Remote management system of household monitoring equipment

Abstract

The invention discloses a remote management system of household monitoring equipment, and relates to the technical field of monitoring equipment management, a score generation module obtains an attack score of the monitoring equipment through addition of a nonlocal access frequency normalized value and an unauthorized port scanning frequency normalized value; the attack judgment module judges whether the monitoring equipment is attacked by an attacker or not according to the attack score, and when it is judged that the monitoring equipment is attacked by the attacker, the induction module shuts down the monitoring equipment, induces the attacker to the honeypot equipment, monitors the attack behavior of the attacker on the honeypot equipment and sends the attack behavior to the honeypot equipment. And when the security protection software arranged on the honeypot equipment is attacked by an attacker, the management module selects to shut down all the monitoring equipment or perform other management according to the system vulnerability condition of the monitoring system. When the management system judges that the attacker behavior exists, the monitoring device with the attack risk is closed firstly, then the attacker is induced to attack through the virtual monitoring device, and the use stability and safety of the monitoring device are guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of monitoring equipment management, and in particular to a remote management system for household monitoring equipment. Background Art

[0002] Home surveillance equipment refers to equipment used to monitor and protect property, family and home security in a home environment. These devices are usually composed of cameras, sensors, recording equipment and network connections, and can provide real-time monitoring, video storage, remote access and alarm functions. The emergence of home surveillance equipment stems from the demand for home security and convenience. With the advancement of technology and the rise of smart homes, home surveillance equipment is becoming more and more popular. They can help homeowners remotely monitor their homes and keep abreast of the situation at home.

[0003] To facilitate users in viewing surveillance footage from home surveillance devices, existing home surveillance devices are typically connected to the Internet. This allows users to view surveillance footage and manage the devices through mobile devices. However, since home surveillance devices are connected to the Internet, the following problems may arise:

[0004] Since the images captured by surveillance devices are of users' homes and are therefore private data, a successful attack on existing surveillance devices could result in the leakage of surveillance video data. This could expose users' privacy and cause them distress. Attackers could also obtain information from surveillance videos, such as family members' activity patterns and time away from home, to plan intrusions or thefts.

[0005] Based on this, the present invention proposes a remote management system for home monitoring equipment, which can judge the attacker's behavior on the monitoring equipment. When it is judged that there is an attacker's behavior, the monitoring equipment with attack risks is first shut down, and then the attacker is induced to attack through a virtual monitoring device, thereby ensuring the stability and security of the use of the monitoring equipment. Summary of the Invention

[0006] The purpose of the present invention is to provide a remote management system for home monitoring equipment to solve the shortcomings of the background technology.

[0007] To achieve the above-mentioned object, the present invention provides the following technical solutions: a remote management system for home monitoring devices, comprising a marking module, a honeypot deployment module, a data acquisition module, a preprocessing module, a score generation module, an attack judgment module, an induction module, and a management module;

[0008] Marking module: obtains the number of monitoring devices in the home and marks each monitoring device;

[0009] Honeypot deployment module: After all monitoring devices are combined into a complete monitoring system, honeypot devices are deployed in the monitoring system;

[0010] Data collection module: During the operation of the monitoring system, the frequency of remote access and unauthorized port scanning of each monitoring device is collected;

[0011] Pre-processing module: normalizes the frequency of remote access and the frequency of unauthorized port scanning to obtain a normalized value of the frequency of remote access and a normalized value of the frequency of unauthorized port scanning;

[0012] Score generation module: obtains the attack score of the monitored device by adding the normalized value of the remote access frequency and the normalized value of the unauthorized port scan frequency;

[0013] Attack judgment module: determines whether the monitoring device is attacked by the attacker based on the attack score;

[0014] Induction module: When it is determined that the monitoring device is under attack, it shuts down the monitoring device and guides the attacker to the honeypot device to monitor the attacker's attack behavior on the honeypot device;

[0015] Management module: When the security protection software installed on the honeypot device is compromised by attackers, all monitoring devices can be shut down or other management can be performed based on the system vulnerability status of the monitoring system.

