Intelligent big data network intrusion behavior analysis method

Abstract

The invention relates to the technical field of network security, in particular to an intelligent big data network intrusion behavior analysis method. Comprising the following steps: S1, detecting power supply states of all Internet of Things equipment, and dividing the Internet of Things equipment into two types according to a power supply connection mode: one type is connected to a main power supply and is defined as the Internet of Things equipment of the main power supply; one type is Internet of Things equipment which is not connected to a main power supply and is defined as a standby power supply; and S2, respectively recording sensitive data access frequency and configuration modification frequency for the main power supply Internet of Things equipment and the standby power supply Internet of Things equipment. According to the method, the power supply state of the Internet of Things equipment is detected and classified, the sensitive data access and configuration modification frequency of the main power supply equipment and the standby power supply equipment are recorded, and'movable whistles' are set for real-time monitoring; and the data acquisition and transmission frequency is dynamically adjusted, tasks are reasonably allocated when the storage capacity reaches the limit, and the resource configuration is optimized, so that the security, stability and response speed of the system are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an intelligent big data network intrusion behavior analysis method. Background Art

[0002] With the rapid development of IoT technology, more and more devices are connected to the internet, forming a vast and complex network. These devices span a wide range of fields, from smart homes and industrial automation to healthcare, significantly improving the convenience and efficiency of our lives and work. However, as the number of connected devices increases, network security issues are becoming increasingly prominent. In particular, cyberattacks targeting IoT devices are becoming more frequent and sophisticated.

[0003] IoT devices are often deployed in a variety of environments and face varying power supply conditions, including primary and backup power. Since many IoT devices directly process sensitive data, attacks can have serious consequences. Traditional network security measures often struggle to address the unique challenges of IoT environments, such as resource constraints, heterogeneity, and large-scale distribution. Therefore, developing security solutions specifically for the IoT is becoming increasingly urgent.

[0004] To effectively prevent potential network intrusions, leveraging big data analysis and intelligent monitoring technologies has become a viable approach. By collecting and analyzing behavioral data from a large number of devices, abnormal patterns can be identified and early warnings can be issued. Behavioral changes before and after power outages require meticulous monitoring, as these devices are more vulnerable to security risks. Intelligent monitoring systems can dynamically adjust their policies based on real-time data, ensuring system security and reliability even during network instability. Summary of the Invention

[0005] In order to overcome the shortcomings of high difficulty in security and intrusion detection of the Internet of Things, the present invention provides an intelligent big data network intrusion behavior analysis method.

[0006] The technical solution of the present invention is: an intelligent big data network intrusion behavior analysis method, comprising the following steps: S1: Detect the power supply status of all IoT devices and classify them into two categories based on the power connection method: one is connected to the main power supply, defined as the main power IoT device; the other is not connected to the main power supply, defined as the backup power IoT device; S2: For the main power IoT device and the backup power IoT device, record the frequency of sensitive data access and the frequency of configuration modification respectively; S3: Based on the frequency of sensitive data access and configuration modification, a monitoring point is set for each type of IoT device and defined as an active sentry. The active sentry is used to closely monitor the access to sensitive data and configuration modification of the IoT device before and after the power outage event occurs. S4: According to the monitoring data provided by the activity sentry, adjust the data collection frequency and data sending frequency of the backup power supply IoT device.

[0007] Preferably, the power supply status of all IoT devices is detected, and IoT devices are divided into two categories according to the power connection mode: one category is connected to the main power supply, defined as the main power IoT device; the other category is not connected to the main power supply, defined as the backup power IoT device, including: Assess the power status of all IoT devices; For the main power IoT device, a backup power IoT device is designated as the first response device before data is received and after data is sent; If a power outage event occurs on the first responding device, another available device within a short period of time is selected, where the other available device is the first responding device that has not experienced a power outage event.

