Internet of things security cooperative defense method, system, device and medium

Abstract

The invention discloses an Internet of Things security cooperative defense method, system and device and a medium, the method comprises the following steps: obtaining a baseline detection model and receiving user connection data from a user side, the baseline detection model being used for indicating a dynamic baseline range of round-trip delay of a plurality of normal connection data under a current time window; performing first data verification on the user connection data through a first filter to obtain first verification information output by the first filter; when the first verification information indicates that verification is passed, performing baseline detection on the user connection data according to the baseline detection model to obtain baseline detection information; and if the baseline detection information indicates that the baseline detection is passed, forwarding the user connection data to a server, so that the server establishes a communication connection with the user side according to the user connection data. According to the method, the security defense effect of the Internet of Things can be effectively improved. The invention relates to the technical field of Internet of Things security.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) security technology, and in particular to an IoT security collaborative defense method, system, device, and medium. Background Technology

[0002] With the continuous development of IoT security technology, SYN Flood attacks are a common form of attack in IoT scenarios, and autonomous defense against SYN Flood attacks has become one of the concerns of relevant personnel.

[0003] Currently, relevant technologies typically employ lightweight Bloom filters (BFs) for initial filtering at the network edge (such as switches). However, because the inherent false positive rate of BFs accumulates non-linearly with the ongoing SYN Flood attack, it is easy for a large amount of invalid traffic that should have been blocked to penetrate the defense layer and flood into the network where the server resides, resulting in poor IoT security defense.

[0004] Therefore, the problems existing in the current technology still need to be solved and optimized. Summary of the Invention

[0005] To address at least one of the aforementioned technical problems, this application provides a method, system, device, and medium for collaborative security defense of the Internet of Things (IoT), wherein the method can effectively improve the effectiveness of IoT security defense.

[0006] According to a first aspect of this application, an IoT security collaborative defense method is provided, applied to an agent end, the method comprising: The baseline detection model is obtained and user connection data from the user terminal is received. The baseline detection model is used to indicate the dynamic baseline range of round-trip delay of several normal connection data under the current time window. The user connection data is subjected to a first data verification through a first filter to obtain the first verification information output by the first filter. If the first verification information is verified, then baseline detection is performed on the user connection data according to the baseline detection model to obtain baseline detection information; If the baseline detection information indicates that the baseline detection is successful, the user connection data is forwarded to the server so that the server can establish a communication connection with the user based on the user connection data.

[0007] In some embodiments, obtaining the baseline detection model includes: Obtain the neighboring dataset and the current time window, wherein the neighboring dataset is a collection of normal user connection data within the most recent time period; Based on the current time window, the neighboring dataset is filtered to obtain several normal connection data; Perform latency analysis on the round-trip latency of all the normal connection data to obtain average latency data and standard latency difference data; The dynamic baseline range is determined based on the average latency data and the standard latency difference data.

[0008] In some embodiments, the step of performing baseline detection on the user connection data according to the baseline detection model to obtain baseline detection information includes: Obtain the false alarm threshold and the current false alarm rate of the first filter, as well as the current network latency corresponding to the user connection data; Based on the false alarm threshold, a first threshold analysis is performed on the current filtering false alarm rate to obtain first threshold analysis information; Based on the baseline detection model, range analysis is performed on the current network latency to obtain range analysis information; If the first threshold analysis information indicates that the current filtering false alarm rate is less than the false alarm threshold, or the range analysis information indicates that the current network latency is less than the maximum value in the dynamic baseline range, then baseline detection information representing that the baseline detection has passed is generated; or, if the first threshold analysis information indicates that the current filtering false alarm rate is greater than or equal to the false alarm threshold, and the range analysis information indicates that the current network latency is greater than or equal to the maximum value in the dynamic baseline range, then the first filter is element-updated to obtain the updated first filter.

[0009] In some embodiments, updating the first filter to obtain an updated first filter includes: Obtain a counting threshold and a second filter, wherein the second filter records several source address data and a false alarm count for each source address data; Based on the counting threshold, a second threshold analysis is performed on the false alarm count of each source address data of the second filter to obtain second threshold analysis information. The second threshold analysis information records a number of source address data whose false alarm counts are greater than the counting threshold. Based on the second threshold analysis information, the first filter is updated to obtain the updated first filter.

[0010] In some embodiments, the method further includes: Obtain the connection response returned by the server based on the user connection data; If the connection response is a forged connection, then obtain the source address data of the user connection data; The second filter is updated by counting based on the source address data of the user connection data, resulting in the updated second filter.

[0011] In some embodiments, forwarding the user connection data to the server includes: Acquire connection rate data and security rate threshold, as well as data tags for the user connection data; the connection rate data is used to characterize the amount of user connection data received by the agent within a unit of time. Based on the security rate threshold, a third threshold analysis is performed on the connection rate data to obtain third threshold analysis information; If the third threshold analysis information indicates that the connection rate data is greater than the security rate threshold, then a reset tag is obtained; Based on the reset label, the data label of the user connection data is replaced to obtain the first connection data; Based on the target probability, the first connection data is subjected to random delay addition processing to obtain the second connection data, and the second connection data is forwarded to the server; the target probability is used to characterize the probability of adding random delay to the first connection data.

