Internet of Things equipment security assessment method based on big data analysis

Abstract

The invention discloses an Internet of Things equipment security assessment method based on big data analysis, and the method comprises the following steps: collecting multi-source security data, and carrying out the time alignment and data format unified processing, thereby obtaining standardized multi-source security data; aggregating the standardized multi-source security data in a device dimension to obtain multi-source security feature data; constructing basic trust distribution for each data source; carrying out credibility discount processing on the basic trust distribution to obtain discounted basic trust distribution; executing conjugate combination operation, and generating a conflict level identifier set based on the conflict credibility; carrying out redistribution processing on the conflict credibility by adopting a PCR5 conflict redistribution rule, and generating a fused security state credibility; and generating a security risk assessment result of the Internet of Things equipment, and outputting a security risk level. According to the invention, the accuracy and stability of the security assessment result of the Internet of Things equipment are improved.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to a method for security assessment of IoT devices based on big data analysis. Background Technology

[0002] IoT devices are widely deployed in industrial control, smart cities, and smart homes. These devices are numerous, heterogeneous in type, and operate in complex environments, often remaining online and continuously connected for extended periods. With the expanding attack surface, security incidents targeting IoT devices, such as malicious intrusions, remote control, firmware tampering, and abnormal communication, are frequent. Operations and maintenance teams typically need to continuously assess the security status of devices and output risk levels to support alarm linkage and response decisions. Current technologies generally rely on multi-source data analysis, including device logs, network traffic, firmware, and vulnerability information. Common practices include rule-based or feature-based anomaly detection, machine learning-based classification and scoring, and weighted aggregation or voting fusion of multi-source detection results to arrive at a device risk conclusion.

[0003] However, existing multi-source fusion assessment methods still have significant shortcomings in large-scale IoT scenarios. On the one hand, multi-source security data suffers from issues such as inconsistent timestamps, inconsistent formats, missing data, and excessive noise along the acquisition chain, making it difficult to reliably align detection conclusions from different sources on the same device and in the same time slice, further affecting the stability of subsequent feature extraction and assessment. On the other hand, the judgments on security status from multi-source data often show high conflict. For example, device logs may show normal data while network traffic shows suspicious outbound connections, or vulnerability intelligence may indicate high risk while operational behavior does not show any abnormalities in the short term. Traditional weighted averages, voting, or conventional normalization fusion based on DS evidence theory are prone to producing unreasonable fusion results in high-conflict scenarios, manifested as fluctuating risk levels, increased false positives and false negatives, or a lack of interpretable constraints on conflict sources. Existing technologies typically lack fine-grained modeling and discounting mechanisms for the credibility of data sources, failing to explicitly suppress the interference of low-credibility data on conclusions during the fusion stage, and also lacking hierarchical control strategies based on conflict intensity, making it difficult to adaptively adjust fusion behavior when the degree of conflict changes. In addition, contextual factors such as device type, deployment location, firmware lifecycle and historical security status have a significant impact on risk assessment. However, existing methods often do not take context as a constraint in the fusion process, which makes it difficult to meet the requirements of assessment consistency and engineering availability under large-scale deployment conditions.

[0004] Therefore, how to provide a security assessment method for IoT devices based on big data analysis is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a security assessment method for IoT devices based on big data analytics. This invention effectively reduces the impact of high-conflict and noisy data on the assessment results by standardizing multi-source security data, performing unified analysis of device and time-slice dimensions, and introducing a fusion mechanism based on credibility discounting and PCR5 conflict redistribution. In large-scale IoT deployment scenarios, this invention significantly improves the accuracy, stability, and consistency of security assessment results, while also enhancing the engineering applicability and scalability of the method.

[0006] A security assessment method for IoT devices based on big data analysis according to an embodiment of the present invention includes the following steps:

[0007] Collect multi-source security data generated by IoT devices during operation, and perform time alignment and data format unification processing to obtain standardized multi-source security data;

[0008] Taking IoT devices as the evaluation object, standardized multi-source security data is aggregated at the device dimension, and features are extracted at different time slices to obtain multi-source security feature data;

[0009] Based on multi-source security feature data, a basic trust allocation is constructed for each data source;

[0010] Based on multi-source feature security data, corresponding data source credibility parameters are generated, and the basic trust allocation is discounted based on the data source credibility parameters to obtain the discounted basic trust allocation.

[0011] Perform conjugate combination operation on the discounted basic trust assignment to obtain the initial combination trust degree and the conflict trust degree formed by the combination of mutually exclusive security states, and generate a set of conflict level identifiers based on the conflict trust degree;

[0012] Obtain the device context information corresponding to the IoT device, and combine it with the conflict level identifier set. Then, use the PCR5 conflict redistribution rule to redistribute the conflict trust level to generate the fused security status trust level.

[0013] Based on the fused security status trust level, a security risk assessment result for the IoT device is generated, and a security risk level is output.

[0014] Optionally, obtaining the standardized multi-source security data specifically includes:

[0015] Collect multi-source security data, extract device identifier, data source identifier, timestamp, and data content for each data record and write them into the record header, group data records with the same device identifier and the same data source identifier into the original data record set, and generate a collection batch identifier;

[0016] A reference time series is established for the set of original data records under the same device identifier. Each data record is mapped to the corresponding reference time point according to the timestamp. When there is no record at the reference time point, a missing identifier is written and a placeholder record is generated. The time-aligned data set corresponding to the reference time series is output.

