Internet of Things security enhancement verification method based on deep learning and adaptive decision-making

Abstract

The present invention belongs to the field of Internet of Things security technology, and specifically relates to an Internet of Things security enhancement verification method based on deep learning and adaptive decision-making, including the following steps: using a large amount of Internet of Things security data to train a deep learning model that can identify Internet of Things security vulnerabilities; according to the recognition results of the deep learning model, combined with the real-time operating status and security requirements of the Internet of Things system, through an adaptive decision-making algorithm, a security verification strategy for the Internet of Things system is generated; according to the security verification strategy generated by the adaptive decision-making module, the Internet of Things system is security verified; and the operation logs, network traffic data and security event multi-source data of the Internet of Things device are integrated. The present invention uses a deep learning model to automatically identify Internet of Things security vulnerabilities, and generates a security verification strategy through an adaptive decision-making algorithm, thereby realizing the automation of Internet of Things security verification, reducing manual participation and improving verification efficiency.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things security technology, and specifically relates to an Internet of Things security enhancement verification method based on deep learning and adaptive decision-making. Background Art

[0002] In recent years, the Internet of Things (IoT) technology has developed rapidly and is widely used in smart homes, smart cities, industrial automation and other fields. However, with the explosive growth of IoT devices, their security issues have become increasingly prominent. Due to the large number of IoT devices, their wide distribution, and the lack of sufficient security protection measures, the IoT system faces serious security threats. Therefore, how to ensure the security and reliability of the IoT system is an urgent problem to be solved.

[0003] Traditional IoT security verification methods mainly rely on static analysis and dynamic testing, but these methods have many limitations. For example, static analysis often cannot cover all security vulnerabilities, while dynamic testing may be affected by the test environment and test data, resulting in inaccurate verification results. In addition, these methods usually require a lot of manual participation, which is inefficient and costly.

[0004] Although static analysis methods can identify potential problems in the code, their limitation is that they cannot detect vulnerabilities or behaviors at runtime. Static analysis can usually only check source code or compiled binary files, and cannot simulate the complex interactions and dynamic behaviors in the actual running environment. Therefore, it may not be able to find problems that only appear at runtime, such as buffer overflows and SQL injections.

[0005] The dynamic testing method detects security vulnerabilities by executing the program in the actual operating environment, but it is limited by the test environment and test data. For example, if the test environment does not fully simulate the real usage scenario, or the test data is not sufficient to cover all possible input situations, then dynamic testing may not be able to find all potential security issues. In addition, dynamic testing usually requires a lot of resources and time, especially for resource-constrained IoT devices, which makes the implementation of dynamic testing more difficult.

[0006] In addition, traditional security verification methods often require a lot of manual participation, which not only increases costs but also may lead to human errors. Due to the large number and wide distribution of IoT devices, manual verification methods are difficult to achieve comprehensive coverage, thus increasing the risk of security vulnerabilities. Summary of the invention

[0007] In response to the technical problems of limitations in the above-mentioned existing IoT security verification methods, the present invention provides an IoT security enhancement verification method based on deep learning and adaptive decision-making, which realizes automatic, accurate and efficient verification of the security and reliability of the IoT system.

[0008] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0009] The IoT security enhancement verification method based on deep learning and adaptive decision-making includes the following steps:

[0010] S1. Use a large amount of IoT security data to train a deep learning model that can identify IoT security vulnerabilities;

[0011] S2. Based on the recognition results of the deep learning model, combined with the real-time operating status and security requirements of the IoT system, a security verification strategy for the IoT system is generated through an adaptive decision-making algorithm;

[0012] S3, perform security verification on the IoT system according to the security verification strategy generated by the adaptive decision module;

[0013] S4. By integrating the operation logs of IoT devices, network traffic data, and multi-source data of security events, the accuracy and efficiency of deep learning models in identifying IoT security vulnerabilities can be improved.

