An internet of things security risk assessment and access control method and system

Abstract

The application relates to the technical field of Internet of Things security risk assessment and access control, in particular to an Internet of Things security risk assessment and access control method and system, which comprises the following steps: acquiring function responsibility information of a device and operation range information of the device in different task states; collecting communication data of the device during execution of an authorized task, and establishing a behavior mode benchmark of the device in the corresponding task according to the function responsibility information and the operation range information; acquiring real-time communication data of the device, extracting communication behavior parameters from the real-time communication data, comparing the communication behavior parameters with the behavior mode benchmark, and determining a behavior deviation degree; judging whether the current behavior of the device is consistent with the function responsibility and the current task context; and adjusting the access authority of the device according to the judgment result. The application improves the security protection capability in the Internet of Things environment.

Description

Technical Field

[0001] This invention relates to the technical field of Internet of Things (IoT) security risk assessment and access control, specifically to an IoT security risk assessment and access control method and system. Background Technology

[0002] In environments with large-scale deployment of IoT devices, traditional access control mechanisms often focus on authentication upon device access, neglecting potential internal state changes and behavioral anomalies that may occur during device operation. This mechanism fails to effectively identify and prevent potential attacks when a device is legitimate but has been compromised by an attacker, leading to the leakage of critical information or business disruption. For example, in an industrial automated production workshop, if an attacker gains control of a legitimate but vulnerable diagnostic instrument, even if its behavior remains within pre-defined broad permissions, the system may struggle to detect its anomalies, providing the attacker with an opportunity for deep penetration. Summary of the Invention

[0003] The purpose of this invention is to address the aforementioned shortcomings by proposing a method and system for IoT security risk assessment and access control.

[0004] The present invention adopts the following technical solution: A method for IoT security risk assessment and access control, comprising the following steps: Obtain the functional responsibility information of the device and the operating range information of the device in different task states. The functional responsibility information includes the device type and the core function list corresponding to the device type. Collect communication data of the device during the execution of authorized tasks, and establish a behavioral pattern benchmark of the device under the corresponding task based on functional responsibility information and operation scope information. The behavioral pattern benchmark is a set of normal behavioral patterns established based on the compliant communication data of the device under the corresponding task. The device acquires current communication data in real time, extracts communication behavior parameters from it, and compares the communication behavior parameters with the behavior pattern benchmark to determine the degree of behavior deviation. When the degree of behavioral deviation reaches the preset conditions, the device’s current behavior is determined to be consistent with its functional responsibilities and current task context based on the preset functional responsibility information and task context rules. The task context rules refer to the pre-configured judgment rules for the target resources that the device is allowed to access, the types of operations that are allowed to be performed, and the order of operations that are allowed in different task states. Based on the assessment results, adjust the device's access permissions.

[0005] Through this technical solution, the present invention can acquire the communication data of the device in real time and compare it with the preset behavior pattern benchmark, thereby effectively identifying the abnormal behavior of the device and dynamically adjusting the access permissions of the device according to the judgment result. This solves the problems that traditional access control mechanisms cannot effectively identify abnormal device behavior and that the permission management method is fixed, thus improving the security protection capability in the Internet of Things environment.

[0006] This invention also discloses an IoT security risk assessment and access control system. Applying the aforementioned IoT security risk assessment and access control method, the system includes: The acquisition module acquires the device's functional responsibility information and the device's operational scope information under different task states. The functional responsibility information includes the device type and a list of core functions corresponding to the device type. The module is established to collect communication data of the device during the execution of authorized tasks, and establishes a behavior pattern benchmark of the device under the corresponding task based on functional responsibility information and operation scope information. The behavior pattern benchmark is a set of normal behavior patterns established based on the compliant communication data of the device under the corresponding task. The processing module acquires the device's current communication data in real time, extracts communication behavior parameters from it, and compares the communication behavior parameters with the behavior pattern benchmark to determine the degree of behavior deviation. The judgment module determines whether the device's current behavior is consistent with its functional responsibilities and current task context when the degree of deviation from the preset conditions is reached, based on the preset functional responsibility information and task context rules. The task context rules refer to the judgment rules that are pre-configured for the target resources that the device is allowed to access, the types of operations that are allowed to be performed, and the order of operations that are allowed in different task states. Adjust the module and, based on the judgment results, adjust the device's access permissions.

