An internet of things card security monitoring method and system

Abstract

The application relates to the technical field of network security monitoring, and discloses an Internet of Things card security monitoring method and system, the method comprising: performing local density calculation on the traffic feature vectors of different Internet of Things cards to obtain the aggregation degree values of the different Internet of Things cards, and selecting a preset number of traffic feature vectors as initial cluster centers; using improved K-means clustering to divide the traffic feature vectors of the different Internet of Things cards into different traffic clusters; constructing the abnormality degree values of the Internet of Things cards corresponding to the traffic feature vectors, and taking the Internet of Things cards with abnormality degrees exceeding a preset threshold value as abnormal network cards to perform security alarm. The application constructs traffic feature vectors representing the time sequence correlation and Fourier point number correlation of different traffic data packets, realizes traffic feature extraction representing the traffic change of the Internet of Things cards, weights the traffic feature vectors based on the information entropy of the dimensions and the dimension slope representing the dimension change rate, and constructs the abnormality degree values representing the multidimensional change of the traffic data sequence to perform abnormality monitoring.

Description

Technical Field

[0001] This invention relates to the field of network security monitoring, and in particular to a method and system for monitoring the security of Internet of Things (IoT) cards. Background Technology

[0002] The Internet of Things (IoT) technology has developed rapidly in recent years. IoT SIM cards, as a crucial medium for connecting IoT devices to networks, have applications spanning from smart homes and intelligent transportation to industrial automation and healthcare. IoT SIM cards (also known as M2M cards or SIM cards) not only provide stable network connectivity but also feature low power consumption, long lifespan, and wide coverage. These characteristics make IoT SIM cards irreplaceable in large-scale device networking scenarios. However, with the rapid increase in the number of IoT devices and the diversification of application scenarios, the security challenges faced by IoT SIM cards are becoming increasingly severe. The security of IoT SIM cards directly affects the stability and data security of the entire IoT system, making security monitoring methods for IoT SIM cards particularly important. Traditional rule-based and feature-based monitoring methods are insufficient to cope with complex and ever-changing attack behaviors and cannot achieve efficient detection of unknown threats. Summary of the Invention

[0003] In view of this, the present invention proposes an IoT card security monitoring method, which realizes IoT card status security monitoring through intelligent correlation analysis and improves the security level of IoT cards.

[0004] To achieve the above objectives, the present invention provides an IoT card security monitoring method, comprising the following steps: S1: Collect network traffic from IoT cards to form a traffic data sequence, and extract features from the traffic data sequence to obtain a traffic feature vector, wherein a graph convolutional neural network is the implementation method for the feature extraction; S2: Perform local density calculation on the traffic feature vectors of different IoT cards to obtain the clustering degree values ​​of different IoT cards, sort the traffic feature vectors in descending order of clustering degree, and select a preset number of traffic feature vectors as the initial cluster centers. S3: Use improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters, and calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster; S4: Based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector. IoT cards with an anomaly value exceeding the preset threshold are treated as abnormal network cards and security alarms are triggered.

[0005] As a further improvement of the present invention: Optionally, the step S1, which involves collecting IoT SIM card network traffic to form a traffic data sequence, includes: The network traffic transmitted by the IoT SIM card is collected to form a traffic data sequence of the IoT SIM card. The IoT SIM card is the SIM (Subscriber Identity Module) card in the IoT device. The collection of traffic data sequences of the IoT SIM card is as follows: ; in: This represents the traffic data sequence of the nth IoT card, where the traffic data sequence It consists of M data packets uploaded by the IoT card. For the m-th data packet uploaded by the n-th IoT SIM card, ; Each traffic data packet consists of several groups of hexadecimal data. Its composition is as follows: ; in: Represents traffic data packets The i-th group of hexadecimal data, , Represents traffic data packets The total number of hexadecimal data in Chinese; Feature extraction is performed on the traffic data sequence to obtain the traffic feature vector, where the traffic data sequence The feature extraction process is as follows: S11: For the traffic data sequence The M traffic data packets are subjected to short-time Fourier transform to form a traffic data sequence. Traffic feature matrix ; S12: Flow characteristic matrix Perform convolution iterations to obtain the traffic data sequence. Traffic feature vector The flow feature matrix The convolution iteration formula is: ; ; in: Representing the flow characteristic matrix The result of the Cth convolution iteration, where C represents the preset maximum number of convolution iterations; Representing the flow characteristic matrix The corresponding degree matrix; Represents an exponential function with the natural constant as its base; This represents the convolution parameter matrix for the c-th convolution iteration. .