[0008] Preferably, the recording of the sensitive data access frequency and the configuration modification frequency for the main power supply IoT device and the backup power supply IoT device respectively includes: Obtain the power outage duration of the first response device and the main power supply device, and use the intrusion probability calculation formula to calculate the probability of network intrusion behavior before and after the power outage. The intrusion probability calculation formula is as follows:

[0009] in, is the invasion probability, 、 are the power outage duration of the first responder equipment, The duration of power outage of the main power supply IoT device; based on the probability of intrusion behavior, the specific time of network intrusion behavior before and after the power outage is calculated using the intrusion time determination formula. is the minimum value.

[0010] Preferably, A and C are respectively the power-off duration of the first responding device, including: First responder equipment includes at least two backup power IoT devices.

[0011] Preferably, the intrusion moment determination formula includes:

[0012]

[0013] in, For the invasion time, and The frequencies of sensitive data access during the power outage of the first responder device before the main power IoT device receives data and after the main power IoT device sends data are respectively: Frequency of sensitive data access during power outages of IoT devices powered by primary power; and The modification frequency is configured for the first responder device during power outage before receiving data from the main power IoT device and after sending data from the main power IoT device. Configure the modification frequency during power outage of the main power supply IoT device. To modify the frequency of the configuration when the main power supply IoT device is not powered off, and The time intervals are respectively from the time when the storage capacity of the first response device reaches the limit before the data of the main power supply IoT device is received and after the data of the main power supply IoT device is sent to the time when the power supply of the main power supply IoT device is restored. From the moment the main power supply IoT device is powered off to the moment the power is restored, is the minimum value; is the adjustment factor.

[0014] Preferably, based on the sensitive data access frequency and configuration modification frequency, a monitoring point is set for each type of IoT device and defined as an active sentinel, including: Record the frequency of sensitive data access for primary power IoT devices and backup power IoT devices respectively; Generate an optimized configuration plan for the main power IoT device and the backup power IoT device based on the recorded frequency of access to sensitive data; The optimized configuration scheme refers to allocating configuration modification frequencies for the main power IoT device and the backup power IoT device according to the sensitive data access frequency, which is defined as the first configuration modification frequency. The higher the sensitive data access frequency, the higher the device configuration modification frequency. Record the configuration modification frequency after the main power supply IoT device is restored and define it as the second configuration modification frequency; Based on the first configuration modification frequency and the second configuration modification frequency, a dedicated activity whistle is set for each type of IoT device.

[0015] Preferably, the step of setting a dedicated activity whistle for each type of IoT device based on the first configuration modification frequency and the second configuration modification frequency includes: Taking the position where the active whistle first appears as a reference point, obtaining the result of dividing the first configuration modification frequency by the second configuration modification frequency and defining it as the configuration modification ratio; If the configuration modification ratio is greater than 1, the active sentry focuses on the access pattern of the device; If the configuration modification ratio is less than 1, the active sentry focuses on the configuration modification mode of the device; If the configuration modification ratio is equal to 1, a new active sentinel is generated.

[0016] Preferably, if the configuration modification ratio is equal to 1, generating a new active sentinel comprises: Generate an activity whistle based on the power outage time of the main power IoT device and the backup power IoT device; Record the movement trajectory of the active sentry in the intersection part; The intersection means that when the storage capacity of the backup power IoT device reaches its limit, the configuration of the main power IoT device is modified; If the frequency of configuration modification of the active sentinel in the intersection reaches a preset threshold, a warning is issued.

[0017] Preferably, adjusting the data collection frequency and data transmission frequency of the backup power supply IoT device according to the monitoring data provided by the activity sentry includes: Adjust the frequency of data collection and transmission of backup power supply IoT devices based on the movement trajectory of the active sentry; If the storage capacity of one of the backup power IoT devices reaches its limit, data is collected using the remaining devices; Based on the activity track of the activity whistle of the main power supply IoT device, the data sending frequency of the backup power supply IoT device is determined.

[0018] Preferably, determining the data transmission frequency of the backup power supply Internet of Things device based on the activity track of the activity whistle of the main power supply Internet of Things device includes: If the moving trajectory frequency of the active sentry in the intersection part is greater than the moving trajectory frequency in the non-intersection part, the frequency of sending data of the backup power supply IoT device is delayed; If the moving trajectory frequency of the active sentry in the intersection part is less than the moving trajectory frequency of the non-intersection part, the data sending frequency of the backup power supply IoT device is sent normally.

