Access control management method and system for internet of things device

Abstract

The application provides an access control management method and system of Internet of Things equipment, and relates to the technical field of Internet of Things. The method comprises the following steps: collecting access behavior log data of a plurality of edge nodes, constructing a plurality of session units of each edge node and generating a plurality of local access behavior sequences, extracting a plurality of initial behavior feature segments and constructing an initial behavior feature set, generating a target behavior feature set through associated behavior iterative growth on the initial behavior feature set, reconstructing the features of the local access behavior sequences and constructing a behavior association graph about the plurality of edge nodes, constructing a local behavior association matrix according to the plurality of reconstructed access behavior sequences, performing real-time access behavior anomaly analysis on the plurality of edge nodes in combination with the behavior association graph and the local behavior association matrix, and generating a real-time behavior anomaly analysis result to be used for access control optimization of the plurality of edge nodes. The application improves the security control capability of abnormal access behavior of Internet of Things equipment.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to an access control management method and system for IoT devices. Background Technology

[0002] In IoT systems, edge node devices are typically responsible for connecting and managing multiple devices, processing and forwarding data, and executing specific functional interfaces. These node devices usually require fine-grained access control to ensure their behavior complies with predetermined security policies.

[0003] Currently, most IoT device access control management methods rely on static rules and permission-based access control, restricting device access to functional interfaces through predefined rules governing device behavior. However, in some scenarios, the access behavior of edge node devices is highly dynamic, with the functional interfaces accessed by the device exhibiting diversity and dynamic changes depending on the device's usage scenario, environment, and task requirements. Under rule-based and permission list-based access control, each access behavior may conform to static rules or permission settings, but some potential anomalies may be masked in the continuous behavioral patterns of the device. Especially when a device accesses multiple functional interfaces, if its behavior deviates from its original pattern, this deviation may not directly violate existing access control rules, but it implies anomaly risks.

[0004] Therefore, there is an urgent need for an access control management method and system for IoT devices to solve the above problems. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention proposes an access control management method and system for IoT devices. By performing dynamic behavior analysis on the access behavior log data of node devices, it captures potential hidden abnormal behaviors, thereby achieving more precise access control management.

[0006] The first aspect of this invention provides an access control management method for Internet of Things (IoT) devices, comprising:

[0007] Collect access behavior log data from multiple edge nodes, construct multiple session units for each edge node based on the access behavior log data, extract multiple access behavior features for each session unit, and construct a local access behavior sequence, where the access behavior features include resource category features and operation category features.

[0008] Multiple initial behavioral feature fragments are extracted from multiple local access behavior sequences to construct an initial behavioral feature set for access behavior log data. The initial behavioral feature set is then subjected to iterative growth of associated behaviors to generate a target behavioral feature set corresponding to the initial behavioral feature set, which includes multiple target behavioral feature fragments.

[0009] Based on the target behavior feature set, the local access behavior sequence is reconstructed to generate multiple reconstructed access behavior sequences. Based on the target behavior feature set and the multiple reconstructed access behavior sequences, a behavior association graph about multiple edge nodes is constructed.

[0010] Based on multiple reconstructed access behavior sequences, fragment behavior correlation analysis is performed and a local behavior correlation matrix is ​​constructed. Combining the behavior correlation map and the local behavior correlation matrix, real-time access behavior anomaly analysis is performed on multiple edge nodes, generating real-time behavior anomaly analysis results, which are then used to optimize access control for multiple edge nodes.

[0011] Preferably, an initial behavioral feature set of access behavior log data is constructed, and the initial behavioral feature set is iteratively grown by associating behaviors to generate a target behavioral feature set corresponding to the initial behavioral feature set, including:

[0012] For each local access behavior sequence, perform neighbor behavior segmentation, extract multiple behavior feature pairs of the local access behavior sequence, and denote the multiple behavior feature pairs and multiple access behavior features of the local access behavior sequence as initial behavior feature fragments to construct an initial behavior feature set containing multiple initial behavior feature fragments.

[0013] The initial behavioral feature set is subjected to iterative growth based on related behaviors. This includes splicing feature fragments from the initial behavioral feature set based on multiple local access behavior sequences to generate multiple candidate sample fragments, calculating the reconstruction gain parameter of each candidate sample fragment based on multiple local access behavior sequences, determining multiple reconstructed sample fragments according to a preset reconstruction gain threshold, and updating the initial behavioral feature set based on the multiple reconstructed sample fragments. The process of splicing feature fragments from the initial behavioral feature set to updating the initial behavioral feature set is repeated until no more reconstructed sample fragments are generated. This completes the iterative growth of the initial behavioral feature set based on related behaviors and outputs a target behavioral feature set including multiple target behavioral feature fragments.

