Iot gateway data processing method and related apparatus

Abstract

The embodiment of the application discloses a kind of Internet of Things gateway data processing method and related device, which can effectively improve the security protection capability of Internet of Things;First, the original data stream set uploaded by Internet of Things terminal equipment is extracted, the communication protocol feature set and the abnormal behavior feature set can be accurately refined, and the data behavior mode is provided to support in-depth insight;Second, based on the linkage analysis and processing of the preset attack identification classification model, the attack type determination result of the data message sequence can be accurately generated, so as to sharply capture various potential attacks;Finally, according to the determination result, the specific security protection strategy set is generated and fed back to the Internet of Things terminal equipment, which can effectively deal with security threats in time, ensure the stable and reliable operation of Internet of Things system, and significantly enhance the security and stability of Internet of Things environment.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to an IoT gateway data processing method and related apparatus. Background Technology

[0002] With the rapid development of IoT technology, IoT gateways, as key hubs connecting IoT terminal devices and upper-layer applications, bear the important responsibility of data aggregation, forwarding, and processing. IoT gateways enable data interaction between terminal devices using different protocols and of different types, allowing various devices to interconnect and greatly promoting the widespread application of IoT in numerous fields.

[0003] However, under the current technological context of IoT gateways, existing technologies have certain shortcomings. Most IoT gateways only perform simple transmission and storage of data uploaded by terminal devices, lacking the ability to deeply analyze and process the data. Faced with complex and ever-changing network attacks, they cannot accurately identify abnormal behaviors and potential attack types in the data, making it difficult to effectively ensure the security of IoT systems. The problem with existing technologies is that they fail to fully explore the value of data uploaded by IoT terminal devices, and cannot accurately determine attack types and generate effective security protection strategies through feature extraction and linkage analysis of raw data streams. Summary of the Invention

[0004] This invention provides an IoT gateway data processing method and related apparatus, which are used to accurately determine the attack type and generate an effective security protection strategy by extracting features from the raw data stream and performing linked analysis.

[0005] In a first aspect, embodiments of the present invention provide an IoT gateway data processing method, applied to an IoT gateway data processing device. The method includes: acquiring a set of raw data streams uploaded by an IoT terminal device through a target IoT gateway, the set of raw data streams including multiple data packet sequences, each data packet sequence consisting of at least one terminal device identifier and a corresponding communication protocol data unit; extracting features from the set of raw data streams to obtain a communication protocol feature set and an abnormal behavior feature set for each data packet sequence; performing a linked analysis on the communication protocol feature set and the abnormal behavior feature set based on a preset attack identification classification model to generate an attack type determination result for the data packet sequence; wherein the linked analysis includes vector concatenation and normalization processing performed through the feature fusion layer of the attack identification classification model, cross-attention mechanism processing performed through the joint analysis layer of the attack identification classification model, and fully connected mapping and Softmax processing performed through the multi-classification output layer of the attack identification classification model; generating a security protection strategy set based on the attack type determination result, and feeding the security protection strategy set back to the IoT terminal device.

[0006] In a second aspect, embodiments of the present invention provide an Internet of Things gateway data processing device, comprising: processor; Storage device, on which computer programs are stored, When the computer program is executed by the processor, the processor implements any of the IoT gateway data processing methods described above.

[0007] This invention provides a readable storage medium storing a program or instructions, which, when executed by a processor, implement the steps of the IoT gateway data processing method.

[0008] Therefore, the embodiments of the present invention can effectively improve the security protection capabilities of the Internet of Things (IoT). First, by extracting features from the raw data stream set uploaded by IoT terminal devices, the communication protocol feature set and abnormal behavior feature set can be accurately extracted, providing support for in-depth insight into data behavior patterns. Second, based on the linkage analysis and processing of the preset attack identification and classification model, the attack type determination result of the data packet sequence can be accurately generated, thereby keenly capturing various potential attacks. Finally, based on the determination result, a set of targeted security protection strategies is generated and fed back to the IoT terminal devices, which can respond to security threats in a timely and effective manner, ensure the stable and reliable operation of the IoT system, and significantly enhance the security and stability of the IoT environment. Attached Figure Description

[0009] Figure 1 This is a flowchart of an IoT gateway data processing method provided in an embodiment of the present invention.

[0010] Figure 2 This is a schematic diagram of the basic structure of an IoT gateway data processing device provided in an embodiment of the present invention. Detailed Implementation

[0011] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0012] See Figure 1 As shown, this figure is a flowchart of an IoT gateway data processing method provided by an embodiment of the present invention. This method can be applied to an IoT gateway data processing device. Figure 1 As shown, the method may include steps 110-140.

[0013] Step 110: Obtain the set of raw data streams uploaded by IoT terminal devices through the target IoT gateway. The set of raw data streams includes multiple data packet sequences, each of which consists of at least one terminal device identifier and a corresponding communication protocol data unit.

[0014] This invention uses a smart factory scenario as an example for illustration. This IoT environment contains multiple IoT terminal devices, such as various sensors and actuators. The target IoT gateway, as a key node for data aggregation, is responsible for receiving data uploaded from these devices. For example, there are multiple terminal devices such as device A and device B, each uploading data according to predefined communication rules. Device A is identified as ID-A, and device B is identified as ID-B. The raw data stream set uploaded by these devices contains multiple data packet sequences, each with a corresponding terminal device identifier and a communication protocol data unit. For example, in a data packet sequence, the terminal device identifier is ID-A, and the communication protocol data unit contains monitoring data such as temperature and pressure collected by device A, encapsulated and transmitted in a relevant protocol format, and received and aggregated by the target IoT gateway to obtain a complete raw data stream set.

[0015] Step 120: Perform feature extraction on the original data stream set to obtain the communication protocol feature set and abnormal behavior feature set for each data packet sequence.

[0016] Next, the acquired raw data stream set is analyzed. In this smart factory scenario, each data message sequence carries important information about the equipment's operating status and communication status. These potential key features can be mined through feature extraction.

