Real-time analyzing and monitoring method for network security information data

Abstract

The invention belongs to the technical field of network information data security analysis, and relates to a real-time analysis monitoring method for network security information data. According to the invention, the deviation degree between the current network information and the corresponding behavior baseline is calculated through dynamic comparison, and the operation parameters, the network flow and the normal range of user operation of the smart home terminal equipment are updated in real time, so that the false alarm rate of security analysis and monitoring is reduced; according to the method, the abnormal types are matched according to the preset rule knowledge base, so that the known attack is quickly handled, and the accuracy of known attack detection is improved; cooperative attack and single-point intrusion scenes of the smart home terminal equipment are comprehensively covered through multi-dimensional danger identification such as transverse space association and longitudinal time sequence prediction, and through a cascade mechanism of a rule knowledge base and a deep learning model, rapid handling of known attacks is guaranteed, unknown dangers are identified, and the method is suitable for popularization and application. And the security of the network information data of the smart home terminal equipment is improved.

Description

Technical Field

[0001] This invention belongs to the field of network information data security analysis technology, and relates to a method for real-time analysis and monitoring of network security information data. Background Technology

[0002] With the rapid proliferation of smart home devices, cybersecurity threats are growing exponentially, and traditional passive defense models can no longer meet the demands for real-time response. Given the unique characteristics of smart home scenarios, the evolution of real-time analysis and monitoring technologies needs to integrate technologies such as the Internet of Things (IoT), edge computing, and artificial intelligence to form a low-latency, highly compatible, and robust defense system.

[0003] Existing methods for monitoring and analyzing network security information data based on smart homes can basically meet the needs of use, but they still have some shortcomings: On the one hand, existing methods for monitoring and analyzing network security information data based on smart homes lack the ability to obtain the normal range of operating parameters, network traffic and user operations of smart home terminal devices in the current state by analyzing historical network information. This may result in false alarms caused by the fact that the danger alarm threshold of network information data does not match its normal range.

[0004] On the other hand, existing monitoring and analysis methods for network security information data based on smart homes mostly adopt single time series analysis or spatial correlation detection, which makes it difficult to identify cross-device collaborative attacks. Furthermore, their corresponding strategies often adopt a "one-size-fits-all" approach, lacking dynamic adjustment of the intensity of response based on the level of danger, which affects user experience and device availability. Summary of the Invention

[0005] In view of this, in order to solve the problems mentioned in the background technology, a real-time analysis and monitoring method for network security information data is proposed.

[0006] The objective of this invention can be achieved through the following technical solution: This invention provides a real-time analysis and monitoring method for network security information data, including: Step 1, real-time collection of current network information of various smart home terminal devices belonging to several users, including device operation data, network communication data and user operation data.

[0007] Step 2: Based on historical network information, construct the behavioral baseline of each smart home terminal device using the weighted average method and automatically iterate and update it. Calculate the deviation between the current network information and its corresponding behavioral baseline by dynamic comparison. When the deviation exceeds a preset threshold, generate an anomaly flag.

[0008] Step 3: The anomaly identifier is matched against the anomaly type according to the rule knowledge base. If the match is successful, the corresponding handling strategy is triggered. If the match fails, step 4 is executed.

[0009] Step 4: The cloud security center obtains the horizontal spatial correlation analysis results and the vertical temporal prediction results through a trained deep learning model based on the current network information. These results are then coupled to calculate the final comprehensive risk score, and the danger level is determined according to the risk interval division rules.

[0010] Step 5: Trigger the graded response mechanism according to the stated hazard level. Compared with the prior art, the beneficial effects of the present invention are as follows:

[0011] 1. This invention analyzes the behavioral baseline of each smart home terminal device based on historical network information, and dynamically compares and calculates the deviation between the current network information and its corresponding behavioral baseline. It updates the operating parameters, network traffic and normal range of user operations of smart home terminal devices in real time, which helps to reduce the false alarm rate of its security analysis and monitoring.

[0012] 2. This invention matches anomaly types according to a preset rule knowledge base, and triggers corresponding handling strategies upon successful matching, thereby ensuring rapid handling of known attacks and improving the accuracy of known attack detection.