[0016] In a preferred embodiment, during the operation of the monitoring system, the data acquisition module collects the frequency of remote access and unauthorized port scanning of each monitoring device as follows:

[0017] Set a monitoring time period and divide it into several sub-time periods of equal length;

[0018] The logic for obtaining the frequency of remote access is as follows: obtain the number of remote accesses to the monitoring device within a sub-time period, and multiply the number of accesses in the sub-time period with the maximum number of remote accesses by the length of the previous sub-time period to obtain the frequency of remote accesses;

[0019] The logic for obtaining the unauthorized port scan frequency is as follows: obtain the number of unauthorized port scans of the monitoring device by the monitoring device within the sub-time period, and divide the number of visits in the sub-time period with the maximum number of unauthorized port scans by the length of the previous sub-time period to obtain the unauthorized port scan frequency.

[0020] In a preferred embodiment, the preprocessing module normalizes the remote access frequency and the unauthorized port scanning frequency through the Z-score normalization calculation formula, maps the value range of the remote access frequency and the unauthorized port scanning frequency between [-3,3], and obtains the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency.

[0021] In a preferred embodiment, the scoring module obtains the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency of each monitoring device, and then calculates the attack score, which is expressed as: J(a)=yf(a)+ws(a), where J(a) is the attack score of the a-th monitoring device, yf(a) is the normalized value of the remote access frequency of the a-th monitoring device, and ws(a) is the normalized value of the unauthorized port scanning frequency of the a-th monitoring device.

[0022] In a preferred embodiment, after the attack judgment module obtains the attack scores of all monitoring devices, it compares the attack scores with a preset score threshold. The score threshold is used to determine whether the monitoring device is under attack. If the attack score is greater than the score threshold, the monitoring device is determined to be under attack. If the attack score is less than or equal to the score threshold, the monitoring device is determined not to be under attack. The monitoring device determined to be under attack is placed in an isolation area, and the monitoring device determined not to be under attack is placed in a normal area.

[0023] In a preferred embodiment, when the security protection software set on the honeypot device is conquered by an attacker, the management module analyzes whether there is a system vulnerability in the monitoring system. If there is a system vulnerability in the monitoring system, all monitoring devices are shut down. If there is no system vulnerability in the monitoring system, other monitoring devices are continuously monitored for attacker attack behaviors, and the attacker's operating behaviors on the honeypot device are continued to be monitored.

[0024] In a preferred embodiment, when the induction module detects that the monitoring device is under attack, it shuts down the monitoring device and activates a pre-deployed honeypot device to put it in a standby state. The honeypot device simulates the behavior of a real monitoring device, including simulating network traffic, login interface, and camera images, to lure the attacker into thinking that he is attacking a real device and monitor the attacker's attack behavior.

[0025] A remote management method for a home monitoring device, the management method comprising the following steps:

[0026] The management system obtains the number of monitoring devices in the home and labels each monitoring device with its number and location information. After all monitoring devices are combined into a complete monitoring system, a honeypot device is deployed within the monitoring system.

[0027] During the operation of the monitoring system, the remote access frequency and unauthorized port scanning frequency of each monitoring device are collected, and the remote access frequency and unauthorized port scanning frequency are normalized to obtain the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency. The attack score of the monitoring device is obtained by adding the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency, and it is determined whether the monitoring device is attacked by an attacker based on the attack score;

[0028] When it is determined that the monitoring device is under attack, the monitoring device will be shut down and the attacker will be lured to the honeypot device to monitor the attacker's attack behavior on the honeypot device. When the security protection software set on the honeypot device is conquered by the attacker, all monitoring devices will be shut down or other management will be carried out based on the system vulnerability status of the monitoring system.