[0017] In one implementation, the step of extracting features from the original data stream set to obtain a communication protocol feature set and an abnormal behavior feature set for each data packet sequence includes: Step 121: Perform protocol parsing processing on the terminal device identifier in the data packet sequence to determine the protocol type identifier and data payload length corresponding to the communication protocol data unit.

[0018] In this embodiment of the invention, different types of devices may use different communication protocols for data transmission. For example, device A uses the Modbus protocol, and device B uses the MQTT protocol. When parsing the terminal device identifier in the data packet sequence, taking device A as an example, when a packet sequence with ID-A is received, the protocol type identifier corresponding to its communication protocol data unit is identified as Modbus according to the preset parsing rules. At the same time, the data content carried in the communication protocol data unit is analyzed to determine the data payload length. For example, the data payload length is L1. This length information is very important for subsequent analysis of protocol characteristics, as it reflects the amount of data carried by device A in this data transmission. The data payload length may vary in different business scenarios and device states.

[0019] Step 122: Invoke the preset protocol feature encoder to perform encoding mapping processing on the protocol type identifier and the data payload length, and generate the protocol timing feature vector and protocol structure feature vector of the data packet sequence.

[0020] In the data analysis system of a smart factory, a pre-configured protocol feature encoder is used to process this information. In a preferred embodiment, the step of invoking the pre-configured protocol feature encoder to perform encoding mapping processing on the protocol type identifier and the data payload length, generating a protocol timing feature vector and a protocol structure feature vector for the data packet sequence, includes: Step 1221: Input the protocol type identifier into the type mapping layer of the protocol feature encoder, and convert the protocol type identifier into a type encoding vector using a preset protocol type encoding table; input the data payload length into the length mapping layer of the protocol feature encoder, and map the data payload length into a length distribution vector using a piecewise linear function; input the type encoding vector and the length distribution vector into the time series analysis layer of the protocol feature encoder, and perform sliding window statistical processing on the type encoding vector and the length distribution vector of multiple consecutive data packet sequences to generate the protocol time series feature vector; input the type encoding vector and the length distribution vector into the structure analysis layer of the protocol feature encoder, and calculate the similarity between the type encoding difference vector and the length distribution difference vector between the current data packet sequence and adjacent data packet sequences to generate the protocol structure feature vector.

[0021] It is understood that for the Modbus protocol type identifier of device A, it is input into the type mapping layer of the protocol feature encoder. Based on a preset protocol type encoding table, for example, the encoding table specifies that the type encoding vector corresponding to the Modbus protocol is [c1, c2, c3]. In this embodiment, the vector element values ​​are determined according to the characteristics of the protocol and the identification rules in the entire system. Simultaneously, the data payload length L1 of the device A data packet is input into the length mapping layer and mapped using a piecewise linear function. The function relationship is that different length intervals correspond to different mapping values; L1 falling within one of these intervals is mapped to a length distribution vector [c4, c5]. Next, the type encoding vector and length distribution vector are input into the time series analysis layer. Using a sliding window approach, for example, setting the window size to 5 data packet sequences, statistical analysis is performed on these vectors of multiple consecutive data packet sequences. Within this window, the changes in the type encoding vector and length distribution vector at different times are statistically analyzed to generate a protocol time series feature vector. This vector reflects the characteristic changes of the protocol over time. These two vectors are then input into the structural analysis layer to calculate the similarity between the type encoding difference vector and the length distribution difference vector of the current data packet sequence and adjacent data packet sequences. For example, compared with another data packet sequence from adjacent device A, the similarity is calculated to be 0.6. The above calculation generates a protocol structural feature vector, which reflects the relative relationships and characteristics of the protocol in terms of structure.

[0022] Step 123: Perform traffic pattern recognition processing on the communication protocol data units in the data packet sequence to obtain the traffic fluctuation feature vector and the data stream interval distribution feature vector.

[0023] In this step, the traffic patterns of the communication protocol data units are further analyzed. These traffic patterns can be used to determine whether there are any abnormalities in the device's communication behavior. In another preferred embodiment, the traffic pattern recognition processing of the communication protocol data units in the data packet sequence to obtain a traffic fluctuation feature vector and a data stream interval distribution feature vector includes: Step 1231: Extract the timestamp sequence of the communication protocol data unit, calculate the standard deviation of the interval between adjacent timestamps, and generate the time interval fluctuation coefficient; divide the timestamp sequence into sliding windows based on the time interval fluctuation coefficient, count the number of data packets in each window, and generate a window packet number sequence; perform Fourier transform processing on the window packet number sequence, and extract the frequency domain amplitude feature vector as the flow fluctuation feature vector; perform probability density estimation on the data payload length sequence of the communication protocol data unit to generate a payload length distribution histogram; perform principal component analysis processing on the payload length distribution histogram to obtain the dimension-reduced payload distribution vector as the data flow interval distribution feature vector.

[0024] Optionally, for the communication protocol data unit of device A, its timestamp sequence is first extracted, for example, the timestamp sequence is T1, T2, T3, etc. The interval between adjacent timestamps is calculated, such as T2-T1, T3-T2, etc., and then the standard deviation of these intervals is calculated to obtain the time interval fluctuation coefficient. Next, the timestamp sequence is divided into sliding windows according to the fluctuation coefficient, for example, the window size is 10 timestamps. The number of data packets is counted in each window to generate a window message count sequence, for example, the number of data packets in one window is N1. The window message count sequence is subjected to Fourier transform processing to convert the time domain signal to the frequency domain, and the frequency domain amplitude feature vector is extracted. This vector can be understood as the flow fluctuation feature vector, which reflects the fluctuation characteristics of flow at different frequencies. At the same time, the probability density of the data payload length sequence of the communication protocol data unit of device A is estimated, the probability of different lengths occurring is counted, and a payload length distribution histogram is generated. Then, principal component analysis is performed on the histogram to reduce the dimensionality of the high-dimensional data. The resulting load distribution vector is used as the data stream interval distribution feature vector. This vector reflects the distribution characteristics of the data load length and the potential patterns of the data stream interval.