[0017] Select format mapping rules for time-aligned data sets according to data source identifiers, perform format unification, and conduct standardization verification. Collect records that pass verification to form standardized multi-source security data.

[0018] Optionally, obtaining the multi-source security feature data specifically includes:

[0019] Standardized multi-source security data is grouped by device identifier, and data records with the same device identifier are grouped into the same device-level data set. Each record in the device-level data set carries a device identifier, a data source identifier, a reference time point, and data content in a uniform format. A device aggregation identifier is generated for each device-level data set.

[0020] For each device-level data set, a time slice set is established. Data records in the device-level data set are placed into the corresponding time slices according to the reference time points. Records within the same time slice are grouped into time slice data subsets. A time slice identifier is written to each time slice data subset and the range of reference time points covered by the current time slice is recorded.

[0021] Feature extraction processing is performed on each time slice data subset corresponding to each device aggregation identifier. Feature components are extracted from records from different data sources and the feature components are combined into time slice-level feature vectors in a preset order. For missing data sources, a missing identifier is written into the time slice-level feature vector while maintaining the consistency of the vector dimension. The time slice-level feature vectors corresponding to all time slices under the same device aggregation identifier are collected to form multi-source security feature data.

[0022] Optionally, the construction of the basic trust assignment specifically includes:

[0023] For multi-source security feature data, the location is determined by the device identifier and time slice identifier, and the data is split according to the data source identifier to obtain the feature vector of each data source in the corresponding device identifier and corresponding time slice. The feature vector of each data source is written into the device identifier, time slice identifier, and data source identifier, and a feature input unit is generated.

[0024] A security state set is constructed based on the feature input unit. The security state set includes normal state, intrusion state and uncertain state. A corresponding state trust allocation structure is established for each data source. The state trust allocation structure includes the trust degree for normal state, the trust degree for intrusion state and the trust degree for uncertain state, and the three are respectively denoted as normal trust degree, intrusion trust degree and uncertain trust degree.

[0025] For each data source within each device identifier and time slice, the intrusion confidence score and information sufficiency are calculated based on the feature input unit. The basic trust assignment for the current data source is generated based on the intrusion confidence score and information sufficiency. At the same time, the basic trust assignment is output for each data source within the same device identifier and time slice.

[0026] Optionally, obtaining the discounted basic trust allocation specifically includes:

[0027] Based on multi-source security feature data, the credibility calculation process is performed on the feature vector of each data source in the corresponding device identifier and the corresponding time slice to generate a data source credibility parameter that corresponds one-to-one with the multi-source security feature data.

[0028] Read the basic trust assignments, associate each basic trust assignment with the corresponding data source credibility parameter, and form a set of basic trust assignments to be discounted;

[0029] For each basic trust assignment set to be discounted, a trustworthiness discounting process is performed. For each basic trust assignment to be discounted, the corresponding data source trustworthiness parameter is used to merge with the normal state trustworthiness and intrusion state trustworthiness in the current basic trust assignment to obtain the discounted normal state trustworthiness and discounted intrusion state trustworthiness. The current data source trustworthiness parameter is then merged with the original uncertain state trustworthiness and written into the discounted uncertain state trustworthiness to form the discounted basic trust assignment.

[0030] Optionally, the generation of the conflict level identifier set specifically includes:

[0031] Read the security status set and the discounted basic trust allocation within the same device identifier and the same time slice, and organize them into triples. At the same time, gather the discounted basic trust allocations from each data source to form a fused input sequence.

[0032] Perform conjugate combination operation on the fused input sequence to generate initial combination trust. Iterate through the state value combinations after discounting the basic trust of each data source, calculate the trust product for each state value combination, and accumulate the trust product to the corresponding combination result. When the intersection of the state value combination on the state set is normal state, intrusion state, and uncertain state, respectively, accumulate the trust product to obtain the normal initial combination trust, intrusion initial combination trust, and uncertain initial combination trust in the initial combination trust. When the intersection of the state value combination on the state set is an empty set, accumulate the trust product to form the conflict trust and output it.

[0033] Two conflict classification thresholds are preset, and the conflict trust level is compared with the conflict classification thresholds. When the conflict trust level is less than the first threshold, a first conflict level identifier is generated. When the conflict trust level is greater than or equal to the first threshold and less than the second threshold, a second conflict level identifier is generated. When the conflict trust level is greater than or equal to the second threshold, a third conflict level identifier is generated. The conflict level identifiers are aggregated to generate a set.

[0034] Optionally, obtaining the fused security state trust level specifically includes:

[0035] Obtain the device context information corresponding to the IoT device, align and associate it with the conflict level identifier set, and generate the backfeed gating identifier and backfeed upper limit parameter based on the device context information;

[0036] The discounted basic trust assignments are grouped according to the data source category. The discounted basic trust assignments of data sources belonging to the same category are merged into a set of sub-fusion inputs. PCR5 conflict reassignment processing is performed independently on each sub-fusion input set to generate the sub-fusion security state trust degree. This sub-fusion security state trust degree is then combined with the sub-fusion security state trust degree corresponding to different categories to form a cross-category fusion input set.

[0037] The second-level PCR5 conflict redistribution process is performed on the cross-category fusion input set. In the second-level PCR5 conflict redistribution process, for each conflict item, it is first determined whether the current conflict item is allowed to be re-injected into the normal state or the intrusion state based on the re-injection gating flag. For conflict items that are allowed to be re-injected, the re-injection ratio is limited according to the re-injection upper limit parameter. The amount of conflict exceeding the re-injection upper limit is directly incorporated into the uncertainty state confidence level. For conflict items that are not allowed to be re-injected, all conflict amounts are incorporated into the uncertainty state confidence level.

