A risk-based data grading linkage management and control method

Abstract

The application provides a risk-based data hierarchical linkage management and control method, comprising: analyzing disturbed node range topology connectivity, combining real-time inter-device resource data, evaluating the influence of bandwidth competition and storage access bottleneck on edge device calculation delay fluctuation, and determining high-risk node distribution according to the influence evaluation result; according to the high-risk node distribution, combining the monitoring of the interaction mode of the device cluster, extracting the dynamic characteristics of the abnormal mode, comparing each dynamic characteristic with the corresponding preset threshold to obtain a high-risk node risk score value; if the high-risk node risk score value exceeds the preset score threshold, dynamically adjusting the hierarchical rules established based on the communication topology and the dynamic characteristics, and isolating the data flow of the high-risk node according to the hierarchical rules.

Description

Technical Field

[0001] This invention relates to the field of information technology, and in particular to a risk-based data hierarchical linkage control method. Background Technology

[0002] In today's information age, the Internet of Things (IoT) technology, as a bridge connecting the physical and digital worlds, is undeniably crucial, especially in collaborative scenarios involving clusters of intelligent devices. Ensuring data security and transmission efficiency has become a core requirement. IoT device clusters are widely used in industrial control, smart cities, and other fields, handling massive amounts of data interaction and processing. Security breaches in these clusters pose a significant threat to socio-economic development and public safety. However, existing solutions often fall short in addressing security risks in complex network environments. Many methods rely too heavily on static rules or single detection mechanisms, making it difficult to adapt to the dynamically changing communication environment within device clusters and to effectively balance the conflict between security protection and data transmission efficiency. Against this backdrop, the security management of IoT device clusters faces numerous challenges. The most pressing is the dynamic change in communication structure. When external, spoofed nodes connect, the network topology reorganizes, leading to unpredictable mutations in data traffic patterns. These mutations further inject abnormal data streams, causing fluctuations in computational latency for edge devices due to resource contention during data processing. These latency fluctuations not only affect the real-time performance of data processing but may also mask potential security threats, making it difficult for the system to quickly identify and isolate high-risk data streams. These issues are interconnected, collectively forming a dual dilemma of security protection and efficiency optimization. Therefore, how to effectively isolate high-risk data streams and ensure the priority transmission of low-risk data in the dynamic environment of a device cluster by dynamically adjusting data classification rules through real-time detection of device behavior and assessment of risk levels has become a critical problem that urgently needs to be solved. Summary of the Invention

[0003] This invention provides a risk-based data hierarchical linkage control method, mainly comprising:

[0004] By collecting communication data from IoT device clusters in real time, extracting data packet characteristics, and analyzing the changing trends of these characteristics, the distribution of abnormal data packet sizes and sudden changes in transmission frequency is obtained. Based on the distribution of abnormal data packet sizes and sudden changes in transmission frequency, combined with real-time monitoring data of the communication topology, the presence of spoofed nodes is detected. If such nodes are found, the source address and destination port of abnormal traffic from spoofed nodes are analyzed to determine the range of nodes affected by the disruption in the communication topology. The topological connectivity of the affected node range is analyzed, and combined with real-time inter-device resource data, the impact of bandwidth contention and storage access bottlenecks on edge device computing latency fluctuations is assessed. Based on the impact assessment results, the distribution of high-risk nodes is determined. Based on the distribution of high-risk nodes, combined with monitoring of device cluster interaction patterns, dynamic characteristics of abnormal patterns are extracted, and these dynamic characteristics are... The risk score of a high-risk node is obtained by comparing it with a corresponding preset threshold. If the risk score of a high-risk node exceeds the preset threshold, the hierarchical rules based on communication topology and dynamic features are dynamically adjusted, and the data stream of the high-risk node is isolated according to the hierarchical rules. The computational overhead and inter-node synchronization delay during the encrypted transmission of the high-risk data stream are monitored in real time to obtain the state of the encrypted data stream. It is determined whether the encrypted data stream meets the preset transmission delay and integrity requirements. If it does, the transmission queue of the low-risk data stream that has not been isolated is adjusted. The low-risk data stream is forwarded first according to the transmission queue, feedback data is obtained, and the computing task allocation of the edge devices is adjusted in combination with the real-time monitoring data of energy consumption limit triggering and excessive processor usage. The computing delay fluctuation of the edge devices after the adjustment is obtained, and the operating status of the edge device cluster is evaluated based on the delay fluctuation.

[0005] The technical solutions provided by the embodiments of the present invention may include the following beneficial effects:

[0006] This invention discloses a risk-based data hierarchical linkage control method. It collects communication data in real time and extracts features, analyzes data packet pattern change trends, detects spoofed node access, determines the range of disturbed nodes, assesses the impact of bandwidth contention and storage access bottlenecks on computational latency, and identifies the distribution of high-risk nodes. Furthermore, this invention extracts dynamic features of abnormal interaction patterns, scores high-risk nodes based on risk, and dynamically adjusts hierarchical rules according to the scoring results to isolate high-risk node data streams. Simultaneously, this invention monitors the encrypted transmission process, adjusts the transmission queue of low-risk data streams, and adjusts the allocation of computing tasks for edge devices based on feedback data and real-time monitoring data. Through these measures, this invention achieves comprehensive security monitoring of IoT device clusters, effectively identifies and isolates high-risk nodes, optimizes data transmission and computing resource allocation, and improves the overall security and operational efficiency of the system. Attached Figure Description

[0007] Figure 1This is a flowchart of a risk-based data hierarchical linkage control method according to the present invention.

[0008] Figure 2 This is a schematic diagram of a risk-based data hierarchical linkage control method according to the present invention.

[0009] Figure 3 This is another schematic diagram of a risk-based data hierarchical linkage control method according to the present invention. Detailed Implementation

[0010] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0011] like Figure 1-3 This embodiment of a risk-based data hierarchical linkage control method may specifically include:

[0012] S101. By collecting communication data from the IoT device cluster in real time, extracting data packet characteristics, analyzing the pattern change trend of data packet characteristics, and obtaining the distribution of abnormal data packet size and sudden changes in transmission frequency based on the change trend.

