Abnormal traffic automatic filtering system of internet of things gateway

Abstract

The application relates to the technical field of Internet of Things security, and discloses an abnormal flow automatic filtering system of an Internet of Things gateway, which comprises the following modules: a message physical property sensing module that obtains message frame load length and frame arrival interval; a computing power feature solving module that calls a sending end reference rhythm cycle, generates micro time delay residual representing hardware packaging time consumption through modulo operation; a link state adaptive compensation module that corrects the upper limit threshold of the computing power slope according to the retransmission rate parameter of the physical layer state feedback bit; a physical constraint checking module that calculates the ratio of the frame load length and the micro time delay residual, and determines whether the obtained computing power mapping slope falls into a legal hardware constraint interval; and an asymmetric feature filtering module that discards illegal messages. The application establishes a defense barrier through physical layer computing power fingerprints, blocks the occupation of gateway resources by abnormal flow, improves the defense robustness of the gateway in a complex channel environment, and realizes entity identity authenticity verification based on the physical features of the Internet of Things hardware.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to an automatic abnormal traffic filtering system for IoT gateways. Background Technology

[0002] Currently, edge-side IoT gateways deployed between low-power sensor nodes and the core backbone network constitute the core communication infrastructure for ensuring the online rate of underlying devices in industrial IoT and smart cities. Due to the limited computing resources and power budgets of IoT terminals, the communication protocol stacks typically employ highly simplified designs. Furthermore, IoT terminals are often driven by specific low-power microprocessors, and their instruction execution process exhibits a high degree of physical determinism. This makes gateway-side traffic security the last line of defense against external attacks. Currently, in this technological field, rule-based matching or deep packet inspection solutions are commonly deployed to identify malicious code or abnormal instructions by parsing the application-layer payload of network packets. However, when facing hidden attacks that simulate legitimate business rhythms... When dealing with concealed abnormal traffic, this defense method, which relies on high-intensity computation, exhibits significant physical limitations. IoT traffic typically exhibits high periodicity. Attackers use high-performance computing platforms to simulate the macroscopic sending cycle of legitimate heartbeat packets, causing the detection mechanism based on network layer time statistics to fail. If the traffic parsing depth is forcibly increased at the edge gateway, it will generate huge computational overhead, directly consuming the gateway's session maintenance resources and causing a sharp increase in processing latency, or even causing system paralysis. In addition, due to the influence of nonlinear congestion of physical links and the inherent temperature drift effect of sensor hardware clocks, legitimate business traffic has natural micro-jitter in the time dimension, making it difficult for statistical models using fixed decision thresholds to balance interception accuracy and business continuity under complex operating conditions.

[0003] To address these challenges, the industry has attempted to enhance computing power using hardware coprocessors. However, analysis reveals that such attempts have not yet addressed the fundamental physical constraints in IoT security defense. Increasing hardware clock speed leads to non-linear increases in power consumption, while macroscopic statistical solutions ignore the microscopic execution fingerprint generated by the microprocessor's clock speed performance at the sending end. There is a fundamental difference in the physical encapsulation time of the protocol stack between forged traffic from the attack source and the real traffic from legitimate nodes. Existing defense mechanisms lack the ability to extract and verify this physical causal characteristic caused by hardware computing power asymmetry. Besides the mismatch of resources at the physical hardware level, existing traffic identification and control methods are ill-equipped to handle dynamic and covert attacks. The flow has insufficient mechanism. For example, Chinese invention patent application CN112134875A discloses an IoT network abnormal traffic detection method and system. It extracts device fingerprints and traffic features, and uses a noise-reduced autoencoder extreme learning machine to perform reconstruction error analysis to identify anomalies. This scheme is anchored to macro indicators of the application layer or network layer. When facing the covert traffic of the attack source simulating the rhythm of legitimate business, it cannot penetrate the surface protocol logic to perceive the physical execution process of the microprocessor at the sending end. It is easily avoided by high-performance computing platforms through feature forgery. The computational overhead and training sample dependence of this model in large-scale concurrent scenarios make it difficult to adapt to the resource-constrained edge gateway environment.

[0004] Therefore, the technical problem to be solved by this invention is how to extract physical fingerprints that can characterize the computing power of the microprocessor on the edge hardware, and achieve in-situ filtering of forged business traffic while reducing the computing power burden on the gateway, thereby building a physical security defense line that is deeply adapted to the IoT ecosystem. Summary of the Invention