[0014] Preferably, the local access behavior sequence is reconstructed based on the target behavior feature set to generate multiple reconstructed access behavior sequences. A behavior association graph of multiple edge nodes is constructed based on the target behavior feature set and the multiple reconstructed access behavior sequences, including:

[0015] Matching local access behavior sequences based on multiple target behavior feature fragments, determining multiple target behavior feature fragments associated with each local access behavior sequence, and performing greedy reconstruction of local access behavior sequences based on multiple target behavior feature fragments, transforming local access behavior sequences into reconstructed access behavior sequences;

[0016] Using multiple target behavioral feature fragments as graph nodes of the behavioral association graph, a directed edge is constructed between any two graph nodes. Transition analysis is performed on multiple graph nodes based on multiple reconstructed access behavior sequences to determine the behavioral transition weight corresponding to each directed edge. The structural stability index of each graph node is determined based on multiple reconstructed access behavior sequences. A behavioral association graph is then constructed based on multiple graph nodes, their associated structural stability indices, and directed edges.

[0017] Preferably, fragment behavior correlation analysis is performed based on multiple reconstructed access behavior sequences, and a local behavior correlation matrix is ​​constructed, including:

[0018] Multiple target behavior feature fragments are combined in an ordered manner to generate multiple feature fragment pairs. Based on the two target behavior feature fragments contained in each feature fragment pair, an associated sample set for each feature fragment pair is constructed based on multiple reconstructed access behavior sequences.

[0019] Statistical analysis is performed on the associated sample set to determine the fragment distribution parameters corresponding to the two target behavior feature fragments contained in the feature fragment pair. Each reconstructed access behavior sequence in the associated sample set is traversed through the target association window to generate the combined co-occurrence distribution parameters of the feature fragment pair. Based on the fragment distribution parameters and the combined co-occurrence distribution parameters, the local behavior association parameters of the feature fragment pair are calculated, and a local behavior association matrix for multiple target behavior feature fragments is constructed.

[0020] Preferably, real-time access behavior anomaly analysis is performed on multiple edge nodes by combining behavioral correlation maps and local behavioral correlation matrices, including:

[0021] The real-time access behavior log data of edge nodes is obtained and the target access behavior sequence is constructed. The target access behavior sequence is reconstructed based on the target behavior feature set to generate the target reconstructed access behavior sequence.

[0022] Based on the behavior association graph, multiple structural stability indices and behavior transition weights are determined to associate the target reconstructed access behavior sequence. Based on the multiple structural stability indices and behavior transition weights, the feature reconstruction index of the target behavior feature fragment is calculated. The number of reconstructed fragments of the target behavior feature fragment is determined and combined with the feature reconstruction index to calculate the global behavior anomaly parameters of the target behavior feature fragment.

[0023] Based on the local behavior correlation matrix, multiple local behavior correlation parameters are determined to associate the target reconstruction access behavior sequence. Local behavior anomaly parameters of the target behavior feature fragment are generated based on the multiple local behavior correlation parameters. By fusing the global behavior anomaly parameters and the local behavior anomaly parameters, the real-time behavior anomaly analysis results of the edge node are obtained.

[0024] Preferably, the local access behavior sequence is reconstructed using a greedy algorithm, including:

[0025] A dual greedy reconstruction is performed on each local access behavior sequence based on multiple target behavior feature fragments, including minimizing the fragment number reconstruction and maximizing the feature coverage reconstruction, generating multiple candidate reconstruction sequences. The fragment number parameter and feature coverage parameter of each candidate reconstruction sequence are determined. The reconstruction matching parameter of the candidate reconstruction sequence is calculated based on the fragment number parameter and feature coverage parameter. Based on the reconstruction matching parameter, the reconstructed access behavior sequence transformed from the local access behavior sequence is determined from the candidate reconstruction sequences.

[0026] A second aspect of the present invention provides an access control management system for Internet of Things (IoT) devices, used to implement the above-described access control management method for IoT devices, comprising:

[0027] The access behavior feature analysis module is used to collect access behavior log data from multiple edge nodes, construct multiple session units for each edge node based on the access behavior log data, extract multiple access behavior features for each session unit, and construct a local access behavior sequence. The access behavior features include resource category features and operation category features.

[0028] The behavior feature fragment generation module is used to extract multiple initial behavior feature fragments from multiple local access behavior sequences, construct an initial behavior feature set about access behavior log data, perform iterative growth on the initial behavior feature set with associated behaviors, and generate a target behavior feature set corresponding to the initial behavior feature set, including multiple target behavior feature fragments.