[0006] Optionally, in step S11, the flow data sequence is processed. The M traffic data packets are subjected to short-time Fourier transform to form a traffic data sequence. Traffic feature matrix ,include: S111: For traffic data sequences Short-time Fourier transform is performed on M traffic data packets, where the traffic data packets The short-time Fourier transform formula is: ; ; in: Represents traffic data packets The short-time Fourier transform result for the number of Fourier points k, K represents the maximum number of Fourier points; Represents the imaginary unit. ; Represents an exponential function with the natural constant as its base; Represents traffic data packets middle The reciprocal of the average interval between groups of hexadecimal data; S112: Traffic Data Sequence Traffic feature matrix : ; ; in: Represents a sequence of traffic data The traffic characteristic matrix; Represents the result of the short-time Fourier transform. Corresponding flow characteristic values; This indicates the preset traffic characteristic threshold.

[0007] Optionally, in step S2, local density calculation is performed on the traffic feature vectors of different IoT cards to obtain the clustering degree values ​​of different IoT cards, including: Local density calculations are performed on the traffic feature vectors of different IoT cards to obtain the clustering values ​​of different IoT cards, where the traffic feature vectors... The local density calculation process is as follows: S21: Calculate the flow characteristic vector The distance between the flow feature vector and any other flow feature vector, where the flow feature vector is the distance between the flow feature vector and any other flow feature vector. With flow feature vector The distance between them is: ; in: Represents the flow feature vector With flow feature vector The distance between them; Describing the L1 norm, Represents the L2 norm; ; S22: This will be compared with the flow feature vector. The A nearest flow feature vectors are used as flow feature vectors The neighborhood vectors are used to construct the flow feature vector from the A neighborhood vectors. neighborhood vector set ; S23: Calculate the flow characteristic vector Local density: ; in: Represents the flow feature vector Local density; Indicates the cutoff distance; , Represents the neighborhood vector set Any neighborhood vector in the cluster; where the larger the local density, the more neighborhood vectors are around the flow feature vector, and the greater the distance between the neighborhood vector and other flow feature vectors with larger local density, which can better perform flow clustering and improve the clustering efficiency of subsequent clustering algorithms. The local density is converted into the clustering degree of the IoT card corresponding to the traffic feature vector, where the clustering degree of the nth IoT card is: ; ; in: This represents the relative distance to the nth IoT card. This represents the Euclidean distance between the location of the nth IoT SIM card and the location of the eth IoT SIM card. This represents the clustering degree of the nth IoT SIM card; the higher the clustering degree, the greater the local density of the IoT SIM card, and the more central its geographical location among all IoT SIM cards. The flow feature vectors are sorted in descending order of their clustering degree, and a predetermined number of flow feature vectors are selected as the initial cluster centers.

[0008] Optionally, the step of sorting the flow feature vectors in descending order of clustering degree and selecting a preset number of flow feature vectors as initial cluster centers includes: The IoT cards are sorted in descending order of aggregation degree. The sorting result of the IoT cards is the sorting result of the traffic feature vectors. The traffic feature vectors corresponding to the first D IoT cards after sorting are selected as the initial cluster centers of D traffic clusters, where D represents the preset number. The initial cluster center of the d-th traffic cluster is: , .

[0009] Optionally, step S3 utilizes improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters, including: Improved K-means clustering is used to divide the traffic feature vectors of different IoT cards into different traffic clusters. The process of dividing the traffic feature vectors is as follows: S31: Let the current iteration number of the cluster center be t, and the maximum iteration number be Max. Then, the cluster center obtained by the t-th iteration of the d-th flow cluster is: ; S32: Calculate the distance from the flow feature vector of any non-cluster center to the cluster center, where the flow feature vector... To the cluster center The distance is ; S33: Assign the flow feature vectors that are not cluster centers to the nearest flow clusters, where the distance between the flow feature vector and the flow cluster is the distance from the flow feature vector to the cluster center; S34: Calculate the clustering effect for each traffic cluster, where the clustering effect for the d-th traffic cluster is: ; in: This represents the average nearest distance between all flow feature vectors in the d-th flow cluster and any flow feature vector in other flow clusters; This represents the mean distance between all flow feature vectors in the d-th flow cluster; Indicates The clustering effect of the d-th flow cluster at the cluster center; S35: Iterate over the cluster center of each traffic cluster, where the cluster center... The iterative formula is: ; in: Indicates is the mean of all flow feature vectors in the d-th flow cluster at the cluster center; This represents the minimum clustering effect. Indicates 1 to Random numbers between; S36: Calculate the iterative change amplitude of the cluster center, let t=t+1, return to step S32, until the iterative change amplitude of all cluster centers is less than the preset threshold, and obtain the D flow clusters at this time; Calculate the entropy value of each traffic feature vector in each dimension within the traffic cluster.