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution: an automatic abnormal traffic filtering system for an Internet of Things gateway, comprising: The message physical attribute perception module is used to obtain the frame payload length of the message sequence to be detected and the arrival time interval between adjacent frames. The arrival time interval between adjacent frames is the difference in physical timestamps of two adjacent messages reaching the physical communication interface. The computing power feature calculation module is used to retrieve the pre-stored sender reference rhythm period of the edge data interaction layer, and perform modulo operation on the arrival time interval of adjacent frames based on the sender reference rhythm period. By stripping the macro synchronization component, it generates micro delay residuals that characterize the hardware packaging time consumption. The link state adaptive compensation module is used to read the retransmission rate parameter in the physical layer state feedback bit, and apply a tolerance shift based on the positive deviation to the pre-stored computing power slope upper limit threshold according to the retransmission rate parameter to generate a corrected upper limit threshold. The physical constraint verification module is used to determine the numerical ratio of the frame payload length to the micro delay residual as the physical computing power mapping slope, and to determine whether the physical computing power mapping slope falls within the legal hardware constraint range consisting of the lower limit threshold of the computing power slope and the upper limit threshold of the correction. The asymmetric feature filtering module is used to overwrite the packet to be detected in the buffer in place before it enters the network protocol stack when the slope of the physical computing power mapping deviates from the legal hardware constraint range, so as to complete the discarding.

[0006] Preferably, the message physical attribute perception module includes a feature capture unit and a spatiotemporal vector generation unit; the feature capture unit is used to capture the message stream to be detected at the physical communication interface and identify the frame payload length through the frame header information of the message stream to be detected; the spatiotemporal vector generation unit is used to record the nanosecond-level hardware timestamp of each message in the message stream to be detected reaching the physical communication interface, and define the arithmetic difference between two consecutive hardware timestamps as the time interval between adjacent frames.

[0007] Preferably, the computing power feature calculation module includes a built-in arithmetic logic unit, which calculates the micro-delay residual δt using the following formula: Where δt is the microscopic time delay residual, and Δt is the arrival time interval between adjacent frames. The reference rhythm period of the transmitting end is used; the micro delay residual δt is used to quantitatively characterize the fluctuation of the internal instruction processing time of the physical layer chip of the transmitting end when encapsulating the message to be detected.

[0008] Preferably, the physical constraint verification module calculates the physical computing power mapping slope based on the linear comparison relationship between the frame payload length and the micro-delay residual. The calculation logic is as follows: ,in, The physical computing power mapping slope is given by L, where L is the frame payload length and δt is the microscopic delay residual. It is mapped to the message payload density carried by the unit hardware encapsulation time of the sending end, which is used to indicate the actual computing power level of the sending end.

[0009] Preferably, the legal hardware constraint range is anchored to the instruction processing clock boundary of the IoT microprocessor; wherein, the lower limit threshold of computing power slope corresponds to the minimum unit load packaging time of the microprocessor at the nominal operating frequency, and the upper limit threshold of computing power slope corresponds to the maximum unit load packaging time of the microprocessor in low-power intermittent mode.

[0010] Preferably, the link state adaptive compensation module includes a state polling unit and a correction gain generation unit; the state polling unit is used to poll the physical layer state feedback bit through the register communication bus to extract the retransmission rate parameter that characterizes the degree of physical link congestion; the correction gain generation unit is used to apply a positive offset to the upper limit threshold of computing power slope based on the retransmission rate parameter to offset the non-computational micro-latency growth caused by network queuing.

[0011] Preferably, the asymmetric feature filtering module is coupled to the message link control layer; when the asymmetric feature filtering module determines that the physical computing power mapping slope is less than the lower limit threshold of the computing power slope, it determines that the computing power of the sending end exceeds the hardware processing limit of the IoT node and identifies it as an illegal forged node; when the asymmetric feature filtering module determines that the physical computing power mapping slope is greater than the upper limit threshold of the correction, it determines that the sending end has controlled abnormal traffic injection behavior.

[0012] Preferably, the abnormal traffic automatic filtering system of the IoT gateway also includes a whitelist fingerprint database module; the whitelist fingerprint database module is used to maintain a legal node computing power feature table, which records the average physical computing power mapping slope corresponding to each known legal node; when the physical computing power mapping slope falls into the legal hardware constraint range, the physical constraint verification module further calculates the real-time deviation rate of the physical computing power mapping slope relative to the average physical computing power mapping slope.

[0013] Preferably, the asymmetric feature filtering module modifies the data validity status bit in the underlying storage descriptor, so that the detected packets that are determined to be abnormal are directly overwritten in place by the subsequent legitimate packets in the receive buffer before being read by the operating system kernel, thereby blocking the invalid occupation of gateway kernel memory resources by abnormal traffic.

[0014] Preferably, the reference rhythm period of the transmitting end is preset in the storage space of the edge data interaction layer according to the interaction specifications of different IoT communication protocols; the computing power feature calculation module calls the corresponding period parameter sub-library for different IoT protocol stacks to adapt to the inherent pulsation characteristics of different types of nodes, ensuring that the micro delay residual is stripped of the macro transmission delay component caused by the difference in protocol handshake.

