Intelligent internet of things camera security evaluation method and device based on multi-layer threat surface analysis, equipment and storage medium

Abstract

The application discloses an intelligent Internet of Things camera security evaluation method and device based on multi-layer threat surface analysis, equipment and a storage medium, relates to the technical field of network security, and comprises the following steps: a topology graph of system architecture and data flow is constructed by identifying device nodes, data paths and communication protocols; based on the topology graph, exposure indexes of the physical layer, the network layer, the application layer, the data layer and the identity authentication layer are identified layer by layer, an exposure index list is generated, a plurality of attack paths are obtained, qualitative or semi-quantitative analysis is performed on each attack path, an influence evaluation report is obtained, the whole device is quantitatively evaluated, and a score is obtained; the score is mapped to a preset maturity level and a severity level, and a security reinforcement suggestion is generated. The problems that the traditional method only focuses on a single vulnerability and cannot evaluate cascade risks are solved, and an evaluation method capable of dynamically sensing a deployment environment, associating a multi-vulnerability attack chain and accurately reflecting actual security risks of an Internet of Things camera is realized.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method, apparatus, device, and storage medium for security assessment of smart IoT cameras based on multi-layer threat surface analysis. Background Technology

[0002] With the widespread adoption of IoT devices, smart cameras have become an important component in areas such as industrial equipment condition monitoring, community security management, and smart city construction. However, their widespread deployment has also brought serious security challenges. Existing security research largely focuses on traditional network security measures, such as firewalls, intrusion detection systems, and encrypted communications. These methods often emphasize perimeter defense and lack systematic analysis and dynamic assessment of vulnerabilities at various levels within the device.

[0003] Existing research largely relies on static vulnerability databases and traditional CVSS (Common Vulnerability Scoring System) scores, focusing on isolated vulnerability points and lacking systematic correlation analysis. It fails to fully consider the unique environmental factors of IoT devices (such as deployment scenarios and data sensitivity) and the linkage effect of multiple vulnerability attack chains.

[0004] Therefore, how to develop an assessment method that can dynamically sense the deployment environment, link multiple vulnerability attack chains, and accurately reflect the actual security risks of IoT cameras is an urgent problem to be solved.

[0005] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The main objective of this application is to provide a method, apparatus, device, and storage medium for security assessment of smart IoT cameras based on multi-layer threat surface analysis, aiming to solve the technical problems corresponding to the background technology.

[0007] To achieve the above objectives, this application proposes a security assessment method for smart IoT cameras based on multi-layer threat surface analysis. The method includes:

[0008] Identify device nodes, data paths, and communication protocols;

[0009] Based on the device nodes, the data paths, and the communication protocols, a system architecture and data flow topology diagram are constructed.

[0010] Based on the aforementioned topology, exposure indicators are identified layer by layer at the physical layer, network layer, application layer, data layer, and identity authentication layer, generating a list of exposure indicators.

[0011] Based on the exposure index list, multiple attack paths are generated, and qualitative or semi-quantitative analysis is performed on each attack path to obtain an impact assessment report.

[0012] Based on the aforementioned impact assessment report, a quantitative assessment of the equipment as a whole is conducted to obtain a quantitative score;

[0013] The quantitative scores are mapped to preset maturity and severity levels to generate security hardening recommendations.

[0014] In one embodiment, the identification of device nodes, data paths, and communication protocols includes:

[0015] The device nodes are obtained by identifying IoT devices in the network based on active scanning and device fingerprinting strategies.

[0016] Data flow paths are plotted based on traffic analysis strategies to obtain data pathways;

[0017] The device's security configuration status is obtained based on the configuration review strategy, and the communication protocol is derived.

[0018] In one embodiment, the step of identifying exposure indicators of the physical layer, network layer, application layer, data layer, and authentication layer layer layer by layer based on the topology map, and generating an exposure indicator list, includes:

[0019] Based on the topology diagram, the physical layer firmware extractability, debug interface exposure, and shell disassembly difficulty are checked to obtain the physical layer exposure points.

[0020] Based on the topology diagram, the communication encryption status, open port status, encryption algorithm strength, and public network exposure risk of the network layer are analyzed to obtain network layer exposure points.

[0021] Based on the topology diagram, injection vulnerabilities, unauthorized access vulnerabilities, cross-site scripting vulnerabilities, and firmware update mechanism security issues at the application layer are detected to obtain application layer exposure points.

[0022] Based on the topology diagram, the encryption status of the data transmission process, the encryption status of the data storage process, and the risk of data residue are evaluated to obtain the data layer exposure points.

[0023] Based on the topology diagram, the default credential usage, multi-factor authentication support, and authentication token security of the identity authentication layer are examined to identify the exposure points of the identity authentication layer.

[0024] Based on the physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points, a list of exposure indicators is obtained.

[0025] In one embodiment, based on the exposure indicator list, multiple attack paths are generated, and qualitative or semi-quantitative analysis is performed on each attack path to obtain an impact assessment report, including:

[0026] Obtain the attack tree constructed based on historical attack data;

[0027] The physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points in the exposure indicator list are used as the leaf nodes of the attack tree;

[0028] Based on the threat modeling strategy, the leaf nodes are combined to obtain multiple attack paths;

[0029] A qualitative or semi-quantitative analysis is performed on each of the aforementioned attack paths to obtain an impact assessment report. The qualitative or semi-quantitative analysis includes success rate assessment, technical threshold assessment, and potential impact assessment.

[0030] In one embodiment, the step of quantitatively evaluating the equipment as a whole based on the impact assessment report to obtain a quantitative score includes:

[0031] Get the threat elements and total number of layers;

[0032] Based on the impact assessment report and the threat elements, confirm the threat element values;

[0033] Based on the total number of layers and the threat element values, the threat surface area is calculated;

[0034] Based on the impact assessment report, the numerical values ​​of security control measures for the threat element in the attack path are obtained;

[0035] A threat score is obtained based on the threat element values ​​and the security control measure values;

[0036] A quantitative score is obtained based on the threat surface area and the threat score.

[0037] In one embodiment, before performing a quantitative assessment of the equipment as a whole based on the impact assessment report to obtain a quantitative score, the method further includes:

[0038] Based on the impact assessment report, the vulnerability was confirmed, and the data sensitivity, deployment environment, attack ease, and potential impact scope of the vulnerability were obtained.

[0039] The IoT environmental factors are derived based on the data sensitivity, the deployment environment, the ease of attack implementation, and the potential scope of impact.

