Detection method, device and equipment for security access of intelligent equipment, medium and product

Abstract

The invention relates to the technical field of Internet of Things, and provides an intelligent device security access detection method and device, equipment, a medium and a product, and the method comprises the steps: obtaining target feature data of a to-be-detected intelligent device; inputting the target feature vector into a global anomaly detection model to obtain a suspected anomaly point output by the global anomaly detection model; wherein the global anomaly detection model is used for dividing the target feature data into clustering points and noise points, and outputting the noise points as suspected anomaly points; inputting the suspected abnormal points into a local anomaly detection model to obtain target abnormal points which are output by the local anomaly detection model and represent existence of intrusion attack behaviors; wherein the local anomaly detection model is used for performing anomaly score evaluation on the suspected anomaly points and outputting the suspected anomaly points with the anomaly scores exceeding a preset anomaly threshold value as target anomaly points. According to the invention, the security detection capability of the Internet of Things equipment is improved, abnormal attack behaviors can be found in time and early warning is carried out, and the influence caused by intrusion behaviors is reduced.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to detection methods, apparatus, equipment, media, and products for secure access of smart devices. Background Technology

[0002] With the development of cloud-based e-commerce, a large number of devices are being connected to the Internet of Things (IoT), inevitably raising a series of security issues. The types of smart devices in these stores are diverse, including cash registers, cameras, speakers, smart voice assistants, and smoke detectors, all falling under the category of IoT smart devices. These devices connect to the network through various methods such as wired connections, wireless connections, cellular networks, and NB-IoT, relying on a central system service for backend authentication and using the network to complete functions such as data transmission, data interaction, remote authorization, and identification element extraction.

[0003] Typically, these smart devices use the same network as customers' public Wi-Fi, which undoubtedly creates numerous security vulnerabilities. This centralized service solution, relying on an open network architecture, allows hackers to use techniques such as electromagnetic attacks, vulnerability scanning, network eavesdropping, attacking service systems, and SQL injection to crack and forge access authentication, thereby infiltrating smart devices, stealing data, misappropriating resources, and disrupting services, ultimately affecting service security.

[0004] Due to performance and physical space limitations, IoT smart devices cannot perform complex calculations or retain data for long periods, making them relatively vulnerable to cybersecurity attacks. Furthermore, existing IoT devices lack robust access security detection capabilities, failing to promptly detect abnormal attacks. This means that once an intrusion occurs, it can have a significant impact on the IoT device and its system. Summary of the Invention

[0005] This invention provides a method, apparatus, device, medium, and product for detecting secure access to smart devices, in order to solve the technical problem in the prior art where IoT terminals cannot detect the security of access, which may cause significant impact once an intrusion occurs.

[0006] This invention provides a method for detecting secure access to smart devices, comprising: acquiring target feature data of the smart device to be detected; inputting the target feature vector into a global anomaly detection model to obtain suspected anomalies output by the global anomaly detection model; wherein the global anomaly detection model is used to divide the target feature data into cluster points and noise points, and output the noise points as suspected anomalies; inputting the suspected anomalies into a local anomaly detection model to obtain target anomalies indicating the presence of intrusion attack behavior output by the local anomaly detection model; wherein the local anomaly detection model is used to evaluate the anomaly score of the suspected anomalies, and output the suspected anomalies with an anomaly score exceeding a preset anomaly threshold as target anomalies.

[0007] According to the present invention, a method for detecting secure access to a smart device is provided, which acquires target feature data of the smart device to be detected, including: acquiring basic data of the smart device to be detected; extracting features from the basic data to obtain at least two single-dimensional feature data; wherein the single-dimensional feature data includes at least two of network traffic features, device behavior features, and device attribute features; performing normalization feature processing and merging feature processing on the at least two single-dimensional feature data to obtain multi-dimensional fused features, and using the multi-dimensional fused features as target feature data.

[0008] According to the present invention, a method for detecting secure access to smart devices includes network traffic characteristics including at least one of traffic rate, traffic change, packet length statistics, and protocol distribution; device behavior characteristics including at least one of successful login count, failed login attempt count, login time, and communication frequency; and device attribute characteristics including at least one of device model, operating system version, and device connection information.

[0009] According to the detection method for secure access of smart devices provided by the present invention, the global anomaly detection model is the DBSCAN model, and the local anomaly detection model is the LOF model.

[0010] According to the present invention, a method for detecting secure access to smart devices divides target feature data into cluster points and noise points, including: determining the neighborhood radius and the minimum number of neighborhood points; determining the dataset based on the target feature vector, wherein the dataset includes multiple seed points; determining the clustering status of each seed point based on the neighborhood radius and the minimum number of neighborhood points, and dividing each seed point into a cluster point or a noise point based on the clustering status.