[0015] The beneficial effects of this invention are: 1. In the automatic filtering of abnormal traffic, a physical causal constraint mechanism is established between message encapsulation time and payload length. A micro-execution fingerprint with hardware uniqueness is extracted. Due to the objective limitation of the low-frequency microprocessor capabilities of legitimate IoT terminals, the micro-latency generated by their message encapsulation and payload length exhibit a linear positive correlation. The system uses modular arithmetic to strip away the macro-network cycle and locks this physical parameter that reflects the extreme value of the computing power of the edge hardware. This enables the underlying physical verification of the entity identity of IoT devices and the legitimacy of traffic. Since attack sources usually use high-performance computing devices, their processing time for the same payload is lower than the physical lower limit of legitimate hardware due to excess computing power. This defense barrier built using the asymmetry of physical computing power transforms the covert rhythmic attacks that are originally difficult to identify at the network layer into unnatural deviations that are easy to judge at the physical execution dimension. This solves the industry problem that highly covert forged traffic is difficult to remove in situ.

[0016] 2. This solution reduces complex security protection logic to basic arithmetic logic operations, enabling massive concurrent connection processing with a lower computing power budget. The system abandons the traditional deep packet inspection's requirement to disassemble application layer protocol payloads layer by layer. It can complete anomaly detection simply by obtaining the network card hardware timestamp and packet length fields. This simplified processing path based on packet physical attributes avoids resource-intensive feature library matching and complex model reasoning, locking the resource consumption of security defense at the outermost hardware layer of the gateway. This design ensures that the IoT gateway can still maintain a high communication throughput rate and system stability when facing large-scale traffic surges, and is suitable for resource-constrained edge deployment environments.

[0017] 3. The system achieves adaptive and robust defense against complex and harsh channel environments through dynamic coupling of physical layer congestion parameters and micro-delay verification. Since industrial field networks are often accompanied by nonlinear physical link fluctuations, the system reads the frame retransmission rate parameter in the network card register and performs dynamic tolerance shifting on the computing power verification boundary. This mechanism accurately separates the natural queuing delay caused by the physical link from the micro-delay anomaly caused by malicious attacks, avoiding interference of physical delay on computing power fingerprints. Through the synergistic effect of multi-dimensional signals, the system achieves maximum tolerance for legitimate service fluctuations without sacrificing interception strength, enhancing the gateway's identification accuracy in unstable network environments. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein: Figure 1This is a flowchart illustrating the abnormal traffic filtering process of the IoT gateway in this invention. Figure 2 This is a hierarchical architecture diagram of the IoT gateway abnormal traffic automatic filtering system of the present invention. Detailed Implementation

[0019] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0020] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0021] Secondly, an embodiment or embodiment referred to herein refers to a specific feature, structure or characteristic that may be included in at least one implementation of the present invention. An embodiment appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0022] This invention is described in detail with reference to the schematic diagrams. When describing the embodiments of this invention, for ease of explanation, the cross-sectional views of the device structure will be partially enlarged without adhering to the general scale. Moreover, the schematic diagrams are only examples and should not limit the scope of protection of this invention. In addition, in actual manufacturing, the three-dimensional spatial dimensions of length, width and depth should be included.

[0023] Furthermore, in the description of this invention, it should be noted that the terms such as "upper," "lower," "inner," and "outer" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or component referred to has a specific orientation, or is constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention. In addition, the terms "first," "second," or "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0024] Unless otherwise explicitly specified and limited, the terms installation, connection, and linking in this invention should be interpreted broadly. For example, they can refer to fixed connection, detachable connection, or integrated connection; similarly, they can refer to mechanical connection, electrical connection, or direct connection, or indirect connection through an intermediate medium, or internal connection between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0025] An automatic abnormal traffic filtering system for an IoT gateway includes: The message physical attribute perception module is used to obtain the frame payload length of the message sequence to be detected and the arrival time interval between adjacent frames. The arrival time interval between adjacent frames is the difference in physical timestamps of two adjacent messages reaching the physical communication interface. The computing power feature calculation module is used to retrieve the pre-stored sender reference rhythm period of the edge data interaction layer, and perform modulo operation on the arrival time interval of adjacent frames based on the sender reference rhythm period. By stripping the macro synchronization component, it generates micro delay residuals that characterize the hardware packaging time consumption. The link state adaptive compensation module is used to read the retransmission rate parameter in the physical layer state feedback bit, and apply a tolerance shift based on the positive deviation to the pre-stored computing power slope upper limit threshold according to the retransmission rate parameter to generate a corrected upper limit threshold. The physical constraint verification module is used to determine the numerical ratio of the frame payload length to the micro delay residual as the physical computing power mapping slope, and to determine whether the physical computing power mapping slope falls within the legal hardware constraint range consisting of the lower limit threshold of the computing power slope and the upper limit threshold of the correction. The asymmetric feature filtering module is used to overwrite the packet to be detected in the buffer in place before it enters the network protocol stack when the slope of the physical computing power mapping deviates from the legal hardware constraint range, so as to complete the discarding.

