Internet-of-things safety real-time monitoring and protecting system

Abstract

The invention discloses an internet of things security real-time monitoring and protection system, which carries out adversarial sample enhancement by introducing a generative adversarial network constrained by a physical rule so as to solve the problem of insufficient model training caused by scarcity of attack samples, and deeply mines long-time-sequence feature association of heterogeneous data in combination with time sequence stacking and a long-short-term memory network so as to realize real-time monitoring and protection of the internet of things security. Therefore, a closed-loop process from state sensing to threat research and judgment to precise blocking is realized. Through the mode, not only can the sensitivity and the recognition precision of scarce attack modes be remarkably improved and the false alarm rate be effectively reduced, but also microsecond-level real-time monitoring and precise blocking of a hardware level can be realized based on a microcode control instruction; therefore, high-reliability protection guarantee is provided for information physical safety of key infrastructures such as a novel electric power system and the like.

Description

IoT security real-time monitoring and protection system Technical Field

[0001] This application relates to the field of intelligent protection, and more specifically, to an IoT security real-time monitoring and protection system. Background Technology

[0002] In the context of the current deep development of the Internet of Things (IoT), IoT technology is being widely applied in critical infrastructure fields such as smart grids and industrial control. Its system characteristics of deeply integrating the information and physical domains bring both efficiency improvements and more complex security risks. Especially in scenarios such as new power systems, advanced persistent threats (APS) are increasingly exhibiting characteristics of strong concealment, long duration, and cross-domain collaboration, posing a severe challenge to existing security protection systems. To ensure the continuous and reliable operation of these systems, building an IoT security monitoring and protection system capable of real-time perception, accurate analysis, and rapid response has become an urgent need for industry development.

[0003] In existing technologies, IoT security real-time monitoring and protection solutions mostly focus on single-dimensional analysis of network traffic or physical signals, or use simple feature splicing to perform shallow fusion of the two, and then use traditional machine learning or deep learning models for anomaly detection. While these methods have some effectiveness, they have significant limitations when facing highly covert and complex attacks lacking historical samples. The core problem is that the scarcity of attack samples makes it difficult for the model to fully learn attack patterns, while the lack of long-term feature correlation makes the system unable to effectively identify slow penetration and latent behaviors across time. Ultimately, this leads to low detection accuracy for complex attacks, high false positive and false negative rates, and an inability to meet the high reliability requirements of critical infrastructure security protection.

[0004] Therefore, we look forward to an optimized real-time monitoring and protection system for IoT security. Summary of the Invention

[0005] To address the aforementioned technical issues, this application provides an IoT security real-time monitoring and protection system.

[0006] According to one aspect of this application, an IoT security real-time monitoring and protection system is provided, comprising: a data parsing module for parsing the collected raw physical signal stream and raw network traffic to obtain a parsed feature set; a feature alignment and fusion module for aligning and fusing the information domain feature vectors and physical domain feature vectors in the parsed feature set to obtain a normalized fused feature vector; an adversarial sample enhancement module for using the normalized fused feature vector as a real sample and performing GAN-based adversarial sample enhancement to obtain optimized model parameters with high sensitivity to scarce attack samples; a temporal stacking and pre-value filling processing module for performing temporal stacking and pre-value filling processing on the normalized fused feature vectors at multiple consecutive time points based on a preset time window length and sliding step size to obtain a temporal feature matrix; a threat probability generation module for inputting the temporal feature matrix into a long short-term memory network initialized based on optimized model parameters to obtain a threat probability value; and a control command generation module for parsing the attack source information in the temporal feature matrix and generating microcode control commands to complete the blocking action when the threat probability value exceeds a dynamic security threshold.

[0007] Compared to existing technologies, this application provides an IoT security real-time monitoring and protection system that utilizes a generative adversarial network (GAN) constrained by physical laws to perform adversarial sample augmentation. This addresses the problem of insufficient model training caused by the scarcity of attack samples. Furthermore, it combines temporal stacking and long short-term memory (LSTM) networks to deeply mine long-term temporal feature correlations in heterogeneous data, thereby achieving a closed-loop process from state perception to threat assessment and precise blocking. This approach not only significantly improves sensitivity and recognition accuracy for scarce attack patterns and effectively reduces false alarm rates, but also enables microsecond-level real-time monitoring and precise blocking at the hardware level based on microcode control commands. This provides highly reliable protection for the cyber-physical security of critical infrastructure such as new power systems. Attached Figure Description

[0008] The above and other objects, features, and advantages of this application will become more apparent from the more detailed description of the embodiments of this application in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this application and form part of the specification. They are used together with the embodiments of this application to explain this application and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0009] Figure 1 is a block diagram of an IoT security real-time monitoring and protection system according to an embodiment of this application; Figure 2 is a data flow diagram of an IoT security real-time monitoring and protection system according to an embodiment of this application; Figure 3 is a block diagram of a feature alignment and fusion module in an IoT security real-time monitoring and protection system according to an embodiment of this application; Figure 4 is a block diagram of an adversarial sample enhancement module in an IoT security real-time monitoring and protection system according to an embodiment of this application. Detailed Implementation

[0010] Hereinafter, exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments of this application. It should be understood that this application is not limited to the exemplary embodiments described herein.