[0029] In the above technical solution, the technical effects and advantages provided by the present invention are:

[0030] The present invention uses a honeypot deployment module to form a complete monitoring system with all monitoring devices, and then deploys a honeypot device in the monitoring system. The scoring generation module obtains the attack score of the monitoring device by adding the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency. The attack judgment module judges whether the monitoring device is attacked by an attacker based on the attack score. When it is determined that the monitoring device is attacked by an attacker, the induction module shuts down the monitoring device and guides the attacker to the honeypot device to monitor the attacker's attack behavior on the honeypot device. When the security protection software set on the honeypot device is overcome by the attacker, the management module chooses to shut down all monitoring devices or perform other management according to the system vulnerability status of the monitoring system. The management system can judge the attacker's behavior on the monitoring device, and when it is determined that there is attacker behavior, it first shuts down the monitoring device with attack risk, and then guides the attacker to attack through the virtual monitoring device, thereby ensuring the stability and security of the monitoring device. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments described in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0032] Figure 1 It is a system module diagram of the present invention. DETAILED DESCRIPTION

[0033] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0034] Example 1: Please refer to Figure 1 As shown, the remote management system for home monitoring devices described in this embodiment includes a marking module, a honeypot deployment module, a data acquisition module, a preprocessing module, a score generation module, an attack judgment module, an induction module, and a management module;

[0035] Marking module: obtains the number of monitoring devices in the home and marks each monitoring device. The marking information includes the number and location information of the monitoring device. The marking information is sent to the honeypot deployment module, data collection module and management module;

[0036] Honeypot deployment module: After all monitoring devices are combined into a complete monitoring system, honeypot devices are deployed in the monitoring system. Honeypot devices are used to simulate real monitoring devices, but are actually virtual devices controlled by the security team. Honeypot device information is sent to the decoy module.

[0037] Data acquisition module: During the operation of the monitoring system, the remote access frequency and unauthorized port scanning frequency of each monitoring device are collected and sent to the pre-processing module;

[0038] Preprocessing module: normalizes the frequency of remote access and the frequency of unauthorized port scans to obtain normalized values of the frequency of remote access and the frequency of unauthorized port scans, and sends the normalized values of the frequency of remote access and the frequency of unauthorized port scans to the score generation module;

[0039] Score generation module: This module obtains the attack score of the monitoring device by adding the normalized value of the remote access frequency and the normalized value of the unauthorized port scan frequency. The attack score is then sent to the attack judgment module.

[0040] Attack judgment module: determines whether the monitoring device is attacked by the attacker based on the attack score, and sends the judgment result to the induction module;

[0041] Induction module: When it is determined that the monitoring device is under attack, it shuts down the monitoring device and guides the attacker to the honeypot device. The attacker's attack behavior on the honeypot device is monitored and sent to the management module and the security team.

[0042] Management module: When the security protection software installed on the honeypot device is compromised by attackers, all monitoring devices can be shut down or other management can be performed based on the system vulnerability status of the monitoring system.

[0043] This application uses the honeypot deployment module to form a complete monitoring system with all monitoring devices, and then deploys honeypot devices in the monitoring system. The score generation module obtains the attack score of the monitoring device by adding the normalized value of the frequency of remote access and the normalized value of the frequency of unauthorized port scanning. The attack judgment module determines whether the monitoring device is attacked by an attacker based on the attack score. When it is determined that the monitoring device is attacked by an attacker, the induction module shuts down the monitoring device and induces the attacker to the honeypot device to monitor the attacker's attack behavior on the honeypot device. When the security protection software set on the honeypot device is overcome by the attacker, the management module chooses to shut down all monitoring devices or perform other management based on the system vulnerability status of the monitoring system. The management system can judge the attacker's behavior on the monitoring device, and when it is determined that there is attacker behavior, it first shuts down the monitoring device with attack risk, and then induces the attacker to attack through the virtual monitoring device to ensure the stability and security of the use of the monitoring device.