[0026] Preferably, the message physical attribute perception module includes a feature capture unit and a spatiotemporal vector generation unit; the feature capture unit is used to capture the message stream to be detected at the physical communication interface and identify the frame payload length through the frame header information of the message stream to be detected; the spatiotemporal vector generation unit is used to record the nanosecond-level hardware timestamp of each message in the message stream to be detected reaching the physical communication interface, and define the arithmetic difference between two consecutive hardware timestamps as the time interval between adjacent frames.

[0027] Preferably, the computing power feature calculation module includes a built-in arithmetic logic unit, which calculates the micro-delay residual δt using the following formula: Where δt is the microscopic time delay residual, and Δt is the arrival time interval between adjacent frames. The reference rhythm period of the transmitting end is used; the micro delay residual δt is used to quantitatively characterize the fluctuation of the internal instruction processing time of the physical layer chip of the transmitting end when encapsulating the message to be detected.

[0028] Preferably, the physical constraint verification module calculates the physical computing power mapping slope based on the linear comparison relationship between the frame payload length and the micro-delay residual. The calculation logic is as follows: ,in, The physical computing power mapping slope is given by L, where L is the frame payload length and δt is the microscopic delay residual. It is mapped to the message payload density carried by the unit hardware encapsulation time of the sending end, which is used to indicate the actual computing power level of the sending end.

[0029] Preferably, the legal hardware constraint range is anchored to the instruction processing clock boundary of the IoT microprocessor; wherein, the lower limit threshold of computing power slope corresponds to the minimum unit load packaging time of the microprocessor at the nominal operating frequency, and the upper limit threshold of computing power slope corresponds to the maximum unit load packaging time of the microprocessor in low-power intermittent mode.

[0030] Preferably, the link state adaptive compensation module includes a state polling unit and a correction gain generation unit; the state polling unit is used to poll the physical layer state feedback bit through the register communication bus to extract the retransmission rate parameter that characterizes the degree of physical link congestion; the correction gain generation unit is used to apply a positive offset to the upper limit threshold of computing power slope based on the retransmission rate parameter to offset the non-computational micro-latency growth caused by network queuing.

[0031] Preferably, the asymmetric feature filtering module is coupled to the message link control layer; when the asymmetric feature filtering module determines that the physical computing power mapping slope is less than the lower limit threshold of the computing power slope, it determines that the computing power of the sending end exceeds the hardware processing limit of the IoT node and identifies it as an illegal forged node; when the asymmetric feature filtering module determines that the physical computing power mapping slope is greater than the upper limit threshold of the correction, it determines that the sending end has controlled abnormal traffic injection behavior.

[0032] Preferably, the abnormal traffic automatic filtering system of the IoT gateway also includes a whitelist fingerprint database module; the whitelist fingerprint database module is used to maintain a legal node computing power feature table, which records the average physical computing power mapping slope corresponding to each known legal node; when the physical computing power mapping slope falls into the legal hardware constraint range, the physical constraint verification module further calculates the real-time deviation rate of the physical computing power mapping slope relative to the average physical computing power mapping slope.

[0033] Preferably, the asymmetric feature filtering module modifies the data validity status bit in the underlying storage descriptor, so that the detected packets that are determined to be abnormal are directly overwritten in place by the subsequent legitimate packets in the receive buffer before being read by the operating system kernel, thereby blocking the invalid occupation of gateway kernel memory resources by abnormal traffic.

[0034] Preferably, the reference rhythm period of the transmitting end is preset in the storage space of the edge data interaction layer according to the interaction specifications of different IoT communication protocols; the computing power feature calculation module calls the corresponding period parameter sub-library for different IoT protocol stacks to adapt to the inherent pulsation characteristics of different types of nodes, ensuring that the micro delay residual is stripped of the macro transmission delay component caused by the difference in protocol handshake.

[0035] Example 1: In the edge data interaction layer of a smart grid substation with a low-power environmental monitoring sensor, the gateway's physical communication interface continuously receives forged message streams from an abnormal computing platform. The forged message streams simulate the 10-second baseline rhythm cycle of a legitimate sensor's transmitter, increasing the parsing computation load through encryption protocols, leading to overload of the defense node's computing power and kernel memory overflow based on application layer parsing and network layer traffic statistics. The IoT gateway's abnormal traffic automatic filtering system intercepts abnormal traffic at the hardware physical computing level. Through the feature capture unit included in the message physical attribute perception module, it intercepts the message sequence to be detected in real time at the physical communication interface, reads the message frame header information to identify the frame payload length L, and simultaneously records the nanosecond-level hardware timestamp of each message arriving at the physical communication interface by the spatiotemporal vector generation unit. It calculates the arithmetic difference between two consecutive hardware timestamps as the arrival time interval between adjacent frames and outputs a spatiotemporal sequence for verifying the authenticity of the physical identity.