[0013] 3. This invention identifies risks through multiple dimensions such as horizontal spatial correlation and vertical temporal prediction, comprehensively covering collaborative attacks and single-point intrusion scenarios of smart home terminal devices. Furthermore, through the cascading mechanism of rule knowledge base and deep learning model, it not only ensures the rapid handling of known attacks but also identifies unknown risks, thereby improving the security of network information data of smart home terminal devices. Attached Figure Description

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0015] Figure 1 This is a schematic diagram illustrating the implementation steps of the method of the present invention. Detailed Implementation

[0016] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0017] Please see Figure 1 As shown, this invention provides a method for real-time analysis and monitoring of network security information data, with the following specific steps:

[0018] Step 1: Collect real-time network information of various smart home terminal devices belonging to several users, including device operation data, network communication data, and user operation data.

[0019] It should be noted that the integrated system monitoring sensors, hardware status sensors, network interface controllers, intrusion detection sensors, input interaction sensors, and behavior analysis engines within the user's home are used to collect current network information of various smart home terminal devices belonging to several users. The existing technology is relatively mature and will not be elaborated here.

[0020] In one specific example, the device operating data includes, but is not limited to, device CPU utilization, memory usage, memory consumption ratio, and firmware version hash value.

[0021] The network communication data includes, but is not limited to, traffic rate, number of IP fragmentation reassembly anomalies, and DNS query domain name blacklist hit rate.

[0022] The user operation data includes, but is not limited to, user login timestamp sequences, multi-factor authentication trigger records, number of biometric verification failures, device function call frequencies such as the number of times the camera is turned on, and permission change records such as the addition of administrator accounts.

[0023] Step 2: Based on historical network information, construct the behavioral baseline of each smart home terminal device using the weighted average method and automatically iterate and update it. Calculate the deviation between the current network information and its corresponding behavioral baseline by dynamic comparison. When the deviation exceeds a preset threshold, generate an anomaly flag.

[0024] As a preferred feasible embodiment, the specific analysis process of the behavioral baseline of each smart home terminal device includes: extracting the historical daily operation monitoring data of each smart home terminal device belonging to several users from the historical device operation data, and obtaining the average value of the historical daily operation monitoring data of each smart home terminal device belonging to several users by weighting and averaging. Similarly, the average value of the historical daily network communication monitoring data of each smart home terminal device belonging to several users and the average value of the user operation monitoring data can be obtained.

[0025] As a feasible embodiment of the above, each historical day can be the historical days of nearly 90 days of each device belonging to several users, with the current time as the boundary.

[0026] The specific calculation process of the historical daily operation monitoring data average includes the following: dividing several users into scenario sub-databases according to user type, and using a weighted average method to calculate the baseline for the historical data in each scenario sub-database to avoid the single average being disturbed by short-term abnormal data.

[0027] For example, the user type may be an office worker, a senior citizen, a freelancer, etc.

[0028] The weighted average method can assign a weight of 0.6 to the data of the past 30 days, a weight of 0.3 to the data of 31-60 days, and a weight of 0.1 to the data of 61-90 days.

[0029] The average historical daily operation monitoring data of each smart home terminal device belonging to several users, the average historical daily network communication monitoring data, and the average user operation monitoring data are collectively referred to as the behavioral baseline of each smart home terminal device.

[0030] As a preferred feasible embodiment, the specific calculation process of the deviation between the current network information and its corresponding behavioral baseline includes: extracting the current operation monitoring data of each smart home terminal device belonging to several users from the current device operation data, and calculating the deviation between the current operation monitoring data of each smart home terminal device belonging to several users and its corresponding behavioral baseline according to the deviation standard formula.

[0031] It should be further explained that the specific process for calculating the deviation of the current operational monitoring data of each smart home terminal device belonging to the aforementioned users from their corresponding behavioral baseline using the deviation standard formula is as follows: ,in Each of the several users belongs to the first The current number of smart home terminal devices Individual operational monitoring data, historical days Average value of each operational monitoring data point, historical days The average value of the first operational monitoring data and the first The deviation of each operational monitoring data point from its corresponding behavioral baseline. , This refers to the serial number of each smart home terminal device. The number of smart home terminal devices, , Assign a number to each operational monitoring data point. This refers to the amount of monitoring data collected during operation.

[0032] If the deviation of the current operational monitoring data from its corresponding behavioral baseline exceeds a preset threshold, an anomaly identifier for the current operational monitoring data is generated.

[0033] It should be further explained that the anomaly identifier is a technical identifier that identifies specific operational characteristics that deviate significantly from the normal behavior baseline and have potential security threats through pattern analysis of user operation behavior. In essence, it uses algorithms to extract behavioral fingerprints with attack characteristics from massive logs to trigger security alerts.

[0034] Similarly, it can generate anomaly flags for the current operation monitoring data, current network communication monitoring data, and current user operation monitoring data of each smart home terminal device belonging to several users.

