A method and system for processing terminal security information in a wireless network

Abstract

This invention discloses a method and system for processing terminal security information in wireless networks, relating to the field of terminal security information technology. The method includes collecting a physical layer feature set and an internal state feature set of the terminal; preprocessing the features using a lightweight edge computing module; arranging the physical layer feature set in chronological order to construct sequential data; recursively calculating the mean and variance of the features to generate a real-time feature baseline range; combining the terminal's internal state feature set with a weighted correction of the real-time feature baseline range to obtain a dynamic baseline range; triggering an alarm based on the dynamic baseline range; triggering re-authentication; and after three consecutive alarm triggers, feeding back to the LSTM model for online updating. This method overcomes the limitations of traditional single-feature authentication, avoids the misjudgment of legitimate signals as abnormal due to multipath effects, reduces the false positive rate through dynamic threshold adjustment, and reduces redundant operations by 30%.

Description

Technical Field

[0001] This invention relates to the field of terminal security information technology, specifically to a method and system for processing terminal security information in a wireless network. Background Technology

[0002] With the rapid development of wireless communication technology, wireless networks have become a core infrastructure for information exchange in modern society, widely used in various fields such as the Internet of Things (IoT), 5G / 6G mobile communication, industrial internet, and smart cities. However, the openness of wireless networks and the mobility and resource constraints of terminal devices pose serious challenges to terminal security. As the access point of a wireless network, the security of terminal devices is directly related to the stable operation and data security of the entire network. In high-speed mobile scenarios such as vehicle-to-everything (V2X) or drone swarms, terminals frequently switch base stations / APs, causing their signal characteristics to fluctuate drastically due to external environmental interference such as multipath effects and obstructions; simultaneously, internal factors such as fluctuations in the terminal's own power level lead to unstable encryption key generation. Traditional static authentication mechanisms frequently trigger false judgments in this scenario due to feature drift.

[0003] Chinese invention application CN115119539A discloses a method, apparatus, and storage medium for recording physical layer characteristics. The method includes a first device receiving a signal from a second device when the connection interval changes; measuring at least one physical characteristic of the received signal; extracting at least one piece of raw data of the at least one physical characteristic of the received signal; and converting the at least one piece of raw data into at least one attribute in a preset format. In this way, the recording of the physical characteristics of Bluetooth Low Energy (BLE) devices is achieved. The proposed framework for a secure service for recording BLE channel physical layer characteristics can be integrated into any platform / operating system environment with a BLE stack, thereby achieving efficient, secure, and automatic recording of BLE channel characteristics.

[0004] In the above invention applications, the first device receives a signal from the second device when the connection interval changes, measures at least one physical feature of the received signal, extracts at least one piece of raw data of the at least one physical feature of the received signal, and converts the at least one piece of raw data into at least one attribute in a preset format. The misjudgment of traditional static authentication mechanisms in high-speed mobile scenarios stems from the rigid processing of dynamic features. Its fixed threshold and lack of context awareness design cannot adapt to dynamic factors such as signal fluctuations and changes in terminal status, resulting in a misjudgment rate of over 30%. The above invention applications only perform efficient and secure automatic recording of BLE channel features and do not solve the problem of misjudgment in high-speed mobile scenarios.

[0005] Therefore, the present invention provides a method and system for processing terminal security information in a wireless network. Summary of the Invention

[0006] (a) Technical problems to be solved

[0007] To address the shortcomings of existing technologies, this invention provides a method and system for processing terminal security information in wireless networks. This invention obtains a dynamic baseline range by weighting and correcting the real-time feature baseline range using a combination of the terminal's internal state feature set. Alarms are triggered based on the dynamic baseline range, re-authentication is initiated, and feedback is fed back to the LSTM model for online updates. By fusing physical layer features with internal states, the limitations of traditional single-feature authentication are overcome, preventing legitimate signals from being misjudged as abnormal due to multipath effects. Dynamic threshold adjustment reduces the false positive rate. A high-security authentication process is only initiated when features deviate from the baseline and the terminal is in a high-risk state, reducing redundant operations by 30%, thereby solving the technical problems described in the background section.

