Fttr-based home network security monitoring method, device and equipment and medium

Abstract

The application discloses a FTTR-based home network security monitoring method and device, equipment and medium, and relates to the field of data processing, wherein the method comprises: collecting historical behavior data of each device in a home network and constructing an initial security detection model based on the historical behavior data, preset parameters and a DBSCAN algorithm; in the case of a new device accessing, collecting behavior data of the new device and calculating the similarity between the behavior data and the historical behavior data of each device; adjusting the preset parameters based on the access time of the new device and the similarity; modifying the initial security detection model based on the adjusted preset parameters, and completing home network security monitoring based on the modified initial security detection model. The application solves the problem that when a new device accesses, a traditional anomaly detection model trained based on historical data cannot automatically adapt to the change of the feature space caused by the access of the new device, thereby causing the false positive rate to rise sharply.

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to a method, apparatus, device, and medium for home network security monitoring based on FTTR. Background Technology

[0002] Fiber to the Room (FTTR), as a next-generation home network architecture, achieves gigabit-level bandwidth coverage and millisecond-level low-latency transmission through all-optical networking, providing highly reliable connectivity for smart home devices. However, with the exponential growth of data from home network devices and the heterogeneity of device types, home network security threats are becoming increasingly covert and collaborative. Traditional home network security monitoring methods rely on static rules and offline training models, making it difficult to address the problems caused by dynamic device access and sudden changes in behavior patterns.

[0003] When a new device is connected, traditional anomaly detection models trained on historical data cannot automatically adapt to the changes in feature space caused by the new device. For example, after a smart socket is connected, its periodic signals are misjudged as port scanning attacks due to differences in protocol format, and the false alarm rate rises sharply. Summary of the Invention

[0004] The main purpose of this application is to provide a home network security monitoring method, device, equipment and medium based on FTTR, which aims to solve the technical problem that when a new device is connected, the traditional anomaly detection model trained on historical data cannot automatically adapt to the feature space changes caused by the connection of the new device, resulting in a sharp increase in the false alarm rate.

[0005] To achieve the above objectives, this application provides a home network security monitoring method based on FTTR, comprising: collecting historical behavior data of each device in the home network and constructing an initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm; when a new device is connected, collecting the behavior data of the new device and calculating the similarity between the behavior data and the historical behavior data of each device; adjusting the preset parameters based on the access time of the new device and the similarity; correcting the initial security detection model based on the adjusted preset parameters, and completing home network security monitoring based on the corrected initial security detection model.

[0006] Optionally, the input to the initial security detection model is the historical behavior data, and the output of the initial security detection model is anomalies and multiple clusters.

[0007] Optionally, calculating the similarity between the behavioral data and the historical behavioral data of each of the devices includes: determining the centroid of each cluster based on the clustering results obtained from the initial security detection model; and calculating the similarity between the behavioral data and each cluster based on the historical behavioral data corresponding to the centroid of each cluster.

[0008] Optionally, adjusting the preset parameters based on the access time of the new device and the similarity includes: determining the initial dynamic parameters of each cluster based on the similarity; adjusting the preset parameters based on the initial dynamic parameters of each cluster and the access time of the new device to obtain the dynamic parameters of each cluster; and correcting the initial security detection model based on the adjusted preset parameters includes: correcting the initial security detection model based on the dynamic parameters of each cluster.

[0009] Optionally, adjusting the preset parameters based on the initial dynamic parameters of each cluster and the access time of the new device to obtain the dynamic parameters of each cluster includes: adjusting the preset parameters using the following formulas (1) and (2) to obtain the dynamic parameters of each cluster:

[0010]

[0011] In the formula, Indicates the first Dynamic parameters of each cluster class, Indicates the first The initial dynamic parameters of each cluster class, Indicates preset parameters. This indicates the preset maximum parameter. Indicates the first Similarity among clusters, This indicates the access time of the new device. This indicates the preset adjustment constant.

[0012] Optionally, before constructing the initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm, the method further includes: extracting features from the historical behavior data to obtain feature data; the construction of the initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm includes: constructing the initial security detection model based on the feature data, preset parameters, and the DBSCAN algorithm.

