A collaborative protection method and system for routers, gateways, and cameras based on AI

Abstract

This invention provides an AI-based method and system for collaborative protection of routers, gateways, and cameras in the field of network security technology. The method includes: Step S1, deploying localized AI anomaly detection models in network devices and cameras respectively; Step S2, the server generates and distributes a unified security protection policy to the network devices, and the network devices distribute the security protection policy to at least one camera within the local area network; Step S3, the AI ​​anomaly detection model in the network devices monitors global network traffic in real time, and the AI ​​anomaly detection model in the cameras monitors its own device behavior in real time; when any AI anomaly detection model identifies an anomaly, it generates an alarm message and reports it to the network devices; Step S4, the network devices determine the attack risk level based on the alarm message and perform interception operations based on the attack risk level. The advantages of this invention are: achieving accurate and real-time perception and collaborative handling of unknown threats, while taking into account both privacy protection and deployment efficiency.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an AI-based method and system for collaborative protection of routers, gateways and cameras. Background Technology

[0002] With the rapid development of IoT technology, smart homes, smart offices, and industrial monitoring are becoming increasingly common. Routers and gateways, as core hubs of network communication, and cameras, as important sensing and data acquisition terminals, have become indispensable basic devices in these scenarios. These devices undertake critical tasks such as data transmission, protocol conversion, video stream acquisition, and remote access, but they also face increasingly severe security threats. Distributed denial-of-service attacks, port scanning, malicious code injection, and unauthorized access to and hijacking of camera video streams are frequent occurrences, which may lead to serious consequences such as device service interruption, leakage of user privacy data, and the theft of monitoring footage, posing a significant risk to the security of individuals and even enterprises.

[0003] Currently, the mainstream solutions on the market to address the aforementioned security threats fall into the following categories: 1. Traditional rule-based firewall technology: This method mainly filters data packets at the network or transport layer based on preset rules (such as IP address, port number, protocol type). Its disadvantages are that the rule base is updated slowly, it cannot effectively identify unknown attacks or new variant attacks using techniques such as protocol spoofing and port skipping, and its protection accuracy is low.

[0004] 2. Centralized Cloud-Based Security Detection: This solution uploads all network traffic data generated by devices such as routers and cameras to a cloud-based security center for unified analysis. While the cloud possesses powerful computing capabilities, this model inherently suffers from latency issues, making it difficult to meet the millisecond-level response requirements of attacks with extremely high real-time demands (such as DDoS). Furthermore, the large volume of data transmission consumes significant bandwidth and increases the risk of user privacy data being exposed during transmission and cloud storage.

[0005] 3. Standalone security software: This type of solution deploys security software on only a single device (such as a personal computer or mobile phone), lacking a unified perspective and collaborative management capability for multiple devices in the network, such as routers, gateways, and cameras. Security information is not shared between devices, making it impossible to form a joint prevention and control system, resulting in obvious security blind spots.

[0006] 4. Static signature database matching technology: This technology relies on manual analysis and regularly updated attack signature databases. Faced with rapidly evolving attack methods, the update cycle of the signature database often cannot keep up with the speed of attack mutations, resulting in insufficient detection capabilities for zero-day attacks and advanced persistent threats. Furthermore, it requires manual maintenance by the user, making the operation complex.

[0007] In summary, existing technologies mainly suffer from drawbacks such as low protection accuracy, insufficient real-time performance, lack of collaborative protection, excessive resource consumption, and complex operation and maintenance. Specifically, traditional methods struggle to cope with unknown and complex cyberattacks; cloud-based solutions cannot meet the stringent real-time requirements of the edge; and single-point protection models cannot build a globally effective security barrier.

[0008] Therefore, how to provide an AI-based method and system for collaborative protection of routers, gateways and cameras to achieve accurate and real-time detection and collaborative handling of unknown threats, while taking into account privacy protection and deployment efficiency, has become an urgent technical problem to be solved. Summary of the Invention

[0009] The technical problem to be solved by this invention is to provide an AI-based method and system for collaborative protection of routers, gateways and cameras, so as to achieve accurate and real-time detection and collaborative handling of unknown threats, while taking into account both privacy protection and deployment efficiency.

[0010] In a first aspect, the present invention provides an AI-based collaborative protection method for routers, gateways, and cameras, comprising the following steps: Step S1: Deploy localized AI anomaly detection models in network devices and cameras respectively; the AI ​​anomaly detection model in the network device is used to monitor network traffic characteristics; the AI ​​anomaly detection model in the camera is used to monitor the device's own behavior characteristics; the network device is a router or gateway. Step S2: The server generates and distributes a unified security protection policy to the network device, and the network device distributes the security protection policy to at least one camera in the local area network. Step S3: The AI ​​anomaly detection model in the network device monitors global network traffic in real time, and the AI ​​anomaly detection model in the camera monitors its own device behavior in real time; when any of the AI ​​anomaly detection models identifies an anomaly, an alarm message is generated and reported to the network device. Step S4: The network device determines the attack risk level based on the alarm information, and performs interception operations at the network layer, application layer, or device layer based on the attack risk level. Step S5: The network device records alarm information and details of interception operations, generates a security log, and synchronizes the security log to local storage and cloud server.

[0011] Furthermore, in step S1, the AI ​​anomaly detection model adopts a fusion model of MobileNetV2 and LSTM, which supports incremental training based on data collected in the local network environment to dynamically update the model parameters. The network traffic characteristics include packet size, transmission frequency, protocol type, and source IP address reliability; the device behavior characteristics include abnormal camera access frequency, illegal port calls, and abnormal video stream uploads. The network device communicates with the camera via an encrypted local area network communication link.

[0012] Furthermore, in step S2, the security protection strategy supports hierarchical configuration, including basic protection level, enhanced protection level and custom protection level; the custom protection level supports user-defined IP whitelist, protocol type blacklist and alarm threshold; The security protection strategy is encrypted using the AES-256 algorithm before being distributed.