[0013] The communication data stream of an IoT device cluster is captured in real time. Four key parameters are extracted from each data packet: packet size, transmission timestamp, source device identifier, and protocol type. The transmission frequency is calculated based on the timestamp to determine the time interval between adjacent data packets. The data is grouped according to the device identifier to form the communication data sequence of each device. For each device's communication data sequence, a fixed-length time window is used to statistically analyze packet size and transmission frequency. The arithmetic mean of the data within the window is calculated as a baseline. The standard deviation is calculated by taking the square root of the sum of the squares of the differences between each data point and the mean, divided by the number of data points. When the packet size at a certain moment exceeds the mean plus a preset multiple of the standard deviation, it is marked as a packet size outlier. When the rate of change of transmission frequency between adjacent windows exceeds a preset threshold, it is marked as a frequency mutation point. This yields a sequence of marked outliers and mutation points. Based on the marked anomaly and mutation sequence, the number of packet size anomalies and frequency mutations in each period are calculated according to the preset statistical period. An anomaly distribution vector is constructed, where each element of the vector corresponds to the number of anomalies in a statistical period. The trend of change is obtained by calculating the difference between the anomaly distribution vectors of adjacent periods. The period of concentrated anomalies is determined based on the trend of change, and the distribution of packet size anomalies and sending frequency mutations in the time dimension is obtained.

[0014] For example, in the communication monitoring of an IoT device cluster, real-time data acquisition is the foundation of the entire monitoring system. When IoT devices communicate, each data packet carries rich information. Packet size reflects the data volume characteristics of the content transmitted by the device; for example, temperature sensors typically send small data packets of tens of bytes, while camera devices send image data packets of thousands of bytes. The transmission timestamp records the precise moment the data packet was generated; the transmission frequency can be calculated by the difference between the timestamps of adjacent data packets. The source device identifier is used to distinguish different IoT devices, such as smart meters and environmental monitors. The protocol type indicates the communication protocol used for data transmission, such as lightweight protocols like MQTT and CoAP.

[0015] Specifically, when grouping data, the system categorizes data packets from the same device together based on the device identifier, forming a time-series communication data sequence for that device. This grouping method allows for independent analysis of the communication behavior characteristics of each device.

[0016] For example, the communication sequence of a smart meter device may be to send electricity consumption data every 15 minutes, with the packet size remaining stable at around 200 bytes; while the communication sequence of a security camera may suddenly increase the frequency of data packet transmission when movement is detected, and the packet size may jump from the usual 100 bytes to 5000 bytes.

[0017] In one possible implementation, setting the time window is crucial for capturing changes in communication patterns. A fixed-length time window can be set to 5 or 10 minutes, within which characteristic values ​​of packet size and transmission frequency are statistically analyzed. The arithmetic mean is calculated by summing the sizes of all packets within the window and dividing by the number of packets; this benchmark represents the normal communication level of the device during that period. The standard deviation reflects the dispersion of the data; when the size of a packet deviates significantly from the average, it indicates potential abnormal communication behavior.

[0018] It's important to note that the anomaly and mutation point marking mechanism can effectively identify abnormal communication patterns of a device. Abnormal packet sizes usually indicate that the device is transmitting data exceeding normal limits; this could be due to erroneous data caused by device malfunction or abnormal traffic generated by malicious attacks. Sudden changes in transmission frequency reflect drastic changes in the device's communication rhythm; for example, a sensor that normally sends data once per minute suddenly starts sending multiple times per second. Such a sudden change often foreshadows a significant alteration in the device's state.

[0019] Preferably, the temporal distribution characteristics of anomalous behavior are quantified by constructing an anomaly distribution vector. Each statistical period forms an element of the vector, with the element value representing the number of anomalies within that period. The vector difference between adjacent periods reflects the increasing or decreasing trend of anomalous behavior; positive values ​​indicate an increase in anomalies, and negative values ​​indicate a decrease. This trend analysis helps identify the evolutionary patterns of anomalous behavior; for example, gradual growth may indicate a progressively worsening equipment problem, while sudden growth may point to an external attack. By acquiring these distributions, the system can provide accurate data support for subsequent anomaly response and handling.

[0020] S102. Based on the distribution of abnormal data packet size and sudden changes in transmission frequency, and combined with real-time monitoring data of the communication topology, detect whether there are spoofed nodes accessing the network. If so, determine the range of nodes affected by the communication topology by analyzing the source address and destination port of the abnormal traffic from the spoofed nodes.

[0021] Based on the distribution of abnormal packet size and abrupt changes in transmission frequency, the number of abnormal occurrences and abrupt changes for each node are combined to form a two-dimensional abnormal feature vector for that node. Combined with the node connection relationships recorded in the real-time monitoring data of the communication topology, the set of directly connected neighbor nodes for each node is obtained. The Euclidean distance between the abnormal node's feature vector and the normal feature vector of each of its neighbor nodes is calculated, which is the square root of the sum of the squares of the differences between corresponding elements of the two vectors. When the calculated distance exceeds a preset threshold, the node is marked as a suspected spoofing node. Abnormal traffic packets sent by the suspected spoofing node are extracted from its communication data. The source IP address field in the packet header is parsed to obtain the source address. The pre-registered address information of the node in the communication topology registry is queried, and the source address is compared with the registered address. If they do not match, the node is confirmed as a spoofing node, and the unique identifier of the spoofing node and the sequence of abnormal traffic packets sent from it are recorded. By using the recorded abnormal traffic data packet sequence of the spoofed nodes, the target port field of each data packet is parsed. All nodes listening to that port in the communication topology are identified as first-level disturbed nodes that directly receive abnormal traffic. Then, the downstream connected nodes of the first-level disturbed nodes are traced. Nodes that have data interaction with the first-level disturbed nodes and whose traffic characteristics have changed are marked as second-level disturbed nodes. The range of disturbed nodes in the communication topology is obtained by summing the sets of first-level and second-level disturbed nodes.

[0022] For example, in IoT communication networks, the construction of abnormal feature vectors is a key foundation for identifying spoofed nodes.

[0023] Specifically, the two-dimensional anomaly feature vector consists of two dimensions: the first dimension is the number of abnormal data packet sizes, and the second dimension is the number of sudden changes in transmission frequency.