[0035] A specific example,

[0036] (1) Operation monitoring data anomaly marker: For the operation status data of smart home terminal devices, such as device CPU utilization, memory utilization, firmware version anomaly, etc., when the deviation of the current data from the historical behavior baseline exceeds the preset threshold.

[0037] (2) Network communication monitoring data anomaly marker: generated when the communication mode deviates from the normal baseline, targeting the network communication behavior of the device, such as abnormal traffic rate, high-risk port access, cross-business group data transmission, etc.

[0038] (3) User operation monitoring data anomaly marker: generated when the operation mode is inconsistent with the historical baseline, based on the user's operation behavior on the device, such as abnormal login frequency, permission abuse, sensitive command call, etc.

[0039] This invention analyzes the behavioral baseline of each smart home terminal device based on historical network information, and dynamically compares and calculates the deviation between the current network information and its corresponding behavioral baseline. It updates the operating parameters, network traffic, and normal range of user operations of the smart home terminal devices in real time, which helps to reduce the false alarm rate of its security analysis and monitoring.

[0040] Step 3: The anomaly identifier is matched against the anomaly type according to the rule knowledge base. If the match is successful, the corresponding handling strategy is triggered. If the match fails, step 4 is executed.

[0041] It should be noted that the rule knowledge base is used to store all the abnormal tags and their abnormal types of the operation monitoring data, abnormal network communication monitoring data, and abnormal user operation monitoring data of various smart home terminal devices belonging to several users.

[0042] As a preferred feasible embodiment, the specific process of matching the anomaly type according to the rule knowledge base includes: if the anomaly identifier of a certain current operation monitoring data of a certain smart home terminal device belonging to a certain user is consistent with a certain anomaly tag of the corresponding operation monitoring data stored in the rule knowledge base, then the current operation monitoring data of the smart home terminal device belonging to the user is recorded as the abnormal operation monitoring data of the smart home terminal device belonging to the user, and the anomaly type of the corresponding operation monitoring data stored in the rule knowledge base is taken as the anomaly type of the abnormal operation monitoring data of the smart home terminal device belonging to the user, and at the same time, the match is marked as successful.

[0043] Similarly, we can obtain the abnormal operation monitoring data, abnormal network communication monitoring data, and abnormal user operation monitoring data of each smart home terminal device belonging to several users.

[0044] As a preferred feasible embodiment, the anomaly type specifically includes brute-force attacks, denial-of-service attacks, malware infections, data theft, and vulnerability exploitation attacks.

[0045] The specific countermeasures for brute-force attacks are to block the attack source and strengthen the authentication mechanism.

[0046] Specifically, the blocking of the attack source is as follows: (1) At the network layer, add firewall rules to the home gateway to block the attack source IP address for 24 hours. (2) At the device layer, temporarily disable the external access ports of the device, such as turning off the remote login function of the smart lock.

[0047] The enhanced authentication mechanism specifically includes: (1) enforcing multi-factor authentication, such as confirming login via mobile APP verification code; (2) temporarily increasing password complexity requirements, such as password length ≥ 12 characters, including uppercase and lowercase letters and symbols.

[0048] The specific strategies for handling denial-of-service attacks include traffic scrubbing and rate limiting, and device protection.

[0049] Specifically, the flow cleaning and flow limiting are as follows:

[0050] Enable traffic shaping on the edge gateway to limit suspected attack traffic to 1Mbps.

[0051] Use tools such as Cloudflare Magic Transit to clean up abnormal traffic.

[0052] The device protection specifically refers to:

[0053] Close unnecessary service ports, such as disabling the external HTTP management interface for smart cameras.

[0054] Enable the device's built-in flood prevention mechanism, such as limiting the maximum number of requests per second to 50.

[0055] The specific strategies for handling malware infections include isolating infected devices, removing malicious programs, and performing a full network scan and repair.

[0056] Specifically, the isolation and infection control equipment is as follows:

[0057] Remove infected devices from the home network, such as by removing their MAC addresses from the Wi-Fi blacklist.

[0058] Disable the device's network communication functions, such as disconnecting the smart bulb's Wi-Fi connection.

[0059] The removal of malicious programs specifically involves:

[0060] Force a factory reset to clear all user data and suspicious processes.

[0061] Re-flash the official firmware in safe mode, such as using the OTA repair tool provided by the manufacturer.

[0062] The full network scan and repair specifically refers to:

[0063] Initiate a whole-house equipment health check to scan other devices for potential impact.