[0013] Furthermore, in step S4, the interception operation employs a multi-level interception mechanism based on the attack risk level: For low-risk attacks, automatically perform blocking operations; For medium- or high-risk attacks, an alarm notification will be sent while automatically performing blocking operations; The network layer interception operation specifically involves the network device blocking the connection of abnormal IPs or blocking malicious ports. The interception operation at the device layer specifically involves the camera pausing video stream uploads or closing sensitive operation interfaces based on received instructions.

[0014] Furthermore, step S5 also includes: Based on the attack source IP, attack path, and attack time recorded in the security logs, a visualized security risk trend report is generated for users to query and trace security events.

[0015] Secondly, the present invention provides an AI-based router, gateway, and camera collaborative protection system, comprising the following modules: The AI ​​anomaly detection model deployment module is used to deploy localized AI anomaly detection models in network devices and cameras respectively; the AI ​​anomaly detection model in the network device is used to monitor network traffic characteristics; the AI ​​anomaly detection model in the camera is used to monitor the device's own device behavior characteristics; the network device is a router or gateway. The security protection policy distribution module is used by the server to generate and distribute a unified security protection policy to the network device, and the network device to distribute the security protection policy to at least one camera in the local area network. An anomaly monitoring module is used for the AI ​​anomaly detection model in the network device to monitor global network traffic in real time, and for the AI ​​anomaly detection model in the camera to monitor its own device behavior in real time; when any of the AI ​​anomaly detection models identifies an anomaly, an alarm message is generated and reported to the network device. The collaborative protection module is used by the network device to determine the attack risk level based on the alarm information, and to perform network layer, application layer or device layer interception operations based on the attack risk level. The security log management module is used by the network device to record alarm information and details of interception operations, generate security logs, and synchronize the security logs to local storage and cloud servers.

[0016] Furthermore, in the AI ​​anomaly detection model deployment module, the AI ​​anomaly detection model adopts a fusion model of MobileNetV2 and LSTM, which supports incremental training based on data collected in the local network environment to dynamically update the model parameters. The network traffic characteristics include packet size, transmission frequency, protocol type, and source IP address reliability; the device behavior characteristics include abnormal camera access frequency, illegal port calls, and abnormal video stream uploads. The network device communicates with the camera via an encrypted local area network communication link.

[0017] Furthermore, in the security protection policy distribution module, the security protection policy supports hierarchical configuration, including basic protection level, enhanced protection level and custom protection level; the custom protection level supports user-defined IP whitelist, protocol type blacklist and alarm threshold; The security protection strategy is encrypted using the AES-256 algorithm before being distributed.

[0018] Furthermore, in the collaborative protection module, the interception operation employs a multi-level interception mechanism based on the attack risk level: For low-risk attacks, automatically perform blocking operations; For medium- or high-risk attacks, an alarm notification will be sent while automatically performing blocking operations; The network layer interception operation specifically involves the network device blocking the connection of abnormal IPs or blocking malicious ports. The interception operation at the device layer specifically involves the camera pausing video stream uploads or closing sensitive operation interfaces based on received instructions.

[0019] Furthermore, the security log management module is also used for: Generate a visual security risk trend report based on the source IP, attack path, and attack time of the security log for users to query and trace security events.

[0020] The advantages of the present invention are as follows: 1. By deploying a localized AI anomaly detection model in network devices and cameras respectively, where the network device is a router or a gateway; the server generates and distributes a unified security protection policy to the network device, and the network device distributes the security protection policy to at least one camera within the local area network; the AI anomaly detection model in the network device monitors the global network traffic in real time, and the AI anomaly detection model in the camera monitors its own device behavior in real time. When any AI anomaly detection model identifies an anomaly, an alarm message is generated and reported to the network device; the network device determines the attack risk level based on the alarm message and performs interception operations at the network layer, application layer, or device layer, synchronously records the details of the alarm message and the interception operation to generate a security log, and synchronizes the security log to local storage and the cloud server; that is, a locally deployable and incrementally learnable AI anomaly detection model is deployed at the network edge devices such as routers / gateways and cameras to achieve real-time anomaly monitoring of network traffic and device behavior, fundamentally improving the perception accuracy and response timeliness of unknown threats; by establishing a collaborative mechanism with the network device as the hub, the alarm of any node can trigger cross-layer and cross-device linkage interception and disposal, forming a global joint defense system; this distributed architecture digests sensitive data locally, combines encrypted communication and unified policy distribution, significantly reducing bandwidth consumption and privacy leakage risks while achieving efficient collaborative protection and simplifying operation and maintenance deployment.

[0021] 2. By enabling the router, gateway, and camera to work together, comprehensive security protection at the network layer, device layer, and application layer is achieved; traditional security methods often handle network traffic or device behavior in isolation, while the present invention can simultaneously monitor the global network traffic and the behavior characteristics of the camera itself (such as abnormal access frequency and video stream upload) by deploying AI anomaly detection models in network devices and cameras respectively, thus effectively identifying cross-layer threats. This collaborative mechanism avoids security blind spots and improves the overall protection coverage and efficiency, especially suitable for smart home or Internet of Things environments where cameras often become the attack entry points.

[0022] 3. An AI anomaly detection model based on the fusion of MobileNetV2 and LSTM is adopted, and incremental training is supported. This allows the model to dynamically update parameters based on local environmental data, improving the accuracy and adaptability of detection. Compared with traditional rule bases or static models, this AI-driven approach can analyze complex features (such as packet size, transmission frequency, and illegal port calls) in real time, quickly identify new or variant attacks, and reduce false positives and false negatives. The real-time monitoring and alarm reporting mechanism ensures immediate response to threats and reduces the risk of security incidents spreading.

