Multi-layer security protection method and system for Internet of Things platform

Abstract

The invention provides a multi-layer security protection method and system for an Internet of Things platform, and relates to the field of security management.The method comprises the steps that firstly, a time sequence data set of access traffic is obtained on a network boundary layer, whether abnormal traffic exists or not is analyzed based on the time sequence data set, and an abnormal traffic monitoring result is generated and obtained; and when the abnormal traffic monitoring result shows that no abnormal traffic exists, further collecting a time sequence data set of the user behavior data in an application layer, detecting whether the user behavior is abnormal or not based on the time sequence data set to generate an abnormal behavior monitoring result, and when the abnormal behavior is found, triggering an alarm. Therefore, the potential security threat existing in the Internet of Things platform can be effectively detected, and quick response can be ensured when the potential security threat is detected, so that the safe operation of the Internet of Things platform is ensured.

Description

Technical Field

[0001] The present application relates to the field of security management, and more specifically, to a multi-layer security protection method and system for an Internet of Things platform. Background Art

[0002] The IoT Platform is a comprehensive technical framework for connecting, managing, and controlling IoT devices and data. It acts as a bridge between devices, networks, and applications, providing functions for device management, data collection, analysis, storage, and application development. Since the IoT platform involves multiple levels such as devices, networks, data, and applications, the security risk is relatively high. Without comprehensive security protection measures, serious consequences may occur, including data leakage, device attacks, service interruptions, etc. In order to effectively protect data and device security, prevent network attacks, and ensure the stable operation of the platform, it is necessary to implement security protection for the IoT platform.

[0003] Security threats to IoT platforms are usually cross-layer, and attackers may bypass the protection of the network layer and directly launch attacks at the application layer. Traditional security protection that relies solely on the network layer or application layer may not be able to fully capture cross-layer attack behaviors, and traditional security protection methods (such as rule-based anomaly detection) are difficult to deal with complex and hidden attack behaviors, especially when attackers gradually test or disguise themselves as normal users. This will cause the attack behavior to go undetected, which will bring security risks to the IoT platform and may have serious consequences.

[0004] Therefore, we look forward to an optimized multi-layer security protection solution for the IoT platform. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiments of the present application provide a multi-layer security protection method and system for an Internet of Things platform.

[0006] According to one aspect of the present application, a multi-layer security protection method for an Internet of Things platform is provided, comprising: obtaining a time series data set of access traffic at a network boundary layer; determining whether there is abnormal traffic at the network boundary layer based on the time series data set of access traffic to obtain an abnormal traffic monitoring result; in response to the abnormal traffic monitoring result being that there is no abnormal traffic, collecting a time series data set of user behavior data at an application layer; in the application layer, determining whether there is abnormal behavior based on the time series data set of user behavior data to obtain an abnormal behavior monitoring result, comprising: embedding and sorting the time series data set of user behavior data to obtain a time queue of user behavior low-dimensional embedded coding vectors; performing user behavior semantic coding on the time queue of user behavior low-dimensional embedded coding vectors to obtain a time queue of user behavior context semantic coding vectors; performing user behavior gated adaptive feature propagation on the time queue of user behavior context semantic coding vectors to obtain a user behavior time series dynamic propagation coding vector; obtaining the abnormal behavior monitoring result based on the user behavior time series dynamic propagation coding vector; in response to the abnormal behavior monitoring result being that there is abnormal behavior, triggering an alarm.

[0007] According to another aspect of the present application, a multi-layer security protection system for an Internet of Things platform is provided, which includes: an access traffic data acquisition module, which is used to obtain a time series data set of access traffic at a network boundary layer; a traffic monitoring module, which is used to determine whether there is abnormal traffic at the network boundary layer based on the time series data set of access traffic to obtain an abnormal traffic monitoring result; a user behavior data acquisition module, which is used to collect a time series data set of user behavior data at an application layer in response to the abnormal traffic monitoring result being that there is no abnormal traffic; a user behavior monitoring module, which is used to determine whether there is abnormal behavior at the application layer based on the time series data set of user behavior data to obtain an abnormal behavior monitoring result, wherein the user behavior monitoring module includes: a user behavior data embedding coding and collating unit, which is used to A time queue for embedding and sorting the time series data set of the user behavior data to obtain a time queue of user behavior low-dimensional embedded coding vectors; a user behavior data semantic coding unit, used to perform user behavior semantic coding on the time queue of the user behavior low-dimensional embedded coding vectors to obtain a time queue of user behavior context semantic coding vectors; a user behavior semantic feature gated propagation unit, used to perform user behavior gated adaptive feature propagation on the time queue of the user behavior context semantic coding vectors to obtain a user behavior time series dynamic propagation coding vector; an abnormal behavior monitoring result generating unit, used to obtain the abnormal behavior monitoring result based on the user behavior time series dynamic propagation coding vector; an alarm triggering module, used to trigger an alarm in response to the abnormal behavior monitoring result indicating the existence of abnormal behavior.

[0008] Compared with the prior art, the multi-layer security protection method and system for the Internet of Things platform provided by the present application first obtains the time series data set of access traffic at the network boundary layer, and analyzes whether there is abnormal traffic based on the time series data set to generate abnormal traffic monitoring results. When the abnormal traffic monitoring results show that there is no abnormal traffic, the time series data set of user behavior data is further collected at the application layer, and the user behavior is detected based on the time series data set to generate abnormal behavior monitoring results. When abnormal behavior is found, an alarm is triggered. In this way, potential security threats to the Internet of Things platform can be effectively detected, and a rapid response can be ensured when potential security threats are detected, thereby ensuring the safe operation of the Internet of Things platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0010] Figure 1 The present invention is a flowchart of a multi-layer security protection method for an Internet of Things platform according to an embodiment of the present application.

[0011] Figure 2 This is a flowchart of step S140 in the multi-layer security protection method for the Internet of Things platform according to an embodiment of the present application.

[0012] Figure 3 This is a flowchart of step S141 in the multi-layer security protection method for the Internet of Things platform according to an embodiment of the present application.

[0013] Figure 4 This is a flowchart of step S143 in the multi-layer security protection method for the Internet of Things platform according to an embodiment of the present application.

[0014] Figure 5 This is a system block diagram of a multi-layer security protection system for an Internet of Things platform according to an embodiment of the present application. DETAILED DESCRIPTION

[0015] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0016] In response to the technical problems raised in the above background technology, the present application provides a multi-layer security protection method for an Internet of Things platform. Figure 1Flowchart of a multi-layer security protection method for an Internet of Things platform according to an embodiment of the present application. Figure 1 As shown, the multi-layer security protection method of the Internet of Things platform according to the embodiment of the present application includes: S110, at the network boundary layer, obtaining a time series data set of access traffic; S120, at the network boundary layer, based on the time series data set of access traffic, determining whether there is abnormal traffic to obtain an abnormal traffic monitoring result; S130, in response to the abnormal traffic monitoring result that there is no abnormal traffic, collecting a time series data set of user behavior data at the application layer; S140, at the application layer, based on the time series data set of user behavior data, determining whether there is abnormal behavior to obtain an abnormal behavior monitoring result; S150, in response to the abnormal behavior monitoring result that there is abnormal behavior, triggering an alarm.

