An internet of things network security optimization method and related device

Abstract

The application relates to the technical field of Internet of Things security, in particular to an Internet of Things network security optimization method and related equipment, which comprises the following steps: if a networking request is detected, target information of a request terminal is acquired based on the networking request; the risk level of the request terminal is acquired based on the target information; if the risk level exceeds a preset level threshold, the networking request is rejected, the request terminal is risk-labeled and a risk label is generated; if a label set meets preset label requirements, the request terminal is added to a blacklist; if the risk level does not exceed the preset level threshold, the historical access authority of the request terminal is acquired; if the historical access authority meets an authority updating standard, the historical access authority is updated and the current access authority is acquired; and based on the current access authority, the networking request is allowed. The application helps to optimize the Internet of Things network security and improve the security and reliability of the Internet of Things system.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) security technology, and in particular to an IoT network security optimization method and related equipment. Background Technology

[0002] In today's digital age, the Internet of Things (IoT) is transforming our lives and work at an astonishing pace. From smart homes and smart cities to industrial automation, the number of IoT devices is exploding. According to statistics, the number of IoT devices globally has been steadily increasing over the past few years and is projected to grow at an annual rate of 20% in the coming years. These devices connect via networks to transmit and interact with data, significantly improving productivity and convenience.

[0003] However, the rapid development of the Internet of Things (IoT) has also brought a series of severe cybersecurity challenges. Due to the wide variety and distribution of IoT devices, and the fact that many devices have limited resources and weak security capabilities, IoT networks face numerous security threats. For example, hackers can obtain sensitive data, such as personal privacy information and corporate trade secrets, by attacking IoT devices; they can also maliciously damage IoT systems, causing device malfunctions and system paralysis, resulting in serious losses to individuals, businesses, and even society. According to incomplete statistics, IoT security incidents have occurred frequently in recent years, with economic losses caused by IoT security vulnerabilities reaching billions or even tens of billions of US dollars annually.

[0004] Traditional network security methods have certain limitations in the Internet of Things (IoT) environment. On the one hand, the diversity of IoT devices and resource constraints make it difficult to effectively deploy and implement traditional security technologies; on the other hand, the dynamic nature and complexity of IoT networks place higher demands on security mechanisms. Therefore, optimizing IoT network security and improving the security and reliability of IoT systems has become a crucial issue that urgently needs to be addressed. Summary of the Invention

[0005] To help optimize IoT network security and improve the security and reliability of IoT systems, this application provides an IoT network security optimization method and related equipment.

[0006] Firstly, this application provides an IoT network security optimization method, which adopts the following technical solution:

[0007] An IoT network security optimization method includes:

[0008] If a network request is detected, the target information of the requesting terminal is obtained based on the network request;

[0009] Based on the target information, the risk level of the requesting terminal is obtained;

[0010] If the risk level exceeds a preset threshold, the network connection request is rejected, the requesting terminal is marked with a risk and a risk label is generated.

[0011] Determine whether the set of tags corresponding to the risk tags meets the preset tag requirements;

[0012] If the tag set meets the preset tag requirements, the requesting terminal will be added to the blacklist.

[0013] If the risk level does not exceed the preset level threshold, then the historical access permissions of the requesting terminal are obtained;

[0014] If the historical access permissions meet the permission update criteria, then the historical access permissions are updated and the current access permissions are obtained;

[0015] Based on the current access permissions, the network connection request is permitted.

[0016] By adopting the above technical solution, when a network request is detected, the system obtains the target information of the requesting terminal based on the network request, and then assesses the risk level of the requesting terminal based on the target information. If the risk level exceeds a preset threshold, it indicates that the requesting terminal has a high risk level, and the system will reject the network request, mark the requesting terminal as a risk and generate a risk label to warn of potential security threats. Subsequently, it is determined whether the label set corresponding to the risk label meets the preset label requirements. If it does, the requesting terminal is added to the blacklist to further enhance the system's security. If the risk level does not exceed the preset threshold, the system obtains the requesting terminal's historical access permissions and determines whether these permissions meet the update criteria. If they do, the historical access permissions are updated and the current access permissions are obtained. Finally, the network request is allowed based on the current access permissions.

[0017] By monitoring network requests in real time and conducting risk assessments, potential security threats can be detected and blocked in a timely manner, effectively protecting the IoT system from attacks. The mechanism of dynamically adjusting access permissions allows the system to flexibly allocate resources according to the risk status of terminals, improving resource utilization efficiency. The combination of risk labeling and blacklisting mechanisms not only enables effective control of high-risk terminals, but also provides strong support for subsequent security decisions by accumulating risk label sets, further optimizing the security and reliability of the IoT network.

[0018] Optionally, obtaining the risk level of the requesting terminal based on the target information includes:

[0019] Based on the target information, obtain the historical network connection records of the requesting terminal;

[0020] If the historical network connection record is not empty, then obtain the historical network connection count and network connection success rate;

[0021] The risk level is determined based on the number of network connections and the network success rate.

[0022] If the historical network record is an empty record, then obtain the trusted terminal and the trusted terminal of the requesting terminal;

[0023] The risk level is obtained based on the trusted terminal and the trusted terminal.

[0024] Optionally, obtaining the risk level based on the number of network connections and the network success rate includes:

[0025] If the number of network connections exceeds a first threshold and the network connection success rate exceeds a second threshold, then the risk level is obtained based on the number of network connections and the network connection success rate.

[0026] If the number of network connections exceeds the first threshold and the network connection success rate does not exceed the second threshold, then the network connection request record and the data modification record of the Internet of Things corresponding to the requesting terminal are obtained.

[0027] Based on the network request record and the data modification record, obtain the correction factor;

[0028] The risk level is obtained based on the number of network connections, the network connection success rate, and the correction factor.