[0014] The method for training a deep learning model capable of identifying IoT security vulnerabilities in S1 is:

[0015] S1.1. Use convolutional neural network (CNN) for feature extraction. Convolutional neural network (CNN) captures local patterns or structures in input data through convolutional layers and generates a series of feature maps.

[0016] S1.2, the feature map is downsampled through the pooling layer to reduce the spatial dimension of the feature map while retaining important information;

[0017] S1.3. Use a recurrent neural network (RNN) to process time series data. At each time step, the RNN takes the current input and the hidden state of the previous time step as input and outputs the hidden state of the current time step.

[0018] S1.4, the features extracted by CNN are fused with the time series features learned by RNN, and the result of feature fusion is further passed to the fully connected layer for more complex feature representation and classification tasks;

[0019] S1.5. After feature extraction and fusion, the data is passed to the fully connected layer, which compresses and integrates the feature vectors for classification prediction; the Softmax function is applied to calculate the probability value corresponding to each category and output the final classification result;

[0020] S1.6. Use the cross entropy loss function to calculate the difference between the actual label and the predicted probability, and adjust the model parameters through the optimization algorithm to minimize the error. During the training process, it is necessary to combine the Dropout technology to prevent overfitting and ensure the generalization ability of the model on different data sets.

[0021] The method for generating a security verification strategy for the Internet of Things system in S2 is:

[0022] S2.1. Use reinforcement learning algorithms to learn the optimal strategy in a specific environment. In the IoT system, reinforcement learning algorithms continuously adjust the control strategy through interaction with the environment to improve the flexibility and intelligence of the system.

[0023] S2.2, the agent performs actions in the IoT system according to the learned strategy. Based on the execution results, the environment gives a reward signal, and the agent adjusts the strategy according to the reward signal;

[0024] S2.3, using genetic algorithms to optimize reinforcement learning strategy parameters. Genetic algorithms search for optimal strategy parameters by simulating the biological evolution process, including defining individual representations, initializing populations, evaluating fitness, selecting operations, crossover operations, mutation operations, updating populations, and determining termination conditions;

[0025] S2.4, IoT system adjusts control strategy in real time through reinforcement learning to improve the overall performance of the system. The application of reinforcement learning in IoT usually manifests itself in dynamic optimization of system parameters and resource allocation to improve the system's response speed and decision-making accuracy;

[0026] S2.5. Perform environmental configuration to ensure that IoT devices and gateways can work together, implement core modules and perform system integration testing to verify the effectiveness of the method;

[0027] S2.6. Use more efficient algorithms, distributed computing technologies, encryption, and access control technologies to improve prediction accuracy, further optimize algorithms to improve prediction accuracy, and ensure the security and privacy protection of data transmission.

[0028] The method for performing security verification on the IoT system in S3 is:

[0029] S3.1, Static analysis: Obtain the device's firmware and disassemble it to find potential security issues, use automated tools to detect vulnerabilities, and manually audit the code to find security issues;

[0030] S3.2, Dynamic testing: Simulate failure conditions in the system to test the system's response and recovery capabilities, verify that the system's behavior is as expected by running test cases, and evaluate the system's performance under different workloads to ensure that it can handle the expected workload;

[0031] S3.3. Collect data through sensor equipment and conduct preliminary analysis of the data. If the data is abnormal, enter the abnormality detection stage and take corresponding safety management measures according to the degree of impact; decide whether to take further safety measures based on the evaluation results and implement corresponding control strategies;

[0032] S3.4. Create a set of rules to guide future operations and maintenance, and record observed failures as part of a feedback mechanism to help continuously improve system performance;

[0033] S3.5. Analyze the verification results, identify potential security vulnerabilities, and take appropriate measures to repair them; then, re-verify the repaired system to ensure that the security of the repaired system still meets the requirements.