[0023] 4. A unified security protection policy is generated and distributed by the server, and then distributed to cameras by network devices, realizing centralized policy management. The policy supports hierarchical configuration (such as basic, enhanced and custom levels) and uses AES-256 encryption, which simplifies user operations (such as custom IP whitelists and alarm thresholds) and ensures the security of the transmission process. This unified management reduces manual configuration errors, improves the consistency and scalability of policies, and is particularly suitable for large-scale deployment scenarios.

[0024] 5. Perform multi-level blocking operations based on the attack risk level (e.g., automatic blocking for low-risk events, and simultaneous alarms for medium- and high-risk events), and specifically distinguish between the network layer (blocking abnormal IPs or blocking ports) and the device layer (pausing video stream uploads from cameras). This hierarchical response mechanism avoids excessive "one-size-fits-all" blocking and ensures the accuracy and resource efficiency of protection. For example, automatic handling can reduce human intervention for low-risk events, while alarm notifications facilitate timely intervention by administrators for high-risk events, thus improving the overall intelligence level of security response.

[0025] 6. By recording alarm information and interception operation details, security logs are generated and synchronized to local and cloud environments. At the same time, visualized risk trend reports are generated based on the attack source IP, path, and time. This not only makes it easier for users to query and trace security events, but also provides a data foundation for long-term security analysis. The visualized reports help identify attack patterns, support proactive protection strategy adjustments, meet the needs of modern security operations and maintenance, and enhance practical value and compliance.

[0026] 7. The AI ​​anomaly detection model is deployed on local devices (such as routers and cameras) and transmits data through encrypted communication links on the local area network, reducing reliance on external cloud services. This localization reduces network latency, improves response speed, and avoids the risk of leakage of sensitive data (such as video streams), better meeting privacy protection requirements and enhancing user trust.

[0027] 8. The AI anomaly detection model supports incremental training based on local network environment data and dynamically updates parameters, enabling the solution to adapt to the ever-changing threat environment. Compared with fixed models, this adaptive ability ensures long-term effectiveness, reduces model obsolescence issues, and lowers maintenance costs, demonstrating the forward-looking and sustainable nature of the technology.

[0028] 9. By collaborating the router, gateway, and camera for joint protection, and using the localized AI anomaly detection model to achieve real-time monitoring of network traffic and device behavior, combined with unified policy management and multi-level interception mechanisms, it significantly enhances the comprehensiveness, accuracy, and response efficiency of security protection. At the same time, its adaptive ability to support incremental training, encrypted policy distribution, and security log visualization functions enhance the flexibility, privacy protection, and traceability of the system, providing an efficient, intelligent, and user-friendly security solution overall. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The present invention will be further described below with reference to the accompanying drawings in conjunction with embodiments.

[0030] Figure 1 It is a flowchart of a method for collaborative protection of a router, gateway, and camera based on AI according to the present invention.

[0031] Figure 2 It is a schematic structural diagram of a system for collaborative protection of a router, gateway, and camera based on AI according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0032] The overall idea of the technical solution in the embodiments of the present application is as follows: Deploy an AI anomaly detection model with incremental learning capabilities locally on network edge devices such as routers / gateways and cameras to achieve real-time anomaly monitoring of network traffic and device behavior, improving the perception accuracy and response timeliness for unknown threats. By establishing a collaborative mechanism with network devices as the hub, an alarm at any node can trigger cross-network layer and device layer linkage interception and disposal, forming a global joint defense system. Digest sensitive data locally, combined with encrypted communication and unified policy distribution, ultimately achieving accurate and real-time perception of unknown threats and collaborative linkage disposal, while taking into account privacy protection and deployment efficiency.

[0033] Please refer to Figures 1 to 2 As shown, a preferred embodiment of a method for collaborative protection of a router, gateway, and camera based on AI according to the present invention includes the following steps: Step S1: Deploy localized AI anomaly detection models in network devices and cameras respectively; the AI ​​anomaly detection model in the network device is used to monitor network traffic characteristics; the AI ​​anomaly detection model in the camera is used to monitor the device's own behavior characteristics; the network device is a router or gateway, responsible for data forwarding and management within the local area network; the camera, as an IoT terminal device, is used for video acquisition and monitoring; the network device establishes encrypted communication links with each camera and associated device through the local area network (Wi-Fi / Ethernet / Zigbee); Step S2: The server (such as a cloud-based security management platform) generates and distributes a unified security protection policy to the network device based on global threat intelligence and user configuration. The network device then distributes the security protection policy to at least one camera within the local area network. In specific implementation, the security protection policy supports version management and rollback, records policy modification logs, and supports automatically updating the attack signature database by obtaining the latest attack signature data from the security server through an encrypted channel. Step S3: The AI ​​anomaly detection model in the network device monitors global network traffic in real time, and the AI ​​anomaly detection model in the camera monitors its own device behavior in real time; when any of the AI ​​anomaly detection models identifies an anomaly (such as DDoS attack packets, illegal IP access requests), an alarm message is generated (including details such as attack type, attack source, affected devices, and interception results) and reported to the network device; Network devices analyze incoming traffic at line speed, detecting abnormal patterns in real time (such as large-scale connection requests or port scanning behavior during a DDoS attack). Cameras continuously monitor their own status, for example, immediately triggering local alarms when abnormal video stream uploads are detected (such as data rates exceeding thresholds) or illegal port calls are made.

[0034] The alarm information includes details such as attack type, attack source IP, affected device identifier, timestamp, and confidence level. The reporting mechanism uses an asynchronous approach, sending alarms to network devices via an encrypted channel to avoid blocking normal operations. In practice, the network device acts as a coordination center, aggregating alarms from multiple cameras and performing preliminary correlation analysis to identify cross-device attack patterns.

[0035] Step S4: The network device, based on the security protection policy, determines the attack risk level according to the alarm information, and performs network layer, application layer, or device layer interception operations based on the attack risk level; the attack risk level is low-risk attack, medium-risk attack, or high-risk attack, and carries the attack type; the attack risk level is dynamically determined based on the severity, frequency, and source of the alarm; for example, a single port scan may be considered low-risk, while continuous video stream hijacking attempts are high-risk.