[0038] When performing the second-layer PCR5 conflict redistribution process, a cross-time-slice conflict memory mechanism is introduced. The security status trust level of the same device after fusion in the previous time slice is read as the historical fusion baseline. When the conflict level indicator of the current time slice is higher than the preset level and is continuously consistent with the conflict level indicator of the previous time slice, the upper limit of the reflow ratio of the corresponding conflict item is increased. When the conflict level indicator of the current time slice is inconsistent with the previous time slice, the change range of the fusion result of the current time slice relative to the historical fusion baseline is limited. After completing the redistribution of all conflict items, the normal status trust level, the intrusion status trust level, and the uncertain status trust level after fusion are output to form the security status trust level after fusion.

[0039] Optionally, the output of the security risk level specifically includes:

[0040] Read the merged security status trust level, obtain the normal status trust level, intrusion status trust level and uncertain status trust level according to device and time slice, and perform consistency verification;

[0041] Pre-set uncertain penalty coefficients, calculate risk scores based on intrusion state trust level and uncertain state trust level, and associate and record risk scores with corresponding devices and time slices;

[0042] The system pre-sets a first risk classification threshold and a second risk classification threshold, outputs a risk level based on the risk score and the comparison between the two thresholds, and aggregates and outputs the safety risk assessment results.

[0043] The beneficial effects of this invention are:

[0044] This invention achieves unified modeling and analysis of large-scale, heterogeneous security data by performing time alignment and data format unification on multi-source security data continuously generated by IoT devices during operation, and by aggregating and extracting features at the device and time slice dimensions. It effectively solves the problems of difficulty in aligning multi-source data, feature dispersion, and instability of evaluation results as the data scale increases in the existing technology, thereby improving the overall consistency and scalability of security assessment in big data scenarios.

[0045] This invention introduces a basic trust allocation and trust discount mechanism based on the credibility of data sources during the security assessment process. Combined with conjugate combination operations and conflict level identification, it quantifies and classifies the degree of conflict between multi-source security evidence, avoiding the problem of distortion or drastic fluctuation of assessment results caused by traditional weighted or normalized fusion methods in high-conflict scenarios, and significantly improving the robustness of security status determination.

[0046] This invention further employs the PCR5 conflict redistribution rule, which combines device context information and conflict level, to finely redistribute conflict trust. While retaining the contribution of valid security evidence, it reasonably constrains the diffusion of uncertainty, making the fused security state trust more consistent with the actual operation and security evolution characteristics of IoT devices. This allows for stable output of security risk levels in complex and dynamic IoT environments, thereby improving the accuracy, stability, and engineering applicability of IoT device security assessment results. Attached Figure Description

[0047] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0048] Figure 1 This is a flowchart of a security assessment method for IoT devices based on big data analysis proposed in this invention;

[0049] Figure 2 This is a schematic diagram illustrating the fusion of conflict classification and PCR5 conflict redistribution in the IoT device security assessment method based on big data analysis proposed in this invention. Detailed Implementation

[0050] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0051] refer to Figure 1-2 A security assessment method for IoT devices based on big data analytics includes the following steps:

[0052] Collect multi-source security data generated by IoT devices during operation, and perform time alignment and data format unification processing to obtain standardized multi-source security data;

[0053] Taking IoT devices as the evaluation object, standardized multi-source security data is aggregated at the device dimension, and features are extracted at different time slices to obtain multi-source security feature data;

[0054] Based on multi-source security feature data, a basic trust assignment is constructed for each data source. The basic trust assignment is used to characterize the trust level of IoT devices in different security states.

[0055] Based on multi-source feature security data, corresponding data source credibility parameters are generated, and the basic trust allocation is discounted based on the data source credibility parameters to obtain the discounted basic trust allocation.

[0056] Perform conjugate combination operation on the discounted basic trust assignment to obtain the initial combination trust degree and the conflict trust degree formed by the combination of mutually exclusive security states, and generate a set of conflict level identifiers based on the conflict trust degree;

[0057] Obtain the device context information corresponding to the IoT device, and combine it with the conflict level identifier set. Then, use the PCR5 conflict redistribution rule to redistribute the conflict trust. The conflict trust is redistributed according to the ratio of the discounted basic trust allocation of the participants in forming the conflict to the corresponding data source trust parameter, and a fused security status trust is generated.

[0058] Based on the fused security status trust level, a security risk assessment result for the IoT device is generated, and a security risk level is output.

[0059] Collect multi-source security data generated by IoT devices during operation, and perform time alignment and data format unification processing to obtain standardized multi-source security data;

[0060] Taking IoT devices as the evaluation object, standardized multi-source security data is aggregated at the device dimension, and features are extracted at different time slices to obtain multi-source security feature data;

[0061] Based on multi-source security feature data, a basic trust allocation is constructed for each data source;

[0062] Based on multi-source feature security data, corresponding data source credibility parameters are generated, and the basic trust allocation is discounted based on the data source credibility parameters to obtain the discounted basic trust allocation.

[0063] Perform conjugate combination operation on the discounted basic trust assignment to obtain the initial combination trust degree and the conflict trust degree formed by the combination of mutually exclusive security states, and generate a set of conflict level identifiers based on the conflict trust degree;

[0064] Obtain the device context information corresponding to the IoT device, and combine it with the conflict level identifier set. Then, use the PCR5 conflict redistribution rule to redistribute the conflict trust level to generate the fused security status trust level.

