Smart home network traffic covert channel detection and blocking method

Abstract

The invention provides a smart home network traffic covert channel detection and blocking method, which comprises the following steps of: constructing a multi-dimensional visual channel model based on a channel feature extractor, constructing a channel anomaly analysis library, acquiring a network traffic channel under a normal condition, and inputting the network traffic channel into the multi-dimensional visual channel model; the method comprises the following steps: acquiring channel multi-dimensional feature data under a normal condition, setting a threshold range of the channel multi-dimensional feature data, acquiring all network flow channels in real time, inputting the network flow channels into a multi-dimensional visual channel model, acquiring real-time channel multi-dimensional feature data, and comparing the real-time channel multi-dimensional feature data with the channel multi-dimensional feature threshold range to obtain a channel multi-dimensional feature data comparison result. The method comprises the following steps: acquiring a network flow hidden channel, performing anomaly analysis on multi-dimensional channel data of the network flow hidden channel based on a channel anomaly analysis library, acquiring an anomaly analysis result and a blocking level of the anomaly analysis result, and performing blocking operation on the network flow hidden channel based on the blocking level. And the reliability of the smart home service is maintained while the safety is ensured.

Description

Technical Field

[0001] The present invention relates to the field of signal transmission technology, and in particular to a method for detecting and blocking covert channels of smart home network traffic. Background Art

[0002] Against the backdrop of a surge in the number of smart home devices and increasingly complex network threats, and with users' increasing demand for home network security and privacy protection, covert channel detection and blocking technologies for smart home network traffic face severe challenges. Traditional detection and blocking methods mainly rely on static rule matching or a single abnormal traffic threshold determination during implementation. However, this approach has significant shortcomings.

[0003] On the one hand, covert channels are usually designed to be disguised in normal traffic, and their patterns are complex and changeable, making it difficult to comprehensively and accurately identify new or highly disguised covert communication behaviors. This causes the detection system to easily generate a large number of missed reports or false alarms, and is unable to effectively ensure network security.

[0004] On the other hand, a single blocking strategy lacks flexibility and specificity. Smart home networks carry a variety of legitimate traffic, such as device control instructions, video streams, software updates, etc., which have different importance and real-time requirements. Once suspicious traffic is detected, traditional methods often adopt a "one-size-fits-all" blocking strategy. This approach may inadvertently delete critical normal business traffic, resulting in abnormal smart home functions or a serious decline in user experience, and it is impossible to maintain the reliability of smart home services while ensuring security.

[0005] Therefore, the existing smart home covert channel detection and blocking technology is inadequate when it comes to balancing the needs of dealing with covert communication threats and ensuring the normal operation of complex smart home services. It is difficult to provide protection capabilities that are both safe and reliable without affecting the user experience. Summary of the Invention

[0006] In view of the above-mentioned problems, in combination with the first aspect of the present invention, an embodiment of the present invention provides a method for detecting and blocking covert channels in smart home network traffic, the method comprising: Building a multi-dimensional visual channel model based on the channel feature extractor, the multi-dimensional visual channel model includes a channel spatiotemporal processor, a channel protocol parser, a channel behavior analyzer, and a channel entropy calculator, and building a channel anomaly analysis library; Obtaining a network traffic channel in a normal operating state of a smart home in a user's home, inputting the network traffic channel in the normal operating state into the multidimensional visualization channel model, obtaining multidimensional feature data of the channel in the normal operating state of the smart home, and setting a threshold range of the multidimensional feature data of the channel based on the multidimensional feature data of the channel in the normal operating state of the smart home; Acquire all network traffic channels of the user's smart home in real time, input all network traffic channels into the multidimensional visualization channel model, acquire real-time channel multidimensional feature data, compare the real-time channel multidimensional feature data with the channel multidimensional feature threshold range, and acquire network traffic hidden channels based on the comparison operation; Based on the channel anomaly analysis library, perform anomaly analysis on the multi-dimensional channel data of the network traffic hidden channel, obtain the anomaly analysis results, and obtain the blocking level of the anomaly analysis results; The network traffic hidden channel is blocked based on the blocking level of the network traffic hidden channel.

[0007] As a further solution of the present invention, obtaining a network traffic channel in a normal operating state of a smart home in a user's home, inputting the network traffic channel in the normal operating state into the multidimensional visualization channel model, obtaining multidimensional feature data of the channel in the normal operating state of the smart home, and setting a threshold range of the multidimensional feature data of the channel based on the multidimensional feature data of the channel in the normal operating state of the smart home include: When the smart home is in normal operation, extracting the network traffic channel in the normal operation state based on the SPAN port of the smart home, and inputting the network traffic channel into the multi-dimensional visualization channel model; Extract the spatiotemporal characteristic data of the network traffic channel under normal operation based on the spatiotemporal processor of the multi-dimensional visual channel model; The channel protocol analyzer in the multi-dimensional visual channel model obtains the channel protocol characteristic data of the network traffic channel under normal operating conditions; The channel behavior analyzer in the multi-dimensional visual channel model obtains the channel behavior characteristic data of the network traffic channel under normal operating conditions; The channel entropy value calculator in the multi-dimensional visual channel model is used to obtain the channel entropy value characteristic data of the network traffic channel under normal operating conditions; Constructing channel multidimensional feature data according to the channel spatiotemporal feature data, the channel protocol feature data, the channel behavior feature data and the channel entropy feature data; Acquire multiple sets of multi-dimensional feature data of channels in a normal operating state of the smart home, and obtain a threshold range of the multi-dimensional feature data of channels through the multiple sets of multi-dimensional feature data of channels in a normal operating state of the smart home.

