Iot-based terminal device control method and system

Abstract

The application discloses a terminal equipment control method and system based on an internet of things. The method monitors network communication parameters of internet of things equipment in real time, establishes a statistical baseline of equipment communication behavior according to the network communication parameters, calculates a deviation degree of the network communication parameters from the statistical baseline under a current communication mode, judges whether the current communication mode is abnormal according to the deviation degree, generates an optimal security rule combination dynamically according to a genetic algorithm if the current communication mode is abnormal, and pushes the optimal security rule combination to a terminal equipment firewall module for updating and deployment. The application significantly improves the security protection capability and response efficiency of internet of things equipment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of terminal device control of Internet of Things, and particularly relates to a terminal device control method and system based on Internet of Things. BACKGROUND

[0002] The Internet of Things devices are generally limited in computing resources, weak in security protection capability, and lack effective security update mechanism, which makes them easy to become the target of network attacks.

[0003] The firewall and access control system of the existing Internet of Things devices adopt predefined static security rules, which cannot dynamically adjust the protection strategy according to the real-time network threat environment, and are difficult to cope with the increasingly complex and variable network attacks; the security scheme mostly adopts a passive protection mode, which can only detect and respond after the attack occurs, lacks the ability of active prediction and prevention, and leads to security response lag; often only a single factor of security is considered, and the characteristics of limited resources of the Internet of Things devices are ignored, lacking comprehensive optimization of security, real-time performance and resource efficiency.

[0004] When the Internet of Things devices are subjected to network attacks, their network communication mode will change significantly, such as abnormal data packet arrival frequency, data packet size distribution change, and increase of abnormal IP address access; based on these communication abnormal characteristics, the application develops an Internet of Things device control method and system which can monitor network behavior in real time, intelligently identify security threats, and dynamically generate optimal security rules. SUMMARY

[0005] The purpose of the application is to solve the technical problems of static, passive and low precision of security protection of Internet of Things devices in the prior art, and to provide a terminal device control method and system based on Internet of Things, which realizes real-time security monitoring, intelligent threat identification and dynamic security rule optimization of Internet of Things devices, and improves the security protection capability and response efficiency of Internet of Things devices.

[0006] The specific technical solutions are as follows:

[0007] In a first aspect, the application provides a terminal device control method based on Internet of Things, which is used to realize real-time update of security rules of the terminal device, and the terminal device communicates with a cloud server through a TCP / IP protocol stack, and has firewall rules, access control lists and traffic limitation rules.

[0008] The control method comprises the following steps:

[0009] Step S1, real-time monitoring of network communication parameters of the Internet of Things device.

[0010] The network communication parameters include data packet arrival interval time, data packet size, source IP address change frequency and port scanning frequency.

[0011] Step S2, establishing a statistical baseline of device communication behavior according to the network communication parameters, calculating the deviation of network communication parameters under the current communication mode from the statistical baseline.

[0012] Step S3, judging whether there is an anomaly in the current communication mode according to the deviation.

[0013] Step S4, if there is an anomaly, dynamically generating an optimal security rule combination according to the genetic algorithm, and pushing it to the terminal device firewall module for updating and deployment.

[0014] Further, a packet listening module is deployed at the device network interface layer to record network communication data continuously at a time interval for a sampling period.

[0015] The first packet arrival interval time is , where is the arrival timestamp of the first packet; the packet size is the byte length of the packet, including the IP header, TCP / UDP header and application layer payload.

[0016] The source IP address change frequency is , where is the time window, which is 60s; is the number of different source IP addresses in the time window ; and the port scanning frequency is , where is the number of connection attempts to different target ports in the time window.

[0017] Further, the statistical baseline is obtained according to the communication behavior characteristics of the sliding window, the sliding window length is set to W=300s, the sliding step is 30s, the packet arrival interval time, the packet size, the source IP address change frequency and the port scanning frequency are calculated in each time window, at least 48 hours of continuous collection are obtained, the average values of the packet arrival interval time, the packet size, the source IP address change frequency and the port scanning frequency are obtained, and each average value is set as the corresponding statistical baseline.

