Internet of Things intrusion detection method based on multi-node state analysis

Abstract

The invention relates to the technical field of Internet of Things intrusion detection, and discloses an Internet of Things intrusion detection method based on multi-node state analysis, and the method comprises the steps: carrying out the feature extraction of Internet of Things equipment node flow, and carrying out the coarse-grained screening of Internet of Things equipment nodes with potential intrusion risks; performing fine-grained risk identification on the Internet of Things equipment nodes with the potential risks to obtain a log behavior sequence; and carrying out aggregation correlation analysis and Internet of Things intrusion detection on all log behavior sequences. The method comprises the following steps: performing causal similarity, semantic similarity and mutual information calculation on log records, selecting the log records which greatly influence the operation state of a potential risk Internet of Things equipment node as log behavior nodes, taking the log behavior nodes as items, and calculating to obtain item sets of different IP addresses communicating with the Internet of Things; and performing item set filtering in combination with the support degree and the confidence coefficient to obtain an abnormal behavior sequence, and performing similarity measurement on the abnormal behavior sequence and an intrusion behavior template to obtain an intrusion detection result of the IP address.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things intrusion detection, and in particular to an Internet of Things intrusion detection method for multi-node state analysis. Background Art

[0002] With the rapid development and popularization of Internet of Things (IoT) technology, more and more devices are connected through the Internet, forming a huge network. The popularity of IoT has brought convenience to people's lives and work, but it has also brought security challenges. The large-scale deployment of IoT devices and the complex network structure make them face various security threats, including intrusion and attack. Traditional network intrusion detection methods achieve the purpose of intrusion detection by analyzing the attack path of the network. However, in the IoT environment, attackers often no longer use a single IoT device as a springboard for penetration attacks. They achieve the purpose of intrusion through penetration attacks on multiple IoT devices, which makes traditional intrusion detection methods ineffective. Summary of the invention

[0003] In view of this, the present invention provides an Internet of Things intrusion detection method for multi-node status analysis, which achieves intrusion detection by fusing the operating status of multiple Internet of Things nodes to perform behavior analysis and protect the security of the Internet of Things network.

[0004] To achieve the above object, the present invention provides an IoT intrusion detection method for multi-node status analysis, comprising the following steps:

[0005] S1: Use the mirror port function of the network switch to copy and collect the traffic data of the IoT device node, obtain the IoT device node traffic and perform feature extraction to obtain the IoT device node traffic feature vector;

[0006] S2: Based on the traffic feature vectors of IoT device nodes, coarse-grained screening is performed on IoT device nodes with potential intrusion risks, and the screening results are used as potential risk IoT device nodes;

[0007] S3: Collect log data of potential risk IoT device nodes, perform fine-grained risk identification on potential risk IoT device nodes, and obtain log behavior sequences with intrusion risks in potential risk IoT device nodes;

[0008] S4: Based on the log behavior sequence, perform aggregation correlation analysis on the potential risk IoT device nodes to obtain the abnormal behavior sequence, and perform similarity measurement with the intrusion behavior template to determine whether it is an intrusion behavior.

[0009] As a further improvement method of the present invention:

[0010] Optionally, in step S1, the flow data of the IoT device node is copied and collected by using the mirror port function of the network switch, including:

[0011] The flow data of the IoT device node is copied by using the mirror port function of the network switch, and the copied flow data is transmitted to the flow monitoring device node as the IoT device node flow of the IoT device node. The network switch is a hardware device for network communication, which connects the IoT device node and the flow monitoring device node in the IoT network, wherein the IoT device node flow is a sequence of data packets sent or received by the IoT device node within a time window during the network communication process;

[0012] The IoT device node is a physical device node or a logical device node participating in the IoT network, which can connect to the IoT network and collect data, execute tasks and communicate over the network. The network communication objects include other IoT device nodes and communication devices except the IoT device node itself.

[0013] Optionally, feature extraction is performed on IoT device node traffic, including:

[0014] The extracted features of the IoT device node traffic include communication protocol distribution, data packet sending frequency, data packet receiving frequency, data packet speed jitter value, data packet size range and communication IP address distribution, and the extracted features constitute an IoT device node traffic feature vector corresponding to the IoT device node traffic;

[0015] The communication protocol distribution is the frequency distribution of the communication protocols used by all data packets sent or received by the IoT device node within the time window, the data packet sending frequency is the number of data packets sent by the IoT device node within the time window, and the data packet receiving frequency is the number of data packets received by the IoT device node within the time window;

[0016] The data packet speed jitter value includes the sending data packet jitter value and the receiving data packet jitter value;

[0017] The range of data packet sizes includes the size range of sent data packets and the size range of received data packets;

[0018] The communication IP address distribution is the frequency distribution of IP addresses of network communication objects of IoT device nodes within the time window.