[0008] (II) Technical Solution

[0009] To achieve the above objectives, the present invention provides the following technical solution: a method for processing terminal security information in a wireless network, comprising the following steps:

[0010] Collect the physical layer feature set and the internal state feature set of the terminal, and preprocess the features through a lightweight edge computing module;

[0011] Arrange the terminal physical layer feature sets in chronological order to construct sequence data, and recursively calculate the mean of the features. and variance Generate real-time feature baseline range;

[0012] The dynamic baseline range is obtained by weighting and correcting the real-time feature baseline range by combining the terminal's internal state feature set. An alarm is triggered based on the dynamic baseline range, and re-authentication is triggered. After three consecutive alarms are triggered, the data is fed back to the LSTM model for online update.

[0013] Furthermore, the terminal signal strength RSSI and channel state information CSI are sampled at a frequency of 100Hz by the terminal radio frequency front-end module and compiled into a terminal physical layer feature set.

[0014] RSSI is a key parameter used in wireless communication to measure the strength of received signals, measured in dBm (decibel-milliwatts), and is typically a negative value. The closer the value is to 0, the stronger the signal (e.g., -30 dBm is an extremely strong signal, and -90 dBm is an extremely weak signal). RSSI reflects the propagation loss of the signal from the transmitter to the receiver and is a fundamental indicator for evaluating the quality of wireless links.

[0015] Channel State Indicator (CSI) is a quantitative description of the characteristics of a wireless channel, encompassing multi-dimensional information in the time, frequency, and spatial domains. CSI is typically obtained through channel estimation techniques. In wireless communication systems, the transmitter sends a known pilot signal, and the receiver estimates the channel state based on the received pilot signal, thus obtaining the CSI. CSI may include various parameters to comprehensively describe the channel state. These parameters may include: the channel matrix, which, in MIMO systems, describes the channel gain and phase relationship between the transmit and receive antennas; and channel gain, which represents the degree of signal attenuation during transmission through the channel.

[0016] Phase information represents the phase change of a signal as it propagates through the channel. Delay spread represents the delay difference of a signal due to multipath effects as it propagates through the channel.

[0017] Furthermore, the terminal's battery level E is collected based on a high-precision battery management chip, the terminal's temperature is collected by a temperature sensor, and the terminal's location and speed are obtained based on GPS, which are then organized into a set of internal state features of the terminal.

[0018] Furthermore, the edge computing load is dynamically adjusted based on the terminal's battery level E. When E > 80%, the terminal performs all preprocessing; when E < 30%, the edge server undertakes 90% of the computing tasks.

[0019] Furthermore, when the terminal is stationary, i.e., when the terminal speed is <1, the RF front-end sampling module is turned off, and only the MEMS sensor is kept running in the lowest power mode.

[0020] The edge computing module and the terminal use a heartbeat mechanism. If no valid data is received for three consecutive times, the module will automatically enter deep sleep mode.

[0021] Furthermore, the terminal physical layer feature sets are arranged in chronological order to construct sequence data; the collected N feature values ​​are combined to form the input vector X_t ∈ R^N for time step t, and the features are normalized by Min-Max or Z-Score.

[0022] The LSTM network layer configuration is as follows: the input layer defines the input shape as (window_size, N); the LSTM layer uses 1-3 layers of LSTM, each layer contains 64-256 hidden units, and the activation function is tanh; the fully connected layer output layer is a single neuron for either a regression task or a Softmax classifier for a classification task. For the regression task, mean squared error is selected, and for the classification task, cross-entropy loss is selected.

[0023] Use the Adam optimizer with a learning rate of 0.001-0.0001, combined with a learning rate decay strategy to prevent overfitting. Add a Dropout layer after the LSTM layer with a ratio of 0.2-0.5, or use L2 weight decay.