[0012] According to a second aspect of this application, an IoT security collaborative defense method is provided, applied to a server, the method comprising: Receive user connection data forwarded by the agent when the baseline detection information indicates that the baseline detection has passed. A communication connection with the user terminal is established based on the user connection data; The baseline detection information is obtained through the following steps: The agent acquires the baseline detection model and receives user connection data from the user terminal. The baseline detection model is used to indicate the dynamic baseline range of round-trip delay for several normal connection data under the current time window. The proxy performs a first data verification on the user connection data through a first filter, and obtains the first verification information output by the first filter. When the first verification information indicates that the verification is successful, the proxy performs baseline detection on the user connection data according to the baseline detection model to obtain baseline detection information.

[0013] According to a third aspect of this application, an IoT security collaborative defense system is provided, comprising: The proxy is used to acquire a baseline detection model and receive user connection data from the user terminal. The baseline detection model is used to indicate the dynamic baseline range of round-trip delay for several normal connection data under the current time window. The user connection data is subjected to a first data verification through a first filter to obtain first verification information output by the first filter. When the first verification information is verified as passed, baseline detection is performed on the user connection data according to the baseline detection model to obtain baseline detection information. The server is used to receive user connection data forwarded by the agent when the baseline detection information is that the baseline detection has passed, and to establish a communication connection with the user based on the user connection data.

[0014] According to a fourth aspect of this application, an electronic device is provided, comprising: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as described above.

[0015] According to a fifth aspect of this application, a computer-readable storage medium is provided, wherein a processor-executable program is stored, which, when executed by the processor, is used to implement the method as described above.

[0016] According to a sixth aspect of this application, a computer program product is provided, comprising a computer program stored in a computer-readable storage medium, wherein a processor of an electronic device reads the computer program from the computer-readable storage medium and executes the computer program, causing the electronic device to perform the method described above.

[0017] The beneficial effects of the technical solutions provided in this application are: This application provides a method, system, device, and medium for collaborative security defense in the Internet of Things (IoT). The method acquires a baseline detection model and receives user connection data from a user terminal. The baseline detection model indicates the dynamic baseline range of round-trip delays for several normal connection data points within the current time window. The user connection data is then subjected to a first data verification using a first filter to obtain first verification information output by the first filter. If the first verification information is successful, baseline detection is performed on the user connection data according to the baseline detection model to obtain baseline detection information. If the baseline detection information is successful, the user connection data is forwarded to the server, enabling the server to establish a communication connection with the user terminal based on the user connection data. This method, by performing baseline detection on the user connection data using a baseline detection model when the first verification information is successful, and through the joint detection of the filter and the baseline detection model, can accurately and promptly detect the nonlinear accumulation phenomenon of BF (Browser Flow), effectively improving the effectiveness of IoT security defense. Attached Figure Description

[0018] Figure 1 A simplified timing logic diagram of an IoT security collaborative defense method provided in this application embodiment; Figure 2 A flowchart illustrating the first IoT security collaborative defense method provided in this application embodiment; Figure 3 A schematic diagram of a process for obtaining a baseline detection model is provided in an embodiment of this application; Figure 4 A detailed flowchart of step S230 provided for an embodiment of this application; Figure 5 A detailed flowchart of step S450 provided for an embodiment of this application; Figure 6 This is a schematic diagram of one optional process of an IoT security collaboration method provided in an embodiment of this application; Figure 7 A detailed flowchart illustrating the forwarding of user connection data to the server is provided for an embodiment of this application. Figure 8 A flowchart illustrating the second IoT security collaborative defense method provided in this application embodiment; Figure 9 A schematic diagram of the framework of an IoT security collaborative defense system provided in this application embodiment; Figure 10 This is a structural block diagram of a computer device provided in an embodiment of this application. Detailed Implementation

[0019] The present application will be further described below with reference to the accompanying drawings and specific embodiments. The described embodiments should not be considered as limitations on the present application, and all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present application.

[0020] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] Before introducing the embodiments of this application, the technical terms involved in the embodiments of this application will be explained: SYN Flood Attack: A form of Distributed Denial-of-Service (DDoS) attack in which attackers exploit a design flaw in the TCP three-way handshake to send a large number of TCP connection requests (SYN packets) with forged source IP addresses to the target server. This exhausts the server's memory (half-open connection queue) and CPU (for handling invalid connections) resources, preventing legitimate users from establishing connections.

[0023] A Bloom filter (BF) is a highly space-efficient probabilistic data structure used to quickly determine whether an element exists in a set. It allows the element to proceed if it exists, or filters it if it does not. Its key feature is that it trades a certain false positive rate for extremely high query efficiency and minimal memory usage.

[0024] False Positive Rate (FPR): The probability that a Bloom filter incorrectly identifies a non-existent element as being in the set. Its calculation formula is as follows: Where m is the size of the bit array, n is the number of inserted elements, and k is the number of hash functions.