[0024] For example, a normal temperature sensor node might only have one packet size anomaly and zero frequency abrupt changes within an hour, with a feature vector of [1,0]. A malicious node masquerading as a temperature sensor, however, might generate 15 packet size anomalies and 8 frequency abrupt changes within the same time period, resulting in a feature vector of [15,8]. This significant difference allows for effective differentiation between normal and abnormal nodes using Euclidean distance calculation. The Euclidean distance calculation process directly reflects the degree of behavioral difference between nodes.

[0025] In one possible implementation, when calculating the distance between the feature vector [15,8] of node A and the feature vector [1,0] of its neighbor node B, the differences in each dimension are first calculated: the difference for packet size anomalies is 14, and the difference for frequency mutations is 8. These two differences are then squared to obtain 196 and 64 respectively, added together to get 260, and finally the square root is taken to obtain an Euclidean distance value of approximately 16.1. When this distance value exceeds a preset threshold, such as 10, node A is marked as a suspected spoofing node.

[0026] It should be noted that the communication topology registry plays a crucial role in identity authentication within an IoT system. Each legitimate node must register its device identifier, IP address, MAC address, and other information in the registry when accessing the network.

[0027] For example, a smart meter might register with the IP address 192.168.1.100 during deployment. A spoofing node could use forged data packets with a source IP address appearing to be 192.168.1.100, but actually originating from 192.168.2.200. By parsing the packet header and comparing it to the registry, this address mismatch can directly expose the spoofing node's identity. The propagation of abnormal traffic in the network has a cascading effect, which is the basis for distinguishing between first- and second-level compromised nodes.

[0028] For example, when a spoofed node sends a large amount of abnormal data to port 8080, all gateway devices listening on that port become primary affected nodes, directly experiencing the impact of abnormal traffic. When processing this abnormal data, these gateway devices also change their forwarding behavior, sending data packets of abnormal format or frequency to downstream terminal devices. Although these terminal devices do not directly receive the spoofed node's traffic, their normal communication patterns are disrupted, and they are therefore marked as secondary affected nodes.

[0029] Preferably, by tracing the complete propagation path of abnormal traffic, the affected area can be accurately identified.

[0030] For example, a spoofed node in an Industrial Internet of Things (IIoT) might impersonate a data acquisition device and send false data to the central processing unit (CPU). The CPU, acting as a primary affected node, would then issue incorrect commands to multiple actuator nodes based on this false data. These actuator nodes would become secondary affected nodes, and their abnormal actions could further impact data acquisition by connected sensor nodes. This step-by-step tracing approach allows for the identification of the entire affected node range, including one CPU, five actuators, and twelve sensors, forming a complete set of affected nodes and providing accurate scope for subsequent safety responses.

[0031] S103. Analyze the topological connectivity of the affected node range, combine real-time inter-device resource data, assess the impact of bandwidth contention and storage access bottlenecks on edge device computing latency fluctuations, and determine the distribution of high-risk nodes based on the impact assessment results.

[0032] Topological connectivity detection is performed on all nodes within the affected node range. A depth-first traversal is used to obtain the number of reachable paths and hop distance for each node. Combined with real-time collected device resource data, including task queue length (representing task backlog), the ratio of used memory to total memory (representing memory allocation status), and processor utilization percentage, a three-dimensional resource load vector is constructed for each node. Nodes with more than a preset threshold of connected paths are marked as critical connected nodes. Using the marked critical connected nodes and their resource load vectors, the ratio of current bandwidth usage to total bandwidth capacity is calculated as the bandwidth contention coefficient. The product of the storage device read / write request queue length and average response time is used as the storage access pressure value. The task completion times of these nodes at different times are collected, and the absolute value of the difference between adjacent processing times is calculated as the raw value of latency fluctuation. A linear regression is performed with the bandwidth contention coefficient and storage access pressure value as independent variables and the raw value of latency fluctuation as the dependent variable to obtain the weights of bandwidth contention and storage access on latency fluctuation. Based on the influence weights obtained from linear regression, the weighted latency fluctuation assessment value of each key connected node is calculated, which is the sum of the bandwidth competition coefficient multiplied by its weight and the storage access pressure value multiplied by its weight. The assessment values ​​are sorted from high to low, and the top 20% are taken as the high-risk judgment threshold. If the assessment value of a node exceeds the threshold and the number of connected paths in the topology exceeds the preset number, it is determined as a high-risk node. The topological location coordinates and adjacency relationships of all high-risk nodes are recorded to determine the distribution of high-risk nodes and form a high-risk node distribution map.

[0033] For example, depth-first traversal plays a key role in topology connectivity detection, as it can systematically explore all possible paths between nodes.

[0034] Specifically, starting from a disturbed node, the algorithm continues to delve deeper along the network connection until it reaches the terminal node where it can no longer proceed, and then backtracks and explores other branches.

[0035] For example, in an IoT topology containing gateways, routers, and terminal devices, starting from the disturbed gateway node A, it might be found that it connects to 3 router nodes, and each router connects to 5-8 terminal devices. Traversing this network reveals that node A has 18 reachable paths, with an average hop distance of 2.3 hops. This quantified connectivity metric directly reflects the importance of a node in the network.

[0036] In one possible implementation, constructing the three-dimensional resource load vector requires real-time monitoring of several key metrics. The task queue length directly reflects the backlog of tasks; when there are 50 tasks waiting to be processed, it indicates a heavy computational load on the node. Memory allocation status is measured by the ratio of used memory to total memory. For example, if an edge server has a total memory of 8GB and currently uses 6.4GB, the memory utilization rate is 80%. Processor utilization is calculated based on the proportion of busy time within the sampling period. These three dimensions together constitute the resource load vector [50, 0.8, 0.75], comprehensively reflecting the resource pressure status of the node.

[0037] It should be noted that the calculation of the bandwidth contention coefficient involves real-time traffic monitoring and capacity analysis. For a critical connectivity node with a total network interface bandwidth of 100Mbps, when the current total uplink and downlink traffic reaches 85Mbps, the bandwidth contention coefficient is 0.85. The storage access pressure value comprehensively considers both request density and response latency.