[0029] The access behavior association analysis module is used to reconstruct the features of local access behavior sequences based on the target behavior feature set, generate multiple reconstructed access behavior sequences, and construct a behavior association map about multiple edge nodes based on the target behavior feature set and multiple reconstructed access behavior sequences.

[0030] The access control management module is used to perform fragment behavior correlation analysis based on multiple reconstructed access behavior sequences and construct a local behavior correlation matrix. It combines the behavior correlation map and the local behavior correlation matrix to perform real-time access behavior anomaly analysis on multiple edge nodes, generate real-time behavior anomaly analysis results, and use them to optimize access control for multiple edge nodes.

[0031] The present invention has the following beneficial effects:

[0032] This invention collects access behavior log data from multiple edge nodes, constructs local access behavior sequences, and extracts initial behavior feature fragments. Through iterative growth of associated behaviors, a more representative target behavior feature set is generated. Based on this, by reconstructing the features of the access behavior sequences and constructing a behavior association graph, combined with the local behavior association matrix obtained from fragment behavior association analysis, anomaly detection of real-time access behavior of edge nodes is achieved from two dimensions: global behavior pattern stability and local behavior fragment association. This effectively identifies potential anomalies that conform to static rules but deviate from historical behavior patterns, thereby dynamically optimizing access control strategies and improving the security management capabilities for abnormal access behaviors. Attached Figure Description

[0033] Figure 1 This is a flowchart illustrating an access control management method for an Internet of Things (IoT) device, as provided in an embodiment of the present invention.

[0034] Figure 2 This is a schematic diagram of the structure of an access control management system for an Internet of Things (IoT) device provided in an embodiment of the present invention. Detailed Implementation

[0035] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only for explaining the invention and are not intended to limit the invention.

[0036] Please see Figure 1 This invention provides an access control management method for Internet of Things (IoT) devices, the method comprising:

[0037] Step S1: Collect access behavior log data from multiple edge nodes, construct multiple session units for each edge node based on the access behavior log data, extract multiple access behavior features from each session unit, and construct a local access behavior sequence.

[0038] Specifically, in IoT systems, edge nodes refer to devices or computing units located close to the data source, responsible for handling edge tasks such as data acquisition, configuration management, and authentication / authorization. Node devices may need to frequently switch access interfaces in different scenarios, or access and invoke different resource interfaces according to task requirements. Access control methods based on static rules may not accurately reflect the true behavioral patterns of node devices, leading to the masking of certain potential abnormal access behaviors. For example, if a node device deviates from its behavior while accessing multiple functional interfaces, but this deviation does not directly violate existing access control rules or permission settings, the risk of abnormal behavior may be overlooked.

[0039] This invention performs access behavior modeling and analysis on access behavior log data from multiple edge nodes. These edge nodes can be IoT monitoring systems in buildings, production line monitoring systems in industrial scenarios, etc. For example, the edge node management on each floor is equipped with hardware devices such as cameras, sensors, and alarm devices, while the edge node management on different production lines is configured with multiple sensors for equipment and environmental monitoring, as well as production equipment. The access behavior log data includes information such as the access behavior of different edge nodes in different task scenarios, such as the resource category and operation category of the accessed interface. The log data can be divided based on session units. Time-continuous events are divided into session units. For example, adjacent events within an idle threshold (e.g., 5 minutes) are grouped into the same session, while events with an interval exceeding the idle threshold are opened into a new session. Each session unit includes a complete task processing flow, including authentication after receiving a request, processing the request, configuring parameters, and issuing control commands. For each session unit, access behavior features corresponding to multiple consecutive actions are extracted. In this embodiment, the access features of each action are characterized by two dimensions: resource category and operation category of the access interface. The resource category is the classification of different functional interfaces, such as authentication, reporting, and configuration interfaces. The operation type is the specific read, write, and execute actions of the specific functional interface. Each local access behavior feature includes resource category features and operation category features, such as discrete feature information like (authentication, execution) and (reporting, write). Multiple consecutive local access behavior features of the session unit are concatenated to construct the local access behavior sequence of the session unit.

[0040] Step S2: Extract multiple initial behavior feature fragments from multiple local access behavior sequences to construct an initial behavior feature set for access behavior log data. Perform iterative growth on the initial behavior feature set to generate a target behavior feature set corresponding to the initial behavior feature set.

[0041] Specifically, each local access behavior sequence is segmented to extract multiple initial behavior feature fragments from each sequence, constructing an initial behavior feature set containing basic behavior units. These feature fragments are then combined based on behavior associations using multiple local access behavior sequences, employing an iterative growth technique based on associated behaviors to gradually expand the initial feature set into a more comprehensive and representative target behavior feature set.