[0065] Based on the fused security status trust level, a security risk assessment result for the IoT device is generated, and a security risk level is output.

[0066] In this embodiment, obtaining the standardized multi-source security data specifically includes:

[0067] Multi-source security data is collected through device-side acquisition interfaces, network-side acquisition interfaces, and information data acquisition interfaces. For each data record, the device identifier, data source identifier, timestamp, and data content are extracted and written into the record header. Data records with the same device identifier and the same data source identifier are grouped into the original data record set and a collection batch identifier is generated.

[0068] A reference time series is established for the set of original data records under the same device identifier. Each data record is mapped to the corresponding reference time point according to the timestamp. When different records are mapped to the same reference time point, one record is retained according to the preset priority rule and a conflict handling flag is written. When there is no record at the reference time point, a missing flag is written and a placeholder record is generated. The time-aligned data set corresponding to the reference time series is output.

[0069] For time-aligned datasets, select format mapping rules based on data source identifiers, and implement format unification, including unified field names, field types, units, and codes. At the same time, perform standardization verification, including verification of required fields, type verification, and timestamp consistency verification. Collect records that pass the verification to form standardized multi-source secure data.

[0070] In this embodiment, obtaining the multi-source security feature data specifically includes:

[0071] Standardized multi-source security data is grouped by device identifier, and data records with the same device identifier are grouped into the same device-level data set. Each record in the device-level data set carries a device identifier, a data source identifier, a reference time point, and data content in a uniform format. A device aggregation identifier is generated for each device-level data set.

[0072] For each device-level data set, a time slice set is established. The time slice set consists of multiple time slices arranged in chronological order. Each time slice is determined by the start time and the time slice length. The time slice is a sliding time window or a fixed time window. Incremental update processing is performed on continuous data according to a preset step size. Data records in the device-level data set are placed into the corresponding time slice according to the reference time point. Records within the same time slice are merged into a time slice data subset. A time slice identifier is written to each time slice data subset and the range of reference time points covered by the current time slice is recorded.

[0073] Feature extraction processing is performed on each time slice data subset corresponding to each device aggregation identifier. Feature components are extracted from records from different data sources and the feature components are combined into time slice-level feature vectors in a preset order. For missing data sources, a missing identifier is written into the time slice-level feature vector while maintaining the consistency of the vector dimension. The time slice-level feature vectors corresponding to all time slices under the same device aggregation identifier are collected to form multi-source security feature data.

[0074] In this embodiment, the construction of the basic trust allocation specifically includes:

[0075] For multi-source security feature data, the location is determined by the device identifier and time slice identifier, and the data is split according to the data source identifier to obtain the feature vector of each data source in the corresponding device identifier and corresponding time slice. The feature vector of each data source is written into the device identifier, time slice identifier, and data source identifier, and a feature input unit is generated.

[0076] A security state set is constructed based on the feature input unit. The security state set includes a normal state, an intrusion state, and an uncertain state. The uncertain state is used to characterize the state whose attribution cannot be determined by the feature input unit. A corresponding state trust allocation structure is established for each data source. The state trust allocation structure includes the trust degree for the normal state, the trust degree for the intrusion state, and the trust degree for the uncertain state. The three are respectively denoted as the normal trust degree, the intrusion trust degree, and the uncertain trust degree.

[0077] For each data source within each device identifier and time slice, an intrusion confidence score and information sufficiency are calculated based on the feature input unit. The intrusion confidence score characterizes the strength of the data source's support for the intrusion state, and the information sufficiency characterizes the proportion of effective information from the feature input unit of the data source for state determination. A basic trust assignment is generated for the current data source based on the intrusion confidence score and information sufficiency. The basic trust assignment uses the product of information sufficiency and intrusion confidence score as the intrusion trust score, the product of information sufficiency and one minus the intrusion confidence score as the normal trust score, and one minus information sufficiency as the uncertain trust score. The sum of the normal trust score, the intrusion trust score, and the uncertain trust score is equal to one. At the same time, basic trust assignments are output for each data source within the same device identifier and the same time slice.

[0078] This invention constructs a unified trust allocation framework that includes three states: normal, intrusion, and uncertain, by performing source decomposition and structured encapsulation of multi-source security features at the device and time slice granularity. The basic trust allocation is driven by intrusion confidence score and information sufficiency, which enables the quantitative expression of evidence from different sources on a comparable scale and explicitly leaves blanks for missing or insufficient information. This reduces the risk of misjudgment caused by bias from a single source or data gaps, and improves the stability and controllability of subsequent fusion and risk assessment.

[0079] In this embodiment, obtaining the discounted basic trust allocation specifically includes:

[0080] Based on multi-source security feature data, the credibility calculation process is performed on the feature vector of each data source in the corresponding device identifier and the corresponding time slice to generate a data source credibility parameter that corresponds one-to-one with the multi-source security feature data.

[0081] Read the basic trust assignments and associate each basic trust assignment with the corresponding data source trust parameters. The basic trust assignments include the trust level for the normal state, the trust level for the intrusion state, and the trust level for the uncertain state, forming a set of basic trust assignments to be discounted.