[0025] Step 124: Integrate the protocol timing feature vector, the protocol structure feature vector, the traffic fluctuation feature vector, and the data stream interval distribution feature vector to obtain the communication protocol feature set.

[0026] Furthermore, the aforementioned feature vectors are integrated to form a communication protocol feature set. In a smart factory scenario, this set comprehensively reflects the integrated characteristics of device A's communication protocol. The protocol timing feature vector, protocol structure feature vector, traffic fluctuation feature vector, and data flow interval distribution feature vector are concatenated in a predetermined order, such as sequentially, to form a new vector set. This set can be understood as the communication protocol feature set, containing feature information of device A in terms of communication protocol from multiple dimensions such as time series, structure, and traffic, providing a rich data foundation for subsequent attack identification.

[0027] Step 125: Perform historical behavior matching processing on the terminal device identifier in the data packet sequence to determine the historical communication frequency range and historical data payload range corresponding to the terminal device identifier.

[0028] To determine whether a device's current behavior is normal, its historical behavior data needs to be referenced. The smart factory's database stores the past communication records of device A. By analyzing these historical records, the communication frequency range of device A over a period of time, such as the past month, can be determined. For example, the historical communication frequency range might be between Fmin and Fmax. Simultaneously, the historical data load range can be determined, for example, between Dmin and Dmax. This historical range data is based on statistics of device A's communication behavior during long-term stable operation and reflects the behavioral characteristics of the device during normal operation.

[0029] Step 126: Calculate the deviation between the actual communication frequency and actual data load of the communication protocol data unit and the historical communication frequency range and the historical data load range, and generate the abnormal behavior feature set.

[0030] Optionally, the deviation is calculated by comparing the actual situation of the current communication protocol data unit with the historical range to detect abnormal behavior. In an exemplary embodiment, the step of calculating and generating the abnormal behavior feature set based on the deviation between the actual communication frequency and actual data payload of the communication protocol data unit and the historical communication frequency range and the historical data payload range includes: Step 1261: Obtain the historical average and historical frequency variance of the terminal device identifier within a preset time period, and calculate the first deviation between the actual communication frequency and the historical average communication frequency.

[0031] In a smart factory, for device A, communication frequency data over a preset time period (e.g., the past week) is retrieved from historical communication records. The mean (Favg) and variance (Fvar) of this data are calculated. The current actual communication frequency of device A is Fcur. Through relevant calculation methods, such as calculating (Fcur - Favg) / Fvar, the first deviation is obtained. This deviation reflects the degree of relative deviation between the current communication frequency and the historical mean.

[0032] Step 1262: Obtain the historical data load mean and historical data load variance of the terminal device identifier within the preset time period, and calculate the second deviation between the actual data load and the historical data load mean.

[0033] Similarly, for device A, data load data within a preset time period is obtained, and its mean Davg and variance Dvar are calculated. The current actual data load of device A is Dcur. By calculating (Dcur-Davg) / Dvar, the second deviation is obtained, which reflects the difference between the actual data load and the historical mean.

[0034] Step 1263: Perform a weighted summation of the first deviation and the second deviation to generate a comprehensive deviation score.

[0035] Based on actual needs, different weights are assigned to the first deviation and the second deviation. For example, the weight of the first deviation is W1, and the weight of the second deviation is W2, and W1 + W2 = 1. By calculating W1 × first deviation + W2 × second deviation, a comprehensive deviation score is obtained. This score comprehensively considers the deviations in both communication frequency and data load, and more comprehensively reflects the degree of difference between the device behavior and historical conditions.

[0036] Step 1264: Determine the anomaly level identifier of the terminal device identifier based on the comparison result between the comprehensive deviation score and the preset threshold.

[0037] In this embodiment, the preset threshold can be R. The overall deviation score is compared with this threshold. If the overall deviation score is greater than R, the anomaly level identifier of device A is determined to be "high"; if it is less than R within a certain range, it is "medium"; if it is much less than R, it is "low". This anomaly level identifier intuitively reflects the degree of abnormality of the device behavior.

[0038] Step 1265: Integrate the first deviation, the second deviation, the comprehensive deviation score, and the anomaly level identifier into the abnormal behavior feature set.

[0039] Furthermore, the calculated first deviation, second deviation, comprehensive deviation score, and anomaly level identifier are integrated according to the set rules (such as weight-based concatenation processing) to form a vector or set containing the above four elements. This set can be understood as an abnormal behavior feature set, which comprehensively records the deviation information of device A from historical situations in terms of communication behavior and the corresponding anomaly level.

[0040] Step 130: Based on the preset attack identification and classification model, perform joint analysis and processing on the communication protocol feature set and the abnormal behavior feature set to generate the attack type determination result of the data packet sequence.

[0041] In this step, a pre-defined attack identification and classification model can be used to perform in-depth analysis on the two feature sets obtained earlier to determine whether the data packet sequence has been attacked and the type of attack. For example, the linked analysis process includes vector concatenation and normalization performed through the feature fusion layer of the attack identification and classification model, cross-attention mechanism processing performed through the joint analysis layer of the attack identification and classification model, and fully connected mapping and Softmax processing performed through the multi-classification output layer of the attack identification and classification model.

[0042] In an alternative embodiment, the step of performing a linked analysis of the communication protocol feature set and the abnormal behavior feature set based on a preset attack identification and classification model to generate an attack type determination result for the data packet sequence includes: Step 131: Input the protocol timing feature vector and protocol structure feature vector from the communication protocol feature set into the feature fusion layer of the attack identification and classification model, perform vector concatenation and normalization processing, and generate the first fused feature vector.

[0043] In the attack identification process of a smart factory, the protocol temporal feature vector and protocol structural feature vector from the communication protocol feature set are input into the feature fusion layer of the attack identification classification model. These two vectors are concatenated in the feature fusion layer, that is, their elements are joined together in a certain order to form a new, longer vector. Then, this concatenated vector is normalized using relevant normalization algorithms, such as dividing each element of the vector by the vector's magnitude, so that the vector length is 1. After the above processing, the first fused feature vector is generated. This vector integrates the temporal and structural feature information of the protocol, providing a more suitable data format for subsequent analysis.