[0010] Optionally, the entropy value of each traffic feature vector in each dimension of the calculated traffic cluster includes: Calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster, where the traffic feature vector... The entropy calculation process for each dimension is as follows: Obtaining traffic feature vectors : ; in: Represents the flow feature vector The dimension values ​​of the H vector dimensions, where H represents the length of the flow feature vector. Represents the flow feature vector The dimension value of the h-th vector dimension; Calculate the flow feature vector Entropy values ​​across various dimensions, including the flow feature vector. The entropy value in the h-th dimension is: ; in: Represents the flow feature vector The entropy value in the h-th dimension; Represents the flow feature vector In the traffic cluster, the sum of the dimension values ​​of all traffic feature vectors in the h-th vector dimension.

[0011] Optionally, in step S4, based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector, including: Based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly degree of the IoT card corresponding to the traffic feature vector. The calculation process of the IoT card anomaly degree is as follows: S41: Calculate the distance from the flow feature vector in each flow cluster to the cluster center, sort the flow feature vectors in ascending order of distance, and extract the dimension value sequence of H vector dimensions in sequence, where the dimension value sequence corresponding to the h-th vector dimension in the d-th flow cluster is... ; S42: The least squares method is used to fit the value sequence of each dimension, resulting in a fitting equation for each dimension value sequence, where the dimension value sequence... The corresponding fitting equation is: ; in: Represents a sequence of dimension values The corresponding fitting equation, where y represents the number of sequence points input to the fitting equation; Represents the fitting coefficients in the fitted equation; S43: Based on the fitted equation, extract the dimensional slope of the value sequences of different dimensions, where the dimensional value sequences... The corresponding dimensional slope is: ; in: Represents a sequence of dimension values The corresponding dimensional slope; This represents the number of flow feature vectors in the d-th flow cluster; S44: Weighted evaluation of the entropy values ​​of the traffic feature vector across each dimension constitutes the anomaly degree of the IoT card corresponding to the traffic feature vector, where the traffic feature vector... The anomaly level of the corresponding IoT card is: ; in: Represents the flow feature vector The corresponding IoT card is malfunctioning; IoT cards with an anomaly level exceeding a preset threshold will be flagged as abnormal network cards and trigger a security alarm.

[0012] To address the above problems, the present invention provides an IoT card security monitoring system, characterized in that the system comprises: The traffic feature vector extraction module is used to collect network traffic from IoT cards to form a traffic data sequence, and to extract features from the traffic data sequence to obtain a traffic feature vector. The vector clustering module is used to perform local density calculation on the traffic feature vectors of different IoT cards, obtain the clustering degree value of different IoT cards, sort the traffic feature vectors in descending order of clustering degree, select a preset number of traffic feature vectors as initial cluster centers, and use improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters. The anomaly monitoring module is used to calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster. Based on the traffic cluster division result of the traffic feature vector, the entropy value of the traffic feature vector in each dimension is weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector. IoT cards with an anomaly value exceeding the preset threshold are identified as abnormal network cards and security alarms are triggered.

[0013] To address the above problems, the present invention also provides an electronic device, the electronic device comprising: Memory, storing at least one instruction; Communication interfaces enable communication between electronic devices; and The processor executes the instructions stored in the memory to implement the IoT card security monitoring method described above.

[0014] To address the aforementioned issues, the present invention also provides a computer-readable storage medium storing at least one instruction, which is executed by a processor in an electronic device to implement the IoT card security monitoring method described above.

[0015] Compared with existing technologies, this invention proposes an IoT card security monitoring method, which has the following advantages: First, this scheme collects transmission traffic data packets from different IoT cards to form a traffic data sequence. The traffic data sequence undergoes multi-scale short-time Fourier transform processing to construct a traffic feature matrix. Then, iterates through convolution with the degree matrix of the traffic feature matrix to generate traffic feature vectors that characterize the temporal correlation and Fourier point correlation of different traffic data packets. The distance between traffic feature vectors is calculated by combining the differences and similarities between them. The distance between a traffic feature vector and its neighboring vectors is then converted into local density. A higher local density indicates that the traffic feature vector has many neighboring vectors, and these neighboring vectors are far from other traffic feature vectors with higher local density. This allows for better clustering of traffic clusters and improves the clustering efficiency of subsequent clustering algorithms.

