Adaptive security protection method for Internet of Things terminal

Abstract

The invention discloses a self-adaptive security protection method for an internet of things terminal, and the method achieves the joint perception and collaborative response of security threats of a physical side and a network side through the construction of a lightweight cross-domain feature perception and resource dynamic adaptation mechanism. According to the method, the physical service criticality and the network attack threat are quantitatively associated, and the optimal security policy is dynamically selected according to the real-time computing power state of the terminal, so that the accurate balance between the protection strength and the service continuity is realized under limited resources. By introducing a resource-aware dynamic scheduling mechanism, the Internet of Things terminal can intelligently degrade or switch a protection strategy in a high-load or high-threat scene, and service interruption caused by resource exhaustion is avoided. Finally, the identification and defense capabilities for information-physical cross-domain hidden attacks are remarkably improved, stable operation and continuous protection of the terminal under harsh resource constraints are ensured, and finally, dual guarantee of security efficiency and service reliability is realized.

Description

Technical Field

[0001] This application relates to the field of intelligent protection, and more specifically, to an adaptive security protection method for IoT terminals. Background Technology

[0002] With the rapid development of IoT technology, IoT terminals have been widely used at the edge of critical infrastructure such as power systems. Because IoT terminals possess both physical sensing and network communication attributes, and are often deployed in complex, unattended environments, their security directly affects the stable operation of the entire system. However, IoT terminals typically face stringent hardware resource constraints, making it difficult to achieve 24 / 7 deployment while ensuring business continuity. Therefore, developing an adaptive security solution that can dynamically adjust protection strength based on environmental threats and resource status has become a critical pain point that urgently needs to be addressed in the current industrial-level development of new power system edge computing.

[0003] In existing IoT terminal protection practices, a protection system typically employs separate physical parameter monitoring (such as SCADA systems) and network traffic filtering (such as firewalls). This architecture has significant limitations when dealing with complex attack methods: First, a semantic gap exists between the physical domain and the information domain. Attackers often exploit this separation to send commands through normal network protocols, causing physical devices to experience destructive oscillations at the threshold. Existing protection methods, lacking lightweight correlation analysis of cross-domain characteristics, struggle to effectively identify such covert information-physical cross-domain attacks. Second, existing defense strategies exhibit obvious rigidity, lacking an effective feedback mechanism with the real-time status of terminal computing power. For example, if a terminal enables full-traffic deep packet inspection, it is highly susceptible to service interruption due to resource exhaustion under resource constraints.

[0004] Therefore, we look forward to an optimized adaptive security protection method for IoT terminals. Summary of the Invention

[0005] To address the aforementioned technical issues, this application provides an adaptive security protection method for IoT terminals.

[0006] According to one aspect of this application, an adaptive security protection method for IoT terminals is provided, comprising: S1: Extract resource features and business features from the raw sensor data stream and raw network communication message stream of the acquired IoT terminal to obtain a system state vector containing resource load indicators and business criticality indicators, and a traffic feature vector containing traffic statistics features. S2: Perform attack prior and malicious feature identification on traffic feature vectors and perform latency sensitivity assessment on business criticality indicators in system state vectors to obtain threat probability index and business loss index. S3: Based on the resource load index in the system state vector, estimate the computing cost of each strategy in the pre-set defense strategy set to obtain the strategy cost mapping table; S4: Under the constraint of the remaining computing power budget in the system state vector, the threat probability index, business loss index and strategy cost mapping table are optimized by the utility function based on Nash equilibrium to obtain the optimal defense strategy identifier. S5: Extract the corresponding subset of detection rules from the local security rule base based on the optimal defense strategy identifier; S6: Based on a subset of detection rules, clean and filter the raw network communication message stream that arrives in real time to obtain a cleaned business data stream.

[0007] Compared with existing technologies, this application provides an adaptive security protection method for IoT terminals. This method constructs a lightweight cross-domain feature perception and dynamic resource adaptation mechanism to achieve joint perception and collaborative response to security threats on both the physical and network sides. The method quantifies and correlates the criticality of physical services with network attack threats and dynamically selects the optimal security strategy based on the terminal's real-time computing power status, thereby achieving a precise balance between protection strength and business continuity under limited resources. By introducing a resource-aware dynamic scheduling mechanism, IoT terminals can intelligently downgrade or switch protection strategies under high load or high-threat scenarios, avoiding business interruptions caused by resource exhaustion. Ultimately, this not only significantly improves the ability to identify and defend against covert cyber-physical cross-domain attacks but also ensures the stable operation and continuous protection of terminals under stringent resource constraints, ultimately achieving dual guarantees of security effectiveness and business reliability. Attached Figure Description

[0008] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0009] Figure 1 This is a flowchart of an IoT terminal adaptive security protection method according to an embodiment of this application; Figure 2 This is a schematic diagram of the data flow of the IoT terminal adaptive security protection method according to an embodiment of this application; Figure 3 This is a flowchart of sub-step S2 of the IoT terminal adaptive security protection method according to an embodiment of this application; Figure 4 This is a flowchart of sub-step S3 of the IoT terminal adaptive security protection method according to an embodiment of this application. Detailed Implementation

[0010] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0011] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0012] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.