[0038] For example, when the read / write request queue length of a storage device is 20 requests and the average response time is 15 milliseconds, the storage access pressure value is calculated to be 300. The larger this value, the heavier the load on the storage subsystem and the more significant the impact on overall performance. Linear regression provides a quantitative analysis method for evaluating the weight of influence. By collecting data at multiple time points, such as a node's task processing time being 120 milliseconds at time t1 and 180 milliseconds at time t2, the original latency fluctuation value is 60 milliseconds. Regression analysis of multiple sets of bandwidth contention coefficients, storage access pressure values, and corresponding latency fluctuation values ​​may yield a bandwidth contention weight coefficient of 0.6 and a storage access weight coefficient of 0.4. This indicates that in this network environment, bandwidth resources have a more significant impact on latency fluctuation.

[0039] Preferably, a dynamic threshold division method is used to identify high-risk nodes. After sorting the weighted delay fluctuation assessment values ​​of all nodes, the top 20% are taken as the high-risk interval.

[0040] For example, the 20 nodes with the highest evaluation values ​​out of 100 nodes may have evaluation values ​​ranging from 450 to 800. A node with an evaluation value of 520 and 15 connected paths (exceeding the preset 10) is identified as a high-risk node. This dual-judgment mechanism considers both the performance risk of a node and its impact on the topology. Creating a high-risk node distribution map requires recording detailed information for each high-risk node. Topological location coordinates can be represented by hierarchy and sequence number, such as the 5th node in the second layer being denoted as L2-N5. Adjacency relationships record the direct connections between nodes, such as L2-N5 being connected to L1-N2, L3-N8, and L3-N12. This information clearly shows the clustering of high-risk nodes in the network, providing a precise basis for subsequent risk mitigation measures.

[0041] S104. Based on the distribution of high-risk nodes and the monitoring of the interaction mode of the device cluster, extract the dynamic features of the abnormal mode, and compare each dynamic feature with the corresponding preset threshold to obtain the risk score value of the high-risk node.

[0042] Based on the node locations recorded in the high-risk node distribution map, the device cluster interaction behavior of each high-risk node is monitored in real time. Request-response patterns and broadcast communication patterns between nodes are identified, and the interaction frequency is calculated by counting the number of interactions per unit time. The source and destination nodes of the data flow are recorded to determine the flow direction. When the interaction frequency exceeds a preset multiple of the node's average interaction frequency over the past seven days, it is marked as an interaction frequency anomaly. When the data flow direction does not match the node connection relationship defined in the network topology, it is marked as a data flow direction anomaly. When the instantaneous traffic exceeds a preset proportion of the link bandwidth capacity, it is marked as a traffic burst impact anomaly. For the three modes of interaction frequency anomaly, data flow direction anomaly, and traffic burst impact anomaly, dynamic feature parameters are extracted respectively. The time difference between the request sending time and the response receiving time is calculated to obtain the interaction delay value. The maximum traffic value within a preset time window is counted as the traffic peak value. The interaction delay value and traffic peak value of each anomaly mode are combined to form a dynamic feature data pair for that anomaly mode. Simultaneously, the duration of each anomaly mode and the number of occurrences within the monitoring period are accumulated. Based on the dynamic characteristic data pairs of the three abnormal modes, their duration and occurrence frequency, the interaction latency value of each abnormal mode is compared with the corresponding preset latency threshold. If it exceeds the threshold, it is linearly mapped to a latency anomaly score of 0 to 100 according to the excess ratio. The traffic peak is compared with the preset peak threshold and mapped to the traffic anomaly score in the same way. Combining the proportion of duration to monitoring period and the proportion of occurrence frequency to total interaction frequency as influencing factors, the sum of the latency anomaly score, traffic anomaly score and the product of the two influencing factors is calculated to obtain the risk score value of the high-risk node.

[0043] For example, monitoring the interaction patterns of device clusters is an important means of identifying network anomalies.

[0044] In one possible implementation, the request-response mode involves node A sending a data request to node B, and node B processing it and returning response data. This one-to-one interaction has a clear directionality. In contrast, the broadcast communication mode involves a node simultaneously sending the same information to multiple nodes, such as a sensor node broadcasting a status update to all gateways. By capturing network data packets in real time and parsing their header information, the characteristics of these two interaction modes can be accurately identified.

[0045] Specifically, the determination of abnormal interaction frequency needs to be based on historical data. A temperature sensor node might send an average of 120 data points per hour over the past seven days; this historical average serves as the benchmark. If real-time monitoring detects that the node sends 600 data points in a particular hour, reaching five times the historical average and exceeding a preset threshold of three times, it is marked as having an abnormal interaction frequency. This baseline-based approach can adapt to the differences in normal behavior among different devices. The identification of abnormal data flow relies on predefined connections within the network topology.

[0046] For example, in the Industrial Internet of Things (IIoT), sensor nodes should only send data to their respective gateways, and specific data exchange paths exist between gateways. When a monitoring system detects a sensor sending data directly to an unrelated gateway, or a data flow loop, this violation of the topology definition constitutes an abnormal data flow direction. Sudden traffic spikes are determined by comparing instantaneous traffic with link capacity. For instance, if a 100Mbps link suddenly experiences 95Mbps of traffic, reaching 95% of its capacity, it exceeds the preset threshold of 80%.

[0047] It should be noted that the extraction of dynamic features provides a quantitative basis for subsequent risk assessment. Interaction latency is calculated using timestamps recorded in data packets. For example, if a request packet is sent at 10:00:00.100 and a response packet is received at 10:00:00.350, the interaction latency is 250 milliseconds. Traffic peaks are determined by continuously sampling within a 5-minute time window, recording the traffic value per second, and taking the maximum value as the traffic peak for that window. These dynamic features directly reflect the real-time status of network performance.

[0048] In one embodiment, the risk score is calculated using a multi-dimensional comprehensive evaluation method. When the interaction latency of a node is 300 milliseconds, while the preset threshold is 200 milliseconds, exceeding the threshold by 50%, a latency anomaly score of 50 is obtained through linear mapping. Simultaneously, if the node's peak traffic reaches 90 Mbps, exceeding the preset threshold of 60 Mbps by 50%, the mapped traffic anomaly score is also 50. The calculation of the influencing factors considers the persistence and frequency of the anomalies; for example, an anomaly lasting 30 minutes accounts for 50% of a 1-hour monitoring cycle, and 100 anomalies occur accounting for 10% of a total of 1000 interactions.