[0016] Meanwhile, this scheme optimizes the cluster center iteration of the traditional K-means clustering algorithm by combining the intra-cluster distance and inter-cluster distance of the traffic clusters after clustering. It enhances the randomness of cluster center iteration based on the clustering effect, where the worse the clustering effect, the higher the randomness of the cluster center iteration, thus avoiding getting trapped in local optima. Based on the clustering results of the traffic clusters, the traffic feature vector is weighted according to the information entropy of the dimension and the slope of the dimension representing the rate of change of the dimension. This enables the calculation of the weights of different vector dimensions in the traffic feature vector, forming an anomaly value that represents the multi-dimensional changes of the traffic data sequence, and realizing the anomaly monitoring of IoT cards based on network traffic. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an IoT card security monitoring method according to an embodiment of the present invention. Figure 2 This is a functional block diagram of an IoT card security monitoring system provided in an embodiment of the present invention; Figure 2 In China: 100 IoT SIM card security monitoring system, 101 traffic feature vector extraction module, 102 vector clustering module, 103 anomaly monitoring module; Figure 3 This is a schematic diagram of the structure of an electronic device that implements an IoT card security monitoring method according to an embodiment of the present invention.

[0018] Figure 3 In Chinese: 1. Electronic device; 10. Processor; 11. Memory; 12. Program; 13. Communication interface; The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0020] This application provides an IoT card security monitoring method. The execution entity of the IoT card security monitoring method includes, but is not limited to, at least one of the following electronic devices that can be configured to execute the method provided in this application: a server, a terminal, etc. In other words, the IoT card security monitoring method can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes, but is not limited to, a single server, a server cluster, a cloud server, or a cloud server cluster.

[0021] Example 1: S1: Collect network traffic from IoT cards to form a traffic data sequence, and extract features from the traffic data sequence to obtain a traffic feature vector.

[0022] Step S1 involves collecting IoT card network traffic to form a traffic data sequence, including: The network traffic transmitted by the IoT SIM card is collected to form a traffic data sequence of the IoT SIM card. The IoT SIM card is the SIM (Subscriber Identity Module) card in the IoT device. The collection of traffic data sequences of the IoT SIM card is as follows: ; in: This represents the traffic data sequence of the nth IoT card, where the traffic data sequence It consists of M data packets uploaded by the IoT card. For the m-th data packet uploaded by the n-th IoT SIM card, ; Each traffic data packet consists of several groups of hexadecimal data. Its composition is as follows: ; in: Represents traffic data packets The i-th group of hexadecimal data, , Represents traffic data packets The total number of hexadecimal data in Chinese; Feature extraction is performed on the traffic data sequence to obtain the traffic feature vector, where the traffic data sequence The feature extraction process is as follows: S11: For the traffic data sequence The M traffic data packets are subjected to short-time Fourier transform to form a traffic data sequence. Traffic feature matrix ; S12: Flow characteristic matrix Perform convolution iterations to obtain the traffic data sequence. Traffic feature vector The flow feature matrix The convolution iteration formula is: ; ; in: Representing the flow characteristic matrix The result of the Cth convolution iteration, where C represents the preset maximum number of convolution iterations; Representing the flow characteristic matrix The corresponding degree matrix; Represents an exponential function with the natural constant as its base; This represents the convolution parameter matrix for the c-th convolution iteration. .

[0023] In step S11, the flow data sequence is processed. The M traffic data packets are subjected to short-time Fourier transform to form a traffic data sequence. Traffic feature matrix ,include: S111: For traffic data sequences Short-time Fourier transform is performed on M traffic data packets, where the traffic data packets The short-time Fourier transform formula is: ; ; in: Represents traffic data packets The short-time Fourier transform result for the number of Fourier points k, K represents the maximum number of Fourier points; Represents the imaginary unit. ; Represents an exponential function with the natural constant as its base; Represents traffic data packets middle The reciprocal of the average interval between groups of hexadecimal data; S112: Traffic Data Sequence Traffic feature matrix : ; ; in: Represents a sequence of traffic data The traffic characteristic matrix; Represents the result of the short-time Fourier transform. Corresponding flow characteristic values; This indicates the preset traffic characteristic threshold.

[0024] S2: Perform local density calculation on the traffic feature vectors of different IoT cards to obtain the clustering degree values ​​of different IoT cards, sort the traffic feature vectors in descending order of clustering degree, and select a preset number of traffic feature vectors as the initial cluster centers.

