Network security intelligent monitoring method of Internet of Things equipment and related device

Abstract

The invention discloses a network security intelligent monitoring method for Internet of Things equipment and a related device, and relates to the technical field of network security, and the method comprises the steps: carrying out the feature screening and integration of initial traffic feature data generated by the traffic data of the Internet of Things equipment based on correlation feature selection, and obtaining target traffic feature data; performing protection capability evaluation of a traffic abnormal state based on attack path influence analysis to construct a traffic security baseline; performing traffic anomaly detection by using the target traffic feature data based on the traffic security baseline; determining a focus time window and an abnormal access behavior sequence based on the historical access behavior information of the user; performing access behavior anomaly detection on the user behavior monitoring information based on access behavior distribution and an abnormal access behavior sequence generated by the focus time window; and judging whether to send out early warning information based on the traffic anomaly detection result and the access behavior anomaly detection result. According to the invention, the reliability of network security monitoring of the Internet of Things equipment can be more effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security intelligent monitoring method and related devices for Internet of Things devices. Background Art

[0002] With the development of information technology, more and more IoT devices are connected to the network. Once an IoT device is maliciously attacked, it will also cause security problems for other IoT devices. Therefore, network security monitoring of IoT devices has become a top priority. Network traffic anomaly detection is a very important part of security monitoring. Network traffic anomaly detection requires the extraction of traffic feature data first. At present, traffic features are usually extracted by a fixed threshold method, but this method will cause the loss of important features, thereby reducing the accuracy of traffic anomaly detection. Network traffic anomaly detection is usually achieved by comparing traffic features with traffic security baselines. However, the construction of traffic security baselines currently does not take into account the protection capabilities of IoT devices in traffic anomaly states, making the constructed traffic security baselines insufficiently reliable, resulting in large errors in traffic anomaly detection results. At the same time, in the current network security monitoring of IoT devices, the anomaly detection of user access behavior is usually achieved by keyword matching of network logs, but this method will cause a high false positive rate, resulting in the inability to accurately monitor the actual network security status of IoT devices. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art. The present invention provides a network security intelligent monitoring method and related devices for Internet of Things devices, which can more accurately detect abnormal conditions existing in Internet of Things devices, so that emergency response strategies can be initiated in time to ensure the network security of Internet of Things devices.

[0004] In order to solve the above technical problems, the present invention provides a network security intelligent monitoring method for an Internet of Things device, the method comprising: Based on the correlation feature selection, the preliminary traffic feature data generated by the traffic data of the IoT devices is screened and integrated to obtain the target traffic feature data; Based on the attack path impact analysis, the protection capability of IoT devices against abnormal traffic status is evaluated, and the protection capability evaluation results are obtained. Based on the protection capability evaluation results, a traffic security baseline is constructed; Based on the traffic safety baseline, the target traffic characteristic data is used to perform traffic anomaly detection to obtain a traffic anomaly detection result; Determine the focus time window and abnormal access behavior sequence based on the user's historical access behavior information of IoT devices; Based on the access behavior distribution and abnormal access behavior sequence generated by the focus time window, the user behavior monitoring information is subjected to access behavior anomaly detection to obtain access behavior anomaly detection results; Based on the traffic anomaly detection result and the access behavior anomaly detection result, it is determined whether an emergency response strategy needs to be initiated.

[0005] Optionally, the step of performing feature screening and integration on the preliminary traffic feature data generated by the traffic data of the IoT device based on correlation feature selection to obtain target traffic feature data includes: Perform preliminary feature extraction on IoT device traffic data based on the attention mechanism to obtain preliminary traffic feature data; Calculate the feature correlation of the feature attribute set for the preliminary traffic feature data, and remove redundancy of the feature attribute set based on the feature correlation to obtain the target feature attribute set; Calculating the correlation coefficient between the target feature attribute set and the category feature set in the preliminary traffic feature data, and selecting the first feature sequence set based on the correlation coefficient; The mutual information between the target feature attribute set and the category feature set is calculated, the second feature sequence set is screened based on the mutual information, and feature integration is performed based on the first feature sequence set and the second feature sequence set to obtain target traffic feature data.

[0006] Optionally, the protection capability evaluation of the IoT device against abnormal traffic status based on the attack path impact analysis to obtain the protection capability evaluation result includes: Perform attack path analysis based on vulnerability information obtained from IoT devices in past traffic anomalies, obtain several corresponding attack paths, and calculate the impact value of the attack path based on the fuzzy evaluation matrix; Extract features of the defense mechanisms used by each attack path to obtain defense mechanism feature information; The defense success rate is calculated based on the characteristic information of the defense mechanism using resource dependency analysis, and the attack path utilization value is calculated based on the impact value of the attack path combined with the attack path probability value; Based on the attack path utilization value and the defense success rate, a protection capability evaluation of the abnormal traffic state is performed to obtain a protection capability evaluation result.

[0007] Optionally, the building of a traffic security baseline based on the protection capability assessment result includes: Determine the baseline range based on the periodic distribution law of historical traffic data, and perform fluctuation statistics on historical traffic data to obtain the normal fluctuation range of traffic; The upper and lower flow tolerances are determined based on the protection capability assessment results, and a flow security baseline is constructed based on the baseline range, the normal flow fluctuation range, and the upper and lower flow tolerances.

[0008] Optionally, performing traffic anomaly detection based on the traffic security baseline using the target traffic characteristic data to obtain a traffic anomaly detection result includes: The target traffic characteristic data is compared with each parameter in the traffic security baseline to obtain a comparison result, and traffic anomaly detection is performed based on the comparison result to obtain a traffic anomaly detection result.