[0040] A time-series score is obtained based on the code maturity, remediation status, and report credibility of the aforementioned vulnerabilities;

[0041] Based on the impact of the aforementioned vulnerabilities on the confidentiality, integrity, and availability of the information system, standard confidentiality-integrity-availability impact values ​​are obtained.

[0042] Based on the impact values ​​of the standard confidentiality, integrity, and availability, the time-series score, and the IoT environmental factors, a dynamic risk rating for vulnerabilities is obtained.

[0043] In one embodiment, mapping the quantitative score to a preset maturity level and severity level to generate security hardening recommendations includes:

[0044] The quantitative score is compared with a predefined score interval threshold to obtain the comparison result;

[0045] Based on the comparison results, the quantitative score is mapped to a preset level mapping table to obtain the target severity level and the target maturity level. The level mapping table defines the maturity level and severity level corresponding to different score ranges.

[0046] Based on the target severity level and target maturity level, security hardening recommendations are generated.

[0047] Furthermore, to achieve the above objectives, this application also proposes a security assessment device for intelligent IoT cameras based on multi-layer threat surface analysis, wherein the intelligent IoT camera security assessment device based on multi-layer threat surface analysis includes:

[0048] The identification module is used to identify device nodes, data paths, and communication protocols.

[0049] The construction module is used to construct the system architecture and data flow topology based on the device nodes, the data paths, and the communication protocols;

[0050] The detection module is used to identify exposure indicators of the physical layer, network layer, application layer, data layer and identity authentication layer layer by layer based on the topology map, and generate a list of exposure indicators.

[0051] The assessment module is used to generate multiple attack paths based on the exposure indicator list, and to perform qualitative or semi-quantitative analysis on each attack path to obtain an impact assessment report.

[0052] The quantification module is used to perform a quantitative assessment of the entire device based on the impact assessment report, the threat surface area formula, and the threat scoring formula, and obtain a quantitative score.

[0053] The output module is used to map the quantitative score to preset maturity and severity levels to generate security hardening recommendations.

[0054] Furthermore, to achieve the above objectives, this application also proposes a security assessment device for intelligent IoT cameras based on multi-layer threat surface analysis. The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. The computer program is configured to implement the steps of the security assessment method for intelligent IoT cameras based on multi-layer threat surface analysis as described above.

[0055] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the smart IoT camera security assessment method based on multi-layer threat surface analysis as described above.

[0056] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the smart IoT camera security assessment method based on multi-layer threat surface analysis as described above.

[0057] One or more technical solutions proposed in this application have at least the following technical effects:

[0058] This method identifies device nodes, data paths, and communication protocols; constructs a system architecture and data flow topology based on these elements; identifies exposure indicators at the physical, network, application, data, and authentication layers, generating an exposure indicator list; generates multiple attack paths based on this list and performs qualitative or semi-quantitative analysis on each path to obtain an impact assessment report; quantifies the overall device based on the impact assessment report to obtain a quantitative score; and maps the quantitative score to preset maturity and severity levels to generate security hardening recommendations. This approach addresses the limitations of traditional methods that focus only on single vulnerabilities and cannot assess cascading risks. It provides an assessment method that dynamically perceives the deployment environment, correlates multiple vulnerability attack chains, and accurately reflects the actual security risks of IoT cameras. Furthermore, by generating specific security hardening recommendations, it avoids the shortcomings of traditional solutions that only provide generalized suggestions and cannot track protection effectiveness. Attached Figure Description

[0059] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0060] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a flowchart illustrating an embodiment of the security assessment method for smart IoT cameras based on multi-layer threat surface analysis provided in this application.

[0062] Figure 2 This is a schematic diagram of the threat surface of an intelligent IoT camera provided in Embodiment 1 of the intelligent IoT camera security assessment method based on multi-layer threat surface analysis of this application;

[0063] Figure 3 This is a simplified flowchart of Embodiment 1 of the Smart IoT Camera Security Assessment Method Based on Multi-layer Threat Surface Analysis of this application;

[0064] Figure 4 This is a schematic diagram of the module structure of the smart IoT camera security assessment device based on multi-layer threat surface analysis according to an embodiment of this application;

[0065] Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the smart IoT camera security assessment method based on multi-layer threat surface analysis in the embodiments of this application.

[0066] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0067] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0068] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0069] The main solution of this application embodiment is as follows: Identify device nodes, data paths, and communication protocols; construct a system architecture and data flow topology based on device nodes, data paths, and communication protocols; based on the topology, identify exposure indicators of the physical layer, network layer, application layer, data layer, and authentication layer layer layer by layer, and generate an exposure indicator list; based on the exposure indicator list, generate multiple attack paths and perform qualitative or semi-quantitative analysis on each attack path to obtain an impact assessment report; based on the impact assessment report, quantitatively assess the overall device to obtain a quantitative score; map the quantitative score to preset maturity and severity levels to generate security hardening recommendations.

[0070] Because existing technologies rely heavily on static vulnerability databases and traditional CVSS scoring, they focus on isolated vulnerability points and lack systematic correlation analysis. They fail to fully consider the unique environmental factors of IoT devices (such as deployment scenarios and data sensitivity) and the linkage effect of multiple vulnerability attack chains.

[0071] This application provides a solution that addresses the problem of traditional methods focusing only on single vulnerabilities and failing to assess cascading risks. It achieves an assessment method that can dynamically perceive the deployment environment, correlate multiple vulnerability attack chains, and accurately reflect the actual security risks of IoT cameras. Furthermore, by generating specific security hardening recommendations, it avoids the shortcomings of traditional solutions that only provide generalized suggestions and cannot track the protection effect.

[0072] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device capable of performing the above functions. The following description uses a computer as an example to illustrate this embodiment and the subsequent embodiments.

[0073] Based on this, embodiments of this application provide a security assessment method for smart IoT cameras based on multi-layer threat surface analysis, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the smart IoT camera security assessment method based on multi-layer threat surface analysis according to this application.

[0074] In this embodiment, the smart IoT camera security assessment method based on multi-layer threat surface analysis includes steps S10~S60:

[0075] Step S10: Identify device nodes, data paths, and communication protocols;

[0076] It should be noted that device nodes refer to various physical device units that constitute the IoT ecosystem, including smart cameras themselves, home routers, gateway devices, connected mobile phones or PC terminals, cloud service platforms, and third-party API services; data paths refer to the paths through which data is transmitted between device nodes, including video stream transmission paths (such as camera → cloud → user), control command paths (such as user → cloud → camera), and inter-device communication paths (such as camera and smart speaker linkage); communication protocols refer to the specific communication rules and standards used on each path, such as HTTP / HTTPS and specific port numbers.