[0008] As a further embodiment of the present invention, the method further comprises: The normal operating state indicates that there is no hidden channel for network traffic when the smart home is running; The channel spatiotemporal characteristic data is represented by data on the channel's temporal and spatial variation characteristics; The channel protocol characteristic data is represented as a set of protocol-related parameters or characteristics used by the channel; The channel behavior characteristic data is expressed as statistical indicators or event characteristics that describe the channel behavior pattern; The channel entropy value characteristic data is represented as the entropy value of the channel characteristic.

[0009] As a further solution of the present invention, the step of obtaining multiple sets of multi-dimensional channel feature data under normal operation of the smart home and obtaining a threshold range of the multi-dimensional channel feature data using the multiple sets of multi-dimensional channel feature data under normal operation of the smart home includes: According to multiple groups of channel multidimensional feature data under normal operation of the smart home, an error range of the channel multidimensional feature data under normal operation of the smart home is obtained, and a threshold range of the channel multidimensional feature data is set based on the error range.

[0010] As a further solution of the present invention, the method of acquiring all network traffic channels of a smart home in a user's home in real time, inputting all network traffic channels into the multidimensional visualization channel model, acquiring real-time channel multidimensional feature data, performing a comparison operation on the real-time channel multidimensional feature data with a channel multidimensional feature threshold range, and acquiring network traffic hidden channels based on the comparison operation includes: When the smart home is running in real time, the network traffic channel in real time is extracted from the SPAN port of the smart home and input into the multi-dimensional visual channel model to obtain the multi-dimensional feature data of the real-time channel; If the acquired real-time channel multi-dimensional feature data is within the channel multi-dimensional feature threshold range, it indicates that there is no network traffic hidden channel; If the acquired real-time channel multi-dimensional feature data is not within the channel multi-dimensional feature threshold range, it indicates that a network traffic hidden channel exists, and the network traffic hidden channel is acquired based on the real-time channel multi-dimensional feature data.

[0011] As a further solution of the present invention, the method of obtaining a hidden network traffic channel based on real-time channel multi-dimensional feature data includes: If the real-time channel spatiotemporal feature data is not within the channel multi-dimensional feature threshold range, the spatiotemporal network traffic hidden channel is obtained; If the real-time channel protocol feature data is not within the channel multi-dimensional feature threshold range, then the protocol network traffic hidden channel is obtained; If the real-time channel behavior feature data is not within the channel multi-dimensional feature threshold range, then the behavior network traffic hidden channel is obtained; If the real-time channel entropy feature data is not within the channel multi-dimensional feature threshold range, the entropy network traffic hidden channel is obtained; The network traffic hidden channel is constructed based on the spatiotemporal network traffic hidden channel, protocol network traffic hidden channel, behavioral network traffic hidden channel and entropy network traffic hidden channel.

[0012] As a further solution of the present invention, the step of constructing a channel anomaly analysis library includes: Acquire existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, wherein the existing channel multidimensional feature data is represented as existing historical channel multidimensional feature data, and define abnormalities for all existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range; Obtaining all anomalies corresponding to existing channel multidimensional feature data that are not within the channel multidimensional feature threshold range, and classifying the anomalies into blocking levels to obtain blocking levels corresponding to the anomalies; A channel anomaly analysis library is constructed based on existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, anomalies corresponding to the existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, and blocking levels corresponding to the anomalies.

[0013] As a further solution of the present invention, the method of performing anomaly analysis on multi-dimensional channel data of a hidden channel of network traffic based on a channel anomaly analysis library, obtaining anomaly analysis results, and obtaining a blocking level of the anomaly analysis results includes: The type of network traffic hidden channel is determined based on the multi-dimensional channel data of the network traffic hidden channel, and the channel multi-dimensional feature data corresponding to the type of network traffic hidden channel is compared with the existing channel multi-dimensional feature data in the channel anomaly analysis library that is not within the channel multi-dimensional feature threshold range to obtain the anomaly corresponding to the channel multi-dimensional feature data corresponding to the type of network traffic hidden channel and the blocking level corresponding to the anomaly.

[0014] As a further solution of the present invention, the blocking operation on the network traffic hidden channel based on the blocking level of the network traffic hidden channel includes: The blocking levels are divided into primary blocking, intermediate blocking and advanced blocking. Primary blocking means traffic control at the gateway layer, intermediate blocking means device-level physical isolation at the access layer, and advanced blocking means policy solidification at the control layer. If the blocking level of the network traffic hidden channel is primary blocking, the network traffic hidden channel is blocked by performing traffic control on the gateway layer of the smart home; If the blocking level of the network traffic hidden channel is medium, the network traffic hidden channel is blocked by performing device-level physical isolation on the access layer of the smart home; If the blocking level of the network traffic hidden channel is high-level blocking, the network traffic hidden channel is blocked by solidifying the strategy of the control layer of the smart home.

