Terminal equipment integrated deployment method and system based on edge intelligent analysis

Abstract

The invention relates to a terminal equipment integration deployment method and system based on edge intelligent analysis, and belongs to the technical field of Internet of Things security. The method comprises the following steps: deploying an edge Internet of Things agent, obtaining terminal equipment traffic data according to the edge Internet of Things agent, integrating an SDN controller to the edge Internet of Things agent, and sending the terminal equipment traffic data to the SDN controller in real time through an API; constructing a threat detection model through an improved weighted random forest algorithm according to a preset network traffic data set; and outputting a network threat detection result through the threat detection model according to the traffic data of the terminal device, and automatically executing a preset security response measure through the SDN controller according to the network threat detection result, thereby realizing real-time monitoring and security management of the terminal device. The network traffic abnormity can be detected in real time, the response measure can be automatically executed, and the network security of the terminal equipment is improved.

Description

Technical Field

[0001] The present invention belongs to the field of Internet of Things security technology, and in particular relates to a terminal device integrated deployment method and system based on edge intelligent analysis. Background Art

[0002] With the widespread use of IoT devices, the number of terminal devices in the network has exploded, covering a variety of types such as sensors, surveillance cameras, and smart home appliances, which has put forward higher requirements for network resources and management complexity. Edge computing technology has emerged as the times require, pushing data processing and analysis to the edge of the network, aiming to reduce data transmission delays and bandwidth consumption, thereby improving the response efficiency of applications with strict real-time requirements. This transformation requires more intelligent data processing and decision support at the edge of the network. At the same time, with the increasing complexity of network attacks, traditional security solutions are difficult to cope with security threats from the edge of the network, and new security strategies and technical means are urgently needed to ensure the security of networks and terminal devices.

[0003] Traditional network management methods are usually based on static configuration and manual operation, which leads to slow network configuration and policy updates and makes it difficult to adapt to the rapidly changing network environment and security requirements. The emergence of software-defined network (SDN) technology provides a new perspective for network management. SDN can achieve more flexible and dynamic network configuration and resource management. By deploying intelligent agents at the edge of the network, the centralized control characteristics of SDN can be used to monitor and analyze network traffic and behavior in real time, so as to quickly identify potential security risks, respond immediately when threats are detected, and dynamically adjust network policies through SDN controllers to isolate or mitigate attacks, ensure the security of the network and terminal devices, and better adapt to the rapidly changing network environment and security requirements. Summary of the invention

[0004] In order to solve the above problems existing in the prior art, the present invention proposes a terminal device integrated deployment method and system based on edge intelligent analysis.

[0005] The purpose of the present invention can be achieved by the following technical solutions: A terminal device integrated deployment method based on edge intelligent analysis, comprising: Deploy an edge IoT agent, and obtain terminal device traffic data according to the edge IoT agent; Integrate the SDN controller into the edge IoT agent, and send the terminal device traffic data to the SDN controller in real time through the API; A threat detection model is constructed based on the preset network traffic data set by improving the weighted random forest algorithm; The network threat detection result is output through the threat detection model according to the terminal device traffic data, and the preset security response measure is automatically executed through the SDN controller according to the network threat detection result.

[0006] Preferably, the edge of the network is selected as the location for deploying the edge IoT agent, and the edge IoT agent is used to monitor and record terminal device traffic data.

[0007] Preferably, the step of integrating the SDN controller into the edge IoT agent and sending the terminal device traffic data to the SDN controller in real time through an API comprises: Connecting the edge IoT agent to the network and configuring network parameters, including IP address, subnet mask, default gateway and DNS server address; Establish a communication connection between the edge IoT agent and the SDN controller; Install Ubuntu Server, an operating system suitable for edge computing, and the latest security patches; Optimize the operating system, including shutting down unnecessary services and adjusting kernel parameters to optimize performance; Enable the system log service and configure the log file rotation policy; Enable the port mirroring function on the network device to copy the traffic data of the terminal device to the edge IoT agent.

