Subtract the s termination backup values ​​from the s initial backup values ​​one by one to obtain s asset data backup values; The expression of asset data backup value is: ZC bfs =BF zzs -BF css ; In the formula, ZC bfs is the asset data backup value of the sth subinterval, BF zzs is the termination backup value of the sth subinterval, BF css is the initial backup value of the sth subinterval.

9. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 8 is characterized in that: The training method of the machine learning model includes: Pre-collect abnormal IoT data of multiple groups of IoT devices in normal IoT state and abnormal IoT state; The abnormal IoT data is converted into multiple feature vectors using a sliding window method. The IoT state value is converted into a label corresponding to the abnormal IoT data according to the sliding step size. The normal state of IoT is converted to 0, and the abnormal state of IoT is converted to 1. One feature vector corresponds to one label and constitutes a set of training data. Multiple sets of training data constitute a training set. The abnormal IoT data are arranged in the order of collection time, and the prediction time step size SB, sliding step size HB and sliding window length CB are preset. The feature vector is used as the input of the machine learning model, and the IoT state value of the next subinterval after the predicted time step SB is used as the output. The subsequent IoT state value of each training set is used as the prediction target. The machine learning model is trained with the minimized sum of prediction errors as the training target to generate a machine learning model that predicts the IoT state value of the next subinterval based on the abnormal IoT data of the previous subinterval. The methods for determining whether to issue an early warning include: When the output of the machine learning model is 0, it is determined that no warning prompt will be issued; When the output of the machine learning model is 1, a warning prompt is issued.

10. The IoT terminal password application analysis and early warning system for abnormal IoT behavior monitoring according to claim 9 is characterized in that: The method for dividing the primary level and the secondary level includes: Compare the invalid access frequency, traffic complexity value, ciphertext verification failure rate and asset data backup value with the access frequency standard value, traffic complexity standard value, verification failure standard value and data backup standard value respectively; The invalid access frequency greater than the access frequency standard value, the traffic complexity value greater than the traffic complexity standard value, the ciphertext verification failure rate greater than the verification failure standard value, and the asset data backup value less than the data backup standard value are recorded as abnormal data, and the number of abnormal data is counted; When the number of abnormal data is 1 or 2, the warning level of the IoT terminal is divided into level 1; When the number of abnormal data is 3 or 4, the warning level of the IoT terminal is divided into the second level; The method for formulating data enhancement monitoring instructions and data defense monitoring instructions includes: When the warning level of the IoT terminal is level 1, formulate data enhanced monitoring instructions; When the warning level of the IoT terminal is level 2, a data defense monitoring instruction is formulated.

Images