[0017] In step S110, a time series data set of access traffic is obtained at the network boundary layer. It should be understood that the time series data set of access traffic records the information of the sender (source address) and receiver (destination address) of the network traffic, the source port and destination port information involved in the traffic, the type of communication protocol followed by the network traffic, the size of the network traffic per unit time, and the frequency information. It is the core input data of the network boundary layer security protection and the basis for abnormal traffic detection.

[0018] Acquiring a time series data set of access traffic at the network boundary layer is an important basic link in the multi-layer security protection of the IoT platform. Its implementation process involves multiple key steps to ensure that network traffic information can be accurately, comprehensively and in real time, and converted into effective data resources for subsequent analysis. The following is a detailed description of its implementation process: First, it is necessary to determine the key nodes of the network boundary. These nodes are usually network devices such as routers and firewalls at the network boundary of the IoT platform. They are the places where network traffic must pass in and out of the platform and can provide the most comprehensive traffic information. After selecting these devices, detailed traffic data collection configuration work is required. For example, for firewall devices, it is necessary to enable its traffic log recording function, and accurately set the level of detail and format of the record according to the needs of subsequent analysis to ensure that the device can accurately capture all relevant information of network traffic.

[0019] During the data collection process, network devices will capture rich information about network traffic in real time, including the sender (source address) and receiver (destination address) of the traffic, which helps track the source and destination of the traffic; the source port and destination port information can reveal the usage of network applications or services; the communication protocol type clarifies the rules and standards followed by the traffic; information such as the size of network traffic per unit time and the frequency of traffic is important for determining whether the traffic is abnormal. Each piece of collected traffic data will be accurately marked with a timestamp, and the accuracy of the timestamp can usually reach the millisecond level. This precise time mark can completely record the order of traffic occurrence, providing a key basis for subsequent in-depth analysis based on time series.

[0020] Subsequently, the traffic data with timestamps are integrated in chronological order to form a time series data set of access traffic. In this process, the data is strictly arranged in chronological order according to the time when the traffic occurred, so that the entire data set presents a clear time series feature. This feature enables subsequent analysis to effectively mine the regularities and abnormal patterns of traffic data in the time dimension. For example, by analyzing the fluctuation of traffic over a period of time and the concentration trend of traffic in a specific time period, potential security threats can be discovered in a timely manner.

[0021] Next, the generated time series data set is stored in a suitable storage medium, such as a database or a dedicated data storage system. The storage system needs to have sufficient capacity to accommodate massive amounts of traffic data, while also having excellent performance to ensure fast data retrieval speeds to meet the needs of real-time or near-real-time security analysis. When storing data, in order to improve storage efficiency and the convenience of subsequent analysis, data is usually preprocessed, such as converting the data into a unified format and performing appropriate data compression.

[0022] Afterwards, the stored access traffic time series data set is transmitted regularly or in real time to a module dedicated to security analysis. The transmission process uses a secure and reliable network transmission protocol to fully guarantee the confidentiality, integrity and availability of the data during transmission, and prevent the data from being stolen, tampered with or lost during transmission.

[0023] Since network traffic is in constant dynamic change, in order to ensure that the system can always accurately detect and judge based on the latest traffic information, it is necessary to continuously collect new traffic data and update the time series data set in a timely manner. This requires the establishment of a reasonable data collection cycle and an efficient update mechanism, so that the system can obtain the latest traffic dynamics in a timely manner while ensuring that system performance is not affected, so as to promptly discover and respond to possible security threats.

[0024] In step S120, at the network boundary layer, based on the time series data set of the access traffic, it is determined whether there is abnormal traffic to obtain abnormal traffic monitoring results. It should be understood that in the security protection system of the Internet of Things platform, the network boundary is the first line of defense. By analyzing the multi-dimensional information such as the source address, destination address, port, protocol type, traffic size and frequency contained in the time series data set, it is possible to quickly identify traffic that does not conform to the normal Internet of Things business communication mode, such as access requests from illegal IP addresses, communication traffic using abnormal ports or protocols, etc. By identifying and blocking these abnormal traffic in advance, it can be prevented from further penetrating into the Internet of Things platform and causing damage to key parts such as equipment, data and applications, thereby ensuring the initial security of the platform as a whole. In particular, in a specific embodiment of the present application, based on the time series data set of the access traffic, the implementation method of determining whether there is abnormal traffic to obtain abnormal traffic monitoring results can be: in the IoT platform environment of the smart factory, in order to protect the platform from external attacks, an advanced intrusion detection system is deployed at the network boundary, which continuously monitors all data packets entering and leaving the platform, and records the relevant information of each data packet, such as the source IP address, destination IP address, protocol type, port number, transmission timestamp, and data packet size, etc., to generate a time series data set describing all network activities in a specific time period. Then, the collected raw data is cleaned to remove invalid or erroneous data records, and key features for analysis are extracted, such as the number of data packets per second, the amount of data per session, the rate of newly established connections, etc., and the data is standardized according to the historical normal traffic pattern. Then, if there is a trained traffic behavior model, it is directly loaded; otherwise, a new model is trained based on the normal traffic samples in the past period of time. Here, an unsupervised learning model based on an autoencoder is used, which is good at capturing the potential structure in the data and identifying deviations from the normal state. The currently collected time series data is input into the pre-trained traffic model. The model calculates the probability score of each new data point or a series of continuous data points belonging to normal traffic, sets a threshold, and when the score of a data point or sequence is lower than this threshold, it is considered an abnormal event. For data points or sequences marked as abnormal, their detailed information is further reviewed to confirm whether there is indeed a threat. Once it is determined to be abnormal traffic, it is recorded and the abnormal traffic monitoring results are generated. At the same time, the alarm mechanism is immediately triggered to notify relevant personnel and take necessary protective measures, such as blocking malicious IP addresses, limiting bandwidth, or starting honeypot strategies, etc. Finally, a detailed abnormal traffic monitoring result report is output, listing all detected abnormal traffic instances, including the time of occurrence, the IP addresses involved, possible causes, and recommended countermeasures.

[0025] In step S130, in response to the abnormal traffic monitoring result that there is no abnormal traffic, a time series data set of user behavior data is collected at the application layer. It should be understood that in the multi-layer security protection system of the Internet of Things platform, a gradual and layered detection approach is adopted. As the first line of defense, the network boundary layer analyzes the time series data set of the access traffic to intercept abnormal traffic that may come from the external network. When the abnormal traffic monitoring result shows that there is no abnormal traffic, it means that from the perspective of the network boundary, the traffic entering the platform initially meets the normal communication mode and expectations. At this time, it is necessary to further go deep into the application layer for detection, so as to avoid wasting resources to analyze the user behavior data of the application layer when the abnormality has been found at the boundary, so as to achieve efficient security detection from outside to inside and layer by layer. The time series data set of user behavior data contains user identity information, operation behavior details, operation time and sequence information, etc. By comprehensively analyzing various types of information contained in the time series data set of user behavior data, the system can build a corresponding behavior model based on the behavior patterns and business operation logic of normal users, and then compare and identify abnormal behaviors that deviate from normal situations, such as operations that exceed the scope of authority, frequent operations that do not conform to time patterns, etc. Even if an attacker tries to disguise himself as a legitimate user, it is difficult to completely imitate normal behavior characteristics. Therefore, with the help of this data set, it is possible to effectively identify hidden security threats within and enhance the ability of the IoT platform to respond to covert attacks.

