Dynamic protection method and device for smart home system based on web service

Abstract

The invention discloses a dynamic protection method and device for a smart home system based on web service. The method comprises the following steps: acquiring a first network data packet in the smart home system through an edge layer of the smart home system, wherein the first network data packet is data forming potential threats to the smart home system; after a service layer of the smart home system receives the first network data packet, the first network data packet and a second network data packet are analyzed through a WebAssessment Sidecar module of the service layer to obtain attack behavior data on the smart home system, and the second network data packet is data which is found by the service layer and forms a potential threat to the smart home system; generating a protection strategy of the smart home system according to the attack behavior data; and performing dynamic protection on the smart home system by using the protection strategy. According to the invention, the technical problem that the network security protection mode of the smart home system in the prior art cannot deal with a complex network environment and a rapidly changing attack means and has potential safety hazards is solved.

Description

Technical Field

[0001] This invention relates to the field of network security protection technology, and more specifically, to a dynamic protection method and device for a web-based smart home system. Background Technology

[0002] With the rapid development of internet technology, especially the widespread adoption of cloud computing, the Internet of Things (IoT), and artificial intelligence (AI), the security of smart home and health-related air conditioning systems faces unprecedented challenges. Traditional network security protection devices, such as Web Application Firewalls (WAFs) and Intrusion Prevention Systems (IPSs), have significant limitations in the face of increasingly complex network environments and rapidly evolving attack methods. Specifically, the following aspects highlight the limitations of traditional protection technologies:

[0003] 1) Increased attack surface in microservice architecture: Microservice architecture breaks down large applications into multiple small, independent services, making the system more flexible and scalable. However, this also means blurred network boundaries, increased east-west traffic, and the widespread deployment of stateless functions. This provides attackers with more potential entry points, increasing the difficulty of security protection.

[0004] 2) Inadequate response to dynamic threats: With the advancement of AI technology, modern web crawlers and automated attack tools (such as Playwright-level bots) can intelligently evade traditional security checks, such as regular expression matching. These tools utilize front-end obfuscation techniques to bypass simple defense mechanisms, significantly reducing the effectiveness of security measures.

[0005] 3) Lack of effective defense against unknown vulnerabilities: Existing protection technologies often rely on signature databases of known vulnerabilities, offering extremely limited protection against unknown business vulnerabilities. This leaves the system virtually defenseless against new types of attacks.

[0006] There is currently no effective solution to the above problems. Summary of the Invention

[0007] This invention provides a dynamic protection method and apparatus for a web-based smart home system, which at least addresses the technical problem that network security protection methods for smart home systems in related technologies cannot cope with complex network environments and rapidly changing attack methods, thus posing security risks.

[0008] According to one aspect of the present invention, a dynamic protection method for a web service-based smart home system is provided, comprising: acquiring a first network data packet from the smart home system through the edge layer of the smart home system, wherein the first network data packet is data that poses a potential threat to the smart home system; after receiving the first network data packet at the service layer of the smart home system, analyzing the first network data packet and a second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data against the smart home system, wherein the second network data packet is data discovered by the service layer that poses a potential threat to the smart home system; generating a protection strategy for the smart home system based on the attack behavior data; and using the protection strategy to dynamically protect the smart home system.

[0009] Optionally, obtaining the first network data packet from the smart home system through the edge layer of the smart home system includes: loading an eBPF program into the kernel of the smart home system in XDP mode, wherein the eBPF program is pre-written and used to define the processing method of network data packets; and using the eBPF program in the kernel to capture the first network data packet from the smart home system.

[0010] Optionally, capturing the first network data packet in the smart home system using the eBPF program in the kernel includes: receiving the network data packet through the eBPF program when the network data packet arrives in the smart home system; using the eBPF program to check the predetermined layer information of the network data packet to determine whether the network data packet poses a potential threat to the smart home system; and determining that the data packet posing a potential threat to the smart home system is the first network data packet.

[0011] Optionally, after the service layer of the smart home system receives the first network data packet, it analyzes the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data against the smart home system. This includes: using the function hooks and analysis logic built into the WebAssemblySidecar module in the service layer to analyze predetermined information of the first network data packet and the second network data packet to obtain the attack behavior data. The predetermined information includes: HTTP / HTTPS requests, SQL statements, and environmental behavior.

[0012] Optionally, after the service layer of the smart home system receives the first network data packet, it analyzes the first and second network data packets through the WebAssembly Sidecar module of the service layer to obtain attack behavior data against the smart home system. This includes: dynamically generating JS maze code after the service layer of the smart home system obtains the first or second network data packet; encrypting the JS maze code using a session key to obtain encrypted JS maze code, wherein the session key is a temporary key generated by the service layer through the ECDH key exchange protocol; sending the encrypted JS maze code to the client of the smart home system, so that the client, after receiving the encrypted JS maze code, decrypts and executes the JS maze code in its local environment, and feeds back the execution result of the JS maze code to the service layer; and obtaining the attack behavior data based on the execution result at the service layer.

[0013] Optionally, generating a protection strategy for the smart home system based on the attack behavior data includes: sending the attack behavior data to the decision layer of the smart home system, so that the attack behavior data is processed by the decision layer using a protection strategy generation model to obtain the protection strategy, wherein the protection strategy generation model is a model trained by machine learning using multiple sets of training data, and each set of multiple sets of training data includes: sample attack behavior data and sample protection strategy corresponding to the attack behavior data.

[0014] Optionally, the protection strategy is used to dynamically protect the smart home system, including sending the protection strategy to the service layer and the edge layer to dynamically protect the smart home system simultaneously at the service layer and the edge layer.

[0015] Optionally, after analyzing the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system, the dynamic protection method further includes: adjusting the protection level of the predetermined interface when it is determined from the attack behavior data that the frequency of attacks on a predetermined interface of the smart home system is greater than a frequency threshold.

[0016] According to another aspect of the present invention, a dynamic protection device for a web service-based smart home system is also provided, comprising: an acquisition unit, configured to acquire a first network data packet from the smart home system through the edge layer of the smart home system, wherein the first network data packet is data that poses a potential threat to the smart home system; an analysis unit, configured to analyze the first network data packet and a second network data packet through the WebAssembly Sidecar module of the service layer of the smart home system after the service layer receives the first network data packet, to obtain attack behavior data against the smart home system, wherein the second network data packet is data that the service layer has discovered to pose a potential threat to the smart home system; a generation unit, configured to generate a protection strategy for the smart home system based on the attack behavior data; and a protection unit, configured to dynamically protect the smart home system using the protection strategy.