[0015] Based on the above aspects, the embodiment of the present application constructs a multidimensional visualization channel model through a channel feature extractor, wherein the multidimensional visualization channel model includes a channel spatiotemporal processor, a channel protocol parser, a channel behavior analyzer, and a channel entropy calculator, and at the same time constructs a channel anomaly analysis library to obtain the network traffic channel of the user's smart home under normal conditions, and transmits the network traffic channel under normal conditions as input to the multidimensional visualization channel model. At the same time, the multidimensional feature data of the channel under normal conditions of the smart home is obtained, and the channel multidimensional feature data threshold range is obtained according to the multidimensional feature data of the channel under normal conditions of the smart home, and all network traffic channels of the user's smart home are obtained in real time, and all network traffic channels are input into the multidimensional visualization channel model to obtain Real-time channel multidimensional feature data is obtained, and the real-time channel multidimensional feature data is compared with the channel multidimensional feature threshold range to obtain the network traffic hidden channel, which is represented by data that is not within the channel multidimensional feature threshold range. Various hidden channels are accurately identified through channel visualization methods to ensure network security. The multidimensional channel data of the network traffic hidden channel is analyzed according to the channel anomaly analysis library to obtain the analysis results and the blocking level of the analysis results. Finally, the network traffic hidden channel is blocked according to the blocking level of the network traffic hidden channel. The blocking operation is divided into primary blocking, intermediate blocking and advanced blocking. The hidden channel is blocked through flexible and changeable blocking strategies to ensure security while maintaining the reliability of smart home services. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The present invention provides a schematic diagram of the execution flow of a method for detecting and blocking covert channels in smart home network traffic.

[0017] Figure 2 It is a schematic diagram of hierarchical blocking in the smart home network traffic covert channel detection and blocking method provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The present invention will be described in detail below with reference to the accompanying drawings. Figure 1 1 is a schematic diagram of an execution flow of a method for detecting and blocking covert channels of smart home network traffic provided by an embodiment of the present invention. Figure 2 This is a schematic diagram of hierarchical blocking in a method for detecting and blocking covert channels of smart home network traffic provided by an embodiment of the present invention. The following is a detailed introduction to this method for detecting and blocking covert channels of smart home network traffic.

[0019] Step S1: construct a multi-dimensional visual channel model based on a channel feature extractor, wherein the multi-dimensional visual channel model includes a channel spatiotemporal processor, a channel protocol parser, a channel behavior analyzer, and a channel entropy calculator.

[0020] Specifically, the channel space-time processor is mainly used to analyze the changing characteristics of the channel in time and space. It processes the timing and spatial dynamics of the channel, including multipath propagation, delay spread, spatial correlation, etc., to understand the changing patterns of the channel over time and space.

[0021] The channel protocol parser is responsible for analyzing the communication protocol used by the channel, including signaling, frame structure, modulation method, etc., to help understand the data structure and protocol operation in the channel, so as to better perform error detection, error correction and protocol optimization.

[0022] The channel behavior analyzer is used to detect and analyze channel behavior patterns, such as interference patterns, channel stability, and emergencies, to identify abnormal or specific channel states and provide a basis for adaptive adjustment or optimization.

[0023] The channel entropy calculator calculates the entropy of the channel, which refers to the information entropy in the channel and measures the uncertainty or complexity of the information in the channel. A high entropy value means that the channel has rich changes and information content, while a low entropy indicates that the channel is relatively stable or simple.

[0024] Furthermore, the channel spatiotemporal feature data, channel protocol feature data, channel behavior feature data and channel entropy feature data in the channel are extracted through the channel spatiotemporal processor, channel protocol parser, channel behavior analyzer and channel entropy value calculator to achieve the purpose of channel visualization.

[0025] Step S2: obtain the network traffic channel of the user's smart home in normal operating state, input the network traffic channel in normal operating state into the multidimensional visualization channel model, obtain the channel multidimensional feature data in normal operating state of the smart home, and set the channel multidimensional feature data threshold range based on the channel multidimensional feature data in normal operating state of the smart home.

[0026] In this embodiment, step S2 includes: Step S21, when the smart home is in normal operation, extracting a network traffic channel in the normal operation state based on the SPAN port of the smart home, and inputting the network traffic channel into a multi-dimensional visualization channel model; Extract the spatiotemporal characteristic data of the network traffic channel under normal operation based on the spatiotemporal processor of the multi-dimensional visual channel model; For example, the smart curtains are opened at 7:00 every day and the traffic generated is about 50KB; the acquisition of spatial dimension feature data includes locating wired devices and wireless devices through port mapping and RSSI positioning technology, and using the traceroute principle to obtain the communication path between devices.