[0029] If the number of network connections does not exceed the first threshold and the network connection success rate exceeds the second threshold, then the activity level of the requesting terminal is obtained.

[0030] The risk level is obtained based on the number of network connections, the network connection success rate, and the activity level.

[0031] If the number of network connections does not exceed the first quantity threshold and the network connection success rate does not exceed the second quantity threshold, then the risk level is obtained based on the number of network connections and the network connection success rate.

[0032] Optionally, obtaining the correction factor based on the network request record and the data modification record includes:

[0033] Based on the network request record, obtain the network request time;

[0034] Based on the data correction record, obtain the data correction time;

[0035] Determine whether the data correction time is included between two adjacent network request times;

[0036] If the data correction time is included between two adjacent network request times, the correction quantity is obtained and the correction quantity is incremented by 1.

[0037] The correction quantity is retrieved again, and a correction factor is obtained based on the retrieved correction quantity.

[0038] Optionally, obtaining the risk level based on the trusted terminal and the trusted terminal includes:

[0039] Determine whether network connection records corresponding to the trusted terminal and the trusted terminal have been detected;

[0040] If the network connection record is detected, then the first number corresponding to the first target terminal and the second number corresponding to the second target terminal are obtained;

[0041] Obtain the first level and first activity level corresponding to the first target terminal, and obtain the second level and second activity level corresponding to the second target terminal;

[0042] Based on the first quantity, the first level, and the first activity level, obtain the trust level;

[0043] Based on the second quantity, the second level, and the second activity level, the trust level is obtained;

[0044] The risk level is obtained based on the trust level and the level of being trusted.

[0045] Optionally, updating the historical access permissions and obtaining the current access permissions if the historical access permissions meet the permission update criteria includes:

[0046] Obtain the change history of the aforementioned historical access permissions;

[0047] Based on the change records, obtain the duration of the last change;

[0048] If the duration of the last change does not exceed a preset duration threshold, then determine whether a special approval instruction for adjusting access permissions has been detected.

[0049] If detected, obtain the access scope and access duration corresponding to the special approval instruction;

[0050] Based on the access scope and the access duration, obtain the current access permissions;

[0051] If the duration of the last change exceeds a preset duration threshold, then the change status of the access permissions is obtained based on the change record;

[0052] Determine whether the changes meet the permission update criteria;

[0053] If the changes meet the permission update criteria, the historical access permissions are updated and the current access permissions are obtained.

[0054] Optionally, determining whether the change meets the permission update criteria includes:

[0055] Based on the changes, obtain the overall rate of change, the unit rate of change, and the type of change of the access range corresponding to the requesting terminal;

[0056] If the change type is an increase, then the change is determined to meet the permission update criteria.

[0057] If the change type is fluctuation type, then determine whether the comprehensive change rate is greater than 0 and whether the unit change rate is less than the fluctuation threshold.

[0058] If the overall rate of change is greater than 0 and the unit rate of change is less than the fluctuation threshold, then the change is determined to meet the permission update standard.

[0059] Secondly, this application also discloses an IoT network security optimization system, which adopts the following technical solution:

[0060] An IoT network security optimization system includes:

[0061] If a network request is detected, the first acquisition module is used to acquire target information of the requesting terminal based on the network request.

[0062] The second acquisition module is used to acquire the risk level of the requesting terminal based on the target information;

[0063] The risk marking module, if the risk level exceeds a preset level threshold, is used to reject the network request, mark the requesting terminal for risk, and generate a risk label;

[0064] The judgment module is used to determine whether the set of tags corresponding to the risk tags meets the preset tag requirements;

[0065] The blacklist module is used to add the requesting terminal to the blacklist if the tag set meets the preset tag requirements.

[0066] If the risk level does not exceed the preset level threshold, the third acquisition module is used to acquire the historical access permissions of the requesting terminal.

[0067] The permission update module is used to update the historical access permissions and obtain the current access permissions if the historical access permissions meet the permission update criteria.

[0068] A network connectivity module is used to allow the network connection request based on the current access permissions.

[0069] By adopting the above technical solution, when a network request is detected, the system obtains the target information of the requesting terminal based on the network request, and then assesses the risk level of the requesting terminal based on the target information. If the risk level exceeds a preset threshold, it indicates that the requesting terminal has a high risk level, and the system will reject the network request, mark the requesting terminal as a risk and generate a risk label to warn of potential security threats. Subsequently, it is determined whether the label set corresponding to the risk label meets the preset label requirements. If it does, the requesting terminal is added to the blacklist to further enhance the system's security. If the risk level does not exceed the preset threshold, the system obtains the requesting terminal's historical access permissions and determines whether these permissions meet the update criteria. If they do, the historical access permissions are updated and the current access permissions are obtained. Finally, the network request is allowed based on the current access permissions.

[0070] By monitoring network requests in real time and conducting risk assessments, potential security threats can be detected and blocked in a timely manner, effectively protecting the IoT system from attacks. The mechanism of dynamically adjusting access permissions allows the system to flexibly allocate resources according to the risk status of terminals, improving resource utilization efficiency. The combination of risk labeling and blacklisting mechanisms not only enables effective control of high-risk terminals, but also provides strong support for subsequent security decisions by accumulating risk label sets, further optimizing the security and reliability of the IoT network.

[0071] Thirdly, the computer device provided in this application adopts the following technical solution:

[0072] A smart terminal includes a memory and a processor, wherein the memory stores a computer program that can run on the processor, and when the processor loads the computer program, it executes the method of the first aspect.

[0073] By adopting the above technical solution, a computer program is generated based on the method of the first aspect and stored in a memory for loading and execution by a processor. Thus, a smart terminal is made based on the memory and the processor, making it convenient for users to use.