[0009] Optionally, the determining of the focus time window and abnormal access behavior sequence based on the user historical access behavior information of the IoT device includes: Determine the number of historical access behaviors of the user's historical access behavior information in each preset time end window, and use the preset time end window corresponding to the number of historical access behaviors greater than or equal to the preset number threshold as the focus time window; Based on a clustering algorithm, several behavior sequences generated by the user's historical access behavior information are classified to obtain several behavior sequence classes; Calculate the correlation coefficient between each user's access behavior based on several behavior sequence classes; The abnormal access behavior sequence is determined based on the correlation coefficient and the output probability of each behavior sequence class.

[0010] Optionally, performing access behavior anomaly detection on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window to obtain the access behavior anomaly detection result includes: Perform distribution statistics on historical access behavior information in the focus time window to obtain access behavior distribution; constructing an access behavior line based on the access behavior distribution, and performing access behavior anomaly detection on the user behavior monitoring information based on the access behavior line to obtain a first preliminary access behavior anomaly detection result; Matching the user behavior monitoring information with the abnormal access behavior sequence to obtain a matching result, and determining a second preliminary access behavior abnormality monitoring result based on the matching result; The first preliminary access behavior anomaly detection result and the second preliminary access behavior anomaly detection result are deduplicated and redundancy-removed to obtain an access behavior anomaly detection result.

[0011] In addition, the present invention also provides a network security intelligent monitoring device for an Internet of Things device, the device comprising: Traffic feature extraction module: used to perform feature screening and integration on the preliminary traffic feature data generated by the traffic data of IoT devices based on correlation feature selection to obtain target traffic feature data; Traffic baseline construction module: used to evaluate the protection capability of IoT devices against abnormal traffic status based on attack path impact analysis, obtain protection capability evaluation results, and build a traffic security baseline based on the protection capability evaluation results; A flow anomaly detection module: used to perform flow anomaly detection based on the flow security baseline using the target flow characteristic data to obtain a flow anomaly detection result; Time window and behavior sequence determination module: used to determine the focus time window and abnormal access behavior sequence based on the user's historical access behavior information of the IoT device; Access behavior anomaly detection module: used to perform access behavior anomaly detection on user behavior monitoring information based on the access behavior distribution and abnormal access behavior sequence generated by the focus time window, and obtain access behavior anomaly detection results; Emergency response judgment module: used to judge whether it is necessary to initiate an emergency response strategy based on the traffic anomaly detection result and the access behavior anomaly detection result.

[0012] In addition, the present invention also provides an electronic device, which includes a processor and a memory, wherein the memory is used to store instructions, and the processor is used to call the instructions in the memory so that the electronic device executes the above-mentioned network security intelligent monitoring method for Internet of Things devices.

[0013] In addition, the present invention also provides a computer-readable storage medium, which stores computer instructions. When the computer instructions are executed on an electronic device, the electronic device executes the above-mentioned network security intelligent monitoring method for Internet of Things devices.

[0014] In an embodiment of the present invention, the preliminary traffic feature data generated by the traffic data of the IoT device is screened and integrated based on the correlation feature selection, which can avoid the loss of important features and ensure the accuracy of feature extraction while eliminating redundant features. Based on the attack path impact analysis, the protection capability of the IoT device in the abnormal traffic state is evaluated, and the protection capability of the IoT device when it is in the abnormal traffic state can be accurately evaluated. The traffic security baseline is constructed based on the protection capability evaluation result, so that the constructed traffic security baseline is more reliable. The traffic anomaly detection is performed through the traffic security baseline, which can greatly reduce the error of traffic anomaly detection. Based on the user historical access behavior information of the IoT device, the focus time window and the abnormal access behavior sequence are determined, and the access behavior anomaly detection is performed on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window, which can improve the accuracy of access behavior anomaly detection and avoid the occurrence of missed detection and false detection. It can accurately monitor the actual network security status of the IoT device. When an abnormal situation is detected, the emergency response strategy can be initiated in time to ensure the network security of the IoT device. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 It is a flowchart of a network security intelligent monitoring method for an Internet of Things device in an embodiment of the present invention; Figure 2 is a flow chart of a method for intelligent network security monitoring of an Internet of Things device in another embodiment of the present invention; Figure 3 It is a schematic diagram of the structure of the network security intelligent monitoring device for Internet of Things devices in an embodiment of the present invention; Figure 4 It is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] Embodiment 1 See also Figure 1 , Figure 1 : is a flow chart of a network security intelligent monitoring method for an Internet of Things device in an embodiment of the present invention, the method comprising: S11: performing feature screening and integration on preliminary traffic feature data generated by the traffic data of IoT devices based on correlation feature selection to obtain target traffic feature data; In the specific implementation process of the present invention, the preliminary traffic feature data generated by the traffic data of the Internet of Things device is screened and integrated based on the correlation feature selection to obtain the target traffic feature data, including: performing preliminary feature extraction on the traffic data of the Internet of Things device based on the attention mechanism to obtain the preliminary traffic feature data; calculating the feature correlation of the feature attribute set for the preliminary traffic feature data, and removing the redundancy of the feature attribute set based on the feature correlation to obtain the target feature attribute set; calculating the correlation coefficient between the target feature attribute set and the category feature set in the preliminary traffic feature data, and screening the first feature sequence set based on the correlation coefficient; calculating the mutual information between the target feature attribute set and the category feature set, screening the second feature sequence set based on the mutual information, and performing feature integration based on the first feature sequence set and the second feature sequence set to obtain the target traffic feature data.