[0027] The channel protocol analyzer in the multi-dimensional visual channel model obtains the channel protocol characteristic data of the network traffic channel under normal operating conditions; For example, the temperature and humidity sensor is only connected to the bedroom AP. The channel protocol parser obtains the channel protocol feature data in layers, extracts the MAC address and Ethernet type at the data link layer, extracts the IP address and protocol type at the network layer, extracts the transmission characteristics of different protocol types at the transport layer, and extracts the key application fields of different protocol types at the application layer.

[0028] The channel behavior analyzer in the multi-dimensional visual channel model obtains the channel behavior characteristic data of the network traffic channel under normal operating conditions; For example, the channel protocol characteristic data of the smart home is obtained as [source MAC, destination IP, L4 protocol, payload length, TCP flag, HTTP method, MQTT_Topic length]. The channel behavior analyzer obtains the channel behavior characteristic data, first establishes a communication relationship model for smart home devices, extracts the behavior patterns of smart home devices based on time regularity analysis and traffic flow, and then updates the behavior of smart home devices based on the rolling baseline algorithm and establishes a behavior pattern library.

[0029] The channel entropy value calculator in the multi-dimensional visual channel model is used to obtain the channel entropy value characteristic data of the network traffic channel under normal operating conditions; For example, the request and response traffic of the voice assistant are symmetrical. The greenhouse sensor uses a stable small traffic to obtain temperature and humidity. The channel entropy calculator obtains channel entropy feature data, performs preprocessing operations on the obtained traffic by slicing, byte frequency statistics, and small traffic filtering. The entropy value of the traffic is calculated using Shannon entropy calculation, and an entropy feature matrix is constructed according to different traffic types. For example, the entropy value range of unencrypted text is 4.0-5.5, and the entropy value range of encrypted data is 7.2-8.0.

[0030] Constructing channel multidimensional feature data according to the channel spatiotemporal feature data, the channel protocol feature data, the channel behavior feature data and the channel entropy feature data; Acquire multiple sets of multi-dimensional feature data of channels in a normal operating state of the smart home, and obtain a threshold range of the multi-dimensional feature data of channels through the multiple sets of multi-dimensional feature data of channels in a normal operating state of the smart home.

[0031] Specifically, the channel space-time processor extracts channel space-time feature data including time dimension feature data and space dimension feature data. The acquisition of time dimension feature data includes obtaining the main clock of the smart home system gateway module, and synchronizing the time of the smart home's wired devices, Wi-Fi devices and battery devices, obtaining the traffic time interval and calculating the traffic rate, and performing periodic pattern detection on the time dimension characteristics of the smart home through Fourier spectrum analysis.

[0032] In step S22, the normal operating state is represented by the absence of hidden network traffic channels when the smart home is running, the channel spatiotemporal feature data is represented by data on the changing characteristics of the channel in time and space, the channel protocol feature data is represented by a set of protocol-related parameters or features used by the channel, the channel behavior feature data is represented by statistical indicators or event features that describe the channel behavior pattern, and the channel entropy feature data is represented by the entropy value of the channel feature.

[0033] Specifically, the normal operating state does not only indicate that the smart home system is operating normally, but must also ensure that there are no hidden channels of network traffic during the operation of the smart home system. The acquired channel spatiotemporal characteristic data, channel protocol characteristic data, channel behavior characteristic data, and channel entropy characteristic data can be divided into threshold ranges.

[0034] Step S23 , obtaining an error range of the channel multidimensional feature data under normal operation of the smart home according to multiple sets of channel multidimensional feature data under normal operation of the smart home, and setting a threshold range of the channel multidimensional feature data based on the error range.

[0035] Furthermore, the acquired channel spatiotemporal feature data, channel protocol feature data, channel behavior feature data and channel entropy feature data are collectively referred to as channel multidimensional feature data, and multiple sets of channel multidimensional feature data are obtained through a multidimensional visualization channel model. The error range of the channel multidimensional feature data is determined based on the multiple sets of channel multidimensional feature data. The error range is expressed as the normal error allowed by the multidimensional feature data under normal operating conditions, rather than abnormal data. The channel multidimensional feature data threshold range is constructed based on the range of the channel multidimensional feature data. Judgment is made by the threshold range rather than a single threshold, thereby improving the robustness and adaptability of the system, adapting to the actual complex and changeable environment, and reducing the impact of error data.

[0036] Step S3, obtaining all network traffic channels of the user's smart home in real time, inputting all the network traffic channels into the multidimensional visualization channel model, obtaining real-time channel multidimensional feature data, comparing the real-time channel multidimensional feature data with the channel multidimensional feature threshold range, and obtaining the network traffic hidden channel based on the comparison operation.

[0037] In this embodiment, step S3 includes: Step S31, when the smart home is running in real time, extracting the network traffic channel in real time from the SPAN port of the smart home and inputting it into the multi-dimensional visual channel model to obtain multi-dimensional feature data of the real-time channel; If the acquired real-time channel multi-dimensional feature data is within the channel multi-dimensional feature threshold range, it indicates that there is no network traffic hidden channel; If the acquired real-time channel multi-dimensional feature data is not within the channel multi-dimensional feature threshold range, it indicates that a network traffic hidden channel exists, and the network traffic hidden channel is acquired based on the real-time channel multi-dimensional feature data.