[0007] This invention provides an IoT security risk assessment and access control system. Through modular design, it realizes the various functions of the above-mentioned method, providing a system-level solution for the security management of IoT devices and improving the convenience of deployment and management.

[0008] This invention, through real-time monitoring and dynamic adjustment, can promptly detect and prevent potential internal state changes and behavioral anomalies in equipment during operation. Even if a device is legitimate but has been controlled by an attacker, it can effectively identify and limit potential attack behaviors, thereby preventing the leakage of important information or business interruption. For example, in an industrial automated production workshop, even if a diagnostic instrument with security vulnerabilities is controlled by an attacker, this invention can promptly detect its abnormal behavior and adjust permissions through behavioral pattern comparison and task context judgment, effectively preventing attackers from using legitimate identities to conduct lateral movement and attacks. Therefore, this invention significantly improves security protection capabilities and response efficiency in the Internet of Things (IoT) environment, providing a solid guarantee for the secure operation of IoT devices.

[0009] To further understand the features and technical content of the present invention, please refer to the following detailed description and drawings of the present invention. However, the drawings provided are for reference and illustration only and are not intended to limit the present invention. Attached Figure Description

[0010] Figure 1 This is a flowchart of a method for IoT security risk assessment and access control according to the present invention; Figure 2 This is a schematic diagram of the structure of an Internet of Things (IoT) security risk assessment and access control system according to the present invention. Detailed Implementation

[0011] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can understand the advantages and effects of the present invention from the content disclosed in this specification. The present invention can be implemented or applied through other different specific embodiments, and various details in this specification can also be modified and changed based on different viewpoints and applications without departing from the spirit of the present invention. Furthermore, the accompanying drawings of the present invention are for simple illustrative purposes only and are not depictions of actual dimensions; this is stated in advance. The following embodiments will further describe the relevant technical content of the present invention in detail, but the disclosed content is not intended to limit the scope of protection of the present invention.

[0012] This embodiment provides a method and system for IoT security risk assessment and access control, combined with... Figure 1 and Figure 2 As shown.

[0013] refer to Figure 1 A method for IoT security risk assessment and access control, comprising the following steps: Obtain the functional responsibility information of the device and the operating range information of the device in different task states. The functional responsibility information includes the device type and the core function list corresponding to the device type. Collect communication data of the device during the execution of authorized tasks, and establish a behavioral pattern benchmark of the device under the corresponding task based on functional responsibility information and operation scope information. The behavioral pattern benchmark is a set of normal behavioral patterns established based on the compliant communication data of the device under the corresponding task. The device acquires current communication data in real time, extracts communication behavior parameters from it, and compares the communication behavior parameters with the behavior pattern benchmark to determine the degree of behavior deviation. When the degree of behavioral deviation reaches the preset conditions, the device’s current behavior is determined to be consistent with its functional responsibilities and current task context based on the preset functional responsibility information and task context rules. The task context rules refer to the pre-configured judgment rules for the target resources that the device is allowed to access, the types of operations that are allowed to be performed, and the order of operations that are allowed in different task states. Based on the assessment results, adjust the device's access permissions.