[0011] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0012] While this application makes various references to certain modules of the systems according to embodiments of this application, any number of different modules can be used and run on user terminals and / or servers. The modules described are merely illustrative, and different aspects of the systems and methods may use different modules.

[0013] Flowcharts are used in this application to illustrate the operations performed by the system according to embodiments of this application. It should be understood that the preceding or following operations are not necessarily performed in exact order. Instead, various steps can be processed in reverse order or simultaneously as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0014] This application proposes a real-time IoT security monitoring and protection system. Figure 1 is a block diagram of the real-time IoT security monitoring and protection system according to an embodiment of this application. Figure 2 is a system architecture diagram of the real-time IoT security monitoring and protection system according to an embodiment of this application. As shown in Figures 1 and 2, the real-time IoT security monitoring and protection system 300 according to an embodiment of this application includes: a data parsing module 310, used to parse the collected raw physical signal stream and raw network traffic to obtain a parsed feature set; a feature alignment and fusion module 320, used to perform information-physical feature alignment and fusion of the information domain feature vector and physical domain feature vector in the parsed feature set to obtain a normalized fused feature vector; and an adversarial sample enhancement module 330, used to use the normalized fused feature vector as a real sample and perform GAN-based adversarial sample enhancement on it to obtain a sample against scarce attacks. This module features highly sensitive optimized model parameters; a temporal stacking and pre-value filling processing module 340, which performs temporal stacking and pre-value filling processing on normalized fused feature vectors at multiple consecutive time points based on a preset time window length and sliding step size to obtain a temporal feature matrix; a threat probability generation module 350, which inputs the temporal feature matrix into a long short-term memory network initialized based on the optimized model parameters to obtain a threat probability value; and a control command generation module 360, which parses the attack source information in the temporal feature matrix and generates microcode control commands to complete the blocking action when the threat probability value exceeds the dynamic security threshold.

[0015] Specifically, the data parsing module 310 is used to parse the collected raw physical signal stream and raw network traffic to obtain a parsed feature set. It should be understood that the operational data of IoT systems, especially critical infrastructure such as new power systems, exhibits high heterogeneity and spatiotemporal misalignment. Raw physical signals are typically continuous analog quantities, while network traffic consists of discrete digital messages, with significant differences in data format, sampling frequency, and dimensional distribution. To achieve cross-domain security monitoring, a unified parsing mechanism must be used to transform these chaotic raw streams into a vector set with consistent feature representations, thereby enabling the capture of subtle attack correlations hidden between physical fluctuations and command flows.

[0016] The raw physical signal flow includes voltage, current, switch positions, and active power. Specifically, voltage and current are the most direct indicators of grid steady state, and abnormal fluctuations in these often foreshadow physical-level attacks or equipment failures. Switch positions reflect the system's logical topology and are used to verify the consistency between network commands and physical actions. Active power is the core of energy balance, and any reading deviation that violates the law of energy conservation is a key clue for identifying covert attacks. Meanwhile, raw network traffic refers to the raw binary data stream captured by the network interface card (NIC) that contains complete protocol stack information. It can identify unauthorized access or malicious code penetration from the source of commands and is the only source of information for determining attack intent and attack path.

[0017] In practice, firstly, the original physical signal stream is discretized and sampled using an analog-to-digital converter (ADC), and then the sampled data is mapped to a preset interval using an extreme value normalization algorithm to obtain physical state characteristic data. Specifically, firstly, continuous analog signals (such as voltage and current) are sampled by the ADC at a system-defined sampling frequency (e.g., 10kHz), converting them into discrete digital sequences. Subsequently, the sampled data is processed using an extreme value normalization algorithm to map the data to the [0,1] interval, eliminating the influence of dimensions and obtaining physical state characteristic data.

[0018] Next, protocol header identification and field decomposition are performed on the raw network traffic to obtain network behavior feature data. Specifically, deep packet inspection (DPI) technology is used to identify the specific industry protocol (such as Modbus TCP, IEC 104, etc.) to which the network data packets belong, and specific fields (such as function codes, address fields, and data values) in the packet header and payload are parsed and extracted according to the protocol specifications. These extracted field values ​​constitute a feature vector describing network communication behavior, i.e., network behavior feature data.

[0019] Furthermore, the physical state feature data and network behavior feature data are spatiotemporally aligned at the microsecond level to obtain the parsed feature set. Here, since physical signals and network data may originate from different acquisition sources and experience transmission delays, the technical solution of this application performs microsecond-level spatiotemporal alignment of the heterogeneous data. Specifically, the system assigns a high-precision timestamp (at the microsecond level) to each data sample, and then associates and matches the physical state features and network behavior features within the same time window based on the timestamp, ensuring consistency in the time dimension, ultimately forming a unified parsed feature set containing both information domain and physical domain features.