[0064] Update the antivirus signature database for all devices, such as the ClamAV database.

[0065] The specific countermeasures for data theft are to block data transmission and encrypt sensitive data.

[0066] Specifically, blocking data transmission means:

[0067] Intercept traffic destined for malicious domains / IPs at the gateway layer, such as blocking DNS resolution for malicious.com.

[0068] Disable the device's data upload function, such as disabling cloud synchronization for smart refrigerators.

[0069] The encrypted sensitive data specifically refers to:

[0070] Force the use of encryption for transmission (e.g., upgrade HTTP to HTTPS, enable TLS for MQTT).

[0071] Remote erasure can be triggered for leaked data, such as clearing the camera's SD card via MDM commands.

[0072] The specific strategies for handling exploit attacks are emergency vulnerability patching and privilege embargo minimization.

[0073] Specifically, the emergency vulnerability fix includes:

[0074] Automatically trigger device firmware updates, prioritizing the patching of known CVE vulnerabilities, such as CVE-2021-44228.

[0075] Temporarily disable vulnerability-related functions, such as disabling the ONVIF protocol for cameras.

[0076] The minimum permission is specifically defined as follows:

[0077] Downgrade device permissions, such as changing the admin account on a smart router to a regular user account.

[0078] Remove high-risk services, such as uninstalling unused Telnet services.

[0079] This invention matches anomaly types according to a preset rule knowledge base, and triggers corresponding handling strategies upon successful matching, thereby ensuring rapid handling of known attacks and improving the accuracy of known attack detection.

[0080] Step 4: The cloud security center obtains the horizontal spatial correlation analysis results and the vertical temporal prediction results through a trained deep learning model based on the current network information. These results are then coupled to calculate the final comprehensive risk score, and the danger level is determined according to the risk interval division rules.

[0081] As a preferred feasible embodiment, the specific process of obtaining the horizontal spatial correlation analysis results includes: the trained deep learning model records the normal connection relationships, communication ports, business group divisions, etc. between devices based on the entity relationship diagram of smart home terminal devices of users stored in the database, i.e., the device network topology. It identifies device nodes that deviate from the normal community structure, such as isolated devices suddenly connecting to unfamiliar IPs, detects abnormal edges of each device, such as high-risk port access, sensitive data transmission across business groups, and identifies various hidden attack chains, such as connections through multi-level jump servers. The GNN can identify these through path analysis and record them as the horizontal spatial correlation analysis results of several users.

[0082] It should be further explained that the deep learning model can be a graph neural network (GNN), which identifies normal patterns and abnormal features through labeled historical data.

[0083] Specifically, the trained deep learning model analyzes the device connection relationships in the current network information in real time, compares them with the trained "normal community structure", identifies abnormal nodes, that is, discovers devices that deviate from the normal connection mode, such as a smart socket suddenly connecting to an external server; detects abnormal edges, that is, identifies abnormal communication links between devices, such as a smart TV sending a large amount of data to an unknown IP, which may be data theft; and identifies hidden attack chains, that is, through path analysis, such as the graph traversal capability of GNN, discovers multi-level jump attacks, such as the "camera → router → cloud" jump attack path.

[0084] As a preferred feasible embodiment, the specific process of obtaining the longitudinal time series prediction result includes: aggregating the current network information according to time windows such as 5 minutes / 1 hour to generate time series feature data corresponding to the current network information of the user's smart home terminal device, and performing preprocessing such as processing missing values ​​and normalizing data.

[0085] It should be further noted that the time-series features include, but are not limited to, single entity features and group features.

[0086] In a specific example, the single entity characteristics include, but are not limited to, device traffic rate, login frequency, request success rate, etc.; the group characteristics include, but are not limited to, overall bandwidth usage of the business group, abnormality rate of similar devices, etc.

[0087] Input the current network information corresponding to the time series feature data into the trained deep learning model, and output the network information of each smart home terminal device of several users corresponding to the predicted values ​​and confidence intervals for future time periods. Record these as the longitudinal time series prediction results for several users.

[0088] It should be further explained that the deep learning model can adopt a time series prediction model such as LSTM to learn the time series patterns in historical data, such as the diurnal periodicity of device traffic and user operation habits. LSTM fits normal time series patterns through historical data to generate predicted values ​​and confidence intervals.

[0089] As a preferred feasible embodiment, the specific process of calculating the final comprehensive risk score through coupling and determining the hazard level according to the risk interval division rule includes: comparing the horizontal spatial correlation analysis results of several users with the horizontal correlation-risk score mapping table stored in the database to obtain the horizontal spatial correlation risk scores of several users.