[0019] Beneficial Effects: This invention detects and categorizes the power supply status of IoT devices, records the frequency of sensitive data access and configuration modifications for both primary and backup power IoT devices, and sets up real-time "activity whistle" monitoring. Based on this, a specific formula is used to calculate the probability and time of intrusion for precise early warning. The data collection and transmission frequency of backup power IoT devices is dynamically adjusted based on the "activity whistle" monitoring data. When device storage capacity reaches its limit, collection tasks are rationally allocated. The transmission frequency is also optimized based on the activity whistle trajectory of the primary power device. This effectively enhances risk prevention capabilities, further optimizes resource allocation, and comprehensively enhances system security and stability, while improving response speed, while achieving precise security monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a flow chart of the intelligent big data network intrusion behavior analysis method of the present invention; Figure 2 This is a schematic diagram of data collection and transmission between the main power supply IoT device and the backup power supply IoT device of the present invention. DETAILED DESCRIPTION

[0021] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0022] An intelligent big data network intrusion behavior analysis method, such as Figure 1 As shown, the following steps are included: S1: Detect the power supply status of all IoT devices and classify them into two categories based on the power connection method: one is connected to the main power supply, defined as the main power IoT device; the other is not connected to the main power supply, defined as the backup power IoT device; S2: For the main power IoT device and the backup power IoT device, record the frequency of sensitive data access and the frequency of configuration modification respectively; S3: Based on the frequency of sensitive data access and configuration modification, a monitoring point is set for each type of IoT device and defined as an active sentry. The active sentry is used to closely monitor the access to sensitive data and configuration modification of the IoT device before and after the power outage event occurs. S4: According to the monitoring data provided by the activity sentry, adjust the data collection frequency and data sending frequency of the backup power supply IoT device.

[0023] Detect the power supply status of all IoT devices and classify them into two categories based on their power connection method: one category is connected to the main power supply, defined as primary power IoT devices, and the other category is not connected to the main power supply, defined as backup power IoT devices, including: Assess the power status of all IoT devices; For the main power IoT device, a backup power IoT device is designated as the first response device before data is received and after data is sent; If a power outage event occurs on the first responding device, another available device within a short period of time is selected, where the other available device is the first responding device that has not experienced a power outage event.

[0024] A further explanation is that Figure 2 As shown, IoT devices have the characteristics of flexible deployment and automatic data collection, so not all IoT devices are connected to the main power supply; due to differences in working environments and uncertainties in power supply, power outages may occur in both main power IoT devices and backup power IoT devices; and the backup power supply needs to send data to devices with main power, such as the main server or central control system; the first response device is used to help detect network intrusion when the device using the main power supply is powered off; the first response device that has not experienced a power outage is, for example, there are 4 backup power IoT devices, two of which are designated as the first response devices. If a power outage occurs in the two designated backup power IoT devices, the remaining two backup power IoT devices that have not experienced a power outage are selected as the first response devices.

[0025] For the main power IoT device and the backup power IoT device, record the frequency of sensitive data access and configuration modification, including: Obtain the power outage duration of the first response device and the main power supply device, and use the intrusion probability calculation formula to calculate the probability of network intrusion behavior before and after the power outage. The intrusion probability calculation formula is as follows:

[0026] in, is the invasion probability, 、 are the power outage duration of the first responder equipment, The duration of power outage of the main power supply IoT device; based on the probability of intrusion behavior, the specific time of network intrusion behavior before and after the power outage is calculated using the intrusion time determination formula. is the minimum value.