[0077] Understandably, since IoT camera systems involve the interaction of multiple devices, multiple protocols, and complex data streams, traditional security assessment methods are unable to fully depict their digital ecosystem. Therefore, performing step S10 can avoid assessment blind spots caused by unclear system structure, thereby improving the comprehensiveness and accuracy of security analysis.

[0078] In one feasible implementation, step S10 may include: identifying IoT devices in the network based on an active scanning strategy and a device fingerprinting strategy to obtain device nodes; drawing data flow paths based on a traffic analysis strategy to obtain data paths; and obtaining the device security configuration status based on a configuration review strategy to obtain communication protocols.

[0079] It should be noted that the proactive scanning strategy refers to actively discovering online devices in the network by sending probe packets; the device fingerprinting strategy refers to identifying the device model, manufacturer, and firmware version by analyzing device response characteristics (such as specific port behavior); the traffic analysis strategy refers to reconstructing the source address, destination address, protocol type, and transmission path of data packets by capturing and parsing network traffic; the data flow path refers to the complete network path that data takes from the source device to the destination device; the configuration review strategy refers to obtaining security configuration information such as the device's communication protocol, open ports, and encryption methods by accessing the device management interface or parsing configuration files; and the device security configuration status refers to the set of security-related parameters such as the communication protocol type, port status, and encryption algorithm strength currently used by the device.

[0080] In this embodiment, the systematic device discovery, traffic tracing, and configuration auditing solve the problem that traditional methods cannot fully construct the digital ecosystem topology of IoT cameras, providing accurate structured input for subsequent layered threat analysis.

[0081] The above is only one feasible implementation of step S10 provided in this embodiment. This embodiment does not specifically limit the specific implementation of step S10.

[0082] Step S20: Based on the device nodes, the data paths, and the communication protocols, construct a system architecture and data flow topology diagram;

[0083] It should be noted that the system architecture and data flow topology diagram is a visual digital model that intuitively displays the connection relationships, data flow, communication protocols, and security boundaries of all device nodes in the IoT camera ecosystem through elements such as nodes, connections, and domain boundaries. This topology diagram not only reflects the static structure of the system but also identifies potential attack paths and security vulnerabilities.

[0084] For example, such as Figure 2 , Figure 2This diagram illustrates the threat surface of smart cameras under a Man-in-the-Middle (MITM) attack. The diagram clearly labels entities such as "user device," "smart camera," "router / gateway," and "cloud service platform," corresponding to device nodes. Arrows clearly indicate data flow, i.e., data paths; solid lines represent secure data paths, demonstrating normal communication relationships between device nodes, while dashed lines represent potential threats and attack paths. The diagram also labels the protocols used: HTTPS (Hypertext Transfer Protocol Secure), MQTT (Message Queuing Telemetry Transport), RTSP (Real-Time Streaming Protocol), and TLS (Transport Layer Security). Furthermore, by dividing the network into three major security boundaries—user domain (e.g., mobile app), local network domain (e.g., camera, router), and cloud domain (e.g., cloud service platform)—different network areas and security boundaries are clearly identified, providing a structural foundation for subsequent exposure point identification (e.g., port exposure, communication encryption).

[0085] Figure 2 The solid line represents two data paths: the first is the encrypted video stream and control stream, and the second is the inter-device communication.

[0086] Video Stream: Smart Camera → Cloud Service Platform. The smart camera connects to the wireless router and reports the collected video stream data using HTTPS and MQTT protocols. The cloud service platform then sends API requests to third-party services to store and process the data.

[0087] Control flow: User → Cloud service platform → Camera. Users obtain data retrieval requests from the cloud service platform via a mobile APP or web client, and then send control commands to the smart camera via a wireless router.

[0088] Inter-device communication: Router → Other IoT devices, demonstrating secure communication between smart devices within a local network using a wireless router.

[0089] Understandably, since IoT camera systems involve multi-domain interactions, heterogeneous protocols, and complex data flows, traditional textual descriptions are insufficient to intuitively present the overall system picture and attack exposure. Therefore, performing step S20 can avoid blind spots and misjudgments caused by structural opacity, thereby improving the visualization of threat identification and the efficiency of systematic analysis.

[0090] Step S30: Based on the topology diagram, identify the exposure indicators of the physical layer, network layer, application layer, data layer and identity authentication layer layer by layer, and generate a list of exposure indicators;

[0091] It's important to note that these are the five key security layers of an IoT camera system. The physical layer focuses on the physical security of the device and its hardware interfaces; the network layer focuses on data transmission and network communication security; the application layer focuses on vulnerabilities in software applications and services; the data layer focuses on the security status of data throughout its lifecycle; and the identity authentication layer focuses on access control and authentication mechanisms. The exposure index list is a structured list of security weaknesses, systematically recording the security exposures found in each layer and their detailed descriptions, clearly listing the location, type, and description of each discovery (e.g., "Network layer: Port 443 uses a self-signed certificate").

[0092] Understandably, due to the complex architecture of IoT camera systems with multiple layers and components, traditional single-dimensional security scanning cannot fully cover the security risks at all levels. Therefore, performing step S30 can avoid security blind spots caused by the lack of assessment dimensions, thereby improving the depth and systematic nature of security assessment.

[0093] In one feasible implementation, step S30 may include: based on the topology diagram, checking the physical layer's firmware extractability, debug interface exposure, and shell disassembly difficulty to obtain physical layer exposure points; based on the topology diagram, analyzing the network layer's communication encryption status, open port status, encryption algorithm strength, and public network exposure risk to obtain network layer exposure points; based on the topology diagram, detecting application layer injection vulnerabilities, unauthorized access vulnerabilities, cross-site scripting vulnerabilities, and firmware update mechanism security to obtain application layer exposure points; based on the topology diagram, evaluating the encryption status of the data transmission process, the encryption status of the data storage process, and data residue risk to obtain data layer exposure points; based on the topology diagram, checking the default credential usage, multi-factor authentication support, and authentication token security of the identity authentication layer to obtain identity authentication layer exposure points; and based on the physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points, obtaining a list of exposure indicators.

[0094] It should be noted that firmware extractability refers to the ease with which the device firmware can be extracted and analyzed through physical or logical means, whether it is stored without encryption; debug interface exposure refers to whether the device exposes hardware debug interfaces such as UART and JTAG without access control; and enclosure disassembly difficulty refers to whether the physical protection of the device enclosure is sufficient to prevent unauthorized disassembly. Physical layer exposure points refer to weak points in physical security.