[0090] As a specific example, the horizontal association-risk score mapping is represented as shown in Table 1 below.

[0091] Table 1. Examples of Horizontal Linkage-Risk Score Mapping

[0092] Horizontal spatial correlation analysis results Example of a specific scenario description Risk score (0-100) Equipment nodes that deviate from the normal community structure If a smart plug that has been offline for more than 60 days suddenly connects to an unfamiliar IP address (i.e., not a home network segment), it may be a sign of a sudden connection to an unfamiliar IP address. 30 points Equipment nodes that deviate from the normal community structure Unregistered devices, such as unfamiliar tablets, can connect to home Wi-Fi using weak passwords and attempt to access the smart home management backend. 45 points Detect abnormal access to high-risk ports on various devices. If a smart light bulb frequently accesses SSH ports, such as port 22, even when only requiring lighting functionality, it may have been infected with a remote control program. 50 points Detecting abnormal edges on various devices - Sensitive data transmission across service groups The smart refrigerator in the kitchen transmits sensitive information such as user payment vouchers and biometric data to the smart TV in the living room. 70 points Detecting anomalies in various devices - cross-service group communication Security cameras sent configuration modification commands to the network router without authorization. 60 points Identifying Covert Attack Chains - Multi-Level Jump Server Connections GNN path analysis revealed the path as follows: Smart camera → Overseas intermediate server → User cloud data storage center 85 points Identifying Covert Attack Chains - Cross-Protocol Attack Paths If a smart lock's Bluetooth protocol is hijacked, it can forward a sequence of unlocking commands to a hacker's server via a relay device such as Wi-Fi. 90 points

[0093] It should be noted that if the duration of abnormal behavior exceeds the threshold, such as a covert attack chain lasting more than 30 minutes, 5 points will be added for every additional 10 minutes, up to a maximum of 100 points.

[0094] If multiple anomaly types occur concurrently, such as "device node anomaly + covert attack chain", the total score will be calculated as 80% of the sum of the scores for each scenario to avoid inflated scores, with a maximum of 100 points.

[0095] If core devices such as smart locks and routers are involved, the score will automatically increase by 20%. For example, if a smart lock is involved in a cross-protocol attack, the score will increase from 90 to 100, with a maximum of 100.

[0096] Based on the longitudinal time series prediction results of several users, the anomaly category of their current network information in the future time period is determined, and it is compared with the longitudinal time series anomaly-risk score mapping table stored in the database to obtain the longitudinal time series prediction risk score of several users.

[0097] As a specific example, the longitudinal time-series anomaly-risk score mapping is represented as shown in Table 2 below.

[0098] Table 2. Examples of Longitudinal Temporal Anomalies-Risk Score Mapping

[0099] Anomaly Category Example of a specific scenario description Risk score (0-100) Concurrency exceptions If five smart devices on the same home network, such as cameras, speakers, and door locks, experience a sudden surge in network traffic exceeding 300% of the baseline, it may be a precursor to a large-scale DDoS attack. 70 points Concurrency exceptions Multiple similar devices, such as all smart light bulbs, simultaneously triggering abnormal login alerts may indicate that attackers are attempting to compromise weak passwords in bulk. 65 points Sequence exception A smart camera first showed a port scan log (anomaly 1), then the smart door lock attempted a brute-force attack (anomaly 2), and finally the cloud server detected data being sent out (anomaly 3), which matches the attack chain sequence (scanning → intrusion → theft). 90 points Sequence exception The smart router first exhibited abnormal configuration changes (Anomaly 1), 10 minutes later the smart TV transmitted a video stream to an unknown IP address (Anomaly 2), and 2 hours later a user account was logged in from a different location (Anomaly 3), forming an attack chain of "device control → data theft → account theft". 95 points

[0100] It should be noted that if the number of concurrent anomalies involves ≥10 devices, the score will increase by 10%, such as from 70 points to 77 points, with a maximum of 100 points.

[0101] If the interval between each stage in the sequence is ≤1 hour, the score will increase by 15%, such as from 90 points to 100 points. Due to the tight attack rhythm and short defense window, the maximum score will not exceed 100 points.

[0102] If an abnormal sequence leads to the leakage of sensitive data, such as the transmission of user biometric data, the score will be directly marked as 100 points.

[0103] The horizontal spatial correlation risk score and the vertical time series prediction risk score of several users are summed according to the preset corresponding weights to obtain the final comprehensive risk score of several users. The final comprehensive risk score is then compared with the range of each hazard level stored in the database to determine the hazard level of several users.