[0017] Optionally, the acquisition unit includes: a loading module, configured to load an eBPF program into the kernel of the smart home system in XDP mode, wherein the eBPF program is pre-written and used to define the processing method of network packets; and a capture module, configured to capture the first network packets in the smart home system using the eBPF program in the kernel.

[0018] Optionally, the capture module includes: a receiving submodule, configured to receive the network data packet via the eBPF program when the network data packet arrives in the smart home system; an inspection submodule, configured to inspect the predetermined layer information of the network data packet using the eBPF program to determine whether the network data packet poses a potential threat to the smart home system; and a determining submodule, configured to determine that the data packet posing a potential threat to the smart home system in the network data packet is the first network data packet.

[0019] Optionally, the analysis unit includes: an analysis module, configured to analyze predetermined information of the first network data packet and the second network data packet at the service layer using function hooks and analysis logic built into the WebAssemblySidecar module to obtain the attack behavior data, wherein the predetermined information includes: HTTP / HTTPS requests, SQL statements, and environmental behavior.

[0020] Optionally, the analysis unit includes: a generation module, configured to dynamically generate JS maze code after the service layer of the smart home system obtains the first network data packet or the second network data packet; an encryption module, configured to encrypt the JS maze code using a session key to obtain encrypted JS maze code, wherein the session key is a temporary key generated by the service layer through the ECDH key exchange protocol; a first sending module, configured to send the encrypted JS maze code to the client of the smart home system, so that the client, after receiving the encrypted JS maze code, decrypts and executes the JS maze code in its local environment, and feeds back the execution result of the JS maze code to the service layer; and an acquisition module, configured to obtain the attack behavior data at the service layer based on the execution result.

[0021] Optionally, the generation unit includes: a second sending module, configured to send the attack behavior data to the decision layer of the smart home system, so that the decision layer processes the attack behavior data using a protection strategy generation model to obtain the protection strategy, wherein the protection strategy generation model is a model trained by machine learning using multiple sets of training data, and each set of multiple sets of training data includes: sample attack behavior data and sample protection strategy corresponding to the attack behavior data.

[0022] Optionally, the protection unit includes a third sending module, configured to send the protection strategy to the service layer and the edge layer, so as to provide dynamic protection for the smart home system simultaneously at the service layer and the edge layer.

[0023] Optionally, the dynamic protection device further includes: an adjustment unit, configured to, after analyzing the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system, adjust the protection level of the predetermined interface when it is determined from the attack behavior data that the frequency of attacks on the predetermined interface of the smart home system is greater than a frequency threshold.

[0024] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein the program executes the dynamic protection method for a web service-based smart home system described in any one of the above embodiments.

[0025] According to another aspect of the present invention, a processor is also provided, the processor being configured to run a program, wherein the program, when running, executes the dynamic protection method for a web service-based smart home system described in any of the preceding embodiments.

[0026] According to another aspect of the present invention, a computer program product is also provided, including computer instructions, which, when executed by a processor, perform the dynamic protection method for a web service-based smart home system described above.

[0027] In this embodiment of the invention, a first network data packet from the smart home system is acquired through the edge layer of the smart home system. This first network data packet represents data that poses a potential threat to the smart home system. After the service layer of the smart home system receives the first network data packet, it analyzes the first and second network data packets through the WebAssembly Sidecar module to obtain attack behavior data on the smart home system. The second network data packet represents data discovered by the service layer that poses a potential threat to the smart home system. A protection strategy for the smart home system is generated based on the attack behavior data. The protection strategy is then used to dynamically protect the smart home system. Through the above-mentioned technical solution provided by this invention, threat capture is achieved at the edge layer. Real-time, low-latency data packets can complete the initial threat assessment and filter out potential threat data. Then, the WebAssembly Sidecar module performs in-depth analysis of the first and second network data packets at the service layer to identify specific attack behaviors. Based on the attack behavior data, the strategy layer uses a machine learning model to generate customized protection strategies to specifically address various attack types. This achieves the technical effect of improving the security of the smart home system, thereby solving the technical problem that the network security protection methods of smart home systems in related technologies cannot cope with complex network environments and rapidly changing attack methods, resulting in security vulnerabilities. Attached Figure Description

[0028] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0029] Figure 1 This is a hardware structure block diagram of a mobile terminal for a dynamic protection method of a web service-based smart home system according to an embodiment of the present invention.

[0030] Figure 2 This is a flowchart of a dynamic protection method for a web service-based smart home system according to an embodiment of the present invention;

[0031] Figure 3 This is a flowchart of an optional dynamic protection method for a web service-based smart home system according to an embodiment of the present invention;

[0032] Figure 4This is a schematic diagram of a dynamic protection device for a web-based smart home system according to an embodiment of the present invention.

[0033] The above figures include the following reference numerals:

[0034] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. Detailed Implementation

[0035] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0037] As described in the background section, current cybersecurity protection methods for smart home systems are inadequate to cope with complex network environments and rapidly evolving attack methods, resulting in security vulnerabilities. Current cybersecurity protection systems struggle to effectively address modern attack methods and increasingly stringent compliance requirements, particularly in microservice architectures and high-performance application environments. Therefore, developing a novel protection technology that can dynamically adapt to complex network environments, respond to unknown threats in real time, meet regulatory requirements, and maintain low latency has become an urgent need in the current technological field. This invention provides a dynamic protection method and apparatus for a web-based smart home system, a computer-readable storage medium, a processor, and a computer program product.

[0038] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0039] The methods and embodiments provided in this invention can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a dynamic protection method of a web service-based smart home system according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0040] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the dynamic protection method of the web service-based smart home system in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0041] Example 1

[0042] According to an embodiment of the present invention, a method embodiment of a dynamic protection method for a smart home system based on web services is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0043] Figure 2 This is a flowchart of a dynamic protection method for a web service-based smart home system according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0044] Step S202: Obtain the first network data packet from the smart home system through the edge layer of the smart home system, wherein the first network data packet is data that poses a potential threat to the smart home system.

[0045] In this embodiment, eBPF (Extended Berkeley Packet Filter) and XDP (eXpress Data Path) technologies can be used to achieve low-latency and high-efficiency packet processing and capture in kernel space. eBPF is loaded and runs in the kernel, while XDP processes packets immediately after they arrive at the network card driver to reduce latency.

[0046] For example, first, the eBPF program is deployed in XDP mode to the kernel of the smart home system server. Then, when the first network packet arrives, the XDP mode eBPF program immediately captures the packet and performs a preliminary check to determine whether it constitutes a potential threat.

[0047] By running in kernel space in the above manner, network packets are processed using hardware acceleration, reducing latency and improving security. eBPF programs can monitor packet flows in real time and quickly filter or flag potentially threatening packets in XDP mode.