[0042] Optionally, an initial behavioral feature set of access behavior log data is constructed, and the initial behavioral feature set is iteratively grown by associating behaviors to generate a target behavioral feature set corresponding to the initial behavioral feature set, specifically including:

[0043] For each local access behavior sequence, neighbor behavior segmentation is performed. Specifically, any two adjacent access behavior features in the local access behavior sequence are regarded as a behavior feature pair to extract multiple behavior feature pairs for each local access behavior sequence. The multiple behavior feature pairs and multiple access behavior features of the local access behavior sequence are all recorded as initial behavior feature fragments, thereby constructing an initial behavior feature set containing multiple initial behavior feature fragments. The multiple initial behavior feature fragments serve as the basic fragment behaviors of continuous behaviors in different sessions. Combined with the behavior association information contained in the local access behavior sequence, these fragment behaviors are fused and spliced ​​to obtain multiple representative target behavior feature fragments.

[0044] Specifically, the initial behavior feature set is subjected to iterative growth based on related behaviors. This process includes splicing feature fragments of the initial behavior feature set based on multiple local access behavior sequences to generate multiple candidate sample fragments. Each candidate sample fragment is obtained by orderly splicing any two initial behavior feature fragments in the initial behavior feature set, and the fragment combination must exist in at least one local access behavior sequence. For example, if a local access behavior sequence is (A, B, B, C, E), then the fragment combination (A, B, B) obtained by orderly splicing the initial behavior feature fragment (A, B) and the initial behavior feature fragment (B) can be recorded as a candidate sample fragment. If the fragment combination (B, B, A) does not appear in any local access behavior sequence, then it does not belong to the candidate sample fragment.

[0045] After the feature fragments are assembled, the reconstruction gain parameter of each candidate sample fragment is calculated based on multiple local access behavior sequences. The calculation of the reconstruction gain parameter includes: counting the occurrence frequency of the candidate sample fragment according to multiple local access behavior sequences, and the occurrence frequency of the two initial behavior feature fragments in the candidate sample fragment respectively; calculating the product between the occurrence frequencies of the two initial behavior feature fragments respectively; and calculating the ratio of the occurrence frequency of the candidate sample fragment to the product between the occurrence frequencies of the two initial behavior feature fragments respectively as the reconstruction gain parameter of the candidate sample fragment.

[0046] Then, multiple reconstructed sample segments are determined based on a preset reconstruction gain threshold, and the initial behavioral feature set is updated based on these reconstructed sample segments. During this process, if the reconstruction gain parameter of a candidate sample segment is greater than the preset reconstruction gain threshold, it indicates that the segment has high information gain in historical data and can adapt well to historical behavior. Candidate sample segments with reconstruction gain parameters greater than the preset reconstruction gain threshold are marked as reconstructed sample segments, and the initial behavioral feature set is updated. This involves adding the reconstructed sample segments to the initial behavioral feature set and removing the initial behavioral feature segments used to constitute the reconstructed sample segments, thus completing one round of iterative growth.

[0047] Repeat the above process from splicing feature fragments from the initial behavior feature set to updating the initial behavior feature set until no more reconstructed sample fragments are generated, that is, after multiple fragments in the initial behavior feature set can no longer be spliced ​​to obtain new reconstructed sample fragments. This completes the iterative growth of the associated behavior of the initial behavior feature set, and finally outputs a target behavior feature set including multiple target behavior feature fragments, which is used to more accurately describe the interface access behavior of multiple edge nodes.

[0048] Step S3: Based on the target behavior feature set, the local access behavior sequence is reconstructed to generate multiple reconstructed access behavior sequences. Based on the target behavior feature set and the multiple reconstructed access behavior sequences, a behavior association graph about multiple edge nodes is constructed.

[0049] Specifically, the feature reconstruction process for local access behavior sequences involves transforming multiple discrete access behavior features within the sequence into fragments, representing them with multiple target behavior feature fragments to more accurately reflect the access behavior patterns of edge nodes in different contexts, while removing some noisy access behavior features from the original data. Furthermore, based on these reconstructed sequences, a behavior association map reflecting the evolutionary characteristics of different access behaviors among multiple edge nodes in dynamic task scenarios is constructed.

[0050] Optionally, feature reconstruction is performed on the local access behavior sequences based on the target behavior feature set to generate multiple reconstructed access behavior sequences. A behavior association graph about multiple edge nodes is constructed based on the target behavior feature set and the multiple reconstructed access behavior sequences, specifically including:

[0051] Matching local access behavior sequences based on multiple target behavior feature fragments determines the multiple target behavior feature fragments associated with each local access behavior sequence. In other words, multiple target behavior feature fragments are mapped to local access behavior sequences. If a target behavior feature fragment exists in a local access behavior sequence, it means that the target behavior feature fragment is associated with the local access behavior sequence, and that these target behavior feature fragments can be segmented from the local access behavior sequence.