[0011] According to the present invention, a method for detecting secure access to intelligent devices includes evaluating anomaly scores for suspected anomalies, comprising: determining the LOF value of each suspected anomaly based on the LOF algorithm, and using the LOF value as the anomaly score of each suspected anomaly; comparing the anomaly score of each suspected anomaly with a preset anomaly threshold; wherein the preset anomaly threshold is determined based on the average LOF value and the standard deviation of the LOF value.

[0012] This invention also provides a detection device for secure access to smart devices, comprising: a target feature data module for acquiring target feature data of the smart device to be detected; a global anomaly detection model module for inputting the target feature vector into the global anomaly detection model to obtain suspected anomaly points output by the global anomaly detection model; wherein the global anomaly detection model is used to divide the target feature data into cluster points and noise points, and output the noise points as suspected anomaly points; and a local anomaly detection model for inputting the suspected anomaly points into the local anomaly detection model to obtain target anomaly points indicating the presence of intrusion attack behavior output by the local anomaly detection model; wherein the local anomaly detection model is used to evaluate the anomaly score of the suspected anomaly points, and output the suspected anomaly points with an anomaly score exceeding a preset anomaly threshold as target anomaly points.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement a detection method for secure access to a smart device as described above.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the detection method for secure access to smart devices as described above.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements a detection method for secure access to a smart device as described above.

[0016] This invention provides a method, apparatus, device, medium, and product for detecting secure access to smart devices. The method includes: acquiring target feature data of the smart device to be detected; inputting the target feature vector into a global anomaly detection model to obtain suspected anomalies output by the global anomaly detection model; wherein the global anomaly detection model is used to divide the target feature data into cluster points and noise points, and outputs the noise points as suspected anomalies; inputting the suspected anomalies into a local anomaly detection model to obtain target anomalies indicating the presence of intrusion attack behavior output by the local anomaly detection model; wherein the local anomaly detection model is used to evaluate the anomaly score of the suspected anomalies, and outputs the suspected anomalies with anomaly scores exceeding a preset anomaly threshold as target anomalies. Through this method, this invention, using a dual detection mechanism with two models, can cover different types of anomalies from global to local levels, improve the security detection capability of IoT devices, promptly detect and warn of abnormal attack behavior, and reduce the impact of intrusion behavior. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the detection method for secure access to smart devices provided in an embodiment of the present invention.

[0019] Figure 2 This is a flowchart illustrating the implementation of the detection method for secure access to smart devices provided in this embodiment of the invention.

[0020] Figure 3 This is a schematic diagram illustrating the process of clustering and anomaly detection of target feature data using the DBSCAN model in this embodiment of the invention.

[0021] Figure 4 This is a schematic diagram of the process for calculating anomaly scores using the LOF model in an embodiment of the present invention.

[0022] Figure 5 This is a schematic diagram of the structure of the detection device for secure access to smart devices provided in an embodiment of the present invention.

[0023] Figure 6 This is a schematic diagram of the physical structure of the electronic device provided in an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0025] Some methods for secure access or intrusion detection are also presented in related technologies. For example, some methods verify device fingerprints, performing identity verification on IoT devices whose fingerprints have been verified when an access request message arrives. However, this method has limitations; it can only detect unauthorized device intrusions and cannot detect attacks such as denial-of-service attacks, device intrusions, and malicious worm propagation.

[0026] Some methods rely on the target IoT network's data traffic status to determine if the data traffic is normal. However, this method is too simplistic and struggles to accurately identify intrusion activity. Furthermore, most of these methods use a single machine learning algorithm, which can lead to an increase in false positives and false negatives.

[0027] Based on this, the present invention provides a method for detecting secure access to smart devices. This method assesses the security of access devices from both holistic and local perspectives, comprehensively evaluating the behavior and potential security threats of the access devices. It establishes an anomaly detection model through a collaborative judgment strategy using both global and local methods. Furthermore, some embodiments utilize multi-dimensional data features. Through multi-dimensional feature extraction and a dual detection mechanism, the accuracy of data anomaly detection can be improved, the false positive rate reduced, and a more comprehensive and accurate anomaly detection capability provided.

[0028] Please see Figure 1 , Figure 1 This is a flowchart illustrating the method for detecting secure access to smart devices provided in an embodiment of the present invention. In this embodiment, the method for detecting secure access to smart devices includes steps S110 to S130, each step of which is detailed below: S110: Acquire target feature data of the smart device to be tested.

[0029] S120: Input the target feature vector into the global anomaly detection model to obtain the suspected anomaly points output by the global anomaly detection model; wherein the global anomaly detection model is used to divide the target feature data into cluster points and noise points, and output the noise points as suspected anomaly points.