[0082] For each basic trust assignment set to be discounted, a trustworthiness discounting process is performed. For each basic trust assignment to be discounted, the corresponding data source trustworthiness parameter is used to merge with the normal state trustworthiness and intrusion state trustworthiness in the current basic trust assignment to obtain the discounted normal state trustworthiness and discounted intrusion state trustworthiness. The current data source trustworthiness parameter is then merged with the original uncertain state trustworthiness and written into the discounted uncertain state trustworthiness. This ensures that the sum of the discounted normal state trustworthiness, discounted intrusion state trustworthiness, and discounted uncertain state trustworthiness equals one, forming the discounted basic trust assignment.

[0083] In this embodiment, the generation of the conflict level identifier set specifically includes:

[0084] Read the security state set and the discounted basic trust allocation of the same device identifier and the same time slice, and organize them into triples. The triples correspond to the trust level of normal state, trust level of intrusion state and trust level of uncertain state, respectively. At the same time, the discounted basic trust allocation of each data source is aggregated to form a fusion input sequence.

[0085] Perform conjugate combination operation on the fused input sequence to generate initial combination trust. Iterate through the state value combinations after discounting the basic trust of each data source, calculate the trust product for each state value combination, and accumulate the trust product to the corresponding combination result. When the intersection of the state value combination on the state set is normal state, intrusion state, and uncertain state, respectively, accumulate the trust product to obtain the normal initial combination trust, intrusion initial combination trust, and uncertain initial combination trust in the initial combination trust. When the intersection of the state value combination on the state set is an empty set, accumulate the trust product to form the conflict trust and output it.

[0086] Two conflict classification thresholds are preset, and the conflict trust level is compared with the conflict classification thresholds. When the conflict trust level is less than the first threshold, a first conflict level identifier is generated. When the conflict trust level is greater than or equal to the first threshold and less than the second threshold, a second conflict level identifier is generated. When the conflict trust level is greater than or equal to the second threshold, a third conflict level identifier is generated. The conflict level identifiers are aggregated to generate a set.

[0087] This invention unifies the basic trust allocation of each data source after discounting into triples and performs conjugate combination operations. It explicitly calculates and outputs the conflict trust degree formed by the empty intersection of mutually exclusive states. Then, it classifies the conflict intensity based on a preset threshold and aggregates them to form a conflict level identifier set. In the case of high conflict in multi-source evidence, this invention enables the quantitative characterization and controllable management of the conflict degree, reduces the random fluctuation and distortion risk of the fusion results, and provides a stable constraint basis for subsequent conflict redistribution.

[0088] In this embodiment, obtaining the security state trust level after fusion specifically includes:

[0089] Obtain device context information corresponding to IoT devices. The device context information is a structured set of information used to characterize the type attributes, operating status and security history characteristics of IoT devices within a specific time slice. It is aligned and associated with a conflict level identifier set. The alignment is established at the granularity of device and time slice, so that each device corresponds to one device context information and one conflict level identifier in each time slice. Based on the device context information, a backfeed gating identifier and a backfeed upper limit parameter are generated. The backfeed gating identifier is used to indicate whether the conflict amount is allowed to backfeed to the normal state or the intrusion state. The backfeed upper limit parameter is used to limit the maximum conflict ratio that can be backfeeded in a single conflict redistribution.

[0090] The discounted basic trust assignments are grouped according to the data source category. The discounted basic trust assignments of data sources belonging to the same category are merged into a sub-fusion input set. PCR5 conflict reassignment processing is performed independently on each sub-fusion input set to generate a sub-fusion security state trust degree. The sub-fusion security state trust degree serves as a new fusion input unit and together with the sub-fusion security state trust degrees corresponding to different categories, they form a cross-category fusion input set.

[0091] The second-level PCR5 conflict redistribution process is performed on the cross-category fusion input set. In the second-level PCR5 conflict redistribution process, for each conflict item, it is first determined whether the current conflict item is allowed to be re-injected into the normal state or the intrusion state based on the re-injection gating flag. For conflict items that are allowed to be re-injected, the re-injection ratio is limited according to the re-injection upper limit parameter. The amount of conflict exceeding the re-injection upper limit is directly incorporated into the uncertainty state confidence level. For conflict items that are not allowed to be re-injected, all conflict amounts are incorporated into the uncertainty state confidence level.

[0092] When performing the second-layer PCR5 conflict redistribution process, a cross-time-slice conflict memory mechanism is introduced. The security status trust level of the same device after fusion in the previous time slice is read as the historical fusion baseline. When the conflict level indicator of the current time slice is higher than the preset level and is continuously consistent with the conflict level indicator of the previous time slice, the upper limit of the reflow ratio of the corresponding conflict item is increased. When the conflict level indicator of the current time slice is inconsistent with the previous time slice, the change range of the fusion result of the current time slice relative to the historical fusion baseline is limited. After completing the redistribution of all conflict items, the normal status trust level, the intrusion status trust level, and the uncertain status trust level after fusion are output to form the security status trust level after fusion.

[0093] This invention introduces a hierarchical PCR5 conflict redistribution algorithm that combines device context information, conflict level control, and cross-time-slice memory mechanisms. This structurally improves the evidence fusion process in high-conflict, high-noise IoT multi-source security data scenarios. The re-injection of conflict data no longer relies on simple normalization or static weights, but is constrained by the credibility of the data source, the device operating background, and the conflict evolution trend. This effectively suppresses the amplification effect of abnormal data or short-term noise on the evaluation results, avoids drastic fluctuations in security status between adjacent time slices, and enhances the sensitivity of the fusion results to real attack behaviors and the controllability of uncertainties. Ultimately, this significantly enhances the accuracy, stability, and engineering applicability of security assessment results under large-scale IoT deployment conditions.