[0044] Step 132: Input the first deviation, the second deviation, and the anomaly level identifier from the set of abnormal behavior features into the anomaly scoring layer of the attack identification and classification model, perform linear weighting and activation function processing, and generate an anomaly scoring vector.

[0045] Furthermore, the first deviation, second deviation, and anomaly level identifier from the abnormal behavior feature set are input into the anomaly scoring layer of the attack identification and classification model. In this layer, different weights are assigned to these three elements: the first deviation is weighted as W3, the second deviation as W4, and the anomaly level identifier as W5, with W3 + W4 + W5 = 1. A linear weighted sum of W3 × first deviation + W4 × second deviation + W5 × anomaly level identifier is calculated, and then processed using an activation function, such as ReLU (if the result is greater than 0, it remains unchanged; if less than 0, it becomes 0), to generate an anomaly scoring vector. This vector reflects the quantitative information of the degree of anomaly in the device behavior.

[0046] Step 133: Input the first fused feature vector and the anomaly score vector into the joint analysis layer of the attack identification classification model, perform cross-attention mechanism processing, and generate a joint feature set.

[0047] Furthermore, the previously generated first fused feature vector and anomaly score vector are input into the joint analysis layer of the attack identification and classification model. In a preferred embodiment, the step of inputting the first fused feature vector and the anomaly score vector into the joint analysis layer of the attack identification and classification model for cross-attention mechanism processing to generate a joint feature set includes: Step 1331: Using the first fused feature vector as the query vector and the anomaly score vector as the key vector and value vector; calculating the dot product attention weight between the query vector and the key vector, and performing a weighted summation on the value vector to generate a first cross feature vector; using the anomaly score vector as the query vector and the first fused feature vector as the key vector and value vector; calculating the dot product attention weight between the query vector and the key vector, and performing a weighted summation on the value vector to generate a second cross feature vector; performing bidirectional gating fusion processing on the first cross feature vector and the second cross feature vector to generate the joint feature set.

[0048] First, the first fused feature vector is used as the query vector, and the anomaly score vector is used as the key and value vectors. The dot product between the query vector and the key vector is calculated, and the result is normalized to obtain the dot product attention weight. Based on this weight, the value vector (i.e., the anomaly score vector) is weighted and summed to generate the first cross-feature vector. Then, conversely, the anomaly score vector is used as the query vector, and the first fused feature vector is used as the key and value vectors, and the above calculation process is repeated to generate the second cross-feature vector. Finally, the first and second cross-feature vectors are subjected to bidirectional gating fusion processing. Through a relevant gating mechanism, the information from the two vectors is fused to generate a joint feature set, which fully integrates the key information of communication protocol features and abnormal behavior features.

[0049] Step 134: Call the multi-classification output layer of the attack identification and classification model, perform fully connected mapping and Softmax processing on the joint feature set, and generate the probability distribution of the data packet sequence belonging to different attack types.

[0050] Optionally, the joint feature set is input into the multi-class output layer of the attack identification and classification model. In this layer, the joint feature set is connected to multiple output nodes via fully connected mapping, with each connection having corresponding weights. After fully connected mapping, a set of output values ​​is obtained. These output values ​​are then processed using Softmax, which transforms them into a probability distribution form such that the sum of all probabilities is 1, generating a probability distribution of the data packet sequence belonging to different attack types, such as a probability P1 for a protocol spoofing attack and a probability P2 for a data injection attack.

[0051] Step 135: Determine the attack type determination result based on the attack type identifier corresponding to the maximum value of the probability distribution.

[0052] Find the maximum value in the generated probability distribution. If P1 is the largest, and the attack type identifier corresponding to P1 is "protocol spoofing attack", then the attack type determination result of the data packet sequence can be determined as a protocol spoofing attack. This result clarifies the attack type that the data packet sequence may suffer, providing a basis for subsequent security protection.

[0053] Step 140: Generate a set of security protection strategies based on the attack type determination result, and feed the set of security protection strategies back to the IoT terminal device.

[0054] Furthermore, based on the attack type determination results, corresponding security protection strategies are formulated, and these strategies are fed back to IoT terminal devices to ensure the secure operation of the system.

[0055] In an optional embodiment, generating a set of security protection strategies based on the attack type determination result includes: Scenario 1: When the attack type determination result is a protocol spoofing attack, a protocol integrity verification policy and a terminal device isolation policy are generated. The protocol integrity verification policy is used to verify the hash value of the subsequently received communication protocol data units, and the terminal device isolation policy is used to block the data stream upload permission of the terminal device identifier.

[0056] Case 2: When the attack type determination result is a data injection attack, a payload content filtering strategy and a transmission encryption strategy are generated. The payload content filtering strategy is used to match and delete the target character sequence in the communication protocol data unit, and the transmission encryption strategy is used to enable key encryption for the data stream of the terminal device identifier.

[0057] Case 3: When the attack type determination result is a traffic flooding attack, a rate limiting policy and a traffic shaping policy are generated. The rate limiting policy is used to control the data stream upload frequency of the terminal device identifier with a threshold, and the traffic shaping policy is used to queue and prioritize the data stream that exceeds the threshold.

[0058] Based on this, the step of feeding back the set of security protection strategies to the IoT terminal device includes: The protocol integrity verification strategy and the terminal device isolation strategy are encapsulated into a first control instruction set, which is sent to the IoT terminal device corresponding to the terminal device identifier through a secure communication channel, instructing the IoT terminal device to enable the protocol verification module and close the data upload port (corresponding to case 1).

[0059] Alternatively, the payload content filtering strategy and the transmission encryption strategy can be encapsulated into a second control instruction set, which is then sent to the IoT terminal device corresponding to the terminal device identifier through the secure communication channel, instructing the IoT terminal device to enable the content filtering task and initialize the encryption key negotiation process (corresponding to case 2).

[0060] Alternatively, the rate limiting strategy and the traffic shaping strategy can be encapsulated into a third control instruction set and sent to the IoT terminal device corresponding to the terminal device identifier through the secure communication channel, instructing the IoT terminal device to adjust the data stream transmission rate and configure the traffic buffer queue (corresponding to case 3).

