A network security protection method using intelligent algorithm to identify abnormal traffic

Abstract

The application discloses a network security protection method for identifying abnormal traffic by using an intelligent algorithm, and relates to the technical field of Internet of Things network security, comprising the following steps: listening to HTTP protocol messages, MQTT protocol messages and CoAP protocol messages transmitted by an Internet of Things network, deconstructing protocol headers and payload fields, identifying protocol operation characteristics that violate the functional roles of Internet of Things devices in combination with untrusted state markers in a physical topology chain, and outputting abnormal protocol characteristic analysis results; inputting the physical topology chain and the abnormal protocol characteristic analysis results into a pre-trained graph neural network model to determine that an Internet of Things device that simultaneously has an untrusted state marker and an abnormal protocol characteristic node is an abnormal traffic source. The application uses a pre-trained graph neural network to perform nonlinear feature aggregation and propagation on multi-hop relationships between nodes, thereby realizing deep modeling of complex dependency relationships between devices.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) network security technology, and in particular to a network security protection method that uses intelligent algorithms to identify abnormal traffic. Background Technology

[0002] With the widespread deployment of IoT technology in key areas such as industrial control, smart homes, and urban infrastructure, network scale is growing exponentially, and communication traffic between devices is becoming increasingly complex. Consequently, cybersecurity threats are showing trends towards concealment, collaboration, and cross-protocol penetration. In recent years, intelligent security protection technologies combining machine learning and network behavior analysis have gradually become a research hotspot. In particular, graph neural networks, due to their advantages in modeling complex dependencies between entities, are widely used in network anomaly detection systems. By learning the topological evolution patterns of device communication graphs, they enable the identification and early warning of behaviors deviating from normal patterns.

[0003] While some existing technologies have attempted to improve detection accuracy by incorporating behavioral baseline modeling and multi-source log correlation analysis, they still face the problem of insufficient utilization of the physical spatial attributes and communication capability boundary constraints of devices in practical applications. Specifically, most solutions mainly rely on communication records at the logical network layer (such as IP address, port, frequency, and data volume) for modeling, lacking a fusion mechanism for prior knowledge such as the actual physical location of the device and the effective range of wireless communication. Therefore, how to effectively introduce physical layer context information to enhance the reliable assessment of logical communication behavior has become a key challenge in improving the accuracy of abnormal traffic identification and anti-spoofing capabilities. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a network security protection method that uses intelligent algorithms to identify abnormal traffic, addressing the problem of insufficient utilization of the physical space attributes and communication capability boundary constraints of devices.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a network security protection method for identifying abnormal traffic using intelligent algorithms, comprising,

[0008] Collect physical coordinate location data of IoT devices, determine the upper limit of the communication radius of IoT devices based on the physical coordinate location data, mark the communication relationship between pairs of IoT devices that exceed the upper limit of the communication radius as untrusted, and generate a physical topology chain;

[0009] Monitor HTTP, MQTT, and CoAP protocol messages transmitted over IoT networks, deconstruct the protocol header and payload fields, combine them with untrusted state markers in the physical topology chain, identify protocol operation characteristics that violate the functional roles of IoT devices, and output abnormal protocol characteristic analysis results.

[0010] The physical topology chain and the results of the abnormal protocol feature analysis are input into the pre-trained graph neural network model to determine that the IoT device with both untrusted state markers and abnormal protocol feature nodes is an abnormal traffic source.

[0011] Block HTTP, MQTT, and CoAP protocol messages sent by abnormal traffic sources, and continuously monitor changes in the physical topology chain status until the conditions for lifting the block are met.

[0012] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, the step of determining the upper limit of the communication radius of IoT devices based on physical coordinate location data is as follows:

[0013] The central controller searches a pre-set experience database for the maximum stable transmission distance of the same wireless communication type in the current deployment environment, based on the wireless communication type of the IoT devices.

[0014] The maximum stable transmission distance is used as the upper limit of the communication radius of IoT devices.

[0015] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, the step of marking the communication relationship between paired IoT devices exceeding the upper limit of the communication radius as an untrusted state is as follows:

[0016] All IoT devices are paired up, and the straight-line distance between the pairs of IoT devices is determined based on their respective physical coordinate location data.

[0017] Compare the straight-line distance between pairs of IoT devices with the sum of the upper limits of the communication radius of the pairs of IoT devices. When the straight-line distance is greater than the sum of the upper limits of the communication radius, mark the communication relationship between pairs of IoT devices that have a straight-line distance greater than the sum of the upper limits of the communication radius as untrusted.

[0018] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, the protocol header consists of control information and metadata from HTTP protocol messages, MQTT protocol messages, and CoAP protocol messages.

[0019] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, the payload field is a field in HTTP protocol messages, MQTT protocol messages, and CoAP protocol messages that carries the actual transmitted data.