[0018] Further, the deviation from the baseline under the current communication mode is calculated, and the comprehensive anomaly degree of communication anomaly detection is defined as :

[0019] , where respectively are the deviation degrees of the packet inter-arrival time, the packet size, the source IP address change frequency and the port scanning frequency from the respective baselines, when , the attack recognition is triggered.

[0020] Further, the attack recognition includes DDoS attack, port scanning attack and data stealing attack, when any one of the attack feature judgment rules is satisfied, it is determined that the current communication mode is abnormal.

[0021] The attack feature judgment rules include: ; and continuously access more than 20 different ports; and the connection duration ; wherein, , and are the baseline values of the source IP address change frequency, the port scanning frequency and the packet size respectively.

[0022] Further, the optimal security rule combination dynamically generated according to the genetic algorithm is based on the multi-objective genetic algorithm according to the constraint function, and an iterative algorithm is used to obtain; the objective function of the security rule combination satisfies the maximization of the sum of security, real-time and resource efficiency, and the mathematical expression of the constraint condition of the objective function is: ; , and are the functions of security, real-time and resource efficiency respectively.

[0023] The security function , wherein, is the number of entries of the security rule, is the security index corresponding to the security rule of the th entry, ; when , it means that the security rule is not suitable for the current attack mode, the value of which is closer to 1 indicates that the security is higher;

[0024] The real-time function , wherein, is the execution time of the th security rule, is the maximum allowed response time; the resource efficiency function , wherein, is the system resource occupied by the th security rule, is the total resource of the device.

[0025] Furthermore, obtaining the optimal combination of security rules through an adaptive multi-objective genetic algorithm includes the following steps:

[0026] Step S401, select the current The safety rules of each entry are used as the initial population. Calculate the objective function value of the safety rules at the initial moment. ;

[0027] Step S402, for the initial population Perform crossover and mutation operations to generate an evolutionary population of size s. , ,in This represents the total number of security rule resource pools.

[0028] Step S403, for the population The various safety rules in the system undergo multi-objective fitness calculations, employing non-dominated ranking and crowding distance selection, and selecting the rules with the highest rankings. The safety rules of each entry are used as an evolutionary population. Computational evolutionary population The objective function value of the corresponding security rule ;

[0029] Step S404, population As the initial population, repeat steps S402-S403 until the preset number of evolutions is completed. Or the objective function converges;

[0030] Obtain the set of objective function values ​​for the corresponding security rules. ;

[0031] Step S405: Select the maximum value element in the set of objective function values ​​of the security rule, whose corresponding... The combination of security rules for each entry is the optimal combination of security rules.

[0032] Furthermore, for The security rules will be removed from the security rule resource pool, and only security rules that are suitable for the current attack mode will be retained in the security rule resource pool.

[0033] Secondly, the present invention provides a terminal device control system based on the Internet of Things, the system comprising, in sequence: a network monitoring module, an anomaly detection module, a rule generation module, and a rule deployment module.

[0034] The network monitoring module monitors the network communication parameters of IoT devices in real time and establishes a statistical baseline for device communication behavior.

[0035] The abnormality detection module judges whether the current communication mode is abnormal according to the deviation degree of the network communication parameter from the statistical baseline.

[0036] The rule generation module dynamically generates the optimal security rule combination according to the genetic algorithm.

[0037] The rule deployment module pushes the generated security rule to the terminal device firewall module for updating and deployment.

[0038] Further, the rule generation module comprises a security rule resource pool, a multi-objective genetic algorithm unit and a rule evaluation unit; the security rule resource pool stores a security rule set corresponding to each attack mode; the multi-objective genetic algorithm unit generates the optimal security rule combination by using a non-dominated sorting genetic algorithm based on a multi-objective optimization function of security, real-time performance and resource efficiency; and the rule evaluation unit performs effectiveness evaluation and conflict detection on the generated security rule combination.

[0039] Compared with the prior art, the present application has the following beneficial effects:

[0040] The present application establishes a real-time monitoring and intelligent analysis mechanism for network communication behavior of Internet of Things devices, realizes a fundamental change from traditional static protection to dynamic adaptive protection, significantly improves the security protection capability and response efficiency of Internet of Things devices, and provides important technical support for building a more secure and reliable Internet of Things ecological environment. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 The flow chart of the terminal device control method based on the Internet of Things.