[0019] Optionally, in step S2, coarse-grained screening of IoT device nodes with potential intrusion risks based on IoT device node traffic feature vectors may include:

[0020] The coarse-grained screening process of IoT device nodes with potential intrusion risks is as follows:

[0021] Obtaining traffic feature vectors of the IoT device nodes in a recent plurality of consecutive time windows, and forming a traffic feature vector sequence of the IoT device nodes with the traffic feature vectors of the IoT device nodes in the consecutive plurality of time windows;

[0022] The Transformer model with improved attention mechanism is used to receive the traffic feature vector sequence of IoT device nodes, and output the classification results of the IoT device nodes corresponding to the traffic feature vector sequence, where the classification results of the IoT device nodes include potential risk IoT device nodes and IoT device nodes without potential risks;

[0023] The network structure of the Transformer model with improved attention mechanism includes an encoding layer, a multi-head attention mechanism layer and a feedforward layer in sequence;

[0024] The encoding layer is used to perform weighted processing on the traffic feature vectors of the IoT device nodes in the traffic feature vector sequence, and based on the time window position corresponding to the traffic feature vector of the IoT device node, use the sine and cosine functions to generate the position vector of the traffic feature vector of the IoT device node, add the weighted processing result and the position vector as the high-dimensional embedding vector corresponding to the traffic feature vector of the IoT device node, and sort the high-dimensional embedding vector based on the order of the traffic feature vector of the IoT device node in the traffic feature vector sequence to form a high-dimensional embedding vector sequence of the IoT device node;

[0025] The multi-head attention mechanism layer includes H independent attention heads. Each attention head uses a different weight matrix to perform attention calculation on the high-dimensional embedding vector. In the attention calculation process, the high-dimensional embedding vector sequence is masked using an adaptively adjusted mask function to control the range of attention and generate an attention matrix for the high-dimensional embedding vector sequence.

[0026] The feedforward layer includes a linear transformation layer, a gated linear unit, and an activation function. The attention matrix of the high-dimensional embedded vector sequence is linearly transformed and linearly projected to obtain the two-dimensional attention features of the high-dimensional embedded vector sequence. The Softmax activation function is used to generate the probability distribution of the two-dimensional attention features in the two classification results, and the distribution result with the highest probability is selected for coarse-grained screening of IoT device nodes.

[0027] Optionally, the log data of the potential risk IoT device nodes are collected in step S3, including:

[0028] The log data of the potential risk IoT device node includes system log, device status log, security log, application log, data log and event log;

[0029] The system log includes the restart record of the potential risk IoT device node, whether the network time is successfully synchronized, the CPU usage record, the available memory ratio record and the available storage space ratio record;

[0030] The device status log includes the current operation mode, power consumption and power interruption records of the potential risk IoT device node, wherein the power consumption is a sequence of power quantity records of the potential risk IoT device node in the most recent consecutive multiple time windows;

[0031] The security log includes a record of access rights changes of potential risk IoT device nodes, encryption status of sent data packets, and firmware integrity check results;

[0032] The application log includes a sequence of application execution records of the potential risk IoT device node in a recent plurality of consecutive time windows, wherein the application execution record includes a specific task executed by the potential risk IoT device node and an execution timestamp;

[0033] The data log includes a data collection record sequence, a data transmission record sequence, and a data reception record sequence of the potential risk IoT device node in the most recent consecutive multiple time windows, wherein the data collection record is the type of data and data content collected by the potential risk IoT device node, the data transmission record is the data content, the IP address of the network communication object, and the transmission timestamp transmitted by the potential risk IoT device node to the network communication object, and the data reception record is the data content, the reception timestamp, and the data packet transmission IP address corresponding to the received data packet received by the potential risk IoT device node;

[0034] The event log includes internal event records and external event records of potential risk IoT device nodes, wherein internal events are events triggered by potential risk IoT device nodes themselves, including alarm events and abnormal detection events, and external events include network disconnection events and power supply interruption events.

[0035] Optionally, the fine-grained risk identification of potential risk IoT device nodes based on log data to obtain a log behavior sequence of potential risk IoT device nodes with intrusion risks includes:

[0036] The fine-grained risk identification process of the potential risk IoT device node is as follows:

[0037] Extract the timestamp of the log record, sort the log records in the log data according to the timestamp order, and use the BERT model to vectorize the log records to obtain the log record vector;

[0038] A causal timing window of length Len is set. If the timestamp difference corresponding to the two sets of log record vectors of the potential risk IoT device node is within the length range of the causal timing window, it means that there is causal similarity between the two sets of log record vectors, and the causal similarity between the two sets of log record vectors is calculated. Otherwise, the causal similarity between the two sets of log record vectors is set to 0. The higher the causal similarity, the more likely the log record with a smaller timestamp is to be the cause of the log record with a larger timestamp.

[0039] Calculate the semantic similarity between the two groups of log record vectors, where the semantic similarity is calculated using cosine similarity;

[0040] The mutual information between the two groups of log record vectors is calculated, where the mutual information is the amount of information contained in one group of log record vectors in another group of log record vectors. The greater the amount of information, the greater the degree of dependence between the two groups of log record vectors.

[0041] Perform weighted calculation on the causal similarity, semantic similarity and mutual information of the two sets of log record vectors, and use the weighted calculation result as the state correlation of the two sets of log record vectors, where the sum of the weights of causal similarity, semantic similarity and mutual information is 1;

[0042] Randomly select a group of log record vectors, calculate the mean and standard deviation of the state correlation between the selected log record vectors and the unselected log record vectors, and calculate the standard deviation / mean, use the calculation result as the variation feature of the log record corresponding to the selected log record vector, and reselect the log record vector until the variation features of all log records are obtained;

[0043] Select log records whose mutation characteristics are higher than the preset mutation characteristic threshold as log behavior nodes of potential risk IoT device nodes; sort the log behavior nodes according to the timestamp order of abnormal behavior nodes, and use the sorting results as the log behavior sequence of potential risk IoT device nodes.