[0025] In step S2, local density calculations are performed on the traffic feature vectors of different IoT cards to obtain the clustering values ​​of different IoT cards, including: Local density calculations are performed on the traffic feature vectors of different IoT cards to obtain the clustering values ​​of different IoT cards, where the traffic feature vectors... The local density calculation process is as follows: S21: Calculate the flow characteristic vector The distance between the flow feature vector and any other flow feature vector, where the flow feature vector is the distance between the flow feature vector and any other flow feature vector. With flow feature vector The distance between them is: ; in: Represents the flow feature vector With flow feature vector The distance between them; Describing the L1 norm, Represents the L2 norm; ; S22: This will be compared with the flow feature vector. The A nearest flow feature vectors are used as flow feature vectors The neighborhood vectors are used to construct the flow feature vector from the A neighborhood vectors. neighborhood vector set ; S23: Calculate the flow characteristic vector Local density: ; in: Represents the flow feature vector Local density; Indicates the cutoff distance; , Represents the neighborhood vector set Any neighborhood vector in; The local density is converted into the clustering degree of the IoT card corresponding to the traffic feature vector, where the clustering degree of the nth IoT card is:

[0026] ; in: This represents the relative distance to the nth IoT card. This represents the Euclidean distance between the location of the nth IoT SIM card and the location of the eth IoT SIM card. This represents the clustering degree of the nth IoT SIM card; The flow feature vectors are sorted in descending order of their clustering degree, and a predetermined number of flow feature vectors are selected as the initial cluster centers.

[0027] The step of sorting the flow feature vectors in descending order of clustering degree and selecting a preset number of flow feature vectors as initial cluster centers includes: The IoT cards are sorted in descending order of aggregation degree. The sorting result of the IoT cards is the sorting result of the traffic feature vectors. The traffic feature vectors corresponding to the first D IoT cards after sorting are selected as the initial cluster centers of D traffic clusters, where D represents the preset number. The initial cluster center of the d-th traffic cluster is: , .

[0028] S3: Use improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters, and calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster.

[0029] Step S3 utilizes improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters, including: Improved K-means clustering is used to divide the traffic feature vectors of different IoT cards into different traffic clusters. The process of dividing the traffic feature vectors is as follows: S31: Let the current iteration number of the cluster center be t, and the maximum iteration number be Max. Then, the cluster center obtained by the t-th iteration of the d-th flow cluster is: ; S32: Calculate the distance from the flow feature vector of any non-cluster center to the cluster center, where the flow feature vector... To the cluster center The distance is ; S33: Assign the flow feature vectors that are not cluster centers to the nearest flow clusters, where the distance between the flow feature vector and the flow cluster is the distance from the flow feature vector to the cluster center; S34: Calculate the clustering effect for each traffic cluster, where the clustering effect for the d-th traffic cluster is: ; in: This represents the average nearest distance between all flow feature vectors in the d-th flow cluster and any flow feature vector in other flow clusters; This represents the mean distance between all flow feature vectors in the d-th flow cluster; Indicates The clustering effect of the d-th flow cluster at the cluster center; S35: Iterate over the cluster center of each traffic cluster, where the cluster center... The iterative formula is: ; in: Indicates is the mean of all flow feature vectors in the d-th flow cluster at the cluster center; This represents the minimum clustering effect. Indicates 1 to Random numbers between; S36: Calculate the iterative change amplitude of the cluster center, let t=t+1, return to step S32, until the iterative change amplitude of all cluster centers is less than the preset threshold, and obtain the D flow clusters at this time; Calculate the entropy value of each traffic feature vector in each dimension within the traffic cluster.

[0030] The entropy value of each traffic feature vector in each dimension of the calculated traffic cluster includes: Calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster, where the traffic feature vector... The entropy calculation process for each dimension is as follows: Obtaining traffic feature vectors : ; in: Represents the flow feature vector The dimension values ​​of the H vector dimensions, where H represents the length of the flow feature vector. Represents the flow feature vector The dimension value of the h-th vector dimension; Calculate the flow feature vector Entropy values ​​across various dimensions, including the flow feature vector. The entropy value in the h-th dimension is: ; in: Represents the flow feature vector The entropy value in the h-th dimension; Represents the flow feature vector In the traffic cluster, the sum of the dimension values ​​of all traffic feature vectors in the h-th vector dimension.

[0031] S4: Based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector. IoT cards with an anomaly value exceeding the preset threshold are treated as abnormal network cards and security alarms are triggered.