[0024] Furthermore, window_size is the length of the sliding window, the size of the sliding window is set according to the feature change cycle, and the step size is set to 50%-100% of the window size.

[0025] Furthermore, as the window slides, the mean of the features within the new window is recursively calculated. and variance ,

[0026]

[0027] Based on the current window and Generate the real-time feature baseline range, Baseline_Lower = - k * Baseline_Upper = +k * Where k is the confidence coefficient.

[0028] When the system starts, it first collects initial data of a full window size, such as the feature values ​​(X1, X2, ..., XW) of the first W time steps, and calculates the initial feature mean and variance.

[0029] Furthermore, the terminal speed feature set is obtained from the internal state feature set of the terminal, and the terminal speed correction coefficient is analyzed. :

[0030]

[0031] in, The minimum speed required to trigger threshold correction. The upper limit threshold for speed, For speed sensitivity coefficient, This is the upper limit of the speed correction factor.

[0032] Furthermore, the terminal's internal state feature set and terminal temperature feature set are obtained, and the terminal temperature correction coefficient is analyzed. :

[0033]

[0034] in, For safe temperature threshold, This is the temperature sensitivity coefficient.

[0035] Furthermore, obtain the terminal speed correction coefficient. and terminal temperature correction factor Analyze the internal state correction coefficient of the terminal. The dynamic baseline range is obtained by dynamically adjusting the real-time feature baseline range based on the terminal's internal state correction coefficient.

[0036]

[0037] in, The weights are used to fuse the internal state features of the terminal, and , This is a power constraint term. , =0.8, , =1.

[0038] A system for processing terminal security information in a wireless network includes:

[0039] The terminal feature acquisition module collects the terminal physical layer feature set and the terminal internal state feature set, and preprocesses the features through a lightweight edge computing module.

[0040] The real-time feature baseline generation module arranges the terminal physical layer feature sets in chronological order, constructs sequential data, and recursively calculates the mean of the features. and variance Generate a real-time feature baseline range.

[0041] The feature baseline correction module combines the terminal's internal state feature set to perform weighted correction on the real-time feature baseline range to obtain the dynamic baseline range. Based on the dynamic baseline range, an alarm is triggered, re-authentication is triggered, and feedback is sent to the LSTM model for online update.

[0042] (III) Beneficial Effects

[0043] This invention provides a method and system for processing terminal security information in a wireless network, which has the following beneficial effects:

[0044] 1. Collect terminal physical layer feature sets and terminal internal state feature sets, and preprocess the features through a lightweight edge computing module. The edge module performs feature extraction and noise filtering on the terminal side, compressing the raw data into structured feature vectors, reducing authentication decision latency by more than 60%, and adapting to high-speed scenarios with frequent base station handover; the lightweight design reduces terminal power consumption by 15%, and transmits only key features instead of raw data, saving more than 50% of communication bandwidth, providing a cost-effective solution for resource-constrained scenarios.

[0045] 2. Arrange the terminal physical layer feature sets in chronological order to construct sequence data, and recursively calculate the mean of the features. and variance It generates a real-time feature baseline range, and the dynamic baseline can predict the reasonable range for the next moment, reducing the false positive rate from 30% of the static mechanism to below 5%. The baseline is updated in real time and is tolerant of transient interference, such as a sudden drop in SNR caused by base station handover, triggering alarms only for behaviors that continuously deviate from the baseline.

[0046] 3. By combining the terminal's internal state feature set, the real-time feature baseline range is weighted and corrected to obtain a dynamic baseline range. An alarm is triggered based on the dynamic baseline range, triggering re-authentication, and feedback is fed back to the LSTM model for online updates. By fusing physical layer features with internal state, the limitations of traditional single feature authentication are overcome, avoiding the misjudgment of legitimate signals as abnormal due to multipath effects. Dynamic threshold adjustment reduces the misjudgment rate. The high-security level authentication process is only initiated when the feature deviates from the baseline and the terminal is in a high-risk state, reducing redundant operations by 30%. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating a method for processing terminal security information in a wireless network according to the present invention.