[0020] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, the identification of protocol operation features that violate the functional roles of IoT devices refers to determining whether the protocol operation features comply with the functional role restrictions of intelligent sensor devices and gateway devices based on preset operation rules, and marking protocol operation features that do not comply with the operation rules as abnormal protocol operation records.

[0021] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, the step of inputting the physical topology chain and abnormal protocol feature analysis results into a pre-trained graph neural network model to determine that IoT devices simultaneously possessing untrusted state markers and abnormal protocol feature nodes are abnormal traffic sources is as follows:

[0022] Using the IoT device numbers in the physical topology chain as nodes of the graph neural network, and establishing edge connections between nodes of the graph neural network based on the untrusted state labels of the communication relationships between paired IoT devices, a network topology graph structure is constructed.

[0023] In the constructed network topology, the nodes corresponding to the IoT device numbers involved in the abnormal protocol feature analysis results are marked as abnormal protocol feature nodes;

[0024] The pre-trained graph neural network model is loaded with the constructed network topology graph structure and the labeled abnormal protocol feature nodes as input.

[0025] The graph neural network model performs feature propagation and aggregation on the network topology graph structure to identify IoT devices that simultaneously have untrusted state markers and abnormal protocol feature nodes;

[0026] IoT devices that simultaneously possess both untrusted status markers and abnormal protocol characteristic nodes are identified as abnormal traffic sources.

[0027] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, the blocking of HTTP protocol messages, MQTT protocol messages, and CoAP protocol messages sent by the abnormal traffic source is specifically as follows.

[0028] Obtain the device ID of the IoT device identified as an abnormal traffic source;

[0029] In the protocol message listening component deployed at the core node of the IoT network, configure message filtering rules based on source IP address to map the IoT device number of the abnormal traffic source to the corresponding source IP address;

[0030] For the source IP address obtained from the mapping, block TCP and UDP protocol packets sent from the source IP address.

[0031] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, the TCP protocol message carries HTTP protocol messages and MQTT protocol messages.

[0032] As a preferred embodiment of the network security protection method for identifying abnormal traffic using intelligent algorithms described in this invention, wherein the UDP protocol message carries a CoAP protocol message.

[0033] The beneficial effects of this invention are as follows: By utilizing a pre-trained graph neural network to perform nonlinear feature aggregation and propagation on multi-hop relationships between nodes, a deep modeling of complex dependencies between devices is achieved. This enables the identification of collaborative attacks and covert communication patterns that are difficult to detect with single-point detection. Combined with the dual constraints of untrusted state marking and protocol semantic anomalies, cross-node contextual correlation analysis is realized in the graph neural network, improving the accuracy of locating abnormal traffic sources, effectively suppressing false alarms and false negatives, and enhancing the detection capability of advanced persistent threats. At the same time, the graph neural network has the potential to generalize the identification of unknown attack patterns, improving the adaptability and intelligence level of the security protection mechanism. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 A flowchart illustrating a network security protection method that uses intelligent algorithms to identify abnormal traffic.

[0036] Figure 2 Generate a flowchart for the physical topology chain.

[0037] Figure 3 This is a flowchart for abnormal protocol feature analysis.

[0038] Figure 4 This is a flowchart for blocking and releasing abnormal traffic. Detailed Implementation

[0039] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0040] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0041] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0042] Reference Figures 1-4 This is one embodiment of the present invention, which provides a network security protection method for identifying abnormal traffic using intelligent algorithms, comprising the following steps:

[0043] S1. Collect the physical coordinate location data of IoT devices, determine the upper limit of the communication radius of IoT devices based on the physical coordinate location data, mark the communication relationship between pairs of IoT devices that exceed the upper limit of the communication radius as untrusted, and generate a physical topology chain.

[0044] S1.1 Deploy ultra-wideband positioning base stations within the Internet of Things network. Each ultra-wideband positioning base station is fixedly installed on a support structure at a known physical location, keeping its position unchanged.

[0045] After the ultra-wideband positioning base station is activated, it continuously receives wireless positioning signals from IoT devices. These wireless positioning signals are actively sent by the IoT devices at fixed intervals.

[0046] After receiving the wireless positioning signal, the ultra-wideband positioning base station uses the signal arrival time difference method to measure the propagation time of the wireless positioning signal from the Internet of Things device to each ultra-wideband positioning base station.

[0047] Specifically, after receiving the wireless positioning signal, the ultra-wideband (UWB) positioning base station records the timestamp of the wireless positioning signal arriving at the first UWB positioning base station, the timestamp of the wireless positioning signal arriving at the second UWB positioning base station, and the timestamp of the wireless positioning signal arriving at the third UWB positioning base station. The first time difference is obtained by comparing the timestamps of the first and second UWB positioning base stations, the second time difference is obtained by comparing the timestamps of the first and third UWB positioning base stations, and the third time difference is obtained by comparing the timestamps of the second and third UWB positioning base stations. These time differences are the propagation time of the wireless positioning signal from the IoT device to each UWB positioning base station.