[0044] Optionally, in step S4, performing aggregate association analysis on potential risk IoT device nodes based on log behavior sequences to obtain abnormal behavior sequences across IoT device nodes includes:

[0045] Obtain the log behavior sequences of all potential risk IoT device nodes, take the log behavior nodes with IP addresses in the log behavior sequence as key items, and take the log behavior nodes without IP addresses in the log behavior sequence as common items;

[0046] Calculate the support of the IP address in the key item among all potential risk IoT device nodes;

[0047] Select an IP address whose support is higher than a preset first support threshold and a key item containing the IP address, use the selected key item as the main key item, and use the selected main key item and other key items or common items other than the selected main key item to form an item set, calculate the support of the item set in all potential risk IoT device nodes, and calculate the confidence of the item set;

[0048] Filtering itemsets whose support is lower than a preset support threshold and whose confidence is lower than a preset confidence threshold;

[0049] The reserved item set of the IP address is counted, and the reserved item set of the IP address is constructed as an abnormal behavior sequence of the IP address.

[0050] Optionally, the measuring similarity between the abnormal behavior sequence of the IP address and the intrusion behavior template includes:

[0051] If the similarity measurement result is higher than the preset similarity threshold, it means that the IP address has intruded into the IoT network and an alarm is triggered.

[0052] In order to solve the above problem, the present invention provides an electronic device, the electronic device comprising:

[0053] A memory storing at least one instruction;

[0054] Communication interface, enabling electronic equipment to communicate; and

[0055] The processor executes the instructions stored in the memory to implement the Internet of Things intrusion detection method for multi-node status analysis described above.

[0056] In order to solve the above problems, the present invention also provides a computer-readable storage medium, in which at least one instruction is stored. The at least one instruction is executed by a processor in an electronic device to implement the Internet of Things intrusion detection method for multi-node status analysis described above.

[0057] Compared with the prior art, the present invention proposes an IoT intrusion detection method based on multi-node status analysis, which has the following advantages:

[0058] First, this scheme proposes a method for screening IoT device nodes with network communication risks. The traffic data of IoT device nodes is collected by using the mirror port space, and the communication protocol distribution and data packet parameters in the traffic data are extracted to form an IoT device node traffic feature vector that characterizes the network communication status of the IoT device node. The Transformer model based on dynamic masks is used to perform coarse-grained screening of IoT device nodes. By performing random masking on the initial mask matrix, the correlation degree of the adaptive mask matrix under each attention head is improved. Then, during the training process of the Transformer model, the model adjusts the attention range of each attention head while adjusting the global attention, so that the model learns the optimal attention range. By adjusting the attention range of the attention head, different attention heads can capture local dependencies and global dependencies, enhance the expression ability of the model, and obtain potential risk IoT device nodes with network communication risks.

[0059] At the same time, this scheme proposes an IoT device status analysis and intrusion detection method, which collects log data of potential risk IoT device nodes, calculates causal similarity, semantic similarity and mutual information of log records based on the timestamps of log records in the log data, selects log records that greatly affect the operating status of potential risk IoT device nodes, and constructs a log behavior sequence of intrusion risks in potential risk IoT device nodes. Combined with the log behavior sequences of all potential risk IoT device nodes, the log behavior nodes are used as items to calculate the item sets of different IP addresses, and the support and confidence of the item sets are used to filter the item sets, and the reserved item sets of IP addresses are counted, and the reserved item sets of IP addresses are constructed as abnormal behavior sequences of IP addresses, and the abnormal behavior sequences of IP addresses are measured for similarity with the intrusion behavior templates. The higher the similarity measurement result, the greater the probability that the IP address has intrusion behavior, thereby realizing an IoT intrusion detection method for multi-node status analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A flowchart of an Internet of Things intrusion detection method for multi-node status analysis provided by an embodiment of the present invention.

[0061] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0062] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0063] The embodiment of the present application provides an Internet of Things intrusion detection method for multi-node status analysis. The execution subject of the Internet of Things intrusion detection method for multi-node status analysis includes but is not limited to at least one of the electronic devices such as a server and a terminal that can be configured to execute the method provided by the embodiment of the present application. In other words, the Internet of Things intrusion detection method for multi-node status analysis can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc.

[0064] Embodiment 1:

[0065] An Internet of Things intrusion detection method for multi-node state analysis includes the following steps:

[0066] S1: Use the mirror port function of the network switch to copy and collect the traffic data of the IoT device node, obtain the IoT device node traffic and perform feature extraction to obtain the IoT device node traffic feature vector.

