Internet of things data security management system based on network security

Abstract

The application belongs to the technical field of network security and data security management, and specifically provides a kind of internet of things data security management system based on network security, system mainly includes multi-dimensional feature generation module: the operating parameter of internet of things equipment is acquired, operating parameter is preprocessed, and multi-dimensional feature vector is obtained;Dynamic anomaly score generation module: based on historical multi-dimensional feature vector clustering, dynamic behavior baseline is constructed, the deviation degree of current multi-dimensional feature vector relative to the baseline is calculated, and preliminary anomaly score is obtained.The application effectively solves the problems of insufficient adaptation of device dynamic behavior, lack of multi-device cooperation, weak new attack recognition and slow strategy synchronization in the prior art, and realizes the effects of improving anomaly recognition accuracy, enhancing unknown attack detection capability and guaranteeing efficient synchronization of protection strategy.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security and data security management, and particularly relates to an Internet of Things data security management system based on network security. BACKGROUND

[0002] Internet of Things data security management is a core link for ensuring stable operation of an Internet of Things system, mainly by collecting device operation data, constructing a security model to identify abnormal behavior, relying on an attack feature library to judge potential risks, and maintaining the security of device communication and data transmission.

[0003] When the system detects that a device may have a security risk, the response mechanism is started, which is usually based on single-device abnormality to start isolation, and the defense is enhanced by updating rules, but there are limitations in adapting to the dynamic behavior of the device, and in risk judgment and processing, there is a lack of effective cooperation among multiple devices, which leads to deviation in abnormality identification due to fluctuations in device behavior, insufficient identification ability for new attacks, and difficulty in quickly synchronizing security policies to associated devices after updating the security policies, so that the protection effect is limited and it is difficult to cope with complex and changing security threats in the Internet of Things environment. SUMMARY

[0004] The application provides an Internet of Things data security management system based on network security, which effectively solves the problems of insufficient adaptation to dynamic behavior of devices, lack of cooperation among multiple devices, weak identification of new attacks, and slow policy synchronization in the prior art, and achieves the effects of improving abnormality identification accuracy, enhancing unknown attack detection capability, and ensuring efficient synchronization of protection policies.

[0005] To achieve the above-mentioned purpose, the application adopts the following technical solutions:

[0006] In a first aspect, the application provides an Internet of Things data security management method based on network security, comprising:

[0007] Obtaining operation parameters of an Internet of Things device, preprocessing the operation parameters to obtain a multi-dimensional feature vector; wherein the multi-dimensional feature vector includes a historical multi-dimensional feature vector and a current multi-dimensional feature vector.

[0008] Constructing a dynamic behavior baseline based on historical multi-dimensional feature vector clustering, calculating the deviation degree of the current multi-dimensional feature vector relative to the baseline to obtain a preliminary abnormality score.

[0009] Constructing an overall abnormality score matrix for at least three devices under the same gateway based on the preliminary abnormality scores of the devices, generating a suspicious instruction label through a majority voting mechanism and triggering operation instruction backtracking, and outputting a to-be-confirmed instruction sequence.

[0010] The disassembled to-be-confirmed instruction sequence generates instruction structure features, matches the known attack feature library, performs context semantic analysis and instruction evolution track detection on unknown attacks, and outputs an attack risk index.

[0011] According to the risk index, the device isolation is activated, the dynamic behavior baseline is updated, the devices in the same group are synchronized, the defense effectiveness verification is realized, and the closed-loop response control is realized.

[0012] Further, the operating parameters include at least three of temperature sensor data, voltage and current data, communication traffic values, memory occupancy, and CPU usage.

[0013] Further, the operating parameters are preprocessed to obtain a multi-dimensional feature vector, including:

[0014] The real-time operating parameters are filtered by a physical threshold to generate a basic operating parameter set.

[0015] The basic operating parameter set is resampled at equal intervals to generate time-aligned sampling data.

