Situation awareness and threat early warning method for malicious programs in Internet of Things environment

Abstract

The invention relates to the technical field of network security, in particular to a situation awareness and threat early warning method for malicious programs in an Internet of Things environment, which comprises the following steps: S1, cache state detection: obtaining cache state data of a domain name resolution server in a target network through an active detection technology; s2, threat association analysis: carrying out association analysis on the cache state data and a threat intelligence library, and identifying malicious program communication behaviors; s3, maliciousness inference: inferring the maliciousness likelihood of an unknown threat domain name by using a symbiotic behavior detection algorithm; s4, infection scale evaluation: generating traceable data including a time sequence, a correlation model and a scale estimation result based on spatial time sequence analysis of DNS dynamic cache data; data are acquired through lightweight DNS cache detection, threats are identified in combination with a threat intelligence library and a symbiotic behavior detection algorithm, the detection efficiency is optimized through intelligent scheduling, the infection scale is evaluated based on gamma distribution, and comprehensive safety protection is provided for the power Internet of Things.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a situation awareness and threat early warning method for malicious programs in an Internet of Things environment. BACKGROUND

[0002] Under the background of rapid development of Internet economy, network space struggle is intensifying, and the United States and other Western countries regard China as a strategic opponent in network space and launch network attacks on the fields of power and telecommunications. In recent years, data leakage incidents have occurred frequently, with more than 100 large-scale leakage incidents involving more than 100 million data in a year, with a total of 5 billion data, and network security problems are increasingly prominent;

[0003] According to the public number: CN111600842B, a trusted threat intelligence Internet of Things terminal security control method and system are disclosed, which discloses "evaluating how many terminals in the network access a certain threat domain name or are infected with similar malicious programs in a period of time, so as to facilitate customers to determine the scope of influence in time and form an emergency processing scheme; using DNS cache detection technology, combined with ubiquitous power Internet of Things threat intelligence, the security threats and risks faced by the network are identified and perceived, realizing ubiquitous terminal threat online detection under the condition of no traffic mirroring, meeting the demand for cross-platform and cross-equipment terminal threat detection in the ubiquitous power Internet of Things environment, and improving the company's internal network security threat detection capability" and other technical solutions;

[0004] The existing detection method based on traffic mirroring cannot cope with the high-concurrency DNS query request generated by a large number of terminal devices in the power Internet of Things, resulting in low detection efficiency and inability to realize real-time monitoring; and the lack of a unified security view across platforms cannot effectively identify the propagation path of malicious programs and evaluate the infection scale. SUMMARY

[0005] In view of the deficiencies of the prior art, the present application provides a situation awareness and threat early warning method for malicious programs in an Internet of Things environment, which obtains data through lightweight DNS cache detection, identifies threats by combining a threat intelligence library and a symbiotic behavior detection algorithm, optimizes detection efficiency by using intelligent scheduling, evaluates the infection scale based on a gamma distribution, and provides comprehensive security protection for the power Internet of Things.

[0006] To achieve the above purpose, the present application realizes the following technical solutions: a situation awareness and threat early warning method for malicious programs in an Internet of Things environment, comprising the following steps:

[0007] S1, cache state detection: obtaining cache state data of a domain name resolution server in a target network through active detection technology;

[0008] S2, threat correlation analysis: correlate the cache state data with a threat intelligence library to identify malicious program communication behavior;

[0009] S3, maliciousness inference: use symbiotic behavior detection algorithms to infer the maliciousness likelihood of unknown threat domain names;

[0010] S4, infection scale evaluation: based on spatial and temporal analysis of DNS dynamic cache data, generate traceable data containing time series, correlation model and scale estimation results;

[0011] S5, situation visualization: display the overall threat situation awareness result through a visual interface.

[0012] Preferably, the active probing technology in S1 includes:

[0013] Probe packet construction: construct a non-recursive query data packet conforming to the DNS protocol standard;

[0014] Probe packet sending: send the probe packet to the target recursive DNS server in TTL cycles;

[0015] Response analysis: analyze the server response to obtain the dynamic refresh state of the threat domain name in the DNS cache;

[0016] Intelligent scheduling: coordinate and control the sending process of the probe packet.