[0025] The non-linear accumulation of the BF false alarm rate: Under a continuous SYN Flood attack, the number of elements n inserted into the filter keeps increasing. Once the attacker identifies a false alarm entry in some way and periodically sends data packets to maintain its presence in the BF filter, the number of elements n only increases and does not decrease, causing the false alarm rate to soar rapidly from the theoretical initial value (e.g., 7.66%) to 15% or even higher, and the filtering effect drops sharply.

[0026] RTT (Round-Trip Time): Round-trip time refers to the time it takes for a data packet to travel from the sender to the receiver and back to the sender. It is a key indicator for measuring network performance.

[0027] RTT side-channel attack: This is a specific attack method used in this invention. Attackers monitor changes in the RTT of legitimate traffic flows, infer false alarm entries in the Bloom filter, and maintain the existence of these false alarm entries by periodically sending "keep-alive" packets, eventually causing the filter to saturate and fail.

[0028] Programmable switches: These are network switching devices that support programming models such as P4 and PISA, allowing users to customize the forwarding and processing logic of the data plane, providing a hardware foundation for achieving high-performance network security functions.

[0029] Currently, relevant technologies typically employ lightweight Bloom filters (BFs) for initial filtering at the network edge (such as switches). However, because the inherent false positive rate of BFs accumulates non-linearly with the ongoing SYN Flood attack, it is easy for a large amount of invalid traffic that should have been blocked to penetrate the defense layer and flood into the network where the server resides, resulting in poor IoT security defense.

[0030] This invention is the first to analyze and define the RTT side-channel attack process against BF defense systems: Step 1 (Probing Phase): While launching the SYN Flood attack, the attacker continuously monitors the RTT value of legitimate business flows that they control or hijack.

[0031] Step Two (Identification Phase): When the false alarm rate of the BF (Blocker's Field of Defense) rises to a certain level, a large amount of invalid traffic that should have been blocked penetrates the defense layer and floods into the network where the server is located, consuming backbone network bandwidth. This will lead to network congestion and a significant surge in the RTT (Round-Trip Time) of legitimate services (in the simulation environment, a surge from the normal 20ms to 17s was observed).

[0032] Step 3 (Maintenance Phase): The attacker marks the source IP / port pairs of packets sent near the moment of RTT surge as "false alarm entries." Subsequently, keep-alive packets (such as ACK or SYN packets during the three-way handshake) are periodically sent to these entries at a rate below the defense threshold to ensure that they are not cleared by the BF's expiration mechanism, thereby permanently "poisoning" the filter (i.e., the non-linear accumulation of the BF's false alarm rate).

[0033] The result of the RTT side-channel attack process: the poisoned BF eventually becomes saturated, its false alarm rate approaches 100%, it completely loses its filtering ability, all attack traffic can penetrate directly, and the server resources are completely exhausted.

[0034] It should be noted that the aforementioned related technologies are only used to assist in understanding the technical solutions of this application and do not mean that they belong to the publicly disclosed prior art.

[0035] In view of this, embodiments of this application provide a method, system, device and medium for collaborative defense of Internet of Things (IoT) security. In this method, when the first verification information is verified as passed, a baseline detection model is used to perform baseline detection on the user connection data. Through the joint detection of the filter and the baseline detection model, the nonlinear accumulation phenomenon of BF can be accurately and timely detected, which can effectively improve the effect of IoT security defense.

[0036] Furthermore, this method performs a second threshold analysis on the false alarm count of each source address data in the second filter, and updates the first filter based on the obtained second threshold analysis information. Specifically, through the organic collaboration between the proxy and the server, the proxy filters user connection data at high speed, and the server returns a connection response to the proxy when the user connection data is a forged packet, thereby updating the false alarm count of the corresponding source address data in the second filter of the proxy. It can automatically and securely remove malicious entries maintained by attackers in the first filter, fundamentally solving the problem of BF false alarm rate accumulation and effectively improving the effectiveness of IoT security defense.

[0037] Furthermore, this method replaces the labels on user connection data by resetting the labels and randomly adds delays to the first connection data using a target probability before forwarding it to the server. This makes the RTT measured by the attacker noisy, preventing the attacker from accurately identifying which specific source IP's packet penetrated the filter and caused the RTT spike. This is beneficial for improving the effectiveness of IoT security defenses.

[0038] The IoT security collaborative defense method provided in this application embodiment can be specifically described through the following embodiments. First, an IoT security collaborative defense method in this application embodiment is described.

[0039] The IoT security collaborative defense method provided in this application embodiment can be applied to IoT application scenarios. In IoT application scenarios, IoT service providers can use the method provided in this application embodiment to process user connection data that the IoT server will process in the application scenario, which can effectively improve the effectiveness of IoT security defense.

[0040] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0041] Reference Figure 1 and Figure 2 , Figure 2 This is a flowchart illustrating an IoT security collaborative defense method provided in an embodiment of this application, applied to an agent end. The method includes, but is not limited to, steps S210 to S240: Step S210: Obtain the baseline detection model and receive user connection data from the user terminal; In this embodiment, the proxy can be a programmable switch loaded with a first filter and a baseline detection model. User connection data can be TCP connection requests (such as SYN packets) sent by a user terminal, which can be a normal IoT device or a terminal device used by an attacker. The baseline detection model is used to indicate the dynamic baseline range of round-trip latency for several normal connection data points within the current time window, and to determine whether the user connection data meets this dynamic baseline range.