[0016] The multi-source sensor data in the time-aligned sampling data are fused to generate a multi-dimensional feature vector.

[0017] Further, the dynamic behavior baseline is constructed, including:

[0018] An unsupervised clustering algorithm is used to identify normal data in the historical multi-dimensional feature vector to generate a behavior pattern clustering center.

[0019] Based on the behavior pattern clustering center and the operating parameters within the specified time, an adaptive floating threshold is calculated to generate a dynamic behavior baseline.

[0020] Further, the majority voting mechanism satisfies: when the preliminary abnormal score of a single device is determined to be abnormal by a specified proportion of the remaining devices under the same gateway, the operation instruction backtracking process is triggered.

[0021] Further, the instruction evolution track detection for unknown attacks includes:

[0022] The to-be-confirmed instruction sequence and the historical records of the same type of instructions within the specified time range are obtained to construct an instruction behavior evolution track graph.

[0023] It is identified whether there is a cumulative parameter deviation or a periodic trial call mode in the instruction behavior evolution track graph, and if so, the potential latent attack behavior is marked.

[0024] Further, the attack risk index generation needs to satisfy: when the known attack determination result is an unknown attack, the potential latent attack behavior mark is integrated as a risk coefficient weight into the context semantic analysis, and then the attack risk index is generated.

[0025] Further, the closed-loop response control comprises:

[0026] When the attack risk index exceeds the critical value, a device isolation protocol is activated to generate a security blocking instruction.

[0027] The dynamic behavior baseline of the affected device is updated based on the security blocking instruction to generate a baseline correction parameter.

[0028] The baseline correction parameter is synchronized to the security policy library of all devices in the same group; the real-time running parameters of the device after the execution of the security blocking instruction are collected and compared with the preset expected security state parameters to output a defense effectiveness state identifier.

[0029] Further, the defense effectiveness state identifier triggers the following branches:

[0030] If the defense effectiveness state identifier is valid, a security confirmation signal is generated.

[0031] If the defense effectiveness state identifier is invalid, the step of instruction evolution trajectory detection is re-executed.

[0032] Further, the operation instruction backtracking mechanism specifically comprises: extracting the operation code sequence and data payload of the instruction sequence associated with the suspicious instruction label.

[0033] In a second aspect, the present application provides an Internet of Things data security management system based on network security, which comprises:

[0034] A multi-dimensional feature generation module: obtains the running parameters of the Internet of Things device, pre-processes the running parameters, and obtains a multi-dimensional feature vector; wherein the multi-dimensional feature vector comprises a historical multi-dimensional feature vector and a current multi-dimensional feature vector.

[0035] A dynamic anomaly score generation module: constructs a dynamic behavior baseline based on historical multi-dimensional feature vector clustering, calculates the deviation degree of the current multi-dimensional feature vector relative to the baseline, and obtains a preliminary anomaly score.

[0036] A collaborative attack instruction backtracking module: constructs an overall anomaly score matrix for the preliminary anomaly scores of at least three devices under the same gateway, generates a suspicious instruction label through a majority voting mechanism and triggers operation instruction backtracking, and outputs a to-be-confirmed instruction sequence.

[0037] An enhanced risk analysis module: disassembles the to-be-confirmed instruction sequence to generate instruction structure features, performs context semantic analysis and instruction evolution trajectory detection on unknown attacks after matching a known attack feature library, and outputs an attack risk index.

[0038] A closed-loop security response module: activates device isolation according to the risk index, updates the dynamic behavior baseline and synchronizes the devices in the same group, and realizes closed-loop response control through defense effectiveness verification.

[0039] In a third aspect, the present application provides a network security-based Internet of Things data security management device, comprising a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program to realize the steps of the network security-based Internet of Things data security management method according to the first aspect.

[0040] In a fourth aspect, the present application provides a storage medium, which stores computer program instructions; when the computer program instructions are read and executed by a processor, the steps of the network security-based Internet of Things data security management method according to the first aspect are executed.