[0030] S130: Input the suspected anomaly point into the local anomaly detection model to obtain the target anomaly point that represents the existence of intrusion attack behavior, as output by the local anomaly detection model; wherein the local anomaly detection model is used to evaluate the anomaly score of the suspected anomaly point and output the suspected anomaly point with the anomaly score exceeding the preset anomaly threshold as the target anomaly point.

[0031] In this embodiment, the method for detecting secure access to smart devices can be applied to various types of shops and other scenarios. This method employs a two-level anomaly detection mechanism, combining global and local anomaly detection to evaluate the secure access of smart devices from different granularities and perspectives. This enables a more comprehensive and accurate identification of intrusion attack behaviors, improving the accuracy and reliability of the detection.

[0032] Specifically, the smart device to be tested is one that is already connected to the network and requires an access security assessment. Target feature data is used to reflect the behavioral patterns and status of the smart device. For example, the device's network connection characteristics (such as connection frequency, connection time, connected IP address, etc.) and the device's operational behavior characteristics (such as the type of operation command, the time interval between operations, etc.) can all be used as target feature data.

[0033] It should be noted that the target feature data needs to be representative and discriminative so that the subsequent model can effectively identify anomalies based on these features.

[0034] Alternatively, target feature data can be obtained through data collection, for example, data can be obtained from multiple data sources such as the smart device itself and network monitoring equipment.

[0035] In addition, the collected data is preprocessed, such as data cleaning (removing noisy data, handling missing values, etc.) and data normalization (unifying the processing of feature data from different ranges), in order to improve the quality and usability of the data.

[0036] The main function of a global anomaly detection model is to divide target feature data into clusters and noise points. Clustering is a technique that groups similar data points together; clusters represent sets of data with similar characteristics, signifying normal behavioral patterns. Noise points, on the other hand, are data points that are dissimilar to the majority of data points and may represent abnormal behavior. In this way, the model can quickly filter out potentially anomaly points, or suspected anomalies, from a large amount of data.

[0037] The global anomaly detection model can run quickly on large-scale datasets. It uses clustering algorithms to initially divide the data, significantly reducing the amount of data required for subsequent processing. It effectively filters out most normal data, focusing attention on a few potentially anomalous data points, thus improving detection efficiency.

[0038] The local anomaly detection model further evaluates the suspected anomalies output by the global anomaly detection model. It measures the degree of anomaly relative to its surrounding data points by calculating an anomaly score for each suspected anomaly. The anomaly score can be calculated using various methods, such as density-based methods and distance-based methods. For example, a density-based method calculates the local density around a data point; if the density around that point is significantly lower than in other areas, the point is considered to have a high anomaly score.

[0039] By setting a preset anomaly threshold, the local anomaly detection model can identify suspected anomalies with anomaly scores exceeding the threshold as target anomalies, i.e., points exhibiting intrusion attack behavior. This method can more accurately identify intrusion attacks and reduce the false positive rate. This is because some suspected anomalies selected in global anomaly detection may be misjudged, while the local anomaly detection model, through a more detailed evaluation of these points, can further distinguish between genuine anomalies and normal fluctuations.

[0040] The present invention provides a detection method for secure access of smart devices. Through a dual detection mechanism of two models, it can cover different types of anomalies from global to local, improve the security detection capability of IoT devices, promptly detect and warn of abnormal attack behaviors, and reduce the impact of intrusion.

[0041] In some embodiments, the step of acquiring target feature data of the smart device to be detected may specifically include: Acquire basic data of the smart device to be tested; extract features from the basic data to obtain at least two single-dimensional feature data; wherein the single-dimensional feature data includes at least two of network traffic features, device behavior features, and device attribute features; perform normalization feature processing and merging feature processing on the at least two single-dimensional feature data to obtain multi-dimensional fused features, and use the multi-dimensional fused features as target feature data.

[0042] In this embodiment, multi-dimensional fused features can be used as target feature data. Multi-dimensional fused features are obtained by normalizing and merging multiple single-dimensional feature data.

[0043] Among them, single-dimensional feature data can include network traffic features, device behavior features, and device attribute features.

[0044] Furthermore, network traffic characteristics may include at least one of traffic rate, traffic variation, packet length statistics, and protocol distribution; device behavior characteristics may include at least one of successful login attempts, failed login attempts, login time, and communication frequency; device attribute characteristics may include at least one of device model, operating system version, and device connection information.

[0045] Please see Figure 2 , Figure 2 This is a flowchart illustrating the implementation of the detection method for secure access to smart devices provided in this embodiment of the invention.

[0046] In this embodiment, feature data is extracted from three dimensions: network traffic, device behavior, and device attribute characteristics, providing comprehensive information for the security detection of smart device access. These will be described in detail below.