[0013] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously, as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0014] The technical solution of this application proposes an adaptive security protection method for IoT terminals. Figure 1 This is a flowchart of an adaptive security protection method for IoT terminals according to an embodiment of this application. Figure 2 This is a system architecture diagram of the IoT terminal adaptive security protection method according to an embodiment of this application. Figure 1 and Figure 2As shown, the IoT terminal adaptive security protection method according to an embodiment of this application includes the following steps: S1, extracting resource features and service features from the acquired raw sensor data stream and raw network communication message stream of the IoT terminal to obtain a system state vector containing resource load indicators and service criticality indicators, and a traffic feature vector containing traffic statistics features; S2, performing attack prior and malicious feature identification on the traffic feature vector, and performing latency sensitivity assessment on the service criticality indicators in the system state vector to obtain a threat probability index and a service loss index; S3, estimating the computing power cost of each strategy in the preset defense strategy set based on the resource load indicators in the system state vector to obtain a strategy cost mapping table; S4, under the constraint of the remaining computing power budget in the system state vector, performing utility function optimization based on Nash equilibrium on the threat probability index, service loss index, and strategy cost mapping table to obtain an optimal defense strategy identifier; S5, extracting the corresponding detection rule subset from the local security rule base based on the optimal defense strategy identifier; S6, cleaning and filtering the raw network communication message stream arriving in real time based on the detection rule subset to obtain a cleaned service data stream.

[0015] Specifically, in step S1, resource feature extraction and business feature extraction are performed on the acquired raw sensor data stream and raw network communication message stream of the IoT terminal to obtain a system state vector containing resource load indicators and business criticality indicators, and a traffic feature vector containing traffic statistics. It should be understood that the IoT terminal simultaneously generates business data (such as sensor readings) and communication data (network messages), which contain crucial information about the system's operating status and potential security threats. However, the raw data stream itself is unstructured and cannot be directly utilized by lightweight decision-making algorithms. Resource feature extraction quantifies the terminal's current computing load, preventing excessive resource consumption by security protection tasks from affecting core business functions; business feature extraction identifies the criticality of current business operations, ensuring that high-priority businesses receive priority protection when attacked or facing resource contention; and traffic feature extraction provides statistical basis for subsequent malicious behavior identification.

[0016] In practice, the original sensor data stream and the original network communication message stream are first clock-synchronized and sliced ​​to obtain synchronized service data blocks and synchronized network data blocks. Since the sensor data stream and the network communication message stream may originate from different hardware modules and have different timestamp bases, direct processing would lead to feature misalignment. Therefore, in this application's technical solution, the original sensor data stream and the original network communication message stream are first clock-synchronized to ensure that the two types of data are aligned on the time axis. Then, the synchronized continuous data stream is sliced ​​according to a fixed time window or data size to generate discrete, temporally continuous data blocks, namely, synchronized service data blocks and synchronized network data blocks. This provides a unified data unit for subsequent feature extraction.

[0017] Next, resource usage parameters are read by accessing the underlying hardware performance counters, and load calculations are performed on these parameters to obtain resource load metrics. In this process, firstly, underlying resource usage parameters such as CPU cycles, instruction retirements, cache miss rate, and memory access counts can be read by directly accessing the hardware performance counters on the IoT terminal's CPU or SoC. Secondly, load calculations are performed on these raw parameters, for example, by calculating the percentage of CPU idle cycles per unit time to obtain the CPU load rate, or by combining multiple parameters to calculate a comprehensive load metric. The calculated resource load metric is one or more quantified values ​​that reflect the current resource stress level of the system.