[0027] Further explanation is, is the minimum value; Indicates the impact of the power outage duration of the main power supply IoT device on the intrusion probability; Indicates the impact of power outage duration of first responder equipment on the intrusion probability; is an interaction term, which represents the joint impact when both are powered off at the same time, and is used to adjust the overestimation caused by a single factor. When the first response device or the main power supply device is powered off separately, the intrusion risk will increase. However, when both are powered off at the same time, this risk is not simply superimposed, but needs to be adjusted through the interaction term to avoid overestimation of the intrusion probability. The minimum value is added to prevent the denominator from being zero and to ensure the mathematical stability of the formula. A is the power-off duration of the backup power supply IoT device specified before the main power supply IoT device receives data, and C is the power-off duration of the backup power supply IoT device specified after the main power supply IoT device sends data.

[0028] A and C are the power outage durations of the first responder equipment, including: First responder equipment includes at least two backup power IoT devices.

[0029] A further explanation is that when the main server or central control system loses power, the backup power supply IoT device continues to collect and store data; and when the main server or central control system resumes power, the main power supply IoT device quickly collects and sends data. At this time, the data of the backup power supply IoT device is not directly sent to the main server or central control system, resulting in the main server or central control system making configuration modifications. Due to the lack of data collected by the backup power supply IoT device to correct the configuration modifications, there is a risk of network intrusion.

[0030] The formula for determining the invasion moment includes:

[0031]

[0032] in, For the invasion time, and The frequencies of sensitive data access during the power outage of the first responder device before the main power IoT device receives data and after the main power IoT device sends data are respectively: Frequency of sensitive data access during power outages of IoT devices powered by primary power; and The modification frequency is configured for the first responder device during power outage before receiving data from the main power IoT device and after sending data from the main power IoT device. Configure the modification frequency during power outage of the main power supply IoT device. To modify the frequency of the configuration when the main power supply IoT device is not powered off, and The time intervals are respectively from the time when the storage capacity of the first response device reaches the limit before the data of the main power supply IoT device is received and after the data of the main power supply IoT device is sent to the time when the power supply of the main power supply IoT device is restored. From the moment the main power supply IoT device is powered off to the moment the power is restored, is the minimum value; is the adjustment factor.

[0033] Further explanation is, is the minimum value; is the adjustment coefficient, used to control the degree of influence; and Indicates the total frequency of configuration changes of the first responder device during a power outage. Indicates the total frequency of configuration changes of main power IoT devices during power outages. Indicates the time point of potential intrusion occurrence calculated based on the frequency of sensitive data access and configuration modification. 、 、 It reflects the frequency of each device accessing sensitive data during a power outage and is an important indicator for evaluating system behavior. 、 、 This reflects the frequency of configuration changes on each device during a power outage, which helps identify abnormal behavior. As a baseline value, it helps compare the changes in the configuration modification frequency before and after the power outage and evaluate the impact of the power outage on system behavior. Assume that in a simple scenario, there is a group of IoT devices, and the main power supply IoT device is powered off for a period of time. =10 minutes, after power is restored, the frequency of sensitive data access during the power outage =5 times / minute, configuration modification frequency =2 times / minute. There are two first responders. The first responder is powered off for A=8 minutes before data is received. The frequency of sensitive data access during the power outage is =4 times / minute, configuration modification frequency =3 times / minute; the first responder device is powered off for C=6 minutes after receiving the data, and the frequency of sensitive data access =3 times / minute, configuration modification frequency =2 times / minute. Set the adjustment coefficient =0.5, minimum value = 0.1, the time from when the storage capacity of the first responding device reaches its limit to when the main power IoT device resumes power supply, = 3 minutes, =2 minutes. =2.25, =29.25, calculated =29.25, which indicates the time point at which a potential intrusion may occur, calculated from the starting point of some key events (the unit of the time point here depends on the actual scenario setting, assuming it is minutes).

[0034] Based on the frequency of sensitive data access and configuration modification, a monitoring point is set for each type of IoT device and defined as an active sentinel, including: Record the frequency of sensitive data access for primary power IoT devices and backup power IoT devices respectively; Generate an optimized configuration plan for the main power IoT device and the backup power IoT device based on the recorded frequency of access to sensitive data; The optimized configuration scheme refers to allocating configuration modification frequencies for the main power IoT device and the backup power IoT device according to the sensitive data access frequency, which is defined as the first configuration modification frequency. The higher the sensitive data access frequency, the higher the device configuration modification frequency. Record the configuration modification frequency after the main power supply IoT device is restored and define it as the second configuration modification frequency; Based on the first configuration modification frequency and the second configuration modification frequency, a dedicated activity whistle is set for each type of IoT device.