[0067] In the step S1, the flow data of the IoT device node is copied and collected by using the mirror port function of the network switch, including:

[0068] The flow data of the IoT device node is copied by using the mirror port function of the network switch, and the copied flow data is transmitted to the flow monitoring device node as the IoT device node flow of the IoT device node. The network switch is a hardware device for network communication, which connects the IoT device node and the flow monitoring device node in the IoT network, wherein the IoT device node flow is a sequence of data packets sent or received by the IoT device node within a time window during the network communication process;

[0069] Specifically, a fixed-length time window can be used to collect data packets, and the data packet sequence in the time window is used as the IoT device node traffic under the time window. After collecting data packets in the current time window, the memory space storing the data packets in the time window is cleared, and the data packets are slid to the next time window to continue collecting data packets. This method not only avoids the problem of large memory overhead caused by too large a time window, but also reduces the delay caused by data packet collection, and better reflects the behavioral characteristics of IoT device nodes in the recent period of time;

[0070] The IoT device node is a physical device node or a logical device node participating in the IoT network, which can connect to the IoT network and collect data, execute tasks and communicate over the network. The network communication objects include other IoT device nodes and communication devices other than the IoT device node itself. The IoT device nodes are divided into perception nodes, execution nodes, edge nodes and user nodes. The perception nodes are mainly used to collect status information of the environment or device nodes. The execution nodes are used to receive instructions and execute specific actions specified. The edge nodes are used to store received data. The user nodes are devices that can interact with users to help users monitor and control IoT device nodes.

[0071] Extract features from IoT device node traffic, including:

[0072] The extracted features of the IoT device node traffic include communication protocol distribution, data packet sending frequency, data packet receiving frequency, data packet speed jitter value, data packet size range and communication IP address distribution, and the extracted features constitute an IoT device node traffic feature vector corresponding to the IoT device node traffic;

[0073] The communication protocol distribution is the frequency distribution of the communication protocols used by all data packets sent or received by the IoT device node within the time window, the data packet sending frequency is the number of data packets sent by the IoT device node within the time window, and the data packet receiving frequency is the number of data packets received by the IoT device node within the time window;

[0074] The data packet speed jitter value includes a sending data packet jitter value and a receiving data packet jitter value, wherein the sending data packet jitter value is the average value of the time interval between data packets sent by the IoT device node within the time window, and the receiving data packet jitter value is the average value of the time interval between data packets received by the IoT device node within the time window;

[0075] The range of data packet size includes the size range of sent data packets and the size range of received data packets. The size range of sent data packets includes the maximum number of bytes and the minimum number of bytes of data packets sent by the IoT device node within the time window. The size range of received data packets includes the maximum number of bytes and the minimum number of bytes of data packets received by the IoT device node within the time window.

[0076] The communication IP address distribution is the frequency distribution of the IP addresses of the network communication objects of the IoT device node within the time window. Specifically, the number of times each IP address communicates with the IoT device node within the time window can be used as the communication IP address distribution of the IoT device node.

[0077] S2: Based on the traffic feature vectors of IoT device nodes, coarse-grained screening is performed on IoT device nodes with potential intrusion risks, and the screening results are used as potential risk IoT device nodes.

[0078] In the step S2, based on the traffic feature vector of the IoT device nodes, the IoT device nodes with potential intrusion risks are coarsely screened, including:

[0079] The coarse-grained screening process of IoT device nodes with potential intrusion risks is as follows:

[0080] Obtaining traffic feature vectors of the IoT device nodes in a recent plurality of consecutive time windows, and forming a traffic feature vector sequence of the IoT device nodes with the traffic feature vectors of the IoT device nodes in the consecutive plurality of time windows;

[0081] The Transformer model with improved attention mechanism is used to receive the traffic feature vector sequence of IoT device nodes, and output the classification results of the IoT device nodes corresponding to the traffic feature vector sequence, where the classification results of the IoT device nodes include potential risk IoT device nodes and IoT device nodes without potential risks;

[0082] The network structure of the Transformer model with improved attention mechanism includes an encoding layer, a multi-head attention mechanism layer and a feedforward layer in sequence;

[0083] The encoding layer is used to perform weighted processing on the traffic feature vectors of the IoT device nodes in the traffic feature vector sequence, and based on the time window position corresponding to the traffic feature vector of the IoT device node, use the sine and cosine functions to generate the position vector of the traffic feature vector of the IoT device node, add the weighted processing result and the position vector as the high-dimensional embedding vector corresponding to the traffic feature vector of the IoT device node, and sort the high-dimensional embedding vector based on the order of the traffic feature vector of the IoT device node in the traffic feature vector sequence to form a high-dimensional embedding vector sequence of the IoT device node;

[0084] The multi-head attention mechanism layer includes H independent attention heads. Each attention head uses a different weight matrix to perform attention calculation on the high-dimensional embedding vector. In the attention calculation process, the high-dimensional embedding vector sequence is masked using an adaptively adjusted mask function to control the range of attention and generate an attention matrix for the high-dimensional embedding vector sequence.

[0085] As a preferred embodiment of the present invention, the attention matrix calculation formula of the high-dimensional embedding vector sequence f is:

[0086] Att(f)=Concat(a f (1),af (2),...,a f (h),...,a f (H))W1

[0087]

[0088] L(f h )=B(f h-1 )·f h-1

[0089] f h =a f (h-1)·f h-1

[0090]

[0091] in:

[0092] Att(f) represents the attention matrix of the high-dimensional embedding vector sequence f;

[0093] T stands for transpose;

[0094] Concat(·) represents concatenation, which is used to concatenate the attention values ​​calculated by multiple attention heads. W1 represents the linear transformation weight matrix, which is used to map the concatenation result of the attention values ​​into a matrix form of H rows and D columns, where D represents the number of features extracted from the traffic feature vector of the IoT device node.