[0018] Furthermore, semantic parsing and quantification of the synchronous business data blocks are performed to obtain business criticality indicators. Due to limited terminal resources, the system cannot implement the highest-intensity security checks on all business flows. By performing semantic parsing on business data blocks, the system can identify whether the current business involves critical operations in power dispatching (such as tripping and closing) or abnormal fluctuations in physical status, thereby measuring the importance of the current business at the semantic level. This quantification method effectively bridges the "information-physical" semantic gap, enabling the security protection system to dynamically allocate computing resources according to the urgency of the business, ensuring that the security and continuity of high-critical businesses are prioritized in the event of an attack or resource shortage. In this process, firstly, the characteristics of the currently executing instruction are parsed from the synchronous business data block. Secondly, the parsed instruction is matched with a preset set of highest priority instructions to determine whether it involves core control behaviors sufficient to change the power grid topology or operating state. Then, real-time sensing data such as voltage at the physical layer is collected, and the degree of deviation from the rated reference value is assessed to reflect whether there are abnormal disturbances in the physical domain. Finally, based on a preset logical relationship, the business criticality semantic parsing and quantification of the synchronous business data block is performed according to the following formula: in, The currently executing instruction is parsed from the synchronous business data block. This is the highest priority instruction set, representing tripping, closing, and restarting, respectively. These are real-time voltage measurements. This is the rated reference voltage value. This is the deviation threshold for determining voltage anomalies.

[0019] Subsequently, network statistical features are extracted from the synchronized network data blocks to obtain a traffic feature vector. That is, the synchronized network data blocks are parsed to extract statistical features that reflect network behavior patterns. These features typically include, but are not limited to: the number of packets per unit time, packet length distribution, protocol type distribution, connection frequency, and throughput. These statistical features are then arranged in a specific order to form a multi-dimensional traffic feature vector, which is used in subsequent anomaly detection or attack identification models.

[0020] Finally, the resource load metric and the business criticality metric are concatenated dimensionally to obtain the system state vector. That is, the resource load metric and the business criticality metric are combined dimensionally to form a higher-dimensional vector, namely the system state vector. For example, if the resource load metric is [CPU load, memory load] and the business criticality metric is 0.7, then the concatenated system state vector might be [CPU load, memory load, 0.7]. This vector comprehensively represents the current resource environment and business importance of the system.

[0021] Specifically, S2 involves performing attack prior identification and malicious feature recognition on the traffic feature vector and latency sensitivity assessment on the business criticality indicators in the system state vector to obtain the threat probability index and business loss index. It should be understood that IoT terminals are typically deployed in complex physical environments with limited computing resources, making it impossible for the system to perform indiscriminate deep security detection on all network communications. By performing attack prior identification on traffic features, the system can quantify the degree of danger in the current network environment; while by assessing the latency sensitivity of business criticality, it can measure the cost of business interruption or damage. These two indices together constitute the input parameters for subsequent utility optimization calculations based on Nash equilibrium, ensuring that the security protection mechanism can effectively resist high-risk threats without sacrificing the execution efficiency of core businesses due to over-protection.

[0022] Figure 3 This is a flowchart of sub-step S2 of the IoT terminal adaptive security protection method according to an embodiment of this application. Figure 3As shown, the specific process of attack prior and malicious feature identification of traffic feature vector and latency sensitivity assessment of business criticality index in system state vector includes: S21, inputting traffic feature vector into a pre-set lightweight Naive Bayes classification model to perform posterior probability inference to obtain threat probability index; S22, performing loss utility assessment of business criticality index in system state vector based on business priority to obtain business loss index.

[0023] Specifically, in step S21, the traffic feature vector is input into a pre-set lightweight Naive Bayes classification model for posterior probability inference to obtain a threat probability index. The lightweight Naive Bayes classification model, based on existing attack sample features and prior knowledge, performs posterior probability inference on the current traffic feature vector, thereby quantifying and outputting a threat probability index indicating that the current traffic belongs to a malicious attack. In this process, the model first needs to be trained using historical labeled data (including feature vectors of normal traffic and various types of attack traffic) to learn the conditional probability distribution of each feature under normal and malicious categories. During the inference phase, the real-time traffic feature vector is input into the trained model, which integrates information from all features to calculate a probability value belonging to the malicious attack category, i.e., the threat probability index. This index is a continuous value between 0 and 1; a higher value indicates a greater likelihood that the current traffic is judged as malicious.

[0024] Specifically, in step S22, a loss utility assessment based on business priority is performed on the business criticality index in the system state vector to obtain a business loss index. That is, the assessment combines the business criticality index with the business's sensitivity to latency. First, the business criticality index quantifies the importance of the current business. Second, it is necessary to assess the sensitivity of the current business type to latency, which is typically based on predefined business priority and latency tolerance parameters. For example, real-time control commands (such as tripping and closing) are extremely sensitive to latency, with a very low allowable latency threshold; while periodic data upload services have a relatively high tolerance for latency. The calculation logic for the business loss index is to combine the business criticality index with a penalty factor determined by the expected introduced latency and the business's maximum latency tolerance. If the security measures do not introduce additional latency, the business loss index equals the business criticality itself; if latency is introduced, the business loss index is amplified based on the proportion of the latency time to the maximum allowable latency threshold, on top of the business criticality. This calculation method can quantitatively reflect the potential impact of security measures on specific critical businesses.