[0104] A specific example is that (1) the horizontal priority mode, i.e., the horizontal spatial correlation risk score and the vertical time series prediction risk score are assigned corresponding weights of 0.6 and 0.4 respectively according to the preset weights. (2) the vertical priority mode, i.e., the horizontal spatial correlation risk score and the vertical time series prediction risk score are assigned corresponding weights of 0.4 and 0.6 respectively according to the preset weights.

[0105] It should be noted that the horizontal spatial correlation risk score and the vertical time series prediction risk score mentioned above can be dynamically and finely configured based on multi-dimensional scenario elements such as network environment characteristics, equipment asset value, and attack threat type, according to the preset corresponding weights.

[0106] For example, when the lateral analysis identifies a core device attack chain, the lateral weight is 0.7 and the vertical weight is 0.3; when the vertical analysis predicts concurrent anomalies within 1 hour, the vertical weight is 0.7 and the lateral weight is 0.3.

[0107] As a preferred feasible embodiment, the exception categories include concurrent exceptions and sequential exceptions.

[0108] The specific process for determining the anomaly category of the current network information of the future time period for the aforementioned users includes: if the monitoring data in the current network information of a smart home terminal device belonging to a user exceeds the corresponding prediction value allowable range in the future time period, then the smart home terminal device belonging to that user is determined to be a time-series anomaly.

[0109] If multiple smart home terminal devices of a user simultaneously exhibit timing anomalies, it may indicate a large-scale attack. Therefore, the anomaly category of the current network information of that user in a future time period is recorded as a concurrent anomaly.

[0110] If multiple smart home terminal devices of a user exhibit timing anomalies in a specific order, such as first scanning ports, then brute-forcing them, and finally sending data out, which conforms to the attack kill chain sequence, then the anomaly category of the user's current network information in the future time period will be recorded as a sequence anomaly.

[0111] Step 5: Trigger the graded response mechanism according to the stated hazard level. As a preferred feasible embodiment, the hazard level is specifically categorized as high-risk, medium-risk, and low-risk.

[0112] In a specific example, the high-risk category corresponds to a final comprehensive risk score range of [80, 100] points, the medium-risk category corresponds to a final comprehensive risk score range of [60, 79) points, and the low-risk category corresponds to a final comprehensive risk score range of [0, 60) points.

[0113] For example, suppose a user's horizontal spatial correlation risk score is 85 points. If a hidden attack chain is detected (see the mapping table above), and the vertical time series prediction risk score is 90 points, if the sequence is abnormal and the attack chain is complete, then the final comprehensive risk score = 85 × 0.6 + 90 × 0.40 = 51 + 36 = 87 points → high risk level.

[0114] For example, suppose a user's horizontal spatial correlation risk score is 70 points, such as sensitive transmission across business groups, and the vertical time-series prediction risk score is 95 points, such as concurrency anomalies + large-scale traffic attacks. Therefore, the final comprehensive risk score = 70 × 0.40 + 95 × 0.60 = 28 + 57 = 85 points → high risk level (≥ 80 points).

[0115] The specific details of the hierarchical response mechanism are as follows:

[0116] (1) If it is high risk, immediately perform automated isolation, forced firmware rollback, emergency notification to users and start evidence collection.

[0117] Specifically, the automated isolation involves: triggering IPS rules to disconnect the device from the network via the 802.1X port; and updating the home gateway ACL rules to block all incoming and outgoing traffic from the device.

[0118] The forced firmware rollback specifically involves: calling the OTA interface to roll back to the latest trusted version, i.e., verifying the signature and then executing; clearing suspicious configurations in persistent storage, such as deleting malicious tasks in / etc / crontab.

[0119] The user emergency notifications specifically include: full-screen pop-ups in the app, SMS messages, and telephone voice notifications, such as those containing the attack type, affected devices, and suggested actions; providing buttons such as "Isolate Device Now" and "Start Evidence Collection" for users to quickly confirm and execute.

[0120] The initiation of forensics specifically involves: automatically saving the original attack traffic data packets, such as those in PCAP format, to a secure storage area; and generating an attack chain report, such as an ATT&CK mapping, for subsequent analysis.

[0121] (2) If it is medium risk, immediately perform operations such as traffic restriction, permission downgrade, user prompts, log recording and dynamic monitoring.