[0034] The method of integrating the operation logs, network traffic data and multi-source data of security events of IoT devices in S4 is as follows:

[0035] S4.1. Feature-level fusion of data from different sources, merging data from multiple sources to provide a more comprehensive data analysis perspective, event fusion of log data from different data sources, reducing redundant information, and reducing system I / O overhead and analyst burden;

[0036] S4.2. Use the fused dataset to train a deep learning model for attack detection and multi-attack classification, and optimize the model through methods such as bagging in ensemble technology to improve detection accuracy and efficiency;

[0037] S4.3. Use the trained deep learning model to monitor network traffic in real time to detect abnormal behavior, and combine it with the NLP model to analyze firmware code and documents to identify potential vulnerabilities; manually verify and use automated tools to verify the potential vulnerabilities discovered by the AI ​​model to confirm its effectiveness.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] The present invention utilizes a deep learning model to automatically identify security vulnerabilities in the Internet of Things, and generates a security verification strategy through an adaptive decision-making algorithm, thereby realizing the automation of security verification in the Internet of Things, reducing manual participation and improving verification efficiency. The present invention uses deep learning technology, and through feature extraction and abstract representation of multi-layer networks, it can more accurately identify security vulnerabilities in the Internet of Things and improve the accuracy of verification results. The present invention uses an adaptive decision-making algorithm to dynamically adjust and optimize security verification strategies according to the real-time operating status and security requirements of the Internet of Things system, thereby improving the efficiency of the verification process. The present invention improves the accuracy and efficiency of deep learning models in identifying security vulnerabilities in the Internet of Things by fusing multi-source data. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0041] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0042] Figure 1 It is a flow chart of the steps of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. These descriptions are only to further illustrate the features and advantages of the present invention, rather than to limit the claims of the present invention. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0044] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0045] IoT security enhancement verification method based on deep learning and adaptive decision making, such as Figure 1As shown, the following steps are included:

[0046] Step 1: Use a large amount of IoT security data to train a deep learning model that can identify IoT security vulnerabilities.

[0047] Step 1.1: Use convolutional neural network (CNN) for feature extraction. Convolutional neural network (CNN) captures local patterns or structures in the input data through convolutional layers and generates a series of feature maps.

[0048] Step 1.2: The feature map is downsampled through the pooling layer to reduce the spatial dimension of the feature map while retaining important information.

[0049] Step 1.3. Use a recurrent neural network (RNN) to process time series data. At each time step, the RNN takes the current input and the hidden state of the previous time step as input and outputs the hidden state of the current time step.

[0050] Step 1.4: Fuse the features extracted by CNN with the time series features learned by RNN. The result of feature fusion is further passed to the fully connected layer for more complex feature representation and classification tasks.

[0051] Step 1.5: After feature extraction and fusion, the data is passed to the fully connected layer, which compresses and integrates the feature vectors for classification prediction. The Softmax function is applied to calculate the probability value corresponding to each category and output the final classification result.

[0052] Step 1.6. Use the cross entropy loss function to calculate the difference between the actual label and the predicted probability, and adjust the model parameters through the optimization algorithm to minimize the error. During the training process, it is necessary to combine the Dropout technology to prevent overfitting and ensure the generalization ability of the model on different data sets.

[0053] Step 2: Based on the recognition results of the deep learning model, combined with the real-time operating status and security requirements of the IoT system, a security verification strategy for the IoT system is generated through an adaptive decision-making algorithm.

[0054] Step 2.1: Use reinforcement learning algorithms to learn the optimal strategy in a specific environment. In the IoT system, reinforcement learning algorithms continuously adjust control strategies through interaction with the environment to improve the flexibility and intelligence of the system.

[0055] Step 2.2: The agent performs actions in the IoT system based on the learned strategy. Based on the execution results, the environment gives a reward signal, and the agent adjusts its strategy based on the reward signal.