[0041] The present application has the following beneficial effects:

[0042] The present application generates a multi-dimensional feature vector by acquiring device running parameters, constructs a dynamic behavior baseline to calculate an abnormal score, combines multi-device collaborative backtracking instructions, analyzes instruction features and attack risks, and finally activates isolation and baseline update to realize a closed-loop response scheme, effectively solving the problems of insufficient adaptation to device dynamic behavior, lack of multi-device collaboration, weak new attack recognition, and slow strategy synchronization in the prior art, and achieving the effects of improving abnormal recognition accuracy, enhancing unknown attack detection capability, and guaranteeing efficient synchronization of protection strategies.

[0043] Other features and advantages of the present application will be described in the following description, and some will become apparent from the description, or will be understood from the practice of the present application. The purposes and other advantages of the present application can be achieved and obtained by the structures indicated in the specification and drawings. BRIEF DESCRIPTION OF DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0045] Figure 1 A schematic diagram of the network security-based Internet of Things data security management system of the present application is shown. DETAILED DESCRIPTION

[0046] In order to solve the problems raised in the background art, the present application generates a multi-dimensional feature vector by acquiring device running parameters, constructs a dynamic behavior baseline to calculate an abnormal score, combines multi-device collaborative backtracking instructions, analyzes instruction features and attack risks, and finally activates isolation and baseline update to realize a closed-loop response scheme.

[0047] To make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0048] In some embodiments, the present application provides a network security-based Internet of Things data security management method, comprising:

[0049] S1. Obtain the running parameters of the Internet of Things device, preprocess the running parameters, and obtain a multi-dimensional feature vector; wherein the multi-dimensional feature vector includes a historical multi-dimensional feature vector and a current multi-dimensional feature vector.

[0050] S2. Construct a dynamic behavior baseline based on the historical multi-dimensional feature vector clustering, calculate the deviation degree of the current multi-dimensional feature vector relative to the baseline, and obtain a preliminary anomaly score.

[0051] S3. Construct an overall anomaly score matrix for the preliminary anomaly scores of at least three devices under the same gateway, generate a suspicious instruction label through a majority voting mechanism and trigger operation instruction backtracking, and output a to-be-confirmed instruction sequence.

[0052] S4. Disassemble the to-be-confirmed instruction sequence to generate instruction structure features, match the known attack feature library, and perform context semantic analysis and instruction evolution trajectory detection on unknown attacks, and output an attack risk index.

[0053] S5. Activate device isolation according to the risk index, update the dynamic behavior baseline and synchronize the same group of devices, and realize closed-loop response control through defense effectiveness verification.

[0054] In some embodiments, the running parameters are preprocessed in S1 to obtain a multi-dimensional feature vector, comprising:

[0055] S11. Physically filter the real-time running parameters to generate a basic running parameter set.

[0056] The running parameters include temperature sensor data, voltage and current data, and communication flow values.

[0057] The temperature sensor data is derived from a temperature sensor deployed on the Internet of Things device, which collects the real-time temperature value of the core component of the device.

[0058] The voltage and current data are generated by a device power management module, including real-time voltage and current values, which are used to analyze the power supply stability of the device, and abnormal voltage fluctuation may indicate a circuit attack.

[0059] The data transmission rate of the communication traffic value recording device network interface can be directly obtained through the device network card chip, and reflects the abnormal communication behavior of the device, such as burst traffic, which may be data leakage.

[0060] The physical threshold is determined according to the safety specification provided by the device manufacturer. For example, the effective range of temperature sensor data is -40℃ to 85℃. When the real-time temperature sensor data is 90℃, it is filtered because it exceeds the physical threshold range.

[0061] The basic operating parameter set only contains valid parameter values that meet the physical safety threshold, such as the filtered voltage and current data 12.3V / 0.5A, communication traffic value 120Kbps, and memory occupancy rate 65%.