[0042] Reference Figure 3 In some embodiments, obtaining the baseline detection model includes: Step S310: Obtain the neighboring dataset and the current time window, wherein the neighboring dataset is a collection of normal user connection data within the most recent time period; Step S320: Based on the current time window, filter the neighboring dataset to obtain several normal connection data; Step S330: Perform delay analysis on the round-trip delay of all the normal connection data to obtain average delay data and standard delay difference data; Step S340: Determine the dynamic baseline range based on the average delay data and the standard delay difference data.

[0043] In this embodiment, the proxy can continuously collect data packets of normal TCP connections (i.e., user connection data), and then determine all data packets within the most recent time period as the nearest dataset. The most recent time period can be any one of the most recent hour, the most recent day, etc. The current time window can be a sliding window, and its window size can be flexibly set according to the actual situation. For example, the window size can accommodate 100 data packets, 500 data packets, 1000 data packets, etc.

[0044] Understandably, data filtering can be based on the current time window, filtering all user connection data in the neighboring dataset to select several normal user connection data that are close to the current time, denoted as normal connection data. The number of normal connection data is equal to the window size of the current time window.

[0045] Latency analysis can be performed by calculating the average and standard deviation of the round-trip latency of all normal connection data, thereby obtaining average latency data and standard latency difference data, which can be expressed as:

[0046] in, This is the average latency data. This represents the round-trip latency for normal connection data. Let be the round-trip time of the i-th normal connection data; This is standard delay difference data.

[0047] It should be noted that the dynamic baseline range can be determined based on the three sigma (3σ) principle, according to the average delay data and the standard delay difference data. This dynamic baseline range is defined as [μ-3σ, μ+3σ]. Then, a numerical model is constructed based on the dynamic baseline range to obtain the baseline detection model.

[0048] Step S220: Perform first data verification on the user connection data through the first filter to obtain the first verification information output by the first filter; In this embodiment, the first filter can be a Bloom filter (BF), and the first data verification can be performed by filtering and screening user connection data through the BF and generating corresponding first verification information. Specifically, if the user connection data is allowed by the BF, first verification information indicating that the verification has passed can be generated; or, if the user connection data is blocked by the BF, first verification information indicating that the verification has failed can be generated.

[0049] Step S230: When the first verification information is verified, baseline detection is performed on the user connection data according to the baseline detection model to obtain baseline detection information; In this embodiment of the application, when the first verification information is verified as passed, the agent can load the baseline detection model and use the baseline detection model to detect the user connection data in order to obtain the baseline detection information.

[0050] Reference Figure 4 In some embodiments, step S230, performing baseline detection on the user connection data according to the baseline detection model to obtain baseline detection information, includes: Step S410: Obtain the false alarm threshold and the current false alarm rate of the first filter, as well as the current network latency corresponding to the user connection data; Step S420: Based on the false alarm threshold, perform a first threshold analysis on the current filtering false alarm rate to obtain first threshold analysis information; Step S430: Based on the baseline detection model, perform range analysis on the current network latency to obtain range analysis information; Step S440: If the first threshold analysis information is that the current false alarm rate is less than the false alarm threshold, or the range analysis information is that the current network latency is less than the maximum value in the dynamic baseline range, then generate baseline detection information that represents the baseline detection passing. In this embodiment, the false alarm threshold can be a pre-set threshold, and its specific value can be any one of 5%, 7.66%, 10%, etc. The current filtering false alarm rate can be the real-time false alarm rate of the first filter BF at the current moment; the current network latency can be the average round-trip latency of the network when the first filter filters user connection data.

[0051] Understandably, the first threshold analysis can be obtained by comparing the false alarm threshold with the current filtering false alarm rate; while the range analysis can be obtained by using the baseline detection model to determine whether the current network latency conforms to the dynamic baseline range at the current moment.

[0052] Specifically, if the first threshold analysis information is that the current false alarm rate is less than the false alarm threshold, or the range analysis information is that the current network latency is less than the maximum value μ+3σ in the dynamic baseline range, it indicates that the first filter BF is still in a healthy state or that the network has not experienced abnormal congestion. At this time, baseline detection information representing that the baseline detection has passed can be generated.

[0053] Alternatively, in step S450, if the first threshold analysis information is that the current false alarm rate is greater than or equal to the false alarm threshold, and the range analysis information is that the current network latency is greater than or equal to the maximum value in the dynamic baseline range, then the first filter is updated to obtain the updated first filter.

[0054] Furthermore, referring to Figure 5 Step S450, updating the elements of the first filter to obtain the updated first filter, includes: Step S510: Obtain the counting threshold and the second filter, wherein the second filter records a number of source address data and the false alarm count for each source address data; Step S520: Based on the counting threshold, perform a second threshold analysis on the false alarm count of each source address data of the second filter to obtain second threshold analysis information. The second threshold analysis information records a number of source address data whose false alarm counts are greater than the counting threshold. Step S530: Update the first filter according to the second threshold analysis information to obtain the updated first filter.