[0048] The edge layer uses eBPF+XDP technology to achieve real-time, low-latency packet inspection, effectively preventing attack surface expansion.

[0049] Step S204: After the service layer of the smart home system receives the first network data packet, it analyzes the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system. The second network data packet is data that the service layer has discovered that poses a potential threat to the smart home system.

[0050] In this embodiment, a WebAssembly (WASM) Sidecar module is deployed at the service layer. This module monitors application behavior through RASP (Runtime Application Self-Protection) technology.

[0051] For example, the WASM Sidecar module runs within the application process and can be dynamically loaded and unloaded without a restart. When the service layer receives data packets, the WASM module uses RASP technology to analyze HTTP / HTTPS requests, SQL statements, and environmental behavior to identify attack behavior data. It dynamically generates and encrypts JavaScript maze code, sends it to the client for execution, verifies client behavior, and further confirms whether it constitutes an attack. RASP technology enables deep security checks within the application by monitoring its behavior at runtime.

[0052] Step S206: Generate a protection strategy for the smart home system based on the attack behavior data.

[0053] In this embodiment, based on attack behavior data, the decision layer uses a machine learning model to generate a protection strategy, which is then quickly synchronized to the service layer and the edge layer via the gRPC protocol.

[0054] For example, attack behavior data can be sent to the decision layer to trigger the training or updating of a policy generation model. The generated protection policies are synchronized to all service layer and edge layer nodes via gRPC at millisecond speeds for immediate application of protective measures.

[0055] Step S208: Utilize protection strategies to dynamically protect the smart home system.

[0056] It is worth noting that in this embodiment of the invention, the edge layer quickly identifies potential threats through eBPF+XDP, while the service layer deeply analyzes request behavior using the RASP technology of the WebAssembly Sidecar to achieve in-depth defense. RASP technology allows for runtime monitoring of application behavior, and through built-in deep analysis logic and a bidirectional JS maze, it can identify attack attempts by advanced bots while reducing false positives. Based on attack behavior data, the policy layer uses machine learning models to automatically generate protection policies, which are then quickly synchronized to the edge and service layers for dynamic protection. By implementing rapid edge layer capture, deep service layer analysis, and intelligent policy generation and synchronization, this dynamic protection method effectively enhances the security capabilities of smart home systems, accurately identifying and responding to various attacks.

[0057] As described above, in this embodiment of the invention, the first network data packet of the smart home system can be obtained through the edge layer of the smart home system. This first network data packet represents data that poses a potential threat to the smart home system. After the service layer of the smart home system receives the first network data packet, it analyzes the first and second network data packets through the WebAssembly Sidecar module to obtain attack behavior data on the smart home system. The second network data packet represents data discovered by the service layer that poses a potential threat to the smart home system. A protection strategy for the smart home system is generated based on the attack behavior data. This strategy enables dynamic protection of the smart home system, achieving threat capture at the edge layer. Real-time, low-latency data packets can complete a preliminary threat assessment and filter out potential threat data. Then, the WebAssembly Sidecar module performs in-depth analysis of the first and second network data packets at the service layer to identify specific attack behaviors. Based on the attack behavior data, the strategy layer uses a machine learning model to generate customized protection strategies to specifically address various attack types, thereby improving the security of the smart home system.

[0058] Therefore, the technical solutions provided by the above embodiments of the present invention solve the technical problem that the network security protection methods of smart home systems in related technologies cannot cope with complex network environments and rapidly changing attack methods, thus posing security risks.

[0059] Figure 3 This is a flowchart of an optional dynamic protection method for a web service-based smart home system according to an embodiment of the present invention, such as... Figure 3 As shown, the application system of the dynamic protection method for a web-based smart home system in this embodiment of the invention is divided into three layers: the edge layer uses eBPF+XDP to push the detection to the network card, with a latency of <1ms; the service layer injects RASP hooks using WebAssemblySidecar, enabling hot-swapping without restarting; the policy layer uses Flink CEP+GNN to retrain the model every 30 seconds, and pushes it through gRPC in seconds. DTC uses a one-time token every 3 seconds to transform stateless HTTP into a session; a bidirectional JS maze uses 5 sets of ASTs per minute to reduce bot false negatives to 3%; Trace-coloring transmits the "protection level" through RPC to achieve single-interface elasticity; PPO online adversarial iteration every 30 seconds, with a false positive rate of <1%. Gray-scale deployment is carried out through K8s CRD and pushed by the WASM module ConfigMap, with upgrades taking <30 seconds.

[0060] According to the above embodiments of the present invention, obtaining the first network data packet of the smart home system through the edge layer of the smart home system includes: loading an eBPF program into the kernel of the smart home system in XDP mode, wherein the eBPF program is pre-written and used to define the processing method of network data packets; and capturing the first network data packet of the smart home system in the kernel using the eBPF program.

[0061] In this embodiment, a pre-written eBPF program is loaded into the kernel in XDP mode. This program defines the processing logic for network packets. Using the loaded eBPF program, the first network packet posing a potential threat to the smart home system is captured in kernel mode.

[0062] The XDP mode described above allows eBPF programs to begin processing packets as soon as they arrive at the network interface card's DMA ring, achieving sub-millisecond latency and thus improving packet processing speed and efficiency. eBPF programs can run securely in kernel mode without frequent user-mode to kernel-mode switching, reducing CPU overhead and improving the real-time performance and efficiency of data capture and monitoring.

[0063] Through the above methods, eBPF+XDP enables rapid capture and initial threat assessment of network packets, reducing detection latency and improving system response speed. Furthermore, by processing packets directly in kernel mode, it avoids the performance bottleneck of the traditional libpcap solution, reducing CPU utilization by 70% and ensuring efficient system operation, especially under high load scenarios.