[0036] The computing power feature calculation module calls the built-in arithmetic logic unit, based on the extracted arrival time interval between adjacent frames and the pre-stored sender reference rhythm period in the edge data interaction layer. According to the law of large numbers, the cumulative channel transmission delay of multi-hop network routing approaches a zero-mean normal distribution within a long sampling period. Terminal physical layer chip instruction encapsulation causes a unidirectional precise time offset. To accurately remove random channel interference, the computing power feature calculation module loads a time-domain smoothing filter before performing modulo operations. The processing unit calls a sliding sampling window of preset length N, reads the set of arrival time intervals of consecutively captured adjacent frames within the window in real time, calculates the arithmetic median, and outputs the smoothed time interval parameter. The parameter N represents the number of consecutively sampled packet frames, limited to an odd number greater than five and dimensionless. The numerical processing objectively cancels out random high-frequency jitter caused by spatial electromagnetic wave propagation and network card interrupt response. The arithmetic logic unit updates and replaces the single-point sampling of adjacent frame arrival time interval Δt with the smoothed time interval parameter, and removes the macroscopic synchronization component based on modulo operations to generate a microscopic time delay residual δt. Specifically, the formula for calculating the microscopic time delay residual δt is as follows: Where δt is the microscopic time delay residual, and Δt is the arrival time interval between adjacent frames. The physical constraint verification module calculates the physical computing power mapping slope, which serves as the reference rhythm period for the transmitting end. Physical computing power mapping slope The calculation formula is as follows: ;in, Let L be the physical computing power mapping slope, L be the frame payload length, and δt be the microscopic delay residual. When attacking nodes utilize high-performance chips to encapsulate data packets, the time spent processing unit payloads is reduced, leading to a decrease in the microscopic delay residual δt and a reduction in the physical computing power mapping slope. Deviation from the lower limit threshold of computing power slope .

[0037] The link state adaptive compensation module includes a state polling unit that polls the physical layer state feedback bits via the register communication bus to extract the retransmission rate parameter R; and a correction gain generation unit that adjusts the upper limit threshold of the computing power slope based on the retransmission rate parameter R. Apply a positive translation operation to generate the upper limit threshold for compensation. The system integrates underlying congestion state feedback bits and delay characteristics to offset the delay increase component caused by network queuing, and outputs dynamic constraint boundaries adapted to fluctuating channel environments; the asymmetric feature filtering module receives the physical computing power mapping slope. Less than the lower limit threshold of computing power slope or greater than the compensation upper limit threshold The judgment instruction modifies the data validity status bit in the underlying storage descriptor. Subsequent legitimate messages arrive in the receive buffer and overwrite the abnormal messages in the message sequence to be detected. The physical layer is discarded before the operating system kernel reads the message. This link control layer blocking mechanism cuts off the path for the forged computing source to occupy the gateway kernel memory and session maintenance resources, maintaining the online status and communication data throughput of the downstream sensor nodes.

[0038] Example 2: In the test platform for physical communication protection of the edge data interaction layer, a physical test environment was built, including a simulator of 10,000 low-power sensor nodes and an attack traffic generator configured with a high-performance central processing unit. This test environment connected a network analyzer with a hardware timestamp resolution of 1ns to capture the underlying communication protocol data. Gaussian white noise with a signal-to-noise ratio of 20dB was injected into the physical communication link, and the link load was adjusted to simulate the queuing and retransmission state. The setting of the sampling window capacity parameter faced an engineering trade-off between the real-time performance of feature extraction and the stability of the statistical benchmark. When the retransmission rate parameter of the physical communication link increased and random jitter intensified, in order to suppress the misjudgment of high-frequency transient noise points under the Nyquist sampling theorem, the sampling window capacity tended to the upper limit of the value range. Under this logic rule, for the working condition of a background signal-to-noise ratio of 20dB and a benchmark rhythm period of 10s, a sampling window capacity of 512 message periods was selected, which maintained the statistical significance of the micro-delay residual distribution characteristics while taking into account the computational cache load of the edge devices.

[0039] After the test platform starts up, it continuously sends a mixed message stream to the gateway's physical communication interface. The feature capture unit reads the message frame header information to obtain the frame payload length L, the spatiotemporal vector generation unit records nanosecond-level hardware timestamps, and the computing power feature calculation module calculates the arrival time interval Δt between adjacent frames and the sender's reference rhythm period. The micro-delay residuals are obtained through modular arithmetic. Under the first control group (i.e., an idle state with a background retransmission rate below 2%), the micro-delay residuals of legitimate low-power nodes are stably distributed between 1200ns and 1500ns. The micro-delay residuals of forged packets from the attack generator drop to the range of 80ns to 150ns. The physical constraint verification module calculates the physical computing power mapping slope of legitimate nodes. The attack node's physical computing power mapping slope is concentrated in the 0.5 to 0.8 range. The performance jumps to over 15.0, forming a physical computing power isolation zone between the two. To reveal the performance inflection point of the system under degraded channels, gradient interference test groups with retransmission rate parameters of 15%, 30%, and 45% were set up. When the retransmission rate parameter R reaches over 30%, the non-computational delay expansion caused by network queuing leads to a saturation degradation effect in the micro-delay residuals of legitimate packets, with the value spreading to over 2500ns and the increase slowing down. In the second control group, which adopts a fixed computing power slope upper limit threshold judgment mechanism, more than 41.5% of the legitimate packets have a physical computing power mapping slope. Touching the boundary; in the experimental group of this invention, the link state adaptive compensation module dynamically calculates and outputs the upper limit threshold of compensation based on the retransmission rate parameter R. The upper limit threshold for compensation The translation amount and the retransmission rate parameter R are positively correlated. The legal hardware constraint interval expands synchronously under congestion conditions, accommodating the nonlinearly expanding legal message slope data.