[0036] Step S5: The network device records alarm information and details of interception operations, generates a security log, and synchronizes the security log to local storage (such as the network device's SD card) and a cloud server via an encrypted channel, supporting cross-device log aggregation and analysis as well as redundant backup. In specific implementation, the security log supports retrieval by time, attack type, device name, and other dimensions, provides a visual report of security status, and displays network security risk trends; it also supports multi-channel alarm notifications (APP push, SMS, email).

[0037] In step S1, the AI ​​anomaly detection model adopts a fusion model of MobileNetV2 and LSTM, which supports incremental training based on data collected in the local network environment to dynamically update model parameters and adapt to the ever-changing threat environment. In specific implementation, the initial version of the model is pre-trained by the cloud server and then distributed, and subsequently fine-tuned using local data (such as normal traffic and behavior samples) to reduce false alarms. MobileNetV2 is used to efficiently extract spatial features (such as packet size and protocol type), and LSTM is used to analyze time series features (such as transmission frequency and access frequency). The network traffic characteristics include packet size, transmission frequency, protocol type, and source IP address credibility (e.g., assessing IP risk through a reputation database); the device behavior characteristics include abnormal camera access frequency (e.g., frequent unauthorized access attempts), illegal port calls (e.g., connection attempts to non-standard ports), and abnormal video stream uploads (e.g., sudden increases in data volume or abnormal encryption). The network device communicates with the camera via a local area network encrypted communication link (such as Wi-Fi or Zigbee protocol based on TLS) to ensure communication security and avoid man-in-the-middle attacks; the encryption key is dynamically generated and managed by the network device and rotated periodically to enhance security.

[0038] The AI ​​anomaly detection model is a fusion architecture of MobileNetV2 and LSTM, designed to balance spatial feature extraction and time series analysis to meet the resource constraints and real-time requirements of edge devices. The specific network structure is as follows: The MobileNetV2 module, acting as a front-end feature extractor, employs depthwise separable convolution to construct a lightweight network. This module includes inverted residual blocks, where the input data is first increased in dimensionality through 1x1 convolutions, then processed by 3x3 depthwise convolutions, and finally reduced in dimensionality through 1x1 convolutions. The output of MobileNetV2 is a high-dimensional feature map used to capture spatial features of network traffic or device behavior (such as packet size distribution and protocol type combination patterns).

[0039] The LSTM module acts as a backend time series analyzer, receiving a flattened feature sequence output from MobileNetV2. The LSTM module consists of multiple layers of LSTM units, each containing an input gate, a forget gate, and an output gate, used to learn temporal dependencies (such as periodic variations in transmission frequency and trends in anomalous access frequency). The hidden state dimension of the LSTM is set to 128 or 256 to balance computational efficiency and model capacity.

[0040] Fusion and Output Layers: The feature sequences extracted by MobileNetV2 are input into the LSTM at time steps. The final hidden state of the LSTM is mapped to the output through a fully connected layer. The output layer uses the sigmoid activation function to generate anomaly probability scores, or uses the softmax function for multi-class classification (e.g., normal, low risk, medium risk, high risk).

[0041] The entire model is designed to be trainable end-to-end, with optimized parameter scale, making it suitable for resource-constrained devices such as routers, gateways, and cameras.

[0042] Model training involves the following key parameters to ensure convergence speed and detection accuracy: Optimizer: The Adam optimizer (adaptive moment estimation) is used, with an initial learning rate set to 0.001 and dynamically adjusted based on the training loss (e.g., using a learning rate decay strategy).

[0043] Loss function: For anomaly detection tasks, the binary cross-entropy loss is used to calculate the error of the anomaly probability; for multi-class tasks, the categorical cross-entropy loss is used.

[0044] Batch Size: Depending on the device's memory settings, it is typically 16 or 32 to support small batch updates during incremental training.

[0045] Training Epochs: Set the number of epochs to 50-100 during initial training; reduce the number of epochs to 5-10 during incremental training to avoid overfitting.

[0046] Regularization: Use Dropout (dropout rate 0.2-0.5) and L2 regularization (weight decay coefficient 0.001) to prevent overfitting.

[0047] Incremental learning parameters: During incremental training, the learning rate is reduced to 0.0001, and the Elastic Weight Consolidation (EWC) technique is used to retain important parameters and avoid catastrophic forgetting.

[0048] ● The model's input data is divided into two categories, corresponding to network devices (routers / gateways) and cameras, respectively: a. Network traffic characteristics (for network devices): Data packet size: Normalized number of bytes, sliding window statistics (e.g., every 10 seconds window).

[0049] Transmission frequency: Number of data packets or connections per second, calculated as a moving average.

[0050] Protocol type: One-hot encoding represents common protocols (such as TCP, UDP, HTTP).

[0051] Source IP address credibility: based on a score (0-1 range) from a reputation database, such as marking suspicious IPs as low credibility.

[0052] Input format: The data is organized as a time series, with each time step containing multiple feature dimensions (such as 4-dimensional features), and the sequence length is fixed at 60-100 time steps.

[0053] b. Device behavioral characteristics (for cameras): Abnormal access frequency: The number of unauthorized access attempts per minute, normalized.

[0054] Illegal port call: A binary flag (0 or 1) indicates a connection event to a non-standard port.

[0055] Abnormal video stream uploads: Coefficient of variation (standard deviation / mean) of upload data rate, or abnormal indicators of encrypted traffic.

[0056] Input format: Input in time series format, with the series length aligned with network traffic characteristics.

[0057] Input data preprocessing includes normalization (Min-Max scaling) and sliding window segmentation to ensure model stability.