[0038] Specifically, the method for obtaining the channel multi-dimensional feature data consistent with the normal operating state is used to obtain the real-time channel multi-dimensional feature data in the real-time operation of the smart home. The real-time channel multi-dimensional feature data may contain hidden channels, and the judgment operation is performed based on the channel multi-dimensional feature threshold range obtained above: If the acquired real-time channel multi-dimensional feature data is within the channel multi-dimensional feature threshold range, it means that the smart home is operating normally and there is no hidden channel for network traffic.

[0039] If the real-time channel multi-dimensional feature data obtained is not within the channel multi-dimensional feature threshold range, it means that there is a hidden channel of network traffic during the operation of the smart home.

[0040] Step S32: if the real-time channel spatiotemporal feature data is not within the channel multi-dimensional feature threshold range, then obtaining the spatiotemporal network traffic hidden channel; If the real-time channel protocol feature data is not within the channel multi-dimensional feature threshold range, then the protocol network traffic hidden channel is obtained; If the real-time channel behavior feature data is not within the channel multi-dimensional feature threshold range, then the behavior network traffic hidden channel is obtained; If the real-time channel entropy feature data is not within the channel multi-dimensional feature threshold range, the entropy network traffic hidden channel is obtained; The network traffic hidden channel is constructed based on the spatiotemporal network traffic hidden channel, protocol network traffic hidden channel, behavioral network traffic hidden channel and entropy network traffic hidden channel.

[0041] Specifically, if the real-time spatiotemporal protocol feature data is not within the channel spatiotemporal feature threshold range in the channel multidimensional feature, it indicates that a hidden spatiotemporal channel exists. The channels that are not within the channel spatiotemporal feature threshold range in the channel multidimensional feature are marked to obtain the hidden spatiotemporal network traffic channel.

[0042] If the real-time channel protocol feature data is not within the channel protocol feature threshold range in the channel multidimensional feature, it indicates that a hidden protocol channel exists. The channels that are not within the channel protocol feature threshold range in the channel multidimensional feature are marked to obtain the hidden channel of the protocol network traffic.

[0043] If the real-time channel behavior feature data is not within the channel behavior feature threshold range in the channel multidimensional feature, it indicates that there is a hidden behavior channel. The channels that are not within the channel behavior feature threshold range in the channel multidimensional feature are marked to obtain the hidden channel of behavioral network traffic.

[0044] If the real-time channel entropy feature data is not within the channel entropy feature threshold range in the channel multidimensional feature, it indicates that there is a hidden entropy channel. The channels that are not within the channel entropy feature threshold range in the channel multidimensional feature are marked to obtain the entropy network traffic hidden channel. The obtained spatiotemporal network traffic hidden channel, protocol network traffic hidden channel, behavior network traffic hidden channel and entropy network traffic hidden channel constitute the network traffic hidden channel.

[0045] Step S4: construct a channel anomaly analysis library, perform an anomaly analysis on the multi-dimensional channel data of the network traffic hidden channel based on the channel anomaly analysis library, obtain an anomaly analysis result, and obtain a blocking level of the anomaly analysis result.

[0046] In this embodiment, step S4 includes: Step S41, obtaining existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, wherein the existing channel multidimensional feature data is represented as existing historical channel multidimensional feature data, and performing an abnormal definition on all existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range; Obtaining all anomalies corresponding to existing channel multidimensional feature data that are not within the channel multidimensional feature threshold range, and classifying the anomalies into blocking levels to obtain blocking levels corresponding to the anomalies; A channel anomaly analysis library is constructed based on existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, anomalies corresponding to the existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, and blocking levels corresponding to the anomalies.

[0047] In this embodiment, existing historical channel multidimensional feature data is obtained and compared with the channel multidimensional feature threshold range, and the existing historical channel multidimensional feature data that is not within the channel multidimensional feature threshold range is obtained. The existing historical channel multidimensional feature data that is not within the channel multidimensional feature threshold range is divided into ranges, and an abnormality is defined for each divided range. A blocking level is divided for each defined abnormality, and the blocking level corresponding to each abnormality is obtained.

[0048] Furthermore, a channel anomaly analysis library is constructed using the existing historical channel multidimensional feature data that is not within the channel multidimensional feature threshold range, the anomalies corresponding to each divided range, and the blocking level corresponding to each anomaly.

[0049] Step S42: Determine the type of the network traffic hidden channel based on the multidimensional channel data of the network traffic hidden channel, compare the channel multidimensional feature data corresponding to the type of the network traffic hidden channel with the existing channel multidimensional feature data in the channel anomaly analysis library that is not within the channel multidimensional feature threshold range, and obtain the anomaly corresponding to the channel multidimensional feature data corresponding to the type of the network traffic hidden channel and the blocking level corresponding to the anomaly.