[0048] S1.2 Calculate the straight-line distance between the IoT device and each ultra-wideband positioning base station based on the product of propagation time and electromagnetic wave propagation speed; where the electromagnetic wave propagation speed is the speed of light in a vacuum, and the speed of light is a fundamental constant in physics.

[0049] The expression for straight-line distance is:

[0050] d = c × t;

[0051] In the formula, d is the straight-line distance between the IoT device and each ultra-wideband positioning base station, c is the speed of light in a vacuum, and t is the propagation time of the wireless positioning signal from the IoT device to each ultra-wideband positioning base station.

[0052] Select the straight-line distances measured by at least three ultra-wideband positioning base stations at different locations, and perform trilateration calculations with the known physical location of each ultra-wideband positioning base station as the center and the straight-line distance as the radius;

[0053]

[0054] In the formula, x represents the horizontal coordinate of the IoT device's physical coordinate position data, indicating the horizontal position of the IoT device in a two-dimensional plane; x1 represents the horizontal coordinate of the known physical position of the first ultra-wideband positioning base station, indicating the horizontal position of the ultra-wideband positioning base station in a two-dimensional plane; x2 represents the horizontal coordinate of the known physical position of the second ultra-wideband positioning base station, indicating the horizontal position of the ultra-wideband positioning base station in a two-dimensional plane; x3 represents the horizontal coordinate of the known physical position of the third ultra-wideband positioning base station, indicating the horizontal position of the ultra-wideband positioning base station in a two-dimensional plane; and y represents the vertical coordinate of the IoT device's physical coordinate position data, indicating the vertical position of the IoT device in a two-dimensional plane; y1 represents the vertical coordinate of the known physical position of the first ultra-wideband positioning base station, indicating the vertical position of the ultra-wideband positioning base station in a two-dimensional plane; y2 represents the vertical coordinate of the known physical position of the second ultra-wideband positioning base station, indicating the vertical position of the ultra-wideband positioning base station in a two-dimensional plane; and y3 represents the vertical coordinate of the known physical position of the third ultra-wideband positioning base station, indicating the vertical position of the ultra-wideband positioning base station in a two-dimensional plane. The square of the straight-line distance from the IoT device to the first ultra-wideband positioning base station is obtained by multiplying the propagation time of the wireless positioning signal by the speed of light in a vacuum. The distance from the IoT device to the second ultra-wideband positioning base station is the square of the straight-line distance, obtained by multiplying the propagation time of the wireless positioning signal by the speed of light in a vacuum. The distance from the IoT device to the third ultra-wideband positioning base station is the square of the straight-line distance, which is obtained by multiplying the propagation time of the wireless positioning signal by the speed of light in a vacuum.

[0055] S1.3 Determine the intersection point of the IoT device in the two-dimensional plane through trilateration calculation. The intersection point is the physical coordinate position data of the IoT device.

[0056] Specifically, the process involves drawing a first circle with the known physical location of the first ultra-wideband positioning base station as the center and the first straight-line distance as the radius, drawing a second circle with the known physical location of the second ultra-wideband positioning base station as the center and the second straight-line distance as the radius, and drawing a third circle with the known physical location of the third ultra-wideband positioning base station as the center and the third straight-line distance as the radius. The common intersection point of the first, second, and third circles in the two-dimensional plane is then found. This common intersection point represents the physical coordinate location data of the IoT device.

[0057] S1.4 The central controller receives the physical coordinate location data of all IoT devices;

[0058] The central controller searches a pre-set experience database for the maximum stable transmission distance of the same wireless communication type in the current "deployment environment" based on the wireless communication type of the IoT device, and uses the maximum stable transmission distance as the upper limit of the communication radius of the IoT device. The experience database is based on historical test data of the wireless communication type of the IoT device (such as Wi-Fi, Bluetooth or ZigBee) in different deployment environments (such as indoor, outdoor or industrial environments), and includes the maximum stable transmission distance of each wireless communication type in a specific environment.

[0059] All IoT devices are paired up, and the straight-line distance between the pairs of IoT devices is determined based on their respective physical coordinate location data.

[0060] Specifically, the process involves: acquiring the physical coordinates of each IoT device from the central controller, including the device ID and its corresponding two-dimensional plane coordinates; pairing each IoT device with other IoT devices one by one to form all possible pairs; extracting the two-dimensional plane coordinates of the first and second IoT devices for each pair; determining the straight-line distance between the first and second IoT devices using the Euclidean distance formula based on the difference between their horizontal and vertical coordinates; and associating the straight-line distance of each pair with the corresponding IoT device ID to generate a record containing both the device ID and the straight-line distance. The Euclidean distance formula is a fundamental formula in geometry and spatial analysis, widely used in positioning and distance measurement, and is well-known in the field.