[0122] Specifically, the traffic restrictions include: limiting the speed of abnormal devices, such as limiting the downlink bandwidth to 1Mbps to prevent large amounts of data from being transmitted outwards; and disabling unnecessary protocols, such as turning off the UPnP service to restrict P2P communication.

[0123] The permission downgrade specifically includes: temporarily revoking sensitive permissions of the device, such as disabling the remote unlocking function of the smart door lock; and forcibly enabling multi-factor authentication to verify subsequent operations.

[0124] The user prompts and log recordings are specifically as follows: APP notifications: push risk summaries, such as "Abnormal traffic detected from the camera, speed has been limited"; record details of abnormal events, such as time, protocol, and data volume.

[0125] The dynamic monitoring specifically refers to: increasing the monitoring frequency of the device, such as adjusting it from 5 minutes / time to 1 minute / time; if the anomaly continues to escalate, automatically upgrading it to a high-risk response.

[0126] (3) If it is low risk, immediately perform operations such as logging, user reminders and dynamic baseline adjustment.

[0127] Specifically, the log recording includes: storing abnormal events to the ELK log system and marking them as [LOW_RISK]; and recording device fingerprints, such as MAC addresses and firmware hash values.

[0128] The user reminders specifically include: the app pushing security suggestions, such as "The camera firmware version is too low, it is recommended to update"; and providing a one-click repair entry, such as automatically downloading and verifying the firmware signature.

[0129] The dynamic baseline adjustment specifically means that if the user confirms a false alarm, the system automatically relaxes the threshold for the same type of behavior of the device (±10%).

[0130] This invention identifies risks through multiple dimensions, including horizontal spatial correlation and vertical temporal prediction, comprehensively covering collaborative attacks and single-point intrusion scenarios of smart home terminal devices. Furthermore, through the cascading mechanism of rule knowledge base and deep learning model, it not only ensures the rapid handling of known attacks but also identifies unknown risks, thereby improving the security of network information data of smart home terminal devices.

[0131] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the concept of the invention or exceed the scope defined by the present invention, and all such modifications and additions should fall within the protection scope of the present invention.

Claims

1. A method for real-time analysis and monitoring of network security information data, characterized in that: include: Step 1: Collect real-time network information of various smart home terminal devices belonging to several users, including device operation data, network communication data, and user operation data; Step 2: Based on historical network information, construct the behavioral baseline of each smart home terminal device using the weighted average method and update it automatically. Calculate the deviation between the current network information and its corresponding behavioral baseline by dynamic comparison. When the deviation exceeds a preset threshold, generate an anomaly flag. Step 3: The anomaly identifier is matched with the anomaly type according to the rule knowledge base. If the match is successful, the corresponding handling strategy is triggered. If the match fails, step 4 is executed. Step 4: The cloud security center obtains the horizontal spatial correlation analysis results and the vertical temporal prediction results through a trained deep learning model based on the current network information. These results are then coupled to calculate the final comprehensive risk score, and the danger level is determined according to the risk interval division rules. Step 5: Trigger the graded response mechanism according to the stated hazard level.

2. The real-time analysis and monitoring method for network security information data according to claim 1, characterized in that: The specific analysis process of the behavioral baseline of each smart home terminal device includes: Extract the historical daily operation monitoring data of each smart home terminal device belonging to several users from the historical device operation data, and obtain the average value of the historical daily operation monitoring data of each smart home terminal device belonging to several users by weighting and averaging. Similarly, the average value of the historical daily network communication monitoring data of each smart home terminal device belonging to several users and the average value of the operation monitoring data of each user can be obtained. The average historical daily operation monitoring data of each smart home terminal device belonging to several users, the average historical daily network communication monitoring data, and the average user operation monitoring data are collectively referred to as the behavioral baseline of each smart home terminal device.

3. The real-time analysis and monitoring method for network security information data according to claim 1, characterized in that: The specific calculation process for the deviation between the current network information and its corresponding behavioral baseline includes: Extract the current operation monitoring data of each smart home terminal device belonging to several users from the current device operation data, and calculate the deviation of the current operation monitoring data of each smart home terminal device belonging to several users from their corresponding behavioral baseline according to the deviation standard formula. If the deviation of the current operation monitoring data from its corresponding behavior baseline exceeds a preset threshold, an anomaly identifier for the current operation monitoring data is generated. Similarly, it can generate anomaly flags for the current operation monitoring data, current network communication monitoring data, and current user operation monitoring data of each smart home terminal device belonging to several users.