[0056] Step 2.3: Use genetic algorithm to optimize reinforcement learning strategy parameters. Genetic algorithm searches for optimal strategy parameters by simulating biological evolution process, including defining individual representation, initializing population, evaluating fitness, selecting operation, crossover operation, mutation operation, updating population and judging termination condition.

[0057] Step 2.4: The IoT system adjusts the control strategy in real time through reinforcement learning to improve the overall performance of the system. The application of reinforcement learning in the IoT is usually manifested in the dynamic optimization of system parameters and resource allocation to improve the system's response speed and decision-making accuracy.

[0058] Step 2.5: Configure the environment to ensure that IoT devices and gateways can work together, implement core modules and perform system integration testing to verify the effectiveness of the method.

[0059] Step 2.6: Use more efficient algorithms, distributed computing technology, encryption and access control technology to improve prediction accuracy, further optimize the algorithm to improve prediction accuracy, and ensure the security and privacy protection of data transmission.

[0060] Step 3: Perform security verification on the IoT system according to the security verification strategy generated by the adaptive decision module.

[0061] Step 3.1, static analysis: Get the device's firmware and disassemble it to find potential security issues, use automated tools for vulnerability detection, and manually audit the code to find security issues.

[0062] Step 3.2, Dynamic Testing: Simulate failure conditions in the system to test the system's response and recovery capabilities, verify that the system's behavior is as expected by running test cases, and evaluate the system's performance under different workloads to ensure that it can handle the expected workload.

[0063] Step 3.3: Collect data through sensor devices and conduct preliminary analysis of the data. If the data is abnormal, enter the abnormality detection stage and take corresponding safety management measures according to the degree of impact. Determine whether further safety measures are needed based on the evaluation results and implement corresponding control strategies.

[0064] Step 3.4. Create a set of rules to guide future operations and maintenance, and record observed failures as part of a feedback mechanism to help continuously improve system performance.

[0065] Step 3.5: Analyze the verification results, identify potential security vulnerabilities, and take appropriate measures to repair them. After that, re-verify the repaired system to ensure that the security of the repaired system still meets the requirements.

[0066] Step 4: Improve the accuracy and efficiency of deep learning models in identifying IoT security vulnerabilities by integrating multi-source data such as IoT device operation logs, network traffic data, and security events.

[0067] Step 4.1: Perform feature-level fusion on data from different sources, merge data from multiple sources to provide a more comprehensive data analysis perspective, perform event fusion on log data from different data sources, reduce redundant information, and reduce system I / O overhead and analyst burden.

[0068] Step 4.2: Use the fused dataset to train a deep learning model for attack detection and multi-attack classification. Optimize the model through methods such as bagging in ensemble technology to improve detection accuracy and efficiency.

[0069] Step 4.3: Use the trained deep learning model to monitor network traffic in real time to detect abnormal behavior, and combine it with the NLP model to analyze firmware code and documents to identify potential vulnerabilities. Perform manual verification and automated tool verification on the potential vulnerabilities discovered by the AI ​​model to confirm its effectiveness.

[0070] Embodiment 1

[0071] The Internet of Things (IoT) connects physical devices embedded with sensors or actuators to provide automated processes ranging from simple automations such as turning off lights to more complex automations such as injecting insulin into the bloodstream of a diabetic patient. Device sensors monitor and measure some physical properties such as room temperature. When specific events occur, the values ​​of these properties are sent to the cloud service through the IoT gateway. These events are processed to initiate IoT devices in a predefined manner. An IoT platform is a multi-layered platform consisting of multiple software components that facilitate the development, management, and maintenance of IoT automation systems. There are several IoT platforms available in the market such as Samsung SmartThings, Apple HomeKit, Home Assistant, OpenHab, Amazon AWS, etc. Recently, many industries have turned to IoT automation to automate their businesses, such as EvaICS in the industrial sector, WeCon in agriculture and smart farming, HealthSaaS in healthcare, and manufacturing, smart cities, etc. Trigger-Action programming (TAP) is an end-user development methodology that allows IoT users to develop their own rules in the format of "If trigger-Then action", i.e., when the rule is triggered by a specified trigger, the associated action will be executed. TAP programming is used in IoT applications to automatically run actions in specific events without user involvement.