[0094] In this embodiment, the output of the security risk level specifically includes:

[0095] Read the merged security status trust level, obtain the normal status trust level, intrusion status trust level and uncertain status trust level according to device and time slice, and perform consistency verification;

[0096] Pre-set uncertain penalty coefficients, calculate risk scores based on intrusion state trust level and uncertain state trust level, and associate and record risk scores with corresponding devices and time slices;

[0097] The system pre-sets a first risk classification threshold and a second risk classification threshold, outputs a risk level based on the risk score and the comparison between the two thresholds, and aggregates and outputs the safety risk assessment results.

[0098] Example 1:

[0099] To verify the feasibility of this invention in practice, it was applied to a continuous security assessment scenario for an enterprise-level IoT network. This scenario involves a diverse range of IoT devices operating simultaneously, including edge devices such as access controllers, industrial gateways, environmental sensors, and video edge boxes, as well as control nodes for device management and data aggregation. These devices generally exhibit characteristics of long-term online operation, periodic reporting, passive control, and intermittent upgrades. A prominent security challenge is the frequent and phased conflicts between multiple sources of security evidence. A typical phenomenon is that while device logs show no obvious anomalies for an extended period, suspected command and control communication appears on the network side, or vulnerability information indicates an increased risk. However, short-term behavioral characteristics remain close to normal. Traditional weighted scoring and simple voting can lead to frequent changes in risk levels during peak conflict periods, resulting in a concentrated outbreak of false alarms and triggering a large number of ineffective actions. At the same time, due to the drift of timestamps, inconsistent formats, and numerous missing data from multiple sources, evidence from the same device within the same observation window cannot be stably aligned, further amplifying the uncertainty of fusion and making it difficult for security operations personnel to form a sustainable risk handling loop. The problem that this embodiment needs to solve is to stably output usable security status trust and risk level and improve the accuracy and stability of the assessment under the conditions of multiple devices, multiple time slices, strong conflicts of multiple source evidence, and unstable data engineering quality.

[0100] In this scenario, the system accesses multi-source security data, including device-side operation logs, network-side communication traffic summaries and connection metadata, firmware and vulnerability information summaries, etc. First, the multi-source data is time-aligned and formatted, mapping data records from different sources to a unified reference time series and filling in missing placeholders. At the same time, the field names, types, units, and codes are unified, and consistency checks are performed on required fields, types, and timestamps to obtain standardized multi-source security data that can be directly used for calculation. Then, taking the device as the evaluation object, the standardized multi-source security data is aggregated at the device level, and a continuous time-slice data subset is formed for each device with a fixed-length time slice. Within each time slice, feature components are extracted from records from different sources and assembled into a time-slice-level feature vector in a unified order. Missing sources are written with missing identifiers and the vector dimensions are kept consistent to form multi-source security feature data.

[0101] In the evidence modeling phase, for each data source, each device, and each time slice, intrusion confidence score and information sufficiency are calculated from the feature vector. The intrusion confidence score represents the strength of support for the intrusion state from that source, and the information sufficiency represents the proportion of effective information from that source within the current time slice. Based on this, a basic trust assignment including normal, intrusion, and uncertain states is generated, so that evidence from different sources on the same device within the same time slice is expressed under the same dimension, while the uncertainty quality is explicitly reserved for sources with insufficient information. Next, based on multi-source security feature data, the data source credibility parameter of each data source within the corresponding device and time slice is calculated. This credibility parameter is associated with the basic trust assignment and credibility discounting is performed, so that the contribution of low-credibility sources to the normal and intrusion states is suppressed and the corresponding quality is transferred to the uncertain state, resulting in the discounted basic trust assignment. In the fusion phase, the discounted basic trust assignment is first subjected to a conjugate combination operation to obtain the initial combined trust score and conflict trust score. The conflict trust score is then classified into a conflict level identifier set through a preset threshold, so that the subsequent fusion can perceive the conflict intensity.

[0102] Subsequently, device context information is introduced and associated with conflict level identifiers at the device and time slice granularity. Based on the context, a refeedback gating identifier and refeedback upper limit parameter are generated. A hierarchical PCR5 conflict redistribution mechanism is used for fusion. First, PCR5 is performed within each group according to data source category to obtain the sub-fusion security state trust level. Then, a second-layer PCR5 is performed on the cross-category fusion input set. For each conflict item, the gating identifier first determines whether refeedback to normal or intrusion is allowed, and then the refeedback upper limit parameter limits the refeedback ratio. Conflicts exceeding the upper limit or prohibited by gating are directly incorporated into the uncertain state. Simultaneously, a cross-time slice conflict memory mechanism is introduced to read the fusion-after-fusion security state information of the same device in the previous time slice. As a historical fusion baseline, the system increases the upper limit of the backfeedback ratio to enhance sensitivity to continuous attack signals when the conflict level is consistent and at a high level. When the conflict level changes, the system limits the change in the fusion result relative to the historical baseline to suppress level jumps caused by short-term noise. Finally, it outputs the fusion-based trust levels of normal, intrusion, and uncertain states. In the risk output phase, the system performs consistency verification on the fusion-based trust level of each device for each time slice, sets an uncertainty penalty coefficient to control the impact of uncertainty on the risk score within an interpretable range, generates a risk score, and outputs the risk level based on two threshold levels. The security operations side uses the risk level to drive alarms, isolation, and review to achieve stable closed-loop handling.