[0042] Figure 2 The composition schematic diagram of the terminal device control system based on the Internet of Things. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the present application is described clearly and completely below. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0044] The terminal device refers to an Internet of Things terminal device (IoT device), i.e. an intelligent device connected through the Internet and capable of collecting and transmitting data. These devices usually have limited computing resources, weak security protection capability, lack of effective security update mechanism, etc., communicate with the cloud server through the TCP / IP protocol stack, and are equipped with basic security functions such as firewall rules, access control lists and traffic limiting rules.

[0045] IoT terminal devices include smart cameras, smart door locks, temperature sensors, humidity monitors, smart sockets, industrial controllers, car networking devices, smart home appliances (such as smart refrigerators, washing machines), smart street lamps, environmental monitoring stations, etc. These devices are distributed in various scenarios such as homes, offices, factories, and urban infrastructure, forming a large IoT ecosystem. Embodiment 1

[0046] The method of this embodiment is used to realize real-time updating of the terminal device security rules, which communicate with the cloud server through the TCP / IP protocol stack, have firewall rules, access control lists, and traffic limiting rules.

[0047] As shown in Figure 1 , it is a flow chart of the terminal device control method based on the Internet of Things of the present application, and the control method comprises the following steps:

[0048] Step S1, real-time monitoring of network communication parameters of IoT devices.

[0049] By deploying a dedicated packet listening module at the network interface layer of the terminal device, comprehensive monitoring of device network communication behavior is realized. The listening module uses deep packet inspection (DPI) technology to analyze the protocol information of each layer of the network packet, including detailed parameters of the physical layer, data link layer, network layer, transport layer, and application layer. The listening module stores network data in a ring buffer to avoid data loss, and uses a multi-threaded parallel processing mechanism to ensure monitoring performance under high traffic conditions.

[0050] The network communication parameters include: data packet arrival interval time, data packet size, source IP address change frequency, and port scanning frequency. The data packet arrival interval time reflects the time distribution characteristics of network traffic, the data packet size reflects the size characteristics of the communication content, the source IP address change frequency reflects the diversity of communication objects, and the port scanning frequency reflects potential attack behavior.

[0051] Deploy a packet listening module at the device network interface layer to record network communication data at a time interval , which is the sampling period.

[0052] The th data packet arrival interval time : , where is the arrival timestamp of the th data packet; the data packet size is the byte length of the data packet, including the IP header, TCP / UDP header, and application layer payload.

[0053] Source IP address change frequency : , wherein is the time window, taking 60s; is the number of different source IP addresses within the time window Port scanning frequency : , wherein is the number of connection attempts to different target ports within the time window.

[0054] Step S2, establishing a statistical baseline of device communication behavior according to the network communication parameters, calculating the deviation of network communication parameters under the current communication mode from the statistical baseline.

[0055] The statistical baseline is obtained according to the communication behavior characteristics of the sliding window, the sliding window length is set to W=300s, the sliding step is 30s, the packet arrival interval time, packet size, source IP address change frequency and port scanning frequency are calculated within each time window, at least 48 hours of continuous collection are obtained, the average value of packet arrival interval time, packet size, source IP address change frequency and port scanning frequency are obtained, and each average value is set as the corresponding statistical baseline.

[0056] Step S3, judging whether the current communication mode is abnormal according to the deviation.

[0057] The deviation of the current communication mode from the baseline is calculated, and the comprehensive abnormality degree of communication anomaly detection is defined :

[0058] , wherein respectively, the deviation of the packet arrival interval time, packet size, source IP address change frequency and port scanning frequency under the current communication mode from the baseline, when , triggering attack recognition.

[0059] The attack recognition includes DDoS attack, port scanning attack and data stealing attack, when any one of the attack feature judgment rules is met, it is judged that the current communication mode is abnormal;

[0060] The attack feature judgment rules include: ; and continuously access more than 20 different ports; and the connection duration ; wherein , and are the baseline values of source IP address change frequency, port scanning frequency and packet size, respectively.