[0047] Network traffic characteristics are an important part of the security detection of IoT devices. The following sub-features can be extracted by analyzing the communication patterns and data transmission of the devices.

[0048] Flow rate: The amount of data a device sends and receives per unit of time. Defined as follows: ; ; Where Sr is the data transmission rate per unit time, and Rr is the data reception rate per unit time. Let i be the data volume (in bytes) at time point i, t be a certain time period, and I be the number of time points.

[0049] Traffic variation: By calculating the variance of the current access traffic compared to the average access traffic over a historical window, it's possible to reflect whether the network traffic for that access is abnormal. This method can help detect sudden increases or decreases in traffic, thereby identifying potential abnormal behavior. The definition is as follows: Define a historical window T, and the access traffic within the time window T is... Current access traffic is The goal is to calculate the variance between the current access traffic and the historical window average access traffic.

[0050] Historical window evaluation access traffic for: .

[0051] Variance of current access and historical window average access traffic for: .

[0052] Packet length statistics: The average length of data packets. Defined as follows: .

[0053] in Let j be the length of data packet j, and m be the number of data packets. This represents the average length of the data packet.

[0054] Protocol distribution: The distribution of communication protocol types used by the device, such as TCP, UDP, HTTP, etc. Defined as follows: .

[0055] Where E is the total number of all captured packets, The total number of data packets for a given protocol. It represents the percentage of protocol data packets.

[0056] The behavioral characteristics of a device reflect its operating mode and communication behavior, and are mainly expressed by the following sub-characteristics.

[0057] Login behavior includes the number of successful login attempts, the number of failed login attempts, and the login time. The number of successful and failed login attempts within a certain time period can help identify normal usage patterns and abnormal behavior. The definitions are as follows: ; ; in, Indicates the number of times a user has successfully logged in. This represents the number of failed login attempts, where A represents the total number of login attempts within that time period. This indicates whether the k-th login attempt was successful.

[0058] User login time can help identify normal usage time and abnormal access time. Common features extracted from login time include its distribution and duration. This is illustrated below: Define a time period T', within which the user's login time is... .

[0059] .

[0060] in This represents the number of login attempts. Further statistical characteristics can be calculated, such as the variance of login time. The definition is as follows: ; Where A is the total number of logins. Let i be the time of the i-th login. This represents the average login time.

[0061] Communication frequency: The frequency at which a device communicates with other devices or servers. Communication frequency reflects how frequently a device communicates with other devices or servers per unit of time. The definition is as follows: ; Where T1 is the length of the time window, and N1 is the number of communications within the time window T1.

[0062] Device attributes, such as device model, operating system version, and connectivity information, can also serve as important features for security detection. Device model, operating system version, and connectivity information form part of a device fingerprint, which can be used to uniquely identify the device. By analyzing device fingerprints, device authentication and authorization can be performed more accurately, preventing device impersonation and cloning attacks. Sub-feature parameters include the following: Device model: that is, the hardware model of the device.

[0063] Operating system version: This refers to the version of the operating system that the device is running.

[0064] Device connection information: This refers to the network information the device is connected to, such as IP address and MAC address. IP and MAC addresses reflect the uniqueness of IoT device hardware within a local area network; frequent changes can render the behavior of the accessing entity untrustworthy.

[0065] Specifically, device attribute characteristics are One-Hot encoded, including device model and operating system version.

[0066] One-Hot Encoding: Device model (device_model) and operating system version (os_version) can be encoded using One-Hot encoding, converting categorical features into multiple binary features. Taking device model classification (device_A, device_B, device_C) as an example, the feature vector expression is: device_A: [1,0,0]; device_B: [0,1,0]; device_C: [0,0,1].

[0067] The operating system versions are os_v1 and os_v2 as examples. The feature vector expression is: os_v1: [1,0]; os_v2: [0,1].

[0068] Convert each octet of the IP address to an integer, and convert each hexadecimal character of the MAC address to an integer.

[0069] Using an IPv4 address: IP Address=abcd.

[0070] Conversion formula: .

[0071] MAC address translation: H1::H2::H3::H4::H5::H6.

[0072] The conversion formula is: Where f(Hi) represents the conversion from hexadecimal to binary.

[0073] In the above embodiment, features are extracted from three major dimensions: network traffic, device behavior, and device attribute characteristics, and from a total of 12 minor dimensions: traffic rate, traffic changes, packet length statistics, protocol distribution, number of successful login attempts, number of failed login attempts, login time, communication frequency, device model, operating system version, IP address, and MAC address.

[0074] Since different features have different dimensions and orders of magnitude, the influence between different dimensions can be eliminated by normalizing other features, except for device attribute features, through One-Hot encoding.