[0052] A greedy reconstruction algorithm is used to reconstruct the local access behavior sequence based on multiple target behavior feature fragments, transforming the local access behavior sequence into a reconstructed access behavior sequence.

[0053] This process specifically involves a dual greedy reconstruction of each local access behavior sequence based on multiple target behavior feature fragments. This includes minimizing the number of fragments in the reconstruction and maximizing feature coverage. Specifically, it aims to represent the local access behavior sequence with as few target behavior feature fragments as possible, and to maximize the coverage of the access behavior features in the local access behavior sequence by the reconstructed sequence. Local optimization based on greedy algorithms is a well-known technique in the field and will not be elaborated upon here. After determining the target for local optimization, the final output includes multiple locally optimal reconstruction combinations corresponding to minimizing the number of fragments and maximizing feature coverage, respectively. These combinations are then marked as candidate reconstruction sequences.

[0054] Determine the fragment number parameter and feature coverage parameter for each candidate reconstruction sequence. The fragment number parameter is the ratio between the number of target behavior feature fragments in the candidate reconstruction sequence and the number of access behavior features in the local access behavior sequence. The feature coverage parameter is the ratio between the number of access behavior features involved in multiple target behavior feature fragments in the candidate reconstruction sequence and the total number of access behavior features in the local access behavior sequence.

[0055] Then, the reconstruction matching parameters of the candidate reconstruction sequence are calculated based on the fragment number parameter and the feature coverage parameter. In this implementation, the ratio between the feature coverage parameter and the fragment number parameter is used to represent the reconstruction sequence. The larger the feature coverage parameter, the more original access behavior features the reconstructed sequence contains. The smaller the fragment number parameter, the more concise the structure of the reconstructed sequence. Finally, the candidate reconstruction sequence with the largest reconstruction matching parameter is selected and denoted as the reconstructed access behavior sequence after the local access behavior sequence is transformed. It has the characteristics of concise structure and high feature coverage.

[0056] The construction process of the behavior association graph involves using multiple target behavior feature fragments as graph nodes, constructing directed edges between any two graph nodes, and performing transition analysis on multiple graph nodes based on multiple reconstructed access behavior sequences to determine the behavior transition weight corresponding to each directed edge. Specifically, the calculation of the behavior transition weight involves determining the total number of transitions of the path starting point of the directed edge in multiple reconstructed access behavior sequences, and using the proportion of the directed edge in the total number of transitions as the behavior transition weight. Simultaneously, a structural stability index for each graph node can be determined based on multiple reconstructed access behavior sequences. This is specifically calculated by normalizing the total occurrence count of the target behavior feature fragment corresponding to the graph node in multiple reconstructed access behavior sequences. Finally, a behavior association graph is constructed based on multiple graph nodes, their associated structural stability indices, and directed edges to describe the association relationships between multiple edge nodes accessing different functional interfaces and their call behaviors in dynamic task scenarios under the same operating environment.

[0057] Step S4: Perform fragment behavior association analysis based on multiple reconstructed access behavior sequences and construct a local behavior association matrix. Combine the behavior association map and the local behavior association matrix to perform real-time access behavior anomaly analysis on multiple edge nodes, generate real-time behavior anomaly analysis results, and use them to optimize access control for multiple edge nodes.

[0058] Specifically, the behavior association graph describes the long-term dependencies between access behavior feature segments of edge nodes through nodes and edges. This embodiment further performs local dependency analysis on multiple access behavior feature segments to construct a local behavior association matrix representing short-term dependencies between these segments. Finally, combining the behavior association graph and the local behavior association matrix, anomaly detection is performed on the real-time behavior data of different edge nodes from a global perspective to identify overall pattern anomalies. From a local behavior association perspective, the existence of short-term dependencies and lag characteristics is analyzed, ultimately generating real-time behavior anomaly analysis results for edge nodes. This results are used to detect potential abnormal access behaviors of nodes, optimize the access control process for different edge nodes across various functional interfaces, and promptly manage nodes exhibiting abnormal access behaviors, thereby improving the security and stability of the IoT system.