[0074] Fourthly, the computer-readable storage medium provided in this application adopts the following technical solution:

[0075] A computer-readable storage medium storing a computer program that, when loaded by a processor, executes the method of the first aspect.

[0076] By adopting the above technical solution, a computer program is generated based on the method of the first aspect and stored in a computer-readable storage medium for loading and execution by a processor. The computer-readable storage medium facilitates the reading and storage of the computer program.

[0077] In summary, this application includes the following beneficial technical effects:

[0078] By monitoring network requests in real time and conducting risk assessments, potential security threats can be detected and blocked in a timely manner, effectively protecting the IoT system from attacks. The mechanism of dynamically adjusting access permissions allows the system to flexibly allocate resources according to the risk status of terminals, improving resource utilization efficiency. The combination of risk labeling and blacklisting mechanisms not only enables effective control of high-risk terminals, but also provides strong support for subsequent security decisions by accumulating risk label sets, further optimizing the security and reliability of the IoT network. Attached Figure Description

[0079] Figure 1 This is a main flowchart of an IoT network security optimization method according to an embodiment of this application;

[0080] Figure 2 This is a flowchart of steps S201 to S205;

[0081] Figure 3 This is a flowchart of steps S301 to S307;

[0082] Figure 4 This is a flowchart of steps S401 to S405;

[0083] Figure 5 This is a flowchart of steps S501 to S506;

[0084] Figure 6 This is a flowchart of steps S601 to S608;

[0085] Figure 7 This is a flowchart of steps S701 to S704;

[0086] Figure 8 This is a block diagram of an IoT network security optimization system according to an embodiment of this application.

[0087] Explanation of reference numerals in the attached figures:

[0088] 1. First Acquisition Module; 2. Second Acquisition Module; 3. Risk Marking Module; 4. Judgment Module; 5. Blacklist Module; 6. Third Acquisition Module; 7. Permission Update Module; 8. Network Connection Module. Detailed Implementation

[0089] Firstly, this application discloses a method for optimizing Internet of Things (IoT) network security.

[0090] Reference Figure 1 An IoT network security optimization method includes steps S101 to S106:

[0091] Step S101: If a network request is detected, obtain the target information of the requesting terminal based on the network request.

[0092] Specifically, in this embodiment, a network connection request refers to a connection request initiated by an IoT terminal device to the network. The request content typically includes the device's identification information and the target address for the requested connection. The requesting terminal is the IoT device that initiates the network connection request, such as various smart sensors, smart home appliances, and industrial control equipment. The target information is a series of information related to the requesting terminal, which may include the terminal's hardware information (such as device model, MAC address, etc.), software information (such as operating system version, application version, etc.), user information (such as user ID, user permissions, etc.), and network environment information (such as IP address, network area, etc.).

[0093] Step S102: Based on the target information, obtain the risk level of the requesting terminal.

[0094] Specifically, in this embodiment, the risk level is calculated based on factors such as the target information of the requesting terminal through a certain risk assessment algorithm or model, and is used to indicate the degree of security risk that the terminal may bring when connecting to the network, such as low risk, medium risk, high risk, etc.

[0095] Step S103: If the risk level exceeds the preset risk level threshold, the network connection request is rejected, the requesting terminal is marked with a risk and a risk label is generated.

[0096] Specifically, in this embodiment, the preset level threshold is a pre-set critical value used to determine whether the risk level is too high. When the risk level of the requesting terminal exceeds the threshold, it indicates that the risk level is too high, and measures such as refusing network access will be taken. The risk label is a further specification and classification of the risk mark, describing the risk type or characteristics of the requesting terminal in the form of a label, such as "network intrusion risk" or "weak password risk". The risk level of the requesting terminal can also be described according to the number of labels.

[0097] Step S104: Determine whether the set of tags corresponding to the risk tags meets the preset tag requirements.

[0098] Specifically, in this embodiment, the tag set is a collection of multiple risk tags used to comprehensively describe the risk status of the requesting terminal; the preset tag requirements are pre-set conditions or rules regarding the tag set used to determine whether the risk status of the requesting terminal reaches the level that requires addition to the blacklist.

[0099] Step S105: If the tag set meets the preset tag requirements, then add the requesting terminal to the blacklist.

[0100] Specifically, in this embodiment, if the tag set meets the preset tag requirements, it means that the number of risk tags corresponding to the tag set is too large, and the requirements for adding it to the blacklist have been met.

[0101] Step S106: If the risk level does not exceed the preset level threshold, then obtain the historical access permissions of the requesting terminal.

[0102] Specifically, in this embodiment, historical access permissions refer to the record of access permissions granted to the requesting terminal to the specified Internet of Things over a period of time, including the type of resources accessed, the time range of access, and the operation permissions accessed.

[0103] Step S107: If the historical access permissions meet the permission update criteria, then update the historical access permissions and obtain the current access permissions.

[0104] Specifically, in this embodiment, the permission update standard is a pre-set condition or rule for determining whether historical access permissions need to be updated, which may include factors such as terminal usage, security status, and changes in business needs; the current access permission is the access permission to network resources currently granted to the terminal after evaluation and updating based on historical access permissions and the permission update standard.

[0105] Step S108: Allow network access requests based on current access permissions.

[0106] The IoT network security optimization method provided in this embodiment, when a network request is detected, the system obtains the target information of the requesting terminal based on the network request, and then assesses the risk level of the requesting terminal based on the target information. If the risk level exceeds a preset threshold, it indicates that the risk level of the requesting terminal is high, and the system will reject the network request, mark the requesting terminal as a risk and generate a risk label to warn of potential security threats. Subsequently, it is determined whether the label set corresponding to the risk label meets the preset label requirements. If it does, the requesting terminal is added to the blacklist to further enhance the security of the system. If the risk level does not exceed the preset threshold, the system obtains the historical access permissions of the requesting terminal and determines whether these permissions meet the update criteria. If they do, the historical access permissions are updated and the current access permissions are obtained. Finally, the network request is allowed based on the current access permissions.