4. The real-time analysis and monitoring method for network security information data according to claim 1, characterized in that: The specific process of matching anomaly types based on the rule knowledge base includes: If the anomaly identifier of a certain operation monitoring data of a certain smart home terminal device belonging to a certain user matches the anomaly tag of the corresponding operation monitoring data stored in the rule knowledge base, then the current operation monitoring data of the smart home terminal device belonging to the user is recorded as the abnormal operation monitoring data of the smart home terminal device belonging to the user, and the anomaly type of the corresponding operation monitoring data stored in the rule knowledge base is used as the anomaly type of the abnormal operation monitoring data of the smart home terminal device belonging to the user, and a successful match is marked. Similarly, we can obtain the abnormal operation monitoring data, abnormal network communication monitoring data, and abnormal user operation monitoring data of each smart home terminal device belonging to several users.

5. The real-time analysis and monitoring method for network security information data according to claim 1, characterized in that: The specific types of anomalies are brute-force attacks, denial-of-service attacks, malware infections, data theft, and vulnerability exploitation attacks. The specific countermeasures for brute-force attacks are to block the attack source and strengthen the authentication mechanism; the specific countermeasures for denial-of-service attacks are to perform traffic scrubbing and rate limiting and device protection; the specific countermeasures for malware infection are to isolate infected devices, remove malicious programs, and perform full network scanning and repair; the specific countermeasures for data theft are to block data transmission and encrypt sensitive data; and the specific countermeasures for vulnerability exploitation attacks are to perform emergency vulnerability patching and privilege emulation.

6. The real-time analysis and monitoring method for network security information data according to claim 1, characterized in that: The specific process for obtaining the results of the lateral spatial correlation analysis includes: The trained deep learning model identifies each device node that deviates from the normal community structure, detects abnormal edges of each device, and identifies each hidden attack chain based on the entity relationship graph of smart home terminal devices of users stored in the database, and records it as the result of horizontal spatial correlation analysis of several users.

7. A real-time analysis and monitoring method for network security information data according to claim 6, characterized in that: The specific process for obtaining the longitudinal time series prediction results includes: The current network information is aggregated by time window to generate time-series feature data corresponding to the current network information of the user's smart home terminal devices, and preprocessing is performed to handle missing values, normalize data, etc. Input the current network information corresponding to the time series feature data into the trained deep learning model, and output the network information of each smart home terminal device of several users corresponding to the predicted values ​​and confidence intervals for future time periods. Record these as the longitudinal time series prediction results for several users.

8. A real-time analysis and monitoring method for network security information data according to claim 7, characterized in that: The specific process of calculating the final comprehensive risk score through coupling and determining the hazard level according to the risk interval division rules includes: The results of horizontal spatial correlation analysis of several users are compared with the horizontal correlation-risk score mapping table stored in the database to obtain the horizontal spatial correlation risk score of several users. Based on the longitudinal time series prediction results of several users, the anomaly category of their current network information in the future time period is determined, and it is compared with the longitudinal time series anomaly-risk score mapping table stored in the database to obtain the longitudinal time series prediction risk score of several users. The horizontal spatial correlation risk score and the vertical time series prediction risk score of several users are summed according to the preset corresponding weights to obtain the final comprehensive risk score of several users. The final comprehensive risk score is then compared with the range of each hazard level stored in the database to determine the hazard level of several users.

9. A real-time analysis and monitoring method for network security information data according to claim 8, characterized in that: The exception categories include concurrent exceptions and sequential exceptions; The specific process for determining the anomaly category of the current network information of the future time period for the aforementioned users includes: if the monitoring data in the current network information of a smart home terminal device belonging to a user exceeds the corresponding prediction value allowable range in the future time period, then the smart home terminal device belonging to that user is determined to be a time-series anomaly. If multiple smart home terminal devices of a user experience timing anomalies simultaneously, the anomaly category of the user's current network information in the future time period will be recorded as a concurrent anomaly. If multiple smart home terminal devices of a user exhibit timing anomalies in a specific order, then the anomaly category of the user's current network information in a future time period will be recorded as a sequence anomaly.

10. A method for real-time analysis and monitoring of network security information data according to claim 1, characterized in that: The specific risk levels are high risk, medium risk, and low risk; The specific details of the hierarchical response mechanism are as follows: (1) If it is high-risk, immediately perform automated isolation, forced firmware rollback, emergency user notification and start evidence collection, etc. (2) If it is a medium risk, immediately implement traffic restrictions, permission downgrades, user prompts, log recording, and dynamic monitoring. (3) If it is low risk, immediately perform operations such as logging, user reminders and dynamic baseline adjustment.

Images