[0062] S12. The basic operating parameter set is equally spaced resampled to generate time-aligned sampling data.

[0063] Due to the difference in sampling frequency of different sensors, such as temperature sensor collecting 1 time per second and communication traffic value collecting 10 times per second, linear interpolation is needed to unify the multi-source data to a fixed timestamp.

[0064] S13. The multi-source sensor data in the time-aligned sampling data is fused to generate a multi-dimensional feature vector.

[0065] The voltage and current data can be converted into power features, such as voltage 12.0V and current 0.6A, then the power is ; The communication traffic value and memory occupancy rate are combined into network load features, such as communication traffic value 150Kbps and memory occupancy rate 70%, then the network load is .

[0066] Finally, the power features, network load features, etc. are combined into a multi-dimensional vector containing time-aligned fusion feature values.

[0067] In some embodiments, the dynamic behavior baseline is constructed in S2, including:

[0068] S21. Adopting unsupervised clustering algorithm to identify normal data in historical multi-dimensional feature vector, generating behavior pattern clustering center.

[0069] The clustering algorithm measures the similarity between vectors by Euclidean distance, and classifies similar feature vectors into the same cluster, and the generated behavior pattern clustering center represents the typical feature value of the historical normal behavior pattern.

[0070] For example, the historical data of 10 lighting devices under a certain gateway is clustered into two main clusters:

[0071] Cluster center 1 corresponds to normal working mode: voltage 220V±5%, temperature 35℃±2℃, flow 1KB / s±0.2).

[0072] Cluster center 2 corresponds to energy saving mode: voltage 110V±3%, temperature 28℃±1℃, flow 0.5KB / s±0.1).

[0073] S22. Calculate adaptive floating threshold based on behavior pattern clustering center and running parameters in the recent specified time, and generate dynamic behavior baseline.

[0074] The length of the specified time window is preset according to the type of the device, such as 24 hours for a gateway device.

[0075] For each behavior pattern clustering center, the set of Euclidean distances between the center and all corresponding mode running parameters in the last 24 hours is calculated, and the standard deviation of the distance set is multiplied by a preset coefficient K to generate the floating threshold of that dimension; wherein the coefficient K is determined by the safety level of the device.

[0076] Finally, all the floating thresholds of all dimensions are merged to form the dynamic behavior baseline.

[0077] For example, the voltage clustering center is 220V, the standard deviation of the voltage value in the last 24 hours of normal working mode is 4.2V, and if K=1.5, then the voltage dimension floating threshold is set to ±6.3V (4.2x1.5), and the final dynamic behavior baseline includes [temperature floating threshold ±2.5℃, voltage floating threshold ±6.3V, flow floating threshold ±0.3KB / s].

[0078] The deviation degree and the preliminary anomaly score generation process includes the following steps:

[0079] 1. For each dimension value (such as temperature value, voltage value, flow value) of the current multi-dimensional feature vector, calculate the absolute difference between the value and the behavior pattern clustering center of the corresponding dimension of the dynamic behavior baseline.

[0080] 2. Divide the single-dimensional deviation distance by the adaptive floating threshold of the corresponding dimension in the dynamic behavior baseline to obtain the standardized deviation degree. If the standardized deviation degree is greater than 1, it indicates that the corresponding dimension is abnormal.

[0081] 3. Take the maximum value of all dimension standardized deviation degrees as the preliminary anomaly score.

[0082] In some embodiments, when constructing the anomaly score matrix in S3, the rows of the matrix can be the device identifiers under the same gateway, the columns can be consecutive time windows, and the element values can be the preliminary anomaly scores of the devices in the time windows.

[0083] In some embodiments, the majority voting mechanism in S3 meets the following condition: when the preliminary anomaly score of a single device is determined as abnormal by a specified proportion of the remaining devices under the same gateway, the operation instruction backtracking process is triggered.

[0084] The specified proportion can be preset, and the data of the detected device itself is excluded in the calculation.