[0026] When the abnormal traffic monitoring results at the network boundary layer determine that there is no abnormal traffic, the implementation process of collecting the time series data set of user behavior data at the application layer is immediately launched. This process can collect comprehensive, accurate and timely data to provide reliable data for subsequent abnormal behavior detection. The following is a detailed description of its implementation process: Before starting the collection work, strict permission verification will be carried out. Only authorized processes or modules with corresponding permissions can perform the task of collecting user behavior data. This step effectively guarantees the legality and security of the data collection process, prevents any unauthorized access and operation, and ensures that the data source is reliable.

[0027] Next, clarifying the source and scope of data becomes a key link. In the application layer, data sources are extensive, covering various applications, interaction data between user terminal devices and the platform, and operation records between different modules within the platform. In view of these rich and diverse data sources, based on the security strategy of the IoT platform and actual analysis needs, the scope of user behavior data that needs to be collected is accurately defined. The user's login operation, various operation instructions issued, data query, device control operation, file upload and download and other behaviors closely related to the platform functions are all included in the collection scope to ensure that the collected data is both comprehensive and highly targeted, and can accurately reflect the user's behavior activities on the platform.

[0028] In order to achieve effective data collection, specialized data collection tools monitor and record user behavior on the platform in real time without interfering with the normal operation of the application, and ensure the integrity and accuracy of the data through a variety of advanced technical means. For example, the hook technology is used to cleverly intercept the key function calls of the application to obtain detailed operation information; with the help of the system log recording function, the event records related to user behavior at the operating system level are comprehensively collected; for behaviors involving network communications, network packet analysis technology is used to accurately obtain the details of data transmission. Through the synergy of these technologies, user behavior data can be captured in an all-round and multi-angle manner, without missing any behavioral details that may contain security risks.

[0029] After collecting user behavior data, each piece of data will be recorded in detail, including key information such as the specific type of behavior, the operation object, and the operation parameters. For example, for a device control operation, not only the name of the device operated and the control command executed are recorded, but also the time when the operation occurred and other details are accurately recorded. At the same time, each record is given a timestamp accurate to the millisecond level. This time mark enables the subsequent in-depth analysis of user behavior patterns from the perspective of time series. By mining data on time series, potential abnormal behaviors can be keenly discovered, such as frequent performance of the same operation in a short period of time or behaviors that do not conform to the normal operation time pattern.

[0030] Afterwards, the user behavior data with timestamps are integrated in chronological order to form an ordered time series data set. This integration process ensures the orderliness of the data before storage, creates favorable conditions for subsequent time-based analysis, and helps to deeply explore the regularities of user behavior over time and the abnormal patterns hidden therein. After the integration is completed, the data is stored in a dedicated database or data storage system. The storage system has excellent data management capabilities, covering functions such as data classification storage, efficient index establishment, and reliable data backup. These functions jointly ensure efficient storage, fast retrieval, and long-term availability of data, providing a stable and reliable data foundation for subsequent complex data processing and analysis work, and ensuring that the entire security protection system can operate continuously and effectively.

[0031] It should be noted that the data quality monitoring mechanism runs through the entire data collection process. By real-time monitoring of the quality of the collected data, key indicators such as data integrity, accuracy, and consistency are strictly checked. For example, carefully check whether there is any data missing, whether the data format and range meet expectations, and whether the data from different sources are consistent with each other. Once data quality problems are found, such as data loss or errors, corresponding measures can be taken quickly to repair them with accurate problem location, including re-collecting data, timely correcting erroneous data, and other operations. Through this rigorous data quality monitoring and feedback mechanism, the quality of the user behavior data time series data set finally collected is ensured to be reliable.

[0032] In step S140, at the application layer, based on the time series data set of the user behavior data, it is determined whether there is abnormal behavior to obtain abnormal behavior monitoring results. It should be understood that by analyzing the time series data set of user behavior data in the application layer, it is possible to deeply explore potential security threats hidden in user operation behaviors, such as disguising as a legitimate user to perform unauthorized access, tampering with data, malicious business operations, etc. With the help of in-depth analysis of user behavior data, potential security risks can be effectively identified, so that security protection resources can be processed in a targeted manner, thereby ensuring the safe operation of the Internet of Things platform.

[0033] Specifically, in determining whether there is abnormal behavior based on the time series data set of the user behavior data to obtain abnormal behavior monitoring results, the technical concept of the present application is to use artificial intelligence-based data processing and analysis technology to embed, arrange and contextually encode the acquired time series data set of user behavior data to obtain a time queue of user behavior context semantic coding vectors, and then intelligently determine whether there is abnormal behavior based on the feature representation obtained by gated adaptive feature propagation of the time queue of user behavior context semantic coding vectors. In this way, by deeply analyzing user behavior data, it is possible to effectively detect and comprehensively capture complex and hidden attack behaviors, which is conducive to improving the security protection capabilities of the Internet of Things platform.

[0034] Figure 2 FIG. 1 is a flowchart of step S140 in the multi-layer security protection method for the Internet of Things platform according to an embodiment of the present application. Figure 2 As shown, the step S140 includes: S141, embedding coding and data sorting the time series data set of the user behavior data to obtain a time queue of user behavior low-dimensional embedded coding vectors; S142, performing user behavior semantic coding on the time queue of the user behavior low-dimensional embedded coding vectors to obtain a time queue of user behavior context semantic coding vectors; S143, performing user behavior gated adaptive feature propagation on the time queue of the user behavior context semantic coding vectors to obtain a user behavior time series dynamic propagation coding vector; S144, obtaining the abnormal behavior monitoring result based on the user behavior time series dynamic propagation coding vector.

[0035] In step S141, embedding coding and data sorting are performed on the time series data set of the user behavior data to obtain a time queue of the user behavior low-dimensional embedding coding vector. Specifically, Figure 3 FIG. 1 is a flowchart of step S141 in the multi-layer security protection method for the Internet of Things platform according to an embodiment of the present application. Figure 3 As shown, the step S141 includes: S1411, embedding and encoding each user behavior data in the time series data set of the user behavior data to obtain a time series data set of user behavior low-dimensional embedded coding vectors; S1412, arranging the time series data set of the user behavior low-dimensional embedded coding vectors according to timestamps to obtain a time queue of the user behavior low-dimensional embedded coding vectors.

[0036] In step S1411, each user behavior data in the time series data set of the user behavior data is embedded and encoded to obtain a time series data set of the user behavior low-dimensional embedded coding vector. Specifically, in an embodiment of the present application, the step S1411 includes: using a user behavior embedding matrix to embed the each user behavior data in the time series data set of the user behavior data to obtain a time series data set of the user behavior low-dimensional embedded coding vector. It should be understood that the time series data set of user behavior data often contains a large amount of complex and high-dimensional information, such as many different types of operation behaviors, corresponding time, operation sources and other detailed descriptions. Directly processing these high-dimensional raw data will face many problems such as high computational complexity, difficulty in model training, and easy overfitting. In order to map high-dimensional user behavior data to low-dimensional space, achieve data dimensionality reduction while retaining key feature information, so that subsequent analysis and processing can be more efficient, and help focus on the features that are truly valuable for judging abnormal behavior and reduce unnecessary information interference, the technical solution of this application needs to use a user behavior embedding matrix to embed and encode each user behavior data in the time series data set of the user behavior data to obtain the time series data set of the user behavior low-dimensional embedded coding vector. In particular, the user behavior embedding matrix is ​​a matrix constructed through pre-training.