[0072] One of the main questions raised when considering IoT automation is the issue of application interaction. IoT applications can perform securely and reliably when each application operates in isolation within its environment. But when these applications interact within an environment, it can cause serious safety and security issues. Interacting IoT applications can be developed or maintained using the same IoT platform or different IoT platforms. Going back to the example of contradictory rules; when smoke is detected, start the sprinkler. When moisture is detected, close the water valve. If the smoke detector and smart valve devices interact and work in the same environment, the shared environmental properties should be considered. The action of one device triggers an event related to another device set up in the same environment.

[0073] 1. Static analysis

[0074] Different static analysis techniques are used in the surveyed tools. The code of a given IoT application is converted into an intermediate representation (IR) and then into a state machine model. A model checker is used to verify its consistency to the specified safety and security properties. The interactions of IoT applications are analyzed by building a dependency graph (DG). By using BanderaToolSet, the generated Promela model is fed into the SPIN model checker to detect any potential security violations. It is proposed to explore all possible physical interactions between IoT applications by running intra-application interaction analysis. The tool is built on three main steps:

[0075] (i) Model security properties using a general policy model.

[0076] (ii) Perform intra-application interaction analysis by extracting the Abstract Syntax Tree (AST) of a given IoT application.

[0077] (iii) Trace the control flow to capture triggers and actions.

[0078] By providing a complete history of IoT system interactions, analysis of potential malicious behavior can be guided. Analysis is performed using provenance-based tracing to generate data provenance graphs. Security properties of IoT systems are verified by building a multi-layer IoT assumption graph and model checking with the SPIN model checker. IoT programs are transformed into vendor-independent graph-based abstractions, and then these generated abstractions are verified and potential conflicts or violations are detected. Rule extraction from IoT applications is automated by applying symbolic execution and identified by encoding each threat type as a Satisfiability Modulo Theory.

[0079] Cross-Application Interference (CAI) threats. That is, Home-Guard analyzes each pair of automation rules and their specified configurations for SMT. The prototype provides symbolic execution to statically analyze the abstract syntax tree to extract the rules of the IoT application, and executes the application instrumentation method to obtain the user's configuration. In addition, Home-Guard provides a risk ranking technique to assess the risk severity as high, medium, or low based on the impact of the rule execution, its functionality. According to the work evaluation, they were able to identify 663 CIA violations in 146 SmartThings real applications. Model checking is run by converting the groovy code of the IoT application into an inter-procedural control flow graph (ICFG) and then into a behavioral rule graph (BRG). Inter-rule security violations of IoT applications are analyzed by building a rule representation (RR) model together with the information flow model. Programming abstractions, driver graphs, driver modules, and policy syntax are used. Allow users to specify the properties they want. It uses Buchi automata to convert these properties into linear temporal logic (LTL) and ensures that it follows TAP rules.

[0080] 2. Dynamic Analysis

[0081] The literature presents different dynamic analysis techniques that have been used to validate the security of IoT systems. In 2016, users can create their own daily recipes, IFTTT applets; these recipes can be posted on social media and captured by others. We analyze such IFTTT recipes through an information flow model to detect any security or privacy risks that could be harmful if used by an attacker. The model and dataset are encoded using facts and then the analysis is run using queries. The analysis assigns labels to IFTTT triggers and actions based on the description associated with each recipe. It then finds direct links between any two existing recipes and determines if there are any physical connections that should have been tracked when previously labeling triggers and actions. The evaluation shows that 49.9% of the recipes in the dataset are insecure due to confidentiality or integrity violations.