[0085] The specific execution process is as follows: count the number of abnormal determinations of the preliminary anomaly score of the target device by all devices under the same gateway except the device itself, and when the number of abnormal determinations divided by the total number of the remaining devices under the same gateway reaches or exceeds the preset specified proportion, generate a suspicious instruction label and activate the operation instruction backtracking, and finally obtain the to-be-confirmed instruction sequence after backtracking is triggered.

[0086] For example, under a certain gateway, there are 4 devices (devices A, B, C, and D), and when detecting the abnormal state of device A: device B determines that the preliminary anomaly score of device A is abnormal; device C determines that the preliminary anomaly score of device A is abnormal; and device D determines that the preliminary anomaly score of device A is normal.

[0087] If the preset specified proportion is set to , the abnormal determination proportion is , which reaches the preset proportion threshold, triggering the operation instruction backtracking of device A.

[0088] Output the to-be-confirmed instruction sequence corresponding to device A, for example, extract all operation code sequences and data payloads executed by device A in the last 5 minutes.

[0089] In some embodiments, the disassembly of the to-be-confirmed instruction sequence in S4 is specifically a deep analysis of the to-be-confirmed instruction sequence, generating two types of core features: operation code sequence features and parameter statistical features.

[0090] The operation code sequence features include extracting the frequency distribution of operation codes, calculating the length of the operation code sequence, and recording sensitive operation code combinations.

[0091] The parameter statistical features include the mean and variance of numerical parameters (such as port numbers and temperature values), and the entropy value of character parameters (such as keys and IP addresses).

[0092] The obtained instruction structure features include the splicing results of the operation code feature vector and the parameter feature vector.

[0093] Calculate the similarity between the instruction structure features and the pre-defined attack pattern features in the known attack feature library, and set a determination threshold. If the similarity reaches the determination threshold, it is determined as a known attack, otherwise it is marked as an unknown attack, and context semantic analysis and instruction evolution trajectory detection are triggered.

[0094] The determination threshold is determined by historical matching accuracy statistics of the known attack feature library.

[0095] In some embodiments, the instruction evolution trajectory detection on unknown attacks in S4 includes:

[0096] S41. Obtain the to-be-confirmed instruction sequence and the historical records of the same type of instructions within a preset specified time range, and construct an instruction behavior evolution trajectory graph.

[0097] The to-be-confirmed instruction sequence is derived from the suspicious operation instruction output by the cooperative attack instruction backtracking module, and includes an operation code sequence and a data payload.

[0098] The preset specified time range is determined by the historical attack incubation period analysis results of the same type of devices, such as 240 hours for temperature control devices.

[0099] In the historical records of the same type of instructions, the instruction sequence of the same operation code is extracted, sorted by timestamp to form a three-dimensional data set including time points, operation code types, and parameter values, and an output result instruction behavior evolution trajectory graph is output. The evolution trajectory graph has a time line as the horizontal axis and an operation parameter value as the vertical axis.

[0100] For example, the to-be-confirmed instruction sequence of a certain gateway device includes a port scanning instruction, and the time points and target port numbers of all port scanning operations within 240 hours are extracted to generate a port number-time relationship evolution graph.

[0101] S42. Identify whether there is a cumulative parameter deviation or a periodic trial call mode in the instruction behavior evolution trajectory graph. If so, mark the potential incubation attack behavior.

[0102] The cumulative parameter deviation judgment standard is that a key parameter continuously exceeds a specified number of operations (such as 10 times) of one-way variation (such as continuously increasing from 1000 to 65535).

[0103] The periodic trial call judgment standard is that the same sensitive operation code appears repeatedly at a fixed interval for a specified number of times. For example, an illegal protocol handshake is performed every 8 hours, and if it is initiated for three times in a row, it is determined to be a periodic trial call judgment standard, and is marked as a potential incubation attack behavior.

[0104] If any mode is detected, output the potential incubation attack behavior mark.