[0008] Preferably, copying the flow data of the terminal device to the edge IoT agent includes: Define monitoring rules; Set the destination port of traffic mirroring, which is the port monitored by the edge IoT proxy; Set the collection frequency and storage strategy of terminal device traffic data.

[0009] Preferably, the step of constructing a threat detection model based on a preset network traffic data set by using an improved weighted random forest algorithm includes: According to the preset network traffic data set, a preset network traffic training set and a preset network traffic test set are obtained; According to the preset network traffic training set, an initial threat detection model is obtained by training an improved weighted random forest algorithm; The threat detection model is obtained by evaluating the initial threat detection model through a five-fold cross-evaluation according to the preset network traffic test set.

[0010] Preferably, the improved weighted random forest algorithm includes: According to the preset network traffic training set, repeated sampling with replacement is performed by using the Bootstrap resampling method to obtain a preset network traffic training subset; Initialize the weighted random forest classifier; Construct a CART classification tree by selecting split nodes through random attributes; Repeat the above steps to construct M CART classification trees; Obtain a preset network traffic CART classification tree by pruning and removing redundant nodes of the CART classification tree; The optimal parameters of the preset network traffic CART classification tree are obtained through the Grey Wolf Algorithm optimization; For the prediction results of the preset network traffic CART classification tree, the category to which the samples in the leaf nodes belong the most is taken as the output of the improved weighted random forest.

[0011] Preferably, the optimal parameters of the preset network traffic CART classification tree obtained by optimizing the gray wolf algorithm include: Initialize the search range of preset network traffic CART classification tree parameters; Preset number of iterations; Initialize the number of gray wolves; The preset network traffic CART classification tree parameters include the preset network traffic CART classification tree size, the preset network traffic CART classification tree depth, the minimum number of leaf node samples, and the minimum number of internal node partition samples; Calculate individual fitness and update the gray wolf's location information; By iterative optimization until the preset number of iterations is met, the optimal parameters of the preset network traffic CART classification tree are output.

[0012] A terminal device integrated deployment system based on edge intelligent analysis, applying the above-mentioned terminal device integrated deployment method based on edge intelligent analysis, including an edge IoT agent module, an SDN controller integration module, a threat detection model building module, and a security response module; The edge IoT proxy module is used to collect and monitor terminal device traffic data; The SDN controller integration module is used to be integrated into the edge IoT agent to achieve real-time monitoring and management of terminal device traffic data and execute security policies; The threat detection model building module is used to build a threat detection model based on a preset network traffic data set by using an improved weighted random forest algorithm, and train the threat detection model to identify and classify potential threats in terminal device traffic data; The security response module is used to analyze the real-time traffic data of the terminal device through the threat detection model, output the threat detection result and automatically execute the preset security response measures through the SDN controller.

[0013] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the above-mentioned terminal device integrated deployment method based on edge intelligent analysis is implemented.

[0014] A storage medium containing computer executable instructions, which, when executed by a computer processor, are used to execute the above-mentioned terminal device integrated deployment method based on edge intelligent analysis.

[0015] The beneficial effects of the present invention are: (1) By deploying edge IoT agents at the edge layer of the network, real-time monitoring and security management of terminal devices are achieved, effectively overcoming the shortcomings of traditional networks in edge device management.

[0016] (2) The threat detection model is constructed by using an improved weighted random forest algorithm, which improves the model's accuracy and efficiency in identifying network threats and reduces false positives and negatives.