[0075] For example, the Z-score normalization method can be used to normalize the numerical characteristics of traffic rate, traffic variation, packet length statistics, protocol distribution, number of successful login attempts, number of failed login attempts, login time, communication frequency, IP address, and MAC address. Specifically: ; Where x is the original data, The mean, 1 represents the standard deviation. Normalized data.

[0076] Furthermore, the normalized feature vector needs to be merged with the One-Hot encoded classification feature vector to form the final feature vector (i.e., the target feature data mentioned above): The correspondence between the feature vectors is as follows: Indicates flow rate; Indicates changes in flow rate; This indicates packet length statistics; Indicates protocol distribution; Indicates the number of successful logins; Indicates the number of failed login attempts; Indicates login time; Indicates the communication frequency; Indicates the IP address; Indicates the MAC address; Indicates the device model's One-Hot code; This indicates the operating system's One-Hot encoding.

[0077] In summary, this embodiment of the invention combines three major dimensions and twelve minor dimensions—network traffic, device behavior characteristics, and device attribute characteristics—to extract feature data and comprehensively evaluate the secure access behavior of intelligent access devices. This can improve the coverage of different attack methods and the accuracy of detection results.

[0078] In some embodiments, the global anomaly detection model is the DBSCAN model, and the local anomaly detection model is the LOF model.

[0079] The DBSCAN model employs the DBSCAN (Density-Based Spatial Clustering of Applications with Noise) algorithm, a density-based clustering algorithm that effectively handles noisy datasets and identifies clusters of various shapes. It improves clustering accuracy by marking low-density points as noise points (i.e., outliers). Furthermore, the DBSCAN model can effectively handle large-scale datasets. In this embodiment, the DBSCAN model is used for global anomaly detection, capturing points with densities different from their neighborhoods as outliers.

[0080] The LOF model employs the LOF (Local Outlier Factor) algorithm, a method for detecting local outliers. It determines whether a data point is an outlier by calculating the local outlier factor for each data point. The local outlier factor measures the degree of local density deviation of a data point relative to other data points in its neighborhood.

[0081] This invention proposes combining DBSCAN and LOF models for anomaly detection. DBSCAN is used for global anomaly detection to identify potential anomalies (noise points). The LOF algorithm is then used to calculate an anomaly score for each point in the noisy anomaly dataset, providing a quantified anomaly severity index for each potential anomaly point, thus offering more comprehensive and accurate anomaly detection capabilities.

[0082] In some embodiments, the step of dividing the target feature data into cluster points and noise points may specifically include: Determine the neighborhood radius and minimum number of neighborhood points; determine the dataset based on the target feature vector, which includes multiple seed points; determine the clustering of each seed point based on the neighborhood radius and minimum number of neighborhood points, and classify each seed point into a cluster point or a noise point based on the clustering.

[0083] Please see Figure 3 , Figure 3This is a schematic diagram illustrating the process of clustering and anomaly detection of target feature data using the DBSCAN model in this embodiment of the invention. Specifically, it includes the following steps: 1. Initialization parameters: Neighborhood radius needs to be set. Find the minimum number of neighboring points, MinPts, and create an empty cluster set. For In this embodiment, the K-distance graph method is used for selection. Specifically, the distance from each point in the dataset to its k-th nearest neighbor is calculated, and a distribution map of these distances is plotted. The "elbow" point on the curve is then identified; the distance corresponding to this point is the k-th nearest neighbor. The minimum number of neighboring points, MinPts, ranges from 2 to 4 times the data dimension.

[0084] 2. Select a seed point: Randomly select an unvisited point in the dataset as the seed point.

[0085] 3. Calculate the neighborhood of the visit point: Calculate the seed point If the number of points in the neighborhood is greater than or equal to MinPts, then the seed point is marked as the core point.

[0086] 4. Expanding the Cluster: If the seed point is a core point, create a new cluster and add the seed point and its neighboring points to the cluster. Recursively visit each point in the neighborhood; if they are also core points, continue expanding the cluster until no more points can be added.

[0087] 5. Repeated traversal: Select the next unvisited point from the dataset as the new seed point, and repeat the above steps until all points have been visited.

[0088] 6. Mark unclustered points as noise: Points in the dataset that are not included in any cluster are marked as noise points.

[0089] In the above embodiment, the DBSCAN clustering detection algorithm is used to divide the data points of the target feature data into clusters and noise points, with the noise points being potential anomalies.

[0090] In some embodiments, the step of evaluating anomaly scores for suspected outliers may specifically include: The LOF value of each suspected outlier is determined according to the LOF algorithm, and the LOF value is used as the outlier score of each suspected outlier. The outlier score of each suspected outlier is compared with a preset outlier threshold, which is determined based on the average LOF value and the standard deviation of the LOF value.