[0019] Specifically, the traffic data of IoT devices is obtained, and the traffic data of IoT devices includes source IP packet data, message duration, interval and flow duration, etc., and preliminary feature extraction is performed on the traffic data of IoT devices based on the attention mechanism. Normal network traffic sample data under normal conditions and abnormal network traffic sample data under abnormal network conditions are used as total traffic sample data, and feature extraction is performed on each traffic sample data in the total traffic sample data to obtain a feature vector corresponding to each traffic sample data, and a corresponding weight is assigned to each feature vector. According to the feature vector and its corresponding weight, a bidirectional long short-term memory network using an attention mechanism is trained, and the traffic data of IoT devices is input into the trained bidirectional long short-term memory network for feature extraction to obtain preliminary traffic feature data, including category features and attribute features. The feature correlation of the feature attribute set is calculated for the preliminary traffic feature data. The feature attributes in the feature attribute set may include but are not limited to the number of source IP packets, the number of source ports, etc. Information entropy is used as a metric for feature correlation, that is, the feature correlation between the feature attributes in the feature attribute set and the corresponding traffic categories is calculated by information entropy. The traffic categories include normal traffic, abnormal traffic, video streaming traffic, etc., and the feature attribute set is redundancy removed based on the feature correlation, the first standard deviation of the feature correlation between the feature attributes and the corresponding traffic categories is calculated, and the feature correlation between the first feature attribute and the second feature attribute in the feature attribute set is calculated, where the first feature attribute is the feature attribute adopted by the first standard deviation, and the second feature attribute is the feature attribute except the first feature attribute. Randomly select out of the attributes, calculate the second standard deviation according to the feature correlation between the feature attributes, determine whether the feature correlation between the feature attribute and the corresponding traffic category is greater than or equal to the first standard deviation, determine whether the feature correlation between the first feature attribute and the second feature attribute between the feature attribute sets is greater than or equal to the second standard deviation, if the feature correlation between the feature attribute and the corresponding traffic category is greater than or equal to the first standard deviation and the feature correlation between the first feature attribute and the second feature attribute between the feature attribute sets is greater than or equal to the second standard deviation, then the first feature attribute is a redundant feature, the redundant features are removed, and the target feature attribute set is obtained, thereby reducing the complexity and computational overhead of traffic detection, and reducing the impact of redundant data on network traffic detection. In order to further reduce the consumption of time and space resources for subsequent data processing, it is necessary to screen and integrate the feature data to a certain extent, calculate the correlation coefficient between the target feature attribute set and the category feature set in the preliminary traffic feature data, that is, calculate the correlation coefficient between each feature attribute in the target feature attribute set and each category feature in the category feature set, and screen the first feature sequence set based on the correlation coefficient, that is, sort the traffic feature data in the preliminary traffic feature data from large to small according to the correlation coefficient, and divide them into three feature data subsets, namely the priority feature data subset and the useful feature data subset, to obtain the final first feature sequence set.Calculate the mutual information of the target feature attribute set and the category feature set, and screen the second feature sequence set based on the mutual information, that is, sort the traffic feature data in the preliminary traffic feature data from large to small according to the mutual information, and divide them into priority feature data subsets and useful feature data subsets to obtain the final second feature sequence set, and perform feature integration based on the first feature sequence set and the second feature sequence set, perform union processing on the priority feature data subset in the first feature sequence set and the priority feature data subset in the second feature sequence set to obtain a priority feature data set, perform intersection processing on the useful feature data subset in the first feature sequence set and the useful feature data subset in the second feature sequence set to obtain a useful feature data set, perform union processing on the priority feature data set and the useful feature data set to obtain the target traffic feature data, so that the obtained traffic feature data is more accurate, and reliable extraction of important features is guaranteed while eliminating redundant features.

[0020] S12: Evaluate the protection capability of IoT devices against abnormal traffic status based on attack path impact analysis, obtain protection capability evaluation results, and build a traffic security baseline based on the protection capability evaluation results; In the specific implementation process of the present invention, the protection capability of the Internet of Things device in the abnormal traffic state is evaluated based on the attack path impact analysis to obtain the protection capability evaluation result, including: performing attack path analysis based on the vulnerability information obtained by the Internet of Things device in the past abnormal traffic state to obtain a corresponding number of attack paths, and calculating the impact value of the attack path based on the fuzzy evaluation matrix; extracting features of the defense mechanism adopted by each attack path to obtain defense mechanism feature information; calculating the defense success rate based on the defense mechanism feature information using resource dependency analysis, and calculating the attack path utilization value based on the impact value of the attack path combined with the attack path probability value; performing protection capability evaluation for the abnormal traffic state based on the attack path utilization value and the defense success rate to obtain the protection capability evaluation result.

[0021] Furthermore, the construction of a traffic security baseline based on the protection capability assessment results includes: determining a baseline range based on the periodic distribution pattern of historical traffic data, and performing fluctuation statistics on the historical traffic data to obtain a normal traffic fluctuation range; determining upper and lower traffic tolerances based on the protection capability assessment results, and constructing a traffic security baseline based on the baseline range, the normal traffic fluctuation range, and the upper and lower traffic tolerances.