[0061] S1.5. Compare the straight-line distance between the pairs of IoT devices with the sum of the upper limits of the communication radius of the pairs of IoT devices. When the straight-line distance is greater than the sum of the upper limits of the communication radius (e.g., the range is from 2 meters to 200 meters), mark the communication relationship between the pairs of IoT devices whose straight-line distance is greater than the sum of the upper limits of the communication radius as untrusted.

[0062] By treating IoT devices as device nodes and the untrusted state of communication relationships as communication edge attributes, a communication structure is established that includes IoT device IDs, physical coordinate location data, and untrusted state markers. This communication structure is the physical topology chain.

[0063] Specifically, the process involves: obtaining a list of all IoT devices from the central controller, which includes the IoT device ID and physical coordinate location data for each device; using the IoT device ID as a unique identifier to create a corresponding device node, and attaching the physical coordinate location data to each device node as a node attribute; traversing all marked communication relationships between paired IoT devices, establishing a communication edge between the device nodes of the first and second IoT devices for each pair, and attaching the untrusted state of the communication relationship to the communication edge as a communication edge attribute; repeating the traversal process until all communication relationships between paired IoT devices have been converted into communication edges; and integrating all device nodes, node attributes, communication edges, and communication edge attributes to form a communication structure containing the IoT device ID, physical coordinate location data, and untrusted state markings, which is the physical topology chain.

[0064] S2. Monitor HTTP, MQTT, and CoAP protocol messages transmitted over the IoT network, deconstruct the protocol header and payload fields, and combine them with the untrusted state markers in the physical topology chain to identify protocol operation characteristics that violate the functional roles of IoT devices, and output abnormal protocol characteristic analysis results.

[0065] S2.1 Deploy a protocol message listening component at the core node of the IoT network. The protocol message listening component captures HTTP protocol messages, MQTT protocol messages and CoAP protocol messages passing through the core node in promiscuous mode.

[0066] Specifically, the process involves installing a network interface card (NIC) for a protocol message monitoring component on the core node of the IoT network. This NIC is set to promiscuous mode. In promiscuous mode, the NIC receives all data frames passing through the core node in the IoT network, not just those sent to its MAC address. The NIC then forwards all received data frames to the kernel processing layer of the protocol message monitoring component. The kernel processing layer examines the IP header and transport layer header of each data frame, identifying data frames whose IP header and transport layer header match HTTP, MQTT, and CoAP protocol message characteristics. The protocol message monitoring component extracts the identified HTTP, MQTT, and CoAP protocol messages from the kernel processing layer as the capture result.

[0067] S2.2 Classify the captured HTTP protocol messages according to the TCP port of the HTTP protocol messages, extract the request action, request path and protocol version in the HTTP request line, parse the key-value pairs in the HTTP header fields, and extract the content data in the HTTP message body.

[0068] Specifically, the process involves: acquiring captured HTTP protocol messages from the kernel processing layer of the protocol message listening component; inspecting the transport layer header of each HTTP protocol message, reading the destination port field in the transport layer header, confirming whether the destination port field is the default TCP port 80 or 443 for HTTP protocol messages, and grouping HTTP protocol messages with destination ports of 80 or 443 into the HTTP protocol message set; reading the request line of each HTTP protocol message one by one from the HTTP protocol message set, separating the request action field, request path field, and protocol version field in the request line, and storing them as HTTP request action, HTTP request path, and HTTP protocol version, respectively; parsing the header fields of each HTTP protocol message, splitting the header fields into a list of key-value pairs by line, extracting the key field and value field from each line, and storing them as a set of HTTP header field key-value pairs; and extracting the entire content from the message body of each HTTP protocol message and storing it as HTTP message body content data. Note that TCP ports 80 and 443 are the default ports for HTTP protocol messages, defined by the IETF standard, and are used for HTTP plaintext transmission and HTTPS encrypted transmission, respectively.

[0069] The captured MQTT protocol messages are classified according to the TCP port of the MQTT protocol messages. The message type and QoS level in the MQTT fixed header are parsed, the protocol name, protocol version and client ID in the MQTT variable header are extracted, and the topic name and payload content in the MQTT payload are obtained.

[0070] Specifically, the process involves: acquiring captured MQTT protocol messages from the kernel processing layer of the protocol message listening component; examining the transport layer header of each MQTT protocol message, reading the destination port field in the transport layer header, confirming whether the destination port field is the default TCP port 1883 or 8883 for MQTT protocol messages, and adding MQTT protocol messages with destination ports of 1883 or 8883 to the MQTT protocol message set; and reading the fixed header of each MQTT protocol message from the MQTT protocol message set, separating the message type field and QoS level field in the fixed header, and storing them as MQTT message type and MQTT... QoS level; extract the variable header of each MQTT protocol message, separate the protocol name field, protocol version field, and client ID field from the variable header, and store them as MQTT protocol name, MQTT protocol version, and MQTT client ID, respectively; extract the topic name field and payload content from the payload of each MQTT protocol message, and store them as MQTT topic name and MQTT payload content; among them, TCP ports 1883 and 8883 are the default ports for MQTT protocol messages, defined by the MQTT standard, and are used for plaintext transmission and encrypted transmission, respectively;

[0071] The captured CoAP protocol messages are classified according to the UDP port of the CoAP protocol messages. The message type, code field and message ID in the CoAP message header are parsed, the resource path and option key-value pairs in the CoAP option field are extracted, and the content data in the CoAP payload is obtained.