[0037] In step S1412, the time series data set of the low-dimensional embedded coding vector of the user behavior is arranged according to the timestamp to obtain the time queue of the low-dimensional embedded coding vector of the user behavior. It should be understood that in the Internet of Things platform, the various operation behaviors of the user occur sequentially over time, and there are often inherent logical connections and causal relationships between behaviors at different time points. By arranging the time series data set of the low-dimensional embedded coding vector of the user behavior according to the timestamp, this temporality can be retained and highlighted to the greatest extent. This enables subsequent analysis to accurately mine potential behavior patterns and discover abnormal changes based on the order in which the behaviors occur, which meets the needs of in-depth analysis of user behavior from a temporal perspective, and is conducive to improving the accuracy of abnormal detection of user behavior.

[0038] In step S142, the time queue of the user behavior low-dimensional embedded coding vector is subjected to user behavior semantic coding to obtain a time queue of the user behavior context semantic coding vector. Specifically, in an embodiment of the present application, the step S142 includes: inputting the time queue of the user behavior low-dimensional embedded coding vector into a converter-based user behavior context encoder to obtain a time queue of the user behavior context semantic coding vector. It should be understood that the user's operating behavior on the Internet of Things platform presents complex and diverse patterns, which are not only reflected in the type and attributes of a single behavior, but also in the sequence, time interval and mutual influence between behaviors. In order to be able to dig out the deep semantic relationships and pattern information hidden in these behavior sequences, and avoid missing some hidden abnormal situations by judging only from isolated behaviors, it is necessary in the technical solution of the present application to input the time queue of the user behavior low-dimensional embedded coding vector into a converter-based user behavior context encoder to obtain a time queue of the user behavior context semantic coding vector. Those skilled in the art should know that the Transformer can globally model the entire behavior sequence through the self-attention mechanism, thereby capturing the long-range dependencies between behaviors, which helps to capture the user's key operating behaviors and improve the accuracy of abnormal behavior judgments. At the same time, the transformer structure adopts a parallel computing mechanism, which can process multiple elements in the sequence at the same time. This parallel computing can ensure that the context encoding processing of user behavior-related data is completed in a short time, so that the entire abnormal behavior detection process can be quickly advanced, which can effectively meet the requirements of the Internet of Things platform for the timeliness of security protection.

[0039] The following is a detailed description of the implementation process of "inputting the temporal queue of user behavior low-dimensional embedding encoding vectors into the converter-based user behavior context encoder to obtain the temporal queue of user behavior context semantic encoding vectors": First, the converter-based encoder is initialized and configured. According to the specific application scenario and data characteristics, the architecture of the user behavior context encoder is built. This involves determining multiple key parameters of the converter, such as the number of layers, the number of heads, and the size of the hidden layer. For complex IoT platforms, it may be necessary to build a deeper converter to capture complex user behavior patterns. When determining the number of layers, it is necessary to comprehensively consider computing resources and model performance. A network that is too shallow may not be able to fully learn complex semantic relationships, while a network that is too deep may face problems such as gradient disappearance or explosion. It is necessary to balance the model's expressiveness and training difficulty by setting the number of layers reasonably. The choice of the number of heads is also critical. It determines the number of paths for parallel calculation of the self-attention mechanism. Different head settings will affect the model's attention to information at different locations. The size of the hidden layer is directly related to the capacity of the model. A larger hidden layer can learn richer features, but it will also increase the computational cost.

[0040] When initializing the model, various weight matrices and bias vectors should be set reasonably. Usually, random initialization is used in combination with specific initialization strategies, such as Xavier initialization or He initialization. These initialization strategies can adjust the distribution of initial weights according to the number of input and output nodes of the network layer, so that the model has better stability and convergence in the early stage of training. For example, Xavier initialization is suitable for cases where the activation function is linear or Sigmoid, which can ensure that the variance remains stable when the signal is transmitted in the network; while He initialization is more suitable for activation functions such as ReLU, which helps to alleviate the gradient vanishing problem and enables the model to converge faster during training.

[0041] In addition to model architecture construction and initialization, some hyperparameters of the encoder need to be fine-tuned. The scaling factor in the self-attention mechanism has an important impact on attention calculation. It can adjust the scale of the result after the dot product operation to prevent the value from being too large or too small to affect the calculation stability of the softmax function. The type of activation function in the feedforward neural network is also a key parameter. Common activation functions such as ReLU and GELU have their own characteristics. The ReLU function has linear characteristics in the positive range, which can speed up the model training, but may cause the death of some neurons; the GELU function alleviates this problem to a certain extent and can achieve better performance in some cases. The setting of the dropout ratio should not be ignored. It prevents the model from overfitting and improves the generalization ability of the model by randomly discarding some neurons during the training process. By conducting experiments on small-scale data sets or adjusting parameters based on rich experience, the most suitable hyperparameter combination for the current task can be found, so that the encoder can perform best in practical applications.

[0042] Configuring the optimizer is an important part of initialization and configuration. The role of the optimizer is to update the parameters of the model during the training process so that it gradually converges to the optimal value. Common optimization algorithms include stochastic gradient descent (SGD), Adam, and Adagrad. SGD is a basic optimization algorithm that updates parameters in the opposite direction of the gradient, but it may have problems such as slow convergence and oscillation when dealing with complex non-convex optimization problems. The Adam optimization algorithm combines the ideas of momentum method and adaptive learning rate, which can converge quickly in the early stage of training and maintain good stability in the later stage. The Adagrad algorithm automatically adjusts the learning rate according to the historical gradient information of the parameters, and has good adaptability to sparse data, but as the training progresses, the learning rate may drop too low, resulting in premature termination of training. When selecting an optimization algorithm, it is necessary to consider factors such as data characteristics, model structure, and computing resources, and set corresponding parameters such as learning rate and momentum. The size of the learning rate directly affects the step size of parameter update. Too large a learning rate may cause the model to fail to converge, while too small a learning rate will make the training process long. The momentum parameter helps to accelerate convergence and avoid falling into a local optimal solution to a certain extent.

[0043] After completing the initialization and configuration of the encoder, the time queue of the low-dimensional embedding encoding vector of user behavior can be input into the encoder. Considering that the amount of data in the time queue is often large, in order to improve processing efficiency and facilitate model training, the data is usually processed in blocks. According to the limitations of computing resources and memory, the size of the data block is reasonably determined, and the time queue is divided into several data blocks. For example, if computing resources are limited, the data can be divided into smaller blocks and processed in batches; if resources are sufficient, the size of the block can be appropriately increased to reduce the overhead of data transmission and processing. At the same time, batch processing technology is used to combine multiple data blocks into a batch for input. Batch processing can make full use of the parallel computing capabilities of hardware such as GPU to accelerate the encoding process. For example, a batch of data blocks containing user behavior data at multiple time points can be input at one time, allowing the encoder to process this batch of data at the same time, greatly improving computing efficiency.