[0050] Specifically, the multi-dimensional channel data of the network traffic hidden channel is obtained, and it is determined whether the network traffic hidden channel belongs to one or more of the spatiotemporal network traffic hidden channel, the protocol network traffic hidden channel, the behavioral network traffic hidden channel, and the entropy network traffic hidden channel, and the type of the network traffic hidden channel is obtained. The channel multi-dimensional feature data corresponding to the type of the network traffic hidden channel is compared with the existing channel multi-dimensional feature data in the channel anomaly analysis library to obtain the corresponding anomaly and the blocking level corresponding to the anomaly. If multiple anomalies and blocking levels corresponding to multiple anomalies are obtained, the three layers work together to block the network traffic hidden channel.

[0051] Step S5: performing a blocking operation on the network traffic hidden channel based on the blocking level of the network traffic hidden channel.

[0052] In this embodiment, step S5 includes: In step S51, the blocking levels are divided into primary blocking, intermediate blocking and advanced blocking. The primary blocking means traffic control at the gateway layer, the intermediate blocking means device-level physical isolation at the access layer, and the advanced blocking means policy solidification at the control layer.

[0053] Specifically, the hidden channels of network traffic are blocked in different levels, which helps to assess the risks of hidden channels of network traffic at different levels, formulate targeted security measures, and prevent information leakage or malicious attacks. At the same time, the grading also promotes the optimization and standardized management of security policies, improves the overall security of the system, and helps to deeply understand and prevent hidden channels of network traffic, thereby effectively ensuring the confidentiality and integrity of information transmission.

[0054] In step S52, if the blocking level of the network traffic hidden channel is primary blocking, the network traffic hidden channel is blocked by performing traffic control on the gateway layer of the smart home.

[0055] For example, the temperature and humidity sensor should report 1KB of data to the local gateway every 5 minutes. However, if it is detected that the temperature and humidity sensor continuously connects to the overseas IP 23.45.67.89.433 at a rate of 500KB / s, the real-time channel protocol characteristic data is abnormal, and the blocking level of the network traffic hidden channel is determined to be primary blocking. The gateway layer discards the overseas IP and sends a false TCP RST to the temperature and humidity sensor for primary blocking. The abnormal session of the temperature and humidity sensor is terminated overseas within 0.2 seconds, and other normal communications of the device are not affected, such as interaction with the local gateway.

[0056] In step S53, if the blocking level of the network traffic hidden channel is medium blocking, the network traffic hidden channel is blocked by performing device-level physical isolation on the access layer of the smart home.

[0057] For example, if a backdoor is implanted in a camera, and the video stream is encrypted and transmitted to an overseas server, and behavioral analysis detects a continuous outbound traffic of 2MB / s, the real-time channel behavior feature data will be abnormal, and the blocking level of the hidden channel of network traffic will be determined to be intermediate. The / shutdown command will be sent through the CoAP protocol. If there is no response, the corresponding port isolation will be triggered, and the device will be offline within 2 seconds. The attack sample will be obtained, such as extracting the server IP 45.76.211.33, and a behavior report will be generated for subsequent analysis.

[0058] In step S54, if the blocking level of the network traffic hidden channel is high-level blocking, the network traffic hidden channel is blocked by solidifying the policy of the control layer of the smart home.

[0059] For example, hackers exploit Zigbee protocol vulnerabilities to control smart door locks or detect abnormalities in door locks and send encrypted instructions to unknown repeaters. They determine the blocking level of hidden channels of network traffic to be advanced blocking, extract the TLS session ID in the attack traffic, and add it to the device fingerprint library blacklist. Based on the traffic in the normal state in the past 7 days, a new model is generated, which limits the door lock to communicate only with the gateway to solidify the policy, thereby completely blocking the vulnerability attack path.

[0060] Furthermore, if the system continues to be threatened and attacked, the smart home system will adopt a three-level blocking collaborative operation, and at the same time implement corresponding response actions on the gateway layer, access layer and control layer. Through multi-level and multi-link coordination and cooperation, it can achieve comprehensive and rapid security defense, effectively enhance the system's anti-attack capabilities, improve response efficiency, ensure information security, reduce security blind spots, and provide more efficient and reliable protection for responding to complex threats.

[0061] The specific usage and function of this embodiment are described below: First, a multidimensional visual channel model is constructed through a channel feature extractor, wherein the multidimensional visual channel model includes a channel spatiotemporal processor, a channel protocol parser, a channel behavior analyzer, and a channel entropy calculator. At the same time, a channel anomaly analysis library is constructed, and then the network traffic channel of the user's smart home under normal conditions is obtained, and the network traffic channel under normal conditions is transmitted as input to the multidimensional visual channel model. At the same time, the multidimensional feature data of the channel under normal conditions of the smart home is obtained, and the channel multidimensional feature data threshold range is obtained according to the multidimensional feature data of the channel under normal conditions of the smart home. Then, all network traffic channels of the user's smart home are obtained in real time, and all network traffic channels are input into the multidimensional visual channel model to obtain real-time Channel multi-dimensional feature data, compare the real-time channel multi-dimensional feature data with the channel multi-dimensional feature threshold range to obtain the network traffic hidden channel, the network traffic hidden channel is represented as data that is not within the channel multi-dimensional feature threshold range, and accurately identify various hidden channels through channel visualization methods to ensure network security. According to the channel anomaly analysis library, the multi-dimensional channel data of the network traffic hidden channel is analyzed to obtain the analysis results and the blocking level of the analysis results. Finally, the network traffic hidden channel is blocked according to the blocking level of the network traffic hidden channel. The blocking operation is divided into primary blocking, intermediate blocking and advanced blocking. The hidden channel is blocked through flexible and changeable blocking strategies to ensure security while maintaining the reliability of smart home services.