[0082] The SafeTap tool was developed to allow TAP users to check if their applications comply with their desired behavior. SafeTap was proposed to analyze TAP applications for the execution of symbolic model checking (SMC). In contrast, SafeTapΔ improves SafeTap by extending SMC to handle updated TAP rules to detect any newly introduced violations. SafetTap implements IoT application rules as a tag transformation system and implements the desired behavior by expressing properties in the computational tree language (CTL).

[0083] After that, it monitors the current state of the running IoT application to perform analysis. Model checking verifies whether the modeled system satisfies the specified set of properties. SafeTap extends SafeTap by applying incremental analysis to any updated rules and providing feedback to users in case of any violations. Their research shows that SafetTap can help users better identify violations in the house.

[0084] The PFirewall system monitors the data between IoT devices and the hub and filters the data according to the specified privacy policy. Therefore, the main role of the system is to ensure privacy protection by monitoring the data flow without changing the existing IoT applications or platforms. PFirewall overcomes the challenge of hub encryption by applying the middleman technique; it connects Lobna Abuserrieh, Manar H. Alalfi*10 all existing devices in the form of a hub. Then, it establishes a set of virtual devices of the same number, which are paired with the actual hub. Applying PFirewall ensures data minimization and protection of user privacy. It can run on SmartThings and OpenHab platforms, and its evaluation shows that the data sent is reduced by 97%. Event spoofing in smart homes is predicted by introducing Peeves, which is an event that can trigger an action but did not physically occur due to sensor failure or attack attempts. The Peeves system uses data from connected sensors to automatically verify physical events. Peeves uses supervised learning to exploit event signatures and physical signatures of sensors. The evaluation was run for two weeks in an actual real-world smart home environment with 48 connected sensors and 22 event types, with a detection rate of 100%.

[0085] IoTGuard is a dynamic policy enforcement tool that supports security and safety violation detection and enforcement in IoT applications. IoTGuard provides three main components to dynamically analyze IoT applications.

[0086] First, it applies instrumentation components to collect runtime-related information about the application. Then, IoTGuard observes the execution behavior and builds a dynamic execution model of the IoT application. Finally, it specifies policies to be enforced on the execution model. This process detects violations on a single IoT application or a group of IoT applications interacting in an environment. Users of the application can allow violations to be executed or have IoTGuard block them. IoTGuard is evaluated on the SmartThings application and the IFTTT application.

[0087] Another dynamic detection method, Patriot, is proposed for policy violation detection. The main idea of ​​Patriot is to monitor during the execution of IoT applications, and when any specified policy is violated, Patriot will block the operation of the application. By targeting three IoT platforms, EVAICS for industrial automation, and SmartThings and OpenHAB for home automation. Patriot evaluates 33 policies in 122 SmarThings applications, 10 policies in 20 OpenHab rules, and 6 policies in 8 EVAICS automation sets. Another dynamic technique, IoTBox, uses sandbox mining to prevent inconsistent behavior. IoTBox observes the current behavior of the smart home. If any behavior has not been explored before, for example, the application is updated, or there is malicious code, IoTBox blocks the violation of the rule and reports this behavior. If trusted, the user may modify the operation and allow the behavior. IoTBox adds this behavior to the sandbox so that future behavior can be relearned. IoTBox uses formal models and model checking to ensure the consistency of expected behavior and actual execution. If not, IoTBox warns the user.