[0017] (3) By integrating the SDN controller into the edge IoT agent and utilizing the centralized control features of SDN, it is possible to detect network traffic anomalies in real time and automatically execute response measures, thereby improving the network security of terminal devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0019] Figure 1 A flow chart of a terminal device integrated deployment method based on edge intelligent analysis according to the present invention. DETAILED DESCRIPTION

[0020] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0021] See also Figure 1 , a terminal device integrated deployment method based on edge intelligent analysis, comprising: S1: deploy an edge IoT agent, and obtain terminal device traffic data according to the edge IoT agent; S2: Integrate the SDN controller into the edge IoT agent, and send the terminal device traffic data to the SDN controller in real time through the API; S3: Construct a threat detection model based on the preset network traffic data set by improving the weighted random forest algorithm; S4: Outputting a network threat detection result through the threat detection model according to the terminal device traffic data, and automatically executing a preset security response measure through the SDN controller according to the network threat detection result.

[0022] In this embodiment, the location for configuring the edge IoT agent is selected as the edge of the network, such as an access point or a gateway; the edge IoT agent is used to monitor and record terminal device traffic data.

[0023] Specifically, for wireless networks, select wireless access points close to terminal devices to deploy edge IoT agents, so as to ensure that the traffic data of wireless devices can be captured in real time; for wired networks, select switches or hubs connected to terminal devices as access points; for LAN gateways, edge IoT agents can be deployed at the egress gateway of the LAN to monitor the egress traffic of the entire LAN; for WAN gateways, edge IoT agents need to be deployed at the gateway connected to the WAN to monitor the traffic data in and out of the WAN.

[0024] It should be noted that by evaluating the network traffic distribution at different locations, edge locations with larger traffic should be selected for deployment to capture more data. At the same time, device compatibility and physical environment should be considered to ensure that the network devices at the selected location are compatible with the edge IoT agent, support functions such as traffic mirroring, and ensure the physical installation environment of the device is safe.

[0025] In this embodiment, the edge IoT agent is connected to the network and the network parameters are configured to ensure that the edge IoT agent establishes a stable and reliable communication connection with the SDN controller.

[0026] Specifically, install Ubuntu Server, an operating system suitable for edge computing, and make sure to select the minimum installation to reduce system resource usage; install the latest security patches to protect the system from attacks of known vulnerabilities; optimize the operating system, including but not limited to shutting down unnecessary services and adjusting kernel parameters to optimize performance; configure network parameters, including IP address, subnet mask, default gateway, and DNS server address; enable the system log service and configure the rotation strategy of the log file to ensure that the log does not take up too much disk space; enable the port mirroring function on the network device to copy the traffic of the terminal device to the edge IoT agent, ensure that the network switch or router supports traffic mirroring, and configure it according to the guidelines of the equipment manufacturer.

[0027] It should be noted that copying the traffic data of the terminal device to the edge IoT agent includes: Define monitoring rules; Set the destination port of traffic mirroring, which is the port monitored by the edge IoT proxy; Set the collection frequency and storage strategy of terminal device traffic data; Specifically, set the collection frequency according to the network traffic size and monitoring requirements; configure the data retention time of traffic data to 30 days, and automatically overwrite old data when disk space is insufficient.

[0028] In this embodiment, the construction of a threat detection model based on a preset network traffic data set by improving a weighted random forest algorithm is specifically implemented by the following steps: According to the preset network traffic data set, a preset network traffic training set and a preset network traffic test set are obtained; According to the preset network traffic training set, an initial threat detection model is obtained by training an improved weighted random forest algorithm; The threat detection model is obtained by evaluating the initial threat detection model through a five-fold cross-evaluation according to the preset network traffic test set.

[0029] The improved weighted random forest algorithm includes: According to the preset network traffic training set, repeated sampling with replacement is performed by using the Bootstrap resampling method to obtain a preset network traffic training subset; Initialize the weighted random forest classifier; Construct a CART classification tree by selecting split nodes through random attributes; Repeat the above steps to construct M CART classification trees; Obtain a preset network traffic CART classification tree by pruning and removing redundant nodes of the CART classification tree; The optimal parameters of the preset network traffic CART classification tree are obtained through the Grey Wolf Algorithm optimization; For the prediction results of the preset network traffic CART classification tree, the category to which the samples in the leaf nodes belong the most is taken as the output of the improved weighted random forest.