[0044] The specific workflow is:

[0045] The management system obtains the number of monitoring devices in the home and labels each monitoring device. The labeling information includes the monitoring device number and location information. After all monitoring devices are combined into a complete monitoring system, honeypot devices are deployed in the monitoring system. Honeypot devices are used to simulate real monitoring devices, but are actually virtual devices controlled by the security team. During the operation of the monitoring system, the remote access frequency and unauthorized port scan frequency of each monitoring device are collected, and the remote access frequency and unauthorized port scan frequency are normalized to obtain the normalized value of the remote access frequency and the normalized value of the unauthorized port scan frequency. The attack score of the monitoring device is obtained by adding the normalized value of the remote access frequency and the normalized value of the unauthorized port scan frequency. Based on the attack score, it is determined whether the monitoring device is under attack by the attacker. If the monitoring device is determined to be under attack by the attacker, the monitoring device is shut down and the attacker is lured to the honeypot device to monitor the attacker's attack behavior on the honeypot device. If the security protection software installed on the honeypot device is overcome by the attacker, all monitoring devices are shut down or other management is performed based on the system vulnerability status of the monitoring system. The security team optimizes the monitoring system accordingly based on the attack behavior information.

[0046] Example 2: The marking module obtains the number of monitoring devices in the home and marks each monitoring device. The marking information includes the number and location information of the monitoring device.

[0047] Scan the home network to identify connected monitoring devices. Obtain the device's IP address, MAC address and other information by scanning the network. Obtain detailed information on each monitoring device, including device type, brand, and model. Identify the location information of each monitoring device. The device's location can be determined by manual input or by using positioning technology (such as Wi-Fi signal strength positioning). Assign a unique number to each monitoring device to identify and distinguish the device. Record the number, type, location information, etc. of each monitoring device. Use a spreadsheet or database to manage this information. Regularly update the monitoring device information, including adding new devices and deleting expired devices. Draw a map or layout of the home based on the device's location information, and mark the location and number of each monitoring device on the map.

[0048] After the honeypot deployment module integrates all monitoring devices into a complete monitoring system, it deploys honeypot devices within the monitoring system. Honeypot devices are used to simulate real monitoring devices, but are actually virtual devices controlled by the security team.

[0049] Establish a virtual or isolated network to deploy honeypot devices. Configure the honeypot devices with a virtual operating system and monitoring software, ensuring their appearance and functionality resemble those of real monitoring devices. Place decoys in the honeypot devices, such as using default usernames and passwords, simulating common device configurations, or generating seemingly valuable but actually fake data. Connect the honeypot devices to the virtual or isolated network, ensuring they can communicate with other devices on the network just like real monitoring devices. Monitor honeypot device activity, including network traffic, login attempts, and command execution, and log all attack behaviors and attacker information. Analyze monitoring data to identify attack behaviors, including login attempts, malicious access, and vulnerability exploits. Based on identified attack behaviors, implement timely countermeasures, such as blocking attack traffic, isolating the attacker, and tracing the attacker's source and behavior. Analyze collected attack data and generate reports summarizing attack behaviors, attacker skill levels, and attack methods to provide reference for strengthening security defenses.

[0050] In this application, a honeypot device is deployed to simulate a home surveillance system and induce potential attackers to expose their attack behaviors, as follows:

[0051] In a secure virtual network environment, a network environment simulating a home surveillance system was established, and a honeypot device was connected to the network. A virtual operating system was configured for the honeypot device, and simulated camera surveillance software was installed to ensure that its appearance and functions were similar to those of a real camera. Some baits were set in the honeypot device, including using common default usernames and passwords, common configuration settings of simulated devices, and some surveillance images that seemed valuable but were actually fake were created. The honeypot device was connected to the virtual network and ensured that it could communicate normally with other virtual devices and the simulated home surveillance system. The activities of the honeypot device were monitored, including monitoring the device's network traffic, login attempts, command execution, etc., and all attack behaviors and attacker information were recorded. The monitoring data was analyzed to identify attack behaviors, such as frequent login attempts and malicious access to surveillance images.

[0052] When a monitoring device is attacked, the induction module shuts down the monitoring device and guides the attacker to the honeypot device. The module monitors the attacker's attack behavior on the honeypot device and sends the attack behavior to the management module and the security team.