[0103] To provide verifiable data demonstrating the beneficial effects of this invention, comparative schemes were set up and evaluated in parallel using the same equipment and the same data acquisition link. Comparison scheme A used a weighted average of multi-source scores and directly output the risk level. Comparison scheme B used conventional evidence fusion but employed normalization processing in cases of high conflict and did not perform conflict classification or context gating. Comparison scheme C did not perform credibility discounting before evidence fusion and did not introduce cross-time-slice constraints. The specific comparative data are shown in the table below:

[0104] Table 1 Performance Comparison of Multi-Source IoT Security Assessment Methods

[0105] index Option A Option B Option C This invention Overall accuracy 93.80% 95.10% 94.60% 97.30% False alarm rate 4.90% 3.80% 4.20% 2.20% underreporting rate 18.60% 16.20% 17.40% 11.50% Average number of time-conflict risk level jumps per device (times / device) 2.70 2.10 2.40 0.80 Median fluctuation of trust level in intrusions in adjacent time slices of the same device 0.23 0.19 0.21 0.11 Multi-source alignment rate 92.60% 92.60% 92.60% 99.10% Unavailable sample proportion 2.30% 2.30% 2.30% 0.40% Median time (milliseconds) for single-time-slice fusion 18 28 24 21 Throughput stability (device time slices / second) 20000 15000 17000 19000 Inefficient work order review 46% 34% 39% 27%

[0106] As shown in Table 1, in scenarios with a significant increase in the number of devices and time slice size, and frequent conflicts among multi-source evidence, this invention achieves the best results in core indicators such as overall accuracy, false positive rate, and false negative rate. The accuracy reaches 97.30%, and the false positive rate and false negative rate are reduced to 2.20% and 11.50%, respectively. At the same time, it significantly suppresses frequent jumps in risk levels in high-conflict time slices, with the average number of device-level risk level jumps reduced to 0.80 times, which is significantly better than the comparison scheme. At the data engineering level, this invention significantly improves the alignment rate of multi-source data and reduces the proportion of unusable samples through standardized alignment and hierarchical fusion mechanisms, providing stable input for subsequent fusion. In terms of operational efficiency, hierarchical PCR5 fusion keeps the processing time and throughput stability of a single time slice at an engineering-deployable level. In addition, the explicit output of conflict level and uncertainty effectively reduces the inefficiency of manual review, further verifying the practical value and comprehensive advantages of this invention in large-scale IoT security assessment.

[0107] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A security assessment method for IoT devices based on big data analytics, characterized in that, The method comprises the following steps: Collecting multi-source security data generated by the Internet of Things device during operation, and performing time alignment and data format unification processing to obtain standardized multi-source security data; Taking the Internet of Things device as the evaluation object, aggregating the standardized multi-source security data in the device dimension, and extracting features in different time slices to obtain multi-source security feature data; Based on the multi-source security feature data, constructing a basic trust allocation for each data source; Generating a data source credibility parameter corresponding to the multi-source security feature data, and performing credibility discount processing on the basic trust allocation based on the data source credibility parameter to obtain a discounted basic trust allocation; Performing conjugate combination operation on the discounted basic trust allocation to obtain initial combined trust degree and conflict trust degree formed by mutually exclusive security state combinations, and generating a conflict level identifier set based on the conflict trust degree; Obtaining device context information corresponding to the Internet of Things device, combining the conflict level identifier set, and using the PCR5 conflict redistribution rule to redistribute the conflict trust degree to generate a fused security state trust degree; Generating a security risk evaluation result of the Internet of Things device according to the fused security state trust degree, and outputting a security risk level. 2.The method of claim 1, wherein, The standardized multi-source security data is obtained specifically as follows: Collecting multi-source security data, extracting device identifier, data source identifier, timestamp, and data content for each data record and writing them into the record header, grouping data records with the same device identifier and the same data source identifier into an original data record set, and generating a collection batch identifier; For the original data record set under the same device identifier, a reference time sequence is established, each data record is mapped to the corresponding reference time point according to the timestamp, a missing identifier is written and a placeholder record is generated when there is no record at the reference time point, and a time alignment data set corresponding to the reference time sequence is outputted; For the time alignment data set, a format mapping rule is selected according to the data source identifier, format unification is performed, and standardization verification is performed at the same time, and records passing the verification are grouped to form standardized multi-source security data. 3.The method of claim 1, wherein, The multi-source security feature data is obtained specifically as follows: Grouping the standardized multi-source security data according to the device identifier, merging data records with the same device identifier into the same device-level data set, each record in the device-level data set carrying the device identifier, the data source identifier, the reference time point, and the unified format data content, and generating a device aggregation identifier for each device-level data set; For each device-level data set, a time slice set is established, the data records in the device-level data set are divided into corresponding time slices according to the reference time point, and the records in the same time slice are merged into a time slice data subset, and a time slice identifier is written for each time slice data subset and the reference time point range covered by the current time slice is recorded; The feature extraction processing is performed on each device aggregation identifier corresponding to each time slice data subset, feature components are extracted from records of different data sources respectively, and each feature component is composed into a time slice level feature vector in a preset order, a missing identifier is written in the time slice level feature vector for a missing data source and the vector dimension is kept consistent, time slice level feature vectors corresponding to all time slices under the same device aggregation identifier are collected, and multi-source security feature data is formed. 4.The method of claim 1, wherein, The construction of the basic trust allocation specifically includes: For the multi-source security feature data, positioning is performed according to the device identifier and the time slice identifier, and splitting processing is performed according to the data source identifier, to obtain a feature vector of each data source in a corresponding device identifier and a corresponding time slice, the device identifier, the time slice identifier and the data source identifier are written in the feature vector of each data source, and a feature input unit is generated; A security state set is constructed based on the feature input unit, the security state set includes a normal state, an intrusion state and an uncertain state, a corresponding state trust allocation structure is established for each data source, the state trust allocation structure includes a trust degree for the normal state, a trust degree for the intrusion state and a trust degree for the uncertain state, and the three are respectively denoted as a normal trust degree, an intrusion trust degree and an uncertain trust degree; For each data source in each device identifier and each time slice, an intrusion confidence score and an information sufficiency degree are calculated based on the feature input unit, a basic trust allocation of the current data source is generated according to the intrusion confidence score and the information sufficiency degree, and the basic trust allocation of each data source in the same device identifier and the same time slice is output.