[0044] When the data block enters the encoder, the self-attention mechanism begins to play a core role. For each low-dimensional embedding encoding vector of user behavior at each time point, the attention score between it and all other vectors is calculated. The attention score reflects the degree of correlation between different vectors, and the calculation method usually involves operations such as dot product operations. First, the input vector is linearly transformed to obtain the corresponding query, key, and value vectors, and then the original attention score is obtained by the dot product operation of the query vector and the key vector. In order to prevent the value from being too large and causing the softmax function calculation to be unstable, the original attention score is usually scaled, such as dividing by the dimension of the key vector under the square root. Finally, after the softmax normalization operation, the attention distribution of each vector relative to other vectors is obtained. According to the calculated attention distribution, the context information is fused for each vector. The information of other vectors is weighted and summed according to the attention weight to obtain a new vector representation containing context information. This process makes the representation of each vector not only depend on itself, but also integrates the information of other related vectors in the time queue, so as to better capture the sequence and mutual influence of user behavior in the time dimension.

[0045] Transformer-based encoders usually contain multiple layers. After the self-attention mechanism and context information fusion, the encoding results are passed to the next layer for further processing. Each layer can learn different levels of user behavior features, from local features to more global semantic features. Between layers, residual connections and other technologies are used to ensure effective information transmission, avoid gradient vanishing or explosion problems, and enable the model to better train deep network structures. After multiple layers of conversion, the contextual semantic encoding vector of user behavior at each time point is finally obtained from the output layer of the encoder. These encoding vectors are very different from the input low-dimensional embedded encoding vectors in semantic representation. They contain richer contextual information and semantic features, and can better reflect the complex patterns and relationships of user behavior in time series. In detail, the input low-dimensional embedded encoding vector may focus on the basic features of user behavior, such as operation type, operation object, etc., while the output contextual semantic encoding vector can capture more advanced semantic information such as the trend, periodicity, and association between user behavior and other behaviors over a period of time. This makes subsequent tasks such as abnormal behavior detection based on these encoding vectors more accurate and effective.

[0046] After being output from the encoder, the user behavior context semantic encoding vectors at each time point need to be reorganized in the original time order to form a new time queue. This process must ensure that the output time queue is strictly consistent with the input time queue in time order so that subsequent time series-based analysis and processing can be performed correctly.

[0047] In step S143, user behavior gated adaptive feature propagation is performed on the time queue of the user behavior context semantic coding vector to obtain a user behavior temporal dynamic propagation coding vector. Specifically, Figure 4 FIG. 1 is a flowchart of step S143 in the multi-layer security protection method for the Internet of Things platform according to an embodiment of the present application. Figure 3 As shown, the step S143 includes: S1431, performing initial dynamic propagation processing on the time queue of the user behavior context semantic coding vector to obtain an initial user behavior context semantic feature dynamic propagation coding vector; S1432, performing private semantic feature calculation and gated screening writing on each user behavior context semantic coding vector in the time queue of the user behavior context semantic coding vector to obtain a time queue of gated-written user behavior semantic private feature coding vectors; S1433, fusing the initial user behavior context semantic feature dynamic propagation coding vector and the time queue of gated-written user behavior semantic private feature coding vectors to obtain the user behavior timing dynamic propagation coding vector.

[0048] It should be understood that in the process of analyzing user behavior data, in order to accurately determine whether there is abnormal behavior, it is necessary to comprehensively consider the overall trend and local details presented by the behavioral characteristics. From the overall trend, there may be a certain regularity in the user's operation behavior on the IoT device over a period of time, such as the changing trend of the overall operation frequency, the distribution of different types of operations in different time periods, etc. These overall trends reflect the macro pattern of user behavior; and in terms of local details, the unique attributes and subtle differences of each specific operation are also critical, such as the difference between the specific parameter settings of a certain device control operation and the normal situation. In order to be able to capture these two aspects of information at the same time, it is helpful to build a more complete user behavior feature representation, thereby providing a more sufficient basis for the accurate detection of abnormal behavior. In the technical solution of this application, it is necessary to perform user behavior gated adaptive feature propagation on the time queue of the user behavior context semantic coding vector to obtain the user behavior time series dynamic propagation coding vector.

[0049] Specifically, in the embodiment of the present application, the step S1431 includes: performing sequence reasoning based on the forward LSTM model on the time queue of the user behavior context semantic encoding vector to obtain the initial user behavior context semantic feature dynamic propagation encoding vector. The above process can be expressed as: ;in, is the time queue of the user behavior context semantic encoding vector, and are the first, second, and third elements in the time queue of the user behavior context semantic encoding vector. and A user behavior context semantic encoding vector, is the forward LSTM encoding, It is the dynamic propagation encoding vector of the initial user behavior context semantic features.

[0050] It should be understood that user behavior is not static, but constantly changes and develops over time. The semantic features reflected by behaviors at different time points and the way they interact with each other are different. During the encoding process, the forward LSTM model can learn the pattern of changes in user behavior features over time. Specifically, it can infer the possible situation of subsequent behavior features based on previous behavior feature information. This ability to learn the dynamic changes of behavior features helps the model understand the complex behavior logic of users on the IoT platform, and then more accurately detect abnormal behaviors that deviate from the norm. The dynamic propagation encoding vector of the initial user behavior context semantic features generated here contains the hidden state representation of the user behavior semantics at all previous time points.

[0051] Specifically, in the embodiment of the present application, the step S1432 includes: calculating the private semantic features of each user behavior context semantic encoding vector in the time queue of the user behavior context semantic encoding vector relative to the initial user behavior context semantic feature dynamic propagation encoding vector to obtain the time queue of the user behavior semantic private feature encoding vector. The process can be expressed as: ;in, is the first in the time queue of the user behavior context semantic encoding vector A user behavior context semantic encoding vector, is the dynamic propagation encoding vector of the initial user behavior context semantic features, It is subtracted by position point. Indicates taking the absolute value, is the point convolutional coding, is the weight matrix, is the activation function, yes The corresponding user behavior weight vector, is the first in the time queue of the user behavior semantic private feature encoding vector A user behavior semantic private feature encoding vector.

[0052] The process of performing gated screening and writing based on the Softmax function on each user behavior semantic private feature coding vector in the time queue of the user behavior semantic private feature coding vector to obtain the time queue of the gated writing user behavior semantic private feature coding vector can be expressed as: ;in, is the first in the time queue of the user behavior semantic private feature encoding vector A user behavior semantic private feature encoding vector, is matrix multiplication, yes The corresponding user behavior private feature weight matrix, yes The corresponding user behavior private feature bias vector, yes The position in the time queue of the user behavior semantic private feature encoding vector, yes function, is the first in the sequence of user behavior private feature activation vectors User behavior private feature activation vector, For Perform mask operations. yes The eigenvalues ​​at each position in , is the preset threshold, is the first in the sequence of user behavior private feature mask vectors User behavior private feature mask vector, and are the first, second and third time series of the user behavior semantic private feature encoding vector respectively. A user behavior semantic private feature encoding vector, and are the first, second and third in the sequence of the user behavior private feature mask vectors respectively. User behavior private feature mask vector, It is a time queue for gating and writing the private feature encoding vector of user behavior semantics.