[0095] Communication encryption status refers to whether data transmission uses an encryption protocol and whether the encryption configuration is correct; open port status refers to the number, type, and service information of network ports opened by the device; encryption algorithm strength refers to whether the encryption algorithm used is secure; public network exposure risk refers to whether the device or service has been incorrectly exposed to the public network. Network layer exposure points refer to vulnerabilities in network communication security.

[0096] Injection vulnerabilities refer to the existence of code execution vulnerabilities such as SQL (Structured Query Language) injection and command injection at the application layer; unauthorized access vulnerabilities refer to the existence of vulnerabilities that allow unauthorized access to other users' data or functions; cross-site scripting vulnerabilities refer to the existence of XSS (Cross-Site Scripting) vulnerabilities in the web interface; firmware update mechanism security refers to whether signature verification and encryption are performed during the firmware update process. Application layer exposure points refer to security flaws at the application layer.

[0097] The encryption status of data transmission refers to whether video streams, control commands, etc., are encrypted throughout the transmission process; the encryption status of data storage refers to whether data stored on the device's SD card or in the cloud is encrypted and protected; data residue risk refers to whether data can still be recovered after deletion. Data layer exposure points refer to security risks throughout the data lifecycle.

[0098] Default credential usage refers to whether the device uses the factory default or weak password; multi-factor authentication support refers to whether it supports authentication methods other than passwords (such as SMS verification codes, biometrics); authentication token security refers to whether the session token is easily predictable or intercepted. Exposure points in the identity authentication layer refer to security issues in the identity verification mechanism.

[0099] In this embodiment, a systematic layered auditing method is used to solve the problem that traditional security assessments only focus on a single layer (such as network port scanning) and ignore the associated risks at other levels, thereby achieving comprehensive and multi-dimensional identification of the security exposure surfaces of IoT cameras.

[0100] The above is only one feasible implementation of step S30 provided in this embodiment. This embodiment does not specifically limit the specific implementation of step S30.

[0101] Step S40: Based on the exposure index list, generate multiple attack paths and perform qualitative or semi-quantitative analysis on each attack path to obtain an impact assessment report;

[0102] It should be noted that an attack path refers to an ordered combination of a series of exposure points (vulnerabilities or weaknesses) that an attacker may exploit to achieve a specific attack goal (such as data theft or device control); qualitative or semi-quantitative analysis refers to evaluating the attributes of an attack path using non-numerical (such as high, medium, and low) or near-numerical (such as scoring range) methods; and an impact assessment report is an analytical document that details the feasibility, technical threshold, and potential consequences of each attack path.

[0103] For example, an attack path can be described as follows: "The attacker first logs into the device management interface using a weak password (identity authentication layer exposure point), then uses an API unauthorized access vulnerability (application layer exposure point) to obtain other users' video stream lists, and finally steals video data through an unencrypted transmission channel (data layer exposure point)." The semi-quantitative analysis conclusions of this path can be: success rate (high), technical threshold (low), and potential impact (serious).

[0104] Understandably, since viewing a single exposure point in isolation cannot truly reflect the cascading risks brought about by complex attack chains, performing step S40 can avoid the limitations of traditional assessment methods, thereby improving the accuracy of the overall threat severity assessment of the system.

[0105] In one feasible implementation, step S40 may include: obtaining an attack tree constructed based on historical attack data; using the physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points in the exposure index list as leaf nodes of the attack tree; combining each leaf node based on a threat modeling strategy to obtain multiple attack paths; performing qualitative or semi-quantitative analysis based on each attack path to obtain an impact assessment report, wherein the qualitative or semi-quantitative analysis includes success rate assessment, success rate evaluation, and potential impact assessment.

[0106] It should be noted that historical attack data refers to known attack methods and patterns collected from public vulnerability databases, security research reports, and internal threat intelligence; an attack tree is a formal model that represents the attack surface of a system in a tree structure, where the root node represents the attack target, and child nodes represent the sub-steps or conditions (i.e., exposure points) required to achieve the target. Threat modeling strategies are a systematic analytical method used to identify, assess, and respond to security threats. Success rate assessment refers to predicting the probability (e.g., high, medium, low) that an attacker will successfully achieve their goal using this path; technical threshold assessment refers to the technical capabilities and resource requirements required to carry out the attack; potential impact assessment refers to the severity of the consequences that will result from a successful attack (e.g., data breaches, service interruptions, privacy violations).

[0107] like Figure 2The dashed line in the diagram represents a typical, escalating man-in-the-middle attack chain. The potential attacker initiates a scan of the internet, discovers router vulnerabilities, and gains initial access to the camera. Using the compromised camera as a springboard, the attacker may exploit application-layer vulnerabilities in the camera's firmware or services to inject malicious commands, attempting to access and control other vulnerable devices within the network, achieving unauthorized external connections. Finally, the attacker implants itself into the communication link between the camera and the user's app or cloud service through ARP spoofing, DNS hijacking, or deploying a proxy within the network. Because the video stream is not encrypted or has insufficient encryption strength during transmission (a data layer exposure point), the attacker successfully achieves man-in-the-middle eavesdropping, enabling real-time interception, theft, and even tampering of the video data stream, and redirecting it to a server under their control.

[0108] For example, a combination of "using default credentials" (exposure point A) and "unauthorized access to cloud API interface" (exposure point B) can construct an attack path: "The attacker logs into the camera backend by brute-forcing the default password → exploits the API interface vulnerability to obtain video stream access permissions for other users."

[0109] In this implementation, isolated exposure points are linked into complete attack scenarios through attack trees and threat modeling. This solves the problem that traditional methods cannot effectively assess the cascading effects and real risks caused by the combined exploitation of multiple vulnerabilities, and enables the identification and quantification of systemic threats.

[0110] The above is only one feasible implementation of step S40 provided in this embodiment. This embodiment does not specifically limit the specific implementation of step S40.

[0111] Step S50: Based on the impact assessment report, a quantitative assessment of the equipment as a whole is performed to obtain a quantitative score;

[0112] It should be noted that quantitative assessment refers to the process of converting the impact of security threats into numerical results using mathematical formulas and models; quantitative scoring refers to the numerical security risk indicators obtained through calculation, which are used to objectively measure the overall security status of equipment.

[0113] For example, the quantitative score may include a threat surface area value of 4.5 and a threat score value of 2.8.

[0114] Understandably, since purely qualitative analysis is difficult to accurately guide repair priorities and resource allocation, step S50 can avoid the subjectivity and ambiguity of security decisions, thereby improving the accuracy and efficiency of risk management.