[0022] Specifically, an attack path analysis is performed based on vulnerability information obtained from IoT devices in past traffic anomalies. Vulnerability information includes vulnerability categories, vulnerability severity metrics of common vulnerability scoring systems, vulnerability reachability, and vulnerability impact range. A vulnerability exploitation graph is constructed based on network topology information and vulnerability information of IoT devices in combination with corresponding open source tools. The nodes in the graph are vulnerabilities, and the edges are dependency relationships of vulnerabilities. It is a directed graph. The vulnerability exploitation graph defines the vulnerabilities existing in the device and their mutual influence relationships. If the second vulnerability is to be exploited, the first vulnerability must be exploited first. A graph algorithm is used to analyze the nodes, edges, and paths in the vulnerability exploitation graph to obtain a number of corresponding attack paths, and the impact value of the attack path is calculated based on the fuzzy evaluation matrix. Taking the attack path as the evaluation object, a corresponding evaluation factor set is established, including vulnerability type, operating system version, asset importance, and user authority, and weights are assigned to each evaluation factor. The weights are set by experts based on the threat score of each factor to the device, and a weighted fuzzy set is obtained. A fuzzy evaluation matrix is ​​constructed through the fuzzy weight set, and the impact value of each attack path is calculated through the fuzzy evaluation matrix. Feature extraction is performed on the defense mechanisms used in each attack path. The defense mechanisms include firewalls, endpoint security policies, and intrusion detection systems. The feature information of the defense mechanisms includes the configuration parameters of the defense mechanisms, the actual operating status, the execution effect of the protection policies, etc., to obtain the feature information of the defense mechanisms. The defense success rate is calculated based on the characteristic information of the defense mechanism using the resource dependency analysis, and the network resource map of the Internet of Things device is obtained. The network resource map represents the dependency between the use of the defense mechanism and the network resources that need to be scheduled. The characteristic information of the defense mechanism and the resource dependency generated by the network resource map are input into the simulation software. When scheduling the corresponding network resources, the possibility of intrusion by exploiting the vulnerability during resource scheduling is analyzed according to the characteristic information of the defense mechanism and the network resource map. According to each attack path and the corresponding characteristic information of the defense mechanism combined with the possibility of intrusion, attack simulation and network defense simulation are performed in the simulation software. The security indicators such as the number of rejected attacks and the response time of security incidents in the simulation process are analyzed. The parameter value of the indicator is compared with the preset safety factor. If it is greater than the preset safety factor, the defense is successful. The defense success rate is calculated through multiple simulations, and the attack path utilization value is calculated based on the impact value of the attack path combined with the attack path probability value, that is, the possibility of attacking by using each attack path is calculated according to the impact value of the attack path and the attack path probability value combined with the corresponding weight. Based on the attack path utilization value and the defense success rate, a protection capability evaluation is performed for the abnormal traffic state. The protection capability level of the IoT device facing network attacks in the abnormal traffic state is matched according to the attack path utilization value and the defense success rate, so as to obtain a protection capability evaluation result.The baseline range is determined based on the periodic distribution law of historical traffic data. Historical traffic data is non-abnormal network traffic data. The periodic distribution law of historical traffic data is analyzed according to the preset periodic detection algorithm, such as the distribution of flow duration and message interval in the same hour of each day. The upper and lower bounds of each parameter of the baseline are divided according to its periodic distribution law, and the fluctuation statistics of the historical traffic data are performed, that is, the normal fluctuation range of the traffic is obtained according to the fluctuation range of each parameter in the historical traffic data. The upper and lower limit tolerance of the traffic is determined based on the protection capability evaluation results, and the corresponding upper and lower limit tolerance of the traffic is matched according to the protection capability level of the IoT device facing network attacks under abnormal traffic conditions. A traffic security baseline is constructed based on the baseline range, the normal fluctuation range of the traffic, and the upper and lower limit tolerance of the traffic. The adjustment coefficients of the ranges of each parameter of the baseline are determined according to the normal fluctuation range of the traffic and the upper and lower limit tolerance of the traffic, thereby constructing a traffic security baseline, so that the constructed traffic security baseline is more in line with the actual situation of the IoT device, and avoids the issuance of unnecessary warning information when the IoT device's own defense mechanism is sufficient to cope with the ordinary traffic exceeding the threshold state.

[0023] S13: Performing flow anomaly detection using the target flow characteristic data based on the flow security baseline to obtain a flow anomaly detection result; In the specific implementation process of the present invention, the flow anomaly detection is performed based on the flow security baseline using the target flow characteristic data to obtain the flow anomaly detection result, including: comparing the target flow characteristic data with each parameter in the flow security baseline to obtain a comparison result, and performing flow anomaly detection based on the comparison result to obtain the flow anomaly detection result.

[0024] Specifically, the target traffic characteristic data is compared with each parameter in the traffic security baseline to obtain a comparison result, and traffic anomaly detection is performed based on the comparison result, that is, whether each characteristic data in the target traffic characteristic data exceeds the range boundary value of each parameter in the traffic security baseline. If it exceeds the range boundary value of each parameter in the traffic security baseline, then the target traffic characteristic data is abnormal traffic, and the defense mechanism of the Internet of Things device itself can no longer handle the situation, and the Internet of Things device has abnormal traffic. If it exceeds the range boundary value, the traffic data is within the normal range or the defense mechanism of the Internet of Things device itself can cope with the situation, that is, the traffic anomaly detection result is obtained.

[0025] S14: Determine the focus time window and abnormal access behavior sequence based on the user's historical access behavior information of the IoT device; In the specific implementation process of the present invention, the focus time window and abnormal access behavior sequence are determined based on the user's historical access behavior information of the Internet of Things device, including: determining the number of historical access behaviors of the user's historical access behavior information in each preset time end window, and taking the preset time end window corresponding to the number of historical access behaviors greater than or equal to the preset number threshold as the focus time window; classifying several behavior sequences generated by the user's historical access behavior information based on a clustering algorithm to obtain several behavior sequence classes; calculating the correlation coefficient between each user's access behavior based on several behavior sequence classes; and determining the abnormal access behavior sequence based on the correlation coefficient combined with the output probability of each behavior sequence class.