[0040] Example 3: When the gateway device activates the physical communication protection logic, the physical computing power constraint boundary parameters are used to distinguish between legitimate low-power sensor nodes and abnormal computing platforms. To address the judgment deviation caused by manually estimated computing power slope boundary parameters under channel fluctuation conditions, the IoT gateway's automatic abnormal traffic filtering system initiates a baseline constraint establishment procedure. The physical constraint verification module sends a frame payload containing the gradient length to the designated legitimate low-power node. The test message sequence is used to extract the corresponding micro-delay residuals; the physical constraint verification module calculates the physical computing power mapping slope of each message based on the test data set, and selects the maximum slope value in the test sequence as the upper limit threshold of the computing power slope. The minimum slope value in the test sequence is selected as the lower limit threshold for computing power slope. This setup step solidifies the clock frequency deviation and interrupt response delay of the legitimate microprocessor into static reference boundaries.

[0041] To address latency inflation caused by network congestion, the link state adaptive compensation module establishes a mapping relationship between physical states and constraint boundaries; the state polling unit reads the retransmission rate parameter R from the physical layer state feedback bits; and the correction gain generation unit adjusts the upper limit threshold of the computing power slope based on the product of the retransmission rate parameter R and the network jitter tolerance coefficient α. Apply proportional widening calculation and output the upper limit threshold of compensation. Compensation upper limit threshold The calculation formula is as follows: ;in, To compensate for the upper limit threshold, The upper limit threshold for computing power slope is defined as α, the network jitter tolerance coefficient is defined as α, and the retransmission rate parameter is defined as R. The operation logic adjusts the fault tolerance range of legitimate hardware features according to the degree of channel degradation. The parameter calibration process and the retransmission rate ratio compensation operation establish the quantitative benchmark of computing power boundary features. The system outputs a set of judgment thresholds that are aligned with the physical communication link load status in real time. The asymmetric feature filtering module intercepts data packets that deviate from the benchmark computing capability based on the set of judgment thresholds, thus forming an adaptive hardware constraint mechanism.

[0042] Example 4: When the IoT gateway's abnormal traffic automatic filtering system is first connected to the communication network for on-site pre-deployment calibration, the quartz crystal oscillators inside low-power environmental monitoring sensors of different batches and models have inherent manufacturing tolerances. Directly applying the factory-specified frequency causes the modular arithmetic benchmark of the computing power feature calculation module to deviate. Before activating abnormal traffic interception and defense, the system switches to baseline rhythm adaptive mapping mode. Within the safe initialization time window when physically isolated and without abnormal traffic injection, the message physical attribute perception module continuously collects the arrival time intervals of adjacent frames of 10,000 consecutive messages sent by each legitimate low-power sensor node, and imports this time interval sequence into the autocorrelation statistical algorithm unit built into the computing power feature calculation module. This statistical algorithm unit calculates the center value of the high-frequency peak cluster interval in the time interval sequence to lock the reference rhythm period of the transmitting end. The reference rhythm period of the transmitting end Write to the protected storage area within the edge data interaction layer to provide subsequent micro-delay residuals. The stripping provides a time scale for on-site measurement and calibration.