[0053] When the induction module detects that the monitoring device may be under attack, it immediately takes measures to shut down the monitoring device to prevent the attack from continuing and protect the real data from being damaged. At the same time, the induction module activates the pre-deployed honeypot device and puts it on standby, ready to lure the attacker in. The honeypot device simulates the behavior of the real monitoring device, including simulating network traffic, login interface, camera images, etc., to lure the attacker into thinking that he is attacking the real device and monitor the attacker's attack behavior.

[0054] Example 3: During the operation of the monitoring system, the data acquisition module collects the frequency of remote access and unauthorized port scanning of each monitoring device;

[0055] Set a monitoring time period (e.g., 10 seconds), and divide the monitoring time period into several sub-time periods of equal length (e.g., five sub-time periods, each of 2 seconds);

[0056] The logic for obtaining the frequency of remote access is as follows: obtain the number of remote accesses to the monitoring device within a sub-time period, and multiply the number of accesses in the sub-time period with the maximum number of remote accesses by the length of the previous sub-time period to obtain the frequency of remote accesses;

[0057] The logic for obtaining the unauthorized port scan frequency is as follows: obtain the number of unauthorized port scans of the monitoring device by the monitoring device within the sub-time period, and divide the number of visits in the sub-time period with the maximum number of unauthorized port scans by the length of the previous sub-time period to obtain the unauthorized port scan frequency.

[0058] The frequency of remote access and unauthorized port scanning can be calculated using the following formula:

[0059]

[0060] Where smv is the parameter frequency, f(i) is the number of times collected in the i-th sub-time period, ΔT(i) is the duration of the i-th sub-time period, and max(*) represents the maximum number of selections. The frequency of remote access and the frequency of unauthorized port scanning are the same as the above method and are not introduced here one by one.

[0061] in:

[0062] The greater the frequency of remote access to a monitoring device, the more likely it is to be attacked by an attacker. Specifically,

[0063] Increased abnormal login attempts: The monitoring device receives frequent login attempts from different geographical locations within a short period of time, especially login attempts using incorrect passwords or common default credentials.

[0064] Multiple failed login attempts: If a monitoring device receives multiple failed login attempts in a short period of time, it may indicate that an attacker is trying to gain access to the device.

[0065] Access from unusual geographic locations: The monitoring device suddenly begins receiving access requests from unusual geographic locations, especially from high-risk areas or uncommon countries.

[0066] Inconsistent login attempts: The login attempts received by the monitoring device are inconsistent in time, such as a large number of login attempts during non-working hours or during time periods when users do not usually log in.

[0067] Abnormal login sources: Login requests received by the monitoring device come from different IP addresses or use different device identifiers. This may be an attack by an attacker through a proxy server or botnet.

[0068] Abnormal login patterns: The login request pattern received by the monitoring device does not conform to normal user behavior patterns, such as multiple consecutive login attempts in a short period of time, or attempts to log in to different device accounts.

[0069] Increased login attempts: The monitoring device suddenly receives a large number of login attempts, which is significantly higher than the previous number of login attempts. This may indicate that an attacker is cracking passwords or performing brute force attacks.

[0070] The higher the frequency of unauthorized port scans on a monitoring device, the more likely it is to be attacked by an attacker. This is manifested in the following ways:

[0071] Increased network traffic: Unauthorized port scanning activity can lead to increased network traffic on the monitored device, especially if the frequency of scans targeting the same device or group of devices increases.

[0072] Frequent port scans: The monitoring device receives a large number of frequent unauthorized port scan requests, which may be caused by attackers trying to find open ports or system vulnerabilities.

[0073] Scans from different IP addresses: Scan requests originate from different IP addresses, indicating that the attacker may be conducting scanning activities from different locations, possibly through a proxy server.

[0074] Unusual scanning patterns: Scan request patterns that do not match normal network traffic patterns, such as during off-hours, during periods of low user activity, or frequent scan requests.

[0075] Scanning of specific ports: Attackers scan specific ports, which may be common vulnerability ports or service ports related to monitoring devices. This may be an attempt by attackers to find potential attack targets.