[0055] In this embodiment of the application, if the first threshold analysis information is that the current false alarm rate is greater than or equal to the false alarm threshold, and the range analysis information is that the current network latency is greater than or equal to the maximum value μ+3σ in the dynamic baseline range, it indicates that the state of the first filter is unhealthy and that the network is experiencing abnormal congestion. At this time, baseline detection information representing the failure of baseline detection can be generated, and the elements of the first filter can be updated to obtain the updated first filter, so that the agent can use the updated first filter at the current time to perform filtering and interception in the next moment.

[0056] Understandably, the second filter could be a counting cuckoo filter (Cuckoo-CBF), consisting of multiple buckets, each with multiple slots. Each slot stores a tuple.<Key,Count> Here, Key typically records the source IP address (i.e., source address data) of a specific user terminal, and Count is the false alarm count for that Key. The counting threshold can be set according to the actual situation, and its specific value can be any one of 3, 5, 10, 20, etc.

[0057] In the first implementation, the second threshold analysis may be comparing each binary tuple of the second filter.<Key,Count> The second filter determines the relationship between the false alarm count and the counting threshold, and removes the source IP addresses corresponding to false alarm counts greater than the counting threshold from the second filter. These source IP addresses are considered maliciously maintained false alarm entries. Then, all the deleted source IP addresses are integrated into the second threshold analysis information.

[0058] It should be noted that the filter update can be based on each source IP address indicated by the second threshold analysis information, updating the corresponding elements in the first filter to obtain the updated first filter. Specifically, for any source IP address indicated by the second threshold analysis information, the corresponding element recorded in the first filter BF set is deleted, so that the first filter BF will no longer allow user connection data received from that source IP address. The same logic applies to other source IP addresses, and this can be easily deduced.

[0059] It is worth mentioning that, in practical applications, since some filters themselves do not support deletion operations, in the second implementation, based on the second threshold analysis information obtained in step S520, the source IP addresses corresponding to false alarm counts greater than the count threshold can be deleted from the second filter, and based on the remaining valid entries in the second filter (i.e., the remaining tuples)...<Key,Count> The first filter is reconstructed, and the reconstructed first filter is determined as the updated first filter.

[0060] Step S240: If the baseline detection information indicates that the baseline detection has passed, the user connection data is forwarded to the server so that the server can establish a communication connection with the user based on the user connection data.

[0061] In this embodiment, when the baseline detection model loaded by the proxy outputs baseline detection information indicating that the baseline detection has passed, the proxy can consider the joint criterion of the user connection data to have passed. At this time, the proxy can forward the user connection data to the server so that the server can process the user connection data. Specifically, if the user connection data is a TCP connection request, the server can attempt to establish a connection with the user based on the TCP connection request.

[0062] In some embodiments, refer to Figure 6 The method further includes: Step S610: Obtain the connection response returned by the server based on the user connection data; Step S620: If the connection response is a forged connection, then obtain the source address data of the user connection data; Step S630: Update the second filter by counting based on the source address data of the user connection data to obtain the updated second filter.

[0063] In this embodiment of the application, for any user connection data, after receiving the user connection data, the server can attempt to establish a connection with the corresponding user. When the connection is successful, it can generate and return a connection response representing a normal connection to the proxy. Alternatively, when the connection fails, it can generate and return a connection response representing a forged connection to the proxy.

[0064] It is understandable that if the connection response received by the proxy is a forged connection, it means that the data packet corresponding to the user connection data is determined to be a forged packet by the first filter and the backend server (i.e., the server). In this case, the source IP address and false alarm count in the user connection data will be updated to the second filter, thus obtaining the updated second filter.

[0065] Specifically, if the source IP address from the user connection data already exists in the second filter, the count update can be performed by incrementing the false alarm count corresponding to that source IP address in the second filter, thus obtaining the updated second filter; or, if the source IP address from the user connection data does not exist in the second filter, a new tuple can be constructed in the second filter.<Key,Count> And the source IP address is identified as the new tuple.<Key,Count> The key in the filter is set to 1, and its corresponding false alarm count is set to 1, thus obtaining the updated second filter.

[0066] It is worth mentioning that the agent in this embodiment can also continuously detect the duration for which the current false alarm rate is greater than or equal to the false alarm threshold, and when the duration is greater than the time threshold, update the capacity of the first filter based on the elastic capacity adjustment algorithm to obtain the first filter with updated capacity. The specific value of the time threshold can be set according to the actual situation, such as any one of 60 seconds, 30 minutes, 60 minutes, etc. The capacity of the first filter with updated capacity can be expressed as:

[0067] in, This is the capacity of the first filter after the capacity update, which is also the size of the bit array of the first filter after the capacity update; The capacity of the first filter before the capacity update; This is an adjustment factor, and its empirical value can be taken as 0.7 to control the aggressiveness of capacity expansion; This represents the current false positive rate. This is the false alarm threshold.