[0049] Preferably, the risk score is calculated using a weighted average: a latency anomaly score of 50 points multiplied by a duration ratio of 0.5 equals 25 points, and a traffic anomaly score of 50 points multiplied by a frequency ratio of 0.1 equals 5 points. The sum of these two scores yields a risk score of 30 points for the node. This scoring mechanism comprehensively considers the severity, duration, and frequency of anomalies, providing a complete picture of the node's risk status and offering accurate quantitative data for network security management.

[0050] S105. If the risk score of a high-risk node exceeds the preset score threshold, the hierarchical rules based on the communication topology and dynamic characteristics will be dynamically adjusted, and the data flow of the high-risk node will be isolated according to the hierarchical rules.

[0051] If a high-risk node's risk score exceeds a preset threshold, the difference between the node's score and the threshold is obtained. The node's hierarchical depth in the communication topology, the number of directly connected neighboring nodes, and previously obtained dynamic characteristics of interaction latency and traffic peaks are extracted. Based on the proportion of the score exceeding the threshold, the node is classified into three isolation levels: severe risk, medium risk, and mild risk. A hierarchical rule record is constructed, containing the node's unique identifier, its isolation level, a list of allowed target nodes, and data transmission rate limits. Using this hierarchical rule record, access control entries are generated to deny severe-risk nodes from sending data to all critical infrastructure nodes; traffic control entries are generated to limit the data transmission rate of medium-risk nodes to a preset percentage of the normal rate; and audit entries are generated to record all communication behaviors of mild-risk nodes. These control entries are then configured into the filtering rules of the gateways or switches connected to the nodes. Based on the configured filtering rules, data packets sent by high-risk nodes are checked in real time. When the destination address of a data packet matches the rejection list, the data packet is discarded directly. When rate limiting is required, data packets exceeding the limit are temporarily stored in a preset memory queue and sent later. By modifying the routing table to delete direct routing entries from high-risk nodes to sensitive nodes, isolation control of data flows from high-risk nodes is achieved.

[0052] For example, precise risk stratification is the foundation for achieving differentiated isolation control.

[0053] Specifically, when a node's risk score is 85, exceeding the preset threshold of 60 by 25 points (41.7% of all nodes), this significant exceedance indicates a serious security threat to the node. Layer depth reflects the importance of a node's position in the network topology; for example, a core routing node in the first layer has a larger influence range than a terminal sensor node in the third layer. The number of directly connected neighboring nodes reflects the node's connectivity density; a gateway connecting 20 nodes has a higher propagation risk than an edge device connecting only 3 nodes.

[0054] In one possible implementation, the three isolation levels are based on a multi-dimensional assessment. The severe risk level corresponds to nodes with scores exceeding the threshold by more than 40% and located in the first two layers of the topology; compromise of these nodes would cause widespread impact. The moderate risk level includes nodes with scores exceeding 20-40% or located in the middle layers; their threat level is relatively controllable. The mild risk level consists of edge nodes with scores only slightly exceeding the threshold, primarily for preventative monitoring. Each level corresponds to a different isolation strength, forming a tiered security protection system.

[0055] It should be noted that the construction of hierarchical rule records must include complete control information. Node unique identifiers use device MAC addresses or pre-assigned ID numbers to ensure uniqueness throughout the network. The list of target nodes allowed for communication explicitly specifies which nodes a node can exchange data with; for example, a critically risky node may only be allowed to communicate with monitoring nodes within an isolated network segment. Data transmission rate limits are set based on normal business needs; for example, limiting the transmission rate of a moderately risky node to 30% of its normal rate ensures basic functionality while limiting potential harm. The generation of access control entries reflects the specific implementation of hierarchical isolation.

[0056] For example, for a node N1 marked as high-risk, the system-generated rejection rule includes the MAC address of N1 as the source address, the address range of all data center servers as the destination address, and the action is DROP. This rule directly blocks the possibility of the high-risk node sending any data to critical infrastructure. Flow control entries are more granular, using a token bucket algorithm to implement rate limiting, allowing only a preset number of packets to pass through per second, with any excess packets entering a waiting queue.

[0057] Preferably, real-time execution of filtering rules ensures the effectiveness of isolation measures. When a high-risk node attempts to send a data packet, the gateway device first checks the source and destination addresses in the packet header. If a denial rule is matched, the packet is immediately dropped, and a security log is generated. For data flows requiring rate limiting, the system maintains a buffer queue, releasing data packets at a set rate. When the queue is full, newly arriving data packets are dropped, thus achieving backpressure control. Modification of the routing table is a key means of achieving network layer isolation. By deleting routing entries from high-risk nodes to sensitive nodes, even if malicious data packets pass access control, they cannot find a path to their destination.

[0058] For example, if there was originally a route A->R1->R2->B from node A to database server B, after deleting the relevant entry, the data packets sent by node A will be dropped because they cannot find the next hop.

[0059] S106. Monitor the computational overhead and inter-node synchronization delay during the encrypted transmission of high-risk data streams in real time, obtain the state of the encrypted data stream, and determine whether the encrypted data stream meets the preset transmission delay and integrity requirements. If it does, adjust the transmission queue of the low-risk data streams that have not been isolated.