[0064] like Figure 3As shown, eBPF+XDP technology is used to monitor and detect network traffic in real time at the edge layer. For example: 1) Writing eBPF programs: eBPF program development: First, an eBPF program needs to be written, usually implemented in C language. The program defines how to process and filter network packets. The eBPF program can implement complex detection logic, such as analyzing packet headers, matching patterns, and statistical behavior. 2) Loading XDP programs into the kernel: XDP registration: The written eBPF program is loaded into the Linux kernel in XDP mode. This is usually done through the tc command or an eBPF toolchain such as libbpf. XDP allows the program to process packets before they reach the network stack, reducing unnecessary kernel protocol stack overhead. 3) Implementing traffic capture and detection: Capturing packets: At the network card driver layer, the XDP program is set as the first processor for packets. When packets arrive, the XDP program immediately captures and analyzes them. Real-time Analysis and Filtering: The XDP program examines L2-L4 layer information of data packets, such as MAC address, IP address, port number, TCP / UDP header, etc., to quickly determine whether the data packet needs further processing or is suspicious. If the data packet is considered suspicious, it will jump to a more in-depth analysis process; otherwise, the data packet passes through quickly, reducing latency. 4) Context Passing and Decision-Making: Context Passing: For data packets that require further analysis, the XDP program will pass its context information, such as HTTP headers, POST body pointers, etc., to the WASM Sidecar module in user space through the kernel-user space communication mechanism (such as ring buffer). Decision-Making and Feedback: After receiving this information, the WASM module in the service layer performs more in-depth analysis and decision-making. If malicious behavior is detected, the WASM module can mark it and notify the XDP program to perform further processing, such as dropping the data packet or sending a warning message. 5) Performance Optimization and Resource Utilization: Efficient Resource Utilization: The XDP program runs in kernel space, without switching between user space and kernel space, reducing the overhead of context switching. At the same time, the XDP program adopts a lock-free design, further reducing execution latency and improving CPU utilization. Low-latency processing: XDP sits at the very front of the packet processing path, enabling filtering with sub-millisecond latency, ensuring minimal network latency, which is especially important for time-sensitive applications. 6) Dynamic adjustment and policy updates: Dynamic policy updates: XDP programs can be dynamically replaced and updated without restarting the network stack or system. This means that security policies and detection rules can be adjusted in real time to adapt to the ever-changing threat environment. Integration with the policy layer: The latest models trained by the policy layer using Flink CEP and GNN technologies can be quickly pushed to the edge layer via the gRPC protocol. XDP programs adjust their detection rules and behaviors based on the received policy update information, achieving policy consistency and real-time performance across the entire system.

[0065] Network traffic monitoring and detection at the edge layer using eBPF+XDP technology is a highly collaborative process from the underlying kernel to user-space applications and then to policy layer management. The combination of the flexibility of eBPF programs and the high performance of XDP ensures that detection is both real-time and efficient, while the tight integration with the service layer and policy layer enables dynamic policy adjustments and in-depth threat analysis, forming a multi-layered, adaptive security protection system that effectively resists various network attacks while ensuring the performance and user experience of the smart home system.

[0066] According to the above embodiments of the present invention, capturing a first network data packet in a smart home system using an eBPF program in the kernel includes: receiving the network data packet through the eBPF program when the network data packet arrives in the smart home system; using the eBPF program to check the predetermined layer information of the network data packet to determine whether the network data packet poses a potential threat to the smart home system; and determining the data packet that poses a potential threat to the smart home system as the first network data packet.

[0067] In this embodiment, the eBPF program receives network data packets in real time within the smart home system. The eBPF program examines the L3-L4 layer information of the data packets to determine whether the data packets pose a potential threat.

[0068] The eBPF program described above can identify potentially threatening data packets by inspecting their L3 (network layer) and L4 (transport layer) information, such as abnormal IP addresses, port numbers, or TCP / UDP flags. Furthermore, the packet inspection is performed in kernel mode without user-space intervention, ensuring both security and efficiency.

[0069] By directly inspecting network packets within the kernel, eBPF can accurately filter out potentially threatening packets, reducing unnecessary data processing and enhancing the overall protection capabilities of the system. Kernel-mode operations avoid user-mode overhead, reduce latency, and increase processing speed, enabling the system to handle higher packet traffic and maintain a good user experience.

[0070] like Figure 3As shown, a 90KB WebAssembly module is directly inserted into the JVMTI / PHP-TSRM hook layer of RASP (Runtime Application Self-Protection). The module is attached to the application process as a "sidecar," but runs in independent linear memory. It can directly read function parameters and return values ​​without triggering class loading or bytecode redefinition. For deployment, simply add `-javaagent:waf.wasm` to the startup script or add an `LD_PRELOAD` pointer to PHP-FPM; the application side requires zero code and zero restarts. Previously, implementing DevOps pipelines required canary deployments, restarts, and observations, often taking hours; now, the operations platform distributes Wasm to the ServiceMesh Sidecar-Injector, achieving full network effectiveness within minutes. In case of emergency rollback, deleting the file automatically hot-unloads the module, without any interruption to the JVM / PHP processes.

[0071] Furthermore, it should be noted that in this embodiment of the invention, the data plane adopts eBPF+XDP dual stack: traffic is hit by the XDP program in the network card driver DMA ring and directly performs L3-L4 filtering, with a single packet latency of <1µs; after a suspicious feature is hit, eBPFkprobe / uprobe packages the context (HTTP header, POST body pointer, SQL statement) into a ring-buffer event and sends it to user-space Wasm; the kernel space is read-only and lock-free, and the CPU utilization is reduced by 70% compared to the traditional libpcap solution; in actual tests, 10 8C16G nodes can stably achieve 100 k TPS, and the 99th RTT still falls within the 100 ms SLA red line.

[0072] According to the above embodiments of the present invention, after the service layer of the smart home system receives the first network data packet, it analyzes the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system. This includes: using the function hooks and analysis logic built into the WebAssembly Sidecar module in the service layer to analyze predetermined information of the first network data packet and the second network data packet to obtain attack behavior data. The predetermined information includes: HTTP / HTTPS requests, SQL statements, and environmental behavior.

[0073] In this embodiment, the WebAssembly Sidecar module enables RASP technology at the service layer to perform deep monitoring and analysis of the first and second network packets. Furthermore, it utilizes built-in function hooks and analysis logic to analyze predetermined information about the packets, such as HTTP / HTTPS requests, SQL statements, and environmental behavior.

[0074] The RASP technology described above allows for monitoring of an application's internal behavior at runtime, capturing function calls, parameters, and return values ​​through function hooks, providing deeper information for attack identification. The WebAssembly Sidecar module not only analyzes network requests but also monitors the runtime environment, such as the operating system's state, providing more comprehensive attack behavior data.

[0075] The above methods, through in-depth monitoring and analysis, can more accurately identify attacks targeting smart home systems, including but not limited to SQL injection and XSS attacks. Based on more detailed attack behavior data, the system can generate more targeted protection strategies, effectively improving protection and reducing the risk of security vulnerabilities.