[0030] The optimal parameters of the preset network traffic CART classification tree obtained by optimizing the gray wolf algorithm include: Initialize the search range of preset network traffic CART classification tree parameters; Preset number of iterations; Initialize the number of gray wolves; The preset network traffic CART classification tree parameters include the preset network traffic CART classification tree size, the preset network traffic CART classification tree depth, the minimum number of leaf node samples, and the minimum number of internal node partition samples; Calculate individual fitness and update the gray wolf's location information; Specifically, the position of each gray wolf represents a set of parameter combinations of a preset network traffic CART classification tree, and these positions are randomly initialized within a preset search range; for the preset network traffic CART classification tree parameter combination represented by each gray wolf, according to the rules of the gray wolf algorithm, the gray wolf position information is updated through individual fitness to move it toward the optimal solution. In each iteration, the optimal preset network traffic CART classification tree parameter combination currently found is recorded.

[0031] By iterative optimization until the preset number of iterations is met, the optimal parameters of the preset network traffic CART classification tree are output.

[0032] In this embodiment, the dynamic configuration capability of the SDN network can support the rapid deployment and adjustment of terminal devices. When the edge IoT agent detects a security threat, the SDN controller can immediately reconfigure the network to isolate the infected device or adjust the traffic path to enhance the security of the network.

[0033] Specifically, when the network threat detection result is a network attack label, preset security response measures are executed in a timely manner to isolate the threatening terminal device.

[0034] A terminal device integrated deployment system based on edge intelligent analysis includes an edge IoT agent module, an SDN controller integration module, a threat detection model building module, and a security response module; The edge IoT proxy module is used to collect and monitor terminal device traffic data; The SDN controller integration module is used to be integrated into the edge IoT agent to achieve real-time monitoring and management of terminal device traffic data and execute security policies; The threat detection model building module is used to build a threat detection model based on a preset network traffic data set by using an improved weighted random forest algorithm, and train the threat detection model to identify and classify potential threats in terminal device traffic data; The security response module is used to analyze the real-time traffic data of the terminal device through the threat detection model, output the threat detection result and automatically execute the preset security response measures through the SDN controller.

[0035] The computer storage medium of the embodiment of the present invention may adopt any combination of one or more computer-readable media. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device.

[0036] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0037] The program code included on the computer readable medium can be transmitted with any appropriate medium, including but not limited to wireless, electric wire, optical cable, RF, etc., or any suitable combination of the above. The computer program code for performing the operation of the present invention can be written in one or more programming languages ​​or their combinations, and the programming language includes object-oriented programming languages-such as Java, Smalltalk, C++, and also includes conventional procedural programming languages-such as "C" language or similar programming languages. The program code can be executed completely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on the remote computer, or completely on the remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0038] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any simple modification, equivalent change and modification made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. A terminal device integrated deployment method based on edge intelligent analysis, characterized in that: include: Deploy an edge IoT agent, and obtain terminal device traffic data according to the edge IoT agent; Integrate the SDN controller into the edge IoT agent, and send the terminal device traffic data to the SDN controller in real time through the API; A threat detection model is constructed based on the preset network traffic data set by improving the weighted random forest algorithm; The network threat detection result is output through the threat detection model according to the terminal device traffic data, and the preset security response measure is automatically executed through the SDN controller according to the network threat detection result.

2. The terminal device integrated deployment method based on edge intelligent analysis according to claim 1 is characterized in that: The edge of the network is selected as the location for deploying the edge IoT agent, and the edge IoT agent is used to monitor and record terminal device traffic data.