[0032] In step S4, based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector, including: Based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly degree of the IoT card corresponding to the traffic feature vector. The calculation process of the IoT card anomaly degree is as follows: S41: Calculate the distance from the flow feature vector in each flow cluster to the cluster center, sort the flow feature vectors in ascending order of distance, and extract the dimension value sequence of H vector dimensions in sequence, where the dimension value sequence corresponding to the h-th vector dimension in the d-th flow cluster is... ; S42: The least squares method is used to fit the value sequence of each dimension, resulting in a fitting equation for each dimension value sequence, where the dimension value sequence... The corresponding fitting equation is: ; in: Represents a sequence of dimension values The corresponding fitting equation, where y represents the number of sequence points input to the fitting equation; Represents the fitting coefficients in the fitted equation; S43: Based on the fitted equation, extract the dimensional slope of the value sequences of different dimensions, where the dimensional value sequences... The corresponding dimensional slope is: ; in: Represents a sequence of dimension values The corresponding dimensional slope; This represents the number of flow feature vectors in the d-th flow cluster; S44: Weighted evaluation of the entropy values ​​of the traffic feature vector across each dimension constitutes the anomaly degree of the IoT card corresponding to the traffic feature vector, where the traffic feature vector... The anomaly level of the corresponding IoT card is: ; in: Represents the flow feature vector The corresponding IoT card is malfunctioning; IoT cards with an anomaly level exceeding a preset threshold will be flagged as abnormal network cards and trigger a security alarm.

[0033] Example 2: like Figure 2 The diagram shown is a functional block diagram of an IoT card security monitoring system provided in an embodiment of the present invention, which can implement the IoT card security monitoring method in Embodiment 1.

[0034] The IoT card security monitoring system 100 of this invention can be installed in an electronic device. Depending on the functions implemented, the IoT card security monitoring system may include a traffic feature vector extraction module 101, a vector clustering module 102, and an anomaly monitoring module 103. The module described in this invention can also be referred to as a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and which are stored in the memory of the electronic device.

[0035] The traffic feature vector extraction module 101 is used to collect IoT card network traffic to form a traffic data sequence, and extract features from the traffic data sequence to obtain a traffic feature vector. The vector clustering module 102 is used to perform local density calculation on the traffic feature vectors of different IoT cards, obtain the clustering degree value of different IoT cards, sort the traffic feature vectors in descending order of clustering degree, select a preset number of traffic feature vectors as initial cluster centers, and use improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters. The anomaly monitoring module 103 is used to calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster. Based on the traffic cluster division result of the traffic feature vector, the entropy value of the traffic feature vector in each dimension is weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector. IoT cards with an anomaly value exceeding the preset threshold are used as abnormal network cards for security alarm.

[0036] In detail, the modules in the IoT card security monitoring system 100 described in this embodiment of the invention employ the same methods as described above during use. Figure 1 The method used is the same as the IoT card security monitoring method described above, and it can produce the same technical effect, so it will not be repeated here.

[0037] Example 3: like Figure 3 The diagram shown is a structural schematic of an electronic device for implementing an IoT card security monitoring method according to an embodiment of the present invention.

[0038] The electronic device 1 may include a processor 10, a memory 11, a communication interface 13 and a bus, and may also include a computer program, such as program 12, stored in the memory 11 and executable on the processor 10.

[0039] The memory 11 includes at least one type of readable storage medium, such as flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of the electronic device 1, such as a portable hard drive. In other embodiments, the memory 11 can be an external storage device of the electronic device 1, such as a plug-in portable hard drive, smart media card (SMC), secure digital card (SD), flash card, etc. Furthermore, the memory 11 can include both internal and external storage units of the electronic device 1. The memory 11 can be used not only to store application software and various types of data installed on the electronic device 1, such as the code of program 12, but also to temporarily store data that has been output or will be output.

[0040] In some embodiments, the processor 10 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 11 (such as program 12 for implementing IoT card security monitoring) and calls data stored in the memory 11 to perform various functions of the electronic device 1 and process data.

[0041] The communication interface 13 may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is typically used to establish communication connections between the electronic device 1 and other electronic devices, and to realize communication between internal components of the electronic device.

[0042] The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. The bus is configured to enable communication between the memory 11 and at least one processor 10, etc.

[0043] Figure 3 Only electronic devices with components are shown; those skilled in the art will understand that... Figure 3 The structure shown does not constitute a limitation on the electronic device 1, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0044] For example, although not shown, the electronic device 1 may also include a power supply (such as a battery) to power the various components. Preferably, the power supply can be logically connected to the at least one processor 10 through a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power supplies, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device 1 may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be described in detail here.

[0045] Optionally, the electronic device 1 may further include a user interface, which may be a display, an input unit (such as a keyboard), and optionally, a standard wired interface or a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device 1 and to display a visual user interface.

[0046] It should be understood that the embodiments described are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0047] It should be noted that the sequence numbers of the above embodiments of the present invention are merely for descriptive purposes and do not represent the superiority or inferiority of the embodiments. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, apparatus, article, or method that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, apparatus, article, or method. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, apparatus, article, or method that includes that element.