[0020] Specifically, the feature alignment and fusion module 320 is used to perform information-physical feature alignment and fusion on the information domain feature vector and physical domain feature vector in the parsed feature set to obtain a normalized fused feature vector. It should be understood that there are objective physical laws and causal coupling relationships between the information domain (network commands) and the physical domain (sensor readings) in IoT systems, especially in new power systems. If these two types of features are directly spliced ​​or simply combined and input into the detection model, the model will struggle to learn the causal relationship between information and physical domains, and may even affect model performance due to differences in feature scales. Therefore, in the technical solution of this application, the two types of features are aligned at the semantic level through an information-physical feature alignment and fusion mechanism, and the differences in dimensions and units are eliminated through a fusion algorithm, ultimately generating a unified and standardized fused feature vector. This allows the originally isolated network behavior features and physical state features to be associated within a unified feature space, eliminating dimensional differences between heterogeneous data, thereby providing a standardized data foundation for subsequently constructing a high-fidelity, physically consistent security protection model.

[0021] Figure 3 is a block diagram of the feature alignment and fusion module in the IoT security real-time monitoring and protection system according to an embodiment of this application. As shown in Figure 3, the feature alignment and fusion module 320 includes: an information-physical domain feature extraction unit 321, used to extract information domain feature vectors and physical domain feature vectors from the parsed feature set; a splicing and fusion unit 322, used to splice and fuse the information domain feature vectors and physical domain feature vectors in a high-dimensional feature space to obtain an original fused feature vector; and a feature normalization unit 323, used to perform Z-Score-based feature dedimensionalization and standardization on the original fused feature vector to obtain a normalized fused feature vector.

[0022] Specifically, the information-physical domain feature extraction unit 321 is used to extract information domain feature vectors and physical domain feature vectors from the parsed feature set. Specifically, based on a preset feature dimension index, the system extracts portions representing information domain features such as network protocol fields and source / destination addresses from the parsed feature set and constructs them as information domain feature vectors; simultaneously, it extracts portions representing physical quantity readings such as voltage and current and constructs them as physical domain feature vectors. The two vectors are synchronized in timestamps.

[0023] Specifically, the splicing and fusion unit 322 is used to splice and fuse the information domain feature vector and the physical domain feature vector in a high-dimensional feature space to obtain the original fused feature vector. Specifically, the system directly splices the information domain feature vector and the physical domain feature vector in terms of feature dimensions. For example, if the information domain feature vector is an m-dimensional vector and the physical domain feature vector is an n-dimensional vector, then the spliced ​​original fused feature vector is an (m+n)-dimensional vector. This operation combines heterogeneous features into a higher-dimensional joint feature vector, providing a complete input containing both information and physical attributes for subsequent models.

[0024] Specifically, the feature normalization unit 323 is used to perform Z-Score-based feature dedimensionalization and standardization on the original fused feature vector to obtain a normalized fused feature vector. Since features in different dimensions of the concatenated original fused feature vector may have different dimensions and numerical ranges (e.g., network protocol fields may have normalized values ​​of 0-1, while physical quantities may have actual engineering values), direct use would lead to unstable model training. Therefore, the original fused feature vector is further subjected to Z-Score-based feature dedimensionalization and standardization. Specifically, the Z-Score standardization algorithm is used to process each dimension of the original fused feature vector separately. The processed data for each dimension will follow a standard normal distribution with a mean of 0 and a standard deviation of 1, eliminating the influence of dimensions and making features in different dimensions comparable. The final normalized fused feature vector is a standardized feature representation, which is convenient for subsequent machine learning model processing.

[0025] Specifically, the adversarial sample augmentation module 330 is used to augment the normalized fused feature vectors as real samples using GAN-based adversarial sample augmentation to obtain optimized model parameters with high sensitivity to scarce attack samples. It should be understood that although the previous step has generated high-quality normalized fused feature vectors as real samples, these samples mainly originate from normal operating conditions and a small number of known attack scenarios. In real industrial control environments, advanced persistent threat (APT) attacks targeting critical infrastructure often exhibit characteristics of concealment, low frequency, and diversity, resulting in attack samples accounting for a very low proportion in the training data, and even some attack types being completely absent during the training phase. If these imbalanced data are directly used to train the anomaly detection model, the model will overfit to normal samples, while its ability to identify rare attack samples will be severely insufficient, leading to false negatives. Traditional oversampling or data augmentation methods struggle to generate physically meaningful attack samples. However, GAN-based adversarial sample augmentation techniques can learn the distribution characteristics of real samples through the generator network, generating adversarial samples that are similar to real attack behaviors in the feature space. These samples simulate the anomalous patterns of real attacks at the feature level, but are not simply noise perturbations. By adding these adversarial samples to the training set, the discriminator is forced to learn more robust feature boundaries, improving its generalization ability to unknown attack samples. The resulting optimized model parameters are more sensitive to scarce attack samples, enabling earlier and more accurate detection of anomalous behavior in practical deployments, thus improving the overall protection effectiveness of the system.