[0061] In a smart factory scenario, if device A is determined to be under a protocol spoofing attack, a protocol integrity verification strategy and a terminal device isolation strategy are generated. For the protocol integrity verification strategy, a relevant hash algorithm, such as SHA-256, is set to calculate the hash value of subsequently received communication protocol data units. The calculated hash value is compared with a pre-stored correct hash value; if they do not match, it is determined that the protocol may have been spoofed or tampered with. The terminal device isolation strategy sends a command to device A to close its data upload port, preventing potentially spoofed data streams from being uploaded to the network and preventing the attack from spreading. These two strategies are encapsulated into a first control command set and sent to the corresponding IoT terminal device of device A through a secure encrypted communication channel. Upon receiving the command, the device activates the protocol verification module and closes the data upload port as instructed.

[0062] If a data injection attack is identified, a payload content filtering strategy and a transmission encryption strategy are generated. The payload content filtering strategy pre-defines target character sequences, such as specific code strings that might be used for malicious injection. It performs character-by-character matching on the content of communication protocol data units. Once a target character sequence is found, it is deleted from the data unit, thus preventing malicious data injection. The transmission encryption strategy assigns a relevant encryption key to device A and uses, for example, an AES encryption algorithm to encrypt the data stream of device A. These two strategies are encapsulated into a second set of control instructions, which is sent to the corresponding IoT terminal device of device A through a secure communication channel. Upon receiving the instructions, the device activates the content filtering task, begins character matching and deletion operations on the data units, and initializes the encryption key negotiation process, negotiating and determining the encryption key with the relevant server or device.

[0063] If the attack is determined to be a traffic flooding attack, a rate limiting policy and a traffic shaping policy are generated. The rate limiting policy sets a threshold for the data stream upload frequency based on the traffic volume of device A during normal operation and the network capacity. For example, it specifies that device A can upload a maximum of N data packets per minute. The traffic shaping policy sets up a queue to buffer data streams exceeding the threshold and assigns priorities to different types of data packets. For example, important device control command packets have higher priority than ordinary monitoring data packets, and data streams in the buffer queue are scheduled according to priority. These two policies are encapsulated into a third control command set and sent to the corresponding IoT terminal device of device A through a secure communication channel. After receiving the command, the device adjusts the data stream transmission rate to ensure that it does not exceed the set threshold and configures the traffic buffer queue to manage the data streams according to priority.

[0064] In a non-limiting embodiment, after feeding back the set of security protection strategies to the IoT terminal device, the method further includes: Step 210: Collect the feedback data stream set after the IoT terminal device executes the security protection strategy set in real time, perform dual verification processing of the feedback data stream set on protocol characteristics and behavioral characteristics, and generate a strategy execution monitoring feature set.

[0065] In smart factories, to ensure the effective execution of security protection strategies, it is necessary to monitor the feedback from IoT terminal devices after the strategies are implemented in real time. Taking device A as an example, after it executes the security protection strategy, its feedback data stream is collected in real time. This feedback data stream is first validated for protocol characteristics, and then protocol-related features such as protocol timing feature vectors and protocol structure feature vectors are extracted and compared with features from normal conditions. For example, the time interval distribution in the protocol timing feature vector is compared to see if it matches expectations; if abnormal fluctuations in the time intervals are found, it may indicate a problem with protocol execution. Simultaneously, behavioral feature validation is performed, calculating behavioral characteristic indicators such as the deviation of the actual communication frequency from the historical average communication frequency and the deviation of the actual data load from the historical average data load. These validated new features are integrated to generate a strategy execution monitoring feature set, which comprehensively reflects the operating status and behavioral characteristics of device A after executing the security protection strategy.

[0066] Step 220: Input the policy execution monitoring feature set into the attack identification and classification model, and output the difference value between the probability distribution of the current data stream attack and the probability distribution of the attack type determination result.

[0067] The generated set of policy execution monitoring features is input into the attack identification and classification model. The model analyzes and processes the input feature set, and through internal calculation and comparison mechanisms, outputs the probability distribution of the current data stream belonging to different attack types. This current probability distribution is compared with the probability distribution obtained when previously determining the attack type, and the difference in probability for each attack type is calculated. For example, if the probability of a previously determined protocol spoofing attack is P1, and the currently calculated probability of a protocol spoofing attack is P1', then |P1-P1'| is calculated. This calculation is performed for all possible attack types to obtain the probability distribution difference value, which reflects the degree of difference between the current data stream state and the previous attack type determination.

[0068] Step 230: When the probability distribution difference value exceeds the preset adjustment threshold, perform gradient descent optimization on the rate limit threshold, traffic shaping priority coefficient and encryption key length parameter in the security protection strategy set to generate a security policy update instruction set.

[0069] It is understandable that when the calculated probability distribution difference exceeds the preset adjustment threshold, it indicates a significant deviation between the current data flow state and expectations, and the security protection strategy may need adjustment. Gradient descent optimization is applied to the rate limiting threshold, traffic shaping priority coefficient, and encryption key length parameter. Taking the rate limiting threshold as an example, a gradient direction is calculated based on the current data flow and system performance indicators, and the rate limiting threshold is gradually adjusted in a direction that improves system performance and security protection effectiveness. Similarly, for the traffic shaping priority coefficient, the priority allocation of different types of data packets is adjusted based on data analysis and system requirements, and a more suitable coefficient value is found through the gradient descent algorithm. For the encryption key length parameter, considering current network security threats and data transmission requirements, the key length is adjusted according to the gradient descent principle. These adjusted parameters are encapsulated into a security policy update instruction set for updating the security protection strategy of IoT terminal devices.

[0070] Step 240: Perform online hot update operations on the protocol verification module, flow control module, and encryption module of the IoT terminal device according to the security policy update instruction set.