[0095] f h It means that the high-dimensional embedding vector sequence is iteratively processed using the attention value output by the h-1th attention head, and the obtained h-th iterative high-dimensional embedding vector sequence is f0=f, h∈[1,H];

[0096] a f (h) represents the attention value of the high-dimensional embedding vector sequence f output by the h-th attention head;

[0097] represents the three weight matrices in the h-th attention head, Represents a high-dimensional embedding vector sequence f h The weighted result of

[0098] d represents the dimension of the attention head; specifically, it can be expressed as d = H / D;

[0099] ||·||2 represents the L2 norm;

[0100] L(·) represents the adaptive adjustment mask function, L(f h ) represents the high-dimensional embedding vector sequence f h Adaptive adjustment mask result;

[0101] B(f h-1 ) represents the high-dimensional embedding vector sequence f h The corresponding adaptive mask matrix, the size of the adaptive mask matrix is ​​consistent with the high-dimensional embedding vector sequence, B represents the initial mask matrix, A represents the preset hyperparameter, represents the attention range of the h-1th attention head obtained through training, num represents the number of shared parameters of H attention heads, and s h-1 represents the weight matrix of the h-1th attention head, ||·||2 represents the L2 norm, and rate represents the preset mask ratio;

[0102] Represents the initial mask matrix B The matrix elements of the mask are randomly masked, and the element values ​​of the matrix elements after the masking process are negative infinity; as a preferred embodiment of the present invention, after the initial mask matrix is ​​randomly masked, the similarity between the current adaptive mask matrix and the adaptive mask matrix of the previous attention head is calculated, and if the similarity is lower than the preset mask similarity threshold, the current adaptive mask matrix is ​​retained, otherwise the initial mask matrix is ​​randomly masked again to improve the correlation degree of the adaptive mask matrix under each attention head, and then in the training process of the Transformer model, the model is adjusted while adjusting the attention range of each attention head and the global attention, so that the model learns the optimal attention range, and by adjusting the attention range of the attention head, different attention heads can capture local dependencies and global dependencies, thereby enhancing the expression ability of the model;

[0103] The feedforward layer includes a linear transformation layer, a gated linear unit, and an activation function, which performs a linear transformation and linear projection on the attention matrix of the high-dimensional embedded vector sequence to obtain a two-dimensional attention feature of the high-dimensional embedded vector sequence, and uses a Softmax activation function to generate a probability distribution of the two-dimensional attention feature in two classification results, and selects the distribution result with the highest probability for coarse-grained screening of IoT device nodes. As an embodiment of the present invention, the present invention uses a binary cross entropy loss function to train the matrix parameters and attention range in the Transformer model, and the training algorithm can use one or more combinations of the ADAM optimization algorithm, the Newton iteration method, and the gradient descent method.

[0104] S3: Collect log data of potential risk IoT device nodes, perform fine-grained risk identification on potential risk IoT device nodes, and obtain log behavior sequences with intrusion risks in potential risk IoT device nodes.

[0105] The log data of the potential risk IoT device nodes collected in step S3 includes:

[0106] The log data of the potential risk IoT device node includes system log, device status log, security log, application log, data log and event log;

[0107] The system log includes the restart record of the potential risk IoT device node, whether the network time is successfully synchronized, the CPU usage record, the available memory ratio record and the available storage space ratio record;

[0108] The device status log includes the current operation mode, power consumption and power interruption records of the potential risk IoT device node, wherein the power consumption is a sequence of power quantity records of the potential risk IoT device node in the most recent consecutive multiple time windows;

[0109] The security log includes a record of access rights changes of potential risk IoT device nodes, the encryption status of sent data packets, and firmware integrity check results, where the encryption status of sent data packets is encrypted or unencrypted;

[0110] The application log includes a sequence of application execution records of the potential risk IoT device node in a recent plurality of consecutive time windows, wherein the application execution record includes a specific task executed by the potential risk IoT device node and an execution timestamp;

[0111] The data log includes a data collection record sequence, a data transmission record sequence, and a data reception record sequence of the potential risk IoT device node in the most recent consecutive multiple time windows, wherein the data collection record is the type of data and data content collected by the potential risk IoT device node, the data transmission record is the data content, the IP address of the network communication object, and the transmission timestamp transmitted by the potential risk IoT device node to the network communication object, and the data reception record is the data content, the reception timestamp, and the data packet transmission IP address corresponding to the received data packet received by the potential risk IoT device node;

[0112] The event log includes internal event records and external event records of potential risk IoT device nodes, wherein internal events are events triggered by potential risk IoT device nodes themselves, including alarm events and abnormal detection events, and external events include network disconnection events and power supply interruption events.