[0076] In this embodiment, a WebAssembly (WASM) Sidecar is deployed at the service layer to implement RASP (Runtime Application Self-Protection) functionality. This is an innovative, lightweight security solution that allows for real-time monitoring and defense against malicious attacks on applications, while enabling hot-swappable updates of the protection module without restarting the application process. The specific implementation steps are as follows:

[0077] 1) Deploying a WebAssembly Sidecar: Building a WASM Module: First, develop a WASM module containing RASP hooks for monitoring and analyzing application runtime behavior. WASM modules are ideal due to their small size, high performance, and cross-platform compatibility. Injecting the Sidecar: Utilize service mesh technologies such as Istio or Linkerd to inject the WASM module as a sidecar into each microservice container. The sidecar pattern means that the WASM module runs in parallel with the microservice process, sharing the network namespace but having independent linear memory, ensuring isolation and security. Hot-Swapping Mechanism: By configuring the JVM's JVMTI (Java Virtual Machine Tool Interface) or PHP's TSRM (ThreadSafe Resource Management), the WASM module can be dynamically loaded or unloaded without restarting the application process. This hot-swapping mechanism allows for immediate updates to protection policies, improving system responsiveness and flexibility.

[0078] 2) Real-time Monitoring and Defense: Monitoring Application Behavior: The WASM Sidecar module can directly read and monitor application function parameters, return values, and execution context. This means it can delve into the application logic layer to detect any anomalies or potential malicious activity. Application Self-Protection: RASP provides deep protection during application runtime, identifying and blocking attacks against the application, such as SQL injection, XSS (Cross-Site Scripting), or code injection. When the WASM module detects an attack, it can take immediate action, such as intercepting requests, logging, or triggering alerts.

[0079] 3) Policy Updates and Management: Policy Hot Migration: The policy layer pushes the latest protection policies and rules to the WASM Sidecar module of the service layer via the gRPC protocol. These updates can be completed within seconds without restarting the application process, enabling rapid deployment and updates of policies. Policy Version Control: Each policy update is accompanied by a version number and a git commit identifier, ensuring the traceability and consistency of the policy. The policy layer is also responsible for managing the policy lifecycle, such as canary releases and emergency rollbacks.

[0080] 4) Chain of Evidence and Compliance: Chain of Evidence Establishment: When detecting and handling malicious behavior, WASM Sidecar records detailed logs, including request IDs, triggered rules, and model confidence levels. This information constitutes a complete chain of evidence. Compliance Support: To meet compliance requirements of regulations such as GDPR, WASM Sidecar also integrates technical and organizational measures templates to ensure the transparency and legality of data processing.

[0081] The injection of the WASM Sidecar module is transparent to the application, requiring no modification to existing code or configuration, thus reducing deployment and maintenance complexity. Hot-swapping mechanisms and real-time policy updates ensure the system can respond quickly to new threats, improving overall security capabilities. Due to the high efficiency of the WASM module, its impact on application performance is minimal, maintaining system stability and responsiveness even under high loads.

[0082] Deploying a WebAssembly Sidecar at the service layer not only implements the RASP function (self-protection of runtime applications), but also ensures the timely updating and application of protection policies through a hot-swappable mechanism, effectively improving the security and stability of the smart home system while minimizing the impact on performance.

[0083] According to the above embodiments of the present invention, after the service layer of the smart home system receives the first network data packet, it analyzes the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data against the smart home system. This includes: dynamically generating JS maze code after the service layer of the smart home system obtains the first or second network data packet; encrypting the JS maze code using a session key to obtain encrypted JS maze code, wherein the session key is a temporary key generated by the service layer through the ECDH key exchange protocol; sending the encrypted JS maze code to the client of the smart home system, so that the client, upon receiving the encrypted JS maze code, decrypts and executes the JS maze code in its local environment and feeds back the execution result of the JS maze code to the service layer; and obtaining attack behavior data at the service layer based on the execution result.

[0084] In this embodiment, dynamic JS maze generation occurs as follows: After receiving a threat data packet, the service layer dynamically generates JS maze code. This JS maze code is encrypted using ECDH and then sent to the client for execution. The client executes the decrypted JS code and returns the execution result to the service layer for further attack behavior analysis.

[0085] The session key generated by the aforementioned ECDH key exchange protocol is used to encrypt the JS maze code, ensuring the security and privacy of code transmission. The dynamically generated JS maze code is difficult for advanced bots to execute completely; through feedback from the client's execution results, the service layer can identify non-human user behavior.

[0086] The bidirectional JS maze technology effectively identifies bots that cannot or do not fully simulate human behavior, reducing the chance of bots bypassing protection and improving the system's security level. Furthermore, the attack bypass rate has decreased from 25% to 3%, significantly enhancing security effectiveness. The open-source nature of the strategy library encourages community expansion and optimization, improving the system's adaptability and scalability.

[0087] like Figure 3As shown, the protection logic no longer relies on regular expressions. Instead, it performs an ECDH key exchange between the browser and the gateway to obtain the session master key. Both parties then obfuscate the JavaScript into a multi-path AST in real time: each path contains fake branches, junk instructions, and dynamic dead code; it is recompiled by Wasm every 30 seconds, and the hash value is sent back with the cookie; if an advanced bot cannot completely execute the JS maze, subsequent requests will lack the cookie signature and result in a 403 error. Furthermore, the policy engine uses a CRDT (Last-Writer-Wins Map + G-Counter) data structure. After any node modifies a rule, an incremental patch is broadcast via the gossip protocol at a granularity of 150 bytes / pattern, achieving network-wide consistency within milliseconds. To avoid push storms, nodes dynamically adjust the gossip fan-out based on CPU load, with high-load nodes automatically reducing their neighbor count; simultaneously, a Bloom filter removes duplicates, ensuring that the same policy version is only propagated once.

[0088] It should be noted that designing a bidirectional JS maze, combined with the ECDH (Elliptic Curve Diffie-Hellman) key exchange mechanism, is an advanced strategy to enhance the security and bot prevention capabilities of smart home systems. The core of this method lies in utilizing dynamically generated multi-path abstract syntax trees (ASTs) and encryption techniques to make it difficult for automated attack programs (bots) to understand and predict the system's behavior, thereby improving the defense effect. The specific design ideas and technical details are as follows:

[0089] 1) Introduction of ECDH Key Exchange: The ECDH key exchange protocol ensures that a unique session key is generated for each client-server interaction. Even if communication is intercepted, attackers will find it difficult to decrypt previous session data. In the bidirectional JS maze design, the role of ECDH is: Initializing the session key: During the initial interaction, the server and client generate a common key through the ECDH protocol. This key will be used for all subsequent request processing. Encrypting the JS maze: The server uses the session key to encrypt the dynamically generated JS maze, ensuring that even if the maze code is intercepted, it cannot be easily understood or cracked. Authentication: During the execution of the JS maze, the client uses the same key for decryption and verification, ensuring authentication between the client and server and preventing man-in-the-middle attacks.