[0061] Step S4, if there is an exception, the optimal security rule combination is dynamically generated according to the genetic algorithm, and is pushed to the terminal device firewall module for updating and deployment.

[0062] The optimal security rule combination dynamically generated according to the genetic algorithm is obtained based on a multi-objective genetic algorithm according to a constraint function, using an iterative algorithm; the target function of the security rule combination satisfies the maximization of the sum of security, real-time performance and resource efficiency, and the mathematical expression of the constraint condition of the target function is: are functions of security, real-time performance and resource efficiency, respectively.

[0063] The security function wherein, is the number of entries of the security rule, is the security index corresponding to the security rule of the i th entry, ; when , it indicates that the security rule is not suitable for the current attack mode, the value of which is closer to 1 indicates that the security is higher;

[0064] The security index is scored by using a multi-dimensional weighted evaluation model, which is mainly based on the following several key indicators for quantitative calculation. Firstly, the attack blocking rate (Detection Rate, DR) is the proportion of the successful identification and blocking of the target attack by the security rule in the historical attack events, and the calculation formula is DR = the number of successfully blocked attacks / the total number of attacks. Secondly, the false positive rate (False Positive Rate, FPR) is the proportion of the normal traffic incorrectly determined as attack by the rule, and the calculation formula is FPR = the number of false positives / the total number of normal traffic. Thirdly, the attack pattern matching degree (Pattern Match Degree, PMD) is used to evaluate the similarity between the current rule and the detected attack characteristics, which is calculated by a feature vector similarity algorithm. Finally, the response time efficiency (Response Time Efficiency, RTE) is the ratio of the rule execution time to the standard response time.

[0065] The specific scoring calculation formula is: wherein w1, w2 and w3 are weight coefficients, and are set as w1 = 0.5, w2 = 0.3 and w3 = 0.2.

[0066] ​​​​For example, if a DDoS protection rule successfully blocked 85 out of the last 100 attacks (DR = 0.85), and falsely reported 50 out of 10,000 normal accesses (FPR = 0.005), has a match rate of 0.9 with the current DDoS attack characteristics, and its response time is 0.8 times the standard time (RTE = 1.25, taking the upper limit of 1.0), then the security index of this rule is: When a rule becomes completely ineffective in multiple consecutive attacks or is not applicable under the current attack pattern, the system will directly set its security index to 0, indicating that the rule needs to be removed from the current rule combination.

[0067] Real-time function ,in, For the first The execution time of each security rule Maximum allowable response time; resource efficiency function ,in, For the first The system resources consumed by each security rule Total equipment resources.

[0068] Obtaining the optimal combination of security rules using an adaptive multi-objective genetic algorithm includes the following steps:

[0069] Step S401, select the current The safety rules of each entry are used as the initial population. Calculate the objective function value of the safety rules at the initial moment. ;

[0070] Step S402, for the initial population Perform crossover and mutation operations to generate an evolutionary population of size s. , ,in This represents the total number of resources in the security rules resource pool.

[0071] Step S403, for the population The various safety rules in the system undergo multi-objective fitness calculations, employing non-dominated ranking and crowding distance selection, and selecting the rules with the highest rankings. The safety rules of each entry are used as an evolutionary population. Computational evolutionary population The objective function value of the corresponding security rule ;

[0072] Step S404, population As the initial population, repeat steps S402-S403 until the preset number of evolutions is completed. Or the objective function converges;

[0073] Obtain the set of objective function values ​​for the corresponding security rules. ;

[0074] Step S405: Select the maximum value element in the set of objective function values ​​of the security rule, whose corresponding The combination of security rules for each entry is the optimal combination of security rules.

[0075] for The security rules will be removed from the security rule resource pool, and only security rules that are suitable for the current attack mode will be retained in the security rule resource pool.

[0076] Taking a smart camera as an example, this method continuously monitors the camera's network communication behavior. Under normal circumstances, the camera transmits approximately 50-100KB of video data to the cloud per second, with relatively stable data packet arrival intervals, primarily communicating with a few fixed cloud server IP addresses. However, when the camera suffers a DDoS attack, the system detects abnormal characteristics: the data packet arrival interval shortens dramatically (…). < 0.5), while the frequency of source IP address changes surged ( If the overall anomaly score (Ascore) exceeds 0.3 (> 5 times the baseline value), the system immediately activates a genetic algorithm to select the optimal combination of protection strategies against DDoS attacks from the security rule resource pool. This may include rules such as limiting the frequency of single-IP connections, enabling deep packet inspection, and temporarily blocking suspicious IP ranges. These rules are then automatically pushed to the firewall modules of the cameras for deployment.