[0072] Specifically, the process involves: acquiring captured CoAP protocol messages from the kernel processing layer of the protocol message listening component; inspecting the transport layer header of each CoAP protocol message, reading the destination port field in the transport layer header, confirming whether the destination port field is the default UDP port 5683 or 5684 for CoAP protocol messages, and adding CoAP protocol messages with destination ports of 5683 or 5684 to the CoAP protocol message set; reading the message header of each CoAP protocol message from the CoAP protocol message set, separating the message type field, code field, and message ID field in the message header, and storing them as CoAP message type, CoAP code field, and CoAP message ID, respectively; extracting the option field of each CoAP protocol message, separating the resource path field and option key-value pair field in the option field, and storing them as CoAP resource path and CoAP option key-value pair, respectively; and extracting all content from the payload of each CoAP protocol message and storing it as CoAP payload content data. UDP ports 5683 and 5684 are the default ports for CoAP protocol messages, as specified in the IETF standard RFC. The 7252 definition is used for plaintext transmission and encrypted transmission, respectively.

[0073] S2.3 Organize the request action, request path, protocol version, header field key-value pairs, and message body content data extracted from the HTTP protocol message into HTTP structured entries;

[0074] Organize the message type, QoS level, protocol name, protocol version, client ID, topic name, and payload content parsed from the MQTT protocol message into MQTT structured entries;

[0075] Organize the message type, code field, message ID, resource path, option key-value pairs, and payload content data parsed in the CoAP protocol message into CoAP structured entries;

[0076] Append source IP address, destination IP address, and timestamp to HTTP structured entries, MQTT structured entries, and CoAP structured entries to form a protocol message destructuring record; the protocol message destructuring record contains protocol message entries, and the protocol message entries include source IP address, destination IP address, timestamp, protocol type, and the content of the destructed header and payload fields.

[0077] S2.4 Obtain the communication structure in the physical topology chain. The communication structure includes the IoT device number, physical coordinate location data, and untrusted state markers of the communication relationship between pairs of IoT devices.

[0078] Obtain protocol message entries from the protocol message deconstruction record. Each protocol message entry contains the source IP address, destination IP address, timestamp, protocol type, and the contents of the deconstructed header and payload fields.

[0079] The source IP address and destination IP address of the protocol message entry are mapped to the corresponding IoT device ID, respectively, to establish the correspondence between the protocol message entry and the IoT device ID;

[0080] Specifically, the process involves: retrieving a device IP mapping table from the device registration database, which contains the IoT device ID and corresponding IP address for each IoT device; for each protocol message entry, reading the source IP address from the entry, searching the device IP mapping table for the matching IoT device ID, and storing the matching ID as the source IoT device ID; reading the target IP address from the entry, searching the device IP mapping table for the matching ID, and storing the matching ID as the target IoT device ID; generating a corresponding record for each protocol message entry, containing the source IP address, target IP address, source IoT device ID, and target IoT device ID; and summarizing all corresponding records to form a mapping relationship between protocol message entries and IoT device IDs. The device registration database is a pre-configured database in the IoT network, storing information such as the IoT device ID, IP address, and functional role of each IoT device; it is an existing database.

[0081] Based on the untrusted state markings between paired IoT devices in the communication structure, filter out protocol message entries marked as untrusted between the source IoT device ID and the target IoT device ID.

[0082] Specifically, the process involves: retrieving all protocol message entries from the correspondence between protocol message entries and IoT device IDs; for each protocol message entry, reading the source IoT device ID and target IoT device ID from the entry; searching the communication structure for paired IoT device communication relationships that match the source and target IoT device IDs of the protocol message entries, and reading the untrusted status flags of these paired IoT device communication relationships; if the untrusted status flag of a paired IoT device communication relationship is marked as untrusted, adding the protocol message entry to the filtered protocol message entry list; repeating the above process until all protocol message entries have been checked, forming a filtered protocol message entry list containing protocol message entries marked as untrusted between the source and target IoT device IDs.

[0083] S2.5. Obtain the functional roles of IoT devices from the device registration database. The functional roles include smart sensor devices and gateway devices.