[0026] Figure 4 is a block diagram of the adversarial sample enhancement module in the IoT security real-time monitoring and protection system according to an embodiment of this application. As shown in Figure 4, the adversarial sample enhancement module 330 includes: a forgery attack feature generation unit 331, used to input a random Gaussian noise vector sampled from a standard normal distribution into a generator neural network to obtain a forgery attack feature vector; a hybrid objective function generation unit 332, used to simultaneously input a normalized fusion feature vector and a forgery attack feature vector into a discriminator neural network to obtain a hybrid objective function value; and an optimized model parameter extraction unit 333, used to alternately update the weight parameters of the generator and discriminator based on the hybrid objective function value using a backpropagation algorithm and freeze the discriminator weights after reaching a Nash equilibrium state to extract optimized model parameters.

[0027] Specifically, the forgery attack feature generation unit 331 is used to input a random Gaussian noise vector sampled from a standard normal distribution into the generator neural network to obtain a forgery attack feature vector. Specifically, the generator neural network receives a noise vector randomly sampled from a standard normal distribution as input, and this noise vector typically has a fixed dimension. The generator neural network is usually composed of multiple fully connected layers or convolutional layers, which, through forward propagation computation, map the input random noise into a forgery attack feature vector with the same dimension as the real normalized fused feature vector. This generation process can be represented as performing a nonlinear transformation on the random noise vector through the generator's weight parameters, ultimately outputting a forgery feature vector that is similar to the real attack sample in the feature space.

[0028] Specifically, the hybrid objective generation function generation unit 332 is used to simultaneously input the normalized fusion feature vector and the spoofing attack feature vector into the discriminator neural network to obtain the hybrid objective function value. It should be understood that in the context of highly integrated Cyber-Physical Systems (CPS), traditional generative adversarial network loss calculation mechanisms only focus on fitting the statistical probability distribution of real samples, often ignoring the objectively existing causal coupling relationship between information domain commands and physical domain responses. Specifically, in a real power control system, there are strict physical laws and logical constraints between a network command (information domain data) and subsequent sensor telemetry readings (physical domain data). For example, when a clear circuit breaker trip command is issued, its corresponding physical domain feature must be that the loop current rapidly approaches zero. Due to a lack of understanding of this coupling relationship, traditional generative adversarial network loss calculation mechanisms may generate spoofing attack feature vectors containing logically contradictory data, such as containing a trip command while simultaneously showing a continuously rising load current. Such physics-paradoxical spoofed samples, although similar to real data in the numerical distribution of individual features, have no real-world significance in combination. If the discriminator judges such physically impossible samples as true, the entire model will learn incorrect and distorted attack patterns, ultimately causing the downstream deep anomaly analysis model to generate a large number of false positives (misjudging normal physical fluctuations as attacks with paradoxical characteristics) and false negatives (failing to identify those hidden attacks that truly violate physical coupling relationships), thus failing to meet the high fidelity requirements of critical infrastructure for security protection.

[0029] Therefore, in the technical solution of this application, a physical perception loss calculation mechanism based on coupling residual regularization is introduced. By embedding mathematical constraints on physical laws into traditional adversarial games, the generator is forced to follow the inherent operating logic of cyber-physical systems while learning to deceive the discriminator.

[0030] In this process, firstly, the information-physical coupling residual of the forged attack feature vector is calculated to obtain the coupling consistency residual. Specifically, the input forged attack feature vector is first decomposed along the feature dimension to separate the information domain component representing network instructions and the physical domain component representing sensor readings. Then, a coupling mapping matrix pre-constructed based on domain knowledge is introduced. This matrix mathematically encapsulates the transformation relationship from specific network instructions to their theoretical physical responses, directly reflecting the system's physical model. By left-multiplying the information domain components of the generated sample by this matrix and passing it through a nonlinear activation function (to simulate saturation or damping effects in the physical world), the theoretically expected physical state can be calculated. Furthermore, by calculating the Euclidean distance (L2 norm) between the physical components of the generated sample and this theoretically expected physical state, the coupling consistency residual is obtained. This residual transforms the abstract problem of physical law conformity into a concrete, computable value, providing a basis for subsequent penalty application, producing a scalar called the coupling consistency residual, whose magnitude directly reflects the physical authenticity of the forged sample. This process can be expressed by the formula: in, This refers to the coupling consistency residual, which corresponds to the coupling consistency residual of the data object. To forge physical feature components in the sample. This refers to the information domain (network) feature components in the forged sample. The coupling mapping matrix is ​​a priori knowledge matrix that describes the mapping rules from information domain instructions to physical domain states. It is a nonlinear activation function that simulates the nonlinear response characteristics of a physical system. It is the square of the L2 norm, that is, the square of the Euclidean distance, used to measure the degree of deviation between two vectors.

[0031] Secondly, the physical violation penalty term is exponentially quantized on the coupling consistency residual to obtain the physical constraint regularization term. It should be understood that for samples that severely violate physical laws, a penalty much larger than linearly increasing is needed to form a hard constraint, forcing the generator to prioritize correcting such logical fallacies. In specific implementation, a physical noise tolerance threshold is introduced into the residual calculated in the previous step. When the residual exceeds a threshold, a penalty calculation is initiated to avoid over-penalizing minor deviations caused by normal sensor noise. This step simulates the tolerance for minor errors in a real industrial environment while imposing exponentially severe penalties for major logical errors (such as equipment shutdown despite full power load). Finally, the residual value is converted into a physically-constrained regularization term with strong learning guidance, serving as a key driver for correcting the generator's behavior. This process can be expressed by the following formula: in, This represents the loss due to physical constraint regularization, corresponding to the physical constraint regularization term for the data object. The penalty intensity hyperparameter is used to adjust the relative importance of physical constraints in the total loss. It is a natural exponential function, achieving exponential growth of the penalty. To maximize the function, ensure that the penalty is only calculated when the residual exceeds the threshold. This is the physical noise tolerance threshold, representing the acceptable range of normal physical fluctuations for the system.