[0025] Specifically, in step S3, the computational cost of each strategy in the pre-set defense strategy set is estimated based on the resource load index in the system state vector to obtain a strategy cost mapping table. It should be understood that IoT terminals typically have limited computing resources (CPU, memory, bandwidth, etc.), and different security defense strategies (such as deep packet inspection, encrypted communication, traffic filtering, etc.) have significantly different consumption of system resources. When system resources are scarce, selecting a high-consumption strategy may lead to a severe decline in business performance or even system crash; while when resources are sufficient, selecting a strategy with low protection strength may not be effective in dealing with threats. Therefore, in the technical solution of this application, the execution cost of each defense strategy is pre-assessed based on the actual resource load of the current system. This step establishes a quantitative correspondence between abstract strategies and specific computational costs by establishing a strategy cost mapping table, enabling subsequent decision-making algorithms to select the most suitable defense strategy under limited resource constraints based on trade-off principles, avoiding security protection failures or business interruptions due to improper resource allocation.

[0026] Figure 4 This is a flowchart of sub-step S3 of the IoT terminal adaptive security protection method according to an embodiment of this application. Figure 4 As shown, the specific process of estimating the computational cost of each strategy in the preset defense strategy set includes: S31, traversing the preset defense strategy set and querying the benchmark instruction cycle count of each strategy under a standard no-load environment from the benchmark performance database to obtain the benchmark strategy list; S32, based on the system state vector, correcting the benchmark instruction cycle count in the benchmark strategy list to obtain the strategy cost mapping table.

[0027] Specifically, in step S31, the system iterates through the preset defense strategy set and queries the benchmark performance database to obtain a benchmark strategy list by querying the benchmark instruction cycle count of each strategy under a standard no-load environment. The preset defense strategy set is a predefined set of strategies containing various security protection measures available to IoT terminals, such as basic traffic filtering, deep packet inspection, encrypted communication, and access control. In this process, the system first retrieves the locally stored preset defense strategy set. Then, the system iterates through each strategy in the set sequentially through a preset database interface program. During the iteration, the system accesses the benchmark performance database, which records the processor instruction cycles consumed by each protection strategy to execute a complete detection process under a standard no-load environment (i.e., completely idle physical resources and no background interference). For each strategy, its corresponding value is extracted and encapsulated into a mapping structure containing a strategy identifier and its corresponding benchmark consumption value. Subsequently, the extracted raw data are aggregated into a baseline strategy list, which will be used for strategy resource sensitivity vector mapping. Through the built-in feature mapping mechanism, each baseline strategy is transformed into a vector in the three-dimensional sensitivity space, laying a static data foundation for subsequent coupled calculations with environmental pressure feature vectors.

[0028] Specifically, in step S32, based on the system state vector, the number of baseline instruction cycles in the baseline policy list is corrected to obtain a policy cost mapping table. In some practical scenarios, IoT terminal protection schemes use a single scalar indicator (such as total load rate) to characterize complex system environmental pressures and uniformly correct the baseline consumption of all security policies through a simple nonlinear function. This approach ignores the orthogonal interference relationship between different computing tasks and resource bottlenecks. However, in real IoT terminal operation scenarios, the hardware resource dependencies of various security policies vary greatly. For example, IP blacklist / whitelist-based filtering policies mainly consume CPU branch prediction and arithmetic logic unit capabilities, which are typical computationally intensive tasks; while deep packet inspection (DPI) policies based on regular expression matching, due to the involvement of large-scale deterministic finite automata (DFA) state transitions, are extremely dependent on memory bandwidth and cache hit rate, which are typical memory-intensive tasks. Therefore, in some existing practical scenarios, when the system status shows a high total load, but this is actually due to the CPU computing units being fully loaded while the memory bus is relatively idle, the original algorithm indiscriminately applies the same level of cost inflation penalty to both strategies. This leads to serious decision distortion: computationally intensive strategies, which should be heavily penalized for competing for scarce CPU resources, may actually only be subject to average penalties; while memory-intensive strategies, which could run efficiently using relatively idle memory resources, are incorrectly judged as high-cost tasks due to the artificially high total load index, and thus degraded or shut down by the scheduling system. This lack of a fine-grained resource supply and demand matching evaluation mechanism cannot achieve true dynamic performance balance in resource-constrained environments, and may even exacerbate system congestion in specific resource dimensions, leading to a decrease in overall throughput.

[0029] Therefore, in the technical solution of this application, by introducing a vector space resource contention interference model, the single-dimensional scalar correction is upgraded to a multi-dimensional resource sensitivity coupled calculation.