[0076] A large number of failed scans: The success rate of scan requests is low, and most scan requests fail. This may be because the attacker is trying to detect open ports or weaknesses.

[0077] Abnormal port activity: Monitors abnormal port activity on devices, such as unauthorized port opening, closing, or changes. This could indicate an attacker is attempting to exploit a vulnerability or attack the device.

[0078] Long-term scanning activities: Scanning activities last for a long time, which may indicate that the attacker is conducting continuous reconnaissance and detection to find system weaknesses and entry points.

[0079] The pre-processing module normalizes the remote access frequency and the unauthorized port scanning frequency to obtain a normalized value of the remote access frequency and a normalized value of the unauthorized port scanning frequency;

[0080] The preprocessing module normalizes the remote access frequency and unauthorized port scan frequency using the Z-score normalization formula, mapping the remote access frequency and unauthorized port scan frequency value range to [-3, 3] to obtain the normalized value of the remote access frequency and the normalized value of the unauthorized port scan frequency;

[0081] The above steps can standardize the remote access frequency and unauthorized port scan frequency to form a standard normal distribution with a mean of 0 and a standard deviation of 1. This helps eliminate the dimensionality effects between different features and makes the data easier to compare and analyze.

[0082] Among them, the Z-score normalization calculation formula is: Where Z is the data normalization value, X is the data value, μ is the data mean, and σ is the data standard deviation. The data standard deviation calculation method belongs to the existing technology, and the general calculation formula is: Where σ is the standard deviation of the data, n represents the number of sub-time periods, n is a positive integer, P i represents the frequency calculated in the i-th sub-time period (such as the frequency of remote access or the frequency of unauthorized port scanning), and μ represents the data mean.

[0083] The data acquisition module obtains the remote access frequency and unauthorized port scanning frequency logic of the monitoring device. It can be seen that the monitoring time period is divided into multiple monitoring points, and each monitoring point represents a sub-time period.

[0084] The scoring generation module obtains the attack score of the monitoring device by adding the normalized value of the remote access frequency and the normalized value of the unauthorized port scan frequency;

[0085] After obtaining the normalized value of the remote access frequency and the normalized value of the unauthorized port scan frequency of each monitoring device, the scoring module calculates the attack score. The expression is: J(a) = yf(a) + ws(a), where J(a) is the attack score of the a-th monitoring device, yf(a) is the normalized value of the remote access frequency of the a-th monitoring device, and ws(a) is the normalized value of the unauthorized port scan frequency of the a-th monitoring device.

[0086] A higher attack score indicates that the monitoring device has been accessed from other locations and received more unauthorized port scans during the monitoring period, indicating that the monitoring device is more likely to be attacked by attackers. Specifically:

[0087] 1) Increased number of remote access requests: If a monitoring device receives a large number of remote access requests during the monitoring period, especially from unknown or unusual geographic locations, this may indicate that an attacker is attempting to hack into the device or gain access to it.

[0088] 2) Increased number of unauthorized port scans: Unauthorized port scans are a common tactic used by attackers to detect open ports and potential vulnerabilities in target systems. If a monitoring device receives a large number of unauthorized port scan requests during the monitoring period, this may indicate that an attacker is attempting to discover vulnerabilities and launch an attack.

[0089] The attack judgment module determines whether the monitoring device is attacked by the attacker based on the attack score;

[0090] After obtaining the attack scores of all monitoring devices, the attack judgment module compares the attack scores with the preset scoring threshold. The scoring threshold is used to determine whether the monitoring device is under attack. If the attack score is greater than the scoring threshold, the monitoring device is judged to be under attack. If the attack score is less than or equal to the scoring threshold, the monitoring device is judged to be not under attack. The monitoring device judged to be under attack will be placed in the isolation area, and the monitoring device judged to be not under attack will be placed in the normal area.