[0059] Optionally, fragment behavior correlation analysis is performed based on multiple reconstructed access behavior sequences, and a local behavior correlation matrix is ​​constructed, specifically including:

[0060] Multiple target behavior feature fragments are combined in an ordered manner to generate multiple feature fragment pairs. That is, the order of the fragments is considered during the combination process. Multiple target behavior feature fragments are combined in pairs. Then, based on the two target behavior feature fragments contained in the feature fragment pair, and multiple reconstructed access behavior sequences are combined to construct the associated sample set of each feature fragment pair. The associated sample set includes multiple reconstructed access behavior sequences associated with each feature fragment pair, wherein these reconstructed access behavior sequences include at least one target behavior feature fragment from the feature fragment pair.

[0061] After constructing the associated sample set of feature fragment pairs, statistical analysis is performed on the associated sample set to determine the fragment distribution parameters corresponding to the two target behavior feature fragments contained in the feature fragment pair, that is, the proportion of reconstructed access behavior sequences containing the target behavior feature fragment, such as the ratio of the reconstructed access behavior sequence containing the target behavior feature fragment to the total number of reconstructed access behavior sequences. Additionally, by traversing each reconstructed access behavior sequence in the associated sample set through the target association window, the combined co-occurrence distribution parameters of the feature fragment pair are generated. The target association window is used to capture the short-term dependencies and hysteresis characteristics between target behavior feature fragments, that is, whether two target behavior feature fragments frequently appear one after the other within a specific window, such as data reading behavior frequently occurring after calling authentication-related interfaces.

[0062] Then, based on the fragment distribution parameters and the combined co-occurrence distribution parameters, the local behavior association parameters of the feature fragment pair are calculated. Specifically, the product of the two fragment distribution parameters of the feature fragment pair is calculated, and the ratio between the combined co-occurrence distribution parameter and the product of the two fragment distribution parameters is used as the local behavior association parameter to describe the local association characteristics between the two target behavior feature fragments. Finally, based on the local behavior association parameters of multiple target behavior feature fragments, a local behavior association matrix describing the short-term behavior dependency characteristics of edge nodes is constructed.

[0063] Optionally, real-time access behavior anomaly analysis can be performed on multiple edge nodes by combining behavioral correlation maps and local behavioral correlation matrices, specifically including:

[0064] The real-time access behavior log data of edge nodes is obtained and the target access behavior sequence is constructed. That is, multiple access behavior features in the same session behavior are extracted and concatenated to obtain the target access behavior sequence of time-series behavior changes. The target access behavior sequence is reconstructed based on the target behavior feature set. The reconstruction process can be based on the aforementioned local access behavior sequence reconstruction process, thereby generating the target reconstructed access behavior sequence.

[0065] Based on the behavior association graph, multiple structural stability indices and behavior transition weights associated with the target reconstruction access behavior sequence are determined. Specifically, these are the structural stability indices corresponding to multiple target behavior feature segments contained in the target reconstruction access behavior sequence, and the behavior transition weights between multiple adjacent target behavior feature segments. For multiple structural stability indices and behavior transition weights, the average of the multiple structural stability indices and the average of the multiple behavior transition weights are calculated, and their sum is recorded as the feature reconstruction index of the target behavior feature segment, used to describe the encoding cost of mapping the target access behavior sequence.

[0066] Simultaneously, the number of reconstructed segments of the target behavior feature fragments and the number of target behavior feature fragments constituting the target behavior feature fragments are determined. The ratio of the feature reconstruction index to the number of reconstructed segments is used as the global behavior anomaly parameter of the target behavior feature fragments. The global behavior anomaly parameter is used to represent the difficulty of expressing real-time data through historical behavior feature sets. The larger the global behavior anomaly parameter, the greater the difficulty of mapping and expressing the real-time access behavior log data of edge nodes based on the behavior association graph, the greater the degree of deviation from historical behavior, and the more likely there are potential anomalies.

[0067] Building upon this foundation, multiple local behavior correlation parameters are further determined based on the local behavior correlation matrix to associate the target reconstruction access behavior sequence. These parameters are the local behavior correlation parameters between multiple adjacent target behavior feature segments within the target reconstruction access behavior sequence. The mean of these multiple local behavior correlation parameters is calculated to generate local behavior anomaly parameters for the target behavior feature segments, used to describe the degree of anomaly in the local behavior. If the correlation between segments within a local window is low, the window may indicate anomalies in node behavior. Finally, global and local behavior anomaly parameters are fused, for example, through equal-weighted fusion, to calculate real-time behavior anomaly parameters. These parameters simultaneously reflect the degree of anomalies in the node's behavior pattern under both global trends and short-term dynamic changes. This allows for real-time monitoring of edge node access behavior and immediate alarm issuance upon anomaly detection, promptly responding to potential security threats or failures. Access control strategies for edge nodes can be dynamically adjusted based on the behavior anomaly analysis results. For example, if a node frequently exhibits abnormal behavior, its access permissions can be restricted, or stricter security measures can be implemented, achieving comprehensive monitoring of edge node access behavior in the IoT system.