[0032] Furthermore, a hybrid game loss aggregation based on physical constraint regularization and adversarial loss is performed to obtain a hybrid objective function value. This step aims to organically integrate the newly introduced physical constraints with the traditional GAN ​​adversarial objective. Specifically, the original adversarial loss value is weighted and summed with the physical constraint regularization term calculated in the previous step. During this process, a dynamically adjustable balance factor is set. As a weighting coefficient. Specifically, the model can adjust its optimization focus according to different training stages: a larger weighting coefficient can be set in the early stages of training. The value is forced to first teach the generator to obey physical laws; the value can be appropriately reduced in the later stages of training. This allows the model more space to learn subtle statistical features from real attack samples. The final hybrid objective function value will serve as a unified optimization objective, guiding the backpropagation and parameter updates of the entire generative adversarial network, ensuring that the generator stays within the bounds of physical reality in its pursuit of indistinguishable realism. This process can be expressed by the following formula: in, is the total loss of the physical perception mixture, corresponding to the mixed objective function value after optimization of the data object. Let be the mathematical expectation. This represents the discrimination score of the discriminator between real and fake samples. It is a dynamic balancing factor used to weigh the importance of adversarial losses against physical constraint losses. It is a logarithmic function with base 2.

[0033] In particular, the physical perception loss computation mechanism based on coupling residual regularization proposed in this application constructs a data generation method that can deeply understand and follow the inherent laws of cyber-physical systems, solving the shortcomings of traditional generative adversarial networks in generating high-fidelity, physically and logically consistent attack samples. Specifically, by introducing a coupling residual regularization term, the generator is forced to adhere to the abnormal states of preset coupling relationships while learning the data distribution, thereby providing more reliable and accurate security guarantees for critical infrastructure based on the physical laws and logical constraints of cyber-physical systems.

[0034] Specifically, the optimized model parameter extraction unit 333 is used to alternately update the weight parameters of the generator and discriminator based on the mixed objective function value using the backpropagation algorithm, and freeze the discriminator weights after reaching a Nash equilibrium state, in order to extract the optimized model parameters. Specifically, the training process adopts an alternating optimization strategy: first, the generator parameters are fixed, and the discriminator parameters are updated to maximize the discriminator's ability to distinguish between real and fake samples; second, the discriminator parameters are fixed, and the generator parameters are updated to minimize the probability that the samples generated by the generator are detected by the discriminator (i.e., to make the generated samples as similar as possible to real samples). Through multiple iterations of this alternating update process, the performance of the generator and discriminator improves together until a balance state (Nash equilibrium) is reached, at which point the generator can produce indistinguishable fake samples, while the discriminator struggles to effectively distinguish between real and fake samples. After training convergence, the weight parameters learned by the discriminator network are considered optimized model parameters with high sensitivity to scarce attack samples. These parameters are learned in adversarial training against high-quality fake attack samples and possess stronger feature discrimination capabilities. Finally, these weight parameters of the discriminator are frozen and used to initialize the subsequent anomaly detection model. It is worth mentioning that the Nash equilibrium state refers to an ideal state achieved during GAN training, in which the distribution of samples generated by the generator is very close to the distribution of real samples, so that the discriminator cannot distinguish between real and fake samples with a higher probability than random guessing.

[0035] Specifically, the temporal stacking and pre-value padding processing module 340 is used to perform temporal stacking and pre-value padding processing on normalized fused feature vectors from multiple consecutive time points based on a preset time window length and sliding step size to obtain a temporal feature matrix. It should be understood that IoT security threats, especially advanced persistent threats targeting new power systems, often exhibit characteristics of cross-temporal latency and slow penetration. Feature vectors from a single time point are insufficient to characterize the physical and logical evolution of attack behavior. To avoid the security model operating in a vacuum of physical laws and generating logical paradoxes, the technical solution of this application captures this cross-temporal feature correlation through temporal stacking to ensure that subsequent models can identify abnormal states that violate physical laws. Furthermore, during actual data acquisition, data may be missing at certain times due to transmission delays, packet loss, etc. Directly using missing data will affect model performance. Pre-value padding processing fills missing values ​​with values ​​from the previous valid time point, maintaining temporal continuity while avoiding training interruptions caused by missing data. The resulting temporal feature matrix arranges the feature vectors within each time window in chronological order to form a two-dimensional matrix. This structured data format facilitates end-to-end temporal modeling by subsequent temporal neural networks, enabling better capture of the dynamic evolution of cyber-physical systems and the temporal patterns of attack behaviors.