[0090] 2) Dynamically Generated Multi-Path AST: The bidirectional JS maze goes a step further by dynamically generating a multi-path Abstract Syntax Tree (AST), ensuring that the JS code for each request is different, increasing the complexity and failure rate of bot attacks. Randomization Generation: On each request, the server randomly generates different JS function execution paths according to preset rules and algorithms. These paths contain mixed true and false conditional branches, garbage instructions, and dynamically dead code. Encrypted Transmission: The generated JS maze is encrypted using a key negotiated with ECDH and then sent as part of the response to the client. Client Execution Verification: After receiving the JS maze, the client executes it locally and sends back a specific signature or hash value in subsequent requests. Only clients that correctly execute the JS maze can generate the correct signature, thus passing the server's verification check.

[0091] 3) Bot Distinguishing Between Legitimate and Acquired Users: Bot Behavior Recognition: Advanced bots may fail to execute the encrypted JS maze or certain conditional branches during execution, thus failing to generate the correct signature. The server distinguishes between bots and legitimate users by checking the returned signature. Adaptive Adjustment: The strategy layer dynamically adjusts the complexity and obfuscation level of the JS maze based on the detected frequency and type of bot attacks to improve defense effectiveness.

[0092] ECDH key exchange and dynamic JS maze generation are completed within milliseconds, causing no significant latency and making them suitable for real-time interactive scenarios. Due to the efficient algorithms and mechanisms employed, actual resource consumption is low, with minimal impact on server and client performance. Open source and community expansion: The policy library's scripts and obfuscation algorithms are open source, allowing community members to extend and improve the system according to specific needs, enhancing its versatility and adaptability. Significantly reduced bypass rate: Compared to traditional protection methods, the dynamic nature and encryption mechanism of the bidirectional JS maze greatly reduce the probability of bots bypassing detection, improving the overall security of the system.

[0093] By combining a two-way JS maze and an ECDH key exchange mechanism, the smart home system can effectively resist Playwright-level bot attacks while ensuring the security and privacy of user data.

[0094] A bidirectional JavaScript maze is designed, utilizing the ECDH key exchange mechanism to ensure the uniqueness and security of each interaction. Advanced bots are deceiving and identified by dynamically generating multi-path ASTs. This series of operations is primarily implemented at the service layer, specifically during web request processing, particularly in the bidirectional communication between the client and server, as detailed below:

[0095] 1) Initialization phase: When a client accesses the server for the first time, the server generates a temporary session key through the ECDH key exchange protocol. This key is only valid in the current session, ensuring the uniqueness and security of each interaction.

[0096] 2) JS Maze Generation and Encryption Phase: After receiving the client's request, the server dynamically generates a complex JS maze code, including obfuscation elements such as multiple execution paths, fake branches, junk instructions, and dynamically dead code. The generated JS maze is then encrypted using the previously negotiated session key, and the encrypted code is sent to the client along with the response.

[0097] 3) Client Execution and Verification Phase: After receiving the encrypted JS maze code, the client decrypts and executes it locally. Due to the multi-path nature of the JS maze, only real human users or advanced bots capable of fully simulating human behavior can correctly execute all paths. After completing the JS maze execution, the client generates a verification signature or hash value based on the execution result and sends it back to the server as part of subsequent requests.

[0098] 4) Server Verification and Decision Phase: When the server receives subsequent requests from the client, it checks the verification signature or hash value contained in the request. If the signature matches the server's expected result, it means the client has correctly executed the JS maze and is therefore considered a legitimate user; conversely, if the signature does not match, it means the client may not be able to execute the JS maze or may not have completed it completely. This usually means that a bot that cannot fully simulate human behavior has been encountered, and the server will take corresponding actions according to its policy, such as denying service or logging.

[0099] Due to the dynamic generation and multi-path characteristics of the JS maze, even highly simulated bots struggle to achieve obfuscation through incomplete path execution, making them easily identifiable by the server. ECDH key exchange ensures all communication is encrypted; even if an attacker intercepts the JS maze code, they cannot decrypt its true content, increasing the overall security and privacy protection of the system. The WASM module in the service layer can update itself promptly based on the latest policies pushed by the policy layer, ensuring that the JS maze rules and obfuscation algorithms are always up-to-date to counter evolving bot attacks. By implementing bidirectional JS maze and ECDH key exchange in the service layer's request processing flow, the smart home system effectively enhances its security capabilities, especially against advanced bots attempting to bypass traditional security measures through automation.

[0100] According to the above embodiments of the present invention, generating a protection strategy for a smart home system based on attack behavior data includes: sending the attack behavior data to the decision layer of the smart home system, so that the attack behavior data is processed by the protection strategy generation model at the decision layer to obtain a protection strategy. The protection strategy generation model is a model trained by machine learning using multiple sets of training data. Each set of training data includes: sample attack behavior data and sample protection strategy corresponding to the attack behavior data.

[0101] In this embodiment, the service layer sends the collected attack behavior data to the decision layer. The decision layer processes the attack behavior data using a protection strategy generation model and automatically generates protection strategies.

[0102] It should be noted that the policy generation model is trained through machine learning and can adaptively generate effective protection policies based on multiple sets of training data (including attack behaviors and corresponding protection policies). The model generates policies that adapt to the current threat environment based on current attack behavior data, improving the real-time performance and effectiveness of the policies.

[0103] The strategy layer can quickly generate updated protection policies based on real-time attack behavior data, improving the system's response speed and protection capabilities against new threats. Through machine learning-trained models, the generation of protection policies is more intelligent, effectively reducing false positives, avoiding interference with legitimate users, and enhancing the user experience.

[0104] According to the above embodiments of the present invention, the protection strategy is used to dynamically protect the smart home system, including: sending the protection strategy to the service layer and the edge layer, so as to dynamically protect the smart home system at both the service layer and the edge layer.

[0105] In this embodiment, the protection policy generated by the decision layer is sent to the service layer and the edge layer via the gRPC protocol. The protection policy is executed simultaneously at the service layer and the edge layer, forming a unified defense mechanism.

[0106] This approach utilizes the CRDT (Conflict-free Replicated Data Type) data structure. After any node modifies its policy, incremental patches are updated to ensure a consistent policy across the entire network within milliseconds via the gossip protocol. Nodes dynamically adjust their gossip fan-out based on CPU load, with high-load nodes automatically reducing the number of neighbors to avoid excessive communication overhead.

[0107] The combination of the gRPC protocol and CRDT data structure achieves millisecond-level policy synchronization, ensuring that the defense strategy across the entire network remains consistent, thus improving the real-time performance and consistency of defense. Dynamically adjusting the gossip communication mechanism reduces unnecessary communication and resource consumption, improving the overall system performance and resource utilization.