[0058] ●The model outputs the anomaly detection results, in the following format: Anomaly Probability Score: The Sigmoid output ranges from [0,1], representing the confidence level of current traffic or behavior anomalies. A preset threshold (e.g., 0.5) is used to trigger an alarm; the threshold can be adjusted based on security policies (e.g., 0.6 for basic level, 0.4 for enhanced level).

[0059] Risk level classification: Softmax outputs multi-class probabilities, including normal, low risk, medium risk, and high risk. The classification results are directly used for attack risk level determination in step S4.

[0060] The output data includes a timestamp and device identifier, which are used for alarm information generation and log recording.

[0061] In step S2, the security protection policy supports hierarchical configuration, including basic protection level (default setting, suitable for general home networks), enhanced protection level (for enterprise environments, increasing detection sensitivity), and custom protection level; the custom protection level supports user-defined IP whitelists, protocol type blacklists, and alarm thresholds; for example, users can add trusted device IPs to the whitelist or block specific protocols (such as FTP) to reduce risks; The security protection strategy is encrypted using the AES-256 algorithm before being distributed to ensure it is not tampered with during transmission. After receiving the strategy, the network device distributes it to all connected cameras via LAN broadcast or point-to-point method.

[0062] In step S4, the interception operation employs a multi-level interception mechanism based on the attack risk level: For low-risk attacks, blocking operations are performed automatically, such as dropping abnormal data packets, without user intervention; For medium- or high-risk attacks, while automatically performing blocking operations, an alarm notification (such as APP push, SMS or email) is sent to prompt the administrator to intervene; The network layer interception operation specifically involves the network device blocking the connection of abnormal IPs or blocking malicious ports (such as closing unused ports). The specific interception operation at the device layer is as follows: the camera pauses video stream upload, closes sensitive operation interfaces (such as remote configuration functions), or enters a safe mode according to the received instructions; The application layer interception operation specifically involves the network device rejecting illegal protocol access (such as blocking video stream requests that are not based on HTTP protocol) and filtering malicious data packets (based on deep packet inspection).

[0063] In practice, the camera has a built-in local interception unit that can independently execute security protection strategies when the network is interrupted, ensuring continuous protection.

[0064] Step S5 further includes: Based on the attack source IP, attack path, and attack time recorded in the security logs, a visualized security risk trend report is generated for users to query and trace security events.

[0065] A preferred embodiment of the AI-based router, gateway, and camera collaborative protection system of the present invention includes the following modules: The AI ​​anomaly detection model deployment module is used to deploy localized AI anomaly detection models in network devices and cameras respectively. The AI ​​anomaly detection model in the network device is used to monitor network traffic characteristics; the AI ​​anomaly detection model in the camera is used to monitor the device's own behavior characteristics; the network device is a router or gateway, responsible for data forwarding and management within the local area network; the camera, as an IoT terminal device, is used for video acquisition and monitoring; the network device establishes encrypted communication links with each camera and associated device through the local area network (Wi-Fi / Ethernet / Zigbee). The security protection policy distribution module is used by the server (such as a cloud security management platform) to generate and distribute a unified security protection policy to the network device based on global threat intelligence and user configuration. The network device then distributes the security protection policy to at least one camera within the local area network. In specific implementation, the security protection policy supports version management and rollback, records policy modification logs, and supports automatic updates to the attack signature database by obtaining the latest attack signature data from the security server through an encrypted channel. An anomaly monitoring module is used for the AI ​​anomaly detection model in the network device to monitor global network traffic in real time, and for the AI ​​anomaly detection model in the camera to monitor its own device behavior in real time. When any of the AI ​​anomaly detection models identifies an anomaly (such as DDoS attack packets or illegal IP access requests), an alarm message (including details such as attack type, attack source, affected devices, and interception results) is generated and reported to the network device. Network devices analyze incoming traffic at line speed, detecting abnormal patterns in real time (such as large-scale connection requests or port scanning behavior during a DDoS attack). Cameras continuously monitor their own status, for example, immediately triggering local alarms when abnormal video stream uploads are detected (such as data rates exceeding thresholds) or illegal port calls are made.

[0066] The alarm information includes details such as attack type, attack source IP, affected device identifier, timestamp, and confidence level. The reporting mechanism uses an asynchronous approach, sending alarms to network devices via an encrypted channel to avoid blocking normal operations. In practice, the network device acts as a coordination center, aggregating alarms from multiple cameras and performing preliminary correlation analysis to identify cross-device attack patterns.

[0067] The collaborative protection module is used by the network device to determine the attack risk level based on the security protection policy and the alarm information, and to perform network layer, application layer, or device layer interception operations based on the attack risk level; the attack risk level is low-risk attack, medium-risk attack, or high-risk attack, and carries the attack type; the attack risk level is dynamically determined based on the severity, frequency, and source of the alarm; for example, a single port scan may be considered low-risk, while continuous video stream hijacking attempts are high-risk.

[0068] The security log management module is used by the network device to record alarm information and details of interception operations, generate security logs, and synchronize these logs to local storage (such as the network device's SD card) and a cloud server via an encrypted channel. It supports cross-device log aggregation and analysis as well as redundant backups. In practice, the security logs support retrieval by time, attack type, device name, and other dimensions, provide visualized security status reports, and display network security risk trends; it also supports multi-channel alarm notifications (APP push, SMS, email).

[0069] In the AI ​​anomaly detection model deployment module, the AI ​​anomaly detection model adopts a fusion model of MobileNetV2 and LSTM, which supports incremental training based on data collected in the local network environment to dynamically update model parameters and adapt to the ever-changing threat environment. In specific implementation, the initial version of the model is pre-trained by the cloud server and then distributed, and subsequently fine-tuned using local data (such as normal traffic and behavior samples) to reduce false alarms. MobileNetV2 is used to efficiently extract spatial features (such as packet size and protocol type), and LSTM is used to analyze time series features (such as transmission frequency and access frequency). The network traffic characteristics include packet size, transmission frequency, protocol type, and source IP address credibility (e.g., assessing IP risk through a reputation database); the device behavior characteristics include abnormal camera access frequency (e.g., frequent unauthorized access attempts), illegal port calls (e.g., connection attempts to non-standard ports), and abnormal video stream uploads (e.g., sudden increases in data volume or abnormal encryption). The network device communicates with the camera via a local area network encrypted communication link (such as Wi-Fi or Zigbee protocol based on TLS) to ensure communication security and avoid man-in-the-middle attacks; the encryption key is dynamically generated and managed by the network device and rotated periodically to enhance security.