[0035] To further explain, the frequency of sensitive data access for both primary and backup IoT devices is recorded to establish a baseline of normal behavior for each device. Based on these access frequencies, an optimized configuration plan is generated to adjust the device's configuration modification frequency (the first configuration modification frequency), ensuring that devices with high access frequencies have a higher configuration modification frequency. When power is restored to the primary IoT devices, the new configuration modification frequency (the second configuration modification frequency) is recorded. Finally, based on the first and second configuration modification frequencies, dedicated activity sentinels are set for each device type to monitor and compare their behavior before and after the power outage in real time, promptly identifying and responding to any anomalies. This allows potential internal network intrusions to be identified from seemingly normal access and modification attempts.

[0036] Based on the first configuration modification frequency and the second configuration modification frequency, a dedicated activity whistle is set for each type of IoT device, including: Taking the position where the active whistle first appears as a reference point, obtaining the result of dividing the first configuration modification frequency by the second configuration modification frequency and defining it as the configuration modification ratio; If the configuration modification ratio is greater than 1, the active sentry focuses on the access pattern of the device; If the configuration modification ratio is less than 1, the active sentry focuses on the configuration modification mode of the device; If the configuration modification ratio is equal to 1, a new active sentinel is generated.

[0037] A further explanation is that the first configuration modification frequency is based on the sensitive data access frequency of the main power IoT device and the backup power IoT device, while the second configuration modification frequency is based on the time when the main power IoT device resumes power. Since the data collected by the backup power device needs to be sent to the device with the main power supply, if the configuration ratio is greater than 1, it means that the sensitive data with high access frequency has not been modified in the configuration when the main power IoT device resumes power, and there is abnormal behavior. On the contrary, if the configuration ratio is less than 1, it means that the sensitive data with low access frequency has been modified in the configuration when the main power IoT device resumes power, and there is also an abnormal problem. When the configuration modification ratio is 1, it is determined by the movement trajectory of the active sentry.

[0038] If the configuration modification ratio is equal to 1, a new active sentinel is generated, including: Generate an activity whistle based on the power outage time of the main power IoT device and the backup power IoT device; Record the movement trajectory of the active sentry in the intersection part; The intersection means that when the storage capacity of the backup power IoT device reaches its limit, the configuration of the main power IoT device is modified; If the frequency of configuration modification of the active sentinel in the intersection reaches a preset threshold, a warning is issued.

[0039] To further illustrate, consider three devices: devices 1 and 2 are backup power IoT devices, and device 3 is the primary power IoT device. When device 3 loses power, devices 1 and 2 continue to collect data until their storage capacity reaches capacity. However, due to the loss of the primary power source connected to device 3, the data collected by devices 1 and 2 cannot be transmitted. When the primary power source is restored, device 3 undergoes a configuration change, representing the intersection. In the activity sentry monitoring mechanism, the activity sentry records the movement trajectory and configuration change frequency within the intersection. If the configuration change frequency reaches a preset threshold, an alert is issued. Configuration changes within the intersection lack data from devices 1 and 2. Normally, configuration changes should be based on comprehensive data. Therefore, an abnormally high frequency of configuration changes is likely a sign of network intrusion. Activity sentry monitors this unusual situation to determine if there is a security risk. Activity sentry collects movement trajectories using monitoring nodes deployed within the IoT device network. These monitoring nodes record the device nodes and timestamps passed by the activity sentry in real time, generating activity sentry movement trajectory data. To determine the frequency of movement between the intersecting and non-intersecting parts, the system counts the number of device nodes that the activity sentry passes through in both the intersecting and non-intersecting parts within a preset time period (e.g., every minute). If the number of device nodes passing through the intersecting part is greater than the non-intersecting part, the frequency of the movement trajectory in the intersecting part is determined to be greater than that in the non-intersecting part; otherwise, it is determined to be less. Based on this determination, the system automatically adjusts the data transmission frequency of the backup power supply IoT device.