[0113] The fine-grained risk identification of potential risk IoT device nodes based on log data is performed to obtain a log behavior sequence of intrusion risks in the potential risk IoT device nodes, including:

[0114] The fine-grained risk identification process of the potential risk IoT device node is as follows:

[0115] Extract the timestamp of the log record, sort the log records in the log data according to the timestamp order, and use the BERT model to vectorize the log records to obtain the log record vector;

[0116] A causal timing window of length Len is set. If the timestamp difference corresponding to the two sets of log record vectors of the potential risk IoT device node is within the length range of the causal timing window, it means that there is causal similarity between the two sets of log record vectors, and the causal similarity between the two sets of log record vectors is calculated. Otherwise, the causal similarity between the two sets of log record vectors is set to 0. The higher the causal similarity, the more likely the log record with a smaller timestamp is to be the cause of the log record with a larger timestamp. Specifically, the causal similarity Sim1(D1, D2) between the log record vectors D1 and D2 can be calculated using the following formula:

[0117]

[0118] in:

[0119] time(D1) represents the timestamp corresponding to the log record vector D1, and time(D2) represents the timestamp corresponding to the log record vector D2. The larger the timestamp, the later the log record occurs, and time(D2)≤time(D1);

[0120] exp(·) represents an exponential function with a natural constant as the base;

[0121] Calculate the semantic similarity between the two groups of log record vectors, where the semantic similarity is calculated using cosine similarity;

[0122] The mutual information between the two groups of log record vectors is calculated, and the mutual information is the amount of information contained in one group of log record vectors in another group of log record vectors. The greater the amount of information, the greater the degree of dependence between the two groups of log record vectors. As a preferred embodiment of the present invention, the mutual information Sim2(D1, D2) between the log record vectors D1 and D2 can be calculated by the following formula:

[0123]

[0124] in:

[0125] P(D1) represents the frequency of occurrence of the log record vector D1, and P(D2) represents the frequency of occurrence of the log record vector D1;

[0126] Perform weighted calculation on the causal similarity, semantic similarity and mutual information of the two sets of log record vectors, and use the weighted calculation result as the state correlation of the two sets of log record vectors, where the sum of the weights of causal similarity, semantic similarity and mutual information is 1;

[0127] Randomly select a group of log record vectors, calculate the mean and standard deviation of the state correlation between the selected log record vectors and the unselected log record vectors, and calculate the standard deviation / mean, use the calculation result as the variation feature of the log record corresponding to the selected log record vector, and reselect the log record vector until the variation features of all log records are obtained;

[0128] The log records with mutation characteristics higher than the preset mutation characteristic threshold are selected as the log behavior nodes of the potential risk IoT device nodes; the log behavior nodes are sorted according to the timestamp order of the abnormal behavior nodes, and the sorting results are used as the log behavior sequence of the potential risk IoT device nodes. As a preferred embodiment of the present invention, the present invention filters the information recorded in the log behavior nodes, wherein the filtered content is the device information of the potential risk IoT device nodes, improves the accuracy of the aggregated association analysis of multiple potential risk IoT device nodes, and avoids the interference of the device information in the aggregated association analysis process.

[0129] S4: Based on the log behavior sequence, perform aggregation correlation analysis on the potential risk IoT device nodes to obtain the abnormal behavior sequence, and perform similarity measurement with the intrusion behavior template to determine whether it is an intrusion behavior.

[0130] In the step S4, based on the log behavior sequence, aggregation correlation analysis is performed on the potential risk IoT device nodes to obtain abnormal behavior sequences across IoT device nodes, including:

[0131] Obtain the log behavior sequences of all potential risk IoT device nodes, take the log behavior nodes with IP addresses in the log behavior sequence as key items, and take the log behavior nodes without IP addresses in the log behavior sequence as common items;

[0132] The support of the IP address in the key item among all potential risk IoT device nodes is calculated, where the support of IP address θ is Support(θ) = count(θ) / Sum, where count(θ) represents the number of potential risk IoT device nodes that contain the key item of IP address θ in the log behavior sequence, and Sum represents the total number of potential risk IoT device nodes;

[0133] An IP address whose support is higher than a preset first support threshold and a key item containing the IP address are selected, the selected key item is used as the main key item, the selected main key item and other key items or common items other than the selected main key item constitute an item set, the support of the item set in all potential risk IoT device nodes is calculated, and the confidence of the item set is calculated; the support of the item set is the ratio of the number of potential risk IoT device nodes containing the item set in the log behavior sequence to the sum, and the confidence of the item set is the ratio of the support of the item set to the support of the main key item in the item set;

[0134] Filtering itemsets whose support is lower than a preset support threshold and whose confidence is lower than a preset confidence threshold;

[0135] The reserved item set of the IP address is counted, and the reserved item set of the IP address is constructed as an abnormal behavior sequence of the IP address. The reserved item set of the IP address θ is the item set including the IP address θ in the current reserved item set. The abnormal behavior sequence construction process of the IP address θ is as follows:

[0136] Extract key items, main key items and common items from the reserved item set of IP address θ, form a set with the extracted results, and re-use the extracted results in the set as log behavior nodes, sort them according to the timestamps of the log behavior nodes, and use the sorting results as the abnormal behavior sequence of IP address θ.

[0137] The similarity measurement of the abnormal behavior sequence of the IP address and the intrusion behavior template includes:

[0138] If the similarity measurement result is higher than the preset similarity threshold, it means that the IP address has intrusion behavior on the Internet of Things network, and an alarm is processed. The similarity measurement method is: use a dynamic time warping algorithm to non-linearly align the behavior nodes in the intrusion behavior template with the abnormal behavior nodes in the abnormal behavior sequence, and calculate the distance between the intrusion behavior template and the abnormal behavior sequence after non-linear alignment, and use the inverse of the distance as the similarity between the two.