[0048] Figure 2 This is a schematic diagram of the structure of a terminal security information processing system in a wireless network according to the present invention. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] Please see Figure 1 This invention provides a method for processing terminal security information in a wireless network, comprising the following steps:

[0051] Step 1: Collect the physical layer feature set and the internal state feature set of the terminal, and preprocess the features through a lightweight edge computing module.

[0052] Step one includes the following:

[0053] Step 101: Sample the terminal signal strength RSSI and channel state information CSI at a frequency of 100Hz through the terminal radio frequency front-end module, and organize them into a terminal physical layer feature set.

[0054] RSSI is a key parameter used in wireless communication to measure the strength of received signals, measured in dBm (decibel-milliwatts), and is typically a negative value. The closer the value is to 0, the stronger the signal (e.g., -30 dBm is an extremely strong signal, and -90 dBm is an extremely weak signal). RSSI reflects the propagation loss of the signal from the transmitter to the receiver and is a fundamental indicator for evaluating the quality of wireless links.

[0055] Channel State Indicator (CSI) is a quantitative description of the characteristics of a wireless channel, encompassing multi-dimensional information in the time, frequency, and spatial domains. CSI is typically obtained through channel estimation techniques. In wireless communication systems, the transmitter sends a known pilot signal, and the receiver estimates the channel state based on the received pilot signal, thus obtaining the CSI. CSI may include various parameters to comprehensively describe the channel state. These parameters may include: the channel matrix, which, in MIMO systems, describes the channel gain and phase relationship between the transmit and receive antennas; and channel gain, which represents the degree of signal attenuation during transmission through the channel.

[0056] Phase information represents the phase change of a signal as it propagates through the channel. Delay spread represents the delay difference of a signal due to multipath effects as it propagates through the channel.

[0057] Step 102: Collect the terminal power E based on the high-precision battery management chip, collect the terminal temperature based on the temperature sensor, and obtain the terminal location and terminal speed based on GPS, and organize them into a terminal internal state feature set.

[0058] Step 103: Preprocess the features using a lightweight edge computing module to filter out noise.

[0059] The edge computing load is dynamically adjusted based on the terminal's battery level (E). When E > 80%, the terminal performs all preprocessing; when E < 30%, the edge server undertakes 90% of the computing tasks.

[0060] When the terminal is stationary, i.e., the terminal speed is <1, the RF front-end sampling module is turned off, and only the MEMS sensor is kept running in the lowest power mode.

[0061] The edge computing module and the terminal use a heartbeat mechanism. If no valid data is received for three consecutive times, the module will automatically enter deep sleep mode.

[0062] When using this method, refer to steps 101 to 103:

[0063] The system collects physical layer feature sets and internal state feature sets of the terminal, and preprocesses the features through a lightweight edge computing module. The edge module performs feature extraction and noise filtering on the terminal side, compressing the raw data into structured feature vectors, reducing authentication decision latency by more than 60%, and adapting to high-speed scenarios with frequent base station handover. The lightweight design reduces terminal power consumption by 15%, and transmits only key features instead of raw data, saving more than 50% of communication bandwidth, providing a cost-effective solution for resource-constrained scenarios.

[0064] Step 2: Arrange the terminal physical layer feature sets in chronological order to construct sequence data, and recursively calculate the mean of the features. and variance Generate a real-time feature baseline range.

[0065] Step two includes the following:

[0066] Step 201: Arrange the terminal physical layer feature sets in chronological order to construct sequence data. Use the collected N feature values ​​to form the input vector X_t ∈ R^N for time step t, and perform Min-Max normalization or Z-Score standardization on the features.

[0067] The LSTM network layer configuration is as follows: The input layer defines the input shape as (window_size, N). The LSTM layer uses 1-3 layers, each containing 64-256 hidden units, with tanh as the activation function. The fully connected layer outputs a single neuron for either a regression task or a softmax classifier task. Mean squared error (MSE) is chosen for regression, and cross-entropy loss is chosen for classification.