[0108] According to the above embodiments of the present invention, after analyzing the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system, the dynamic protection method further includes: adjusting the protection level of the predetermined interface when it is determined from the attack behavior data that the frequency of attacks on the predetermined interface of the smart home system is greater than the frequency threshold.

[0109] In this embodiment, the service layer continuously monitors the frequency of attacks on each interface in the smart home system. When the attack frequency of an interface exceeds a preset threshold, the protection level of the interface is automatically adjusted to enhance its defense capabilities.

[0110] By monitoring the frequency of attacks on interfaces, the system can dynamically adjust the protection level according to the actual situation, achieving adaptive defense. High-risk interfaces receive a higher level of protection, while low-risk interfaces maintain a lower level of protection, in order to balance security and system performance.

[0111] This system dynamically adjusts protection levels to ensure the rational allocation of protection resources, providing more robust protection for high-risk interfaces and reducing the risk of lateral movement attacks. Through adaptive protection and resource optimization, the system can more effectively defend against various attacks while maintaining a good user experience and system performance.

[0112] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0113] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0114] Example 2

[0115] According to an embodiment of the present invention, an energy-saving control device for a water heater for implementing the above-described energy-saving control method for a water heater is also provided. Figure 4 This is a schematic diagram of an energy-saving control device for a water heater according to an embodiment of the present invention, such as... Figure 4 As shown, the device includes: an acquisition unit 401, an analysis unit 403, a generation unit 405, and a protection unit 407. The device will be described below.

[0116] The acquisition unit 401 is used to acquire a first network data packet in the smart home system through the edge layer of the smart home system, wherein the first network data packet is data that poses a potential threat to the smart home system.

[0117] The analysis unit 403 is used to analyze the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer after receiving the first network data packet at the service layer of the smart home system, so as to obtain attack behavior data on the smart home system. The second network data packet is data that the service layer has discovered that poses a potential threat to the smart home system.

[0118] The generation unit 405 is used to generate a protection strategy for the smart home system based on attack behavior data.

[0119] Protection unit 407 is used to dynamically protect the smart home system using protection strategies.

[0120] It should be noted that the acquisition unit 401, analysis unit 403, generation unit 405 and protection unit 407 mentioned above correspond to steps S202 to S208 in the above embodiments. The four units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiments.

[0121] As can be seen from the above, in the solution described in the above embodiments of the present invention, the acquisition unit can acquire the first network data packet of the smart home system through the edge layer of the smart home system. The first network data packet is data that poses a potential threat to the smart home system. After receiving the first network data packet at the service layer of the smart home system, the analysis unit analyzes the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data of the smart home system. The second network data packet is data that the service layer discovers poses a potential threat to the smart home system. The generation unit generates a protection strategy for the smart home system based on the attack behavior data. The protection unit uses the protection strategy to dynamically protect the smart home system, realizing threat capture at the edge layer. Real-time, low-latency data packets can complete the preliminary threat assessment and filter out potential threat data. Then, the WebAssembly Sidecar module performs in-depth analysis of the first and second network data packets at the service layer to identify specific attack behaviors. Based on the attack behavior data, the strategy layer uses a machine learning model to generate customized protection strategies to specifically deal with various attack types, thereby achieving the technical effect of improving the security of the smart home system.

[0122] Therefore, the technical solutions provided by the above embodiments of the present invention solve the technical problem that the network security protection methods of smart home systems in related technologies cannot cope with complex network environments and rapidly changing attack methods, thus posing security risks.

[0123] Optionally, the acquisition unit includes: a loading module for loading an eBPF program into the kernel of the smart home system in XDP mode, wherein the eBPF program is pre-written and used to define the processing method of network packets; and a capture module for capturing the first network packets in the smart home system using the eBPF program in the kernel.

[0124] Optionally, the capture module includes: a receiving submodule, used to receive network data packets via an eBPF program when network data packets arrive from the smart home system; an inspection submodule, used to inspect predetermined layer information of the network data packets using an eBPF program to determine whether the network data packets pose a potential threat to the smart home system; and a determination submodule, used to determine the data packets in the network data packets that pose a potential threat to the smart home system as the first network data packet.

[0125] Optionally, the analysis unit includes: an analysis module, used at the service layer to analyze predetermined information of the first network data packet and the second network data packet using function hooks and analysis logic built into the WebAssembly Sidecar module to obtain attack behavior data, wherein the predetermined information includes: HTTP / HTTPS requests, SQL statements, and environmental behavior.

[0126] Optionally, the analysis unit includes: a generation module, used to dynamically generate JS maze code after obtaining the first network data packet or the second network data packet at the service layer of the smart home system; an encryption module, used to encrypt the JS maze code using a session key to obtain encrypted JS maze code, wherein the session key is a temporary key generated by the service layer through the ECDH key exchange protocol; a first sending module, used to send the encrypted JS maze code to the client of the smart home system, so that the client, after receiving the encrypted JS maze code, decrypts and executes the JS maze code in its local environment, and feeds back the execution result of the JS maze code to the service layer; and an acquisition module, used to obtain attack behavior data at the service layer based on the execution result.

[0127] Optionally, the generation unit includes: a second sending module, used to send attack behavior data to the decision layer of the smart home system, so that the decision layer can process the attack behavior data using a protection strategy generation model to obtain a protection strategy. The protection strategy generation model is a model trained by machine learning using multiple sets of training data. Each set of training data includes: sample attack behavior data and sample protection strategy corresponding to the attack behavior data.

[0128] Optionally, the protection unit includes: a third sending module for sending protection policies to the service layer and the edge layer to provide dynamic protection for the smart home system at both the service layer and the edge layer.

[0129] Optionally, the dynamic protection device further includes: an adjustment unit, used to adjust the protection level of a predetermined interface when, after analyzing the first network data packet and the second network data packet through the WebAssemblySidecar module of the service layer to obtain attack behavior data on the smart home system, it is determined based on the attack behavior data that the frequency of attacks on a predetermined interface of the smart home system is greater than a frequency threshold.

[0130] According to another aspect of the present invention, a processor is also provided, which is used to run a program, wherein the program executes the dynamic protection method for a web service-based smart home system described above.

[0131] According to another aspect of the present invention, a computer program product is also provided, including computer instructions, which, when executed by a processor, perform any of the above-described methods for dynamic protection of a web service-based smart home system.

[0132] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium including a stored program, wherein the program executes the dynamic protection method for a web service-based smart home system described above.

[0133] Optionally, in this embodiment, the computer-readable storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any communication device in a group of communication devices.

[0134] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: acquiring a first network data packet from the smart home system through the edge layer of the smart home system, wherein the first network data packet is data that poses a potential threat to the smart home system; after the service layer of the smart home system receives the first network data packet, analyzing the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system, wherein the second network data packet is data that the service layer has discovered that poses a potential threat to the smart home system; generating a protection strategy for the smart home system based on the attack behavior data; and using the protection strategy to dynamically protect the smart home system.