[0107] By monitoring network requests in real time and conducting risk assessments, potential security threats can be detected and blocked in a timely manner, effectively protecting the IoT system from attacks. The mechanism of dynamically adjusting access permissions allows the system to flexibly allocate resources according to the risk status of terminals, improving resource utilization efficiency. The combination of risk labeling and blacklisting mechanisms not only enables effective control of high-risk terminals, but also provides strong support for subsequent security decisions by accumulating risk label sets, further optimizing the security and reliability of the IoT network.

[0108] Reference Figure 2 In one embodiment of this example, step S102, based on target information, obtains the risk level of the requesting terminal, including steps S201 to S205:

[0109] Step S201: Based on the target information, obtain the historical network connection records of the requesting terminal.

[0110] Specifically, historical network access records refer to records of successful network access by the requesting terminal in the past, including information such as the network access time and the network environment at the time of access.

[0111] Step S202: If the historical network connection record is not empty, then obtain the historical network connection count and network connection success rate.

[0112] Specifically, in this embodiment, an empty record means that the requesting terminal has no record of successfully connecting to the Internet of Things; the number of historical network connections is the total number of times the terminal has successfully connected to the Internet in the past, which is calculated from the historical network connection records of the requesting terminal; the network success rate is an indicator calculated from the historical network connection records, that is, the proportion of the number of successful network connections to the total number of historical network connections.

[0113] Step S203: Obtain the risk level based on the number of network connections and the success rate of network connections.

[0114] Step S204: If the historical network record is empty, then obtain the trusted terminal and the trusted terminal of the requesting terminal.

[0115] Specifically, a trusted terminal refers to another terminal that the requesting terminal trusts. In this embodiment, a trusted terminal can easily access the requesting terminal or establish a connection with it. A trusted terminal refers to another terminal that regards the requesting terminal as a trusted object. That is, the requesting terminal has a certain degree of trust influence over these terminals, and the requesting terminal can easily access the trusted terminal or establish a connection with it.

[0116] Step S205: Obtain the risk level based on the trusted terminal and the trusted terminal.

[0117] The IoT network security optimization method provided in this embodiment, when obtaining the risk level of a requesting terminal based on target information, first queries the terminal's historical network connection records; if the records are not empty, it further obtains the historical number of network connections and the network connection success rate, and calculates the risk level based on these; if the number of network connections exceeds a first threshold and the network connection success rate exceeds a second threshold, the risk level is directly calculated based on both; if the number of network connections exceeds the threshold but the success rate does not meet the standard, the system retrieves the terminal's network request records and IoT data modification records, obtains a correction factor by analyzing the correlation between the two, and then calculates the risk level by combining the number of network connections, the success rate, and the correction factor; if the number of network connections does not exceed the threshold but the success rate meets the standard, the terminal activity index is introduced to comprehensively calculate the risk level; if neither of these meets the standard, the risk level is directly calculated based on the number of network connections and the success rate; if the historical network connection records are empty, the system obtains the terminal's trusted terminal and trusted terminal information, and assesses the risk level based on these trust relationships.

[0118] By analyzing historical network connection records from multiple dimensions, accurate risk level assessments were achieved. Differentiated assessment strategies were developed for different network performance patterns, taking into account both basic network frequency and success rate, and introducing supplementary indicators such as correction factors and activity levels to make risk assessments more comprehensive and in-depth. For newly connected terminals with no historical records, a trust-based assessment mechanism ensured the rationality of the initial risk assessment. This hierarchical and multi-faceted risk assessment approach can more accurately identify potential risky terminals, providing a reliable basis for subsequent security decisions, thereby effectively improving the overall security and anti-attack capabilities of the IoT system.

[0119] Reference Figure 3 In one embodiment of this example, step S203, based on the number of network connections and the network success rate, obtains the risk level, including steps S301 to S307:

[0120] Step S301: If the number of network connections exceeds the first threshold and the network connection success rate exceeds the second threshold, then obtain the risk level based on the number of network connections and the network connection success rate.

[0121] Specifically, in this embodiment, the first quantity threshold is a pre-set critical value used to measure the number of times the requesting terminal has historically connected to the network; the second quantity threshold is a pre-set critical value used to measure the success rate of the requesting terminal connecting to the network; in this embodiment, the risk value can be calculated using a formula, and then, according to a preset level classification standard, the corresponding risk level is matched based on the risk value. The risk value calculation formula is as follows:

[0122]

[0123] Where R is the risk value, S is the network connection success rate, N is the number of network connections, and N0 is the baseline number of network connections (which can be set according to user needs or actual situation; in this embodiment, N0 can be set to half of the first quantity threshold).

[0124] In this embodiment, the risk level can be divided into low risk (0 < risk value ≤ 30), medium risk (30 < risk value ≤ 70) and high risk (70 < risk value ≤ 100) according to the risk value.

[0125] Step S302: If the number of network connection attempts exceeds the first threshold and the network connection success rate does not exceed the second threshold, then obtain the network connection request record and IoT data modification record corresponding to the requesting terminal.

[0126] Specifically, the network request record is a detailed record of the requesting terminal's past network requests to the specified IoT, including the time of each request, the network node requested, and the parameters carried in the request; the data modification record refers to the record of the data of the specified IoT being modified, such as the modification of the IoT password and IoT physical address.

[0127] Step S303: Obtain the correction factor based on the network request record and data modification record.