[0060] When applying symmetric encryption algorithms to encrypt high-risk data streams, the processor utilization percentage and the number of bytes of memory used per second are collected in real time as computational overhead data. The timestamps of data packets being encrypted at the sending node and decryption starting at the receiving node are recorded, and the difference between the two is calculated to obtain the synchronization delay in milliseconds between nodes. The ratio of the number of bytes in the data packet before encryption to the number of bytes in the data packet after encryption, as well as the number of milliseconds consumed by the encryption operation, are obtained, forming a data stream status record that includes computational overhead, synchronization delay, size ratio, and encryption time. The synchronization delay value is extracted from the data stream status record and compared with a preset maximum allowable transmission delay threshold. At the same time, the hash value generated by the message digest algorithm is calculated for the encrypted data, and this hash value is compared byte by byte with the original hash value carried in the data packet header to verify integrity. If the synchronization delay value is less than the delay threshold and the two hash values ​​are exactly the same, the encrypted data stream is determined to meet the transmission requirements, and the number of megabits of network bandwidth currently occupied by the high-risk data stream that meets the requirements is counted. Based on the statistics of high-risk data stream bandwidth usage, the remaining allocable bandwidth is obtained by subtracting the usage amount from the total bandwidth capacity. The service type identifier of each low-risk data stream is obtained to determine its transmission priority level. Transmission time slots and bandwidth shares are allocated to low-risk data streams in descending order of priority. The queue position of high-priority data streams is moved forward, and the queue position of low-priority data streams is moved backward, thus completing the adjustment of the transmission queue.

[0061] For example, symmetric encryption algorithms play a key role in protecting high-risk data streams, characterized by the use of the same key for encryption and decryption, and faster processing speed.

[0062] Specifically, when encrypting data using the AES-128 algorithm, the original data is divided into 128-bit blocks and processed one block at a time. The encryption process causes a change in the data packet size; for example, an original 1000-byte data packet may become 1024 bytes after encryption. This is because padding data and initialization vectors need to be added. This size change directly affects network transmission efficiency, therefore, the size ratio before and after encryption needs to be recorded as an evaluation metric.

[0063] In one possible implementation, real-time monitoring of computational overhead is achieved through system performance counters. Processor utilization reflects the CPU resource consumption of encryption operations; when processor utilization rises from the usual 30% to 75%, it indicates that encryption operations consume 45% of the processing power. Memory usage is reflected in the encryption buffer and key storage; a typical encryption session may occupy 2MB of memory. This overhead data is collected once per second, forming a continuous monitoring sequence, providing foundational data for subsequent performance evaluation.

[0064] It's important to note that the synchronization delay between nodes involves multiple stages. After the data packet is encrypted at the sending node, it needs to be transmitted over the network to reach the receiving node. This process includes network propagation delay and queuing delay. The accuracy of the timestamp recording directly affects the accuracy of the delay measurement, and millisecond-level precision is typically used.

[0065] For example, if the sending node completes encryption at 10:15:30.250 and the receiving node begins decryption at 10:15:30.380, the synchronization delay is 130 milliseconds. This delay includes network transmission time and intermediate device processing time. Message digest algorithms play a crucial role in integrity verification. The SHA-256 algorithm can generate a fixed 256-bit hash value from data of any length; even a small change in the data will result in a significant change in the hash value. The sending end calculates the hash value of the original data before encryption and appends it to the packet header. The receiving end recalculates the hash value after decryption and compares the two hash values ​​to determine if the data has been tampered with during transmission. This mechanism ensures data integrity even in insecure network environments.

[0066] Preferably, service type identifiers provide a standard basis for traffic priority allocation. In an IoT environment, real-time control commands are typically identified as having the highest priority, and their transmission cannot have significant delays; periodic status reports have medium priority, tolerating some delays; while non-critical information such as log data has low priority. When a high-risk data stream occupies 60Mbps of bandwidth, and the total bandwidth is 100Mbps, the remaining 40Mbps needs to be reasonably allocated among various low-risk data streams. The transmission queue adjustment adopts a dynamic priority sorting mechanism. High-priority control command packets are moved to the front of the queue to ensure they can get a transmission opportunity immediately. Medium-priority status data is arranged in the middle according to the first-in, first-out principle. Low-priority log data is pushed to the end of the queue and can only get a transmission opportunity after the high-priority data transmission is completed. This hierarchical queue management mechanism not only ensures the real-time requirements of critical services but also makes full use of network resources, achieving optimal transmission efficiency under security constraints.

[0067] S107. Prioritize forwarding low-risk data streams according to the transmission queue, obtain feedback data, and combine real-time monitoring data of energy consumption limit triggering and excessive processor usage to adjust the computing task allocation of edge devices, obtain the computing latency fluctuation of edge devices after the adjustment, and evaluate the operating status of the edge device cluster based on the latency fluctuation.

[0068] Based on the adjusted transmission queue, low-risk data streams are prioritized for forwarding to the target node. The transmission completion time and reception confirmation time of each data stream are recorded. The transmission success rate is calculated by the ratio of the number of successful transmissions to the total number of transmissions; the average response time is calculated by the arithmetic mean of all response times; and the packet loss rate is calculated by the ratio of the number of lost packets to the total number of sent packets. Feedback data records are generated. Simultaneously, the instantaneous power consumption (wattage) and processor utilization percentage of each edge device are collected in real time. When the power value exceeds a preset power threshold or the processor utilization rate exceeds a preset percentage threshold, the device is marked as a resource-constrained device. Using the list of marked resource-constrained devices and the corresponding feedback data records, a list of computing tasks being executed on the resource-constrained devices is obtained. Based on the computational complexity index and completion deadline, the tasks are divided into portable and non-portable categories. Portable tasks are transferred to the edge device with a processor utilization rate below a preset threshold and the closest network distance to the resource-constrained device for execution. After the migration is completed, the number of tasks carried by each device and the total load value obtained by summing the task complexity are recorded. Based on the distribution of task quantity and total load value of each device after migration, the processing time of each edge device to complete a single task is continuously collected within the preset monitoring period. The absolute value of the difference between the average processing time of the current period and the average processing time of the previous period is calculated as the calculation delay fluctuation value of the device. The fluctuation values ​​of all devices are summarized to calculate their arithmetic mean and standard deviation. If the average value is less than the preset fluctuation threshold and the standard deviation is less than the preset discrete threshold, the edge device cluster is determined to be in a stable operating state; otherwise, it is determined to be in an abnormal operating state.

[0069] For example, the priority forwarding mechanism for low-risk data streams embodies the essence of hierarchical management.

[0070] In one possible implementation, the transmission queue is sorted according to the risk level and service priority of the data streams. Low-risk real-time monitoring data is placed at the front of the queue to get faster transmission opportunities. When a data packet from a temperature sensor enters the queue, the system records its entry timestamp and the transmission completion time after the packet is sent; the difference between the two is the queuing delay. Simultaneously, the receiving end sends an acknowledgment message upon receiving data; the time interval from transmission completion to receiving the acknowledgment reflects the network transmission quality.