[0030] Specifically, firstly, a policy resource sensitivity vector mapping is performed on the baseline policy list to obtain a policy resource sensitivity matrix. During this process, a built-in feature mapping mechanism is used to map each policy in the baseline policy list... This is transformed into a vector in a three-dimensional sensitivity space, which accurately characterizes the strategy's dependence on different computational resources. The specific computational model is constructed as follows: in, Representative strategy The resource sensitivity vector; This indicates the weight of the strategy's dependence on the CPU's arithmetic logic unit (ALU) (such as a higher value in scenarios with a large number of hash calculations). This indicates the weight of dependence on memory bandwidth and cache (this value is higher in AC automaton matching scenarios). This represents the dependency weights on bus interrupts and DMA transfers. To ensure comparability between different strategies, this vector typically satisfies L1 norm normalization constraints. This process digitizes abstract logical strategies into physical layer resource consumption DNA, giving the scheduling system the ability to identify the physical attributes of tasks, laying the foundation for subsequent differentiated and precise scheduling.

[0031] Next, an environmental stress feature vector is extracted from the system state vector. Here, it should be understood that in the actual operating conditions of IoT terminals, different security strategies have orthogonal interference relationships regarding resource dependencies. For example, compute-intensive strategies and memory-intensive strategies have different requirements for CPU and memory, and a single load rate value cannot reflect the complex resource contention topology within the system. If only the total load index is used for correction, the system will incorrectly penalize all strategies when the CPU is fully loaded and memory is idle. Therefore, by extracting the environmental stress feature vector, the congestion degree of resources in different dimensions when approaching physical limits can be quantified, thereby achieving a true dynamic performance balance in resource-constrained environments.

[0032] In this process, real-time resource load indicators are first extracted from the system state vector generated in step S1, specifically including current CPU utilization, memory bandwidth utilization, and I / O queuing rate. To simulate the phenomenon of drastic performance degradation when resource utilization approaches its limit in the physical world, the system introduces an exponential growth model to calculate the congestion penalty potential energy of resources in each dimension. Specifically, the system performs a nonlinear transformation on each normalized utilization parameter and vectorizes the calculated components to finally construct a complete environmental pressure feature vector. This process can be expressed by the following formula: in, This is the environmental pressure feature vector, where each component represents the congestion penalty potential energy of the corresponding resource. , , These represent the normalized utilization rates of the current CPU, memory bandwidth, and I / O queue, respectively, with values ​​ranging from [0,1]. The instruction term is introduced to simulate the physical phenomenon that contention latency increases exponentially rather than nonlinearly when resource utilization approaches physical limits (e.g., 100%). This step can accurately detect the redline region of the current system. Whether it is a CPU computing power bottleneck or a memory wall bottleneck, it can be clearly extracted and quantified, providing an accurate background environment description for subsequent interferometric calculations.

[0033] Furthermore, resource contention interference coupling is applied to the strategy resource sensitivity matrix, environmental pressure feature vector, and baseline strategy list to obtain a strategy cost mapping table. That is, vector operations are used to simulate the resource supply and demand matching process in the physical world. Specifically, using the dot product principle, the projection relationship between the strategy's resource demand vector and the system's environmental pressure vector is calculated to quantify the resonance degree between strategy execution and environmental congestion. The corrected formula for calculating the true cost is as follows: in, Indicating strategies under high congestion conditions The estimated true cost; Consumption as the baseline for the strategy; For the inner product term of the vector, its physical meaning lies in quantifying the degree of supply and demand conflict—that is, the more heavily a strategy depends on a resource, the more scarce it is at present, the larger the product term of the two, and the more drastic the inflation of the cost value. This is the interference sensitivity coefficient, used to adjust the magnitude of the impact of the conflict on overall performance; This refers to the global jitter noise overhead caused by frequent resource contention in the system.

[0034] Specifically, this application's embodiments introduce a vector space interference model to address the evaluation distortion problem of traditional single-index correction methods in complex resource contention scenarios, achieving orthogonal perception and staggered matching of security policies and hardware resource states. Specifically, by distinguishing between different types of task characteristics, such as computationally intensive and memory-intensive tasks, and coupling them with specific resource bottlenecks of the current system, the terminal device can intelligently identify and run security policies that rely on other idle resources (such as memory bandwidth) even when some resources (such as CPU) are fully loaded. This intelligent scheduling avoids blind resource idleness and excessive contention, significantly improving the system survivability and business continuity of resource-constrained IoT terminals when facing high-concurrency services and high-intensity attacks. Ultimately, it achieves the goal of maximizing the computing power potential of devices and ensuring the optimal level of security protection without increasing hardware costs.