[0070] The AI ​​anomaly detection model is a fusion architecture of MobileNetV2 and LSTM, designed to balance spatial feature extraction and time series analysis to meet the resource constraints and real-time requirements of edge devices. The specific network structure is as follows: The MobileNetV2 module, acting as a front-end feature extractor, employs depthwise separable convolution to construct a lightweight network. This module includes inverted residual blocks, where the input data is first increased in dimensionality through 1x1 convolutions, then processed by 3x3 depthwise convolutions, and finally reduced in dimensionality through 1x1 convolutions. The output of MobileNetV2 is a high-dimensional feature map used to capture spatial features of network traffic or device behavior (such as packet size distribution and protocol type combination patterns).

[0071] The LSTM module acts as a backend time series analyzer, receiving a flattened feature sequence output from MobileNetV2. The LSTM module consists of multiple layers of LSTM units, each containing an input gate, a forget gate, and an output gate, used to learn temporal dependencies (such as periodic variations in transmission frequency and trends in anomalous access frequency). The hidden state dimension of the LSTM is set to 128 or 256 to balance computational efficiency and model capacity.

[0072] Fusion and Output Layers: The feature sequences extracted by MobileNetV2 are input into the LSTM at time steps. The final hidden state of the LSTM is mapped to the output through a fully connected layer. The output layer uses the sigmoid activation function to generate anomaly probability scores, or uses the softmax function for multi-class classification (e.g., normal, low risk, medium risk, high risk).

[0073] The entire model is designed to be trainable end-to-end, with optimized parameter scale, making it suitable for resource-constrained devices such as routers, gateways, and cameras.

[0074] Model training involves the following key parameters to ensure convergence speed and detection accuracy: Optimizer: The Adam optimizer (adaptive moment estimation) is used, with an initial learning rate set to 0.001 and dynamically adjusted based on the training loss (e.g., using a learning rate decay strategy).

[0075] Loss function: For anomaly detection tasks, the binary cross-entropy loss is used to calculate the error of the anomaly probability; for multi-class tasks, the categorical cross-entropy loss is used.

[0076] Batch Size: Depending on the device's memory settings, it is typically 16 or 32 to support small batch updates during incremental training.

[0077] Training Epochs: Set the number of epochs to 50-100 during initial training; reduce the number of epochs to 5-10 during incremental training to avoid overfitting.

[0078] Regularization: Use Dropout (dropout rate 0.2-0.5) and L2 regularization (weight decay coefficient 0.001) to prevent overfitting.

[0079] Incremental learning parameters: During incremental training, the learning rate is reduced to 0.0001, and the Elastic Weight Consolidation (EWC) technique is used to retain important parameters and avoid catastrophic forgetting.

[0080] ● The model's input data is divided into two categories, corresponding to network devices (routers / gateways) and cameras, respectively: a. Network traffic characteristics (for network devices): Data packet size: Normalized number of bytes, sliding window statistics (e.g., every 10 seconds window).

[0081] Transmission frequency: Number of data packets or connections per second, calculated as a moving average.

[0082] Protocol type: One-hot encoding represents common protocols (such as TCP, UDP, HTTP).

[0083] Source IP address credibility: based on a score (0-1 range) from a reputation database, such as marking suspicious IPs as low credibility.

[0084] Input format: The data is organized as a time series, with each time step containing multiple feature dimensions (such as 4-dimensional features), and the sequence length is fixed at 60-100 time steps.

[0085] b. Device behavioral characteristics (for cameras): Abnormal access frequency: The number of unauthorized access attempts per minute, normalized.

[0086] Illegal port call: A binary flag (0 or 1) indicates a connection event to a non-standard port.

[0087] Abnormal video stream uploads: Coefficient of variation (standard deviation / mean) of upload data rate, or abnormal indicators of encrypted traffic.

[0088] Input format: Input in time series format, with the series length aligned with network traffic characteristics.

[0089] Input data preprocessing includes normalization (Min-Max scaling) and sliding window segmentation to ensure model stability.

[0090] ●The model outputs the anomaly detection results, in the following format: Anomaly Probability Score: The Sigmoid output ranges from [0,1], representing the confidence level of current traffic or behavior anomalies. A preset threshold (e.g., 0.5) is used to trigger an alarm; the threshold can be adjusted based on security policies (e.g., 0.6 for basic level, 0.4 for enhanced level).

[0091] Risk level classification: Softmax outputs multi-class probabilities, including normal, low risk, medium risk, and high risk. The classification results are directly used for attack risk level determination in step S4.

[0092] The output data includes a timestamp and device identifier, which are used for alarm information generation and log recording.

[0093] In the security protection policy distribution module, the security protection policy supports hierarchical configuration, including basic protection level (default setting, suitable for general home networks), enhanced protection level (for enterprise environments, increasing detection sensitivity) and custom protection level; the custom protection level supports user-defined IP whitelists, protocol type blacklists and alarm thresholds; for example, users can add trusted device IPs to the whitelist, or block specific protocols (such as FTP) to reduce risks; The security protection strategy is encrypted using the AES-256 algorithm before being distributed to ensure it is not tampered with during transmission. After receiving the strategy, the network device distributes it to all connected cameras via LAN broadcast or point-to-point method.