[0071] Specifically, constructing feedback data records requires precise statistical calculations. The transmission success rate is calculated by dividing the number of successfully received acknowledgments within the statistical time window by the total number of packets sent. For example, if 1000 packets are sent and 980 are successfully received, the success rate is 98%. The average response time is the sum of the response times of all successful transmissions divided by the number of successful transmissions, reflecting the overall network latency level. Packet loss rate calculation focuses on transmission failures; 20 lost packets represent a 2% packet loss rate, which directly impacts the service quality of upper-layer applications.

[0072] It is important to note that energy consumption monitoring is particularly important in edge computing environments. Edge devices are typically deployed in resource-constrained environments, and instantaneous power consumption reflects the real-time energy consumption of these devices.

[0073] For example, an edge gateway with a rated power of 50 watts might experience a surge in power to 45 watts when handling intensive computing tasks, approaching 90% load. Processor utilization, obtained through the operating system's performance counters, reflects the intensity of computing resource usage. When both metrics exceed thresholds simultaneously, it indicates the device is under high load, and further increasing tasks could lead to a sharp performance drop or device failure. Task migration decisions are based on multiple considerations. Computational complexity metrics can be derived by comprehensively evaluating the number of floating-point operations, memory access patterns, and data processing volume of the task.

[0074] For example, the complexity metric for video stream analysis tasks is 8.5, while that for simple sensor data aggregation tasks is only 2.3. Deadlines are set based on business requirements; real-time control tasks typically need to complete within 100 milliseconds, while batch analysis tasks can tolerate delays of several seconds. Portable tasks are usually those with high complexity but relatively lenient latency requirements, such as log analysis and data backup.

[0075] Preferably, a multi-factor comprehensive evaluation method is adopted for selecting target devices for task migration. Network distance is measured by hop count or round-trip latency; selecting the closest device can reduce migration overhead and communication latency. Simultaneously, the processor utilization of the target device must be below a set threshold, such as 30%, to ensure sufficient computing power to handle the new task. After migration, the system recalculates the load distribution of each device. The total load value is obtained by summing the complexity indicators of all tasks, which directly reflects the computing pressure on the devices. Monitoring computational latency fluctuations provides a quantitative basis for cluster status assessment. In each monitoring cycle, the system records the time from the start of each task to its completion. For example, if a device's average processing time is 150 milliseconds in the first cycle and 180 milliseconds in the second cycle, the fluctuation value is 30 milliseconds. By collecting the fluctuation values ​​of all devices and calculating statistical characteristics, the stability of the cluster can be comprehensively evaluated. When the mean fluctuation is controlled within 20 milliseconds and the standard deviation is less than 10 milliseconds, it indicates that the cluster load is well balanced, the performance of each device is stable, and the overall operating status is healthy.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A risk-based data-driven hierarchical and collaborative management and control method, characterized in that, The method includes: real-time acquisition of communication data from an IoT device cluster, extraction of data packet features, analysis of the changing trends of the data packet feature patterns, and acquisition of the distribution of abnormal data packet size and sudden changes in transmission frequency; based on the distribution of abnormal data packet size and sudden changes in transmission frequency, combined with communication topology monitoring data, detection of spoofed node access, analysis of the source address and destination port of abnormal traffic from spoofed nodes, and determination of the range of disturbed nodes in the communication topology, including: based on the distribution of abnormal data packet size and sudden changes in transmission frequency, combining the number of node anomalies and the number of sudden changes to generate a two-dimensional anomaly feature vector, combining the node connection relationships in the communication topology monitoring data to obtain the set of directly connected neighbor nodes, and calculating the anomaly features. The Euclidean distance between the vector and the normal feature vectors of neighboring nodes is calculated, and nodes whose distance exceeds a preset threshold are marked as suspected spoofing nodes. Abnormal traffic data packets of the suspected spoofing nodes are extracted, the source address in the packet header is parsed, the registered address in the communication topology registry is queried, and the source address is compared with the registered address. Nodes that do not match are confirmed to be spoofing nodes, and the spoofing node identifier and abnormal traffic data packet sequence are recorded. The target port of the abnormal traffic data packet sequence is parsed, and the listening port node in the communication topology is found as a primary disturbed node. The downstream connections of the primary disturbed node are traced, and nodes that interact with the primary disturbed node and whose traffic characteristics change are marked as secondary disturbed nodes. The primary and secondary disturbed nodes are summarized to generate a... The process involves defining the range of affected nodes; analyzing the topological connectivity of the affected node range; combining inter-device resource data to assess the impact of bandwidth contention and storage access bottlenecks on edge device computing latency fluctuations; and determining the distribution of high-risk nodes, including: detecting the topological connectivity of the affected node range using a depth-first traversal method to obtain the number of reachable paths and hop distances between nodes; constructing a three-dimensional resource load vector based on the resource data, including task queue length, memory allocation ratio, and processor utilization; marking nodes with more than a preset threshold of connected paths as critical connected nodes; calculating the ratio of bandwidth usage to total bandwidth capacity for the critical connected nodes; and statistically analyzing the length and response of storage device read / write request queues. The time product is used to collect the task processing completion time, calculate the absolute value of the time difference between adjacent moments, and obtain the latency fluctuation value. Using the bandwidth usage ratio and storage request queue data as independent variables, and the latency fluctuation value as the dependent variable, linear regression is performed to obtain the influence weights, calculate the weighted latency fluctuation evaluation value, and mark nodes whose evaluation values ​​exceed preset limits and whose number of connected paths exceeds a preset number as high-risk nodes, generating the high-risk node distribution. Based on the high-risk node distribution, the interaction mode of the monitoring device cluster is analyzed, dynamic features of abnormal modes are extracted, and the dynamic features are compared with preset thresholds to obtain a risk score for high-risk nodes. The grading rules are dynamically adjusted based on the risk score to isolate the data streams of high-risk nodes.The system monitors the computational overhead and inter-node synchronization latency during the encrypted transmission of high-risk data streams in real time. It obtains the encrypted data stream status and determines whether the encrypted data stream meets preset transmission latency and integrity requirements. If it does, it adjusts the transmission queue of low-risk data streams that are not isolated. Based on the transmission queue, it prioritizes forwarding low-risk data streams, obtains feedback data, and combines this with real-time monitoring data on energy consumption limits and excessive processor usage to adjust the allocation of computing tasks on edge devices. It then obtains the computational latency fluctuations of the edge devices after the adjustment and assesses the operational status of the edge device cluster based on these latency fluctuations.