[0053] It should be understandable that the user behavior context semantic feature dynamic propagation coding vector focuses on capturing the overall pattern and global semantic information of the original time queue data. Although this global feature can well reflect the macro characteristics of user behavior, it may ignore some fine-grained and individualized information. In order to recapture this ignored information and provide more comprehensive support for abnormal behavior detection, it is necessary to calculate the private semantic features of each user behavior context semantic coding vector in the time queue of the user behavior context semantic coding vector relative to the initial user behavior context semantic feature dynamic propagation coding vector to obtain a series of user behavior semantic private feature coding vectors that emphasize differences in user behaviors at different time points. In the time queue of the user behavior semantic private feature encoding vector, the features generated at different time points may contain different degrees of importance or relevance. The behavioral features at certain time points may be the key clues of abnormal behavior and therefore need to be retained, while the behavioral features at other time points may be normal behavior or noise, which contributes less to anomaly detection. In order to screen these features, retain the most representative and relevant features, and weaken or ignore unimportant features, to ensure that the subsequent reasoning process is more efficient and accurate, in this application, it is necessary to perform gated screening and writing based on the Softmax function on each user behavior semantic private feature encoding vector in the time queue of the user behavior semantic private feature encoding vector to obtain the gated writing user behavior semantic private feature encoding vector. That is, the gated screening and writing based on the Softmax function is used to determine whether the private semantic features at each time point need to be written into the initial propagation reasoning information of the user behavior context semantic feature sequence.

[0054] Finally, the initial user behavior context semantic feature dynamic propagation coding vector and the time queue of the gated written user behavior semantic private feature coding vector are fused to obtain the user behavior temporal dynamic propagation coding vector. The above process can be expressed as: ;in, is the dynamic propagation encoding vector of the initial user behavior context semantic features, is the time queue for gated writing of user behavior semantic private feature encoding vectors, For cascade processing, It is the user behavior temporal dynamic propagation encoding vector.

[0055] It should be understood that the initial user behavior context semantic feature dynamic propagation coding vector mainly captures the dynamic interaction mode of user behavior at different time points. This feature representation reflects the behavioral dependencies and mutual influences between different time points by modeling user behaviors at different time points; the time queue of gated writing of user behavior semantic private feature coding vector dynamically screens and strengthens the private semantic features at different time points through a gating mechanism, accurately capturing the unique attributes of each time point. In order to construct a comprehensive representation that can reflect the dynamic interaction of user behavior and maintain the uniqueness of user behavior, it is necessary to fuse the initial user behavior context semantic feature dynamic propagation coding vector and the time queue of gated writing of user behavior semantic private feature coding vector to obtain the user behavior temporal dynamic propagation coding vector in this application. By fusing these two types of features, the model can find a balance between the global and local, thereby more comprehensively describing user behavior.

[0056] In step S144, based on the user behavior time series dynamic propagation coding vector, the abnormal behavior monitoring result is obtained. Specifically, in the embodiment of the present application, the step S144 includes: inputting the user behavior time series dynamic propagation coding vector into the abnormal behavior monitoring module based on the classifier to obtain the abnormal behavior monitoring result, and the abnormal behavior monitoring result is used to indicate whether there is abnormal behavior. It should be understood that the user behavior time series dynamic propagation coding vector contains complex semantic feature information of user behavior. In order to judge the user behavior based on these feature information, it is necessary to input the user behavior time series dynamic propagation coding vector into the abnormal behavior monitoring module based on the classifier for feature analysis. Specifically, the classifier is a machine learning model that can learn the characteristic laws corresponding to various complex behavior patterns by training on a large amount of historical user behavior data (including labeled normal and abnormal behavior samples), and has the ability to automatically identify the degree of matching between the input new user behavior time series dynamic propagation coding vector and the known normal or abnormal pattern, so as to accurately judge whether there is abnormal behavior. The abnormal behavior monitoring result is the key output of the entire application layer abnormal behavior detection process, which provides a direct basis for the subsequent security protection decision and operation of the Internet of Things platform. In particular, in a specific embodiment of the present application, the user behavior time series dynamic propagation coding vector is input into an abnormal behavior monitoring module based on a classifier to obtain the abnormal behavior monitoring result, and the abnormal behavior monitoring result is used to indicate whether there is abnormal behavior, including: using the fully connected layer of the classifier to fully connect the user behavior time series dynamic propagation coding vector to obtain a user behavior time series dynamic propagation fully connected coding feature vector; inputting the user behavior time series dynamic propagation fully connected coding feature vector into the Softmax classification function of the classifier to obtain the probability value of the user behavior time series dynamic propagation coding vector belonging to each classification label, and the classification labels include those for indicating the presence of abnormal behavior and those for indicating the absence of abnormal behavior; and determining the classification label corresponding to the largest of the probability values ​​as the abnormal behavior monitoring result.

[0057] Here, in the case where each user behavior context semantic coding vector in the time queue of the user behavior context semantic coding vector represents the local time domain temporal association feature of the local time domain temporal context association between local time domains, when performing feature dynamic propagation optimization based on gated writing, the time domain gating complexity of the global time domain for the local time domain will lead to insufficient representation of the long-distance dynamic propagation fusion of the user behavior temporal dynamic propagation coding vector, thereby reducing the expression effect of the user behavior temporal dynamic propagation coding vector and affecting the accuracy of the abnormal behavior monitoring result obtained by inputting the classifier-based abnormal behavior monitoring module.

[0058] Based on this, in a preferred example, when the user behavior time series dynamic propagation coding vector is input into the abnormal behavior monitoring module based on the classifier to obtain the abnormal behavior monitoring result, the user behavior time series dynamic propagation coding vector is optimized, specifically including the following optimization steps: respectively calculating the first Eigenvalue Eigenvalue and Eigenvalue The absolute value of the difference between them is used to obtain the forward discrete value of the user behavior temporal dynamic propagation coding and user behavior temporal dynamic propagation encoding backward discrete value , here, if ,but ,like , is the length of the target message information query response encoding vector, then .

[0059] Dynamically propagate the encoded forward discreteness value in response to the user behavior sequence The backward discrete value of the user behavior time series dynamic propagation encoding The absolute value of the difference between them is less than or equal to the distance difference hyperparameter , calculate the The eigenvalues ​​are similar to the The weighted sum between the eigenvalues ​​is the optimized Eigenvalue , and represents a weighted hyperparameter.

[0060] Dynamically propagate the encoded forward discreteness value in response to the user behavior sequence The backward discrete value of the user behavior time series dynamic propagation encoding The absolute value of the difference between them is greater than the distance difference hyperparameter , perform the following steps: calculate the forward discrete value of the user behavior time series dynamic propagation coding corresponding to all eigenvalues ​​of the user behavior time series dynamic propagation coding vector The backward discrete value of the user behavior time series dynamic propagation encoding The square root of the sum of the squares of the user behavior time series dynamic propagation encoding heterogeneous distribution meta-domain coupling value : ; Dynamically propagate the user behavior time series to encode the forward discrete value The backward discrete value of the user behavior time series dynamic propagation encoding The absolute value of the difference is multiplied by the corresponding eigenvalue of the user behavior time series dynamic propagation coding vector Then divided by the user behavior time series dynamic propagation coding heterogeneous distribution meta-domain coupling value To obtain the user behavior timing dynamic propagation coding adaptive modulation value .