[0017] Preferably, the intelligent scheduling includes:

[0018] Node scheduling: implement distributed multi-node probing scheduling based on the size of the recursive DNS node;

[0019] Concurrent scheduling: conduct large-scale concurrent thread scheduling according to the number of threat domain names and TTL cycles, where the number of concurrent threads N = α·M / T, α is the adjustment coefficient, M is the number of threat domain names, and T is the TTL cycle;

[0020] Periodic scheduling: dynamically adjust the probing frequency using the TTL cache mechanism.

[0021] Preferably, the threat intelligence library in S2 includes:

[0022] Intelligence collection: collect threat data from global open-source intelligence websites through distributed crawlers with anti-censorship mechanisms;

[0023] Attack trapping: deploy a honeypot system simulating power Internet of Things terminals to trap unknown threat attacks;

[0024] Intelligence evaluation: evaluate threat intelligence based on historical vulnerability conditions, popularity and update frequency.

[0025] Preferably, the symbiotic behavior detection algorithm in S3 comprises:

[0026] Relationship graph construction, construct the trace overlap relationship graph between domain names, and the edge weight w=Jaccard(A, B), A and B are the terminal set corresponding to the domain name pair;

[0027] Seed node marking, taking the known malicious domain name as the seed node, and the initial malicious score S0∈[0.8, 1.0];

[0028] Malicious propagation, transmitting the maliciousness to the associated unknown domain name through the PageRank algorithm;

[0029] Likelihood calculation, output the final malicious score S∈[0, 1] of each domain name.

[0030] Preferably, the traceable data generated in S4 comprises:

[0031] The cache refresh interval time sequence CRI_Seq={CRI1, CRI2,..., CRIn}, wherein CRIi obeys the gamma distribution Γ(k, θ);

[0032] The terminal request association model f: CRI_Seq→Request_Pattern;

[0033] The terminal size estimation result N=floor(k·θ), wherein k is the shape parameter and θ is the scale parameter.

[0034] Preferably, the traceable data is further used for:

[0035] Time alignment and association of DNS resolution logs and the CRI_Seq;

[0036] Reconstructing the attack path based on the threat domain name resolution record and the Request_Pattern, and verifying by using the threat intelligence library in S2;

[0037] Generating the spatial distribution identification of the affected terminal group according to the N value, and the identification accuracy reaches the IP network segment level.

[0038] Preferably, the visualization interface in S5 comprises:

[0039] Geographical situation display, presenting the geographical distribution of threat events by a heat map, wherein the heat value H=log10(N+1);

[0040] Time series trend display, predicting the time series trend of the threat type by using the ARIMA model;

[0041] Scale statistics display, displaying the statistical distribution of the affected terminal size in a box plot.

[0042] The present application provides a situation awareness and threat early warning method for malicious programs in an Internet of Things environment.

[0043] Compared with the prior art, the following beneficial effects are possessed:

[0044] 1. Through the lightweight DNS cache detection technology and intelligent scheduling mechanism, efficient coverage and accurate monitoring of the power Internet of Things are realized; using a non-intrusive detection method, DNS cache state data is obtained in real time without affecting business operation, and through distributed node scheduling and dynamic concurrency control, comprehensive monitoring of a large number of terminal devices is ensured; combined with the Gamma distribution model and space-time analysis technology, the infection scale can be accurately evaluated and traceable data can be generated, providing a reliable basis for threat analysis; not only the monitoring efficiency is improved, but also the false positive rate is greatly reduced, meeting the demand of the power industry for high-precision security monitoring.

[0045] 2. Through the fusion of multi-source threat intelligence and symbiotic behavior detection algorithm, intelligent identification and evaluation of unknown threats are realized; the threat intelligence library integrates authoritative data sources and honeypot trapping results, combined with a dynamic scoring mechanism, the identification accuracy of malicious domain names is significantly improved; the symbiotic behavior detection algorithm is optimized based on graph neural networks and PageRank, effectively capturing the propagation mode of new threats such as DGA domain names; and through attack path reconstruction and spatial distribution identification technology, the security team can quickly locate the threat source and the scope of influence, providing decision support for emergency response, greatly shortening the disposal time.