[0043] Write the reference rhythm period at the sending end Subsequently, the physical constraint verification module performs a trial run verification of the hardware calculation slope based on the actual channel noise floor state of the local network environment, and retrieves the transmitter reference rhythm period from the protected storage area. The modulo operation of the arrival time interval Δt of adjacent frames involved in real-time measurement is used to extract the microscopic time delay residual δt characterizing the current batch of sensor states. Based on the arithmetic ratio of the frame payload length L to the microscopic time delay residual δt, a physical computing power mapping slope is continuously generated for 10,000 verification cycles. The system will collect the slope of all physical computing power images during the verification period. The minimum and maximum values ​​are set as the lower limit threshold of the computing power slope, respectively. With the upper limit threshold of computing power slope An initial reference benchmark is established, and an initial judgment reference table covering the range of computing power fluctuations of legitimate terminals under this network topology is created. The on-site deployment and calibration process establishes the physical traceability path for computing power boundary parameters. The system then enters a formal protection state with a customized underlying hardware constraint baseline. Addressing the thermal effects and clock crystal oscillator temperature drift caused by long-term continuous operation of the microprocessor, the physical constraint verification module continuously activates the baseline online adaptive reconstruction procedure in the formal protection state. Based on the exponentially weighted moving average statistical principle and with a higher calculation weight for recent observation data, sudden noise is filtered out to extract long-term physical parameter drift trends. The status polling unit has a built-in hardware timer that extracts all legitimate terminals within a fixed 24-hour time window. The processing unit extracts the latest observed maximum value from the current window for the slope of the physical computing power image of the message, multiplies it by the attenuation factor set internally by the maximum value, and adds the product of the initial computing power slope upper limit threshold and the difference between one and the attenuation factor to calculate and output the calibration upper limit benchmark. Simultaneously, the lower limit benchmark is updated using the same arithmetic logic. The calculated calibration upper and lower limit benchmarks are directly written to the underlying protected storage area to overwrite the original parameters. The attenuation factor represents the proportion of historical benchmark data retained and is dimensionless within the real number interval of 0.01 to 0.10. The online calibration procedure periodically integrates micro-environmental drift variables within the physical boundary of maintaining business communication continuity, providing dynamic hardware constraint boundaries that adapt to long-term operating conditions.

[0044] Example 5: In the gateway parameter calibration process for determining the network jitter tolerance coefficient, the statically preset compensation parameters cause the defense boundary to continuously widen under fluctuating channels. The abnormal traffic automatic filtering system of the IoT gateway switches to the parameter dynamic fitting mode. The link state adaptive compensation module injects gradient congestion traffic into the test port and controls the underlying communication bus to output multiple sets of baseline retransmission rate parameters R spanning from 0% to 50% in sequence. The physical constraint verification module collects the upper limit of the critical computing power slope for maintaining a 99% pass rate of legitimate packets under each set of baseline retransmission rate parameters R, and calculates its value compared with the upper limit threshold of computing power slope under the non-congestion state. The arithmetic difference is used to extract the corresponding absolute slope broadening ΔK; the correction gain generation unit imports the baseline retransmission rate parameter R and the absolute slope broadening ΔK under all test nodes into the linear fitting algorithm unit to perform slope calculation. The slope calculation process uses the least squares method as the basic mathematical model to find the local error sum of squares minimum constraint boundary. The algorithm unit input receives a test sample set containing M data pairs; the processing unit extracts the arithmetic mean of all baseline retransmission rate parameter samples and the arithmetic mean of all absolute slope broadening samples in the set; and calculates the individual baseline retransmission rate parameter and the absolute slope broadening ΔK. The arithmetic mean deviation is multiplied by the arithmetic mean deviation of the corresponding absolute slope broadening individual sample to obtain the partial cumulative sum of all test samples; the processing unit calculates the square cumulative sum of the deviations of the baseline retransmission rate individual sample and the arithmetic mean deviation; the partial cumulative sum is divided by the square cumulative sum to output a single definite constant. The parameter M is set as the total number of data points required for parameter calibration, and is constrained to be a dimensionless positive integer greater than ten. The data processing closed loop directly obtains the definite fitting slope constant, and the fitting slope constant is used as the benchmark reference for the network jitter tolerance coefficient and is solidified into the system's non-volatile memory.

[0045] When the physical communication interface faces a sudden channel change caused by network disconnection and reconnection, the backlog of messages in the physical queue causes the retransmission rate parameter R output by the physical layer status feedback bit to show a pulse-like increase. To control the compensation upper limit threshold... Unrestricted offset, link state adaptive compensation module wakes up boundary clamping mechanism, retrieves the preset retransmission rate limit threshold in built-in memory. The status polling unit will read the retransmission rate parameter R and the retransmission rate limit threshold in real time. The data is synchronously transmitted to a hardware comparator. When the comparator determines that the retransmission rate parameter R is greater than the retransmission rate limit threshold, the data is transmitted back to the hardware comparator. At that time, the correction gain generation unit suspends the regular proportional compensation operation flow and retrieves the retransmission rate limit threshold. The retransmission rate parameter R, which replaces the actual acquisition, is injected with a compensation upper limit threshold. In the compensation multiplier, the data replacement execution process locks the highest release boundary of the computing power mapping characteristics while maintaining the established channel fault tolerance capability, suppressing the divergence of the release conditions of the gateway system in a severely congested network environment.

[0046] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the protection scope of the present invention.