[0091] When the security protection software installed on the honeypot device is compromised by an attacker, the management module will choose to shut down all monitoring devices or perform other management based on the system vulnerability status of the monitoring system;

[0092] When the security protection software installed on the honeypot device is conquered by the attacker, the management module analyzes whether there are system vulnerabilities in the monitoring system. If there are system vulnerabilities in the monitoring system, all monitoring devices will be shut down. If there are no system vulnerabilities in the monitoring system, other monitoring devices will be continuously monitored for attacker attack behaviors, and the attacker's operation behaviors on the honeypot device will be continuously monitored. Once the attacker enters the honeypot device, the attack behaviors will be monitored immediately, including login attempts, command execution, vulnerability exploitation, etc. All attacker behaviors and attack data will be recorded, including attack methods, tools, attacker's IP address and other information. After detecting the attack behavior, the management module will send the collected attack data to the security team for further analysis and processing;

[0093] After obtaining information about attacker behavior, including login attempts, command execution, vulnerability exploitation, attack methods, tools, and the attacker's IP address, the security team can perform the following targeted optimizations on the entire monitoring system:

[0094] Enhance monitoring and detection capabilities: Based on the characteristics and patterns of attack behaviors, optimize the monitoring system's detection rules and algorithms, improve the ability to identify and capture potential attack behaviors, and promptly detect abnormal activities and take appropriate countermeasures.

[0095] Strengthen access control and identity authentication: By strengthening access control and identity authentication mechanisms, unauthorized users' access rights can be restricted, preventing attackers from obtaining device login credentials or permissions, thereby reducing the risk of system attacks.

[0096] Strengthen security configuration: Perform security configuration on the monitoring system, including updating system patches, shutting down unnecessary services and ports, strengthening account passwords, and restricting network access, etc., to reduce the system's attack surface and improve system security.

[0097] Enhanced logging and auditing capabilities: Added logging and auditing capabilities to record detailed information on attack behaviors, including the attacker's IP address, attack method, attack target, etc., to facilitate post-analysis and tracing, and strengthen the ability to monitor and track attack behaviors.

[0098] Emergency response and disposal capabilities: Establish a sound emergency response and disposal mechanism and take timely countermeasures to discovered attacks, including isolating infected devices, restoring system functions, repairing vulnerabilities, etc., to minimize the damage caused by attacks to the system.

[0099] Continuous improvement and learning: Regularly conduct security assessments and vulnerability scans on the monitoring system to promptly identify and fix security issues in the system. Continuously improve the security and defense capabilities of the monitoring system, maintain sensitivity to new attack methods and threats, and continuously enhance the technical level and response capabilities of the security team.

[0100] Throughout this specification, references to terms such as "one embodiment," "example," or "specific example" indicate that the specific features, structures, materials, or characteristics described in conjunction with that embodiment or example are included in at least one embodiment or example of the present invention. In this specification, schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0101] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to specific embodiments. Obviously, many modifications and variations are possible based on the contents of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A remote management system for home monitoring equipment, characterized by: It includes labeling module, honeypot deployment module, data collection module, preprocessing module, score generation module, attack judgment module, induction module, and management module; Marking module: obtains the number of monitoring devices in the home and marks each monitoring device; Honeypot deployment module: After all monitoring devices are combined into a complete monitoring system, honeypot devices are deployed in the monitoring system; Data collection module: During the operation of the monitoring system, the frequency of remote access and unauthorized port scanning of each monitoring device is collected; Preprocessing module: normalizes the frequency of remote access and the frequency of unauthorized port scanning to obtain a normalized value of the frequency of remote access and a normalized value of the frequency of unauthorized port scanning; Score generation module: obtains the attack score of the monitored device by adding the normalized value of the remote access frequency and the normalized value of the unauthorized port scan frequency; Attack judgment module: determines whether the monitoring device is attacked by the attacker based on the attack score; Induction module: When it is determined that the monitoring device is under attack, it shuts down the monitoring device and guides the attacker to the honeypot device to monitor the attacker's attack behavior on the honeypot device; Management module: When the security protection software installed on the honeypot device is compromised by attackers, all monitoring devices can be shut down or other management can be performed based on the system vulnerability status of the monitoring system.