[0135] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: loading an eBPF program into the kernel of the smart home system in XDP mode, wherein the eBPF program is pre-written and used to define the processing method of network packets; and capturing the first network packet in the smart home system using the eBPF program in the kernel.

[0136] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: receiving network data packets via an eBPF program when network data packets arrive at the smart home system; using the eBPF program to examine predetermined layer information of the network data packets to determine whether the network data packets pose a potential threat to the smart home system; and determining the data packets that pose a potential threat to the smart home system as the first network data packet.

[0137] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: at the service layer, using the function hooks and analysis logic built into the WebAssembly Sidecar module, pre-defined information of the first network data packet and the second network data packet is analyzed to obtain attack behavior data, wherein the pre-defined information includes: HTTP / HTTPS requests, SQL statements, and environmental behavior.

[0138] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: after the service layer of the smart home system obtains the first network data packet or the second network data packet, dynamically generating JS maze code; encrypting the JS maze code using a session key to obtain encrypted JS maze code, wherein the session key is a temporary key generated by the service layer through the ECDH key exchange protocol; sending the encrypted JS maze code to the client of the smart home system, so that after receiving the encrypted JS maze code, the client decrypts and executes the JS maze code in its local environment, and feeds back the execution result of the JS maze code to the service layer; and obtaining attack behavior data at the service layer based on the execution result.

[0139] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: sending attack behavior data to the decision layer of the smart home system, so that the attack behavior data is processed by the protection strategy generation model at the decision layer to obtain a protection strategy, wherein the protection strategy generation model is a model trained by machine learning using multiple sets of training data, and each set of multiple sets of training data includes: sample attack behavior data and sample protection strategy corresponding to the attack behavior data.

[0140] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: sending protection policies to the service layer and the edge layer to provide dynamic protection for the smart home system at both the service layer and the edge layer.

[0141] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: adjusting the protection level of the predetermined interface when it is determined from attack behavior data that the frequency of attacks on a predetermined interface of the smart home system is greater than a frequency threshold.

[0142] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0143] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0144] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0145] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0146] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0148] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0149] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A dynamic protection method for a web service-based smart home system, characterized in that, include: The first network data packet in the smart home system is obtained through the edge layer of the smart home system, wherein the first network data packet is data that poses a potential threat to the smart home system. After the service layer of the smart home system receives the first network data packet, it analyzes the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system. The second network data packet is data that the service layer has discovered that poses a potential threat to the smart home system. The smart home system's protection strategy is generated based on the attack behavior data. The aforementioned protection strategy is used to dynamically protect the smart home system.

2. The dynamic protection method for a web-based smart home system according to claim 1, characterized in that, The first network data packet of the smart home system is obtained through the edge layer of the smart home system, including: The eBPF program is loaded into the kernel of the smart home system in XDP mode, wherein the eBPF program is pre-written and used to define the processing method of network packets; The first network data packet in the smart home system is captured using the eBPF program within the kernel.

3. The dynamic protection method for a web-based smart home system according to claim 2, characterized in that, The first network data packet in the smart home system is captured using the eBPF program within the kernel, including: When a network data packet arrives in the smart home system, the network data packet is received through the eBPF program; The eBPF program is used to examine the predetermined layer information of the network packets to determine whether the network packets pose a potential threat to the smart home system. The first network data packet is identified as the data packet that poses a potential threat to the smart home system.

4. The dynamic protection method for a web-based smart home system according to claim 1, characterized in that, After the service layer of the smart home system receives the first network data packet, it analyzes the first and second network data packets through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system, including: The service layer utilizes the built-in function hooks and analysis logic of the WebAssembly Sidecar module to analyze predetermined information of the first network data packet and the second network data packet to obtain the attack behavior data. The predetermined information includes: HTTP / HTTPS requests, SQL statements, and environmental behavior.

5. The dynamic protection method for a web-based smart home system according to claim 1, characterized in that, After the service layer of the smart home system receives the first network data packet, it analyzes the first and second network data packets through the WebAssembly Sidecar module of the service layer to obtain attack behavior data on the smart home system, including: After the service layer of the smart home system obtains the first network data packet or the second network data packet, it dynamically generates JS maze code. The JS maze code is encrypted using a session key to obtain the encrypted JS maze code, wherein the session key is a temporary key generated by the service layer through the ECDH key exchange protocol; The encrypted JS maze code is sent to the client of the smart home system, so that after receiving the encrypted JS maze code, the client decrypts and executes the JS maze code in its local environment, and feeds back the execution result of the JS maze code to the service layer; The service layer obtains the attack behavior data based on the execution result.

6. The dynamic protection method for a web-based smart home system according to claim 1, characterized in that, Based on the attack behavior data, a protection strategy for the smart home system is generated, including: The attack behavior data is sent to the decision layer of the smart home system, where the attack behavior data is processed by the protection strategy generation model to obtain the protection strategy. The protection strategy generation model is a model trained by machine learning using multiple sets of training data. Each set of training data includes: sample attack behavior data and sample protection strategy corresponding to the attack behavior data.

7. The dynamic protection method for a web-based smart home system according to claim 1, characterized in that, The protection strategy is used to dynamically protect the smart home system, including: The protection strategy is sent to the service layer and the edge layer to provide dynamic protection for the smart home system simultaneously at both the service layer and the edge layer.

8. The dynamic protection method for a web-based smart home system according to claim 1, characterized in that, After analyzing the first and second network packets through the WebAssembly Sidecar module of the service layer to obtain attack behavior data against the smart home system, the dynamic protection method further includes: When the frequency of attacks on a predetermined interface of the smart home system is determined to be greater than a frequency threshold based on the attack behavior data, the protection level of the predetermined interface is adjusted.

9. A dynamic protection device for a web-based smart home system, characterized in that, include: The acquisition unit is used to acquire a first network data packet in the smart home system through the edge layer of the smart home system, wherein the first network data packet is data that poses a potential threat to the smart home system; The analysis unit is configured to analyze the first network data packet and the second network data packet through the WebAssembly Sidecar module of the service layer after the service layer of the smart home system receives the first network data packet, so as to obtain attack behavior data on the smart home system, wherein the second network data packet is data that the service layer has discovered to pose a potential threat to the smart home system; A generation unit is used to generate a protection strategy for the smart home system based on the attack behavior data. A protection unit is used to dynamically protect the smart home system using the protection strategy.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program executes the dynamic protection method for a web-based smart home system as described in any one of claims 1 to 8.

Images