[0115] In one feasible implementation, step S50 may include: obtaining threat elements and the total number of layers; confirming threat element values ​​based on the impact assessment report and the threat elements; calculating the threat surface area based on the total number of layers and the threat element values; obtaining the security control measures values ​​for the threat elements in the attack path based on the impact assessment report; obtaining a threat score based on the threat element values ​​and the security control measures values; and obtaining a quantitative score based on the threat surface area and the threat score.

[0116] It should be noted that the threat elements include 15 categories of security threats, as shown in Table 1.

[0117] Table 1

[0118]

[0119] It should also be noted that the total number of layers refers to the total number of security layers for exposure indicator identification, which defaults to 5 layers (physical layer, network layer, application layer, data layer, and authentication layer). The Threat Element Value (TE) is the calculated value of each threat element after adjustments for existence, severity, and environmental weights. Existence is 0 / 1; if an exposure point is detected at a certain layer, the corresponding TE value is 1, otherwise it is 0. Severity is based on the CVSS standard score, and the severity value refers to the base CVSS score of the threat element in a specific attack path, ranging from 0 to 10. Environmental weights are determined based on the influencing factors of the device's environment, i.e., the IoT environmental factors mentioned below. The formula for calculating the Threat Element Value (TE) is:

[0120]

[0121] Threat surface area (TSA) is a macroscopic indicator that measures the overall exposure level of an equipment. The formula for calculating threat surface area is:

[0122]

[0123] Here, 'a' is the starting layer (usually layer 1, i.e., the physical layer or perception layer); 'b' is the ending layer (such as the application layer, cloud service layer, etc.). 'a' and 'b' define the range of layers in the IoT device architecture to be evaluated, for example, from the physical layer (a=1) to the application layer (b=5), with each layer contributing a threat element value.

[0124] The security control measure numerical value refers to the maturity level corresponding to the threat element obtained from the impact assessment report, converted into a decimal value, and reflects the effectiveness of existing protective measures. The threat score is an indicator that measures the degree of immediate risk. The formula for calculating the threat score is:

[0125]

[0126] Here, 'a' is the starting layer (usually layer 1, i.e., the physical layer or perception layer); 'b' is the ending layer (such as the application layer, cloud service layer, etc.). 'a' and 'b' define the range of layers in the IoT device architecture to be evaluated, for example, from the physical layer (a=1) to the application layer (b=5), with each layer contributing a threat element value.

[0127] In this embodiment, multi-dimensional security data is aggregated into intuitive quantitative indicators through formulaic calculations, which solves the problem that traditional assessment methods cannot provide objective and comparable risk measurements, and achieves an accurate profile of the security status.

[0128] In one feasible implementation, before step S50, the process may further include: confirming the vulnerability based on the impact assessment report, and obtaining the vulnerability's data sensitivity, deployment environment, attack ease of implementation, and potential impact scope; obtaining an IoT environment factor based on the data sensitivity, deployment environment, attack ease of implementation, and potential impact scope; obtaining a time-series score based on the vulnerability's code maturity, patching status, and report credibility; obtaining a standard confidentiality-integrity-availability impact value based on the vulnerability's impact on the confidentiality, integrity, and availability of the information system; and obtaining a dynamic risk rating for the vulnerability based on the standard confidentiality-integrity-availability impact value, the time-series score, and the IoT environment factor.

[0129] It should be noted that data sensitivity refers to the sensitivity of the data involved in the vulnerability (e.g., low sensitivity in public areas, high sensitivity in bedrooms); deployment environment refers to the physical and network environment of the device (e.g., behind a firewall or directly exposed to the public network); attack implementation ease refers to the technical difficulty of exploiting the vulnerability (e.g., whether there is publicly available exploit code); potential impact scope refers to the chain reaction that may be caused after the vulnerability is exploited (e.g., affecting only a single device or attacking an internal network); the IoT environment factor (IoT_Factor) is an adjustment coefficient calculated by combining the four dimensions and used to correct the standard score; code maturity refers to the availability and reliability of the exploit code; remediation status refers to whether the vulnerability has an official patch; report credibility refers to the credibility of the vulnerability source; time-series score is a dynamic adjustment of the CVSS basic score by combining code maturity, remediation status, and report credibility; the standard confidentiality-integrity-availability impact value (CIA value) is a benchmark value for measuring the impact of the vulnerability on the confidentiality, integrity, and availability of the information system; the dynamic risk rating of the vulnerability is the final risk score adjusted by the IoT environment factor and time-series score, which better reflects the actual risk.

[0130] The core calculation formula for dynamic vulnerability risk rating (environment score) is as follows:

[0131]

[0132] Among them, the CVSS time-series score is based on the maturity of the exploit code, the status of the fix, and the credibility of the report;

[0133] C, I, A stands for Confidentiality, Integrity, and Availability, which are the standard CIA three-dimensional impact values;

[0134] C_Weight, I_Weight, and A_Weight are custom weighting coefficients. Given the extreme importance of the confidentiality of camera data, C_Weight (e.g., 0.8) > I_Weight (e.g., 0.6) > A_Weight (e.g., 0.4) is usually set.

[0135] IoT_Factor represents the IoT environmental factor, an aggregated indicator typically ranging from 0.5 to 2.0. It is calculated from four key dimensions using a weighted average or multiplicative model: Data_Sensitivity (data sensitivity), Deployment_Context (deployment environment), Attack_Feasibility (attack feasibility), and Impact_Scope (potential impact scope). w1, w2, w3, and w4 are the weights of each dimension and can be adjusted based on expert experience. The formula for calculating the IoT environmental factor is as follows:

[0136]

[0137] The data sensitivity, deployment environment, ease of attack implementation, and potential scope of impact of the cameras are shown in Table 2.

[0138] Table 2

[0139]

[0140] In this embodiment, by introducing IoT environmental factors and time-series factors to dynamically correct the standard vulnerability score, the problem that the general vulnerability scoring system (CVSS) cannot reflect the real risks in specific scenarios is solved, and the context-awareness and accuracy of risk rating are realized.

[0141] The above are merely feasible implementations of step S50 provided in this embodiment. This embodiment does not specifically limit the specific implementation of step S50.

[0142] Step S60: Map the quantitative score to a preset maturity level and severity level to generate security hardening recommendations;

[0143] It should be noted that the quantitative score refers to numerical risk indicators such as threat surface area and threat score calculated through step S50. The maturity level is an inverse indicator (4.0 is the highest, and 0 is the lowest), used to measure the robustness of the system's overall security protection capabilities. A level of 4.0 indicates that the system's security protection is very mature and robust, effectively resisting threats, while a level of 0 indicates that the system's security protection is extremely immature and vulnerable, providing almost no effective protection. Therefore, the lower the maturity level, the worse the security situation. The severity level is a positive indicator used to directly describe the urgency of the risk vulnerability and guide the priority of handling; the security hardening recommendations are a list of specific and actionable security remediation measures generated based on the mapping results.