[0084] For protocol message entries identified as untrusted, the system determines whether the protocol operation characteristics in the message entry violate the operation rules of the functional role based on the protocol type and the pre-defined operation rules of the functional role. The operation rules are pre-defined based on the functional roles of IoT devices, specifying the allowed protocol operation types and behavioral restrictions for each functional role. For example, the operation rules for smart sensor devices are to only initiate reporting operations and not respond to control commands; the operation rules for actuator devices are to only receive control operations and not report operation status; and the operation rules for gateway devices are to forward data packets and not generate original payloads.

[0085] Protocol message entries that violate the operation rules are marked as abnormal protocol operation records. Abnormal protocol operation records include IoT device number, protocol type, operation type, description of rule violation, and timestamp.

[0086] All abnormal protocol operation records are summarized to form an abnormal protocol feature analysis result that includes IoT device number, protocol type, and description of rule violation.

[0087] S3. Input the physical topology chain and abnormal protocol feature analysis results into the pre-trained graph neural network model to determine that IoT devices with both untrusted state labels and abnormal protocol feature nodes are abnormal traffic sources.

[0088] S3.1 Obtain the analysis results of communication structure and abnormal protocol characteristics in the physical topology chain;

[0089] Using the IoT device numbers in the physical topology chain as nodes of the graph neural network, and establishing edge connections between nodes of the graph neural network based on the untrusted state labels of the communication relationships between paired IoT devices, a network topology graph structure is constructed.

[0090] Specifically, the process involves: obtaining all IoT device IDs and untrusted state tags for communication relationships between pairs of IoT devices from the communication structure in the physical topology chain; creating a graph neural network node for each IoT device ID, using the IoT device ID as the unique identifier of the graph neural network node; extracting the source IoT device ID and target IoT device ID from each pair of IoT device communication relationships; finding the source node corresponding to the source IoT device ID and the target node corresponding to the target IoT device ID in the graph neural network nodes, and establishing edge connections between graph neural network nodes based on the source node and the target node; attaching the untrusted state tags for the communication relationships between pairs of IoT devices to the corresponding edge connections as attributes of the edge connections; repeating the above process until all communication relationships between pairs of IoT devices have been transformed into edge connections; and integrating all graph neural network nodes and edge connections to form a network topology graph structure containing IoT device IDs and untrusted state tags.

[0091] Training process of graph neural network model:

[0092] Training datasets are extracted from historical IoT network traffic data. These datasets include IoT device IDs, physical coordinates, communication relationships between paired IoT devices, and untrusted state markers. The IoT device IDs from the training dataset are used as identifiers for graph neural network (Graph Neural Network) nodes, the communication relationships between paired IoT devices are used as edge connections, and the untrusted state markers are used as attributes of these edge connections to construct a training network topology. Abnormal protocol feature records are extracted from historical protocol message data. These records contain IoT device IDs and abnormal protocol operation records. The IoT device IDs in these abnormal protocol feature records are mapped to nodes in the training network topology, and the corresponding Graph Neural Network nodes are labeled as abnormal protocol feature nodes. Graph Neural Network nodes labeled as abnormal protocol feature nodes are used as positive samples, and unlabeled nodes are used as negative samples to initialize the Graph Neural Network (Graph Neural Network) model. The Graph Neural Network (Graph Neural Network) model is used to propagate and aggregate features from the training network topology, learning the feature representations of the Graph Neural Network (Graph Neural Network) nodes. Based on the learned feature representations, the model parameters of the Graph Neural Network (Graph Neural Network) model are optimized so that it can distinguish Graph Neural Network (Graph Neural Network) nodes with untrusted state markers and abnormal protocol features. The training process is repeated until the Graph Neural Network (Graph Neural Network) model converges, generating a pre-trained Graph Neural Network (Graph Neural Network) model.

[0093] S3.2 In the constructed network topology diagram, the nodes corresponding to the IoT device numbers involved in the abnormal protocol feature analysis results are marked as abnormal protocol feature nodes;

[0094] The pre-trained graph neural network model is loaded with the constructed network topology graph structure and the labeled abnormal protocol feature nodes as input.

[0095] The graph neural network model performs feature propagation and aggregation on the network topology graph structure to identify IoT devices that simultaneously have untrusted state markers and abnormal protocol feature nodes;

[0096] Specifically: The graph neural network (Graph Neural Network) model receives a network topology graph as input, which includes all Graph Neural Network nodes and edge connections. The Graph Neural Network model initializes initial node features for each Graph Neural Network node, based on the node's IoT device ID and additional attributes. The Graph Neural Network model initiates the first-layer propagation process. During this process, for each Graph Neural Network node, it collects the initial node features of all neighboring Graph Neural Network nodes and transmits these features to the current Graph Neural Network node through edge connections. At each Graph Neural Network node, the Graph Neural Network model combines the received initial node features of neighboring Graph Neural Network nodes with the initial node features of the current Graph Neural Network node to generate the first-layer updated node features. The Graph Neural Network model then initiates the second-layer propagation process. During this process, for each Graph Neural Network node, it collects the first-layer updated features of all neighboring Graph Neural Network nodes. The process involves updating node features by passing the first-layer updated node features of adjacent graph neural network nodes to the current graph neural network node through edge connections. At each graph neural network node, the model combines the received first-layer updated node features from adjacent nodes with those of the current node to generate the second-layer updated node features. This propagation process is repeated until a preset number of layers is reached, yielding the final node features for each node. The model then checks these final node features to determine if they contain untrusted state markers or markers for anomalous protocol feature nodes. The model identifies IoT devices corresponding to graph neural network nodes whose final node features simultaneously contain both untrusted state markers and anomalous protocol feature node markers as abnormal traffic sources. The preset number of layers is determined based on the complexity of the network topology and feature propagation requirements, typically ranging from 2 to 5 layers.