[0068] Use the Adam optimizer with a learning rate of 0.001-0.0001, combined with a learning rate decay strategy to prevent overfitting. Add a Dropout layer after the LSTM layer with a ratio of 0.2-0.5, or use L2 weight decay.

[0069] Where window_size is the length of the sliding window, the size of the sliding window is set according to the feature change period, and the step size is set to 50%-100% of the window size.

[0070] Step 202: When the window slides, recursively calculate the mean of the features within the new window. and variance :

[0071]

[0072] Based on the current window and Generate the real-time feature baseline range, Baseline_Lower = - k * Baseline_Upper = +k * Where k is the confidence coefficient, such as k=3 corresponding to a 99.7% confidence interval.

[0073] When the system starts, it first collects initial data of a full window size, such as the feature values ​​(X1, X2, ..., XW) of the first W time steps, and calculates the initial feature mean and variance.

[0074] When using it, refer to steps 201 and 202:

[0075] Arrange the terminal physical layer feature sets in chronological order to construct sequence data, and recursively calculate the mean of the features. and variance It generates a real-time feature baseline range, and the dynamic baseline can predict the reasonable range for the next moment, reducing the false positive rate from 30% of the static mechanism to below 5%. The baseline is updated in real time and is tolerant of transient interference, such as a sudden drop in SNR caused by base station handover, triggering alarms only for behaviors that continuously deviate from the baseline.

[0076] Step 3: Combine the terminal's internal state feature set to perform weighted correction on the real-time feature baseline range to obtain the dynamic baseline range. Trigger an alarm based on the dynamic baseline range, trigger re-authentication, and feed back to the LSTM model for online update.

[0077] Step three includes the following steps:

[0078] Step 301: Obtain the terminal speed feature set from the terminal's internal state feature set, and analyze the terminal speed correction coefficient. :

[0079]

[0080] in, The minimum speed required to trigger threshold correction. The upper limit threshold for speed, For speed sensitivity coefficient, This is the upper limit of the speed correction factor.

[0081] Step 302: Obtain the terminal temperature feature set from the terminal's internal state feature set, and analyze the terminal temperature correction coefficient. :

[0082]

[0083] in, For safe temperature threshold, This is the temperature sensitivity coefficient.

[0084] Step 303: Obtain the terminal speed correction coefficient and terminal temperature correction factor Analyze the internal state correction coefficient of the terminal. The dynamic baseline range is obtained by dynamically adjusting the real-time feature baseline range based on the terminal's internal state correction coefficient.

[0085]

[0086] in, The weights are used to fuse the internal state features of the terminal, and , This is a power constraint term. , =0.8, , =1.

[0087] Step 304: When the new observed features of the terminal exceed the range of the dynamic baseline, an alarm is triggered, and re-authentication is triggered. After three consecutive alarms are triggered, the data is fed back to the LSTM model for online update.

[0088] When using this method, refer to steps 301 to 303:

[0089] By combining the terminal's internal state feature set with the real-time feature baseline range to obtain a dynamic baseline range, an alarm is triggered based on the dynamic baseline range, triggering re-authentication, and feedback is fed back to the LSTM model for online updates. By fusing physical layer features with internal state, the limitations of traditional single feature authentication are overcome, avoiding the misjudgment of legitimate signals as abnormal due to multipath effects. Dynamic threshold adjustment reduces the false judgment rate, and the high-security level authentication process is only initiated when the feature deviates from the baseline and the terminal is in a high-risk state, reducing redundant operations by 30%.

[0090] Please see Figure 2 This invention provides a system for processing terminal security information in a wireless network, comprising:

[0091] The terminal feature acquisition module collects the terminal physical layer feature set and the terminal internal state feature set, and preprocesses the features through a lightweight edge computing module.

[0092] The real-time feature baseline generation module arranges the terminal physical layer feature sets in chronological order, constructs sequential data, and recursively calculates the mean of the features. and variance Generate a real-time feature baseline range.