[0014] The "Functional Responsibility Information" refers to a set of data describing the inherent attributes and intended uses of IoT devices. Specifically, it includes the device type, such as a sensor, actuator, or controller, and a list of core functions corresponding to that device type. For example, the functional responsibility information for a temperature sensor device might include its type as an "environmental sensor," with core functions of "collecting temperature data" and "reporting temperature data." "Operating Scope Information" refers to the boundaries of operations that the device is allowed to perform under different task states. This can be a predefined whitelist listing the resources the device can access, the types of operations it can perform, and the order of operations under a specific task. For example, under a "data acquisition" task, the operating scope information for a sensor device might limit it to sending data to a specific data server and performing only "read" operations. "Behavioral Pattern Baseline" is a set of normal behavioral patterns established based on compliant communication data during authorized tasks. It is formed by learning and modeling the device's communication behavior under normal, anomaly-free conditions. For example, a statistical model or machine learning model can be constructed as a behavioral pattern baseline by statistically analyzing parameters such as the device's communication frequency, packet size, and target address during normal operation. "Communication behavior parameters" refer to various indicators extracted from the device's real-time communication data to characterize the device's current communication behavior. These parameters may include, but are not limited to, source IP address, destination IP address, source port, destination port, protocol type, packet length, communication frequency, and session duration. "Behavioral deviation" is a quantitative indicator that measures the difference between the device's current communication behavior and a baseline behavioral pattern. It can be statistical distance (such as Euclidean distance or Mahalanobis distance), probability deviation, or anomaly score. "Task context rules" refer to pre-configured rules that determine the target resources the device is allowed to access, the types of operations it is allowed to perform, and the order of operations allowed under different task states. These rules are dynamic and can be adjusted according to the specific task scenario the device is in. For example, under a "firmware upgrade" task, the device may be allowed to access a specific firmware server and perform a "write" operation, while under normal operating tasks, it may not be allowed.

[0015] The core of the IoT security risk assessment and access control method of the present invention lies in the real-time monitoring of IoT device behavior, anomaly detection, and dynamic permission adjustment.

[0016] First, it's necessary to obtain the device's functional responsibilities and operational scope information under different task states. Functional responsibilities information can be pre-stored in the device's security configuration file or obtained through metadata submitted during device registration. For example, when a device first connects to the network, its type (e.g., smart camera, industrial robot) and its corresponding core function list (e.g., video streaming, motion control) are entered into the security management platform. Operational scope information can be configured according to the device's role and task requirements in different business scenarios. For example, a smart door lock in "daily use" might have its operational scope limited to receiving unlocking commands and sending status information; while in "maintenance mode," it might be allowed to perform firmware updates and upload diagnostic data. This information can be obtained through manual configuration, extraction from specifications provided by the device manufacturer, or learning from historical data using machine learning methods.

[0017] Secondly, it is necessary to collect communication data of the device during the execution of authorized tasks, and establish a behavioral pattern benchmark for the device under the corresponding task based on functional responsibility information and operational scope information. Establishing a behavioral pattern benchmark is fundamental to identifying abnormal behavior. For example, during normal device operation, its network traffic can be continuously captured, and protocol parsing and feature extraction can be performed on the communication data, such as communication frequency, packet size, target IP address, port number, and protocol type. This compliant communication data is used to train a behavioral model, which can be a statistical model (such as a Gaussian mixture model), a rule-based model, or a machine learning model (such as an autoencoder or recurrent neural network). For example, for a smart meter, under normal meter reading tasks, its communication pattern might exhibit periodic sending of small data packets to the data center. By learning from this normal behavioral data, a benchmark describing its normal communication pattern can be established.

[0018] Next, the device's current communication data is acquired in real time, and communication behavior parameters are extracted from it. These parameters are then compared with a behavior pattern benchmark to determine the degree of deviation. Real-time communication data acquisition can be achieved by deploying traffic mirroring ports in the network or using network probes. The communication behavior parameters extracted from this real-time data, such as the current communication target address, data volume, and communication frequency, are input into a pre-established behavior pattern benchmark for comparison. The comparison method can be to calculate the distance between the current behavior parameters and the benchmark model, or to assess the probability of the current behavior falling within the benchmark model. For example, if the behavior pattern benchmark is a statistical model, the probability that the current communication behavior parameters fall at the tail of the model's distribution can be calculated; the lower the probability, the greater the degree of behavior deviation.