[0144] It is understandable that simple numerical scoring is difficult for security operations personnel to understand and implement directly. Therefore, step S60 can avoid the disconnect between risk assessment results and actual actions, thereby improving the accuracy and efficiency of security response.

[0145] In one feasible implementation, step S60 may include: comparing the quantitative score with a predefined score interval threshold to obtain a comparison result; mapping the quantitative score to a preset level mapping table based on the comparison result to obtain a target severity level and a target maturity level, wherein the level mapping table defines the maturity level and severity level corresponding to different score intervals; and generating security hardening recommendations based on the target severity level and target maturity level.

[0146] It should be noted that the quantitative score refers to the numerical risk indicators such as the threat surface area and threat score calculated through step S50. The score interval threshold is a predefined numerical boundary used to divide different risk levels. The comparison result refers to the judgment conclusion of which threshold interval the quantitative score falls into. The target severity level is a qualitative description of the risk severity determined based on the comparison result. The target maturity level is the system protection capability level determined based on the comparison result.

[0147] The level mapping table is shown in Table 3.

[0148] Table 3

[0149]

[0150] In this embodiment, by associating abstract numerical values ​​with intuitive level labels and generating concrete action guidelines accordingly, the problems of vague output results and poor operability of traditional assessment methods are solved, and a seamless closed loop from "risk perception" to "risk management" is achieved.

[0151] The above is only one feasible implementation of step S60 provided in this embodiment. This embodiment does not specifically limit the specific implementation of step S60.

[0152] This embodiment provides a security assessment method for smart IoT cameras based on multi-layer threat surface analysis. It identifies device nodes, data paths, and communication protocols; constructs a system architecture and data flow topology based on these elements; identifies exposure indicators at the physical layer, network layer, application layer, data layer, and authentication layer, generating an exposure indicator list; generates multiple attack paths based on the exposure indicator list and performs qualitative or semi-quantitative analysis on each path to obtain an impact assessment report; quantifies the overall device based on the impact assessment report to obtain a quantitative score; and maps the quantitative score to preset maturity and severity levels to generate security hardening recommendations. This method solves the problem of traditional methods focusing only on single vulnerabilities and failing to assess cascading risks. It achieves an assessment method that can dynamically perceive the deployment environment, correlate multiple vulnerability attack chains, and accurately reflect the actual security risks of IoT cameras. Furthermore, by generating specific security hardening recommendations, it avoids the shortcomings of traditional solutions that only provide generalized suggestions and cannot track protection effectiveness.

[0153] For example, to help understand the implementation process of the smart IoT camera security assessment method based on multi-layer threat surface analysis obtained by combining this embodiment with the above embodiment one, please refer to... Figure 3 , Figure 3 A simplified flowchart of a security assessment method for smart IoT cameras based on multi-layer threat surface analysis is provided, specifically:

[0154] The first step is ecosystem mapping. Through technologies such as active scanning, device fingerprinting, traffic analysis, and configuration review, device nodes, data paths, and communication protocols are identified, and a topology map of the system architecture and data flow (device node and data flow map) is output.

[0155] The second step is exposure indicator identification. Based on the topology map generated in the first step, the exposure indicators of the physical layer, network layer, application layer, data layer and identity authentication layer are identified layer by layer to find subtle security flaws and exposure points. A structured list of exposure indicators is output, which clearly lists the location, type and description of each discovery point.

[0156] The third step is threat vector identification, which combines the exposure points in the exposure indicator list to construct multiple specific attack paths (threat vectors). Then, the success rate, technical threshold and potential impact of each path are qualitatively or semi-quantitatively analyzed, and an impact assessment report is output.

[0157] The fourth step is threat assessment, which transforms the qualitative findings from the third step into quantifiable risk indicators, calculating the threat surface area (TSA) and threat score.

[0158] Finally, the calculated TSA and Threat Score scores are mapped to a predefined grading table to obtain easily understandable target maturity and severity assessment results. The system then determines whether the security status is acceptable. If acceptable, the assessment report is completed; otherwise, the assessment results are directly used to generate a precise and actionable list of security hardening recommendations.

[0159] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the smart IoT camera security assessment method based on multi-layer threat surface analysis. Any simple modifications based on this technical concept are within the protection scope of this application.

[0160] This application also provides a security assessment device for intelligent IoT cameras based on multi-layer threat surface analysis. Please refer to [link / reference]. Figure 4 The intelligent IoT camera security assessment device based on multi-layer threat surface analysis includes:

[0161] The identification module 10 is used to identify device nodes, data paths, and communication protocols;

[0162] The construction module 20 is used to construct a system architecture and data flow topology based on the device nodes, the data paths, and the communication protocols.

[0163] The detection module 30 is used to identify exposure indicators of the physical layer, network layer, application layer, data layer and identity authentication layer layer by layer based on the topology map, and generate a list of exposure indicators.

[0164] The assessment module 40 is used to generate multiple attack paths based on the exposure indicator list, and to perform qualitative or semi-quantitative analysis on each attack path to obtain an impact assessment report.

[0165] The quantification module 50 is used to perform a quantitative assessment of the entire device based on the impact assessment report, the threat surface area formula, and the threat scoring formula, and obtain a quantitative score.

[0166] The output module 60 is used to map the quantitative score to a preset maturity level and severity level to generate security hardening recommendations.

[0167] The smart IoT camera security assessment device based on multi-layer threat surface analysis provided in this application adopts the smart IoT camera security assessment method based on multi-layer threat surface analysis in the above embodiments, and can solve the technical problems of smart IoT camera security assessment based on multi-layer threat surface analysis. Compared with the prior art, the beneficial effects of the smart IoT camera security assessment device based on multi-layer threat surface analysis provided in this application are the same as the beneficial effects of the smart IoT camera security assessment method based on multi-layer threat surface analysis provided in the above embodiments, and other technical features in the smart IoT camera security assessment device based on multi-layer threat surface analysis are the same as the features disclosed in the methods of the above embodiments, and will not be repeated here.

[0168] The identification module 10 is also used to identify IoT devices in the network based on an active scanning strategy and a device fingerprinting strategy to obtain device nodes; draw data flow paths based on a traffic analysis strategy to obtain data paths; and obtain device security configuration status based on a configuration review strategy to obtain communication protocols.