[0026] Specifically, determine the number of historical access behaviors of the user's historical access behavior information in each preset time end window, that is, count the number of different access behaviors in each preset time end window. The user's historical access information includes different access behaviors of each user in each time period. The preset time end window corresponding to the number of historical access behaviors greater than or equal to the preset number threshold is used as the focus time window, that is, if there is a number of historical access behaviors greater than or equal to the preset number threshold in the preset time end window, then the preset time end window is the focus time window, and the focus time window indicates that the user's access behavior in this time period is relatively frequent. Based on the clustering algorithm, several behavior sequences generated by the user's historical access behavior information are classified. The behavior sequence is a sequence rule for user access, such as posting a message, and its behavior sequence is login page-posting page-posting a message. The clustering algorithm uses a hidden Markov model to calculate the output probability function according to the hidden Markov model of each behavior sequence, and judge whether the function value meets the convergence condition. If the convergence condition is met, the iteration is terminated to obtain several behavior sequence classes. Based on several behavior sequence classes, the correlation coefficient between each user's access behavior is calculated. The behavior similarity between each user in the preset time window can be calculated by the length of each user's behavior sequence. The correlation coefficient between users' access behaviors is calculated based on the behavior similarity. The correlation coefficient between users can describe the similarity of users' behavior relationships. The abnormal access behavior sequence is determined based on the correlation coefficient combined with the output probability of each behavior sequence class, and the correlation coefficient variance and the correlation coefficient average are calculated according to the correlation coefficient between each user. The correlation coefficient average minus the correlation coefficient variance is taken as one endpoint of the interval, and the correlation coefficient average plus the correlation coefficient variance is taken as the other endpoint of the interval to form a judgment interval. The user combination whose correlation coefficient does not reach the judgment interval is taken as the abnormal user combination, and the behavior sequence class corresponding to the abnormal user combination is taken as the first initial abnormal access behavior sequence. The behavior sequence class with an output probability less than a preset probability threshold is taken as the second initial abnormal access behavior sequence. Since the access behavior of most users is normal access behavior, the output probability less than the preset probability threshold indicates that the access behavior is abnormal. The repeated access behavior sequences in the first initial abnormal access behavior sequence and the second initial abnormal access behavior sequence are deleted to form an abnormal access behavior sequence, so that the obtained abnormal access behavior sequence is more comprehensive and avoids the limitations of single abnormal access behavior analysis.

[0027] S15: performing access behavior anomaly detection on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window to obtain an access behavior anomaly detection result; In the specific implementation process of the present invention, the access behavior anomaly detection is performed on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window to obtain the access behavior anomaly detection result, including: feature screening of the historical access behavior information in the focus time window to obtain access behavior feature information, and distribution statistics based on the access behavior feature information to obtain the access behavior distribution; constructing an access behavior line based on the access behavior distribution, and performing access behavior anomaly detection on the user behavior monitoring information based on the access behavior line to obtain a first preliminary access behavior anomaly detection result; matching the user behavior monitoring information with the abnormal access behavior sequence to obtain a matching result, and determining a second preliminary access behavior anomaly monitoring result based on the matching result; and removing duplicate redundancy from the first preliminary access behavior anomaly detection result and the second preliminary access behavior anomaly detection result to obtain an access behavior anomaly detection result.

[0028] Specifically, the historical access behavior information in the focus time window is distributed and counted, that is, the frequency distribution of each historical access behavior in the focus time window is counted, such as the frequency distribution of successful network logins in the focus time window, etc., to obtain the access behavior distribution. An access behavior line is constructed based on the access behavior distribution, and a target entropy value is calculated based on the statistical access behavior distribution. The access behavior line is constructed based on the target entropy value. The user behavior monitoring information is subjected to access behavior anomaly detection based on the access behavior line. According to the access behavior line, it is determined whether there is an access behavior frequency in the user behavior monitoring information that exceeds the access behavior line, such as whether the frequency of the user connecting to the Internet of Things device exceeds the device connection frequency in the access behavior line. If it exceeds the access behavior line, it is determined that the user has one or more access behaviors that are abnormal. If it does not exceed the access behavior line, it indicates that the user's access behavior is still normal, that is, the first preliminary access behavior anomaly detection result is obtained. Match the user behavior monitoring information with the abnormal access behavior sequence, match the user behavior sequence in the user behavior monitoring information with the abnormal access behavior sequence to see if there is abnormal access behavior, obtain a matching result, and determine the second preliminary access behavior abnormal monitoring result based on the matching result. If the user behavior is constantly registering pages and constantly logging into the device to modify information, then it is determined that the user access behavior is abnormal. If the user behavior monitoring information does not match the access behavior in the abnormal access behavior sequence, it indicates that there is no abnormality in the current access behavior. Remove duplicate redundancy from the first preliminary access behavior abnormality detection result and the second preliminary access behavior abnormality detection result. If either of the first preliminary access behavior abnormality detection result and the second preliminary access behavior abnormality detection result detects an abnormality, it is regarded as an access abnormality. If neither detects an abnormality, it is a normal access situation. When both detect an access behavior abnormality, delete the same abnormal access behavior detected in both to obtain an access behavior abnormality detection result.