[0061] Each eigenvalue of the encoding vector is dynamically propagated through the user behavior time series The corresponding user behavior time sequence dynamic propagation coding adaptive modulation value After multiplication, calculate the product and the The weighted reduction between the eigenvalues ​​is the optimized Eigenvalue , and represents a weighted hyperparameter.

[0062] On the basis of keeping the first eigenvalue of the user behavior time series dynamic propagation sequence encoding vector unchanged, the first eigenvalue of the combined optimization The feature values ​​are used to obtain the optimized user behavior timing dynamic propagation encoding vector.

[0063] That is, in response to long-distance feature queries for a given feature set of the user behavior temporal dynamic propagation coding vector, when its attribute cluster is dynamically weighted by a classifier, the spatial neighborhood discreteness exceeds the critical threshold of the multimodal representation integrity, resulting in the weakening of the long-distance correlation between cross-modal features. By adopting a topological mapping method based on heterogeneous feature projection of the user behavior temporal dynamic propagation coding vector, the global association network architecture of the feature parameters of the user behavior temporal dynamic propagation coding vector is mapped to the implicit basis function space of distributed meta-domain coupling, and by constructing a parameterized adaptive modulation of the user behavior temporal dynamic propagation coding vector, a cross-dimensional association retrieval model between feature parameters is reconstructed to effectively capture the reconstruction path of remote temporal dependency. Thus, by enhancing the efficiency of multi-dimensional semantic fusion, the long-range joint encoding of the feature interaction relationship of the user behavior temporal dynamic propagation coding vector is realized, the representation accuracy and retrieval robustness of long-distance context association are significantly improved, and the accuracy of the abnormal behavior monitoring result obtained by inputting the user behavior temporal dynamic propagation coding vector into the abnormal behavior monitoring module based on the classifier is improved. In this way, through in-depth analysis of user behavior data, complex and hidden attack behaviors can be effectively detected and comprehensively captured, which is conducive to improving the security protection capabilities of the Internet of Things platform.

[0064] In step S150, in response to the abnormal behavior monitoring result that there is abnormal behavior, an alarm is triggered. It should be understood that the alarm is an explicit mark of abnormal behavior, which can send a clear risk signal to the system administrator or the automated protection module. It is not only a notification method for abnormal behavior, but also a trigger point for subsequent protection mechanisms. In a multi-layer security protection system, triggering an alarm is often a prerequisite for starting other security mechanisms (such as automated isolation, traffic restriction, data rollback, etc.). That is, by triggering an alarm, the system can quickly respond to threats, reduce losses, and provide support for subsequent recovery and optimization, thereby forming a complete security protection closed loop for the Internet of Things platform. Specifically, when the abnormal behavior monitoring module based on the classifier outputs the monitoring result of the existence of abnormal behavior, it will determine the severity of the abnormal behavior according to the pre-set abnormal level classification rules. The abnormal level classification comprehensively considers multiple factors such as the type of abnormal behavior, the frequency of occurrence, and the possible impact on the platform. Different abnormal levels will correspond to different alarm triggering strategies. Next, the system generates a message structure containing key information such as the timestamp of the abnormal behavior, the user account or device identifier involved, the specific description of the abnormal behavior, and the abnormal level, and sends it to the relevant subscription module through the platform's internal message queue mechanism according to the preset topic. At the same time, after receiving the message, the monitoring platform integrated with the IoT platform will trigger an alarm in a striking way on the visual interface, such as making the status indicator of the corresponding user account line flash red and popping up a detailed prompt box. In addition, the system will send alarm information through multiple notification channels such as email, SMS, and instant messaging tools. The email will highlight the subject and attach detailed content, response suggestions, and data links to relevant personnel. The SMS will edit the key abnormal information and send it to the mobile phone to ensure immediate knowledge. The instant messaging tool uses the API interface to push a card-style reminder with pictures and texts to the relevant groups or individuals. The triggering of the alarm is not an isolated action. It will be linked with the emergency response process, immediately restrict the permissions of the relevant accounts or devices, start data backup and strengthen log records, call security analysis tools and match the emergency plan, and organize relevant personnel to carry out follow-up investigations and processing work to ensure that the IoT platform is in a safe and stable state.

[0065] In summary, the multi-layer security protection method of the Internet of Things platform based on the embodiment of the present application is explained, which first obtains the time series data set of access traffic at the network boundary layer, and analyzes whether there is abnormal traffic based on the time series data set to generate abnormal traffic monitoring results. When the abnormal traffic monitoring results show that there is no abnormal traffic, the time series data set of user behavior data is further collected at the application layer, and the user behavior is detected based on the time series data set to generate abnormal behavior monitoring results. When abnormal behavior is found, an alarm is triggered. In this way, potential security threats to the Internet of Things platform can be effectively detected, and a rapid response can be ensured when potential security threats are detected, thereby ensuring the safe operation of the Internet of Things platform.

[0066] Figure 5 : is a system block diagram of a multi-layer security protection system for an Internet of Things platform according to an embodiment of the present application. Figure 5 As shown, according to the multi-layer security protection system 100 of the Internet of Things platform of the embodiment of the present application, it includes: an access flow data acquisition module 110, which is used to obtain a time series data set of access flow at the network boundary layer; a flow monitoring module 120, which is used to determine whether there is abnormal flow at the network boundary layer based on the time series data set of access flow to obtain an abnormal flow monitoring result; a user behavior data acquisition module 130, which is used to collect a time series data set of user behavior data at the application layer in response to the abnormal flow monitoring result that there is no abnormal flow; a user behavior monitoring module 140, which is used to determine whether there is abnormal behavior at the application layer based on the time series data set of user behavior data to obtain an abnormal behavior monitoring result; an alarm triggering module 150, which is used to generate an alarm in response to the abnormal behavior monitoring result that there is an abnormal flow behavior, triggering an alarm; wherein, the user behavior monitoring module includes: a user behavior data embedding coding and arranging unit, which is used to embed the coding and data arranging of the time series data set of the user behavior data to obtain a time queue of the user behavior low-dimensional embedded coding vector; a user behavior data semantic coding unit, which is used to perform user behavior semantic coding on the time queue of the user behavior low-dimensional embedded coding vector to obtain a time queue of the user behavior context semantic coding vector; a user behavior semantic feature gated propagation unit, which is used to perform user behavior gated adaptive feature propagation on the time queue of the user behavior context semantic coding vector to obtain a user behavior time series dynamic propagation coding vector; an abnormal behavior monitoring result generating unit, which is used to obtain the abnormal behavior monitoring result based on the user behavior time series dynamic propagation coding vector.

[0067] Here, those skilled in the art will appreciate that the specific functions and operations of the various units and modules in the multi-layer security protection system 100 of the IoT platform have been described in detail above. Figures 1 to 4The multi-layer security protection method for the Internet of Things platform has been introduced in detail, and therefore, its repeated description will be omitted.