2. The risk-based data hierarchical linkage control method according to claim 1, characterized in that, The real-time acquisition of IoT device cluster communication data, extraction of data packet features, analysis of the changing trends of the data packet feature patterns, and acquisition of data packet size anomalies and transmission frequency mutation distributions include: intercepting the IoT device cluster communication data stream, extracting the packet size, transmission timestamp, source device identifier, and protocol type of each data packet, calculating the time interval between adjacent data packets based on the transmission timestamp, acquiring the transmission frequency, grouping by source device identifier, and generating a device communication data sequence; for the communication data sequence, using a fixed time window to statistically analyze the packet size and transmission frequency, calculating the arithmetic mean within the window, determining the sum of squares of the differences between the data points and the mean divided by the square root of the number of data points to obtain the standard deviation, marking packet sizes exceeding the mean plus a preset multiple of the standard deviation as anomalies, and marking points where the rate of change of transmission frequency in adjacent windows exceeds a preset threshold as mutation points, generating anomaly point sequences and mutation point sequences; based on the anomaly point sequences and mutation point sequences, calculating the number of anomalies and mutations according to statistical periods, constructing an anomaly distribution vector, calculating the difference between adjacent period vectors, acquiring the changing trend, determining the concentrated period of anomalies, and generating the data packet size anomaly and transmission frequency mutation distributions.

3. The risk-based data hierarchical linkage control method according to claim 1, characterized in that, The step of monitoring the interaction mode of the monitoring device cluster based on the distribution of high-risk nodes, extracting dynamic features of abnormal modes, comparing the dynamic features with preset thresholds, and obtaining a risk score for high-risk nodes includes: monitoring the interaction behavior of high-risk nodes based on the distribution of high-risk nodes, identifying request-response and broadcast communication in the interaction mode, counting the number of interactions per unit time, obtaining the interaction frequency, recording the source node and target node of the data flow, determining the flow direction, marking nodes whose interaction frequency exceeds a preset multiple of the historical average as frequency anomalies, marking nodes whose flow direction does not match the topology connection relationship as direction anomalies, and marking nodes whose instantaneous traffic exceeds a preset proportion of the link bandwidth as sudden anomalies; extracting the interaction latency and traffic peak of the frequency anomaly, direction anomaly, and sudden anomaly respectively, generating dynamic feature data pairs, and accumulating the anomaly duration and occurrence frequency; comparing the interaction latency with a preset latency threshold, mapping the excess proportion as a latency anomaly score, comparing the traffic peak with a preset peak threshold, mapping it as a traffic anomaly score, and combining the duration and occurrence frequency ratio to calculate the sum of the products of the latency anomaly score and the traffic anomaly score to generate the risk score.

4. The risk-based data hierarchical linkage control method according to claim 1, characterized in that, The step of dynamically adjusting the grading rules based on the risk score to isolate high-risk node data streams includes: comparing the risk score with a preset scoring threshold, obtaining the score difference for nodes exceeding the threshold, classifying the risk into severe, moderate, and mild levels based on the difference ratio, and generating grading rules; generating control entries to refuse data transmission to critical nodes for severe-risk level nodes, generating control entries to limit data transmission rate for moderate-risk level nodes, and generating communication behavior audit entries for mild-risk level nodes, configuring the control entries to the gateway device filtering rules; checking high-risk node data packets according to the filtering rules, discarding data packets matching the rejection list, temporarily storing over-rate data packets, deleting routes from high-risk nodes to sensitive nodes, and completing the isolation control of high-risk node data streams.

5. The risk-based data hierarchical linkage control method according to claim 1, characterized in that, The process of real-time monitoring of the computational overhead and inter-node synchronization delay during the encrypted transmission of high-risk data streams, obtaining the encrypted data stream status, determining whether the encrypted data stream meets preset transmission delay and integrity requirements, and adjusting the transmission queue of the unisolated low-risk data streams includes: applying an encryption algorithm to the high-risk data streams, collecting processor utilization and memory usage, recording the encryption timestamp of the sending node and the decryption timestamp of the receiving node, calculating the difference, obtaining the synchronization delay, comparing the number of bytes in the data packets before and after encryption, obtaining the encryption time, and generating a data stream status containing the synchronization delay and encryption time; comparing the synchronization delay with a preset delay threshold, calculating the hash value of the encrypted data and the original hash value, verifying integrity, and statistically analyzing the bandwidth usage of high-risk data streams that meet the requirements; subtracting the bandwidth usage from the total bandwidth to obtain the remaining bandwidth, allocating transmission time slots and bandwidth shares according to the service type identifier of the low-risk data streams, and adjusting the transmission queues.

6. The risk-based data hierarchical linkage control method according to claim 1, characterized in that, The process of prioritizing the forwarding of low-risk data streams according to the transmission queue, obtaining feedback data, and combining real-time monitoring data on energy consumption limit triggers and excessive processor usage to adjust the allocation of computing tasks for edge devices, obtaining the computing latency fluctuations of edge devices after the adjustment, and assessing the operating status of the edge device cluster based on the latency fluctuations includes: forwarding low-risk data streams according to the transmission queue, collecting the power consumption and processor usage of edge devices, marking devices with power or usage exceeding a preset threshold as resource-constrained devices; obtaining a list of computing tasks for the resource-constrained devices, dividing them into migrateable tasks according to task complexity and deadline, transferring the migrateable tasks to adjacent devices with low occupancy, and recording the number of tasks and load values ​​after migration; collecting the task processing time of edge devices, calculating the absolute value of the time difference between adjacent periods, obtaining latency fluctuation values, calculating the average and standard deviation of the fluctuation values, comparing the average and standard deviation with a preset threshold, and determining the cluster operating status.

Images