[0139] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0140] It should be noted that the serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. And the terms "including", "comprising" or any other variants thereof in this article are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "including a ..." does not exclude the presence of other identical elements in the process, device, article or method including the element.

[0141] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0142] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A multi-node state analysis method for intrusion detection in the Internet of Things, characterized in that: The method comprises: S1: Use the mirror port function of the network switch to copy and collect the traffic data of the IoT device node, obtain the IoT device node traffic and perform feature extraction to obtain the IoT device node traffic feature vector; S2: Based on the traffic feature vectors of IoT device nodes, coarse-grained screening is performed on IoT device nodes with potential intrusion risks, and the screening results are used as potential risk IoT device nodes; S3: Collect log data of potential risk IoT device nodes, perform fine-grained risk identification on potential risk IoT device nodes, and obtain log behavior sequences with intrusion risks in potential risk IoT device nodes; S4: Based on the log behavior sequence, perform aggregation correlation analysis on the potential risk IoT device nodes to obtain the abnormal behavior sequence, and perform similarity measurement with the intrusion behavior template to determine whether it is an intrusion behavior.

2. The method for intrusion detection of the Internet of Things based on multi-node status analysis as claimed in claim 1, characterized in that: In the step S1, the flow data of the IoT device node is copied and collected by using the mirror port function of the network switch, including: The flow data of the IoT device node is copied by using the mirror port function of the network switch, and the copied flow data is transmitted to the flow monitoring device node as the IoT device node flow of the IoT device node. The network switch is a hardware device for network communication, which connects the IoT device node and the flow monitoring device node in the IoT network, wherein the IoT device node flow is a sequence of data packets sent or received by the IoT device node within a time window during the network communication process; The IoT device node is a physical device node or a logical device node participating in the IoT network, which can connect to the IoT network and collect data, execute tasks and communicate over the network. The network communication objects include other IoT device nodes and communication devices except the IoT device node itself.

3. The method for intrusion detection of the Internet of Things based on multi-node status analysis as claimed in claim 2, characterized in that: Extract features from IoT device node traffic, including: The extracted features of the IoT device node traffic include communication protocol distribution, data packet sending frequency, data packet receiving frequency, data packet speed jitter value, data packet size range and communication IP address distribution, and the extracted features constitute an IoT device node traffic feature vector corresponding to the IoT device node traffic; The communication protocol distribution is the frequency distribution of the communication protocols used by all data packets sent or received by the IoT device node within the time window, the data packet sending frequency is the number of data packets sent by the IoT device node within the time window, and the data packet receiving frequency is the number of data packets received by the IoT device node within the time window; The data packet speed jitter value includes the sending data packet jitter value and the receiving data packet jitter value; The range of data packet sizes includes the size range of sent data packets and the size range of received data packets; The communication IP address distribution is the frequency distribution of IP addresses of network communication objects of IoT device nodes within the time window.

4. The method for intrusion detection of the Internet of Things based on multi-node status analysis as claimed in claim 3, characterized in that: In the step S2, based on the traffic feature vector of the IoT device nodes, the IoT device nodes with potential intrusion risks are coarsely screened, including: The coarse-grained screening process of IoT device nodes with potential intrusion risks is as follows: Obtaining traffic feature vectors of the IoT device nodes in a recent plurality of consecutive time windows, and forming a traffic feature vector sequence of the IoT device nodes with the traffic feature vectors of the IoT device nodes in the consecutive plurality of time windows; The Transformer model with improved attention mechanism is used to receive the traffic feature vector sequence of IoT device nodes, and output the classification results of the IoT device nodes corresponding to the traffic feature vector sequence, where the classification results of the IoT device nodes include potential risk IoT device nodes and IoT device nodes without potential risks; The network structure of the Transformer model with improved attention mechanism includes an encoding layer, a multi-head attention mechanism layer and a feedforward layer in sequence; The encoding layer is used to perform weighted processing on the traffic feature vectors of the IoT device nodes in the traffic feature vector sequence, and based on the time window position corresponding to the traffic feature vector of the IoT device node, use the sine and cosine functions to generate the position vector of the traffic feature vector of the IoT device node, add the weighted processing result and the position vector as the high-dimensional embedding vector corresponding to the traffic feature vector of the IoT device node, and sort the high-dimensional embedding vector based on the order of the traffic feature vector of the IoT device node in the traffic feature vector sequence to form a high-dimensional embedding vector sequence of the IoT device node; The multi-head attention mechanism layer includes H independent attention heads. Each attention head uses a different weight matrix to perform attention calculation on the high-dimensional embedding vector. In the attention calculation process, the high-dimensional embedding vector sequence is masked using an adaptively adjusted mask function to control the range of attention and generate an attention matrix for the high-dimensional embedding vector sequence. The feedforward layer includes a linear transformation layer, a gated linear unit, and an activation function. The attention matrix of the high-dimensional embedded vector sequence is linearly transformed and linearly projected to obtain the two-dimensional attention features of the high-dimensional embedded vector sequence. The Softmax activation function is used to generate the probability distribution of the two-dimensional attention features in the two classification results, and the distribution result with the highest probability is selected for coarse-grained screening of IoT device nodes.