[0040] Adjust the data collection and transmission frequencies of the backup power supply IoT device based on the monitoring data provided by the activity whistle, including: Adjust the frequency of data collection and transmission of backup power supply IoT devices based on the movement trajectory of the active sentry; If the storage capacity of one of the backup power IoT devices reaches its limit, data is collected using the remaining devices; Based on the activity track of the activity whistle of the main power supply IoT device, the data sending frequency of the backup power supply IoT device is determined.

[0041] A further explanation is that if the storage capacity of device No. 1 reaches its limit, device No. 2 will be used to continue storing data; if the storage capacity of device No. 2 reaches its limit, device No. 1 will be used to continue storing data; the purpose of determining the data transmission frequency of the backup power supply IoT device is to verify the occurrence of network intrusion.

[0042] Based on the activity track of the active whistle of the main power IoT device, the data transmission frequency of the backup power IoT device is determined, including: If the moving trajectory frequency of the active sentry in the intersection part is greater than the moving trajectory frequency in the non-intersection part, the frequency of sending data of the backup power supply IoT device is delayed; If the moving trajectory frequency of the active sentry in the intersection part is less than the moving trajectory frequency of the non-intersection part, the data sending frequency of the backup power supply IoT device is sent normally.

[0043] Further explanation is that the reason for delaying the frequency of sending backup power IoT device data is that the frequency of configuration modifications occurring in the movement trajectory of the intersection part is greater than the frequency of movement trajectory in the non-intersection part. Therefore, the configuration modification at this time is abnormal because the configuration modification in the intersection part only modifies a small part of the data, not all the data.

[0044] The above is a detailed introduction to the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for those skilled in the art, based on the idea of ​​the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. An intelligent big data network intrusion behavior analysis method, characterized by: The following steps are involved: S1: Detect the power supply status of all IoT devices and classify them into two categories according to the power connection method: one is connected to the main power supply, defined as the main power IoT device; the other is not connected to the main power supply, defined as the backup power IoT device; S2: for the main power IoT device and the backup power IoT device, respectively record the sensitive data access frequency and the configuration modification frequency; S3: Based on the sensitive data access frequency and configuration modification frequency, a monitoring point is set for each type of IoT device and defined as an activity sentinel; the activity sentinel is used to closely monitor the access to sensitive data and configuration modification of the IoT device before and after the power failure event occurs; S4: According to the monitoring data provided by the activity sentinel, adjust the data collection frequency and data sending frequency of the backup power supply IoT device.

2. The intelligent big data network intrusion behavior analysis method according to claim 1 is characterized in that: The power supply status of all IoT devices is detected, and IoT devices are divided into two categories according to the power connection method: one category is connected to the main power supply, defined as the main power IoT device; One category is IoT devices that are not connected to the main power supply and are defined as backup power supply devices, including: Assess the power status of all IoT devices; For the main power IoT device, designate a backup power IoT device as the first response device before data is received and after data is sent; If a power outage event occurs to the first responding device, another available device in the near time is selected, and the other available device is the first responding device that has not experienced a power outage event.

3. The intelligent big data network intrusion behavior analysis method according to claim 1 is characterized in that: The method of recording the sensitive data access frequency and the configuration modification frequency for the main power supply IoT device and the backup power supply IoT device respectively includes: Obtain the power outage duration of the first response device and the main power supply device, and use the intrusion probability calculation formula to calculate the probability of network intrusion behavior before and after the power outage. The intrusion probability calculation formula is as follows: , in, is the invasion probability, , are the power outage duration of the first responder equipment, The duration of power outage of the IoT device as the main power source; based on the probability of intrusion, the specific time of network intrusion before and after power outage is calculated using the intrusion time determination formula. is a minimum value.

4. The intelligent big data network intrusion behavior analysis method as claimed in claim 3 is characterized in that: A and C are respectively the power-off duration of the first responding device, including: First responder equipment includes at least two backup power IoT devices.