[0068] Please see Figure 2 This invention also provides an access control management system for IoT devices, specifically for implementing the aforementioned access control management method for IoT devices, including:

[0069] The access behavior feature analysis module is used to collect access behavior log data from multiple edge nodes, construct multiple session units for each edge node based on the access behavior log data, extract multiple access behavior features for each session unit, and construct a local access behavior sequence. The access behavior features include resource category features and operation category features.

[0070] The behavior feature fragment generation module is used to extract multiple initial behavior feature fragments from multiple local access behavior sequences, construct an initial behavior feature set about access behavior log data, perform iterative growth on the initial behavior feature set with associated behaviors, and generate a target behavior feature set corresponding to the initial behavior feature set, including multiple target behavior feature fragments.

[0071] The access behavior association analysis module is used to reconstruct the features of local access behavior sequences based on the target behavior feature set, generate multiple reconstructed access behavior sequences, and construct a behavior association map about multiple edge nodes based on the target behavior feature set and multiple reconstructed access behavior sequences.

[0072] The access control management module is used to perform fragment behavior correlation analysis based on multiple reconstructed access behavior sequences and construct a local behavior correlation matrix. It combines the behavior correlation map and the local behavior correlation matrix to perform real-time access behavior anomaly analysis on multiple edge nodes, generate real-time behavior anomaly analysis results, and use them to optimize access control for multiple edge nodes.

[0073] The above are merely specific embodiments of the present invention, enabling those skilled in the art to understand or implement the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art. Parts not described in detail in this specification are prior art known to those skilled in the art.

Claims

1. A method for access control management of Internet of Things (IoT) devices, characterized in that, include: Collect access behavior log data from multiple edge nodes, construct multiple session units for each edge node based on the access behavior log data, extract multiple access behavior features for each session unit, and construct a local access behavior sequence, where the access behavior features include resource category features and operation category features. Multiple initial behavioral feature fragments are extracted from multiple local access behavior sequences to construct an initial behavioral feature set for access behavior log data. The initial behavioral feature set is then subjected to iterative growth of associated behaviors to generate a target behavioral feature set corresponding to the initial behavioral feature set, which includes multiple target behavioral feature fragments. The generation of the target behavior feature set includes performing neighbor behavior segmentation on each local access behavior sequence, extracting multiple behavior feature pairs of the local access behavior sequence, and recording the multiple behavior feature pairs and multiple access behavior features of the local access behavior sequence as initial behavior feature fragments to construct an initial behavior feature set containing multiple initial behavior feature fragments. The initial behavior feature set is subjected to iterative growth of related behaviors, including splicing feature fragments of the initial behavior feature set based on multiple local access behavior sequences to generate multiple candidate sample fragments, calculating the reconstruction gain parameter of each candidate sample fragment based on multiple local access behavior sequences, determining multiple reconstructed sample fragments according to a preset reconstruction gain threshold, and updating the initial behavior feature set based on the multiple reconstructed sample fragments. The above process from splicing feature fragments of the initial behavior feature set to updating the initial behavior feature set is repeated until no more reconstructed sample fragments are generated, thus completing the iterative growth of related behaviors of the initial behavior feature set and outputting a target behavior feature set including multiple target behavior feature fragments. Based on the target behavior feature set, the local access behavior sequence is reconstructed to generate multiple reconstructed access behavior sequences. Based on the target behavior feature set and the multiple reconstructed access behavior sequences, a behavior association graph about multiple edge nodes is constructed. Based on multiple reconstructed access behavior sequences, fragment behavior correlation analysis is performed and a local behavior correlation matrix is ​​constructed. Combining the behavior correlation map and the local behavior correlation matrix, real-time access behavior anomaly analysis is performed on multiple edge nodes, generating real-time behavior anomaly analysis results, which are then used to optimize access control for multiple edge nodes.

2. The access control management method for an Internet of Things (IoT) device according to claim 1, characterized in that, Based on the target behavior feature set, the local access behavior sequence is reconstructed to generate multiple reconstructed access behavior sequences. Based on the target behavior feature set and the multiple reconstructed access behavior sequences, a behavior association graph of multiple edge nodes is constructed, including: Matching local access behavior sequences based on multiple target behavior feature fragments, determining multiple target behavior feature fragments associated with each local access behavior sequence, and performing greedy reconstruction of local access behavior sequences based on multiple target behavior feature fragments, transforming local access behavior sequences into reconstructed access behavior sequences; Using multiple target behavioral feature fragments as graph nodes of the behavioral association graph, a directed edge is constructed between any two graph nodes. Transition analysis is performed on multiple graph nodes based on multiple reconstructed access behavior sequences to determine the behavioral transition weight corresponding to each directed edge. The structural stability index of each graph node is determined based on multiple reconstructed access behavior sequences. A behavioral association graph is then constructed based on multiple graph nodes, their associated structural stability indices, and directed edges.