[0019] When a behavioral deviation reaches a preset threshold, the system determines whether the device's current behavior is consistent with its functional responsibilities and current task context, based on preset functional responsibility information and task context rules. The preset threshold can be a threshold; when the behavioral deviation exceeds this threshold, further judgment is triggered. For example, if a smart camera, in a non-video transmission task, reaches the preset threshold due to continuously sending large amounts of data to unknown IP addresses, the system will initiate a functional responsibility and task context consistency judgment. Task context rules are pre-configured and define the target resources the device is allowed to access, the types of operations allowed to perform, and the allowed order of operations in a specific task state. For example, in a "video surveillance" task, the smart camera is allowed to transmit video streams to a video server but is not allowed to access the internal database or perform firmware upgrades. By comparing the device's current behavior with these rules, its compliance can be determined.

[0020] Finally, based on the assessment results, adjust the device's access permissions. If the assessment results indicate that the device's current behavior is inconsistent with its functional responsibilities and the current task context, appropriate permission adjustment measures need to be taken. For example, if a sensor device is judged to be behaving abnormally and its behavior is inconsistent with its functional responsibilities, its access permissions may be downgraded, restricting it to communicating only with the security management platform, or it may be directly isolated from the production network. Permission adjustments can be achieved by modifying network access control lists, firewall rules, or the device's own security policies.

[0021] This invention further proposes an IoT security risk assessment and access control method. When the degree of behavioral deviation reaches a preset condition, and when the device is a critical IoT device, the method further includes performing causal path determination on the critical IoT device. The steps of causal path determination include: Establish a causal logic mapping table for key IoT devices. The causal logic mapping table records the causal relationship between the operation instructions of key IoT devices, the internal state of key IoT devices and expected changes in internal state, and expected external functional performance. The internal state of key IoT devices refers to the internal hardware and software working conditions and internal parameter state of key IoT devices at the current operating moment. The expected external functional performance refers to the functional output result or business execution result presented to the outside world after the key IoT devices perform the corresponding operation. Real-time acquisition of operation command sequences and internal status information of key IoT devices; Based on the real-time operation command sequence of key IoT devices and the internal state information of key IoT devices, the matching causal relationship path is searched in the causal logic mapping table to infer the expected result of the corresponding operation. The expected results are compared with the actual observed internal state changes and external functional performance of key IoT devices to determine the degree of causal deviation. The degree of causal deviation is an indicator that quantifies the magnitude of the deviation of the actual observed internal state changes and external functional performance from the expected results. When the degree of causal deviation exceeds the preset causal deviation threshold, the current behavior of the key IoT device is determined to be abnormal in the causal relationship path. The causal relationship path determination results are combined with preset functional responsibility information and task context rules as the basis for judging whether the current behavior of key IoT devices is consistent with their functional responsibilities and current task context.

[0022] Specifically, "critical IoT devices" refer to devices that have important functions in IoT systems, carry critical business operations, or involve sensitive data. A malfunction or attack on such devices would lead to serious consequences. Examples include programmable logic controllers (PLCs) in industrial control systems, monitoring and data acquisition equipment, medical devices, and smart terminals in smart grids. "Causal path determination" refers to analyzing the logical relationships between the operational instructions, internal state changes, and external functional performance of critical IoT devices to determine whether the device's behavior conforms to a pre-defined causal logic. A "causal logic mapping table" can be understood as a pre-built knowledge graph or rule base that records in detail how, under normal operating conditions, a specific "operational instruction" causes the "internal state of the critical IoT device" to transition from one state to the "expected internal state change," ultimately resulting in the "expected external functional performance." For example, for a smart valve, upon receiving a "open valve" instruction, its internal state (such as the valve opening sensor reading) should change from "closed" to "open," and the external functional performance should show fluid beginning to flow. This mapping table can be constructed using specifications provided by the device manufacturer, historical normal operation data analysis, or expert knowledge. "Internal state of critical IoT devices" specifically refers to the device's internal operating parameters at a given moment, such as hardware and software configuration, register values, sensor readings, program counter, and memory usage. "Expected external functional performance" refers to the visible functional output or business processing results that the device will exhibit after performing a specific operation, such as sensor data output, actuator actions, and network message transmission. "Real-time operation instruction sequence" refers to the set of instructions received and executed by the critical IoT device within a certain time period; these instructions may originate from a host computer, other devices, or internal programs. "Causal deviation degree" is a quantitative indicator representing the magnitude of the deviation between the observed internal state changes and external functional performance of the critical IoT device and the expected results inferred from the causal logic mapping table. This indicator can be obtained by calculating the difference, error rate, or inconsistency between the actual and expected values; for example, it can be calculated using Euclidean distance, Manhattan distance, or rule-based matching degree calculation methods. "Causal deviation threshold" is a preset critical value; when the causal deviation degree exceeds this threshold, the causal relationship path of the device is considered abnormal. This threshold can be configured and dynamically adjusted based on the device type, importance, historical data analysis, and security policies.