[0029] S16: Determine whether an emergency response strategy needs to be initiated based on the traffic anomaly detection result and the access behavior anomaly detection result.

[0030] During the specific implementation of the present invention, when traffic anomalies and / or abnormal access behavior are detected, an emergency response strategy is initiated based on the corresponding detection results. For example, if traffic anomalies are detected, the intrusion prevention system deployed at the external zone boundary is activated to perform operations such as abnormal traffic blocking and malicious code removal. When abnormal access behavior is detected, the access security management center is activated to block the access user's behavior and disconnect access rights, thereby ensuring the network security of the Internet of Things devices.

[0031] In an embodiment of the present invention, the preliminary traffic feature data generated by the traffic data of the IoT device is screened and integrated based on the correlation feature selection, which can avoid the loss of important features and ensure the accuracy of feature extraction while eliminating redundant features. Based on the attack path impact analysis, the protection capability of the IoT device in the abnormal traffic state is evaluated, and the protection capability of the IoT device when it is in the abnormal traffic state can be accurately evaluated. The traffic security baseline is constructed based on the protection capability evaluation result, so that the constructed traffic security baseline is more reliable. The traffic anomaly detection is performed through the traffic security baseline, which can greatly reduce the error of traffic anomaly detection. Based on the user historical access behavior information of the IoT device, the focus time window and the abnormal access behavior sequence are determined, and the access behavior anomaly detection is performed on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window, which can improve the accuracy of access behavior anomaly detection and avoid the occurrence of missed detection and false detection. It can accurately monitor the actual network security status of the IoT device. When an abnormal situation is detected, the emergency response strategy can be initiated in time to ensure the network security of the IoT device.

[0032] Embodiment 2 See also Figure 2 , Figure 2 : is a flow chart of a network security intelligent monitoring method for an Internet of Things device in another embodiment of the present invention, the method comprising: S201: performing feature screening and integration on preliminary traffic feature data generated by traffic data of IoT devices based on correlation feature selection to obtain target traffic feature data; S202: Perform attack path analysis based on vulnerability information obtained by the IoT device in past traffic abnormality states, obtain a number of corresponding attack paths, and calculate impact values ​​of the attack paths based on a fuzzy evaluation matrix; S203: extracting features of the defense mechanisms used by each attack path to obtain defense mechanism feature information; S204: Calculate the defense success rate by analyzing the resource dependency based on the defense mechanism feature information, and calculate the attack path utilization value based on the attack path impact value combined with the attack path probability value; S205: performing a protection capability assessment of the abnormal traffic state based on the attack path utilization value and the defense success rate, obtaining a protection capability assessment result, and constructing a traffic security baseline based on the protection capability assessment result; S206: Performing flow anomaly detection based on the flow security baseline and using the target flow characteristic data to obtain a flow anomaly detection result; S207: Determine a focus time window and an abnormal access behavior sequence based on historical access behavior information of users of IoT devices; S208: performing access behavior anomaly detection on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window to obtain an access behavior anomaly detection result; S209: Determine whether an emergency response strategy needs to be initiated based on the traffic anomaly detection result and the access behavior anomaly detection result.

[0033] In an embodiment of the present invention, the preliminary traffic feature data generated by the traffic data of the IoT device is screened and integrated based on the correlation feature selection, which can avoid the loss of important features and ensure the accuracy of feature extraction while eliminating redundant features. Based on the attack path impact analysis, the protection capability of the IoT device in the abnormal traffic state is evaluated, and the protection capability of the IoT device when it is in the abnormal traffic state can be accurately evaluated. The traffic security baseline is constructed based on the protection capability evaluation result, so that the constructed traffic security baseline is more reliable. The traffic anomaly detection is performed through the traffic security baseline, which can greatly reduce the error of traffic anomaly detection. Based on the user historical access behavior information of the IoT device, the focus time window and the abnormal access behavior sequence are determined, and the access behavior anomaly detection is performed on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window, which can improve the accuracy of access behavior anomaly detection and avoid the occurrence of missed detection and false detection. It can accurately monitor the actual network security status of the IoT device. When an abnormal situation is detected, the emergency response strategy can be initiated in time to ensure the network security of the IoT device.

[0034] Embodiment 3 See also Figure 3 , Figure 3 : is a schematic diagram of the structure of a network security intelligent monitoring device for an Internet of Things device in an embodiment of the present invention, the device comprises: Traffic feature extraction module 31: used to perform feature screening and integration on the preliminary traffic feature data generated by the traffic data of the IoT device based on correlation feature selection to obtain target traffic feature data; Traffic baseline construction module 32: used to evaluate the protection capability of the IoT device against traffic anomaly based on the attack path impact analysis, obtain the protection capability evaluation result, and construct a traffic security baseline based on the protection capability evaluation result; Traffic anomaly detection module 33: used to perform traffic anomaly detection based on the traffic safety baseline using the target traffic characteristic data to obtain a traffic anomaly detection result; A time window and behavior sequence determination module 34 is used to determine a focus time window and an abnormal access behavior sequence based on historical access behavior information of users of IoT devices; The access behavior anomaly detection module 35 is used to perform access behavior anomaly detection on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window, and obtain the access behavior anomaly detection result; The emergency response judgment module 36 is used to judge whether it is necessary to start an emergency response strategy based on the abnormal traffic detection result and the abnormal access behavior detection result.

[0035] In the specific implementation process of the present invention, the specific implementation method of the device item can refer to the implementation method of the above-mentioned method item, which will not be repeated here.