[0062] In addition, an embodiment of the present invention further provides an electronic device, including: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method proposed in the first embodiment of the present invention.

[0063] The following is a detailed introduction to the various components of electronic equipment: The term "processor" is the control center of an electronic device and can be a single processor or a collective term for multiple processing elements. For example, the processor can be one or more central processing units (CPUs), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the first embodiment of the present invention, such as one or more digital signal processors (DSPs) or one or more field programmable gate arrays (FPGAs).

[0064] The processor can execute various functions of the electronic device by running or executing software programs stored in the memory and calling data stored in the memory.

[0065] The memory is used to store the software program for executing the solution of the present invention, and the execution is controlled by the processor. The specific implementation method can refer to the above method embodiment and will not be repeated here.

[0066] The memory may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only (CD-ROM), or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory may be integrated with the processor or exist independently and be coupled to the processor via an interface circuit of the electronic device, and this is not specifically limited in the embodiments of the present invention.

[0067] The above embodiments can be implemented in whole or in part via software, hardware (e.g., circuits), firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product comprises one or more computer instructions or computer programs. When loaded or executed on a computer, the processes or functions described in accordance with the embodiments of the present invention are fully or partially performed. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wireless communication (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium accessible by a computer, or a data storage device such as a server or data center that contains a collection of one or more available media. The available medium can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. The semiconductor media can be a solid-state drive.

[0068] It should be understood that the term "and / or" as used herein simply describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent the existence of A alone, the existence of both A and B, or the existence of B alone. A and B can be singular or plural. Furthermore, the character " / " as used herein generally indicates an "or" relationship between the related objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0069] It should be understood that in the embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0070] The embodiments described above are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A method for detecting and blocking covert channels in smart home network traffic, characterized in that: The method comprises: Building a multi-dimensional visual channel model based on the channel feature extractor, the multi-dimensional visual channel model includes a channel spatiotemporal processor, a channel protocol parser, a channel behavior analyzer, and a channel entropy calculator, and building a channel anomaly analysis library; Obtaining a network traffic channel in a normal operating state of a smart home in a user's home, inputting the network traffic channel in the normal operating state into the multidimensional visualization channel model, obtaining multidimensional feature data of the channel in the normal operating state of the smart home, and setting a threshold range of the multidimensional feature data of the channel based on the multidimensional feature data of the channel in the normal operating state of the smart home; Acquire all network traffic channels of the user's smart home in real time, input all network traffic channels into the multidimensional visualization channel model, acquire real-time channel multidimensional feature data, compare the real-time channel multidimensional feature data with the channel multidimensional feature threshold range, and acquire network traffic hidden channels based on the comparison operation; Based on the channel anomaly analysis library, perform anomaly analysis on the multi-dimensional channel data of the network traffic hidden channel, obtain the anomaly analysis results, and obtain the blocking level of the anomaly analysis results; The network traffic hidden channel is blocked based on the blocking level of the network traffic hidden channel.

2. A method for detecting and blocking covert channels in smart home network traffic according to claim 1, characterized in that: The method of obtaining a network traffic channel in a normal operating state of a smart home in a user's home, inputting the network traffic channel in the normal operating state into the multidimensional visualization channel model, obtaining multidimensional feature data of the channel in the normal operating state of the smart home, and setting a threshold range of the multidimensional feature data of the channel based on the multidimensional feature data of the channel in the normal operating state of the smart home includes: When the smart home is in normal operation, extracting the network traffic channel in the normal operation state based on the SPAN port of the smart home, and inputting the network traffic channel into the multi-dimensional visualization channel model; Extract the spatiotemporal characteristic data of the network traffic channel under normal operation based on the spatiotemporal processor of the channel in the multi-dimensional visual channel model; The channel protocol analyzer in the multi-dimensional visual channel model obtains the channel protocol characteristic data of the network traffic channel under normal operating conditions; The channel behavior analyzer in the multi-dimensional visual channel model obtains the channel behavior characteristic data of the network traffic channel under normal operating conditions; Based on the channel entropy calculator in the multi-dimensional visual channel model, the channel entropy characteristic data of the network traffic channel under normal operating conditions is obtained; Constructing channel multidimensional feature data according to the channel spatiotemporal feature data, the channel protocol feature data, the channel behavior feature data and the channel entropy feature data; Acquire multiple sets of multi-dimensional feature data of channels in a normal operating state of the smart home, and obtain a threshold range of the multi-dimensional feature data of channels through the multiple sets of multi-dimensional feature data of channels in a normal operating state of the smart home.