[0088] Introducing the SmartAttack framework, which relies on deep learning and machine learning to design and build attack models for IoT-based applications. Users can configure the attack model that best suits their needs. It can evaluate the security and privacy properties in smart home automation systems. SmartAttack has been evaluated using 2

[0089] 11A Survey of Analysis Methods for Security and Safety Verification in IoT Systems dataset, UNSW Sydney Smart Home dataset and simulated smart home dataset SmartFIU. The iot-prator system detects bad behaviors of IoT applications, including the interactions and communications of applications, by using device usage descriptions (DUD) and generating behavioral models, device usage rules (DUR). It dynamically collects the behaviors of applications and designs a behavioral rule engine to expand its flexibility in analyzing real-time behaviors. The iot-prator is evaluated using SmartThings applications and IFTTT applets, and its malicious interaction detection rate is 94.5% and malicious communication detection rate is over 98%. The HAWatcher method is an anomaly detection system for SmartThings IoT applications. HAWatcher first builds a simulation model for normal home automation behaviors by capturing event logs and system semantics, and observes the automation process at runtime. This process enables HAWatcher to explore the differences and inconsistencies between the real world and the simulation model to detect violations. HAWatcher is evaluated on 62 different violations using four Smartthings datasets.

[0090] III. Form and mathematical representation

[0091] IoTSER uses Measured Temporal Logic (MTL) to describe physical interactions that have undesirable consequences on system behavior, which can then be used to verify IoT systems through grid-based testing

[68] . MTL representation is a formula used to describe a specified property. MTL representation uses Int to represent expected impact, unInt to represent unexpected impact, and isOppImp to represent opposite impacts from different operations. Similarly, SafeTAP uses the temporal logic representation Au.

[0092]

[0093] Foresight specifies correctness properties as linear temporal logic (LTL) formulas. Whereas Jarvis expresses safe states and transitions in defined formulas. FriendlyFire, on the other hand, uses calculus to express properties.

[0094] IV. Conclusion

[0095] IoT systems are growing excessively, which leads to more connected IoT devices, more developed IoT applications, and more deployed IoT platforms. This growth brings new challenges to IoT systems and their environment. One of these challenges could be the interaction between different IoT applications developed using different IoT platforms and run together in one environment. Some motivating examples highlight the security impact of IoT systems on their users or environment due to security vulnerabilities. This study investigates the methods that have been recently developed to address this issue or contribute to it. The study highlights the main analysis techniques used in the investigated tools, IoT security and security validation used while conducting the analysis, and whether the investigated tools take the surrounding IoT environment into consideration.

[0096] Only the preferred embodiments of the present invention are described in detail above, but the present invention is not limited to the above embodiments. Various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of the present invention, and various changes should be included in the protection scope of the present invention.

Claims

1. An IoT security enhancement verification method based on deep learning and adaptive decision making, characterized in that: The following steps are involved: S1. Use a large amount of IoT security data to train a deep learning model that can identify IoT security vulnerabilities; S2. Based on the recognition results of the deep learning model, combined with the real-time operating status and security requirements of the IoT system, a security verification strategy for the IoT system is generated through an adaptive decision-making algorithm; S3, perform security verification on the IoT system according to the security verification strategy generated by the adaptive decision module; S4. By integrating the operation logs of IoT devices, network traffic data, and multi-source data of security events, the accuracy and efficiency of deep learning models in identifying IoT security vulnerabilities can be improved.

2. According to claim 1, the method for enhancing the security of the Internet of Things based on deep learning and adaptive decision-making is characterized in that: The method for training a deep learning model capable of identifying IoT security vulnerabilities in S1 is: S1.

1. Use convolutional neural network (CNN) for feature extraction. Convolutional neural network (CNN) captures local patterns or structures in input data through convolutional layers and generates a series of feature maps. S1.2, the feature map is downsampled through the pooling layer to reduce the spatial dimension of the feature map while retaining important information; S1.

3. Use a recurrent neural network (RNN) to process time series data. At each time step, the RNN takes the current input and the hidden state of the previous time step as input and outputs the hidden state of the current time step. S1.4, the features extracted by CNN are fused with the time series features learned by RNN, and the result of feature fusion is further passed to the fully connected layer for more complex feature representation and classification tasks; S1.

5. After feature extraction and fusion, the data is passed to the fully connected layer, which compresses and integrates the feature vectors for classification prediction; the Softmax function is applied to calculate the probability value corresponding to each category and output the final classification result; S1.