[0013] Optionally, the step of extracting features from the historical behavior data to obtain feature data includes: determining anomaly labels based on the historical behavior data; calculating the correlation between each piece of historical behavior data and the anomaly label; and extracting features from the historical behavior data based on the correlation to obtain feature data.

[0014] Furthermore, to achieve the above objectives, this application also provides a home network security monitoring device based on FTTR, comprising: an initial security detection model construction module, used to collect historical behavior data of each device in the home network and construct an initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm; a new device access module, used to collect the behavior data of a new device when a new device is accessed and calculate the similarity between the behavior data and the historical behavior data of each of the devices; a parameter adjustment module, used to adjust the preset parameters based on the access time of the new device and the similarity; and a model adjustment module, used to correct the initial security detection model based on the adjusted preset parameters and complete home network security monitoring based on the corrected initial security detection model.

[0015] This application also provides a home network security monitoring device based on FTTR, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to execute the aforementioned home network security monitoring method based on FTTR.

[0016] This application also provides a computer-readable storage medium, comprising: storing a computer program, wherein when the computer program is executed by a processor, it implements the above-described FTTR-based home network security monitoring method.

[0017] This application proposes a home network security monitoring method, apparatus, device, and medium based on FTTR. First, an initial security detection model is constructed based on historical behavioral data representing the network status of historical devices. Second, when a new device is connected, behavioral data of the new device is collected, and the similarity between the new device's behavioral data and the historical behavioral data of each device is calculated. The preset parameters of the initial security detection model are adjusted based on the new device's connection time and similarity. This addresses the issue of false positives when using the initial security detection model directly when a new device is first connected, due to the limited data volume. Furthermore, this application considers the situation where the behavioral data of the new device increases with the connection time, and the behavioral characteristics of the new device gradually become apparent. Gradually reducing the preset parameters with the new device's connection time can improve detection accuracy. Finally, the initial security detection model is corrected based on the adjusted preset parameters, and home network security monitoring is completed based on the corrected initial security detection model. This solves the technical problem that traditional anomaly detection models trained on historical data cannot automatically adapt to the changes in the feature space caused by the connection of a new device, leading to a sharp increase in false positive rates. Attached Figure Description

[0018] Figure 1 This is a flowchart of a home network security monitoring method based on FTTR according to one embodiment of this application;

[0019] Figure 2 This is a structural block diagram of a home network security monitoring device based on FTTR according to one embodiment of this application;

[0020] Figure 3 This is a schematic diagram of the structure of a home network security monitoring device based on FTTR according to one embodiment of this application.

[0021] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0022] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0023] When using anomaly detection models trained on historical data for home network security monitoring in existing technologies, the anomaly detection models cannot automatically adapt to the changes in feature space introduced by the connection of new devices. For example, when an anomaly detection model built using the DBSCAN algorithm is connected, its periodic signals are misjudged as anomalies due to differences in protocol format, resulting in a sharp increase in the false alarm rate.

[0024] To address the aforementioned issues, this application provides a home network security monitoring method, apparatus, device, and medium based on FTTR. The solution described in this application is detailed below.

[0025] Figure 1 This is a flowchart of a home network security monitoring method based on FTTR according to one embodiment of this application, with reference to... Figure 1 The FTTR-based home network security monitoring method may include the following steps:

[0026] S1. Collect historical behavior data of each device in the home network and construct an initial security detection model based on the historical behavior data, preset parameters and DBSCAN algorithm.

[0027] The historical behavior data for each device includes network access data for each device within a preset time period. This network access data includes at least network traffic data and metadata extracted from the network traffic data for each device. The preset parameters represent the radius (Eps) and minimum neighborhood number (MinPts) that need to be preset before using the DBSCAN algorithm.

[0028] It should be noted that this embodiment uses the DBSCAN algorithm to construct the initial security detection model for home network security detection. The DBSCAN algorithm is a density-based clustering algorithm that clusters data by identifying high-density regions and marking low-density regions as noise points. In this embodiment, these noise points are typically considered as outliers in security detection.