[0023] This invention addresses the limitations of basic solutions in detecting deep-seated abnormal behavior within critical IoT devices by introducing a causal path determination mechanism. Specifically, when the basic solution detects a behavioral deviation reaching a preset condition, it no longer relies solely on external communication behavior for judgment. Instead, it further analyzes the internal operating logic of the critical IoT device. Through a pre-established causal logic mapping table, this solution compares the real-time acquired operation command sequences and internal state information of the critical IoT device with the expected causal relationships. Once a significant difference is found between the actual internal state change or external functional performance and the expected result inferred from the causal logic mapping table—that is, the causal deviation exceeds a preset causal deviation threshold—the current behavior of the critical IoT device can be determined to be an abnormal causal path. This mechanism effectively identifies critical IoT devices whose external communication behavior appears normal, but whose internal logic has been tampered with or is executing abnormally, thus compensating for the shortcomings of detection based solely on external communication behavior patterns. Finally, by combining the causal path determination results with preset functional responsibility information and task context rules, a more comprehensive and in-depth basis is provided for determining whether the current behavior of the critical IoT device is consistent with its functional responsibilities and current task context.

[0024] Through the above technical solution, this invention enables a deeper and more refined security risk assessment of critical IoT devices. Compared to detection relying solely on external communication behavior patterns, the introduction of a causal path determination mechanism allows the system to identify critical IoT devices whose external communication behavior is normal but whose internal logic or state has malfunctioned. This effectively avoids missing complex internal attacks or covert tampering. This significantly improves the security protection capabilities of critical IoT devices and enhances the overall resilience and reliability of the IoT system, especially in the face of advanced persistent threats or internal threats, providing more accurate and timely early warnings and responses.

[0025] The following is a concrete example to illustrate this. Suppose that in an industrial control system, there is a key IoT device—a smart valve—whose function is to control the flow of fluid in the pipeline according to commands. First, a causal logic mapping table is established for this smart valve, which records the causal relationship that "receiving an open command" leads to "the valve's internal opening sensor reading changing from 0% to 100%" and "externally, fluid begins to flow." When the system detects that the smart valve's communication behavior deviates to a preset condition through communication behavior pattern detection, it further triggers the causal path determination. At this time, the system acquires the sequence of operation commands received by the smart valve in real time (e.g., receiving a "open valve" command) and its internal state information (e.g., the valve opening sensor reading). According to the causal logic mapping table, the system infers that the expected result should be that the valve opening becomes 100% and fluid begins to flow. Subsequently, the system compares the expected result with the actual observed internal state (e.g., the sensor reading is still 0%) and external functional behavior (e.g., fluid does not flow). If the comparison results show that the degree of causal deviation (e.g., a significant difference between sensor readings and expected values) exceeds a preset causal deviation threshold, the current behavior of the smart valve is determined to be an anomaly in the causal path. Even if its external communication behavior may be disguised as normal to some extent, this anomaly in internal causal logic can be detected in a timely manner, thus providing a more reliable basis for subsequent access control adjustments. For example, the access control of the smart valve can be downgraded or isolated to prevent potential security incidents from escalating further.