[0035] Specifically, in step S4, under the constraint of the remaining computing power budget in the system state vector, the threat probability index, business loss index, and strategy cost mapping table are optimized using a utility function based on Nash equilibrium to obtain the optimal defense strategy identifier. It should be understood that IoT terminals typically face extremely limited computing resources and extremely high real-time business requirements. Traditional security protection methods often exhibit obvious rigidity, meaning that a fixed-strength defense algorithm is activated regardless of the level of environmental threat. This can easily lead to the interruption of normal business due to resource exhaustion when resources are scarce. To find a balance between security and business availability, the technical solution of this application introduces Nash equilibrium and utility function optimization. The system can calculate an optimal defense depth based on the current threat perception level and real-time computing power cost, thereby maximizing security benefits while ensuring that the remaining computing power budget is not exceeded, thus solving the problems of rigid defense strategies and unsustainable computing power.

[0036] In practical implementation, firstly, based on the threat probability index, business loss index, and strategy cost mapping table, the net comprehensive utility value of each strategy is calculated to obtain a strategy utility score table. That is, a utility function that comprehensively reflects security gains, business losses, and resource costs is defined to model security protection decisions as a multi-objective optimization problem. In this process, the net comprehensive utility value is obtained by subtracting the business loss component from the security gains component. The security gains component is calculated by multiplying the threat probability index by the strategy defense effectiveness coefficient, representing the strategy's defense effect against threats; the business loss component is calculated by multiplying the business loss index by the strategy computing power cost, representing the impact of strategy execution on business. In practice, the system iterates through all strategies in the pre-set defense strategy set. For each strategy, its net comprehensive utility value is calculated according to the above calculation principle, and a mapping relationship is established between the strategy identifier and the utility value to form a strategy utility score table. This table records the comprehensive utility score of each strategy in the current scenario, providing a basis for subsequent optimal strategy selection.

[0037] Next, based on the resource load indicators in the system state vector, the remaining computing power budget is determined. That is, the system's resource constraints are transformed into specific computing power budget values. In this process, firstly, resource load indicators are obtained from the system state vector, mainly including CPU load and memory load. Secondly, based on these load indicators, the difference between the total system resource capacity and the currently occupied resources is calculated to obtain the current system's remaining computing power budget. This remaining computing power budget reflects the amount of currently available, unoccupied computing resources in the system and is a key constraint condition for subsequent constraint optimization solutions.

[0038] Furthermore, based on the remaining computing power budget, the optimal defense strategy identifier is obtained by performing constraint-based optimization on the strategy cost mapping table. In this process, firstly, all strategies in the strategy cost mapping table are traversed, and it is checked whether the computing power cost of each strategy is less than or equal to the remaining computing power budget. Strategies that satisfy the constraint are marked as feasible strategies, forming a subset of feasible strategies. This sub-step limits the search space for subsequent optimization. Secondly, each strategy is considered as a "player," and the utility of each strategy (obtained from the strategy utility rating table) represents the "payoff" of that strategy. By finding the Nash equilibrium point, i.e., finding a strategy that maximizes its own utility given that other strategies remain unchanged, this is equivalent to finding the strategy that maximizes the utility value within the subset of feasible strategies. Since the strategy set is discrete, the actual solution can be obtained using an enumeration method: traversing all strategies in the subset of feasible strategies, for each strategy, obtaining its utility value from the strategy utility rating table, and then selecting the strategy with the highest utility value as the optimal strategy. If multiple strategies have the same and maximum utility value, a selection can be made according to predefined rules (such as strategy priority, strategy with minimum cost, etc.). This solution process ensures that a globally optimal solution is found under resource constraints.

[0039] Specifically, in step S5, a subset of detection rules is extracted from the local security rule base based on the optimal defense strategy identifier. It should be understood that the preceding steps, through a complex evaluation and optimization process, ultimately output an optimal defense strategy identifier, but this identifier itself is merely a strategy code or ID and does not contain specific execution rules. Actual security protection requires specific detection rules, filtering rules, access control rules, etc., to support it. The local security rule base stores complete rule sets corresponding to various defense strategies, but different strategies correspond to different rule sets, and the number of rules can be very large; loading all of them would consume a significant amount of resources. In the technical solution of this application, a subset of rules corresponding to the selected optimal strategy identifier is accurately extracted from the rule base, ensuring that the strategy can be executed correctly while avoiding resource waste caused by loading irrelevant rules.

[0040] In practice, the first step is to load the meta-policy template based on the optimal defense strategy identifier. The meta-policy template is a predefined structured template that contains the basic rule framework, parameter configuration interface, and rule matching conditions for that defense strategy type. During execution, the system takes the optimal defense strategy identifier as input, looks up the corresponding meta-policy template file path in a pre-defined template mapping table, and then loads the template file from the storage medium. Meta-policy templates typically use XML, JSON, or a custom DSL (Domain-Specific Language) format, defining the rule organization structure, configurable parameters, and conditional expression framework for that strategy type.