[0097] S3.3. Identify IoT devices that simultaneously possess untrusted state flags and abnormal protocol characteristic nodes as abnormal traffic sources.

[0098] S4. Block HTTP, MQTT, and CoAP protocol messages sent by abnormal traffic sources, and continuously monitor changes in the physical topology chain status until the conditions for lifting the block are met.

[0099] S4.1 Obtain the IoT device ID identified as an abnormal traffic source;

[0100] In the protocol message listening component deployed at the core node of the IoT network, configure message filtering rules based on source IP address to map the IoT device number of the abnormal traffic source to the corresponding source IP address;

[0101] Specifically, the process is as follows: For each IoT device ID of an abnormal traffic source, the system searches the device IP mapping table for an IP address that matches the IoT device ID of the abnormal traffic source and stores the matching IP address as the corresponding source IP address; a source IP address list is formed by mapping the source IP addresses of all IoT device IDs of all abnormal traffic sources; the protocol packet monitoring component deployed on the core node of the IoT network accesses the packet filtering configuration interface, and adds packet filtering rules based on the source IP address through the packet filtering configuration interface. The packet filtering rules specify the blocking of packets sent by all source IP addresses in the source IP address list; the packet filtering rules in the packet filtering configuration interface are activated, enabling the protocol packet monitoring component to apply the packet filtering rules based on the source IP address in real time to block abnormal traffic; the packet filtering rules are set based on the source IP address of the abnormal traffic source and include rules for blocking TCP protocol packets and UDP protocol packets sent by all source IP addresses in the source IP address list;

[0102] For the mapped source IP address, block TCP and UDP protocol packets sent from the source IP address; among them, TCP protocol packets carry HTTP and MQTT protocol packets, and UDP protocol packets carry CoAP protocol packets;

[0103] It should be noted that transport layer messages are TCP and UDP protocol messages; application layer messages are HTTP, MQTT, and CoAP protocol messages. TCP protocol messages encapsulate HTTP and MQTT protocol messages, and UDP protocol messages encapsulate CoAP protocol messages. The network protocol layering mechanism allows transport layer messages to include application layer messages as data payloads in transport layer messages for transmission.

[0104] S4.2. By periodically monitoring the physical topology chain through the central controller, the updated status of the untrusted state marker of the communication relationship between paired IoT devices is obtained.

[0105] Determine whether all communication relationships between pairs of IoT devices related to the abnormal traffic source in the physical topology chain have not been marked as untrusted.

[0106] The specific determination process is as follows: Obtain all paired IoT device communication relationships related to the IoT device ID of the abnormal traffic source from the communication structure of the physical topology chain; for each paired IoT device communication relationship, extract the untrusted state marker, where the untrusted state marker is determined based on the sum of the upper limits of the straight-line distance between the paired IoT devices being greater than the communication radius; otherwise, it is a trusted state; record the untrusted state marker of each paired IoT device communication relationship in a temporary list; check each untrusted state marker in the temporary list to confirm whether all untrusted state markers are trusted states; if all untrusted state markers in the temporary list are trusted states, then all paired IoT device communication relationships related to the IoT device ID of the abnormal traffic source are determined to be trusted states; if any untrusted state marker in the temporary list is untrusted, then an untrusted state is determined to exist in the paired IoT device communication relationships related to the IoT device ID of the abnormal traffic source.

[0107] If the judgment result is yes, then the blocking of TCP and UDP protocol packets sent from the source IP address is lifted;

[0108] If the judgment result is not, maintain the blocking state until the conditions for releasing the blocking are met.

[0109] This embodiment also provides a computer device applicable to network security protection methods that use intelligent algorithms to identify abnormal traffic, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the network security protection method for identifying abnormal traffic using intelligent algorithms as proposed in the above embodiment.