[0046] 3. Through intelligent resource scheduling and adaptive detection mechanism, the best balance between system performance and business stability is realized; the intelligent scheduling module dynamically adjusts the detection parameters according to the network load and threat situation, ensuring monitoring coverage while controlling resource consumption within a reasonable range; the non-intrusive detection technology avoids interference with the power business system, fully meeting the requirement of "zero business interruption"; the GeoHash algorithm used realizes accurate threat positioning while strictly following data desensitization specifications to ensure information security; it can operate stably in complex network environments, providing continuous and reliable security protection for the power Internet of Things. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 The method steps block diagram of the present application;

[0048] Figure 2 The block diagram of the active detection technology in the present application;

[0049] Figure 3 The block diagram of intelligent scheduling in the present application;

[0050] Figure 4 The block diagram of the threat intelligence library in the present application;

[0051] Figure 5 Figure 1 is a block diagram of the symbiotic behavior detection algorithm in the present application;

[0052] Figure 6 Figure 2 is a block diagram of the visual interface display in the present application. DETAILED DESCRIPTION

[0053] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0054] Please refer to Figure 1 Figure 6 The present application provides a technical solution: a situation awareness and threat early warning method for malicious programs in an Internet of Things environment, comprising the following steps:

[0055] S1, cache state detection: obtaining cache state data of a domain name resolution server in a target network through active detection technology;

[0056] S2, threat correlation analysis: correlating and analyzing the cache state data with a threat intelligence library to identify malicious program communication behavior;

[0057] S3, maliciousness inference: using a symbiotic behavior detection algorithm to infer the malicious likelihood of an unknown threat domain name;

[0058] S4, infection scale evaluation: based on spatial and temporal analysis of DNS dynamic cache data, generating traceable data containing time series, correlation models and scale estimation results;

[0059] S5, situation visualization: displaying the overall threat situation awareness result through a visual interface.

[0060] ​In this implementation, during the cache status detection phase, the system uses lightweight DNS cache detection technology to obtain DNS cache status without collecting raw traffic data. The threat correlation analysis module integrates threat intelligence from authoritative vulnerability libraries and identifies malicious domain names through a feature matching algorithm. Symbiotic behavior detection constructs a domain name correlation map to effectively identify the generation patterns of new DGA domain names. Infection scale assessment, based on a distributed computing framework, performs real-time cluster analysis of DNS records generated by massive terminals. The situation visualization platform supports real-time access and collaborative analysis from multiple terminals. A security monitoring system covering all aspects of the power Internet of Things has been established. The non-invasive detection technology meets the power industry's "zero business interruption" requirement, and standardized data interfaces support the automated sharing of threat intelligence. The system uses the GeoHash algorithm to convert IP addresses into geographic grid identifiers, enabling substation-level threat localization while meeting the data desensitization requirements of the "Regulations on the Security Protection of Power Monitoring Systems."

[0061] Specifically, the active detection technology in S1 includes:

[0062] Probe packet construction, constructing a non-recursive query data packet that complies with the DNS protocol standard;

[0063] Probe packet sending: Probe packets are sent to the target recursive DNS server in units of TTL cycles;

[0064] Response parsing: Parse the server response and obtain the dynamic refresh status of the threat domain name in the DNS cache;

[0065] Intelligent scheduling coordinates and controls the sending process of detection packets.

[0066] In this embodiment, at the node scheduling level, the system automatically divides the detection area and allocates detection nodes according to the topology of the target network and the geographical distribution of the recursive DNS server, ensuring effective coverage of the entire power Internet of Things. At the concurrency control level, the system dynamically monitors the real-time changes of the list of domain names to be detected, and intelligently allocates thread resources based on the threat level and business priority to achieve efficient parallel processing of detection tasks. At the timing control level, by accurately tracking the TTL remaining time of each domain name, an adaptive adjustment mechanism for the detection frequency is established, which not only ensures the timeliness of cached data but also avoids invalid detection.