3. A method for detecting and blocking covert channels in smart home network traffic according to claim 2, characterized in that: The method further comprises: The normal operating state indicates that there is no hidden channel for network traffic when the smart home is running; The channel spatiotemporal characteristic data is represented by data on the channel's temporal and spatial variation characteristics; The channel protocol characteristic data is represented as a set of protocol-related parameters or characteristics used by the channel; The channel behavior characteristic data is expressed as statistical indicators or event characteristics that describe the channel behavior pattern; The channel entropy value characteristic data is represented as the entropy value of the channel characteristic.

4. A method for detecting and blocking covert channels in smart home network traffic according to claim 2, characterized in that: The step of obtaining a plurality of sets of multi-dimensional channel feature data under normal operation of the smart home, and obtaining a threshold range of the multi-dimensional channel feature data through the plurality of sets of multi-dimensional channel feature data under normal operation of the smart home, includes: According to multiple groups of channel multidimensional feature data under normal operation of the smart home, an error range of the channel multidimensional feature data under normal operation of the smart home is obtained, and a threshold range of the channel multidimensional feature data is set based on the error range.

5. A method for detecting and blocking covert channels in smart home network traffic according to claim 1, characterized in that: The method of acquiring all network traffic channels of a smart home in a user's home in real time, inputting all network traffic channels into the multidimensional visualization channel model, acquiring multidimensional feature data of the real-time channels, performing a comparison operation on the multidimensional feature data of the real-time channels with a multidimensional feature threshold range of the channels, and acquiring hidden network traffic channels based on the comparison operation includes: When the smart home is running in real time, the network traffic channel in real time is extracted from the SPAN port of the smart home and input into the multi-dimensional visual channel model to obtain the multi-dimensional feature data of the real-time channel; If the acquired real-time channel multi-dimensional feature data is within the channel multi-dimensional feature threshold range, it indicates that there is no network traffic hidden channel; If the acquired real-time channel multi-dimensional feature data is not within the channel multi-dimensional feature threshold range, it indicates that a network traffic hidden channel exists, and the network traffic hidden channel is acquired based on the real-time channel multi-dimensional feature data.

6. A method for detecting and blocking covert channels in smart home network traffic according to claim 5, characterized in that: The method of obtaining network traffic hidden channels based on real-time channel multi-dimensional feature data includes: If the real-time channel spatiotemporal feature data is not within the channel multi-dimensional feature threshold range, the spatiotemporal network traffic hidden channel is obtained; If the real-time channel protocol feature data is not within the channel multi-dimensional feature threshold range, then the protocol network traffic hidden channel is obtained; If the real-time channel behavior feature data is not within the channel multi-dimensional feature threshold range, then the behavior network traffic hidden channel is obtained; If the real-time channel entropy feature data is not within the channel multi-dimensional feature threshold range, the entropy network traffic hidden channel is obtained; The network traffic hidden channel is constructed based on the spatiotemporal network traffic hidden channel, protocol network traffic hidden channel, behavioral network traffic hidden channel and entropy network traffic hidden channel.

7. A method for detecting and blocking covert channels in smart home network traffic according to claim 1, characterized in that: The construction of the channel anomaly analysis library includes: Acquire existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, wherein the existing channel multidimensional feature data is represented as existing historical channel multidimensional feature data, and define abnormalities for all existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range; Obtaining all anomalies corresponding to existing channel multidimensional feature data that are not within the channel multidimensional feature threshold range, and classifying the anomalies into blocking levels to obtain blocking levels corresponding to the anomalies; A channel anomaly analysis library is constructed based on existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, anomalies corresponding to the existing channel multidimensional feature data that is not within the channel multidimensional feature threshold range, and blocking levels corresponding to the anomalies.

8. The method for detecting and blocking covert channels of smart home network traffic according to claim 1, wherein: The method of performing anomaly analysis on the multi-dimensional channel data of the hidden channel of the network traffic based on the channel anomaly analysis library, obtaining anomaly analysis results, and obtaining a blocking level of the anomaly analysis results includes: The type of network traffic hidden channel is determined based on the multi-dimensional channel data of the network traffic hidden channel, and the channel multi-dimensional feature data corresponding to the type of network traffic hidden channel is compared with the existing channel multi-dimensional feature data in the channel anomaly analysis library that is not within the channel multi-dimensional feature threshold range to obtain the anomaly corresponding to the channel multi-dimensional feature data corresponding to the type of network traffic hidden channel and the blocking level corresponding to the anomaly.

9. A method for detecting and blocking covert channels in smart home network traffic according to claim 1, characterized in that: The blocking operation on the network traffic hidden channel based on the blocking level of the network traffic hidden channel includes: The blocking levels are divided into primary blocking, intermediate blocking and advanced blocking. Primary blocking means traffic control at the gateway layer, intermediate blocking means device-level physical isolation at the access layer, and advanced blocking means policy solidification at the control layer. If the blocking level of the network traffic hidden channel is primary blocking, the network traffic hidden channel is blocked by performing traffic control on the gateway layer of the smart home; If the blocking level of the network traffic hidden channel is medium, the network traffic hidden channel is blocked by performing device-level physical isolation on the access layer of the smart home; If the blocking level of the network traffic hidden channel is high-level blocking, the network traffic hidden channel is blocked by solidifying the strategy of the control layer of the smart home.

Images