[0110] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0111] This embodiment also provides a storage medium storing a computer program. When executed by a processor, the program implements the network security protection method for identifying abnormal traffic using intelligent algorithms as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0112] In summary, this invention achieves deep modeling of complex dependencies between devices by utilizing a pre-trained graph neural network to perform nonlinear feature aggregation and propagation of multi-hop relationships between nodes. This enables the identification of collaborative attacks and covert communication patterns that are difficult to detect with single-point detection. By combining the dual constraints of untrusted state marking and protocol semantic anomalies, cross-node contextual correlation analysis is implemented in the graph neural network, improving the accuracy of locating abnormal traffic sources, effectively suppressing false positives and false negatives, and enhancing the detection capability of advanced persistent threats. At the same time, the graph neural network has the potential to generalize the identification of unknown attack patterns, improving the adaptability and intelligence level of the security protection mechanism.

[0113] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A network security protection method using intelligent algorithms to identify abnormal traffic, characterized in that: include, Collect physical coordinate location data of IoT devices, determine the upper limit of the communication radius of IoT devices based on the physical coordinate location data, mark the communication relationship between pairs of IoT devices that exceed the upper limit of the communication radius as untrusted, and generate a physical topology chain; Monitor HTTP, MQTT, and CoAP protocol messages transmitted over IoT networks, deconstruct the protocol header and payload fields, combine them with untrusted state markers in the physical topology chain, identify protocol operation characteristics that violate the functional roles of IoT devices, and output abnormal protocol characteristic analysis results. The physical topology chain and the results of the abnormal protocol feature analysis are input into the pre-trained graph neural network model to determine that the IoT device with both untrusted state markers and abnormal protocol feature nodes is an abnormal traffic source. Block HTTP, MQTT, and CoAP protocol messages sent by abnormal traffic sources, and continuously monitor changes in the physical topology chain status until the conditions for lifting the block are met.

2. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 1, characterized in that: The method for determining the upper limit of the communication radius of IoT devices based on physical coordinate location data is as follows: The central controller searches a pre-set experience database for the maximum stable transmission distance of the same wireless communication type in the current "deployment environment" based on the wireless communication type of the IoT devices. The maximum stable transmission distance is used as the upper limit of the communication radius of IoT devices.

3. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 1, characterized in that: The process of marking the communication relationship between paired IoT devices that exceeds the upper limit of the communication radius as an untrusted state is as follows: All IoT devices are paired up, and the straight-line distance between the pairs of IoT devices is determined based on their respective physical coordinate location data. Compare the straight-line distance between pairs of IoT devices with the sum of the upper limits of the communication radius of the pairs of IoT devices. When the straight-line distance is greater than the sum of the upper limits of the communication radius, mark the communication relationship between pairs of IoT devices that have a straight-line distance greater than the sum of the upper limits of the communication radius as untrusted.

4. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 1, characterized in that: The protocol header contains control information and metadata from HTTP, MQTT, and CoAP protocol messages.

5. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 1, characterized in that: The payload field is the field that carries the actual transmitted data in HTTP protocol messages, MQTT protocol messages, and CoAP protocol messages.

6. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 1, characterized in that: The identification of protocol operation features that violate the functional roles of IoT devices refers to determining whether the protocol operation features comply with the functional role restrictions of smart sensor devices and gateway devices based on preset operation rules, and marking protocol operation features that do not comply with the operation rules as abnormal protocol operation records.

7. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 1, characterized in that: The process involves inputting the physical topology chain and abnormal protocol feature analysis results into a pre-trained graph neural network model to determine whether an IoT device simultaneously possesses an untrusted state marker and an abnormal protocol feature node is an abnormal traffic source. The specific steps are as follows: Using the IoT device numbers in the physical topology chain as nodes of the graph neural network, and establishing edge connections between nodes of the graph neural network based on the untrusted state labels of the communication relationships between paired IoT devices, a network topology graph structure is constructed. In the constructed network topology, the nodes corresponding to the IoT device numbers involved in the abnormal protocol feature analysis results are marked as abnormal protocol feature nodes; The pre-trained graph neural network model is loaded with the constructed network topology graph structure and the labeled abnormal protocol feature nodes as input. The graph neural network model performs feature propagation and aggregation on the network topology graph structure to identify IoT devices that simultaneously have untrusted state markers and abnormal protocol feature nodes; IoT devices that simultaneously possess both untrusted status markers and abnormal protocol characteristic nodes are identified as abnormal traffic sources.

8. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 1, characterized in that: The blocking of HTTP, MQTT, and CoAP protocol messages from the abnormal traffic source is specifically as follows. Obtain the device ID of the IoT device identified as an abnormal traffic source; In the protocol message listening component deployed at the core node of the IoT network, configure message filtering rules based on source IP address to map the IoT device number of the abnormal traffic source to the corresponding source IP address; For the source IP address obtained from the mapping, block TCP and UDP protocol packets sent from the source IP address.

9. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 8, characterized in that: The TCP protocol message carries HTTP protocol messages and MQTT protocol messages.

10. The network security protection method for identifying abnormal traffic using intelligent algorithms as described in claim 8, characterized in that: The UDP protocol message carries the CoAP protocol message.

Images