2. A remote management system for home monitoring equipment according to claim 1, characterized in that: During the operation of the monitoring system, the data acquisition module collects the frequency of remote access and unauthorized port scanning of each monitoring device as follows: Set a monitoring time period and divide it into several sub-time periods of equal length; The logic for obtaining the frequency of remote access is as follows: obtain the number of remote accesses to the monitoring device within a sub-time period, and multiply the number of accesses in the sub-time period with the maximum number of remote accesses by the length of the previous sub-time period to obtain the frequency of remote accesses; The logic for obtaining the unauthorized port scan frequency is as follows: obtain the number of unauthorized port scans of the monitoring device by the monitoring device within the sub-time period, and divide the number of visits in the sub-time period with the maximum number of unauthorized port scans by the length of the previous sub-time period to obtain the unauthorized port scan frequency.

3. A remote management system for home monitoring equipment according to claim 2, characterized in that: The preprocessing module normalizes the remote access frequency and the unauthorized port scanning frequency through the Z-score normalization calculation formula, maps the value range of the remote access frequency and the unauthorized port scanning frequency between [-3, 3], and obtains the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency.

4. A remote management system for home monitoring equipment according to claim 3, characterized in that: After obtaining the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency of each monitoring device, the scoring module calculates the attack score, which is expressed as: J(a)=yf(a)+ws(a), where J(a) is the attack score of the a-th monitoring device, yf(a) is the normalized value of the remote access frequency of the a-th monitoring device, and ws(a) is the normalized value of the unauthorized port scanning frequency of the a-th monitoring device.

5. A remote management system for home monitoring equipment according to claim 4, characterized in that: After obtaining the attack scores of all monitoring devices, the attack judgment module compares the attack scores with a preset scoring threshold. The scoring threshold is used to determine whether the monitoring device is under attack. If the attack score is greater than the scoring threshold, the monitoring device is determined to be under attack. If the attack score is less than or equal to the scoring threshold, the monitoring device is determined not to be under attack. The monitoring device determined to be under attack is placed in an isolation area, and the monitoring device determined not to be under attack is placed in a normal area.

6. A remote management system for home monitoring equipment according to claim 5, characterized in that: When the security protection software installed on the honeypot device is conquered by the attacker, the management module analyzes whether there is a system vulnerability in the monitoring system. If there is a system vulnerability in the monitoring system, all monitoring devices will be shut down. If there is no system vulnerability in the monitoring system, other monitoring devices will be continuously monitored for the attacker's attack behavior, and the attacker's operation behavior on the honeypot device will continue to be monitored.

7. A remote management system for home monitoring equipment according to claim 6, characterized in that: When the induction module detects that the monitoring device is under attack, it shuts down the monitoring device and activates the pre-deployed honeypot device to put it in standby mode. The honeypot device simulates the behavior of a real monitoring device, including simulating network traffic, login interface, and camera images, to lure attackers into thinking that they are attacking a real device and monitor the attacker's attack behavior.

8. A remote management method for home monitoring equipment, implemented by the management system according to any one of claims 1 to 7, characterized in that: The management method comprises the following steps: The management system obtains the number of monitoring devices in the home and labels each monitoring device with its number and location information. After all monitoring devices are combined into a complete monitoring system, a honeypot device is deployed within the monitoring system. During the operation of the monitoring system, the remote access frequency and unauthorized port scanning frequency of each monitoring device are collected, and the remote access frequency and unauthorized port scanning frequency are normalized to obtain the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency. The attack score of the monitoring device is obtained by adding the normalized value of the remote access frequency and the normalized value of the unauthorized port scanning frequency, and it is determined whether the monitoring device is attacked by an attacker based on the attack score; When it is determined that the monitoring device is under attack, the monitoring device will be shut down and the attacker will be lured to the honeypot device to monitor the attacker's attack behavior on the honeypot device. When the security protection software set on the honeypot device is conquered by the attacker, all monitoring devices will be shut down or other management will be carried out based on the system vulnerability status of the monitoring system.

Images