[0029] In the actual implementation process, radio frequency sensors are deployed in various corners of the room to collect the wireless signals of each device, i.e., the metadata of each device. At the same time, the SPAN port of the FTTR main gateway is configured to mirror network traffic, ensuring that all data packets entering and leaving the home network can be captured and analyzed.

[0030] Furthermore, network traffic data of each device is collected within a preset time period through the SPAN port. The network traffic data includes the amount of data uploaded and downloaded. Metadata of each device is extracted from the network traffic data. The metadata of each device includes the MAC address, connection time, duration, etc.

[0031] It should be noted that raw historical behavior data often contains a large number of redundant or irrelevant features, and directly using it for network security monitoring can lead to the disaster of dimensionality and noise interference. By extracting and filtering multiple features related to security behavior, such as traffic entropy and cross-protocol access rate, we can effectively reduce data dimensionality and improve detection efficiency. At the same time, multiple features related to security behavior can amplify the differences between normal and abnormal behavior, thereby improving detection accuracy.

[0032] In one embodiment, before constructing an initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm, the method of this embodiment may further include: extracting features from the historical behavior data to obtain feature data.

[0033] In the specific implementation process, the historical behavior data of each device is first cleaned. The data cleaning includes at least outlier removal and missing value imputation. Then, feature extraction is performed on the cleaned data to obtain feature data.

[0034] In one embodiment, feature extraction of the cleaned data to obtain feature data may specifically include:

[0035] S11. Determine the abnormal label based on the historical behavior data;

[0036] S12. Calculate the correlation between each of the historical behavior data and the anomaly label;

[0037] S13. Based on the correlation, feature extraction is performed on the historical behavior data to obtain feature data.

[0038] In the specific implementation process, clustering algorithms or anomaly detection algorithms are used to cluster or detect anomalies in the cleaned data to obtain multiple anomaly labels. It should be noted that in other embodiments, manual annotation can also be used to annotate the cleaned data based on existing network attack patterns to obtain multiple anomaly labels.

[0039] Furthermore, the correlation between each type of data and the abnormal label in the historical behavior data is calculated, and a preset threshold is set. The preset threshold can be set to 1 / 3 of the number of data types. In the historical behavior data, the first preset threshold of data types are selected in descending order of correlation to form a vector as feature data.

[0040] It is understandable that if historical behavior data includes both uploaded and downloaded data, then the uploaded data in historical behavior data is one type of data, and the downloaded data is another type of data. Furthermore, multiple anomaly tags also represent several types of data within historical behavior data.

[0041] It should be noted that correlation coefficients can be used to measure the correlation between different types of data in historical behavior data and anomaly labels. That is, the correlation coefficients between different types of data in historical behavior data and anomaly labels are used as numerical values ​​of correlation. In other embodiments, mutual information can also be used to measure the correlation between different types of data in historical behavior data and anomaly labels. After obtaining the feature data of each device, this embodiment also needs to standardize the feature data to eliminate the impact of different data units on DBSCAN distance calculation.

[0042] It is understood that, in this embodiment, the initial security detection model constructed based on historical behavior data, preset parameters, and the DBSCAN algorithm is essentially an initial security detection model constructed based on feature data, preset parameters, and the DBSCAN algorithm.

[0043] In the specific implementation process, the construction process of the initial security detection model includes: first, setting the preset parameters of the DBSCAN algorithm, inputting the feature data into the DBSCAN algorithm to obtain multiple clusters and noise points, and then determining the abnormal points and the clusters corresponding to each device based on each cluster and noise point. Among them, the abnormal points are noise points, and the clusters corresponding to each device are determined by the clusters to which its corresponding feature data belongs in the DBSCAN clustering results.

[0044] It should be noted that when using the DBSCAN clustering algorithm to cluster the feature data of devices, devices of similar types are highly similar in their network behavior. Therefore, in the clustering results, devices of the same type are usually assigned to the same cluster. For example, in smart homes, smart light bulbs and smart thermostats are similar in type. Because their network traffic data and radio frequency data are similar, they will be classified into the same cluster by the DBSCAN algorithm.