5. The method for intrusion detection of the Internet of Things based on multi-node status analysis as claimed in claim 1, characterized in that: The log data of the potential risk IoT device nodes collected in step S3 includes: The log data of the potential risk IoT device node includes system log, device status log, security log, application log, data log and event log; The system log includes the restart record of the potential risk IoT device node, whether the network time is successfully synchronized, the CPU usage record, the available memory ratio record and the available storage space ratio record; The device status log includes the current operation mode, power consumption and power interruption records of the potential risk IoT device node, wherein the power consumption is a sequence of power quantity records of the potential risk IoT device node in the most recent consecutive multiple time windows; The security log includes a record of access rights changes of potential risk IoT device nodes, encryption status of sent data packets, and firmware integrity check results; The application log includes a sequence of application execution records of the potential risk IoT device node in a recent plurality of consecutive time windows, wherein the application execution record includes a specific task executed by the potential risk IoT device node and an execution timestamp; The data log includes a data collection record sequence, a data transmission record sequence, and a data reception record sequence of the potential risk IoT device node in the most recent consecutive multiple time windows, wherein the data collection record is the type of data and data content collected by the potential risk IoT device node, the data transmission record is the data content, the IP address of the network communication object, and the transmission timestamp transmitted by the potential risk IoT device node to the network communication object, and the data reception record is the data content, the reception timestamp, and the data packet transmission IP address corresponding to the received data packet received by the potential risk IoT device node; The event log includes internal event records and external event records of potential risk IoT device nodes, wherein internal events are events triggered by potential risk IoT device nodes themselves, including alarm events and abnormal detection events, and external events include network disconnection events and power supply interruption events.

6. The method for intrusion detection of the Internet of Things based on multi-node status analysis as claimed in claim 5, characterized in that: The fine-grained risk identification of potential risk IoT device nodes based on log data is performed to obtain a log behavior sequence of intrusion risks in the potential risk IoT device nodes, including: The fine-grained risk identification process of the potential risk IoT device node is as follows: Extract the timestamp of the log record, sort the log records in the log data according to the timestamp order, and use the BERT model to vectorize the log records to obtain the log record vector; A causal timing window of length Len is set. If the timestamp difference corresponding to the two sets of log record vectors of the potential risk IoT device node is within the length range of the causal timing window, it means that there is causal similarity between the two sets of log record vectors, and the causal similarity between the two sets of log record vectors is calculated. Otherwise, the causal similarity between the two sets of log record vectors is set to 0. The higher the causal similarity, the more likely the log record with a smaller timestamp is to be the cause of the log record with a larger timestamp. Calculate the semantic similarity between the two groups of log record vectors, where the semantic similarity is calculated using cosine similarity; The mutual information between the two groups of log record vectors is calculated, where the mutual information is the amount of information contained in one group of log record vectors in another group of log record vectors. The greater the amount of information, the greater the degree of dependence between the two groups of log record vectors. Perform weighted calculation on the causal similarity, semantic similarity and mutual information of the two sets of log record vectors, and use the weighted calculation result as the state correlation of the two sets of log record vectors, where the sum of the weights of causal similarity, semantic similarity and mutual information is 1; Randomly select a group of log record vectors, calculate the mean and standard deviation of the state correlation between the selected log record vectors and the unselected log record vectors, and calculate the standard deviation / mean, use the calculation result as the variation feature of the log record corresponding to the selected log record vector, and reselect the log record vector until the variation features of all log records are obtained; Select log records whose mutation characteristics are higher than the preset mutation characteristic threshold as log behavior nodes of potential risk IoT device nodes; sort the log behavior nodes according to the timestamp order of abnormal behavior nodes, and use the sorting results as the log behavior sequence of potential risk IoT device nodes.

7. The method for intrusion detection of the Internet of Things based on multi-node status analysis as claimed in claim 6, characterized in that: In the step S4, based on the log behavior sequence, aggregation correlation analysis is performed on the potential risk IoT device nodes to obtain abnormal behavior sequences across IoT device nodes, including: Obtain the log behavior sequences of all potential risk IoT device nodes, take the log behavior nodes with IP addresses in the log behavior sequence as key items, and take the log behavior nodes without IP addresses in the log behavior sequence as common items; Calculate the support of the IP address in the key item among all potential risk IoT device nodes; Select an IP address whose support is higher than a preset first support threshold and a key item containing the IP address, use the selected key item as the main key item, and use the selected main key item and other key items or common items other than the selected main key item to form an item set, calculate the support of the item set in all potential risk IoT device nodes, and calculate the confidence of the item set; Filtering itemsets whose support is lower than a preset support threshold and whose confidence is lower than a preset confidence threshold; The reserved item set of the IP address is counted, and the reserved item set of the IP address is constructed as an abnormal behavior sequence of the IP address.

8. The method for intrusion detection of the Internet of Things based on multi-node status analysis as claimed in claim 7, characterized in that: The similarity measurement of the abnormal behavior sequence of the IP address and the intrusion behavior template includes: If the similarity measurement result is higher than the preset similarity threshold, it means that the IP address has intruded into the IoT network and an alarm is triggered.

Images