3. The access control management method for an Internet of Things (IoT) device according to claim 2, characterized in that, Based on multiple reconstructed access behavior sequences, fragment behavior correlation analysis is performed and a local behavior correlation matrix is ​​constructed, including: Multiple target behavior feature fragments are combined in an ordered manner to generate multiple feature fragment pairs. Based on the two target behavior feature fragments contained in each feature fragment pair, an associated sample set for each feature fragment pair is constructed based on multiple reconstructed access behavior sequences. Statistical analysis is performed on the associated sample set to determine the fragment distribution parameters corresponding to the two target behavior feature fragments contained in the feature fragment pair. Each reconstructed access behavior sequence in the associated sample set is traversed through the target association window to generate the combined co-occurrence distribution parameters of the feature fragment pair. Based on the fragment distribution parameters and the combined co-occurrence distribution parameters, the local behavior association parameters of the feature fragment pair are calculated, and a local behavior association matrix for multiple target behavior feature fragments is constructed.

4. The access control management method for an Internet of Things (IoT) device according to claim 3, characterized in that, Real-time access behavior anomaly analysis of multiple edge nodes is performed by combining behavioral correlation maps and local behavioral correlation matrices, including: The real-time access behavior log data of edge nodes is obtained and the target access behavior sequence is constructed. The target access behavior sequence is reconstructed based on the target behavior feature set to generate the target reconstructed access behavior sequence. Based on the behavior association graph, multiple structural stability indices and behavior transition weights are determined to associate the target reconstructed access behavior sequence. Based on the multiple structural stability indices and behavior transition weights, the feature reconstruction index of the target behavior feature fragment is calculated. The number of reconstructed fragments of the target behavior feature fragment is determined and combined with the feature reconstruction index to calculate the global behavior anomaly parameters of the target behavior feature fragment. Based on the local behavior correlation matrix, multiple local behavior correlation parameters are determined to associate the target reconstruction access behavior sequence. Local behavior anomaly parameters of the target behavior feature fragment are generated based on the multiple local behavior correlation parameters. By fusing the global behavior anomaly parameters and the local behavior anomaly parameters, the real-time behavior anomaly analysis results of the edge node are obtained.

5. The access control management method for an Internet of Things (IoT) device according to claim 2, characterized in that, Greedy reconstruction of local access behavior sequences includes: A dual greedy reconstruction is performed on each local access behavior sequence based on multiple target behavior feature fragments, including minimizing the fragment number reconstruction and maximizing the feature coverage reconstruction, generating multiple candidate reconstruction sequences. The fragment number parameter and feature coverage parameter of each candidate reconstruction sequence are determined. The reconstruction matching parameter of the candidate reconstruction sequence is calculated based on the fragment number parameter and feature coverage parameter. Based on the reconstruction matching parameter, the reconstructed access behavior sequence transformed from the local access behavior sequence is determined from the candidate reconstruction sequences.

6. An access control management system for Internet of Things (IoT) devices, characterized in that, The system is used to implement the access control management method for an Internet of Things (IoT) device as described in any one of claims 1-5, comprising: The access behavior feature analysis module is used to collect access behavior log data from multiple edge nodes, construct multiple session units for each edge node based on the access behavior log data, extract multiple access behavior features for each session unit, and construct a local access behavior sequence. The access behavior features include resource category features and operation category features. The behavior feature fragment generation module is used to extract multiple initial behavior feature fragments from multiple local access behavior sequences, construct an initial behavior feature set about access behavior log data, perform iterative growth on the initial behavior feature set with associated behaviors, and generate a target behavior feature set corresponding to the initial behavior feature set, including multiple target behavior feature fragments. The access behavior association analysis module is used to reconstruct the features of local access behavior sequences based on the target behavior feature set, generate multiple reconstructed access behavior sequences, and construct a behavior association map about multiple edge nodes based on the target behavior feature set and multiple reconstructed access behavior sequences. The access control management module is used to perform fragment behavior correlation analysis based on multiple reconstructed access behavior sequences and construct a local behavior correlation matrix. It combines the behavior correlation map and the local behavior correlation matrix to perform real-time access behavior anomaly analysis on multiple edge nodes, generate real-time behavior anomaly analysis results, and use them to optimize access control for multiple edge nodes.

Images