[0128] Specifically, in this embodiment, the correction factor is used to correct data that causes the requesting terminal to fail to connect to the network due to modifications of data such as IoT passwords or physical addresses. By correcting with the correction factor, the failure rate of the requesting terminal to fail to connect to the network due to modifications of data such as IoT passwords or physical addresses can be removed, thereby correcting the network success rate.

[0129] Step S304: Obtain the risk level based on the number of network connections, network success rate, and correction factor.

[0130] Specifically, the network connection success rate is first recalculated based on the correction factor, and then the risk level is calculated based on the recalculated network connection success rate.

[0131] Step S305: If the number of network connection attempts does not exceed the first threshold and the network connection success rate exceeds the second threshold, then obtain the activity level of the requesting terminal.

[0132] Specifically, in this embodiment, activity level is an indicator used to measure the frequency with which a requesting terminal participates in network activities (such as data transmission, command interaction, etc.) within a certain period of time, and can be calculated by statistically analyzing the terminal's operation frequency, data interaction volume, etc.

[0133] Step S306: Obtain the risk level based on the number of network connections, network success rate, and activity level.

[0134] Specifically, in this embodiment, the risk value is first calculated by combining the number of network connections, the network success rate, and the activity level. The calculation formula is as follows:

[0135]

[0136] Where A represents activity level, A max This is the preset maximum activity threshold.

[0137] Step S307: If the number of network connections does not exceed the first threshold and the network connection success rate does not exceed the second threshold, then obtain the risk level based on the number of network connections and the network connection success rate.

[0138] The IoT network security optimization method provided in this embodiment, when determining the risk level based on the number of network connections and the success rate, first determines whether the number of network connections exceeds a first threshold and whether the success rate exceeds a second threshold, and forms processing logic for four scenarios. When both the number of network connections and the success rate exceed the threshold, the risk level is directly calculated based on both. When the number of network connections exceeds the threshold but the success rate does not meet the standard, the system retrieves the terminal's network request records and IoT data modification records, analyzes whether there is a data correction time between adjacent network request times, counts the correction quantity and generates a correction factor, and then calculates the risk level by combining the number of network connections, the success rate, and the correction factor. When the number of network connections does not exceed the threshold but the success rate meets the standard, the system obtains the terminal's activity level and calculates the risk level based on a comprehensive assessment of the three factors. When neither of the three conditions is met, the risk level is directly calculated based on the number of network connections and the success rate.

[0139] Through refined analysis of network behavior, the risk level was accurately quantified. Differentiated risk assessment models were designed for different network behavior characteristics, considering not only basic network frequency and success rate but also introducing dynamic indicators such as correction factors and activity levels, making the risk assessment more comprehensive and relevant to real-world scenarios. Especially when dealing with high-frequency, low-success-rate abnormal network behavior, the introduction of correction factors through data modification records effectively corrects the network success rate. For terminals with low frequency and high success rates, the use of activity indicators avoids misjudgments caused by occasional behavior. This multi-layered, dynamic risk assessment mechanism significantly improves the system's ability to identify abnormal behavior and strengthens the security protection system of the Internet of Things (IoT) system.

[0140] Reference Figure 4 In one embodiment of this example, step S303, based on network request records and data modification records, obtains the correction factor, including steps S401 to S405:

[0141] Step S401: Obtain the network request time based on the network request record.

[0142] Specifically, in this embodiment, the network request time refers to the specific time point at which the requesting terminal initiates a connection request to the Internet of Things, which can be directly extracted from the network request record for subsequent time series analysis.

[0143] Step S402: Obtain the data correction time based on the data correction record.

[0144] Specifically, in this embodiment, the data correction time refers to the specific time point at which data (such as passwords, physical addresses, etc.) in the Internet of Things system is modified. It is recorded in the data modification record and can be directly retrieved.

[0145] Step S403: Determine whether there is a data correction time between two adjacent network request times.

[0146] Specifically, in this embodiment, the data correction time is compared with the network request time one by one, so as to determine whether it is between two adjacent network request times based on the time sequence.

[0147] Step S404: If there is a data correction time between two adjacent network request times, obtain the correction quantity and control the correction quantity to be incremented by 1.

[0148] Specifically, the correction quantity refers to the number of times a requesting terminal fails to connect to the network due to data correction. In this embodiment, the correction quantity is also the sum of the number of times data correction time is included in adjacent network request time intervals. It is the basic value for calculating the correction factor. The initial value is usually 0, and it is increased by 1 each time a matching interval is found.

[0149] Step S405: Reacquire the correction quantity and obtain the correction factor based on the reacquired correction quantity.

[0150] Specifically, in this embodiment, the correction factor can be determined by... The calculation is performed using F as the correction factor, C as the correction quantity, and M as the total number of intervals (the total number of adjacent time point pairs in the network request record, i.e., the number of network requests - 1).

[0151] The IoT network security optimization method provided in this embodiment first obtains the network request time from the network request record and the data modification time from the data modification record when obtaining the correction factor based on the network request record and the data modification record. Then, it determines whether the data modification time is included between two adjacent network request times. If it is included, the correction quantity is incremented by 1. Finally, the correction factor is calculated based on the newly obtained correction quantity.

[0152] By accurately comparing network request time and data modification time, network failures caused by modifications to IoT passwords or physical addresses can be accurately identified. A correction factor can then be used to remove these failure rates caused by factors beyond the terminal's own risk, making the network success rate calculation more accurately reflect the actual network behavior risk of the terminal. This refined correction mechanism effectively avoids interference from external factors such as system configuration changes in terminal risk assessment, significantly improving the accuracy of risk level assessment and thus enhancing the reliability and effectiveness of the entire IoT network security protection system.