[0045] S2, when a new device is connected, collect the behavior data of the new device and calculate the similarity between the behavior data and the historical behavior data of each device;

[0046] S3, adjust the preset parameters based on the access time of the new device and the similarity.

[0047] The behavioral data of the new device includes network access data at the time of the new device's access, and the network access data includes at least network traffic data and device metadata.

[0048] It's important to note that when a new device is first connected, the limited amount of data can lead to false positives when using the initial security detection model. Therefore, the preset radius can be adjusted based on the similarity between the new device and historical devices. This means increasing the preset radius for clusters of historical devices with higher behavioral data similarity to the new device, reducing the risk of false positives. Determining the type of the new device and increasing the radius of its corresponding cluster further reduces the risk of false positives. Simultaneously, as the new device's connection time increases and its behavioral data accumulates, its behavioral characteristics gradually emerge. The radius can then be gradually reduced to improve detection accuracy.

[0049] In the specific implementation process, when a new device is connected, network access data of the new device is collected, and feature extraction is performed on the network access data to obtain the new device's attention data. It should be noted that the new device's attention data is also a vector, and the data type contained in this vector is the same as that of the feature data.

[0050] Taking any cluster as an example, the centroid of the cluster is determined based on the clustering results obtained from the initial security detection model. The similarity between the new device's data of interest and the feature data corresponding to the centroid of the cluster is calculated, and the calculated similarity is used as the similarity between the cluster and the behavioral data, i.e., the new device.

[0051] It should be noted that this embodiment can use DTW distance to calculate similarity. In other embodiments, other similarity calculation methods can also be used to calculate similarity. This embodiment does not specifically limit the calculation method of similarity. However, in this embodiment, the higher the similarity, the more similar the two sides are. Since the larger the DTW distance, the less similar the two sides are, it is necessary to linearly normalize the obtained DTW distance and then subtract the normalized DTW distance from 1 as the similarity.

[0052] In one embodiment, step S3, adjusting the preset parameters based on the access time of the new device and the similarity, may specifically include:

[0053] S31. Determine the initial dynamic parameters of each cluster class based on the similarity;

[0054] S32. Adjust the preset parameters based on the initial dynamic parameters of each cluster class and the access time of the new device to obtain the dynamic parameters of each cluster class.

[0055] The similarity of each cluster is the similarity between that cluster and the behavioral data.

[0056] It should be noted that the preset parameters include the radius and minimum number of neighbors that need to be preset before using the DBSCAN algorithm. However, since there is a coupling relationship between these two parameters, adjusting both at the same time often leads to an exponential increase in the parameter search space, increasing the complexity and uncertainty of algorithm optimization.

[0057] Based on this, this embodiment adopts a single-parameter optimization strategy, focusing on adjusting the neighborhood radius, which is more sensitive to clustering results. It is understood that in this embodiment, adjusting the preset parameter specifically refers to adjusting the preset radius, while the minimum neighborhood number is fixed using an empirical formula based on data characteristics. For example, in this embodiment, the minimum neighborhood number is equal to the number of data types in the network access data plus one. For instance, when the network access data includes the amount of uploaded data, the amount of downloaded data, and the duration (i.e., 3D data), the minimum neighborhood number is 4.

[0058] In the specific implementation process, with the first Taking the first cluster class as an example, it can be based on the first cluster class. The similarity of the nth cluster class is determined using the following formula (1). Initial dynamic parameters for each cluster class:

[0059]

[0060] in, Indicates the first The initial dynamic parameters of each cluster class, Indicates preset parameters. This indicates the preset maximum parameter. Indicates the first The similarity of each cluster class. Among them, Great need For example, when using the DBSCAN algorithm to cluster network access data, the preset radius range can be determined based on the k-distance map in traditional techniques. Specifically, We can take the value at a position before the inflection point of the k-distance graph. The value can be taken at a certain position after the inflection point; of course, in other embodiments... and Other methods can also be used for setting. In this embodiment, the values ​​of the preset parameters and the preset maximum parameters are not specifically limited.