[0067] Specifically, the intelligent scheduling includes:

[0068] Node scheduling, which implements distributed multi-node detection scheduling based on the scale of recursive DNS nodes;

[0069] Concurrent scheduling: Perform large-scale concurrent thread scheduling based on the number of threat domain names and the TTL period, where the concurrency number N = α·M / T, where α is the adjustment coefficient, M is the number of threat domain names, and T is the TTL period;

[0070] Periodic scheduling, dynamic adjustment of probe frequency using TTL cache mechanism.

[0071] In this embodiment, the intelligent scheduling system realizes precise detection control through a three-level coordination mechanism. At the node scheduling level, the system analyzes the distribution density and service capacity of recursive DNS servers in the target network in real time, uses an adaptive partitioning algorithm to dynamically assign the detection task to the optimal detection node, and ensures full coverage monitoring of tens of thousands of Internet of Things terminals in the provincial power network. At the concurrent scheduling level, based on the threat situation dynamic evaluation model, the optimal number of concurrent threads is calculated in real time through the formula N = a M / T, where the threat domain name library update triggers real-time scheduling strategy adjustment, realizing efficient processing of million-level domain name detection tasks. At the periodic scheduling level, combined with the DNS record time-to-live characteristics and network traffic monitoring data, a TTL dynamic compensation algorithm is established to keep the detection frequency within the optimal interval. In the concurrent scheduling formula N = a M / T, the adjustment coefficient a is in the range of 0.5 to 1.5, and its specific value is dynamically adjusted according to the network environment: a lower value of 0.5-0.8 is taken during peak business hours to avoid network congestion, a value of 1.0-1.2 is taken during regular periods to maintain balanced detection efficiency, and for key monitoring areas, it can be increased to 1.3-1.5 to enhance monitoring intensity. The default value of the adjustment coefficient is 1.0, at which point the system can achieve the best balance between detection coverage and resource consumption in a typical power Internet of Things environment.

[0072] Specifically, the threat intelligence library in S2 includes:

[0073] Intelligence collection: Collect threat data from global open-source intelligence websites through distributed crawlers with anti-censorship mechanisms;

[0074] Attack trapping: Deploy honeypot systems simulating power Internet of Things terminals to trap unknown threat attacks;

[0075] Intelligence evaluation: Evaluate threat intelligence from historical vulnerability conditions, prevalence, and update frequency.

[0076] In this embodiment, in the intelligence collection link, the distributed crawler system uses dynamic UA camouflage, IP rotation, and request speed limit anti-censorship strategies to obtain the latest malicious domain name, IP, and attack feature data from 15 authoritative threat intelligence platforms such as VirusTotal and MalwareDomainList; In the attack trapping link, a honeypot cluster simulating the behavior of typical power Internet of Things terminals such as smart meters and charging piles is deployed to trap new attack samples by constructing false vulnerabilities, trapping dozens of zero-day attack behaviors per day; Intelligence evaluation uses a multi-dimensional weighting algorithm, combining vulnerability historical active period, geographical distribution characteristics, and 30-day appearance frequency indicators to dynamically score and classify threat intelligence.

[0077] Specifically, the symbiotic behavior detection algorithm in S3 includes:

[0078] Relationship graph construction, a trace overlap relationship graph between domain names is constructed, and the edge weight w=Jaccard(A, B), A and B are terminal sets corresponding to the domain name pair;

[0079] Seed node marking, taking the known malicious domain name as the seed node, and the initial malicious score S0 [0.8, 1.0];

[0080] Malicious propagation, the maliciousness is transmitted to the associated unknown domain name through the PageRank algorithm;

[0081] Likelihood calculation, output the final malicious score S of each domain name [0, 1].