[0105] In some embodiments, the attack risk index generation in S4 needs to meet the following conditions: when the known attack determination result is an unknown attack, the potential incubation attack behavior mark is integrated as a risk coefficient weight into the context semantic analysis, and then the attack risk index is generated.

[0106] Specifically, when the known attack determination result is marked as an unknown attack, the following operations are performed:

[0107] 1. Obtain the state value of the potential latent attack behavior marker: if there is a cumulative parameter deviation or a periodic trial call pattern, set the weight coefficient ω = 0.3; otherwise, ω = 0.

[0108] 2. Perform context semantic analysis: analyze the logical association of the operation code in the instruction sequence to be confirmed, and output the basic risk value in percentage form .

[0109] 3. Calculate the attack risk index , .

[0110] In some embodiments, the closed-loop response control in S5 includes:

[0111] S51. When the attack risk index exceeds the critical value, activate the device isolation protocol and generate a security blocking instruction.

[0112] The critical value is determined by the minimum risk value of high-risk attack events in the known attack feature library.

[0113] The device isolation protocol cuts off the physical connection of the target device to the network, and generates a security blocking instruction containing the device ID, isolation timestamp, and blocking instruction code.

[0114] For example, the attack risk index of the air conditioning device reaches 84.5%, which exceeds the 80% critical value, and generates a security blocking instruction.

[0115] S52. Update the dynamic behavior baseline of the affected device based on the security blocking instruction and generate baseline correction parameters.

[0116] The correction logic of the dynamic behavior baseline is: add an attack isolation state mode to the behavior pattern clustering center, and recalculate the adaptive floating threshold under this mode based on the running parameters when the security blocking instruction is triggered, and finally obtain the baseline correction parameters containing the center coordinates and floating threshold of the new mode.

[0117] For example, the parameters of a certain type of air conditioner when blocked are [temperature 32℃, voltage 240V, flow 0bps], based on which the new mode center [32, 240, 0] is generated, and the floating threshold is calculated to be ±1.5℃, and the final baseline correction parameters are {Mode: Attack_Isolated, Center: [32, 240, 0], Threshold: [±1.5℃, ±5V, ±0bps]}.

[0118] S53. Synchronize the baseline correction parameters to the security policy library of all devices in the same group; collect the real-time running parameters of the device after the execution of the security blocking instruction, and compare them with the preset expected security state parameters to output the defense effectiveness state identifier.

[0119] The expected security state parameters are preset by the device security policy, such as network traffic = 0, CPU occupancy < 5%, and the like.

[0120] The comparison rule is that the deviation between the actual value and the expected value of each parameter is ≤ 5%, and then it is counted as conforming.

[0121] The output result is the defense effectiveness state identifier: if all parameters conform to the expectation, it is marked as "valid"; if any parameter is out of tolerance, it is marked as "invalid".

[0122] In some embodiments, the defense effectiveness state identifier in S53 triggers the following branches:

[0123] If the defense effectiveness state identifier is valid, a security confirmation signal is generated.

[0124] If the defense effectiveness state identifier is invalid, the step of instruction evolution trajectory detection is re-executed.

[0125] When the defense effectiveness state identifier is marked as "valid", it means that the device isolation measure is fully effective, and the generated security confirmation signal contains the unique identifier of the isolated device, the security state timestamp, and the defense effectiveness code, which are used to notify the management platform to cancel the alarm.

[0126] When the defense effectiveness state identifier is marked as "invalid", it means that the isolation measure does not meet the expectation, and the step of instruction evolution trajectory detection is re-executed.

[0127] The re-execution needs to clear the original to-be-confirmed instruction sequence cache, obtain the latest preset specified time range of the same type of instruction history record, output the updated instruction behavior evolution trajectory graph and potential latent attack behavior label.