[0068] In some embodiments, refer to Figure 7 The step of forwarding the user connection data to the server includes: Step S710: Obtain connection rate data and security rate threshold, as well as the data tag of the user connection data; the connection rate data is used to characterize the amount of user connection data received by the agent within a unit of time. Step S720: Based on the security rate threshold, perform a third threshold analysis on the connection rate data to obtain third threshold analysis information; Step S730: If the third threshold analysis information indicates that the connection rate data is greater than the security rate threshold, then obtain the reset tag; Step S740: According to the reset tag, replace the data tag of the user connection data to obtain the first connection data; Step S750: According to the target probability, perform random delay addition processing on the first connection data to obtain the second connection data, and forward the second connection data to the server; the target probability is used to characterize the probability of adding random delay to the first connection data.

[0069] In this embodiment, the security rate threshold can be set according to actual conditions, and its specific value can be 1000 data packets / second. The data tag can be the tag information required for collaboration between the proxy and the server, and specifically it can be the tag (such as setup_tag) in the data packet corresponding to the user connection data.

[0070] It is understandable that the third threshold analysis can be obtained by comparing the magnitude of the security rate threshold and the connection rate data. Specifically, if the third threshold analysis indicates that the connection rate data is less than or equal to the security rate threshold, the user connection data can be directly forwarded to the server; or, if the third threshold analysis indicates that the connection rate data is greater than the security rate threshold, the proxy can obtain a reset tag. This reset tag can be generated based on a pre-agreed security algorithm between the proxy and the server, and is denoted as the reset tag. Various security algorithms exist, and this application does not limit them here. Then, the reset tag is used to replace the original data tag of the user connection data to obtain the first connection data.

[0071] It should be noted that since the server and the proxy need to coordinate through tags (such as setup_tag) in the data packets corresponding to user connection data, if these data tags are forged by the user, security bypass can easily occur. This embodiment of the application replaces tags by resetting them, which can avoid the situation where tags are forged by the user, prevent security bypass, and improve the effectiveness of IoT security defense.

[0072] It is worth mentioning that the random delay addition process can be to inject a tiny random delay into the first connection data with a target probability (such as 10%), so that the round-trip delay measured by the attacker is filled with noise, thereby obtaining the second connection data, and forwarding the second connection data to the server.

[0073] For example, the delay value of the second connection data obtained by injecting a random delay into the first connection data can be expressed as:

[0074] in, The delay value of the second connection data obtained by injecting random delay; This is the delay value for the first connection data; This is the noise figure, which can be 0.05, meaning it introduces ±5% delay jitter. This is a random number generation function.

[0075] Figure 8 This is a flowchart illustrating an IoT security collaborative defense method provided in an embodiment of this application. The method includes, but is not limited to, steps S810 to S820: Step S810: Receive user connection data forwarded by the agent when the baseline detection information indicates that the baseline detection has passed; Step S820: Establish a communication connection with the user terminal based on the user connection data; The baseline detection information is obtained through the following steps: The agent acquires the baseline detection model and receives user connection data from the user terminal. The baseline detection model is used to indicate the dynamic baseline range of round-trip delay for several normal connection data under the current time window. The proxy performs a first data verification on the user connection data through a first filter, and obtains the first verification information output by the first filter. When the first verification information indicates that the verification is successful, the proxy performs baseline detection on the user connection data according to the baseline detection model to obtain baseline detection information.

[0076] In the embodiments of this application, the contents of steps S810 to S820 are similar to those of the aforementioned steps S210 to S240, and can be easily deduced by analogy. Therefore, this application will not repeat them here.

[0077] Figure 9 A system block diagram of an IoT security collaborative defense system provided in this application embodiment includes: Agent 901 is used to acquire a baseline detection model and receive user connection data from the user terminal. The baseline detection model is used to indicate the dynamic baseline range of round-trip delay of several normal connection data under the current time window. The user connection data is subjected to a first data verification through a first filter to obtain the first verification information output by the first filter. When the first verification information is verified as passed, the user connection data is subjected to baseline detection according to the baseline detection model to obtain baseline detection information. Server 902 is used to receive user connection data forwarded by the agent when the baseline detection information is that the baseline detection is passed, and to establish a communication connection with the user terminal based on the user connection data.

[0078] It is worth mentioning that the content of the above method embodiments is applicable to this system embodiment. The specific functions implemented in this system embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0079] Figure 10 A schematic diagram of the structure of a computer device provided in this application embodiment includes: At least one processor 980; At least one memory 920 is used to store at least one program; When the at least one program is executed by the at least one processor 980, the at least one processor 980 performs the method as described in the foregoing embodiments.

[0080] This application also provides a computer-readable storage medium storing a processor-executable program, which, when executed by the processor 980, is used to implement the methods described in the foregoing embodiments.

[0081] Specifically, computer equipment can be either a user terminal or a server.