[0082] In this embodiment, the symbiotic behavior detection algorithm realizes intelligent analysis of threat propagation through a graph neural network. In the relationship graph construction phase, the system processes more than one million DNS query records daily, and uses an improved Jaccard similarity algorithm to calculate the correlation strength between domain names. The terminal set A and B are dynamically updated through a sliding time window to ensure that the relationship graph reflects the latest network situation in real time. The seed node selection considers five authoritative data sources, including CNCERT blacklist and VirusTotal detection results. The initial score S0 is dynamically assigned according to the threat confidence. The malicious propagation process introduces device association rules specific to the power Internet of Things, and adds a terminal type weight factor based on the standard PageRank algorithm, making the propagation path more consistent with the characteristics of the power business scenario.

[0083] Specifically, the traceable data generated in S4 includes:

[0084] The cache refresh interval time sequence CRI_Seq={CRI1, CRI2,..., CRIn}, wherein CRIi follows the gamma distribution Γ(k, θ);

[0085] Terminal request association model f: CRI_Seq→Request_Pattern;

[0086] Terminal size estimation result N=floor(k·θ), wherein k is the shape parameter and θ is the scale parameter.

[0087] In this embodiment, by continuously monitoring the cache refresh behavior of the recursive DNS server in the target network, a time series CRI_Seq is constructed, and the gamma distribution characteristics of the power Internet of Things terminal are verified based on the specific access mode of the terminal. The terminal request association model combines time series analysis and machine learning algorithms, and can extract the Request_Pattern reflecting the communication characteristics of malicious programs from massive cache records. The terminal scale estimation is based on a distributed computing framework to update the shape parameter k and scale parameter θ in real time, ensuring that the evaluation accuracy is maintained in a large-scale network environment.

[0088] Specifically, the traceable data is further used for:

[0089] Time alignment and association of DNS resolution logs and CRI_Seq;

[0090] Reconstruction of attack paths based on threat domain name resolution records and Request_Pattern, and verification using the threat intelligence library in S2;

[0091] According to the N value, the spatial distribution identifier of the affected terminal group is generated, and the identification accuracy reaches the IP network segment level.

[0092] In this embodiment, a timestamp-based precise alignment algorithm is used to synchronize and associate the CRI_Seq time series generated by the recursive DNS server with the original DNS logs collected by the core network equipment at the millisecond level, and a complete communication behavior timeline is constructed. Attack path reconstruction combined with the labeling information of the threat intelligence library identifies the topological relationship between C&C servers, relay nodes and controlled terminals through a graph traversal algorithm, and the Request_Pattern feature is used to verify the rationality of the attack link. The spatial distribution identifier generation uses the GeoHash geocoding technology to convert IP addresses into grid area identifiers, ensuring positioning accuracy while avoiding exposure of specific device information.

[0093] Specifically, the visualization interface in S5 includes:

[0094] Geographical situation display, showing the geographical distribution of threat events through a heat map, where the heat value H = log10(N+1);

[0095] Time trend display, using an ARIMA model to predict the time series trend of threat types;

[0096] Scale statistics display, showing the statistical distribution of the size of affected terminals in a box plot.

[0097] In this embodiment, the visualization system realizes the intuitive presentation of threat situation through multidimensional data analysis technology; the hierarchical coloring scheme is adopted for the geographical situation, and the heat value H=log10(N+1) is mapped into the six-color gradient spectrum, wherein the provincial power grid dispatching center can intuitively identify the threat aggregation area of the city level; the autoregressive analysis of historical threat data is performed through the ARIMA model for the time trend, the prediction curve of the future 72 hours is generated, and the confidence interval is marked with different color bands in the interface; the box plot display of the scale statistics adopts the Tukey method to calculate the five-number summary of data distribution, and the network area that needs to be focused on is identified through the abnormal value mark.

[0098] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one entity or action from another, without necessarily requiring or implying any such actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0099] While embodiments of the present application have been shown and described, it is to be understood that various modifications, substitutions, combinations, and variations of the embodiments can be made by those skilled in the art without departing from the spirit and scope of the present application, which is defined by the appended claims and their equivalents.