[0071] In this step, a security policy update instruction set is sent to the IoT terminal device. Upon receiving the instruction set, the device performs an online hot update of its protocol verification module, flow control module, and encryption module. For the protocol verification module, the verification algorithm or rules are adjusted according to the parameters in the update instruction set; for example, updating the hash algorithm parameters or adding new protocol format verification rules. The flow control module updates its configuration based on the new rate limit threshold and flow shaping priority coefficient, adjusting the control of data stream upload frequency and the scheduling strategy of the buffer queue. The encryption module regenerates or adjusts the encryption key according to the new encryption key length parameters to ensure the security of data transmission. Through this online hot update operation, the IoT terminal device can adapt to new security requirements in a timely manner, ensuring the stable operation of the system.

[0072] In a non-limiting embodiment, the method further includes, after feeding back the set of security protection strategies to the IoT terminal device: Step 310: Based on the attack type determination result and the comprehensive deviation score in the abnormal behavior feature set, generate the behavior compliance evaluation feature set of the terminal device identifier.

[0073] In the security management system of a smart factory, the compliance of equipment behavior is assessed by combining the attack type determination result and the comprehensive deviation score in the abnormal behavior feature set. For example, if the attack type determination result is a protocol spoofing attack, and the comprehensive deviation score in the abnormal behavior feature set is high, it indicates that the equipment behavior deviates significantly from normal conditions and does not meet expectations. Through relevant calculation methods, the attack type information and the comprehensive deviation score are integrated to generate a behavior compliance assessment feature set. For example, if the attack type is a protocol spoofing attack, denoted as A1, and the comprehensive deviation score is S, a value is calculated using the functional relationship f(A1, S), such as f(A1, S) = A1 × S. This value, along with relevant assessment parameters, forms the behavior compliance assessment feature set, which reflects the degree of compliance between the equipment behavior and normal behavior patterns.

[0074] Step 320: Perform time window sliding accumulation calculation on the behavior compliance evaluation feature set to generate a device credibility score sequence, and classify credibility level identifiers according to the monotonicity characteristics of the credibility score sequence.

[0075] This can be understood as performing a time-window sliding cumulative calculation on the behavior compliance assessment feature set. A time window size is set, for example, one hour. Within each time window, the relevant values ​​in the behavior compliance assessment feature set are accumulated. For example, within the first hour's time window, the values ​​of the behavior compliance assessment feature set corresponding to multiple data packet sequences within that time period are accumulated to obtain an accumulated value. As time progresses, the time window continuously slides, calculating a new accumulated value with each slide, thus generating a device reliability score sequence. The monotonicity of this sequence is observed: if the sequence value continuously rises, it indicates that the device behavior is increasingly conforming to the normal pattern, and the reliability is gradually increasing; if the sequence value continuously falls, the reliability decreases. Based on this monotonicity, reliability level identifiers are assigned; for example, a continuously rising reliability level reaching a certain standard is "high reliability," fluctuating within a certain range is "medium reliability," and a continuously falling reliability level below one of the thresholds is "low reliability."

[0076] Step 330: When the trust level identifier is lower than the preset trust threshold, determine the policy enhancement coefficient by combining the effective time parameters of the protocol integrity verification policy and the terminal device isolation policy in the security protection policy set.

[0077] It is understandable that when a device's trust level identifier is lower than the preset trust threshold, it indicates a significant security risk, necessitating strengthened security protection strategies. The strategy enhancement coefficient is determined by combining the effective time parameters of the protocol integrity verification strategy and the terminal device isolation strategy. For example, if the effective time of the protocol integrity verification strategy is short, it indicates a high requirement for the timeliness of protocol verification, while the device's trust level is low, potentially requiring more stringent verification measures. For instance, considering factors such as the effective time parameter and the device's current security status, if the effective time of the protocol integrity verification strategy is Q1, the effective time of the terminal device isolation strategy is Q2, and the device's current security risk indicator is U, then the strategy enhancement coefficient can be calculated using the formula g(Q1, Q2, U). This coefficient is used to determine the degree of subsequent strategy enhancement. The calculation logic of the strategy enhancement coefficient g(Q1, Q2, U) can be implemented based on the following three-layer relationship: 1) Time Sensitivity Factor: The reciprocal function is used to process the effective time parameters Q1 and Q2, so that the shorter the effective time of the strategy (the higher the response requirement), the greater the reinforcement demand. The time sensitivity of the two strategies is fused by weighted summation: α×(1 / Q1)+β×(1 / Q2), where α+β=1 is the weight allocation coefficient of the time dimension; 2) Risk amplification coefficient: An exponential function is introduced to nonlinearly amplify the safety risk indicator U, i.e., e^γU (γ is the risk sensitivity adjustment factor), so that high-risk scenarios generate exponential strategy reinforcement requirements; 3) Dynamic normalization: After fusing the results of the above two calculation steps through Cartesian product, the results are normalized to the [0, 1] interval through min-max normalization, and finally a policy reinforcement coefficient value that can be compared horizontally is generated.

[0078] Step 340: Downgrade the data stream upload permission corresponding to the terminal device identifier according to the strategy enhancement coefficient, and add the bidirectional authentication frequency parameter of the communication protocol data unit to generate a trust chain reinforcement strategy set.

[0079] Based on the calculated policy enhancement coefficient, the data stream upload permissions for device A are downgraded. For example, if device A originally had high upload permissions and could upload large amounts of data packets at any time, its upload frequency limit or the amount of data uploaded each time is reduced according to the policy enhancement coefficient. Simultaneously, the frequency parameter for two-way authentication of communication protocol data units is increased. For instance, if two-way authentication was originally performed every ten minutes, the authentication frequency is now increased to once every five minutes based on the policy enhancement coefficient. These permission downgrade and authentication frequency increase strategies are integrated to form a trust chain reinforcement strategy set. These measures improve the security and trustworthiness of devices, ensuring the stable operation of the smart factory IoT system.

[0080] It should be noted that those skilled in the art, when implementing the above technical solutions, can undoubtedly and without hindrance combine existing technologies and conventional technical means to achieve the following improvements in order to fully and clearly realize the embodiments of the present invention: Based on the cross-attention mechanism in existing technologies, the correlation between protocol temporal feature vectors and anomaly scoring vectors is modeled. Attention weights are dynamically allocated by calculating the cosine similarity between feature vectors, thereby improving the deficiency of insufficient logical correlation between temporal features and anomaly scoring.