[0128] For example, the CPU occupancy rate of a certain access control device is 48% after being blocked, and if the expected value is < 10%, the deviation is 380% which triggers the invalid identifier, and the card swiping instruction record (same type of instruction history record) of the device within 72 hours is re-acquired to construct a new instruction behavior evolution trajectory graph for attack mode reanalysis.

[0129] In some embodiments, the operation instruction backtracking mechanism in S3 is specifically: for the instruction sequence associated with the suspicious instruction tag, the operation code sequence and the data payload are extracted.

[0130] The operation code sequence represents a set of atomic instruction codes arranged in chronological order, such as 0x01 temperature setting and 0x02 port listening.

[0131] The data payload represents the parameter value associated with each operation code, such as temperature setting value 32°C and port number 8080.

[0132] Specifically, the suspicious instruction label contains the unique identifier of the judged device and the abnormal time point, the instruction code stream of the device is intercepted before the abnormal time point for a specified time (such as 5 minutes), the specific parameter value of each operation code is bound, the data is organized in a timestamp, operation code, and data payload three-tuple structure, and the output result is a to-be-confirmed instruction sequence containing complete instruction data.

[0133] In some embodiments, as shown in FIG. Figure 1 The present application provides a network security-based Internet of Things data security management system, which comprises:

[0134] The multi-dimensional feature generation module obtains the running parameters of the Internet of Things device, pre-processes the running parameters, and obtains a multi-dimensional feature vector; wherein the multi-dimensional feature vector comprises a historical multi-dimensional feature vector and a current multi-dimensional feature vector.

[0135] The dynamic anomaly score generation module constructs a dynamic behavior baseline based on the historical multi-dimensional feature vector clustering, calculates the deviation degree of the current multi-dimensional feature vector relative to the baseline, and obtains a preliminary anomaly score.

[0136] The collaborative attack instruction backtracking module constructs an overall anomaly score matrix for the preliminary anomaly scores of at least three devices under the same gateway, generates a suspicious instruction label through a majority voting mechanism and triggers operation instruction backtracking, and outputs a to-be-confirmed instruction sequence.

[0137] The enhanced risk analysis module disassembles the to-be-confirmed instruction sequence to generate instruction structure features, matches a known attack feature library, performs context semantic analysis and instruction evolution track detection on unknown attacks, and outputs an attack risk index.

[0138] The closed-loop security response module activates device isolation according to the risk index, updates the dynamic behavior baseline and synchronizes the devices in the same group, and realizes closed-loop response control through defense effectiveness verification.

[0139] In some embodiments, the present application provides a network security-based Internet of Things data security management device, which comprises a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program to realize the steps of the network security-based Internet of Things data security management method.

[0140] In some embodiments, the present application provides a storage medium, which stores computer program instructions; when the computer program instructions are read and run by a processor, the steps of the network security-based Internet of Things data security management method are executed.

[0141] Any reference to storage, memory, database or other medium herein includes non-volatile and / or volatile storage. Non-volatile storage can include read-only memory (ROM), programmable ROM (PROM), electronically programmable ROM (EPROM), or electrically erasable programmable ROM (EEPROM). Volatile storage can include random-access memory (RAM), or external cache memory.