[0036] In practice, the system first pushes the real-time arriving normalized fused feature vectors into a deque and dynamically removes expired data to obtain the original feature queue. Specifically, the system maintains a deque as a data buffer to store the real-time arriving normalized fused feature vectors. Whenever a new feature vector arrives, the system pushes it into the queue from the tail. Simultaneously, the system checks whether the oldest data in the queue has expired (i.e., exceeded the current time window) according to a preset time window length; if expired, it is removed from the head of the queue. This dynamic update mechanism ensures that the queue always contains feature vectors from the most recent period, satisfying real-time requirements while avoiding memory overflow problems caused by unlimited data accumulation. In this way, the system obtains an original feature queue arranged in chronological order, providing a data foundation for subsequent time-series processing.

[0037] Next, the original feature queue undergoes time-series interruption detection and missing value imputation to obtain a complete feature queue. Due to network transmission delays, equipment failures, and other reasons, the original feature queue may contain missing data or discontinuous time sequences. In this process, the system first performs time-series interruption detection on the queue: iterating through each timestamp in the queue and checking whether the interval between adjacent timestamps exceeds a preset sampling period threshold. If an abnormal interval is found, the position is marked as having missing data. For detected missing values, the system uses a previous-value imputation algorithm: filling the current missing value with the feature vector value of the previous valid time step. If the missing value occurs at the beginning of the queue (i.e., the first data point is missing), subsequent-value imputation or zero vector imputation is used. Through this imputation process, the continuity of the feature queue in the time dimension is ensured, resulting in a complete, missing-free, imputed feature queue.

[0038] Furthermore, the completed feature queue is subjected to temporal stacking and dimensional adaptation to obtain a temporal feature matrix. Specifically, the system extracts temporal sequences from the completed feature queue according to preset time window length and sliding step size parameters. Specifically, feature vectors of consecutive time window lengths are sequentially extracted from the queue at sliding step size intervals. For each extracted sequence, these feature vectors are stacked chronologically along the time dimension to form a two-dimensional matrix. The row dimension of this matrix corresponds to the time step (from 1 to the time window length), and the column dimension corresponds to the feature dimension (the dimension of the normalized and fused feature vectors). For example, if the time window length is 10 and the feature vector dimension is 6, the stacked matrix has a dimension of 10×6. This dimensional adaptation operation transforms the temporal data into a standard matrix format, facilitating subsequent neural network processing. The final temporal feature matrix contains complete temporal information within each time window, providing structured input data for threat detection.

[0039] Specifically, the threat probability generation module 350 is used to input the temporal feature matrix into a Long Short-Term Memory (LSTM) network initialized based on optimized model parameters to obtain a threat probability value. It should be understood that IoT security real-time monitoring and protection systems need to perform threat detection on the current system state based on temporal features and output a quantifiable, continuous probability value as a decision-making basis. Although the previous step has constructed a feature matrix containing historical temporal information, these features themselves cannot directly determine whether a threat exists. Long Short-Term Memory (LSTM), as a special type of recurrent neural network, has a memory gating mechanism and can effectively capture long-term dependencies in long sequences. However, directly and randomly initializing LSTM network parameters for training can easily overfit normal samples when facing scarce attack samples, resulting in insufficient sensitivity to attack sample detection. Therefore, in the technical solution of this application, the optimized model parameters obtained through adversarial sample augmentation in the previous step are used to initialize the LSTM network. These parameters have already learned feature representations more sensitive to attack samples during adversarial training, which can significantly improve the model's ability to detect rare attacks. The final output threat probability value is a continuous value between 0 and 1, representing the likelihood of the system being attacked at the current moment.

[0040] In practice, firstly, the optimized model parameters are loaded into the forget gate, input gate, and output gate structures of the Long Short-Term Memory (LSTM) network. Then, recursive gating calculations and state updates are performed on the temporal feature matrix along the time dimension to obtain the deep latent feature vector for the last time step. During this process, the system first constructs an LSTM network containing an input layer, an LSTM layer, and an output layer. Next, the optimized model parameters are obtained; these parameters are the discriminator network weights frozen after adversarial training. Since the discriminator network and the LSTM network have functional similarities in feature extraction, the discriminator's weight parameters can be mapped to the corresponding gating structures of the LSTM network as initial parameters. Specifically, the optimized model parameters are loaded into the weight matrices and bias vectors of the LSTM's forget gate, input gate, and output gate, respectively. Finally, the temporal feature matrix is ​​input into the initialized LSTM network in time-step order. For each time step, the LSTM unit calculates the following through a gating mechanism: the forget gate determines how much cell state information from the previous time step is retained. Specifically, it uses the Sigmoid activation function to transform a linear combination of the current input and the previous hidden state, outputting a value between 0 and 1 to control the degree of information retention. The input gate determines how much new information is updated to the cell state. Specifically, it uses the Sigmoid function to calculate update weights and the Tanh function to generate candidate values. The cell state is updated based on the outputs of the forget and input gates. The output gate determines the output of the current hidden state. Specifically, it uses the Sigmoid function to calculate output weights, which are then multiplied by the updated cell state after the Tanh function transformation to obtain the current hidden state. Through recursive calculation step by step, the deep latent feature vector for the last time step is finally obtained. This vector contains a compressed representation of the temporal information within the entire time window.