[0093] The feature baseline correction module combines the terminal's internal state feature set to perform weighted correction on the real-time feature baseline range to obtain the dynamic baseline range. Based on the dynamic baseline range, an alarm is triggered, and re-authentication is triggered. After three consecutive alarms are triggered, feedback is initiated to the LSTM model for online update.

[0094] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0095] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0096] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A method for handling security information for a terminal in a wireless network, characterized by: It comprises the following steps: Collecting terminal physical layer feature set and terminal internal state feature set, and pre-processing the features through a lightweight edge computing module; Collecting terminal signal strength RSSI and channel state information CSI through a terminal radio frequency front-end module at a frequency of 100 Hz, and arranging them into a terminal physical layer feature set; Collecting terminal power E based on a high-precision battery management chip, collecting terminal temperature through a temperature sensor, and obtaining terminal position and terminal speed based on GPS, and arranging them into a terminal internal state feature set; The terminal physical layer feature sets are arranged in time sequence respectively, sequence data is constructed, and the mean value of the features is calculated recursively and variance , to generate a real-time feature baseline range; Combining the terminal internal state feature set to weight and correct the real-time feature baseline range to obtain a dynamic baseline range, triggering an alarm and triggering re-authentication according to the dynamic baseline range, and feeding back to the LSTM model for online updating after three consecutive alarm triggers; Obtaining a terminal speed feature set in a terminal internal state feature set, and analyzing a terminal speed correction coefficient Obtaining a terminal temperature feature set in the terminal internal state feature set, and analyzing a terminal temperature correction coefficient ; Acquiring a terminal speed correction coefficient and a terminal temperature correction coefficient , analyzing a terminal internal state correction coefficient , and dynamically adjusting a real-time characteristic baseline range according to the terminal internal state correction coefficient to obtain a dynamic baseline range.

2. The processing method for terminal security information in a wireless network according to claim 1, characterized in that: According to the terminal power E, the edge computing load is dynamically adjusted, when E>80%, the terminal executes all pre-processing; when E<30%, the edge server undertakes 90% of the computing tasks.

3. The processing method for terminal security information in a wireless network according to claim 1, characterized in that: The terminal physical layer feature set is arranged in time sequence respectively to construct sequence data; the collected N feature values are combined into an input vector X_t ∈ R^N of time step t, and the features are Min-Max normalized or Z-Score standardized; The LSTM network layer is configured as follows: the input layer defines the input shape as (window_size, N); the LSTM layer uses 1-3 layers of LSTM, each layer contains 64-256 hidden units, and the activation function is tanh; the fully connected output layer is one neuron for regression task or Softmax classifier for classification task, the regression task selects mean square error, and the classification task selects cross-entropy loss.

4. The processing method for terminal security information in a wireless network according to claim 3, characterized in that: Wherein window_size is the length of the sliding window, and the size of the sliding window is set according to the feature change period, and the step is set to 50%-100% of the window size.

5. The processing method for terminal security information in a wireless network according to claim 1, characterized in that: While the window slides, the mean of the features within the new window is recursively computed and variance , based on the current window's and , a real-time feature baseline range, Baseline_Lower = - k * , Baseline_Upper = +k * is generated; where k is a confidence coefficient.

6. A system for handling security information for terminals in a wireless network for implementing the method according to any one of claims 1 to 5, characterized by: It comprises: A terminal feature collection module for collecting terminal physical layer feature set and terminal internal state feature set, and pre-processing the features through a lightweight edge computing module; The real-time feature baseline generation module arranges the terminal physical layer feature sets in chronological order, constructs sequential data, and recursively calculates the mean of the features. and variance Generate real-time feature baseline range; A feature baseline correction module for combining the terminal internal state feature set to weight and correct the real-time feature baseline range to obtain a dynamic baseline range, triggering an alarm and triggering re-authentication according to the dynamic baseline range, and feeding back to the LSTM model for online updating after three consecutive alarm triggers.

Images