[0041] Furthermore, the instantiated template parameters are used to perform conditional retrieval and pruning on the local complete security rule base to obtain an active rule subset. That is, the loaded meta-policy template is combined with the current system state to intelligently retrieve and filter the complete local security rule base. In this process, firstly, the system instantiates the parameter placeholders in the meta-policy template based on dynamic parameters such as the current threat probability index and business loss index, generating specific query conditions. Secondly, these instantiated conditions are used to retrieve the local complete security rule base, matching all rule entries that meet the conditions. The retrieval process may involve complex condition judgments, such as multi-dimensional filtering conditions based on rule priority, applicable scenarios, and resource consumption. Then, the matched rule set is pruned to remove redundant, conflicting, or currently inapplicable rules, forming the final active rule subset. This subset contains all the specific rules required to execute the optimal defense strategy under the current system state.

[0042] Specifically, step S6 involves cleaning and filtering the real-time arriving raw network communication packet stream based on a subset of detection rules to obtain a cleaned business data stream. It should be understood that actual security protection requires real-time traffic processing. However, traditional network communication packet streams may contain malicious attack traffic, abnormal access requests, or packets that do not comply with security policies. If these are directly passed to the business processing module without filtering, it may lead to system attacks, data leaks, or business interruptions. Therefore, in the technical solution of this application, the real-time arriving raw packet stream is inspected and filtered packet by packet based on a subset of detection rules, identifying and discarding malicious packets, and only allowing business data that conforms to security rules to pass through. This translates policy decisions into actual protection effects, ensuring that only secure and compliant business data can enter the system's internal processing flow.

[0043] In practice, the first step is to perform protocol parsing on the real-time arriving raw network communication message stream to extract message feature vectors. Since the raw network communication message stream is a continuous, unordered sequence of IP data packets, each message contains an Ethernet frame header, IP header, transport layer header, and application layer data. Therefore, protocol parsing is performed on each arriving message, decapsulating it layer by layer according to the network protocol stack to extract key feature information. Specifically, source IP address, destination IP address, protocol type, and TTL value are extracted from the IP header; source port, destination port, and flags are extracted from the transport layer header (e.g., TCP / UDP); and payload features and protocol fields are extracted from the application layer data. These extracted feature information are organized into feature vectors, which serve as input for subsequent rule matching. It is worth noting that the protocol parsing process requires efficient processing, typically employing zero-copy technology or high-performance network processing frameworks such as DPDK to reduce data copy overhead and improve processing performance.

[0044] Next, rule-based matching detection is performed on the packet feature vectors based on the subset of detection rules to obtain matching results. That is, the extracted packet feature vectors are matched against the rules in the subset of detection rules to determine whether the packet conforms to security rules. The subset of detection rules contains multiple specific detection rules, each defining matching conditions and actions (such as allow, deny, alarm, etc.). During execution, all rules in the subset of detection rules are traversed, and for each rule, the packet feature vector is checked to see if it meets the matching conditions of that rule. Matching conditions may involve judgments across multiple feature dimensions, such as IP address range matching, port number matching, protocol type matching, and payload feature matching. If the packet features meet the matching conditions of a rule, the matching result of that rule is recorded (including the matching rule ID, matching action, etc.). To improve matching efficiency, the system typically employs rule optimization techniques, such as organizing rules into data structures like decision trees, hash tables, or AC automata, avoiding rule-by-rule traversal. The matching process needs to support fast lookup and parallel matching to handle high-throughput network traffic.

[0045] Then, the original packets are filtered based on the matching results to obtain the cleaned business data stream. That is, the packets are processed according to the action type in the matching results: if an allow rule is matched (or no deny rule is matched), the packet is forwarded to the business data stream; if a deny rule is matched, the packet is discarded; if an alarm rule is matched, after recording the alarm log, a decision is made based on the configuration whether to forward or discard the packet. It is worth noting that the filtering process needs to ensure the atomicity and sequentiality of packet processing to avoid business anomalies caused by out-of-order processing. The cleaned business data stream only contains packets that have passed security checks. These packets are considered safe and normal traffic that meets business requirements, and can be passed to subsequent business processing modules for application layer processing. In addition, the system needs to maintain session state information. For stateful protocols (such as TCP), connection states need to be tracked to ensure the correctness of the filtering process.