6. Use the cross entropy loss function to calculate the difference between the actual label and the predicted probability, and adjust the model parameters through the optimization algorithm to minimize the error. During the training process, it is necessary to combine the Dropout technology to prevent overfitting and ensure the generalization ability of the model on different data sets.

3. The method for enhancing the security of the Internet of Things based on deep learning and adaptive decision-making according to claim 1 is characterized in that: The method for generating a security verification strategy for the Internet of Things system in S2 is: S2.

1. Use reinforcement learning algorithms to learn the optimal strategy in a specific environment. In the IoT system, reinforcement learning algorithms continuously adjust the control strategy through interaction with the environment to improve the flexibility and intelligence of the system. S2.2, the agent performs actions in the IoT system according to the learned strategy. Based on the execution results, the environment gives a reward signal, and the agent adjusts the strategy according to the reward signal; S2.3, using genetic algorithms to optimize reinforcement learning strategy parameters. Genetic algorithms search for optimal strategy parameters by simulating the biological evolution process, including defining individual representations, initializing populations, evaluating fitness, selecting operations, crossover operations, mutation operations, updating populations, and determining termination conditions; S2.4, IoT system adjusts control strategy in real time through reinforcement learning to improve the overall performance of the system. The application of reinforcement learning in IoT usually manifests itself in dynamic optimization of system parameters and resource allocation to improve the system's response speed and decision-making accuracy; S2.

5. Perform environmental configuration to ensure that IoT devices and gateways can work together, implement core modules and perform system integration testing to verify the effectiveness of the method; S2.

6. Use more efficient algorithms, distributed computing technologies, encryption, and access control technologies to improve prediction accuracy, further optimize algorithms to improve prediction accuracy, and ensure the security and privacy protection of data transmission.

4. The method for enhancing the security of the Internet of Things based on deep learning and adaptive decision-making according to claim 1 is characterized in that: The method for performing security verification on the IoT system in S3 is: S3.1, Static analysis: Obtain the device's firmware and disassemble it to find potential security issues, use automated tools to detect vulnerabilities, and manually audit the code to find security issues; S3.2, Dynamic testing: Simulate failure conditions in the system to test the system's response and recovery capabilities, verify that the system's behavior is as expected by running test cases, and evaluate the system's performance under different workloads to ensure that it can handle the expected workload; S3.

3. Collect data through sensor equipment and conduct preliminary analysis of the data. If the data is abnormal, enter the abnormality detection stage and take corresponding safety management measures according to the degree of impact; decide whether to take further safety measures based on the evaluation results and implement corresponding control strategies; S3.

4. Create a set of rules to guide future operations and maintenance, and record observed failures as part of a feedback mechanism to help continuously improve system performance; S3.

5. Analyze the verification results, identify potential security vulnerabilities, and take appropriate measures to repair them; then, re-verify the repaired system to ensure that the security of the repaired system still meets the requirements.

5. The method for enhancing security verification of the Internet of Things based on deep learning and adaptive decision-making according to claim 1 is characterized in that: The method of integrating the operation logs, network traffic data and multi-source data of security events of IoT devices in S4 is as follows: S4.

1. Feature-level fusion of data from different sources, merging data from multiple sources to provide a more comprehensive data analysis perspective, event fusion of log data from different data sources, reducing redundant information, and reducing system I / O overhead and analyst burden; S4.

2. Use the fused dataset to train a deep learning model for attack detection and multi-attack classification, and optimize the model through methods such as bagging in ensemble technology to improve detection accuracy and efficiency; S4.

3. Use the trained deep learning model to monitor network traffic in real time to detect abnormal behavior, and combine it with the NLP model to analyze firmware code and documents to identify potential vulnerabilities; manually verify and use automated tools to verify the potential vulnerabilities discovered by the AI ​​model to confirm its effectiveness.

Images