[0077] This solution offers significant advantages over traditional static protection. For example, in a factory with a network of 100 temperature sensors, when subjected to port scanning attacks, traditional solutions require manual log analysis and rule updates, typically taking several hours or even longer to respond. However, with the dynamic protection solution of this invention, the system can automatically generate and deploy optimal security rules within minutes when it detects a port scanning frequency exceeding 10 times the baseline value and continuous access to more than 20 different ports. This reduces the attack success rate from over 60% to below 5%, while ensuring normal business operations remain unaffected. The entire process represents a shift from passive response to proactive prevention, greatly improving the overall security and response efficiency of IoT device networks. Example 2

[0078] like Figure 2 The diagram shows the composition of a terminal device control system based on the Internet of Things provided by the present invention. The system includes, in sequence, a network monitoring module, an anomaly detection module, a rule generation module, and a rule deployment module.

[0079] The network monitoring module monitors the network communication parameters of the Internet of Things device in real time, and establishes a statistical baseline of device communication behavior.

[0080] The anomaly detection module determines whether the current communication mode is abnormal according to the deviation of the network communication parameters from the statistical baseline.

[0081] The rule generation module dynamically generates an optimal security rule combination according to a genetic algorithm.

[0082] The rule deployment module pushes the generated security rules to the terminal device firewall module for updating and deployment.

[0083] The rule generation module includes a security rule resource pool, a multi-objective genetic algorithm unit, and a rule evaluation unit. The security rule resource pool stores a set of security rules corresponding to various attack modes. The multi-objective genetic algorithm unit generates an optimal security rule combination based on a multi-objective optimization function of security, real-time performance, and resource efficiency using a non-dominated sorting genetic algorithm. The rule evaluation unit evaluates the effectiveness of the generated security rule combination and detects conflicts.

[0084] The system adopts modular design, and the modules are connected through standard interfaces, having good scalability and maintainability. The communication between modules uses a message queue mechanism, which can effectively decouple the dependency relationship between modules, improving the stability and reliability of the system. Each module has an independent configuration file and log system, facilitating the deployment, debugging, and maintenance of the system.

[0085] The above specific embodiments further illustrate the purpose, technical solutions, and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and does not limit the protection scope of the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A terminal device control method based on the Internet of Things (IoT), used to realize real-time updates of the security rules of the terminal device, wherein the terminal device communicates with a cloud server through a TCP / IP protocol stack and has firewall rules, access control lists, and traffic restriction rules, characterized in that... The control method includes the following steps: Step S1: Monitor the network communication parameters of IoT devices in real time; The network communication parameters include: data packet arrival interval, data packet size, source IP address change frequency, and port scan frequency; Deploy a packet monitoring module at the device's network interface layer, at time intervals. The sampling period is used to continuously record network communication data; No. Data packet arrival interval : ,in For the first Arrival timestamps of individual data packets; data packet size The length of the data packet in bytes, including the IP header, TCP / UDP header, and application layer payload; Source IP address change frequency : ,in Set the time window to 60 seconds; For time window Number of different source IP addresses; port scan frequency : ,in The number of connection attempts to different target ports within the time window; Step S2: Establish a statistical baseline for device communication behavior based on the network communication parameters, and calculate the deviation between the network communication parameters and the statistical baseline under the current communication mode; Define the comprehensive anomaly degree of communication anomaly detection : ,in, These represent the deviations of the data packet arrival interval, data packet size, source IP address change frequency, and port scan frequency from each baseline under the current communication mode. At that time, attack identification is triggered; Step S3: Determine whether there is an anomaly in the current communication mode based on the deviation. The attack identification includes DDoS attacks, port scanning attacks, and data theft attacks. When any one of the attack feature judgment rules is met, it is determined that the current communication mode is abnormal. The rules for determining the attack characteristics include: ; And accessed more than 20 different ports consecutively; And connection duration ;in, , and These are the baseline values ​​for source IP address change frequency, port scan frequency, and packet size, respectively. Step S4: If an anomaly is found, the optimal combination of security rules is dynamically generated according to the genetic algorithm and pushed to the firewall module of the terminal device for update and deployment. The optimal combination of safety rules is dynamically generated using a genetic algorithm. This is based on a multi-objective genetic algorithm and an iterative algorithm using constraint functions. The objective function of the combination of safety rules is... To maximize the sum of security, real-time performance, and resource efficiency, the mathematical expression for the objective function constraints is: ; , and These are functions for security, real-time performance, and resource efficiency, respectively. Security functions ,in, For the number of security rule entries, For the first The security index corresponding to the security rules of each item. ;when When this occurs, it indicates that the security rule is not suitable for the current attack pattern. The closer the value is to 1, the higher its security; security index The calculation formula is: ,in , , ; For attack blocking rate, For false alarm rate, For attack pattern matching degree, For response time efficiency; Real-time function ,in, For the first The execution time of each security rule The maximum allowable response time; Resource efficiency function ,in, For the first The system resources consumed by each security rule Total equipment resources.