[0048] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0049] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A method for security monitoring of Internet of Things (IoT) cards, characterized in that, The method includes: S1: Collect network traffic from IoT cards to form a traffic data sequence, and extract features from the traffic data sequence to obtain a traffic feature vector; S2: Perform local density calculation on the traffic feature vectors of different IoT cards to obtain the clustering degree values ​​of different IoT cards, sort the traffic feature vectors in descending order of clustering degree, and select a preset number of traffic feature vectors as the initial cluster centers. S3: Use improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters, and calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster; S4: Based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector. IoT cards with an anomaly value exceeding the preset threshold are treated as abnormal network cards and security alarms are triggered.

2. The IoT card security monitoring method as described in claim 1, characterized in that, Step S1 involves collecting IoT card network traffic to form a traffic data sequence, including: The network traffic transmitted by the IoT card is collected to form a traffic data sequence of the IoT card. The set of collected IoT card traffic data sequences is as follows: ； in: This represents the traffic data sequence of the nth IoT card, where the traffic data sequence It consists of M data packets uploaded by the IoT card. For the m-th data packet uploaded by the n-th IoT SIM card, ; Each traffic data packet consists of several groups of hexadecimal data. Its composition is as follows: ； in: Represents traffic data packets The i-th group of hexadecimal data, , Represents traffic data packets The total number of hexadecimal data in Chinese; Feature extraction is performed on the traffic data sequence to obtain the traffic feature vector, where the traffic data sequence The feature extraction process is as follows: S11: For the traffic data sequence The M traffic data packets are subjected to short-time Fourier transform to form a traffic data sequence. Traffic feature matrix ; S12: Flow characteristic matrix Perform convolution iterations to obtain the traffic data sequence. Traffic feature vector The flow feature matrix The convolution iteration formula is: ； ； in: Representing the flow characteristic matrix The result of the Cth convolution iteration, where C represents the preset maximum number of convolution iterations; Representing the flow characteristic matrix The corresponding degree matrix; Represents an exponential function with the natural constant as its base; This represents the convolution parameter matrix for the c-th convolution iteration. .

3. The IoT card security monitoring method as described in claim 2, characterized in that, In step S11, the flow data sequence is processed. The M traffic data packets are subjected to short-time Fourier transform to form a traffic data sequence. Traffic feature matrix ,include: S111: For traffic data sequences Short-time Fourier transform is performed on M traffic data packets, where the traffic data packets The short-time Fourier transform formula is: ； ； in: Represents traffic data packets The short-time Fourier transform result for the number of Fourier points k, K represents the maximum number of Fourier points; Represents the imaginary unit. ; Represents an exponential function with the natural constant as its base; Represents traffic data packets middle The reciprocal of the average interval between groups of hexadecimal data; S112: Traffic Data Sequence Traffic feature matrix : ； ； in: Represents a sequence of traffic data The traffic characteristic matrix; Represents the result of the short-time Fourier transform. Corresponding flow characteristic values; This indicates the preset traffic characteristic threshold.

4. The IoT card security monitoring method as described in claim 1, characterized in that, In step S2, local density calculations are performed on the traffic feature vectors of different IoT cards to obtain the clustering values ​​of different IoT cards, including: Local density calculations are performed on the traffic feature vectors of different IoT cards to obtain the clustering values ​​of different IoT cards, where the traffic feature vectors... The local density calculation process is as follows: S21: Calculate the flow characteristic vector The distance between the flow feature vector and any other flow feature vector, where the flow feature vector is the distance between the flow feature vector and any other flow feature vector. With flow feature vector The distance between them is: ； in: Represents the flow feature vector With flow feature vector The distance between them; Describing the L1 norm, Represents the L2 norm; ； S22: Combine with the flow feature vector The A nearest flow feature vectors are used as flow feature vectors The neighborhood vectors are used to construct the flow feature vector from the A neighborhood vectors. neighborhood vector set ; S23: Calculate the flow characteristic vector Local density: ； in: Represents the flow feature vector Local density; Indicates the cutoff distance; , Represents the neighborhood vector set Any neighborhood vector in; Convert local density into the clustering degree of IoT cards corresponding to the traffic feature vector; The flow feature vectors are sorted in descending order of their clustering degree, and a predetermined number of flow feature vectors are selected as the initial cluster centers.

5. The IoT card security monitoring method as described in claim 4, characterized in that, The step of sorting the flow feature vectors in descending order of clustering degree and selecting a preset number of flow feature vectors as initial cluster centers includes: The IoT cards are sorted in descending order of aggregation degree. The sorting result of the IoT cards is the sorting result of the traffic feature vectors. The traffic feature vectors corresponding to the first D IoT cards after sorting are selected as the initial cluster centers of D traffic clusters, where D represents the preset number. The initial cluster center of the d-th traffic cluster is: , .