5. The method of claim 1, wherein, The discounted basic trust allocation is obtained specifically by: According to the multi-source security feature data, a feature vector of each data source in a corresponding device identifier and a corresponding time slice is subjected to trustworthiness calculation processing, and a data source trustworthiness parameter corresponding to the multi-source security feature data is generated; The basic trust allocation is read, each basic trust allocation is associated with a corresponding data source trustworthiness parameter to form a set of basic trust allocations to be discounted; The set of basic trust allocations to be discounted is subjected to trustworthiness discounting processing, for each basic trust allocation to be discounted, the corresponding data source trustworthiness parameter is fused with the normal state trust degree and the intrusion state trust degree in the current basic trust allocation to obtain a discounted normal state trust degree and a discounted intrusion state trust degree, and the current data source trustworthiness parameter and the original uncertain state trust degree are combined to write into a discounted uncertain state trust degree, to form a discounted basic trust allocation.

6. The method of claim 1, wherein, The generation of the conflict level identifier set specifically includes: The security state set and the discounted basic trust allocation in the same device identifier and the same time slice are read and arranged in a triple form, and the discounted basic trust allocation of each data source is collected to form a fusion input sequence; The conjugate combination operation is performed on the fusion input sequence to generate an initial combination trust degree, state value combinations of the basic trust allocation after discounting of each data source are traversed, a trust degree product is calculated for each state value combination, and the trust degree product is accumulated to the corresponding combination result, when the intersection of the state value combinations on the state set is normal state, intrusion state and uncertain state respectively, the trust degree product is accumulated to the normal initial combination trust degree, the intrusion initial combination trust degree and the uncertain initial combination trust degree in the initial combination trust degree respectively, when the intersection of the state value combinations on the state set is an empty set, the trust degree product is accumulated to form a conflict trust degree and is output; Two conflict grading thresholds are set in advance, and the conflict trust degree is compared with the conflict grading thresholds, when the conflict trust degree is less than the first threshold, a first conflict level identifier is generated, when the conflict trust degree is greater than or equal to the first threshold and less than the second threshold, a second conflict level identifier is generated, when the conflict trust degree is greater than or equal to the second threshold, a third conflict level identifier is generated, and a conflict level identifier set is generated.

7. The method of claim 1, wherein, The fusion security state trust degree specifically includes: Device context information corresponding to the Internet of Things device is obtained, and is aligned and associated with the conflict level identifier set, a back-filling gate control identifier and a back-filling upper limit parameter are generated based on the device context information; The basic trust allocation after discounting is grouped according to the data source category, the basic trust allocation after discounting of the data sources belonging to the same category is merged into a sub-fusion input set, the PCR5 conflict redistribution processing is independently performed on each sub-fusion input set to generate a sub-fusion security state trust degree, and the sub-fusion security state trust degrees corresponding to different categories together constitute a cross-category fusion input set; The second layer PCR5 conflict redistribution processing is performed on the cross-category fusion input set, in the second layer PCR5 conflict redistribution processing, for each conflict item, firstly, whether the current conflict item is allowed to backfill to the normal state or the intrusion state is judged according to the back-filling gate control identifier, for the conflict item allowed to backfill, the backfilling proportion is limited according to the back-filling upper limit parameter, the conflict quantity exceeding the back-filling upper limit is directly merged into the uncertain state trust degree, and for the conflict item not allowed to backfill, all the conflict quantity is merged into the uncertain state trust degree; When the second layer PCR5 conflict redistribution processing is performed, a cross-time slice conflict memory mechanism is introduced, the fusion security state trust degree of the same device in the previous time slice is read as a historical fusion baseline, when the conflict level identifier of the current time slice is higher than a preset level and is consistent with the conflict level identifier of the previous time slice continuously, the backfilling proportion upper limit of the corresponding conflict item is increased, when the conflict level identifier of the current time slice is inconsistent with that of the previous time slice, the change amplitude of the fusion result of the current time slice relative to the historical fusion baseline is limited, after the redistribution of all conflict items is completed, the fusion normal state trust degree, the fusion intrusion state trust degree and the fusion uncertain state trust degree are output, and the fusion security state trust degree is formed. 8.The method of claim 1, wherein, The output of the security risk level specifically includes: Read the fused security state trust degree, obtain the normal state trust degree, the intrusion state trust degree and the uncertain state trust degree according to the device and the time slice, and perform consistency check; Pre-set the uncertain penalty coefficient, calculate the risk score based on the intrusion state trust degree and the uncertain state trust degree, and record the risk score associated with the corresponding device and time slice; Pre-set the first risk classification threshold and the second risk classification threshold, output the risk level based on the comparison of the risk score and the two thresholds, and output the security risk assessment result.

Images