2. The terminal device control method based on the Internet of Things according to claim 1, characterized in that, The statistical baseline is obtained based on the communication behavior characteristics of the sliding window. The sliding window length is set to 300s and the sliding step is 30s. Within each time window, the data packet arrival interval, data packet size, source IP address change frequency, and port scanning frequency are calculated. Data is collected continuously for at least 48 hours to obtain the average values ​​of data packet arrival interval, data packet size, source IP address change frequency, and port scanning frequency. Each average value is set as the corresponding statistical baseline.

3. The terminal device control method based on the Internet of Things according to claim 2, characterized in that, Obtaining the optimal combination of security rules using an adaptive multi-objective genetic algorithm includes the following steps: Step S401, select the current The safety rules of each entry are used as the initial population. Calculate the objective function value of the safety rules at the initial moment. ; Step S402, for the initial population Perform crossover and mutation operations to generate an evolutionary population of size s. , ,in This represents the total number of security rule resource pools. Step S403, for the population The various safety rules in the system undergo multi-objective fitness calculations, employing non-dominated ranking and crowding distance selection, and selecting the rules with the highest rankings. The safety rules of each entry are used as an evolutionary population. Computational evolutionary population The objective function value of the corresponding security rule ; Step S404, population As the initial population, repeat steps S402-S403 until the preset number of evolutions is completed. Or the objective function converges; Obtain the set of objective function values ​​for the corresponding security rules. ; Step S405: Select the maximum value element in the set of objective function values ​​of the security rule, whose corresponding The combination of security rules for each entry is the optimal combination of security rules.

4. The terminal device control method based on the Internet of Things according to claim 3, characterized in that, for The security rules will be removed from the security rule resource pool, and only security rules that are suitable for the current attack mode will be retained in the security rule resource pool.

5. A terminal device control system based on the Internet of Things (IoT), used to execute the terminal device control method based on the IoT as described in any one of claims 1-4, characterized in that, The system comprises, in sequence, a network monitoring module, an anomaly detection module, a rule generation module, and a rule deployment module; The network monitoring module monitors the network communication parameters of IoT devices in real time and establishes a statistical baseline for device communication behavior; The anomaly detection module determines whether there is an anomaly in the current communication mode based on the deviation of network communication parameters from the statistical baseline; The rule generation module dynamically generates the optimal combination of security rules based on a genetic algorithm; The rule generation module includes: a security rule resource pool, a multi-objective genetic algorithm unit, and a rule evaluation unit; The security rule resource pool stores a set of security rules corresponding to various attack modes; The multi-objective genetic algorithm unit is based on a multi-objective optimization function of safety, real-time performance, and resource efficiency, and uses a non-dominated sorting genetic algorithm to generate the optimal combination of safety rules. The rule evaluation unit performs effectiveness evaluation and conflict detection on the generated security rule combinations; The rule deployment module pushes the generated security rules to the terminal device firewall module for update and deployment.

Images