[0081] To address the risk of historical data contamination, outlier detection techniques (such as the Isolation Forest algorithm) can be used to clean the device's historical communication data. After removing outlier records that exceed three times the median absolute difference (MAD), the historical communication frequency range and load range can be recalculated, thereby ensuring the reliability of the historical behavior matching benchmark.

[0082] For setting the parameters of the piecewise linear function, the data load length can be divided into 10 intervals using the equal-width binning method, and a smooth transition coefficient can be generated based on the sigmoid function, thereby clarifying the mapping rules and avoiding abrupt feature changes. In the Fourier transform processing, the sliding window length can be set to twice the minimum communication interval according to the Nyquist sampling theorem, and a Hanning window function with a 50% overlap rate can be used. At the same time, the top three principal components with a cumulative variance contribution rate of 95% can be retained through principal component analysis, thereby ensuring the reproducibility of the frequency domain amplitude characteristics and the load distribution vector.

[0083] For further optimization of the deviation calculation, the first deviation in step 1261 can be corrected to (Fcur-Favg) / σ (σ is the standard deviation of historical communication frequency) and the second deviation in step 1262 can be adjusted to (Dcur-Davg) / σ', thereby unifying the dimensions to a unitless standardized score.

[0084] For cross-attention weight calculation, the dot product result can be normalized using the Softmax function, and a scaling factor of √dk (dk being the key vector dimension) can be introduced to prevent gradient vanishing, thereby stabilizing the attention distribution. At the security policy implementation level, the protocol integrity verification hash value can be generated using the SHA-256 algorithm based on the RFC 6234 specification, and AES-256-GCM encrypted transmission can be implemented according to the NIST SP800-38D standard. At the same time, the QoS level coefficient of the traffic shaping policy can be defined with reference to the CoAP protocol priority flag, thereby ensuring the standardization of policy implementation.

[0085] The Z-score normalization method is used to unify the dimensions of the protocol type encoding vector and the length distribution vector. The two types of vectors are aligned to the same dimension by zero padding before the concatenation operation is performed, thereby eliminating the distortion of the feature space.

[0086] In summary, the embodiments of the present invention can effectively enhance the security protection capabilities of the Internet of Things (IoT). First, by extracting features from the raw data streams uploaded by IoT terminal devices, the communication protocol feature set and abnormal behavior feature set can be accurately extracted, providing support for in-depth insight into data behavior patterns. Second, based on the linkage analysis and processing of the preset attack identification and classification model, the attack type determination result of the data packet sequence can be accurately generated, thereby keenly capturing various potential attacks. Finally, based on the determination result, a set of targeted security protection strategies is generated and fed back to the IoT terminal devices, which can respond to security threats in a timely and effective manner, ensure the stable and reliable operation of the IoT system, and significantly enhance the security and stability of the IoT environment.

[0087] See Figure 2 As shown in the figure, this is a schematic diagram of the basic structure of an IoT gateway data processing device 200 provided in an embodiment of the present invention. The IoT gateway data processing device 200 includes: Processor 201; Storage device 202, on which computer program 2020 is stored; When the computer program 2020 is executed by the processor 201, the processor 201 implements any of the IoT gateway data processing methods described above.

[0088] Based on the above, a readable storage medium is provided, on which a program or instructions are stored, and when the program or instructions are executed by a processor, the steps of the above method are implemented.

[0089] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems or apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and relevant parts can be referred to the method section.

Claims

1. A data processing method for an Internet of Things (IoT) gateway, characterized in that, include: The raw data stream set uploaded by the IoT terminal device is obtained through the target IoT gateway. The raw data stream set includes multiple data packet sequences, each of which consists of at least one terminal device identifier and a corresponding communication protocol data unit. Feature extraction is performed on the original data stream set to obtain a communication protocol feature set and an abnormal behavior feature set for each data packet sequence. Specifically, this includes: performing protocol parsing processing on the terminal device identifiers in the data packet sequence to determine the protocol type identifier and data payload length corresponding to the communication protocol data unit; calling a preset protocol feature encoder to perform encoding mapping processing on the protocol type identifier and the data payload length to generate a protocol timing feature vector and a protocol structure feature vector for the data packet sequence; performing traffic pattern recognition processing on the communication protocol data units in the data packet sequence to obtain a traffic fluctuation feature vector and a data stream interval distribution feature vector; integrating the protocol timing feature vector, the protocol structure feature vector, the traffic fluctuation feature vector, and the data stream interval distribution feature vector to obtain the communication protocol feature set; performing historical behavior matching processing on the terminal device identifiers in the data packet sequence to determine the historical communication frequency range and historical data payload range corresponding to the terminal device identifier; and calculating the deviation between the actual communication frequency and actual data payload of the communication protocol data unit and the historical communication frequency range and historical data payload range to generate the abnormal behavior feature set. Based on a preset attack identification and classification model, the communication protocol feature set and the abnormal behavior feature set are analyzed and processed in a linked manner to generate an attack type determination result for the data packet sequence. A set of security protection strategies is generated based on the attack type determination result, and the set of security protection strategies is fed back to the IoT terminal device; The step of generating the abnormal behavior feature set by calculating the deviation between the actual communication frequency and actual data payload of the communication protocol data unit and the historical communication frequency range and the historical data payload range includes: Obtain the historical average and historical communication frequency variance of the terminal device identifier within a preset time period, and calculate the first deviation between the actual communication frequency and the historical average communication frequency. Obtain the historical data load mean and historical data load variance of the terminal device identifier within the preset time period, and calculate the second deviation between the actual data load and the historical data load mean; The first deviation and the second deviation are weighted and summed to generate a comprehensive deviation score; Based on the comparison result between the comprehensive deviation score and the preset threshold, the abnormality level identifier of the terminal device identifier is determined; The first deviation, the second deviation, the comprehensive deviation score, and the anomaly level identifier are integrated into the abnormal behavior feature set.