[0061] It is understandable that when the similarity between a certain cluster and behavioral data is high, it means that the behavioral data of a new device is more likely to fall into the range of that cluster. In this case, increasing the preset parameter of the cluster, i.e. the preset radius, when the algorithm is first run can effectively reduce the risk of misjudgment caused by insufficient data of new devices.

[0062] Furthermore, with the first Taking the first cluster class as an example, it can be based on the first cluster class. The initial dynamic parameters of each cluster class and the access time of the device are adjusted using the following formula (2) to obtain the first cluster class. Dynamic parameters of each cluster class:

[0063]

[0064] in, Indicates the first Dynamic parameters of each cluster class, Indicates the first The initial dynamic parameters of each cluster class, Indicates preset parameters. This indicates the access time of the new device. This indicates the preset adjustment constant. In this embodiment, the value is positive. One can be chosen.

[0065] It is understandable that as the access time of new devices increases, the behavioral data of new devices continuously increases, and the behavioral characteristics of new devices gradually emerge. At this time, gradually reducing the radius can improve the accuracy of detection. Therefore, in this embodiment, in equation (2), this embodiment sets an inverse proportional function. ,Right now With access time The increase and decrease, and thus the and Multiplication can be understood as multiplying the access time. As initial dynamic parameters The attenuation factor, and therefore, in equation (2), with the access time The increase, Continuously reducing the radius can improve the accuracy of anomaly detection in new equipment.

[0066] S4, based on the adjusted preset parameters, corrects the initial security detection model, and completes home network security monitoring based on the corrected initial security detection model.

[0067] In the specific implementation process, the initial dynamic parameters of each cluster class are used as the starting parameters of the data corresponding to each cluster class, and the initial security detection model is modified as follows: First, the preset parameters in the DBSCAN algorithm initialization stage of the initial security detection model are replaced with the starting parameters. Second, the preset parameters in the algorithm operation process are updated with dynamic parameters.

[0068] Furthermore, the home network is monitored for security after the new device is connected, based on the revised initial security detection model.

[0069] This application proposes a home network security monitoring method based on FTTR. First, an initial security detection model is constructed based on historical behavioral data representing the network status of historical devices. Second, when a new device is connected, behavioral data of the new device is collected, and the similarity between the new device's behavioral data and the historical behavioral data of each device is calculated. The preset parameters of the initial security detection model are adjusted based on the new device's connection time and similarity. This addresses the issue of false positives when using the initial security detection model directly when a new device is first connected, due to the limited data volume. Furthermore, this application considers the situation where the behavioral data of the new device increases with its connection time, and its behavioral characteristics gradually become apparent. In this case, gradually reducing the preset parameters with the new device's connection time can improve detection accuracy. Finally, the initial security detection model is corrected based on the adjusted preset parameters, and home network security monitoring is completed based on the corrected initial security detection model. This solves the technical problem that traditional anomaly detection models trained on historical data cannot automatically adapt to the changes in the feature space caused by the connection of a new device, leading to a sharp increase in false positive rates.

[0070] Based on the above embodiments, Figure 2 This is a structural block diagram of a home network security monitoring device based on FTTR according to one embodiment of this application, as shown below. Figure 2As shown, the FTTR-based home network security monitoring device 200 may include: an initial security detection model construction module 210, a new device access module 220, a parameter adjustment module 230, and a model adjustment module 240, wherein,

[0071] The initial security detection model construction module 210 is used to collect historical behavior data of each device in the home network and construct an initial security detection model based on the historical behavior data, preset parameters and DBSCAN algorithm.

[0072] The new device access module 220 is used to collect the behavior data of the new device and calculate the similarity between the behavior data and the historical behavior data of each device when a new device is accessed.

[0073] The parameter adjustment module 230 is used to adjust the preset parameters based on the access time of the new device and the similarity.

[0074] The model adjustment module 240 is used to correct the initial security detection model based on the adjusted preset parameters, and to complete home network security monitoring based on the corrected initial security detection model.

[0075] In an exemplary embodiment, the input of the initial security detection model in the initial security detection model construction module 210 is the historical behavior data, and the output of the initial security detection model is anomalies and multiple clusters.