[0068] In summary, the multi-layer security protection system 100 of the Internet of Things platform based on the embodiment of the present application is explained, which first obtains the time series data set of access traffic at the network boundary layer, and analyzes whether there is abnormal traffic based on the time series data set to generate abnormal traffic monitoring results. When the abnormal traffic monitoring results show that there is no abnormal traffic, it further collects the time series data set of user behavior data at the application layer, and detects whether the user behavior is abnormal based on the time series data set to generate abnormal behavior monitoring results. When abnormal behavior is found, an alarm is triggered. In this way, potential security threats to the Internet of Things platform can be effectively detected, and it can ensure that a rapid response can be made when potential security threats are detected, thereby ensuring the safe operation of the Internet of Things platform.

Claims

1. A multi-layer security protection method for an Internet of Things platform, characterized in that: include: At the network boundary layer, obtain a time series data set of access traffic; At the network boundary layer, based on the time series data set of the access traffic, determining whether there is abnormal traffic to obtain an abnormal traffic monitoring result; In response to the abnormal traffic monitoring result being that there is no abnormal traffic, collecting a time series data set of user behavior data at the application layer; At the application layer, based on the time series data set of the user behavior data, determining whether there is abnormal behavior to obtain abnormal behavior monitoring results, including: embedding coding and data sorting the time series data set of the user behavior data to obtain a time queue of a low-dimensional embedded coding vector of the user behavior; Perform user behavior semantic encoding on the time queue of the user behavior low-dimensional embedded coding vector to obtain a time queue of user behavior context semantic coding vector; perform user behavior gated adaptive feature propagation on the time queue of the user behavior context semantic coding vector to obtain a user behavior time series dynamic propagation coding vector; obtain the abnormal behavior monitoring result based on the user behavior time series dynamic propagation coding vector; and trigger an alarm in response to the abnormal behavior monitoring result indicating the existence of abnormal behavior.

2. The multi-layer security protection method for the Internet of Things platform according to claim 1 is characterized in that: The time series data set of the user behavior data is embedded and sorted to obtain a time queue of the user behavior low-dimensional embedded coding vector, including: embedding coding each user behavior data in the time series data set of the user behavior data to obtain a time series data set of the user behavior low-dimensional embedded coding vector; arranging the time series data set of the user behavior low-dimensional embedded coding vector according to timestamps to obtain a time queue of the user behavior low-dimensional embedded coding vector.

3. The multi-layer security protection method for the Internet of Things platform according to claim 2 is characterized in that: Embedding and encoding each user behavior data in the time series data set of the user behavior data to obtain a time series data set of user behavior low-dimensional embedded coding vectors, including: using a user behavior embedding matrix to embed and encode each user behavior data in the time series data set of the user behavior data to obtain a time series data set of user behavior low-dimensional embedded coding vectors.

4. The multi-layer security protection method for the Internet of Things platform according to claim 3 is characterized in that: Performing user behavior semantic encoding on the time queue of the user behavior low-dimensional embedding coding vector to obtain a time queue of user behavior context semantic coding vector, including: inputting the time queue of the user behavior low-dimensional embedding coding vector into a converter-based user behavior context encoder to obtain a time queue of the user behavior context semantic coding vector.

5. The multi-layer security protection method for the Internet of Things platform according to claim 4 is characterized in that: The time queue of the user behavior context semantic coding vector is subjected to user behavior gated adaptive feature propagation to obtain a user behavior temporal dynamic propagation coding vector, including: performing initial dynamic propagation processing on the time queue of the user behavior context semantic coding vector to obtain an initial user behavior context semantic feature dynamic propagation coding vector; performing private semantic feature calculation and gated screening writing on each user behavior context semantic coding vector in the time queue of the user behavior context semantic coding vector to obtain a time queue of gated written user behavior semantic private feature coding vector; fusing the initial user behavior context semantic feature dynamic propagation coding vector and the time queue of gated written user behavior semantic private feature coding vector to obtain the user behavior temporal dynamic propagation coding vector.

6. The multi-layer security protection method for the Internet of Things platform according to claim 5 is characterized in that: The time queue of the user behavior context semantic coding vector is subjected to initial dynamic propagation processing to obtain an initial user behavior context semantic feature dynamic propagation coding vector, including: performing sequence reasoning based on a forward LSTM model on the time queue of the user behavior context semantic coding vector to obtain the initial user behavior context semantic feature dynamic propagation coding vector.

7. The multi-layer security protection method for the Internet of Things platform according to claim 6 is characterized in that: The method comprises: performing private semantic feature calculation and gated filtering writing on each user behavior context semantic coding vector in the time queue of the user behavior context semantic coding vector to obtain a time queue of gated written user behavior semantic private feature coding vectors, including: calculating the private semantic features of each user behavior context semantic coding vector in the time queue of the user behavior context semantic coding vector relative to the initial user behavior context semantic feature dynamic propagation coding vector to obtain a time queue of user behavior semantic private feature coding vectors; performing gated filtering writing based on a Softmax function on each user behavior semantic private feature coding vector in the time queue of the user behavior semantic private feature coding vector to obtain a time queue of gated written user behavior semantic private feature coding vectors.

8. The multi-layer security protection method for the Internet of Things platform according to claim 7 is characterized in that: Based on the user behavior time series dynamic propagation coding feature, the abnormal behavior monitoring result is obtained, including: inputting the user behavior time series dynamic propagation coding vector into a classifier-based abnormal behavior monitoring module to obtain the abnormal behavior monitoring result, and the abnormal behavior monitoring result is used to indicate whether there is abnormal behavior.

9. A multi-layer security protection system for an Internet of Things platform, characterized in that: include: The access traffic data collection module is used to obtain the time series data set of access traffic at the network boundary layer; A traffic monitoring module is used to determine whether there is abnormal traffic at the network boundary layer based on the time series data set of the access traffic to obtain an abnormal traffic monitoring result; A user behavior data collection module, configured to collect a time series data set of user behavior data at an application layer in response to the abnormal traffic monitoring result indicating that there is no abnormal traffic; A user behavior monitoring module is used to determine whether there is abnormal behavior at the application layer based on the time series data set of the user behavior data to obtain an abnormal behavior monitoring result, wherein the user behavior monitoring module includes: a user behavior data embedding coding and sorting unit, which is used to embed the coding and data sorting of the time series data set of the user behavior data to obtain a time queue of user behavior low-dimensional embedded coding vectors; a user behavior data semantic coding unit, which is used to perform user behavior semantic coding on the time queue of the user behavior low-dimensional embedded coding vectors to obtain a time queue of user behavior context semantic coding vectors; a user behavior semantic feature gated propagation unit, which is used to perform user behavior gated adaptive feature propagation on the time queue of the user behavior context semantic coding vectors to obtain a user behavior time series dynamic propagation coding vector; an abnormal behavior monitoring result generating unit, which is used to obtain the abnormal behavior monitoring result based on the user behavior time series dynamic propagation coding vector; an alarm triggering module, which is used to trigger an alarm in response to the abnormal behavior monitoring result indicating the existence of abnormal behavior.

10. The multi-layer security protection system for the Internet of Things platform according to claim 9, characterized in that: The abnormal behavior monitoring result generating unit is used to: input the user behavior time series dynamic propagation coding vector into the classifier-based abnormal behavior monitoring module to obtain the abnormal behavior monitoring result, and the abnormal behavior monitoring result is used to indicate whether there is abnormal behavior.

Images