[0082] This application uses a computer device as a user terminal as an example, as detailed below: like Figure 10 As shown, the computer device 900 may include an RF (Radio Frequency) circuit 910, a memory 920 including one or more computer-readable storage media, an input unit 930, a display unit 940, a sensor 950, an audio circuit 960, a WiFi module 970, a processor 980 including one or more processing cores, and a power supply 990, among other components. Those skilled in the art will understand that... Figure 10 The device structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements. The RF circuit 910 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and hands it over to one or more processors 980 for processing; additionally, it transmits uplink data to the base station. Typically, the RF circuit 910 includes, but is not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, an LNA (Low Noise Amplifier), a duplexer, etc. Furthermore, the RF circuit 910 can also communicate wirelessly with networks and other devices. Wireless communication can use any communication standard or protocol, including but not limited to GSM (Global System for Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), email, SMS (Short Messaging Service), etc. The memory 920 can be used to store software programs and modules. The processor 980 executes various functional applications and data processing by running the software programs and modules stored in the memory 920. The memory 920 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the computer device 900 (such as audio data, telephone directory, etc.). In addition, the memory 920 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 920 may also include a memory controller to provide access to the memory 920 by the processor 980 and the input unit 930. Although Figure 10 The RF circuit 910 is shown, but it is understood that it is not a necessary component of the computer device 900 and can be omitted as needed without changing the nature of the invention.

[0083] The input unit 930 can be used to receive input digital or character information, and to generate keyboard, mouse, joystick, optical, or trackball signal inputs related to user settings and function control. Specifically, the input unit 930 may include a touch-sensitive surface 932 and other input devices 931. The touch-sensitive surface 932, also known as a touch display screen or touchpad, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch-sensitive surface 932), and drive the corresponding connection device according to a pre-set program. Optionally, the touch-sensitive surface 932 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, sends it to the processor 980, and can receive and execute commands from the processor 980. In addition, the touch-sensitive surface 932 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch-sensitive surface 932, the input unit 930 may also include other input devices 931. Specifically, other input devices 931 may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc. Display unit 940 can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces of computer device 900. These graphical user interfaces can be composed of graphics, text, icons, video, and any combination thereof. Display unit 940 may include display panel 941, optionally configured as LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), etc. Further, touch-sensitive surface 932 may cover display panel 941. When touch-sensitive surface 932 detects a touch operation on or near it, it transmits the information to processor 980 to determine the type of touch event. Subsequently, processor 980 provides corresponding visual output on display panel 941 according to the type of touch event. Although in Figure 10 In this embodiment, the touch-sensitive surface 932 and the display panel 941 are implemented as two separate components to realize input and output functions. However, in some embodiments, the touch-sensitive surface 932 and the display panel 941 can be integrated to realize input and output functions.

[0084] The computer device 900 may also include at least one sensor 950, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 941 according to the ambient light level, and the proximity sensor can turn off the display panel 941 and / or backlight when the computer device 900 is moved to the ear. As a type of motion sensor, a gravity acceleration sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometers, taps), etc. Other sensors that the computer device 900 may also be equipped with, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0085] Audio circuitry 960, speaker 961, and microphone 962 provide an audio interface between the user and computer device 900. Audio circuitry 960 converts received audio data into electrical signals, which are then transmitted to speaker 961, where they are converted into sound signals for output. Conversely, microphone 962 converts collected sound signals into electrical signals, which are received by audio circuitry 960, converted back into audio data, and then processed by processor 980 before being transmitted via RF circuitry 910 to another control device, or output to memory 920 for further processing. Audio circuitry 960 may also include an earphone jack to facilitate communication between peripheral headphones and computer device 900.

[0086] Computer device 900 can transmit information with the wireless transmission module set up on the battle equipment via WiFi module 970.

[0087] The processor 980 is the control center of the computer device 900. It connects various parts of the control device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 920, and by calling data stored in the memory 920, it performs various functions of the computer device 900 and processes data, thereby providing overall monitoring of the control device. Optionally, the processor 980 may include one or more processing cores; optionally, the processor 980 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the aforementioned modem processor may also not be integrated into the processor 980.

[0088] The computer device 900 also includes a power supply 990 (such as a battery) that supplies power to various components. Preferably, the power supply can be logically connected to the processor 980 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 990 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. Although not shown, the computer device 900 may also include a camera, Bluetooth module, etc., which will not be described in detail here.

[0089] This application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the methods described in the foregoing embodiments.

[0090] This application also discloses a computer program product or computer program, which includes computer instructions stored in the aforementioned computer-readable storage medium; the processor of the aforementioned electronic device can read the computer instructions from the aforementioned computer-readable storage medium, and the processor executes the computer instructions, causing the electronic device to perform the aforementioned method embodiment.

[0091] It is understood that the content of the above method embodiments is applicable to this computer program product or computer program embodiment. The specific functions implemented by this computer program product or computer program embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0092] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatuses.

[0093] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0094] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0095] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0096] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0097] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0098] The step numbers in the above method embodiments are set only for ease of explanation and do not limit the order of the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0099] The above is a detailed description of the preferred embodiments of this application, but this application is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of this application, and these equivalent modifications or substitutions are all included within the scope defined by the claims of this application.