[0076] In an exemplary embodiment, the new device access module 220 can also be used to determine the center point of each cluster based on the clustering results obtained from the initial security detection model; and to calculate the similarity between the behavior data and each cluster based on the historical behavior data corresponding to the center point of each cluster.

[0077] In an exemplary embodiment, the parameter adjustment module 230 can also be used to determine the initial dynamic parameters of each cluster based on the similarity; and adjust the preset parameters based on the initial dynamic parameters of each cluster and the access time of the new device to obtain the dynamic parameters of each cluster.

[0078] In an exemplary embodiment, the parameter adjustment module 230 can also adjust the preset parameters using the following formulas (1) and (2) to obtain the dynamic parameters of each cluster:

[0079]

[0080] In the formula, Indicates the first Dynamic parameters of each cluster class, Indicates the first The initial dynamic parameters of each cluster class, Indicates preset parameters. This indicates the preset maximum parameter. Indicates the first Similarity among clusters, This indicates the access time of the new device. This indicates the preset adjustment constant.

[0081] In an exemplary embodiment, the initial security detection model construction module 210 can also be used to extract features from the historical behavior data to obtain feature data; the construction of the initial security detection model based on the historical behavior data, preset parameters and DBSCAN algorithm includes: constructing the initial security detection model based on the feature data, preset parameters and DBSCAN algorithm.

[0082] In an exemplary embodiment, the initial security detection model construction module 210 can also be used to determine anomaly labels based on the historical behavior data; calculate the correlation between each piece of historical behavior data and the anomaly label; and extract features from the historical behavior data based on the correlation to obtain feature data.

[0083] Those skilled in the art should understand that the division of the various modules in the embodiments is merely a logical functional division. In actual applications, they can be fully or partially integrated onto one or more actual carriers. These modules can be implemented entirely in software through processing unit calls, entirely in hardware, or a combination of software and hardware. It should be noted that each module in the FTTR-based home network security monitoring device in this embodiment corresponds one-to-one with each step in the FTTR-based home network security monitoring method in the aforementioned embodiments. Therefore, the specific implementation of this embodiment can refer to the implementation of the aforementioned FTTR-based home network security monitoring method, which will not be repeated here.

[0084] Based on the above embodiments, Figure 3 This is a schematic diagram of the structure of a home network security monitoring device based on FTTR according to one embodiment of this application, as shown below. Figure 3As shown, the electronic device may include a processor 310, a communication interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute a home network security monitoring method based on FTTR. The method includes: collecting historical behavior data of each device in the home network and constructing an initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm; when a new device is connected, collecting the behavior data of the new device and calculating the similarity between the behavior data and the historical behavior data of each device; adjusting the preset parameters based on the access time of the new device and the similarity; correcting the initial security detection model based on the adjusted preset parameters, and completing home network security monitoring based on the corrected initial security detection model.

[0085] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0086] Based on the above embodiments, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the FTTR-based home network security monitoring method provided by the above methods. The method includes: collecting historical behavior data of each device in the home network and constructing an initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm; when a new device is connected, collecting the behavior data of the new device and calculating the similarity between the behavior data and the historical behavior data of each device; adjusting the preset parameters based on the access time of the new device and the similarity; correcting the initial security detection model based on the adjusted preset parameters, and completing home network security monitoring based on the corrected initial security detection model.

[0087] Based on the above embodiments, in another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the FTTR-based home network security monitoring method provided by the above methods. The method includes: collecting historical behavior data of each device in the home network and constructing an initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm; when a new device is connected, collecting the behavior data of the new device and calculating the similarity between the behavior data and the historical behavior data of each device; adjusting the preset parameters based on the access time of the new device and the similarity; correcting the initial security detection model based on the adjusted preset parameters, and completing home network security monitoring based on the corrected initial security detection model.