5. The intelligent big data network intrusion behavior analysis method as claimed in claim 3 is characterized in that: The intrusion moment determination formula includes: , , in, For the invasion time, and They are the sensitive data access frequencies during the power-off process of the first responder device before the main power IoT device receives data and after the main power IoT device sends data, Frequency of access to sensitive data during power outages of IoT devices powered by the mains; and The modification frequency is configured during the power-off process of the first responding device before receiving the data of the main power IoT device and after sending the data of the main power IoT device. Configure the modification frequency during power outage of the main power supply IoT device. To configure the modification frequency during the process of main power supply IoT device without power failure, and They are respectively the time when the storage capacity of the first responding device reaches the limit before the data of the main power IoT device is received and after the data of the main power IoT device is sent, and the time when the main power IoT device resumes power supply. From the time when the main power supply IoT device is powered off to the time when the power is restored, is the minimum value; is the adjustment factor.

6. The intelligent big data network intrusion behavior analysis method according to claim 1 is characterized in that: Based on the sensitive data access frequency and configuration modification frequency, a monitoring point is set for each type of IoT device and defined as an activity sentinel, including: Record the frequency of sensitive data access for main power IoT devices and backup power IoT devices respectively; Generate an optimized configuration plan for the main power IoT device and the backup power IoT device based on the recorded access frequency of sensitive data; The optimization configuration scheme refers to allocating configuration modification frequencies for the main power IoT device and the backup power IoT device according to the sensitive data access frequency, which is defined as the first configuration modification frequency. The higher the sensitive data access frequency, the higher the device configuration modification frequency. Record the configuration modification frequency after the main power IoT device resumes power supply and define it as the second configuration modification frequency; Based on the first configuration modification frequency and the second configuration modification frequency, a dedicated activity whistle is set for each type of IoT device.

7. The intelligent big data network intrusion behavior analysis method according to claim 6 is characterized in that: The step of setting a dedicated activity whistle for each type of IoT device based on the first configuration modification frequency and the second configuration modification frequency includes: Taking the position where the active sentinel first appears as a reference point, obtaining the result of dividing the first configuration modification frequency by the second configuration modification frequency and defining it as a configuration modification ratio; If the configuration modification ratio is greater than 1, the active sentinel focuses on the access mode of the device; If the configuration modification ratio is less than 1, the active sentinel focuses on the configuration modification mode of the device; If the configuration modification ratio is equal to 1, a new active sentinel is generated.

8. The intelligent big data network intrusion behavior analysis method according to claim 7 is characterized in that: If the configuration modification ratio is equal to 1, a new activity sentinel is generated, including: Generate an activity whistle based on the power outage time of the main power IoT device and the backup power IoT device; Record the moving trajectory of the active sentinel in the intersection part; The intersection means that when the storage capacity of the backup power IoT device reaches its limit, the configuration of the main power IoT device is modified; If the frequency of configuration modification of the active sentinel in the intersection reaches a preset threshold, a warning is issued.

9. The intelligent big data network intrusion behavior analysis method according to claim 1, characterized in that: The method of adjusting the data collection frequency and data transmission frequency of the backup power supply IoT device according to the monitoring data provided by the activity sentinel includes: Adjust the frequency of data collection and transmission of backup power supply IoT devices based on the movement trajectory of the activity sentinel; If the storage capacity of one of the backup power IoT devices reaches its limit, the remaining devices are used to collect data; Based on the activity track of the activity whistle of the main power IoT device, the data sending frequency of the backup power IoT device is determined.

10. The intelligent big data network intrusion behavior analysis method according to claim 9, characterized in that: The method of determining the data transmission frequency of the backup power supply Internet of Things device based on the activity track of the activity whistle of the main power supply Internet of Things device includes: If the moving trajectory frequency of the active sentinel in the intersection part is greater than the moving trajectory frequency of the non-intersection part, the frequency of sending the backup power supply IoT device data is delayed; If the moving trajectory frequency of the active sentinel in the intersection part is less than the moving trajectory frequency of the non-intersection part, the data sending frequency of the backup power supply IoT device is sent normally.

Images