[0142] It should be noted that, in the present document, relational terms such as "first" and "second", and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. In other words, any process, method, article, or apparatus that comprises a list of elements is deemed to include not only those elements but also other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0143] Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that the technical solutions recorded in the foregoing embodiments can be modified or some of the technical features can be replaced equivalently, and such modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network security-based Internet of Things data security management system, characterized by, The method comprises the following steps: A multi-dimensional feature generation module: obtain the running parameters of the Internet of Things device, preprocess the running parameters, and obtain a multi-dimensional feature vector; wherein the multi-dimensional feature vector includes a historical multi-dimensional feature vector and a current multi-dimensional feature vector; A dynamic anomaly score generation module: construct a dynamic behavior baseline based on the historical multi-dimensional feature vector clustering, calculate the deviation of the current multi-dimensional feature vector relative to the baseline, and obtain a preliminary anomaly score; A collaborative attack instruction backtracking module: construct an overall anomaly score matrix for the preliminary anomaly scores of at least three devices under the same gateway, generate a suspicious instruction label through a majority voting mechanism and trigger an operation instruction backtracking process, and output a to-be-confirmed instruction sequence; wherein the rows of the matrix can be device identifiers under the same gateway, the columns are consecutive time windows, and the element values are the preliminary anomaly scores of the devices in the time windows; the majority voting mechanism satisfies: when the preliminary anomaly score of a single device is determined as abnormal by a specified proportion of the remaining devices under the same gateway, the operation instruction backtracking process is triggered; An enhanced risk analysis module: disassemble the to-be-confirmed instruction sequence to generate instruction structure features, match the known attack feature library, and perform context semantic analysis and instruction evolution trajectory detection on unknown attacks to output an attack risk index; A closed-loop security response module: activate device isolation according to the risk index, update the dynamic behavior baseline and synchronize the devices in the same group, and realize closed-loop response control through defense effectiveness verification.

2. The network security based IoT data security management system of claim 1, wherein, The running parameters include at least three of temperature sensor data, voltage and current data, communication flow value, memory occupancy rate, and CPU usage rate. 3.The network security based IoT data security management system of claim 1, wherein, The preprocessing of the running parameters to obtain the multi-dimensional feature vector comprises: Performing physical threshold filtering on real-time running parameters to generate a basic running parameter set; Performing equal-interval resampling on the basic running parameter set to generate time-aligned sampling data; Performing feature fusion on the multi-source sensor data in the time-aligned sampling data to generate a multi-dimensional feature vector.

4. The network security based IoT data security management system of claim 1, wherein, The dynamic behavior baseline is constructed by: Using an unsupervised clustering algorithm to identify normal data in the historical multi-dimensional feature vector to generate a behavior pattern clustering center; Based on the behavior pattern clustering center and the running parameters in the nearest specified time, an adaptive floating threshold is calculated to generate a dynamic behavior baseline.

5. The network security based IoT data security management system of claim 1, wherein, The instruction evolution trajectory detection for unknown attacks comprises: Obtain the to-be-confirmed instruction sequence and the historical records of the same type of instructions within a preset specified time range to construct an instruction behavior evolution trajectory graph; Identify whether there is a cumulative parameter deviation or a periodic trial call pattern in the instruction behavior evolution trajectory graph. If so, mark a potential latent attack behavior.

6. The network security based IoT data security management system of claim 5, wherein, The generation of the attack risk index needs to satisfy: when the to-be-confirmed instruction sequence matches the known attack feature library as an unknown attack, the potential latent attack behavior mark is taken as a risk coefficient weight in the context semantic analysis to generate an attack risk index; wherein the cumulative parameter deviation or the periodic trial call pattern is marked as 1, the weight is 0.3, otherwise it is marked as 0, and the weight is 0.

7. The network security based IoT data security management system of claim 1, wherein, The closed-loop response control comprises: When the attack risk index exceeds a critical value, activate the device isolation protocol and generate a security blocking instruction; updating a dynamic behavior baseline of the affected device based on the security blocking instruction, generating a baseline correction parameter; synchronizing the baseline correction parameter to a security policy library of all devices in the same group; collecting real-time running parameters of the device after execution of the security blocking instruction, comparing with preset expected security state parameters, and outputting a defense effectiveness state identifier. 8.The network security based IoT data security management system of claim 7, wherein, The defense effectiveness state identifier triggers the following branches: if the defense effectiveness state identifier is valid, a security confirmation signal is generated; if the defense effectiveness state identifier is invalid, the step of instruction evolution trajectory detection is re-executed. 9.The network security based IoT data security management system of claim 1, wherein, The operation instruction backtracking mechanism specifically comprises: extracting an operation code sequence and a data payload for an instruction sequence associated with the suspicious instruction tag.

Images