[0088] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A home network security monitoring method based on FTTR, characterized in that, include: Historical behavior data of each device in the home network is collected, and an initial security detection model is constructed based on the historical behavior data, preset parameters, and the DBSCAN algorithm. The input of the initial security detection model is the historical behavior data, and the output of the initial security detection model is anomalies and multiple clusters. When a new device is connected, the behavior data of the new device is collected and the similarity between the behavior data and the historical behavior data of each device is calculated. The preset parameters are adjusted based on the access time of the new device and the similarity. The initial security detection model is corrected based on the adjusted preset parameters, and home network security monitoring is completed based on the corrected initial security detection model. The adjustment of the preset parameters based on the access time of the new device and the similarity includes: The initial dynamic parameters of each cluster class are determined based on the similarity. The preset parameters are adjusted based on the initial dynamic parameters of each cluster class and the access time of the new device to obtain the dynamic parameters of each cluster class. The process of correcting the initial security detection model based on the adjusted preset parameters includes: The initial security detection model is modified based on the dynamic parameters of each of the aforementioned clusters; The adjustment of the preset parameters based on the initial dynamic parameters of each cluster and the access time of the new device to obtain the dynamic parameters of each cluster includes: The preset parameters are adjusted using the following formulas (1) and (2) to obtain the dynamic parameters of each cluster class: In the formula, Indicates the first Dynamic parameters of each cluster class, Indicates the first The initial dynamic parameters of each cluster class, Indicates preset parameters. This indicates the preset maximum parameter. Indicates the first Similarity among clusters, This indicates the access time of the new device. This indicates the preset adjustment constant.

2. The home network security monitoring method based on FTTR as described in claim 1, characterized in that, The calculation of the similarity between the behavioral data and the historical behavioral data of each of the devices includes: The center point of each cluster is determined based on the clustering results obtained from the initial security detection model; The similarity between the behavioral data and each cluster class is calculated based on the historical behavioral data corresponding to the center point of each cluster class.

3. The home network security monitoring method based on FTTR as described in claim 1, characterized in that, Before constructing the initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm, the method further includes: Feature data is obtained by extracting features from the historical behavior data; The construction of the initial security detection model based on the historical behavior data, preset parameters, and the DBSCAN algorithm includes: An initial security detection model is constructed based on the aforementioned feature data, preset parameters, and the DBSCAN algorithm.

4. The home network security monitoring method based on FTTR as described in claim 3, characterized in that, The step of extracting features from the historical behavior data to obtain feature data includes: Anomaly labels are determined based on the historical behavior data; Calculate the correlation between each of the historical behavior data and the anomaly label; Feature data is obtained by extracting features from the historical behavior data based on the correlation.

5. A home network security monitoring device based on FTTR, characterized in that, include: An initial security detection model construction module is used to collect historical behavior data of each device in the home network and construct an initial security detection model based on the historical behavior data, preset parameters and DBSCAN algorithm. The input of the initial security detection model is the historical behavior data, and the output of the initial security detection model is anomalies and multiple clusters. The new device access module is used to collect the behavior data of the new device and calculate the similarity between the behavior data and the historical behavior data of each device when a new device is accessed. The parameter adjustment module is used to adjust the preset parameters based on the access time of the new device and the similarity. The model adjustment module is used to correct the initial security detection model based on the adjusted preset parameters, and to complete home network security monitoring based on the corrected initial security detection model; The parameter adjustment module is further configured to determine the initial dynamic parameters of each cluster based on the similarity; and to adjust the preset parameters based on the initial dynamic parameters of each cluster and the access time of the new device to obtain the dynamic parameters of each cluster. The model adjustment module is also used to correct the initial security detection model based on the dynamic parameters of each of the clusters; The parameter adjustment module is also used to adjust the preset parameters using the following formulas (1) and (2) to obtain the dynamic parameters of each cluster: In the formula, Indicates the first Dynamic parameters of each cluster class, Indicates the first The initial dynamic parameters of each cluster class, Indicates preset parameters. This indicates the preset maximum parameter. Indicates the first Similarity among clusters, This indicates the access time of the new device. This indicates the preset adjustment constant.

6. A home network security monitoring device based on FTTR, characterized in that, include: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the FTTR-based home network security monitoring method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the FTTR-based home network security monitoring method as described in any one of claims 1 to 4.

Images