[0169] The detection module 30 is further configured to, based on the topology diagram, check the physical layer's firmware extractability, debug interface exposure, and shell disassembly difficulty to obtain physical layer exposure points; based on the topology diagram, analyze the network layer's communication encryption status, open port status, encryption algorithm strength, and public network exposure risk to obtain network layer exposure points; based on the topology diagram, detect application layer injection vulnerabilities, unauthorized access vulnerabilities, cross-site scripting vulnerabilities, and firmware update mechanism security to obtain application layer exposure points; based on the topology diagram, evaluate the encryption status of the data transmission process, the encryption status of the data storage process, and the risk of data residue to obtain data layer exposure points; based on the topology diagram, check the default credential usage, multi-factor authentication support, and authentication token security of the identity authentication layer to obtain identity authentication layer exposure points; and based on the physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points, obtain a list of exposure indicators.

[0170] The evaluation module 40 is further configured to obtain an attack tree constructed based on historical attack data; use the physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points in the exposure indicator list as leaf nodes of the attack tree; combine the leaf nodes based on threat modeling strategies to obtain multiple attack paths; perform qualitative or semi-quantitative analysis based on each attack path to obtain an impact assessment report, wherein the qualitative or semi-quantitative analysis includes success rate assessment, technical threshold assessment, and potential impact assessment.

[0171] The quantization module 50 is further configured to: acquire threat elements and total number of layers; confirm threat element values ​​based on the impact assessment report and the threat elements; calculate the threat surface area based on the total number of layers and the threat element values; obtain the security control measures values ​​for the threat elements in the attack path based on the impact assessment report; obtain a threat score based on the threat element values ​​and the security control measures values; and obtain a quantification score based on the threat surface area and the threat score.

[0172] The quantification module 50 is further configured to confirm vulnerabilities based on the impact assessment report, and obtain the data sensitivity, deployment environment, attack ease, and potential impact scope of the vulnerabilities; obtain IoT environmental factors based on the data sensitivity, deployment environment, attack ease, and potential impact scope; obtain time-series scores based on the code maturity, remediation status, and report credibility of the vulnerabilities; obtain standard confidentiality-integrity-availability impact values ​​based on the impact of the vulnerabilities on the confidentiality, integrity, and availability of the information system; and obtain a dynamic risk rating for the vulnerabilities based on the standard confidentiality-integrity-availability impact values, the time-series scores, and the IoT environmental factors.

[0173] The output module 60 is further configured to compare the quantitative score with a predefined score interval threshold to obtain a comparison result; based on the comparison result, map the quantitative score to a preset level mapping table to obtain a target severity level and a target maturity level, wherein the level mapping table defines the maturity level and severity level corresponding to different score intervals; and generate security hardening recommendations based on the target severity level and target maturity level.

[0174] This application provides a security assessment device for smart IoT cameras based on multi-layer threat surface analysis. The smart IoT camera security assessment device based on multi-layer threat surface analysis includes: at least one processor; and a memory communicatively connected to at least one processor; wherein the memory stores instructions executable by at least one processor, and the instructions are executed by at least one processor to enable at least one processor to execute the smart IoT camera security assessment method based on multi-layer threat surface analysis in the above embodiment 1.

[0175] The following is for reference. Figure 5This document illustrates a structural schematic diagram of a smart IoT camera security assessment device suitable for implementing embodiments of this application based on multi-layer threat surface analysis. The smart IoT camera security assessment device based on multi-layer threat surface analysis in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The smart IoT camera security assessment device based on multi-layer threat surface analysis shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0176] like Figure 5 As shown, the smart IoT camera security assessment device based on multi-layer threat surface analysis may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into random access memory (RRAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the smart IoT camera security assessment device based on multi-layer threat surface analysis. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard drives, etc.; and communication devices 1009. Communication device 1009 allows the smart IoT camera security assessment device based on multi-layer threat surface analysis to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows a smart IoT camera security assessment device based on multi-layer threat surface analysis with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented alternatively.

[0177] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0178] The smart IoT camera security assessment device based on multi-layer threat surface analysis provided in this application adopts the smart IoT camera security assessment method based on multi-layer threat surface analysis in the above embodiments, and can solve the technical problems of smart IoT camera security assessment based on multi-layer threat surface analysis. Compared with the prior art, the beneficial effects of the smart IoT camera security assessment device based on multi-layer threat surface analysis provided in this application are the same as the beneficial effects of the smart IoT camera security assessment method based on multi-layer threat surface analysis provided in the above embodiments, and other technical features in the smart IoT camera security assessment device based on multi-layer threat surface analysis are the same as the features disclosed in the previous embodiment method, and will not be repeated here.

[0179] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0180] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0181] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the smart IoT camera security assessment method based on multi-layer threat surface analysis in the above embodiments.

[0182] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0183] The aforementioned computer-readable storage medium may be included in a smart IoT camera security assessment device based on multi-layer threat surface analysis; or it may exist independently and not assembled into a smart IoT camera security assessment device based on multi-layer threat surface analysis.

[0184] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a smart IoT camera security assessment device based on multi-layer threat surface analysis, the smart IoT camera security assessment device based on multi-layer threat surface analysis enables the following: identification of device nodes, data paths, and communication protocols; construction of a system architecture and data flow topology based on the device nodes, data paths, and communication protocols; identification of exposure indicators at the physical layer, network layer, application layer, data layer, and authentication layer based on the topology, generating an exposure indicator list; generation of multiple attack paths based on the exposure indicator list, and qualitative or semi-quantitative analysis of each attack path to obtain an impact assessment report; quantitative assessment of the device as a whole based on the impact assessment report to obtain a quantitative score; and mapping the quantitative score to a preset maturity level and severity level to generate security hardening recommendations.

[0185] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0186] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0187] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0188] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described security assessment method for smart IoT cameras based on multi-layer threat surface analysis, thereby solving the technical problem of security assessment for smart IoT cameras based on multi-layer threat surface analysis. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the security assessment method for smart IoT cameras based on multi-layer threat surface analysis provided in the above embodiments, and will not be repeated here.

[0189] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the smart IoT camera security assessment method based on multi-layer threat surface analysis as described above.

[0190] The computer program product provided in this application can solve the technical problem of security assessment of smart IoT cameras based on multi-layer threat surface analysis. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the smart IoT camera security assessment method based on multi-layer threat surface analysis provided in the above embodiments, and will not be repeated here.