Claims

1. A collaborative security defense method for the Internet of Things, characterized in that, Applied to the proxy side, the method includes: The baseline detection model is obtained and user connection data from the user terminal is received. The baseline detection model is used to indicate the dynamic baseline range of round-trip delay of several normal connection data under the current time window. The user connection data is subjected to a first data verification through a first filter to obtain the first verification information output by the first filter. If the first verification information is verified, then baseline detection is performed on the user connection data according to the baseline detection model to obtain baseline detection information; If the baseline detection information indicates that the baseline detection is successful, the user connection data is forwarded to the server so that the server can establish a communication connection with the user based on the user connection data.

2. The method according to claim 1, characterized in that, The acquisition of the baseline detection model includes: Obtain the neighboring dataset and the current time window, wherein the neighboring dataset is a collection of normal user connection data within the most recent time period; Based on the current time window, the neighboring dataset is filtered to obtain several normal connection data; Perform latency analysis on the round-trip latency of all the normal connection data to obtain average latency data and standard latency difference data; The dynamic baseline range is determined based on the average latency data and the standard latency difference data.

3. The method according to claim 1, characterized in that, The step of performing baseline detection on the user connection data according to the baseline detection model to obtain baseline detection information includes: Obtain the false alarm threshold and the current false alarm rate of the first filter, as well as the current network latency corresponding to the user connection data; Based on the false alarm threshold, a first threshold analysis is performed on the current filtering false alarm rate to obtain first threshold analysis information; Based on the baseline detection model, range analysis is performed on the current network latency to obtain range analysis information; If the first threshold analysis information indicates that the current filtering false alarm rate is less than the false alarm threshold, or the range analysis information indicates that the current network latency is less than the maximum value in the dynamic baseline range, then baseline detection information representing that the baseline detection has passed is generated; or, if the first threshold analysis information indicates that the current filtering false alarm rate is greater than or equal to the false alarm threshold, and the range analysis information indicates that the current network latency is greater than or equal to the maximum value in the dynamic baseline range, then the first filter is element-updated to obtain the updated first filter.

4. The method according to claim 3, characterized in that, The step of updating the elements of the first filter to obtain the updated first filter includes: Obtain a counting threshold and a second filter, wherein the second filter records several source address data and a false alarm count for each source address data; Based on the counting threshold, a second threshold analysis is performed on the false alarm count of each source address data of the second filter to obtain second threshold analysis information. The second threshold analysis information records a number of source address data whose false alarm counts are greater than the counting threshold. Based on the second threshold analysis information, the first filter is updated to obtain the updated first filter.

5. The method according to claim 4, characterized in that, The method further includes: Obtain the connection response returned by the server based on the user connection data; If the connection response is a forged connection, then obtain the source address data of the user connection data; The second filter is updated by counting based on the source address data of the user connection data, resulting in the updated second filter.

6. The method according to any one of claims 1-5, characterized in that, The step of forwarding the user connection data to the server includes: Acquire connection rate data and security rate threshold, as well as data tags for the user connection data; the connection rate data is used to characterize the amount of user connection data received by the agent within a unit of time. Based on the security rate threshold, a third threshold analysis is performed on the connection rate data to obtain third threshold analysis information; If the third threshold analysis information indicates that the connection rate data is greater than the security rate threshold, then a reset tag is obtained; Based on the reset label, the data label of the user connection data is replaced to obtain the first connection data; Based on the target probability, the first connection data is subjected to random delay addition processing to obtain the second connection data, and the second connection data is forwarded to the server; the target probability is used to characterize the probability of adding random delay to the first connection data.

7. A collaborative security defense method for the Internet of Things, characterized in that, Applied to the server side, the method includes: Receive user connection data forwarded by the agent when the baseline detection information indicates that the baseline detection has passed. A communication connection with the user terminal is established based on the user connection data; The baseline detection information is obtained through the following steps: The agent acquires the baseline detection model and receives user connection data from the user terminal. The baseline detection model is used to indicate the dynamic baseline range of round-trip delay for several normal connection data under the current time window. The proxy performs a first data verification on the user connection data through a first filter, and obtains the first verification information output by the first filter. When the first verification information indicates that the verification is successful, the proxy performs baseline detection on the user connection data according to the baseline detection model to obtain baseline detection information.

8. An Internet of Things (IoT) security collaborative defense system, characterized in that, include: The proxy is used to acquire a baseline detection model and receive user connection data from the user terminal. The baseline detection model is used to indicate the dynamic baseline range of round-trip delay for several normal connection data under the current time window. The user connection data is subjected to a first data verification through a first filter to obtain first verification information output by the first filter. When the first verification information is verified as passed, baseline detection is performed on the user connection data according to the baseline detection model to obtain baseline detection information. The server is used to receive user connection data forwarded by the agent when the baseline detection information is that the baseline detection has passed, and to establish a communication connection with the user based on the user connection data.

9. An electronic device, characterized in that, include: At least one processor; At least one memory for storing at least one program; When the at least one program is executed by the at least one processor, the at least one processor performs the method as claimed in any one of claims 1-6 or the method as claimed in claim 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6 or the method as described in claim 7.

Images