6. The IoT card security monitoring method as described in claim 5, characterized in that, Step S3 utilizes improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters, including: Improved K-means clustering is used to divide the traffic feature vectors of different IoT cards into different traffic clusters. The process of dividing the traffic feature vectors is as follows: S31: Let the current iteration number of the cluster center be t, and the maximum iteration number be Max. Then, the cluster center obtained by the t-th iteration of the d-th flow cluster is: ; S32: Calculate the distance from the flow feature vector of any non-cluster center to the cluster center, where the flow feature vector... To the cluster center The distance is ; S33: Assign the flow feature vectors that are not cluster centers to the nearest flow clusters, where the distance between the flow feature vector and the flow cluster is the distance from the flow feature vector to the cluster center; S34: Calculate the clustering effect for each traffic cluster; S35: Iterate over the cluster center of each traffic cluster; S36: Calculate the iterative change amplitude of the cluster center, let t=t+1, return to step S32, until the iterative change amplitude of all cluster centers is less than the preset threshold, and obtain the D flow clusters at this time; Calculate the entropy value of each traffic feature vector in each dimension within the traffic cluster.

7. The IoT card security monitoring method as described in claim 6, characterized in that, The calculation of the entropy value of each traffic feature vector in each dimension includes: Calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster, where the traffic feature vector... The entropy calculation process for each dimension is as follows: Obtain traffic feature vector : ； in: Represents the flow feature vector The dimension values ​​of the H vector dimensions, where H represents the length of the flow feature vector. Represents the flow feature vector The dimension value of the h-th vector dimension; Calculate the flow feature vector Entropy values ​​across various dimensions, including the flow feature vector. The entropy value in the h-th dimension is: ； in: Represents the flow feature vector The entropy value in the h-th dimension; Represents the flow feature vector In the traffic cluster, the sum of the dimension values ​​of all traffic feature vectors in the h-th vector dimension.

8. The IoT card security monitoring method as described in claim 7, characterized in that, In step S4, based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector, including: Based on the traffic clustering results of the traffic feature vector, the entropy values ​​of the traffic feature vector in each dimension are weighted and evaluated to form the anomaly degree of the IoT card corresponding to the traffic feature vector. The calculation process of the IoT card anomaly degree is as follows: S41: Calculate the distance from the flow feature vector in each flow cluster to the cluster center, sort the flow feature vectors in ascending order of distance, and extract the dimension value sequence of H vector dimensions in sequence, where the dimension value sequence corresponding to the h-th vector dimension in the d-th flow cluster is... ; S42: The least squares method is used to fit the value sequence of each dimension, resulting in a fitting equation for each dimension value sequence, where the dimension value sequence... The corresponding fitting equation is: ； in: Represents a sequence of dimension values The corresponding fitting equation, where y represents the number of sequence points input to the fitting equation; Represents the fitting coefficients in the fitted equation; S43: Based on the fitted equation, extract the dimensional slope of the value sequences of different dimensions, where the dimensional value sequences... The corresponding dimensional slope is: ； in: Represents a sequence of dimension values The corresponding dimensional slope; This represents the number of flow feature vectors in the d-th flow cluster; S44: Weighted evaluation of the entropy values ​​of the traffic feature vector across each dimension constitutes the anomaly degree of the IoT card corresponding to the traffic feature vector, where the traffic feature vector... The anomaly level of the corresponding IoT card is: ； in: Represents the flow feature vector The corresponding IoT card is malfunctioning; IoT cards with an anomaly level exceeding a preset threshold will be flagged as abnormal network cards and trigger a security alarm.

9. An IoT card security monitoring system, characterized in that, The system includes: The traffic feature vector extraction module is used to collect network traffic from IoT cards to form a traffic data sequence, and to extract features from the traffic data sequence to obtain a traffic feature vector. The vector clustering module is used to perform local density calculation on the traffic feature vectors of different IoT cards, obtain the clustering degree value of different IoT cards, sort the traffic feature vectors in descending order of clustering degree, select a preset number of traffic feature vectors as initial cluster centers, and use improved K-means clustering to divide the traffic feature vectors of different IoT cards into different traffic clusters. An anomaly monitoring module is used to calculate the entropy value of each traffic feature vector in each dimension of the traffic cluster. Based on the traffic cluster division result of the traffic feature vector, the entropy value of the traffic feature vector in each dimension is weighted and evaluated to form the anomaly value of the IoT card corresponding to the traffic feature vector. IoT cards with an anomaly value exceeding a preset threshold are used as abnormal network cards for security alarm, so as to realize an IoT card security monitoring method as described in any one of claims 1-8.

Images