Claims

1. An automatic abnormal traffic filtering system for an Internet of Things (IoT) gateway, characterized in that, include: The message physical attribute sensing module is used to obtain the frame payload length of the message sequence to be detected and the arrival time interval between adjacent frames. The arrival time interval between adjacent frames is the difference between the hardware timestamps of two adjacent messages reaching the physical communication interface. The computing power feature calculation module is used to retrieve the pre-stored sender reference rhythm period of the edge data interaction layer, and perform modulo operation on the arrival time interval of adjacent frames based on the sender reference rhythm period. By stripping the macro synchronization component, it generates micro delay residuals that characterize the hardware packaging time consumption. The link state adaptive compensation module is used to read the retransmission rate parameter in the physical layer state feedback bit, and apply a tolerance shift based on the positive deviation to the pre-stored computing power slope upper limit threshold according to the retransmission rate parameter to generate a corrected upper limit threshold. The physical constraint verification module is used to determine the ratio of the frame payload length to the micro-delay residual as the physical computing power mapping slope, and to determine whether the physical computing power mapping slope falls within the legal hardware constraint range consisting of the lower limit threshold and the upper limit threshold of the computing power slope. The legal hardware constraint range is anchored to the instruction processing clock boundary of the IoT microprocessor. The lower limit threshold of the computing power slope corresponds to the minimum unit payload packaging time of the microprocessor at its nominal operating frequency, and the upper limit threshold of the computing power slope corresponds to the maximum unit payload packaging time of the microprocessor in low-power intermittent mode. The asymmetric feature filtering module is used to modify the data validity status bit in the underlying storage descriptor when the physical computing power mapping slope deviates from the legal hardware constraint range. This allows the detected packets that are judged to be abnormal to be directly overwritten in place by the subsequent legal packets in the receive buffer before being read by the operating system kernel, thereby blocking the invalid occupation of gateway kernel memory resources by abnormal traffic.

2. The automatic abnormal traffic filtering system for an IoT gateway according to claim 1, characterized in that, The message physical attribute perception module includes a feature capture unit and a spatiotemporal vector generation unit. The feature capture unit is used to capture the message stream to be detected at the physical communication interface and identify the frame payload length through the frame header information of the message stream to be detected. The spatiotemporal vector generation unit is used to record the nanosecond-level hardware timestamp of each message in the message stream to be detected reaching the physical communication interface, and defines the arithmetic difference between two consecutive hardware timestamps as the time interval between adjacent frames.

3. The automatic abnormal traffic filtering system for an IoT gateway according to claim 1, characterized in that, The computing power feature calculation module includes a built-in arithmetic logic unit (ALU), which calculates the micro-delay residual δt using the following formula: Where δt is the microscopic time delay residual, and Δt is the arrival time interval between adjacent frames. The reference rhythm period of the transmitting end is used; the micro delay residual δt is used to quantitatively characterize the fluctuation of the internal instruction processing time of the physical layer chip of the transmitting end when encapsulating the message to be detected.

4. The automatic abnormal traffic filtering system for an IoT gateway according to claim 1, characterized in that, The physical constraint verification module calculates the physical computing power mapping slope based on the linear comparison relationship between frame payload length and micro-delay residual. The calculation logic is as follows: ,in, The physical computing power mapping slope is given by L, where L is the frame payload length and δt is the microscopic delay residual. It is mapped to the message payload density carried by the unit hardware encapsulation time of the sending end, which is used to indicate the actual computing power level of the sending end.

5. The automatic abnormal traffic filtering system for an IoT gateway according to claim 1, characterized in that, The link state adaptive compensation module includes a state polling unit and a correction gain generation unit; the state polling unit is used to poll the physical layer state feedback bits through the register communication bus to extract the retransmission rate parameter that characterizes the degree of physical link congestion. The modified gain generation unit is used to apply a positive offset to the upper limit threshold of computing power slope based on the retransmission rate parameter in order to offset the non-computational micro-latency increase caused by network queuing.

6. The automatic abnormal traffic filtering system for an IoT gateway according to claim 1, characterized in that, The asymmetric feature filtering module is coupled to the message link control layer; When the asymmetric feature filtering module determines that the physical computing power mapping slope is less than the lower limit threshold of the computing power slope, it determines that the computing power of the sending end exceeds the hardware processing limit of the IoT node and identifies it as an illegal forged node. When the slope of the physical computing power mapping is greater than the upper limit threshold, the asymmetric feature filtering module determines that there is controlled abnormal traffic injection behavior at the sending end.

7. The automatic abnormal traffic filtering system for an IoT gateway according to claim 1, characterized in that, The IoT gateway's automatic abnormal traffic filtering system also includes a whitelist fingerprint database module. The whitelist fingerprint database module is used to maintain a table of legitimate node computing power characteristics, which records the average physical computing power mapping slope corresponding to each known legitimate node. When the physical computing power mapping slope falls within the legitimate hardware constraint range, the physical constraint verification module further calculates the real-time deviation rate of the physical computing power mapping slope relative to the average physical computing power mapping slope.

8. The automatic abnormal traffic filtering system for an IoT gateway according to claim 1, characterized in that, The sender's reference rhythm period is preset in the storage space of the edge data interaction layer according to the interaction specifications of different IoT communication protocols; the computing power feature calculation module calls the corresponding period parameter sub-library for different IoT protocol stacks to adapt to the inherent pulsation characteristics of different types of nodes, ensuring that the micro delay residual is stripped of the macro transmission delay component caused by the difference in protocol handshake.

Images