[0091] In this embodiment, global anomaly detection is performed using the DBSCAN model to obtain potential anomaly points (noise points). Then, the LOF algorithm is used to calculate the degree of anomaly. The noise points are sorted according to the LOF value. If the LOF value is greater than the preset anomaly threshold, it is considered a real anomaly point, which means that there is an intrusion attack.

[0092] Please see Figure 4 , Figure 4 This is a schematic diagram illustrating the process of calculating anomaly scores using the LOF model in an embodiment of the present invention. Specifically, it includes the following steps: 1. Define the neighborhood: For each point p in the set of noise points detected globally by the DBSCAN model, define a neighborhood. It consists of the k points closest to p, where k is a parameter of the LOF algorithm, and a small value is usually chosen to reflect the local density.

[0093] 2. Calculate the reachable distance: For point p and its neighborhood point q, the reachable distance is... Defined as: .

[0094] in It is the distance between points p and q. It is the distance from point q to its k-th nearest neighbor. If point q is not a core point, then... Defined as its neighborhood radius .

[0095] 3. Calculate the locally reachable density: Locally reachable density Let p be the reciprocal of the average reachable distance of all points within the neighborhood of point p. .

[0096] 4. Calculate the LOF value: Calculate the LOF value of point p, which is the ratio of the local reachability density of all points in the neighborhood of point p to the average local reachability density of point p itself. .

[0097] 5. Obtain anomaly score: The LOF value can be used as anomaly score. The higher the LOF value, the more anomalous point p is relative to its neighborhood points.

[0098] 6. Determine whether the preset abnormal threshold is exceeded: In this embodiment, the preset abnormal threshold can be further determined based on the method of average value and standard deviation.

[0099] Specifically, set 2 represents the sample mean of the LOF values. 2 represents the sample standard deviation of the LOF values, and the preset outlier threshold. The formula is: .

[0100] Here, r is a constant, taking the value of 2 or 3, which can be adjusted according to the actual situation. When r=2, this threshold can basically cover 95% of the LOF values ​​in the dataset, that is, only about 5% of the data points will have LOF values ​​exceeding this threshold, and these points are considered outliers.

[0101] This invention proposes a method for calculating thresholds based on average value and standard deviation. By combining threshold judgment, the sensitivity of anomaly detection can be flexibly adjusted to adapt to different security requirements and tolerance for false alarm rates.

[0102] Therefore, when noise points not exceeding a preset anomaly threshold are detected, it is determined that there is no abnormal attack behavior; when noise points exceeding the preset anomaly threshold are detected, it is determined that there is abnormal attack behavior. Feedback is then sent to the business system for timely anomaly handling and user notification to minimize the impact of intrusion.

[0103] The present invention extracts feature data from three major dimensions (network traffic, device behavior, and device attributes) and twelve sub-dimensions (device attributes). It combines a DBSCAN and LOF combined model. The DBSCAN model performs preliminary clustering for global anomaly detection, identifying noise points (suspected anomalies). The LOF model then uses local density and neighborhood density to detect these suspected anomalies and evaluates their corresponding LOF values ​​(LOF scores). If an LOF value exceeds a preset anomaly threshold, an abnormal attack is considered to have occurred. This combination of DBSCAN and LOF anomaly detection methods fully leverages their respective advantages. Through multi-dimensional feature extraction and a dual detection mechanism, it provides an efficient, accurate, and adaptive security detection solution for smart devices such as those used in IoT applications in retail stores.

[0104] Based on the above description of the embodiments, the advantages of the embodiments of the present invention are as follows: 1. Multi-dimensional feature analysis: This embodiment of the invention integrates features from three aspects: network traffic, device behavior, and device attributes, which can more comprehensively reflect the state and behavior of the system, thereby improving the accuracy and reliability of anomaly detection.

[0105] 2. Combination of Local and Global Anomaly Detection: The DBSCAN model can identify global anomaly patterns, i.e., isolated or low-density points in the dataset, while the LOF model can meticulously detect local anomalies, i.e., points with significantly lower density than their neighbors within a local region. This combination in the embodiments of the present invention can cover different types of anomalies from global to local, improving the comprehensiveness of detection.

[0106] 3. Adaptive Anomaly Detection: The DBSCAN model can adaptively identify clusters in a dataset without pre-setting the number of clusters, making it well-suited for handling dynamically changing IoT environments. The LOF model, on the other hand, can quantify the degree of anomaly at each point, providing an adaptive anomaly scoring mechanism.