[0153] Reference Figure 5 In one embodiment of this example, step S205, based on the trusted terminal and the trusted terminal, obtains the risk level, including steps S501 to S506:

[0154] Step S501: Determine whether network records corresponding to the trusted terminal and the trusted terminal have been detected.

[0155] Specifically, in this embodiment, the network connection record is the record of successfully connecting to the specified Internet of Things.

[0156] Step S502: If a network connection record is detected, obtain the first number corresponding to the first target terminal and the second number corresponding to the second target terminal.

[0157] Specifically, in this embodiment, the first target terminal refers to a trusted terminal with network access records, and the first quantity is the number of the first target terminals, which is the number of trusted terminals with network access records; the second target terminal refers to a trusted terminal with network access records, and the second quantity is the number of the second target terminals, which is the number of trusted terminals with network access records.

[0158] Step S503: Obtain the first level and first activity level corresponding to the first target terminal, and obtain the second level and second activity level corresponding to the second target terminal.

[0159] Specifically, in this embodiment, the first level is the risk level corresponding to the first target terminal, and the first activity level is the activity level corresponding to the first target terminal; the second level is the risk level corresponding to the second target terminal, and the second activity level is the activity level corresponding to the second target terminal.

[0160] Step S504: Obtain the trust level based on the first quantity, the first level, and the first activity level.

[0161] Specifically, the trust level is the comprehensive trust level of the first target terminal generated based on all the first quantity, first level, and first activity. In this embodiment, the trust level can be calculated using the following formula:

[0162]

[0163] Where P1 is the trust level, N1 is the first quantity, and L... i For the security level of the i-th first target terminal, A 1i Let T1 be the activity level of the i-th first target terminal, and T1 be the first compensation factor (used to compensate for the impact of the first quantity on the trust level). .

[0164] Step S505: Obtain the trust level based on the second quantity, the second level, and the second activity level.

[0165] Specifically, in this embodiment, the trust level is the comprehensive trust level of the second target terminal generated based on all the second quantity, second level, and second activity. In this embodiment, the trust level can be calculated using the following formula:

[0166]

[0167] Where P2 is the level of trust, N2 is the second quantity, and L j For the security level of the j-th second target terminal, A 2j Let T1 be the activity level of the j-th second target terminal, and T2 be the second compensation factor (used to compensate for the impact of the second quantity on the trust level). .

[0168] Step S506: Obtain the risk level based on the trust level and the level of being trusted.

[0169] Specifically, in this embodiment, the risk level satisfies the following calculation formula:

[0170]

[0171] Where P is the risk level and K is the basic risk threshold (system preset, such as 10, which represents the initial risk when there is no trust relationship). For trust level weights, Trust weight, .

[0172] The IoT network security optimization method provided in this embodiment assesses risk by determining whether network records of trusted terminals and trusted terminals are detected when historical network records are empty. If network records exist, the method obtains the first quantity, first level, and first activity level of the first target terminal (trusted terminal), and the second quantity, second level, and second activity level of the second target terminal (trusted terminal), and then calculates the trust level and the trusted level, and finally combines the two to obtain the risk level.

[0173] By introducing a trust network relationship to conduct risk assessment on newly accessed terminals, the problem of risk assessment for terminals without historical network connection records is solved. This assessment method based on social network trust mechanism combines the trustworthiness of a terminal with the quality and quantity of its associated terminals, and can comprehensively measure terminal risk from the perspective of network ecosystem. It effectively makes up for the shortcomings of traditional assessment methods based on historical behavior, provides more reliable security for the access of new devices in the Internet of Things environment, and improves the risk identification capability and security of the entire system.

[0174] Reference Figure 6 In one embodiment of this example, if the historical access permissions meet the permission update criteria in step S107, then updating the historical access permissions and obtaining the current access permissions includes steps S601 to S608:

[0175] Step S601: Obtain the change record of historical access permissions.

[0176] Specifically, in this embodiment, the change record includes the change time, change content, and change reason, etc.

[0177] Step S602: Based on the change records, obtain the duration of the last change.

[0178] Specifically, in this embodiment, the duration of the last change is the time interval between the completion of the last adjustment and the current time.

[0179] Step S603: If the duration of the last change does not exceed the preset duration threshold, determine whether a special approval instruction for adjusting access permissions has been detected.

[0180] Specifically, in this embodiment, the system pre-sets a time standard for judging whether the "duration of the last change" is reasonable (such as 10 days, 20 days, etc.); the special approval instruction refers to the instruction issued by the system administrator or a preset authorization mechanism (such as an emergency response system) for temporarily adjusting access permissions.

[0181] Step S604: If detected, obtain the access scope and access duration corresponding to the special approval instruction.

[0182] Specifically, in this embodiment, the access scope refers to the resource boundaries that the requesting terminal can access, as specified in the special approval instruction, including: resource type (such as sensor data, control instructions, log files, etc.), resource location (such as devices in a certain area, a certain server node, etc.), and access method (such as read-only, modifiable, deletable, etc.); the access duration refers to the effective time interval of the temporary permission as defined in the special approval instruction.

[0183] Step S605: Obtain the current access permissions based on the access scope and access duration.

[0184] Step S606: If the duration of the last change exceeds a preset duration threshold, obtain the changes in access permissions based on the change records.

[0185] Specifically, in this embodiment, the changes are summarized by analyzing the "change records" to determine the trends or patterns of "historical access permissions" during multiple adjustments.

[0186] Step S607: Determine whether the changes meet the permission update criteria.

[0187] Step S608: If the changes meet the permission update criteria, update the historical access permissions and obtain the current access permissions.