3. The terminal device integrated deployment method based on edge intelligent analysis according to claim 1 is characterized in that: The step of integrating the SDN controller into the edge IoT agent and sending the terminal device traffic data to the SDN controller in real time through an API includes: Connecting the edge IoT agent to the network and configuring network parameters, including IP address, subnet mask, default gateway and DNS server address; Establish a communication connection between the edge IoT agent and the SDN controller; Install Ubuntu Server, an operating system suitable for edge computing, and the latest security patches; Optimize the operating system, including shutting down unnecessary services and adjusting kernel parameters to optimize performance; Enable the system log service and configure the log file rotation policy; Enable the port mirroring function on the network device to copy the traffic data of the terminal device to the edge IoT agent.

4. The terminal device integrated deployment method based on edge intelligent analysis according to claim 3 is characterized in that: The step of copying the flow data of the terminal device to the edge IoT agent includes: Define monitoring rules; Set the destination port of traffic mirroring, which is the port monitored by the edge IoT proxy; Set the collection frequency and storage strategy of terminal device traffic data.

5. The terminal device integrated deployment method based on edge intelligent analysis according to claim 1 is characterized in that: The step of constructing a threat detection model based on a preset network traffic data set by using an improved weighted random forest algorithm includes: According to the preset network traffic data set, a preset network traffic training set and a preset network traffic test set are obtained; According to the preset network traffic training set, an initial threat detection model is obtained by training an improved weighted random forest algorithm; The threat detection model is obtained by evaluating the initial threat detection model through a five-fold cross-evaluation according to the preset network traffic test set.

6. The terminal device integrated deployment method based on edge intelligent analysis according to claim 5 is characterized in that: The improved weighted random forest algorithm includes: According to the preset network traffic training set, repeated sampling with replacement is performed by using the Bootstrap resampling method to obtain a preset network traffic training subset; Initialize the weighted random forest classifier; Construct a CART classification tree by selecting split nodes through random attributes; Repeat the above steps to construct M CART classification trees; Obtain a preset network traffic CART classification tree by pruning and removing redundant nodes of the CART classification tree; The optimal parameters of the preset network traffic CART classification tree are obtained through the Grey Wolf Algorithm optimization; For the prediction results of the preset network traffic CART classification tree, the category to which the samples in the leaf nodes belong the most is taken as the output of the improved weighted random forest.

7. The terminal device integrated deployment method based on edge intelligent analysis according to claim 6 is characterized in that: The optimal parameters of the preset network traffic CART classification tree obtained by optimizing the gray wolf algorithm include: Initialize the search range of preset network traffic CART classification tree parameters; Preset number of iterations; Initialize the number of gray wolves; The preset network traffic CART classification tree parameters include the preset network traffic CART classification tree size, the preset network traffic CART classification tree depth, the minimum number of leaf node samples, and the minimum number of internal node partition samples; Calculate individual fitness and update the gray wolf's location information; By iterative optimization until the preset number of iterations is met, the optimal parameters of the preset network traffic CART classification tree are output.

8. A terminal device integrated deployment system based on edge intelligent analysis, applying the terminal device integrated deployment method based on edge intelligent analysis as described in any one of claims 1 to 7, characterized in that: It includes edge IoT agent module, SDN controller integration module, threat detection model building module, and security response module; The edge IoT proxy module is used to collect and monitor terminal device traffic data; The SDN controller integration module is used to be integrated into the edge IoT agent to achieve real-time monitoring and management of terminal device traffic data and execute security policies; The threat detection model building module is used to build a threat detection model based on a preset network traffic data set by using an improved weighted random forest algorithm, and train the threat detection model to identify and classify potential threats in terminal device traffic data; The security response module is used to analyze the real-time traffic data of the terminal device through the threat detection model, output the threat detection result and automatically execute the preset security response measures through the SDN controller.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, it implements the terminal device integrated deployment method based on edge intelligent analysis as described in any one of claims 1-7.

10. A storage medium containing computer executable instructions, characterized in that: The computer executable instructions, when executed by a computer processor, are used to execute the terminal device integrated deployment method based on edge intelligent analysis as described in any one of claims 1-7.

Images