[0107] 4. Anomaly Scoring and Threshold Judgment: The anomaly score calculated using LOF provides a quantifiable indicator of the degree of anomaly for each potential anomaly. Combined with preset anomaly threshold judgment, the sensitivity of anomaly detection can be flexibly adjusted to adapt to different security requirements and tolerances for false alarm rates. Furthermore, by monitoring and analyzing changes in system behavior over time, the preset anomaly threshold for the anomaly score can be dynamically adjusted, which helps adapt to environmental changes and maintain the stability of detection performance.

[0108] 5. Adaptable to complex data structures: It can handle high-dimensional data and complex data structures, such as multi-dimensional network traffic data and device attribute data, which is a huge advantage for the diversity and complexity of IoT devices.

[0109] 6. Early warning of abnormal behavior: It can quickly detect abnormal patterns, which helps to discover potential network attacks or equipment failures in a timely manner, and buys valuable time for corrective measures.

[0110] The intelligent device secure access detection method of the present invention, combined with the anomaly detection methods of DBSCAN and LOF, fully utilizes the advantages of each. Through multi-dimensional feature extraction and dual detection mechanism, it significantly improves the intelligence level and security protection capability of the system. It can not only accurately detect intrusion behavior and ensure the system's security and reliability, but also promptly notify the user to handle the situation when intrusion behavior is detected, thereby reducing the impact of intrusion behavior.

[0111] The present invention also provides a detection device for secure access to smart devices. The detection device for secure access to smart devices provided by the present invention will be described below. The detection device for secure access to smart devices described below and the detection method for secure access to smart devices described above can be referred to in correspondence.

[0112] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a detection device for secure access to smart devices provided in an embodiment of the present invention. In this embodiment, the detection device for secure access to smart devices may include a target feature data module 510, a global anomaly detection model module 520, and a local anomaly detection model 530.

[0113] The target feature data module 510 is used to acquire the target feature data of the smart device to be detected.

[0114] The global anomaly detection model module 520 is used to input the target feature vector into the global anomaly detection model to obtain the suspected anomaly points output by the global anomaly detection model; wherein the global anomaly detection model is used to divide the target feature data into cluster points and noise points, and output the noise points as suspected anomaly points.

[0115] The local anomaly detection model 530 is used to input suspected anomalies into the local anomaly detection model and obtain the target anomalies that represent intrusion attack behavior as output by the local anomaly detection model; wherein the local anomaly detection model is used to evaluate the anomaly score of suspected anomalies and output the suspected anomalies with anomaly scores exceeding the preset anomaly threshold as target anomalies.

[0116] In some embodiments, the target feature data module 510 can be specifically used for: Acquire basic data of the smart device to be tested; extract features from the basic data to obtain at least two single-dimensional feature data; wherein the single-dimensional feature data includes at least two of network traffic features, device behavior features, and device attribute features; perform normalization feature processing and merging feature processing on the at least two single-dimensional feature data to obtain multi-dimensional fused features, and use the multi-dimensional fused features as target feature data.

[0117] In some embodiments, network traffic characteristics include at least one of traffic rate, traffic variation, packet length statistics, and protocol distribution; device behavior characteristics include at least one of successful login attempts, failed login attempts, login time, and communication frequency; and device attribute characteristics include at least one of device model, operating system version, and device connection information.

[0118] In some embodiments, the global anomaly detection model is the DBSCAN model, and the local anomaly detection model is the LOF model.

[0119] In some embodiments, the global anomaly detection model module 520 can be specifically used for: Determine the neighborhood radius and minimum number of neighborhood points; determine the dataset based on the target feature vector, which includes multiple seed points; determine the clustering of each seed point based on the neighborhood radius and minimum number of neighborhood points, and classify each seed point into a cluster point or a noise point based on the clustering.

[0120] In some embodiments, the local anomaly detection model 530 can be specifically used to: determine the LOF value of each suspected anomaly point according to the LOF algorithm, and use the LOF value as the anomaly score of each suspected anomaly point; compare the anomaly score of each suspected anomaly point with a preset anomaly threshold; wherein the preset anomaly threshold is determined based on the average value of the LOF value and the standard deviation of the LOF value.

[0121] On the other hand, embodiments of the present invention also provide an electronic device, please refer to... Figure 6 , Figure 6 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of the present invention, such as... Figure 6 As shown, the electronic device may include a memory 620, a processor 610, and a computer program stored in the memory 620 and executable on the processor 610. When the processor 610 executes the program, it can implement a method for detecting secure access to a smart device, which may include: The process involves: acquiring target feature data of the smart device to be detected; inputting the target feature vector into a global anomaly detection model to obtain suspected anomalies output by the global anomaly detection model; wherein the global anomaly detection model is used to divide the target feature data into cluster points and noise points, and output the noise points as suspected anomalies; inputting the suspected anomalies into a local anomaly detection model to obtain target anomalies indicating intrusion attack behavior output by the local anomaly detection model; wherein the local anomaly detection model is used to evaluate the anomaly score of the suspected anomalies, and output the suspected anomalies with anomaly scores exceeding a preset anomaly threshold as target anomalies.