[0094] In the collaborative protection module, the interception operation adopts a multi-level interception mechanism based on the attack risk level: For low-risk attacks, blocking operations are performed automatically, such as dropping abnormal data packets, without user intervention; For medium- or high-risk attacks, while automatically performing blocking operations, an alarm notification (such as APP push, SMS or email) is sent to prompt the administrator to intervene; The network layer interception operation specifically involves the network device blocking the connection of abnormal IPs or blocking malicious ports (such as closing unused ports). The specific interception operation at the device layer is as follows: the camera pauses video stream upload, closes sensitive operation interfaces (such as remote configuration functions), or enters a safe mode according to the received instructions; The application layer interception operation specifically involves the network device rejecting illegal protocol access (such as blocking video stream requests that are not based on HTTP protocol) and filtering malicious data packets (based on deep packet inspection).

[0095] In practice, the camera has a built-in local interception unit that can independently execute security protection strategies when the network is interrupted, ensuring continuous protection.

[0096] The security log management module is further configured to: Generate a visual security risk trend report based on the attack source IP, attack path, and attack time recorded in the security log, for users to query and trace security events.

[0097] In summary, the advantages of the present invention are as follows: 1. By separately deploying a localized AI anomaly detection model in network devices and cameras, where the network device is a router or gateway; the server generates and distributes a unified security protection policy to the network device, and the network device distributes the security protection policy to at least one camera within the local area network; the AI anomaly detection model in the network device monitors the global network traffic in real time, and the AI anomaly detection model in the camera monitors its own device behavior in real time. When any AI anomaly detection model identifies an anomaly, it generates an alarm message and reports it to the network device; the network device determines the attack risk level based on the alarm message and performs interception operations at the network layer, application layer, or device layer, synchronously records the details of the alarm message and the interception operation to generate a security log, and synchronizes the security log to local storage and the cloud server; that is, by locally deploying an AI anomaly detection model with incremental learning ability in network edge devices such as routers / gateways and cameras, real-time anomaly monitoring of network traffic and device behavior is achieved, fundamentally improving the perception accuracy and response timeliness of unknown threats; by establishing a collaborative mechanism with the network device as the hub, the alarm of any node can trigger cross-layer and cross-device联动interception and handling, forming a global joint defense system; this distributed architecture digests sensitive data locally, combines encrypted communication and unified policy distribution, while achieving efficient collaborative protection, significantly reducing the bandwidth consumption and privacy leakage risk, and simplifying the operation and maintenance deployment.

[0098] 2. By enabling the router, gateway, and camera to work collaboratively, comprehensive security protection at the network layer, device layer, and application layer is achieved; traditional security methods often handle network traffic or device behavior in isolation, while the present invention can simultaneously monitor the global network traffic and the behavior characteristics of the camera itself (such as abnormal access frequency and video stream upload) by separately deploying an AI anomaly detection model in the network device and the camera, thus effectively identifying cross-layer threats. This collaborative mechanism avoids security blind spots, improves the coverage and efficiency of overall protection, and is particularly suitable for smart home or Internet of Things environments, where cameras often become the attack entry points.

[0099] 3. An AI anomaly detection model based on the fusion of MobileNetV2 and LSTM is adopted, and incremental training is supported. This allows the model to dynamically update parameters based on local environmental data, improving the accuracy and adaptability of detection. Compared with traditional rule bases or static models, this AI-driven approach can analyze complex features (such as packet size, transmission frequency, and illegal port calls) in real time, quickly identify new or variant attacks, and reduce false positives and false negatives. The real-time monitoring and alarm reporting mechanism ensures immediate response to threats and reduces the risk of security incidents spreading.

[0100] 4. A unified security protection policy is generated and distributed by the server, and then distributed to cameras by network devices, realizing centralized policy management. The policy supports hierarchical configuration (such as basic, enhanced and custom levels) and uses AES-256 encryption, which simplifies user operations (such as custom IP whitelists and alarm thresholds) and ensures the security of the transmission process. This unified management reduces manual configuration errors, improves the consistency and scalability of policies, and is particularly suitable for large-scale deployment scenarios.

[0101] 5. Perform multi-level blocking operations based on the attack risk level (e.g., automatic blocking for low-risk events, and simultaneous alarms for medium- and high-risk events), and specifically distinguish between the network layer (blocking abnormal IPs or blocking ports) and the device layer (pausing video stream uploads from cameras). This hierarchical response mechanism avoids excessive "one-size-fits-all" blocking and ensures the accuracy and resource efficiency of protection. For example, automatic handling can reduce human intervention for low-risk events, while alarm notifications facilitate timely intervention by administrators for high-risk events, thus improving the overall intelligence level of security response.

[0102] 6. By recording alarm information and interception operation details, security logs are generated and synchronized to local and cloud environments. At the same time, visualized risk trend reports are generated based on the attack source IP, path, and time. This not only makes it easier for users to query and trace security events, but also provides a data foundation for long-term security analysis. The visualized reports help identify attack patterns, support proactive protection strategy adjustments, meet the needs of modern security operations and maintenance, and enhance practical value and compliance.

[0103] 7. The AI ​​anomaly detection model is deployed on local devices (such as routers and cameras) and transmits data through encrypted communication links on the local area network, reducing reliance on external cloud services. This localization reduces network latency, improves response speed, and avoids the risk of leakage of sensitive data (such as video streams), better meeting privacy protection requirements and enhancing user trust.

[0104] 8. The AI ​​anomaly detection model supports incremental training based on local network environment data and dynamic parameter updates, which enables the solution to adapt to the ever-changing threat environment. Compared with a fixed model, this adaptive capability ensures long-term effectiveness, reduces model obsolescence issues, lowers maintenance costs, and reflects the forward-looking and sustainable nature of the technology.