[0191] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A security assessment method for smart IoT cameras based on multi-layer threat surface analysis, characterized in that, The method includes: Identify device nodes, data paths, and communication protocols; Based on the device nodes, the data paths, and the communication protocols, a system architecture and data flow topology diagram are constructed. Based on the aforementioned topology, exposure indicators are identified layer by layer at the physical layer, network layer, application layer, data layer, and identity authentication layer, generating a list of exposure indicators. Based on the exposure index list, multiple attack paths are generated, and qualitative or semi-quantitative analysis is performed on each attack path to obtain an impact assessment report. Based on the aforementioned impact assessment report, a quantitative assessment of the equipment as a whole is conducted to obtain a quantitative score; The quantitative scores are mapped to preset maturity and severity levels to generate security hardening recommendations; Based on the topology diagram, the exposure indicators of the physical layer, network layer, application layer, data layer, and identity authentication layer are identified layer by layer, and a list of exposure indicators is generated, including: Based on the topology diagram, the physical layer firmware extractability, debug interface exposure, and shell disassembly difficulty are checked to obtain the physical layer exposure points. Based on the topology diagram, the communication encryption status, open port status, encryption algorithm strength, and public network exposure risk of the network layer are analyzed to obtain network layer exposure points. Based on the topology diagram, injection vulnerabilities, unauthorized access vulnerabilities, cross-site scripting vulnerabilities, and firmware update mechanism security issues at the application layer are detected to obtain application layer exposure points. Based on the topology diagram, the encryption status of the data transmission process, the encryption status of the data storage process, and the risk of data residue are evaluated to obtain the data layer exposure points. Based on the topology diagram, the default credential usage, multi-factor authentication support, and authentication token security of the identity authentication layer are examined to identify the exposure points of the identity authentication layer. Based on the physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points, a list of exposure indicators is obtained.

2. The method as described in claim 1, characterized in that, The identification device node, data path, and communication protocol include: The device nodes are obtained by identifying IoT devices in the network based on active scanning and device fingerprinting strategies. Data flow paths are plotted based on traffic analysis strategies to obtain data pathways; The device's security configuration status is obtained based on the configuration review strategy, and the communication protocol is derived.

3. The method as described in claim 1, characterized in that, Based on the exposure indicator list, multiple attack paths are generated, and qualitative or semi-quantitative analysis is performed on each attack path to obtain an impact assessment report, including: Obtain the attack tree constructed based on historical attack data; The physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points in the exposure indicator list are used as the leaf nodes of the attack tree; Based on the threat modeling strategy, the leaf nodes are combined to obtain multiple attack paths; A qualitative or semi-quantitative analysis is performed on each of the aforementioned attack paths to obtain an impact assessment report. The qualitative or semi-quantitative analysis includes success rate assessment, technical threshold assessment, and potential impact assessment.

4. The method as described in claim 1, characterized in that, The quantitative assessment of the equipment as a whole based on the impact assessment report, to obtain a quantitative score, includes: Get the threat elements and total number of layers; Based on the impact assessment report and the threat elements, confirm the threat element values; Based on the total number of layers and the threat element values, the threat surface area is calculated; Based on the impact assessment report, the numerical values ​​of security control measures for the threat element in the attack path are obtained; A threat score is obtained based on the threat element values ​​and the security control measure values; A quantitative score is obtained based on the threat surface area and the threat score.

5. The method as described in claim 1, characterized in that, Before the quantitative assessment of the equipment as a whole based on the impact assessment report to obtain a quantitative score, the process also includes: Based on the impact assessment report, the vulnerability was confirmed, and the data sensitivity, deployment environment, attack ease, and potential impact scope of the vulnerability were obtained. The IoT environmental factors are derived based on the data sensitivity, the deployment environment, the ease of attack implementation, and the potential scope of impact. A time-series score is obtained based on the code maturity, remediation status, and report credibility of the aforementioned vulnerabilities; Based on the impact of the aforementioned vulnerabilities on the confidentiality, integrity, and availability of the information system, standard confidentiality-integrity-availability impact values ​​are obtained. Based on the impact values ​​of the standard confidentiality, integrity, and availability, the time-series score, and the IoT environmental factors, a dynamic risk rating for vulnerabilities is obtained.

6. The method as described in claim 1, characterized in that, The step of mapping the quantitative score to preset maturity and severity levels to generate security hardening recommendations includes: The quantitative score is compared with a predefined score interval threshold to obtain the comparison result; Based on the comparison results, the quantitative score is mapped to a preset level mapping table to obtain the target severity level and the target maturity level. The level mapping table defines the maturity level and severity level corresponding to different score ranges. Based on the target severity level and target maturity level, security hardening recommendations are generated.

7. A security assessment device for intelligent IoT cameras based on multi-layer threat surface analysis, characterized in that, The device includes: The identification module is used to identify device nodes, data paths, and communication protocols. The construction module is used to construct the system architecture and data flow topology based on the device nodes, the data paths, and the communication protocols; The detection module is used to identify exposure indicators of the physical layer, network layer, application layer, data layer and identity authentication layer layer by layer based on the topology map, and generate a list of exposure indicators. The assessment module is used to generate multiple attack paths based on the exposure indicator list, and to perform qualitative or semi-quantitative analysis on each attack path to obtain an impact assessment report. The quantification module is used to perform a quantitative assessment of the entire device based on the impact assessment report, the threat surface area formula, and the threat scoring formula, and obtain a quantitative score. The output module is used to map the quantitative score to a preset maturity level and severity level to generate security hardening recommendations; The detection module is used to: 1) check the physical layer's firmware extractability, debug interface exposure, and shell disassembly difficulty based on the topology diagram to obtain physical layer exposure points; 2) analyze the network layer's communication encryption status, open port status, encryption algorithm strength, and public network exposure risk based on the topology diagram to obtain network layer exposure points; 3) detect application layer injection vulnerabilities, unauthorized access vulnerabilities, cross-site scripting vulnerabilities, and firmware update mechanism security based on the topology diagram to obtain application layer exposure points; 4) evaluate the encryption status of data transmission and data storage processes and data residue risks based on the topology diagram to obtain data layer exposure points; 5) check the default credential usage, multi-factor authentication support, and authentication token security of the identity authentication layer to obtain identity authentication layer exposure points; and 6) generate a list of exposure indicators based on the physical layer exposure points, network layer exposure points, application layer exposure points, data layer exposure points, and identity authentication layer exposure points.

8. A security assessment device for intelligent IoT cameras based on multi-layer threat surface analysis, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the smart IoT camera security assessment method based on multi-layer threat surface analysis as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the smart IoT camera security assessment method based on multi-layer threat surface analysis as described in any one of claims 1 to 6.

Images