[0122] Optionally, the electronic device may further include a communication bus 630 and a communication interface 640, wherein the processor 610, the communication interface 640, and the memory 620 communicate with each other through the communication bus 630. The processor 610 can call the computer program in the memory 620 to execute the detection method for secure access to intelligent devices provided by the above methods.

[0123] Furthermore, the logical instructions in the aforementioned memory 620 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0124] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the detection method for secure access to smart devices provided by the above methods. The steps and principles of the method have been described in detail in the above methods and will not be repeated here.

[0125] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the detection method for secure access to smart devices provided by the above methods. The steps and principles of the method have been described in detail in the above methods and will not be repeated here.

[0126] Non-transitory computer-readable storage media can be any available medium or data storage device that can be accessed by a processor, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MOs), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs)).

[0127] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0128] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting secure access to intelligent devices, characterized in that, include: Acquire target feature data of the smart device to be tested; The target feature vector is input into a global anomaly detection model to obtain suspected anomaly points output by the global anomaly detection model; wherein the global anomaly detection model is used to divide the target feature data into cluster points and noise points, and output the noise points as the suspected anomaly points; The suspected anomaly points are input into the local anomaly detection model to obtain the target anomaly points that indicate the presence of intrusion attack behavior, as output by the local anomaly detection model; wherein the local anomaly detection model is used to evaluate the anomaly score of the suspected anomaly points, and output the suspected anomaly points whose anomaly scores exceed a preset anomaly threshold as the target anomaly points.

2. The detection method for secure access to intelligent devices according to claim 1, characterized in that, The acquisition of target feature data of the smart device to be detected includes: Obtain the basic data of the smart device to be tested; Feature extraction is performed on the basic data to obtain at least two single-dimensional feature data; wherein the single-dimensional feature data includes at least two of network traffic features, device behavior features, and device attribute features. Normalization and merging feature processing are performed on the at least two single-dimensional feature data to obtain multi-dimensional fused features, and the multi-dimensional fused features are used as the target feature data.

3. The detection method for secure access to intelligent devices according to claim 2, characterized in that, The network traffic characteristics include at least one of traffic rate, traffic variation, packet length statistics, and protocol distribution; The device behavior characteristics include at least one of the following: number of successful login attempts, number of failed login attempts, login time, and communication frequency. The device attribute features include at least one of the following: device model, operating system version, and device connection information.

4. The detection method for secure access of intelligent devices according to any one of claims 1 to 3, characterized in that, The global anomaly detection model is the DBSCAN model, and the local anomaly detection model is the LOF model.

5. The detection method for secure access of intelligent devices according to claim 4, characterized in that, The step of dividing the target feature data into cluster points and noise points includes: Determine the neighborhood radius and the minimum number of neighborhood points; A dataset is determined based on the target feature vector, and the dataset includes multiple seed points; The clustering of each seed point is determined based on the neighborhood radius and the minimum number of neighborhood points, and each seed point is divided into a cluster point or a noise point based on the clustering.

6. The detection method for secure access to intelligent devices according to claim 4, characterized in that, The evaluation of anomaly scores for the suspected anomalies includes: The LOF value of each suspected outlier is determined according to the LOF algorithm, and the LOF value is used as the outlier score of each suspected outlier. The abnormal score of each suspected abnormal point is compared with the preset abnormal threshold; wherein the preset abnormal threshold is determined based on the average LOF value and the standard deviation of the LOF value.

7. A detection device for secure access of intelligent devices, characterized in that, include: The target feature data module is used to acquire the target feature data of the smart device to be detected. A global anomaly detection model module is used to input the target feature vector into a global anomaly detection model to obtain suspected anomaly points output by the global anomaly detection model; wherein the global anomaly detection model is used to divide the target feature data into cluster points and noise points, and output the noise points as the suspected anomaly points; A local anomaly detection model is used to input the suspected anomaly points into the local anomaly detection model to obtain the target anomaly points that indicate the presence of intrusion attack behavior output by the local anomaly detection model; wherein the local anomaly detection model is used to evaluate the anomaly score of the suspected anomaly points, and output the suspected anomaly points with an anomaly score exceeding a preset anomaly threshold as the target anomaly points.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the detection method for secure access to a smart device as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the detection method for secure access to smart devices as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the detection method for secure access to smart devices as described in any one of claims 1 to 6.

Images