[0188] The IoT network security optimization method provided in this embodiment, when determining whether historical access permissions meet the update criteria, first obtains the change records of historical access permissions and calculates the duration of the last change; if the duration does not exceed a preset threshold, it further checks whether there is a special approval instruction to adjust access permissions; if so, it determines the current access permissions based on the access scope and access duration corresponding to the special approval instruction; if the duration of the last change exceeds the preset threshold, it analyzes the permission changes in the change records to determine whether they meet the permission update criteria; if they do, it updates the historical access permissions and obtains the current access permissions.

[0189] By combining the time dimension (duration of the last change) and the characteristics of permission changes (change situation) for dual judgment, it ensures that access permissions can be quickly adjusted in emergency situations (such as special instructions), while also ensuring the stability and security of long-term permission changes. This dynamic adjustment mechanism can flexibly update access permissions according to actual needs and risk conditions, effectively addressing the complexity and dynamism of device permission management in the Internet of Things environment, reducing security risks caused by expired or unreasonable permissions, and improving system security and management efficiency.

[0190] Reference Figure 7 In one embodiment of this example, step S607, determining whether the change meets the permission update criteria, includes steps S701 to S704:

[0191] Step S701: Based on the changes, obtain the overall change rate, unit change rate, and change type of the access range corresponding to the requesting terminal.

[0192] Specifically, the overall change rate refers to the overall degree of change of the requesting terminal; the unit change rate refers to the average degree of change of the access range of the requesting terminal within a unit of time (such as daily or weekly); in this embodiment, according to the change trend of the access range, the change type is divided into increasing, fluctuating, and decreasing types. Increasing type means that the access range continues to expand and the trust level of the corresponding terminal continues to rise; fluctuating type means that the access range increases and decreases, and the trust level of the corresponding terminal is unstable; decreasing type means that the access range continues to decrease and the trust level of the corresponding terminal continues to decline.

[0193] Step S702: If the change type is enlargement, then the change situation is determined to meet the permission update criteria.

[0194] Step S703: If the change type is fluctuation type, determine whether the overall change rate is greater than 0 and whether the unit change rate is less than the fluctuation threshold.

[0195] Specifically, in this embodiment, the fluctuation threshold is a preset critical value used to determine whether the unit rate of change is stable.

[0196] Step S704: If the overall rate of change is greater than 0 and the unit rate of change is less than the fluctuation threshold, then the change is determined to meet the permission update criteria.

[0197] Specifically, in this embodiment, a comprehensive change rate greater than 0 indicates that the access range is on an overall upward trend, and a unit change rate less than the fluctuation threshold indicates that the access range is changing steadily without significant changes. Therefore, it can be determined that the change meets the permission update standard.

[0198] The IoT network security optimization method provided in this embodiment first extracts the comprehensive change rate, unit change rate, and change type of the access range of the requesting terminal based on the change situation when determining whether the change of access permissions meets the change criteria. If the change type is increasing (i.e., the access range continues to expand and the trust level of the corresponding terminal continues to rise), it is directly determined that the standard is met; if it is fluctuating (i.e., the access range fluctuates up and down and the trust level of the corresponding terminal is unstable), it further analyzes whether the comprehensive change rate is greater than 0 and whether the unit change rate is less than the fluctuation threshold. If both are met, it is determined that the standard is met, because it indicates that although the access range fluctuates, it shows a steady upward trend overall.

[0199] By dynamically linking permission change types with terminal trust levels and setting differentiated judgment mechanisms for different change patterns, this system can respond promptly to reasonable permission expansion needs arising from increased terminal trust levels, effectively identify abnormal fluctuation risks, and avoid security vulnerabilities caused by blindly expanding permissions. This refined permission change evaluation system enables IoT systems to maintain necessary flexibility while ensuring security, adapting to dynamic changes in terminal trust levels, significantly improving the scientific nature and effectiveness of access permission management, and providing a more precise mechanism for secure device access and data protection in the IoT environment.

[0200] Secondly, this application also discloses an IoT network security optimization system.

[0201] Reference Figure 8 An Internet of Things (IoT) network security optimization system, comprising:

[0202] If a network request is detected, the first acquisition module is used to acquire the target information of the requesting terminal based on the network request.

[0203] The second acquisition module is used to acquire the risk level of the requesting terminal based on the target information;

[0204] The risk marking module is used to reject network requests if the risk level exceeds a preset threshold. It marks the requesting terminal with risk and generates a risk label.

[0205] The judgment module is used to determine whether the set of tags corresponding to the risk tags meets the preset tag requirements;

[0206] The blacklist module is used to add the requesting terminal to the blacklist if the tag set meets the preset tag requirements.

[0207] If the risk level does not exceed the preset threshold, the third acquisition module is used to acquire the historical access permissions of the requesting terminal.

[0208] The permission update module is used to update the historical access permissions and obtain the current access permissions if the historical access permissions meet the permission update criteria.

[0209] The network connectivity module is used to allow network requests based on current access permissions.

[0210] Thirdly, this application discloses a smart terminal, including a memory and a processor. The memory stores a computer program that can run on the processor. When the processor loads the computer program, it executes an IoT network security optimization method as described in the above embodiment.

[0211] Fourthly, embodiments of this application disclose a computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is loaded by a processor, it executes an IoT network security optimization method according to the above embodiments.

[0212] The above are all preferred embodiments of this application, and are not intended to limit the scope of protection of this application. Therefore, all equivalent changes made in accordance with the structure, shape and principle of this application should be covered within the scope of protection of this application.