[0036] In an embodiment of the present invention, the preliminary traffic feature data generated by the traffic data of the IoT device is screened and integrated based on the correlation feature selection, which can avoid the loss of important features and ensure the accuracy of feature extraction while eliminating redundant features. Based on the attack path impact analysis, the protection capability of the IoT device in the abnormal traffic state is evaluated, and the protection capability of the IoT device when it is in the abnormal traffic state can be accurately evaluated. The traffic security baseline is constructed based on the protection capability evaluation result, so that the constructed traffic security baseline is more reliable. The traffic anomaly detection is performed through the traffic security baseline, which can greatly reduce the error of traffic anomaly detection. Based on the user historical access behavior information of the IoT device, the focus time window and the abnormal access behavior sequence are determined, and the access behavior anomaly detection is performed on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window, which can improve the accuracy of access behavior anomaly detection and avoid the occurrence of missed detection and false detection. It can accurately monitor the actual network security status of the IoT device. When an abnormal situation is detected, the emergency response strategy can be initiated in time to ensure the network security of the IoT device.

[0037] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the network security intelligent monitoring method of the Internet of Things device of any one of the above embodiments is implemented. The computer-readable storage medium includes but is not limited to any type of disk (including floppy disk, hard disk, optical disk, CD-ROM, and magneto-optical disk), ROM (Read-Only Memory), RAM (Random Access Memory), EPROM (Erasable Programmable Read-Only Memory), EEPROM (Electrically Erasable Programmable Read-Only Memory), flash memory, magnetic card or optical card. That is, the storage device includes any medium that can store or transmit information in a readable form by a device (for example, a computer, a mobile phone), which can be a read-only memory, a disk or an optical disk, etc.

[0038] Embodiment 4 See also Figure 4 , Figure 4 It is a schematic diagram of the structure of an electronic device in an embodiment of the present invention.

[0039] The embodiment of the present invention further provides an electronic device, such as Figure 4 As shown, the electronic device includes a memory 41, a processor 43, and a computer program 42 stored in the memory 41 and executable on the processor 43. Those skilled in the art will appreciate that Figure 3The electronic device shown does not constitute a limitation on all devices, and may include more or fewer components than shown, or combine certain components. The memory 41 can be used to store the computer program 42 and various functional modules, and the processor 43 runs the computer program 42 stored in the memory 41, thereby executing various functional applications and data processing of the device. The memory can be an internal memory or an external memory, or include both internal and external memories. The internal memory can include a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, or a random access memory. The external memory can include a hard disk, a floppy disk, a ZIP disk, a U disk, a magnetic tape, etc. The processor 43 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general processor may be a microprocessor, a single chip microcomputer or the processor 43 may also be any conventional processor, etc. The processor and memory disclosed in the present invention include but are not limited to these types of processors and memories. The processor and memory disclosed in the present invention are only examples and not limitations.

[0040] As an embodiment, the electronic device includes: one or more processors 43, a memory 41, and one or more computer programs 42, wherein the one or more computer programs 42 are stored in the memory 41 and are configured to be executed by the one or more processors 43, and the one or more computer programs 42 are configured to execute the network security intelligent monitoring method for the Internet of Things device in any of the above-mentioned embodiments. For the specific implementation process, please refer to the above-mentioned embodiments and will not be repeated here.

[0041] In an embodiment of the present invention, the preliminary traffic feature data generated by the traffic data of the IoT device is screened and integrated based on the correlation feature selection, which can avoid the loss of important features and ensure the accuracy of feature extraction while eliminating redundant features. Based on the attack path impact analysis, the protection capability of the IoT device in the abnormal traffic state is evaluated, and the protection capability of the IoT device when it is in the abnormal traffic state can be accurately evaluated. The traffic security baseline is constructed based on the protection capability evaluation result, so that the constructed traffic security baseline is more reliable. The traffic anomaly detection is performed through the traffic security baseline, which can greatly reduce the error of traffic anomaly detection. Based on the user historical access behavior information of the IoT device, the focus time window and the abnormal access behavior sequence are determined, and the access behavior anomaly detection is performed on the user behavior monitoring information based on the access behavior distribution and the abnormal access behavior sequence generated by the focus time window, which can improve the accuracy of access behavior anomaly detection and avoid the occurrence of missed detection and false detection. It can accurately monitor the actual network security status of the IoT device. When an abnormal situation is detected, the emergency response strategy can be initiated in time to ensure the network security of the IoT device.

[0042] In addition, the above is a detailed introduction to a network security intelligent monitoring method and related devices for an Internet of Things device provided by an embodiment of the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for a person skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A network security intelligent monitoring method for Internet of Things devices, characterized in that: The method comprises: Based on the correlation feature selection, the preliminary traffic feature data generated by the traffic data of the IoT devices is screened and integrated to obtain the target traffic feature data; Based on the attack path impact analysis, the protection capability of IoT devices against abnormal traffic status is evaluated, and the protection capability evaluation results are obtained. Based on the protection capability evaluation results, a traffic security baseline is constructed; Based on the traffic security baseline, the target traffic characteristic data is used to perform traffic anomaly detection to obtain a traffic anomaly detection result; Determine the focus time window and abnormal access behavior sequence based on the user's historical access behavior information of IoT devices; Based on the access behavior distribution and abnormal access behavior sequence generated by the focus time window, the user behavior monitoring information is subjected to access behavior anomaly detection to obtain access behavior anomaly detection results; Based on the traffic anomaly detection result and the access behavior anomaly detection result, it is determined whether an emergency response strategy needs to be initiated.