[0105] 9. By coordinating the protection of routers, gateways, and cameras, and utilizing a localized AI anomaly detection model to achieve real-time monitoring of network traffic and device behavior, combined with unified policy management and multi-level interception mechanisms, the comprehensiveness, accuracy, and response efficiency of security protection are significantly improved. At the same time, it supports adaptive incremental training, encrypted policy distribution, and security log visualization, enhancing the system's flexibility, privacy protection, and traceability, and providing an efficient, intelligent, and user-friendly security solution overall.

[0106] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the present invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A collaborative protection method for routers, gateways, and cameras based on AI, characterized in that: Includes the following steps: Step S1: Deploy localized AI anomaly detection models in network devices and cameras respectively; the AI ​​anomaly detection model in the network device is used to monitor network traffic characteristics; the AI ​​anomaly detection model in the camera is used to monitor the device's own behavior characteristics. The network device is a router or gateway; Step S2: The server generates and distributes a unified security protection policy to the network device, and the network device distributes the security protection policy to at least one camera in the local area network. Step S3: The AI ​​anomaly detection model in the network device monitors global network traffic in real time, and the AI ​​anomaly detection model in the camera monitors its own device behavior in real time; when any of the AI ​​anomaly detection models identifies an anomaly, an alarm message is generated and reported to the network device. Step S4: The network device determines the attack risk level based on the alarm information, and performs interception operations at the network layer, application layer, or device layer based on the attack risk level. Step S5: The network device records alarm information and details of interception operations, generates a security log, and synchronizes the security log to local storage and cloud server.

2. The AI-based router, gateway, and camera collaborative protection method as described in claim 1, characterized in that: In step S1, the AI ​​anomaly detection model adopts a fusion model of MobileNetV2 and LSTM, which supports incremental training based on data collected in the local network environment to dynamically update the model parameters. The network traffic characteristics include packet size, transmission frequency, protocol type, and source IP address reliability; the device behavior characteristics include abnormal camera access frequency, illegal port calls, and abnormal video stream uploads. The network device communicates with the camera via an encrypted local area network communication link.

3. The AI-based router, gateway, and camera collaborative protection method as described in claim 1, characterized in that: In step S2, the security protection strategy supports hierarchical configuration, including basic protection level, enhanced protection level and custom protection level; the custom protection level supports user-defined IP whitelist, protocol type blacklist and alarm threshold. The security protection strategy is encrypted using the AES-256 algorithm before being distributed.

4. The AI-based router, gateway, and camera collaborative protection method as described in claim 1, characterized in that: In step S4, the interception operation employs a multi-level interception mechanism based on the attack risk level: For low-risk attacks, automatically perform blocking operations; For medium- or high-risk attacks, an alarm notification will be sent while automatically performing blocking operations; The network layer interception operation specifically involves the network device blocking the connection of abnormal IPs or blocking malicious ports. The interception operation at the device layer specifically involves the camera pausing video stream uploads or closing sensitive operation interfaces based on received instructions.

5. The AI-based router, gateway, and camera collaborative protection method as described in claim 1, characterized in that: Step S5 further includes: Based on the attack source IP, attack path, and attack time recorded in the security logs, a visualized security risk trend report is generated for users to query and trace security events.

6. An AI-based collaborative protection system for routers, gateways, and cameras, characterized in that: Includes the following modules: The AI ​​anomaly detection model deployment module is used to deploy localized AI anomaly detection models in network devices and cameras respectively; the AI ​​anomaly detection model in the network device is used to monitor network traffic characteristics; the AI ​​anomaly detection model in the camera is used to monitor the device's own device behavior characteristics. The network device is a router or gateway; The security protection policy distribution module is used by the server to generate and distribute a unified security protection policy to the network device, and the network device to distribute the security protection policy to at least one camera in the local area network. An anomaly monitoring module is used for the AI ​​anomaly detection model in the network device to monitor global network traffic in real time, and for the AI ​​anomaly detection model in the camera to monitor its own device behavior in real time; when any of the AI ​​anomaly detection models identifies an anomaly, an alarm message is generated and reported to the network device. The collaborative protection module is used by the network device to determine the attack risk level based on the alarm information, and to perform network layer, application layer or device layer interception operations based on the attack risk level. The security log management module is used by the network device to record alarm information and details of interception operations, generate security logs, and synchronize the security logs to local storage and cloud servers.

7. The AI-based router, gateway, and camera collaborative protection system as described in claim 6, characterized in that: In the AI ​​anomaly detection model deployment module, the AI ​​anomaly detection model adopts a fusion model of MobileNetV2 and LSTM, which supports incremental training based on data collected in the local network environment to dynamically update the model parameters. The network traffic characteristics include packet size, transmission frequency, protocol type, and source IP address reliability; the device behavior characteristics include abnormal camera access frequency, illegal port calls, and abnormal video stream uploads. The network device communicates with the camera via an encrypted local area network communication link.

8. The AI-based router, gateway, and camera collaborative protection system as described in claim 6, characterized in that: In the security protection policy distribution module, the security protection policy supports hierarchical configuration, including basic protection level, enhanced protection level and custom protection level; the custom protection level supports user-defined IP whitelist, protocol type blacklist and alarm threshold; The security protection strategy is encrypted using the AES-256 algorithm before being distributed.

9. The AI-based router, gateway, and camera collaborative protection system as described in claim 6, characterized in that: In the collaborative protection module, the interception operation adopts a multi-level interception mechanism based on the attack risk level: For low-risk attacks, automatically perform blocking operations; For medium- or high-risk attacks, an alarm notification will be sent while automatically performing blocking operations; The network layer interception operation specifically involves the network device blocking the connection of abnormal IPs or blocking malicious ports. The interception operation at the device layer specifically involves the camera pausing video stream uploads or closing sensitive operation interfaces based on received instructions.

10. The AI-based router, gateway, and camera collaborative protection system as described in claim 6, characterized in that: The security log management module is also used for: Based on the attack source IP, attack path, and attack time recorded in the security logs, a visualized security risk trend report is generated for users to query and trace security events.

Images