Claims

1. A method for optimizing Internet of Things (IoT) network security, characterized in that, include: If a network request is detected, the target information of the requesting terminal is obtained based on the network request; Based on the target information, the risk level of the requesting terminal is obtained; If the risk level exceeds a preset threshold, the network connection request is rejected, the requesting terminal is marked with a risk and a risk label is generated. Determine whether the set of tags corresponding to the risk tags meets the preset tag requirements; If the tag set meets the preset tag requirements, the requesting terminal will be added to the blacklist. If the risk level does not exceed the preset level threshold, then the historical access permissions of the requesting terminal are obtained; If the historical access permissions meet the permission update criteria, then the historical access permissions are updated and the current access permissions are obtained; Based on the current access permissions, the network request is permitted; The process of obtaining the risk level of the requesting terminal based on the target information includes: Based on the target information, obtain the historical network connection records of the requesting terminal; If the historical network connection record is not empty, then obtain the historical network connection count and network connection success rate; The risk level is determined based on the number of network connections and the network success rate. If the historical network record is an empty record, then obtain the trusted terminal and the trusted terminal of the requesting terminal; Based on the trusted terminal and the trusted terminal, the risk level is obtained; The process of obtaining the risk level based on the trusted terminal and the trusted terminal includes: Determine whether network connection records corresponding to the trusted terminal and the trusted terminal have been detected; If the network connection record is detected, the first number corresponding to the first target terminal and the second number corresponding to the second target terminal are obtained. The first target terminal refers to the trusted terminal with network connection record. The first number is the number of the first target terminal, which is also the number of the trusted terminal with network connection record. The second target terminal refers to the trusted terminal with network connection record. The second number is the number of the second target terminal, which is also the number of the trusted terminal with network connection record. Obtain the first level and first activity level corresponding to the first target terminal, and obtain the second level and second activity level corresponding to the second target terminal; Based on the first quantity, the first level, and the first activity level, obtain the trust level; Based on the second quantity, the second level, and the second activity level, the trust level is obtained; The risk level is obtained based on the trust level and the level of being trusted.

2. The IoT network security optimization method according to claim 1, characterized in that, The method of obtaining the risk level based on the number of network connections and the network success rate includes: If the number of network connections exceeds a first threshold and the network connection success rate exceeds a second threshold, then the risk level is obtained based on the number of network connections and the network connection success rate. If the number of network connections exceeds the first threshold and the network connection success rate does not exceed the second threshold, then the network connection request record and the data modification record of the Internet of Things corresponding to the requesting terminal are obtained. Based on the network request record and the data modification record, obtain the correction factor; The risk level is obtained based on the number of network connections, the network connection success rate, and the correction factor. If the number of network connections does not exceed the first threshold and the network connection success rate exceeds the second threshold, then the activity level of the requesting terminal is obtained. The risk level is obtained based on the number of network connections, the network connection success rate, and the activity level. If the number of network connections does not exceed the first quantity threshold and the network connection success rate does not exceed the second quantity threshold, then the risk level is obtained based on the number of network connections and the network connection success rate.

3. The IoT network security optimization method according to claim 2, characterized in that, The process of obtaining the correction factor based on the network request record and the data modification record includes: Based on the network request record, obtain the network request time; Based on the data correction record, obtain the data correction time; Determine whether the data correction time is included between two adjacent network request times; If the data correction time is included between two adjacent network request times, the correction quantity is obtained and the correction quantity is incremented by 1. The correction quantity is retrieved again, and a correction factor is obtained based on the retrieved correction quantity.

4. The IoT network security optimization method according to claim 1, characterized in that, If the historical access permissions meet the permission update criteria, then updating the historical access permissions and obtaining the current access permissions includes: Obtain the change history of the aforementioned historical access permissions; Based on the change records, obtain the duration of the last change; If the duration of the last change does not exceed a preset duration threshold, then determine whether a special approval instruction for adjusting access permissions has been detected. If detected, obtain the access scope and access duration corresponding to the special approval instruction; Based on the access scope and the access duration, obtain the current access permissions; If the duration of the last change exceeds a preset duration threshold, then the change status of the access permissions is obtained based on the change record; Determine whether the changes meet the permission update criteria; If the changes meet the permission update criteria, the historical access permissions are updated and the current access permissions are obtained.

5. The IoT network security optimization method according to claim 4, characterized in that, The determination of whether the change meets the permission update criteria includes: Based on the changes, obtain the overall rate of change, the unit rate of change, and the type of change of the access range corresponding to the requesting terminal; If the change type is an increase, then the change is determined to meet the permission update criteria. If the change type is fluctuation type, then determine whether the comprehensive change rate is greater than 0 and whether the unit change rate is less than the fluctuation threshold. If the overall rate of change is greater than 0 and the unit rate of change is less than the fluctuation threshold, then the change is determined to meet the permission update standard.

6. An Internet of Things (IoT) network security optimization system, used to execute the method according to any one of claims 1 to 5, characterized in that, include: If a network request is detected, the first acquisition module is used to acquire target information of the requesting terminal based on the network request. The second acquisition module is used to acquire the risk level of the requesting terminal based on the target information; The risk marking module, if the risk level exceeds a preset level threshold, is used to reject the network request, mark the requesting terminal for risk, and generate a risk label; The judgment module is used to determine whether the set of tags corresponding to the risk tags meets the preset tag requirements; The blacklist module is used to add the requesting terminal to the blacklist if the tag set meets the preset tag requirements. If the risk level does not exceed the preset level threshold, the third acquisition module is used to acquire the historical access permissions of the requesting terminal. The permission update module is used to update the historical access permissions and obtain the current access permissions if the historical access permissions meet the permission update criteria. A network connectivity module is used to allow the network connection request based on the current access permissions.

7. A smart terminal, comprising a memory and a processor, characterized in that, The memory is used to store computer programs that can run on the processor, and when the processor loads the computer program, it executes the method of any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is loaded by the processor, it executes the method of any one of claims 1 to 5.

Images