2. The network security intelligent monitoring method of the Internet of Things device according to claim 1 is characterized in that: The method of selecting and integrating the preliminary traffic feature data generated by the traffic data of the IoT device based on the correlation feature to obtain the target traffic feature data includes: Perform preliminary feature extraction on IoT device traffic data based on the attention mechanism to obtain preliminary traffic feature data; Calculate the feature correlation of the feature attribute set for the preliminary traffic feature data, and remove redundancy of the feature attribute set based on the feature correlation to obtain the target feature attribute set; Calculating the correlation coefficient between the target feature attribute set and the category feature set in the preliminary traffic feature data, and selecting the first feature sequence set based on the correlation coefficient; The mutual information between the target feature attribute set and the category feature set is calculated, the second feature sequence set is screened based on the mutual information, and feature integration is performed based on the first feature sequence set and the second feature sequence set to obtain target traffic feature data.

3. The network security intelligent monitoring method of the Internet of Things device according to claim 1 is characterized in that: The protection capability evaluation of the IoT device against abnormal traffic status based on the attack path impact analysis is performed to obtain the protection capability evaluation result, including: Perform attack path analysis based on vulnerability information obtained from IoT devices in past traffic anomalies, obtain several corresponding attack paths, and calculate the impact value of the attack path based on the fuzzy evaluation matrix; Extract features of the defense mechanisms used by each attack path to obtain defense mechanism feature information; The defense success rate is calculated based on the characteristic information of the defense mechanism using resource dependency analysis, and the attack path utilization value is calculated based on the impact value of the attack path combined with the attack path probability value; Based on the attack path utilization value and the defense success rate, a protection capability evaluation of the abnormal traffic state is performed to obtain a protection capability evaluation result.

4. The network security intelligent monitoring method of the Internet of Things device according to claim 1 is characterized in that: The traffic security baseline is constructed based on the protection capability assessment result, including: Determine the baseline range based on the periodic distribution law of historical traffic data, and perform fluctuation statistics on historical traffic data to obtain the normal fluctuation range of traffic; The upper and lower flow tolerances are determined based on the protection capability assessment results, and a flow security baseline is constructed based on the baseline range, the normal flow fluctuation range, and the upper and lower flow tolerances.

5. The network security intelligent monitoring method of the Internet of Things device according to claim 1 is characterized in that: The performing flow anomaly detection based on the flow security baseline and utilizing the target flow characteristic data to obtain a flow anomaly detection result includes: The target traffic characteristic data is compared with each parameter in the traffic security baseline to obtain a comparison result, and traffic anomaly detection is performed based on the comparison result to obtain a traffic anomaly detection result.

6. The network security intelligent monitoring method of the Internet of Things device according to claim 1 is characterized in that: The method of determining the focus time window and abnormal access behavior sequence based on the user historical access behavior information of the IoT device includes: Determine the number of historical access behaviors of the user's historical access behavior information in each preset time end window, and use the preset time end window corresponding to the number of historical access behaviors greater than or equal to the preset number threshold as the focus time window; Based on a clustering algorithm, several behavior sequences generated by the user's historical access behavior information are classified to obtain several behavior sequence classes; Calculate the correlation coefficient between each user's access behavior based on several behavior sequence classes; The abnormal access behavior sequence is determined based on the correlation coefficient and the output probability of each behavior sequence class.

7. The network security intelligent monitoring method of the Internet of Things device according to claim 1 is characterized in that: The method of performing access behavior anomaly detection on user behavior monitoring information based on the access behavior distribution and abnormal access behavior sequence generated by the focus time window to obtain an access behavior anomaly detection result includes: Perform distribution statistics on historical access behavior information in the focus time window to obtain access behavior distribution; constructing an access behavior line based on the access behavior distribution, and performing access behavior anomaly detection on the user behavior monitoring information based on the access behavior line to obtain a first preliminary access behavior anomaly detection result; Matching the user behavior monitoring information with the abnormal access behavior sequence to obtain a matching result, and determining a second preliminary access behavior abnormality monitoring result based on the matching result; The first preliminary access behavior anomaly detection result and the second preliminary access behavior anomaly detection result are deduplicated and redundancy-removed to obtain an access behavior anomaly detection result.

8. A network security intelligent monitoring device for Internet of Things devices, characterized in that: The device comprises: Traffic feature extraction module: used to perform feature screening and integration on the preliminary traffic feature data generated by the traffic data of IoT devices based on correlation feature selection to obtain target traffic feature data; Traffic baseline construction module: used to evaluate the protection capability of IoT devices against abnormal traffic status based on attack path impact analysis, obtain protection capability evaluation results, and build a traffic security baseline based on the protection capability evaluation results; A flow anomaly detection module: used to perform flow anomaly detection based on the flow security baseline using the target flow characteristic data to obtain a flow anomaly detection result; Time window and behavior sequence determination module: used to determine the focus time window and abnormal access behavior sequence based on the user's historical access behavior information of the IoT device; Access behavior anomaly detection module: used to perform access behavior anomaly detection on user behavior monitoring information based on the access behavior distribution and abnormal access behavior sequence generated by the focus time window, and obtain access behavior anomaly detection results; Emergency response judgment module: used to judge whether it is necessary to initiate an emergency response strategy based on the traffic anomaly detection result and the access behavior anomaly detection result.

9. An electronic device, comprising a processor and a memory, characterized in that: The memory is used to store instructions, and the processor is used to call the instructions in the memory, so that the electronic device executes the network security intelligent monitoring method for an Internet of Things device according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed on an electronic device, the electronic device executes the network security intelligent monitoring method for an Internet of Things device according to any one of claims 1 to 7.

Images