[0046] In summary, the IoT terminal adaptive security protection method according to the embodiments of this application is explained. It achieves joint perception and coordinated response to security threats on both the physical and network sides by constructing a lightweight cross-domain feature perception and dynamic resource adaptation mechanism. This method quantifies and correlates the criticality of physical services with network attack threats, and dynamically selects the optimal security strategy based on the terminal's real-time computing power status, thereby achieving a precise balance between protection strength and business continuity under limited resources. By introducing a resource-aware dynamic scheduling mechanism, IoT terminals can intelligently downgrade or switch protection strategies under high load or high-threat scenarios, avoiding business interruptions caused by resource exhaustion. Ultimately, it not only significantly improves the ability to identify and defend against covert cyber-physical cross-domain attacks, but also ensures the stable operation and continuous protection of terminals under stringent resource constraints, ultimately achieving dual guarantees of security performance and business reliability.

[0047] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. An adaptive security protection method for IoT terminals, characterized in that, include: S1: Extract resource features and business features from the raw sensor data stream and raw network communication message stream of the acquired IoT terminal to obtain a system state vector containing resource load indicators and business criticality indicators, and a traffic feature vector containing traffic statistics features. S2: Perform attack prior and malicious feature identification on traffic feature vectors and perform latency sensitivity assessment on business criticality indicators in system state vectors to obtain threat probability index and business loss index. S3: Based on the resource load index in the system state vector, estimate the computing cost of each strategy in the pre-set defense strategy set to obtain the strategy cost mapping table; S4: Under the constraint of the remaining computing power budget in the system state vector, the threat probability index, business loss index and strategy cost mapping table are optimized by the utility function based on Nash equilibrium to obtain the optimal defense strategy identifier. S5: Extract the corresponding subset of detection rules from the local security rule base based on the optimal defense strategy identifier; S6: Based on a subset of detection rules, clean and filter the raw network communication message stream that arrives in real time to obtain a cleaned business data stream.

2. The adaptive security protection method for IoT terminals according to claim 1, characterized in that, Step S1 includes: Clock synchronization and slicing are performed on the raw sensor data stream and the raw network communication message stream to obtain synchronized service data blocks and synchronized network data blocks. Resource usage parameters are read by accessing the underlying hardware performance counters, and load calculations are performed on the resource usage parameters to obtain resource load metrics. Perform semantic parsing and quantification of business criticality on synchronous business data blocks to obtain business criticality indicators; Network statistical features are extracted from synchronous network data blocks to obtain traffic feature vectors; The system state vector is obtained by concatenating the resource load index and the business criticality index.

3. The adaptive security protection method for IoT terminals according to claim 2, characterized in that, Perform semantic parsing and quantification of business criticality on synchronous business data blocks to obtain business criticality indicators, including: performing semantic parsing and quantification of business criticality on synchronous business data blocks using the following formula: in, The currently executing instruction is parsed from the synchronous business data block. This is the highest priority instruction set, representing tripping, closing, and restarting, respectively. These are real-time voltage measurements. This is the rated reference voltage value. This is the deviation threshold for determining voltage anomalies.

4. The adaptive security protection method for IoT terminals according to claim 1, characterized in that, Step S2 includes: The traffic feature vector is input into a pre-set lightweight Naive Bayes classification model to perform posterior probability inference to obtain the threat probability index. A business loss index is obtained by evaluating the business criticality index in the system state vector based on business priority.

5. The adaptive security protection method for IoT terminals according to claim 1, characterized in that, Step S3 includes: Traverse the preset defense strategy set and query the benchmark performance database for the benchmark instruction cycle count of each strategy under standard no-load environment to obtain the benchmark strategy list. Based on the system state vector, the number of baseline instruction cycles in the baseline policy list is modified to obtain the policy cost mapping table.

6. The adaptive security protection method for IoT terminals according to claim 1, characterized in that, Step S4 includes: Based on the threat probability index, business loss index, and strategy cost mapping table, the net comprehensive utility value of each strategy is calculated to obtain the strategy utility score table. Determine the remaining computing power budget based on the resource load index in the system state vector; Based on the remaining computing power budget, the optimal strategy is selected by constraint optimization of the strategy cost mapping table to obtain the optimal defense strategy identifier.

7. The adaptive security protection method for IoT terminals according to claim 1, characterized in that, Step S5 includes: Load the meta-policy template based on the optimal defense strategy identifier; The instantiated template parameters are used to perform conditional retrieval and pruning on the local complete security rule base to obtain a subset of active rules.

8. The adaptive security protection method for IoT terminals according to claim 5, characterized in that, Based on the system state vector, the baseline instruction cycle number in the baseline policy list is corrected to obtain a policy cost mapping table, including: The baseline strategy list is mapped using strategy resource sensitivity vectors to obtain the strategy resource sensitivity matrix; Extract environmental pressure feature vectors from the system state vector; Resource contention interference coupling is performed on the strategy resource sensitivity matrix, environmental pressure eigenvector, and baseline strategy list to obtain a strategy cost mapping table.

Images