[0041] Next, the deep latent feature vectors are subjected to probability mapping and classification based on fully connected layers to obtain threat probability values. Specifically, the deep latent feature vectors obtained in the first sub-step are input into a fully connected layer, which maps the dimension of the deep latent feature vectors to the number of target categories. Then, the output of the fully connected layer is applied with a sigmoid activation function, which converts it into a probability value between 0 and 1, i.e., the threat probability value, which quantifies the likelihood that the system state corresponding to the current time series is threatened.

[0042] Specifically, the control command generation module 360 ​​is used to parse the attack source information in the time-series feature matrix and generate microcode control commands to complete the blocking action when the threat probability value exceeds the dynamic security threshold. It should be understood that the IoT security real-time monitoring and protection system not only needs to detect threats but also needs to have proactive defense capabilities. Although the previous step has output the threat probability value, the probability value alone cannot determine the specific source, type, and scope of the attack, nor can it directly take blocking measures. In industrial control systems, attacks often have the characteristics of rapid propagation and chain reactions. If a threat is not responded to in a timely manner after detection, the attack may spread to other devices or systems within milliseconds, causing irreversible physical damage. Therefore, when the threat probability value exceeds the preset security threshold, the system must immediately activate the response mechanism. The dynamic security threshold is designed to consider factors such as system operating status, historical attack frequency, and false alarm tolerance, making it more adaptable than a fixed threshold. Parsing the attack source information in the time-series feature matrix is ​​to accurately locate the attack source (such as the attacker's IP address, device identifier, control command source, etc.) to provide a target object for subsequent blocking. The final step of generating microcode control instructions transforms the blocking logic into executable instructions for the underlying hardware. Microcode is characterized by its high execution speed and low resource consumption, meeting the real-time requirements of industrial control systems. Specifically, the final blocking actions may include: severing abnormal network connections, isolating controlled devices, modifying control logic, and triggering physical switches. This step achieves a closed loop from threat perception to proactive defense, representing a crucial leap from "detection" to "protection," effectively reducing the actual losses caused by attacks.

[0043] In practice, firstly, when the threat probability value is determined to be higher than the dynamic security threshold, the time-series feature matrix is ​​reverse-correlation parsing is performed to determine the physical and network indices to obtain the attack source identification information. During this process, the system continuously monitors the threat probability value and compares it with the dynamically calculated security threshold. When the threat probability value exceeds the threshold, the system immediately obtains the time-series feature matrix at the time the alarm is triggered. By performing reverse-correlation parsing on this matrix, the system traces back from the current abnormal state to analyze the feature sources that led to the anomaly. Specifically, the system identifies feature dimensions in the time-series feature matrix that show significant changes within the abnormal time window and parses the corresponding physical device indices (such as PLC device addresses and sensor numbers) and network indices (such as source IP addresses and communication port numbers). For example, analysis reveals that the anomaly mainly occurs in the network feature dimension related to a specific IP address and the physical feature dimension related to a specific circuit breaker, thus determining the attack source identification information as "Source IP: 192.168.1.100, Target Device: DEV001".

[0044] Next, the attack source identification information is mapped to underlying matching key values ​​and operation instructions to obtain microcode control commands. The system has a pre-built blocking policy rule base, which defines the blocking actions to be taken under different attack scenarios. In this process, the attack source identification information (such as IP address and device ID) obtained in the first step is used as input to query the rule base and match the corresponding blocking policy. Then, specific microcode control commands that are recognizable by the underlying hardware are generated according to the policy. These commands typically contain an opcode (indicating the action to be performed, such as BLOCK or ISOLATE) and operands (i.e., the specific matching key value, such as the target IP address or device identifier). For example, the generated microcode command might be formatted as "Opcode: BLOCK_NET; Parameters: src_ip=192.168.1.100, dst_dev=DEV001".

[0045] Then, microcode control commands are sent to the hardware forwarding engine of the data processing unit via the control channel to update the matching action table, and traffic is dropped or redirected at the network interface card (NIC) entry point to complete the blocking action. Specifically, the generated microcode control commands are sent at high speed to the network data processing unit, such as a smart NIC or hardware forwarding engine, via a dedicated control channel (such as a specific system bus or management interface). After receiving the command, the engine immediately updates its internal matching action table (e.g., Access Control List, ACL), adding a blocking rule for the identified attack source. Subsequently, all network traffic arriving at the NIC entry point is compared with this matching action table in real time. Once the rule is matched (i.e., the source IP of the packet is 192.168.1.100 and the destination is DEV001), the NIC will directly perform the operation of dropping or redirecting the packet to the isolation zone at the hardware level before the packet enters the system protocol stack. This hardware-level blocking at the NIC entry point achieves extremely low latency and extremely high processing efficiency, ensuring real-time interception of attack traffic.

[0046] As described above, the IoT security real-time monitoring and protection system 300 according to the embodiments of this application can be implemented in various wireless terminals, such as servers with IoT security real-time monitoring and protection algorithms. In one possible implementation, the IoT security real-time monitoring and protection system 300 according to the embodiments of this application can be integrated into the wireless terminal as a software module and / or hardware module. For example, the IoT security real-time monitoring and protection system 300 can be a software module in the operating system of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the IoT security real-time monitoring and protection system 300 can also be one of many hardware modules of the wireless terminal.