2. The IoT gateway data processing method according to claim 1, characterized in that, The process of invoking a preset protocol feature encoder to perform encoding mapping on the protocol type identifier and the data payload length generates a protocol timing feature vector and a protocol structure feature vector for the data packet sequence, including: The protocol type identifier is input into the type mapping layer of the protocol feature encoder, and the protocol type identifier is converted into a type encoding vector through a preset protocol type encoding table; The data payload length is input to the length mapping layer of the protocol feature encoder, and the data payload length is mapped into a length distribution vector through a piecewise linear function; The type encoding vector and the length distribution vector are input to the timing analysis layer of the protocol feature encoder. Sliding window statistical processing is performed on the type encoding vector and the length distribution vector of multiple consecutive data packet sequences to generate the protocol timing feature vector. The type encoding vector and the length distribution vector are input into the structural analysis layer of the protocol feature encoder to calculate the similarity between the type encoding difference vector and the length distribution difference vector between the current data packet sequence and the adjacent data packet sequences, thereby generating the protocol structural feature vector.

3. The IoT gateway data processing method according to claim 1, characterized in that, The step of performing traffic pattern recognition processing on the communication protocol data units in the data packet sequence to obtain traffic fluctuation feature vectors and data stream interval distribution feature vectors includes: Extract the timestamp sequence of the communication protocol data unit, calculate the standard deviation of the interval between adjacent timestamps, and generate the time interval fluctuation coefficient; Based on the time interval fluctuation coefficient, the timestamp sequence is divided into sliding windows, the number of data packets in each window is counted, and a window packet count sequence is generated. The sequence of number of window messages is subjected to Fourier transform processing to extract the frequency domain amplitude feature vector as the flow fluctuation feature vector; The probability density of the data payload length sequence of the communication protocol data unit is estimated to generate a payload length distribution histogram. Principal component analysis is performed on the load length distribution histogram to obtain the dimensionality-reduced load distribution vector, which is used as the data stream interval distribution feature vector.

4. The IoT gateway data processing method according to claim 1, characterized in that, The attack identification and classification model based on a preset method performs linked analysis on the communication protocol feature set and the abnormal behavior feature set to generate an attack type determination result for the data packet sequence, including: The protocol timing feature vector and protocol structure feature vector in the communication protocol feature set are input into the feature fusion layer of the attack identification and classification model, and vector concatenation and normalization are performed to generate the first fused feature vector. The first deviation, second deviation, and anomaly level identifier in the abnormal behavior feature set are input into the anomaly scoring layer of the attack identification and classification model, and linear weighting and activation function processing are performed to generate an anomaly scoring vector. The first fused feature vector and the anomaly score vector are input into the joint analysis layer of the attack identification and classification model, and cross-attention mechanism processing is performed to generate a joint feature set; The multi-class output layer of the attack identification and classification model is invoked to perform fully connected mapping and Softmax processing on the joint feature set, thereby generating the probability distribution of the data packet sequence belonging to different attack types. The attack type determination result is determined based on the attack type identifier corresponding to the maximum value of the probability distribution.

5. The IoT gateway data processing method according to claim 4, characterized in that, The step of inputting the first fused feature vector and the anomaly score vector into the joint analysis layer of the attack identification and classification model, performing cross-attention mechanism processing, and generating a joint feature set includes: Use the first fused feature vector as the query vector and the anomaly score vector as the key vector and value vector; Calculate the attention weight of the dot product between the query vector and the key vector, and perform a weighted summation of the value vectors to generate the first cross feature vector; Use the anomaly score vector as the query vector and the first fused feature vector as the key vector and value vector; Calculate the attention weight of the dot product between the query vector and the key vector, and perform a weighted summation of the value vectors to generate a second cross feature vector; The first cross feature vector and the second cross feature vector are subjected to bidirectional gating fusion processing to generate the joint feature set.

6. The IoT gateway data processing method according to claim 1, characterized in that, The step of generating a set of security protection strategies based on the attack type determination result includes: When the attack type determination result is a protocol spoofing attack, a protocol integrity verification policy and a terminal device isolation policy are generated. The protocol integrity verification policy is used to verify the hash value of the subsequently received communication protocol data units, and the terminal device isolation policy is used to block the data stream upload permission of the terminal device identifier. When the attack type determination result is a data injection attack, a payload content filtering strategy and a transmission encryption strategy are generated. The payload content filtering strategy is used to match and delete the target character sequence in the communication protocol data unit. The transmission encryption strategy is used to enable key encryption for the data stream of the terminal device identifier. When the attack type determination result is a traffic flooding attack, a rate limiting policy and a traffic shaping policy are generated. The rate limiting policy is used to control the data stream upload frequency of the terminal device identifier with a threshold, and the traffic shaping policy is used to queue and prioritize data streams that exceed the threshold.

7. The IoT gateway data processing method according to claim 6, characterized in that, The step of feeding back the set of security protection strategies to the IoT terminal device includes: The protocol integrity verification strategy and the terminal device isolation strategy are encapsulated into a first control instruction set, which is sent to the IoT terminal device corresponding to the terminal device identifier through a secure communication channel, instructing the IoT terminal device to enable the protocol verification module and close the data upload port. The payload content filtering strategy and the transmission encryption strategy are encapsulated into a second control instruction set, which is sent to the IoT terminal device corresponding to the terminal device identifier through the secure communication channel, instructing the IoT terminal device to enable the content filtering task and initialize the encryption key negotiation process. The rate limiting strategy and the traffic shaping strategy are encapsulated into a third control instruction set, which is sent to the IoT terminal device corresponding to the terminal device identifier through the secure communication channel, instructing the IoT terminal device to adjust the data stream transmission rate and configure the traffic buffer queue.

8. An Internet of Things (IoT) gateway data processing device, characterized in that, include: processor; A storage device having a computer program stored thereon, which, when executed by the processor, causes the processor to implement the IoT gateway data processing method as described in any one of claims 1-7.

Images