Claims

1. A situational awareness and threat warning method for malicious programs in an IoT environment includes the following steps: S1, cache status detection: obtain the cache status data of the domain name resolution server in the target network through active detection technology; S2, threat correlation analysis: performing correlation analysis on the cache status data and the threat intelligence library to identify malicious program communication behaviors; S3, Maliciousness Inference: Using the symbiotic behavior detection algorithm to infer the malicious likelihood of unknown threat domain names; S4, infection scale assessment: Based on spatial temporal analysis of DNS dynamic cache data, traceable data including time series, correlation models and scale estimation results are generated; S5, Situation Visualization: Display the overall threat situation awareness results through a visual interface.

2. The situational awareness and threat warning method for malicious programs in an Internet of Things environment according to claim 1, characterized in that: The active detection technology in S1 includes: Probe packet construction, constructing a non-recursive query data packet that complies with the DNS protocol standard; Probe packet sending: Probe packets are sent to the target recursive DNS server in units of TTL cycles; Response parsing: Parse the server response and obtain the dynamic refresh status of the threat domain name in the DNS cache; Intelligent scheduling coordinates and controls the sending process of detection packets.

3. The situational awareness and threat warning method for malicious programs in an Internet of Things environment according to claim 2, characterized in that: The intelligent scheduling includes: Node scheduling, which implements distributed multi-node detection scheduling based on the scale of recursive DNS nodes; Concurrent scheduling: Perform large-scale concurrent thread scheduling based on the number of threat domain names and the TTL period, where the concurrency number N = α·M / T, where α is the adjustment coefficient, M is the number of threat domain names, and T is the TTL period; Periodic scheduling, using the TTL cache mechanism to dynamically adjust the detection frequency.

4. The situational awareness and threat warning method for malicious programs in an Internet of Things environment according to claim 1, characterized in that: The threat intelligence library in S2 includes: Intelligence gathering, which collects threat data from global open-source intelligence websites through distributed crawlers with anti-blocking mechanisms; Attack trapping: deploying a honeypot system that simulates power IoT terminals to trap unknown threat attacks; Intelligence assessment, evaluating threat intelligence based on historical vulnerability status, prevalence, and update frequency.

5. The situational awareness and threat warning method for malicious programs in an Internet of Things environment according to claim 1, characterized in that: The symbiotic behavior detection algorithm in S3 includes: Relationship graph construction: construct the trace overlap relationship graph between domain names, where the edge weight w = Jaccard(A, B), A and B are the terminal sets corresponding to the domain names; Seed node marking, using known malicious domain names as seed nodes, and its initial malicious score is S0∈[0.8,1.0]; Malicious spread, passing maliciousness to associated unknown domains through the PageRank algorithm; Likelihood calculation, output the final malicious score S∈[0,1] of each domain name.

6. The situational awareness and threat warning method for malicious programs in an Internet of Things environment according to claim 1, characterized in that: The traceable data generated in S4 includes: Cache refresh interval time series CRI_Seq = {CRI1, CRI2, ..., CRIn}, where CRIi follows a gamma distribution Γ(k, θ); Terminal request association model f:CRI_Seq→Request_Pattern; The terminal scale estimation result N = floor(k·θ), where k is the shape parameter and θ is the scale parameter.

7. The situational awareness and threat warning method for malicious programs in an Internet of Things environment according to claim 6, characterized in that: The traceable data is further used to: Time-align and associate the DNS resolution log with the CRI_Seq; Reconstruct the attack path based on the threat domain name resolution record and the Request_Pattern, and verify it using the threat intelligence library in S2; A spatial distribution identifier of the affected terminal group is generated according to the N value, with the identifier accuracy reaching the IP network segment level.

8. The situational awareness and threat warning method for malicious programs in an Internet of Things environment according to claim 1, characterized in that: The visual interface display in S5 includes: Geographic situation display, showing the geographical distribution of threat events through heat maps, where the heat value H = log10(N+1); Time series trend display, using ARIMA model to predict the time series trend of threat types; Scale statistics display, using box plots to show the statistical distribution of the affected terminal scales.

Images