[0047] Alternatively, in another example, the IoT security real-time monitoring and protection system 300 and the wireless terminal can also be separate devices, and the IoT security real-time monitoring and protection system 300 can be connected to the wireless terminal via wired and / or wireless networks, and transmit interactive information in accordance with an agreed data format.

[0048] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or improvement of the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A real-time monitoring and protection system for IoT security, characterized in that, include: The data parsing module is used to parse the collected raw physical signal stream and raw network traffic to obtain the parsed feature set; The feature alignment and fusion module is used to align and fuse the information domain feature vectors and physical domain feature vectors in the parsed feature set to obtain a normalized fused feature vector; adversarial The sample augmentation module is used to take the normalized fused feature vector as a real sample and perform adversarial sample augmentation based on GAN to obtain optimized model parameters that are highly sensitive to scarce attack samples; the temporal stacking and pre-value filling module is used to perform temporal stacking and pre-value filling on the normalized fused feature vector at multiple consecutive time points based on the preset time window length and sliding step size to obtain the temporal feature matrix. The threat probability generation module is used to input the temporal feature matrix into a long short-term memory network initialized based on optimized model parameters to obtain threat probability values; The control command generation module is used to parse the attack source information in the time-series feature matrix and generate microcode control commands to complete the blocking action when the threat probability value exceeds the dynamic security threshold.

2. The IoT security real-time monitoring and protection system according to claim 1, characterized in that, The original physical signal stream includes voltage, current, switch position, and active power; the data parsing module is used to: discretize and sample the original physical signal stream using an analog-to-digital converter and map the sampled data to a preset interval using an extreme value normalization algorithm to obtain physical state characteristic data; The protocol headers of the raw network traffic are identified and the fields are decomposed to obtain network behavior feature data; the physical state feature data and the network behavior feature data are spatiotemporally aligned at the microsecond level to obtain the parsed feature set.

3. The IoT security real-time monitoring and protection system according to claim 1, characterized in that, The feature alignment and fusion module includes: an information-physical domain feature extraction unit, used to extract information domain feature vectors and physical domain feature vectors from the parsed feature set; a splicing and fusion unit, used to splice and fuse the information domain feature vectors and physical domain feature vectors in a high-dimensional feature space to obtain the original fused feature vector; and a feature normalization unit, used to perform Z-score-based feature dedimensionalization and standardization on the original fused feature vector to obtain the normalized fused feature vector.

4. The IoT security real-time monitoring and protection system according to claim 1, characterized in that, The adversarial sample augmentation module includes: a forgery attack feature generation unit, which inputs a random Gaussian noise vector sampled from a standard normal distribution into the generator neural network to obtain a forgery attack feature vector; a hybrid objective function generation unit, which simultaneously inputs the normalized fused feature vector and the forgery attack feature vector into the discriminator neural network to obtain a hybrid objective function value; and an optimized model parameter extraction unit, which uses the backpropagation algorithm to alternately update the weight parameters of the generator and discriminator based on the hybrid objective function value and freezes the discriminator weights after reaching a Nash equilibrium state to extract optimized model parameters.

5. The IoT security real-time monitoring and protection system according to claim 1, characterized in that, The temporal stacking and pre-value filling module is used to: push the real-time arriving normalized fusion feature vector into a double-ended queue and dynamically remove expired data to obtain the original feature queue; and perform temporal interruption detection and missing value filling on the original feature queue to obtain the completed feature queue. The completed feature queue is time-series stacked and dimension-adapted to obtain the time-series feature matrix.

6. The IoT security real-time monitoring and protection system according to claim 1, characterized in that, The threat probability generation module is used to: load the optimized model parameters into the forget gate, input gate, and output gate structure of the long short-term memory network, and perform recursive gating calculation and state update on the temporal feature matrix along the time dimension to obtain the deep latent feature vector of the last time step; and perform probability mapping and classification on the deep latent feature vector based on fully connected layers to obtain the threat probability value.

7. The IoT security real-time monitoring and protection system according to claim 1, characterized in that, The control command generation module is used to: when the threat probability value is determined to be higher than the dynamic security threshold, perform reverse correlation parsing on the time-series feature matrix to determine the physical index and network index to obtain the attack source identification information; map the attack source identification information to the underlying matching key value and operation command to obtain the microcode control command; send the microcode control command to the hardware forwarding engine of the data processing unit through the control channel to update the matching action table, and perform traffic dropping or redirection at the network card entry point to complete the blocking action.

8. The IoT security real-time monitoring and protection system according to claim 4, characterized in that, The hybrid objective generation function generation unit is used to: calculate the information-physical coupling residual of the forgery attack feature vector to obtain the coupling consistency residual; exponentially quantize the coupling consistency residual by the physical violation penalty term to obtain the physical constraint regularization term; and aggregate the physical constraint regularization term and the adversarial loss value by the physical-aware hybrid game loss to obtain the hybrid objective function value.

Images