[0026] When the degree of causal deviation exceeds a preset causal deviation threshold, the steps to determine that the current behavior of a critical IoT device belongs to an abnormal causal path include: Continuously monitor historical data on the degree of causal deviation, and dynamically adjust the causal deviation threshold based on the type of key IoT device, the uptime of key IoT devices, and environmental parameters; When the degree of causal deviation fluctuates within the preset range of the dynamically adjusted causal deviation threshold, the causal deviation threshold is readjusted again based on the reliability of the self-inspection results of key IoT devices. When the degree of causal deviation exceeds the final adjusted causal deviation threshold, the current behavior of the critical IoT device is determined to be an abnormal causal path.

[0027] Specifically, the historical data for continuously monitoring causal deviation refers to the system continuously collecting and storing causal deviation values ​​calculated by key IoT devices at different times and under different operating conditions. This historical data constitutes a long-term view of device behavior patterns, providing a data foundation for subsequent dynamic adjustments. Dynamically adjusting the causal deviation threshold based on the type of key IoT device, its operating time, and environmental parameters can be understood as the system using machine learning algorithms, statistical analysis models, or preset rule sets to adjust the causal deviation threshold in real time or periodically, based on the device's inherent attributes (such as the device type determining its normal behavior patterns and performance parameters), its lifecycle stage (such as the potential for different performance degradation or behavioral drift between new and old devices), and external environmental factors (such as temperature, humidity, vibration, network load, and other parameters that may affect device performance and communication behavior). The aim is to make the threshold more accurately adapt to the specific operating conditions of the device, avoiding misjudgments caused by environmental changes or device aging.

[0028] Specifically, when the degree of causal deviation fluctuates within the preset range of the dynamically adjusted causal deviation threshold, the threshold is readjusted based on the reliability of the self-test results of key IoT devices. The preset range refers to the interval within which the degree of causal deviation is allowed to fluctuate slightly to a certain extent, based on the dynamically adjusted threshold. This reflects the inherent randomness and uncertainty in the normal operation of the device. The reliability of the self-test results of key IoT devices means that when the degree of causal deviation is within this fluctuation range, the system will refer to the internal diagnostic results (i.e., self-test results) reported by the device itself and their reliability. For example, if the device's self-test results show everything is normal and are assessed as highly reliable, the system may further tighten the causal deviation threshold to improve sensitivity to minor anomalies; conversely, if the self-test results show anomalies or have low reliability, the system may appropriately relax the threshold to avoid misjudgments due to inaccurate self-test results. The purpose is to improve the accuracy and robustness of anomaly detection by introducing the device's own internal state information to perform deeper verification and calibration of deviations observed from external behavior. Ultimately, when the degree of causal deviation exceeds the causal deviation threshold after two dynamic adjustments, the system will finally determine that the current behavior of the critical IoT device belongs to an abnormal causal path.

[0029] This invention effectively addresses the false alarms and missed alarms that may arise from static thresholds in complex and ever-changing IoT environments by introducing a dynamic adjustment mechanism for causal deviation thresholds. First, by continuously monitoring historical data and combining it with device type, operating time, and environmental parameters, preliminary dynamic adjustments are made to allow the threshold to better adapt to the normal behavioral fluctuations of devices under different operating conditions, thereby improving the basic accuracy of anomaly detection. Furthermore, when the degree of causal deviation fluctuates within the initially adjusted threshold range, the system does not immediately make a judgment but instead readjusts it based on the reliability of the self-test results of key IoT devices. This mechanism allows the system to finely calibrate the threshold by referring to the device's internal self-diagnostic information when external behavioral deviations are not significant. For example, when external deviations are small but device self-test results indicate internal problems, the system can more sensitively identify potential anomalies; conversely, when external deviations are small but device self-test results are highly reliable, the system can avoid unnecessary alarms. Therefore, this invention's solution can more comprehensively and accurately assess the true operating status of devices, avoiding the limitations of relying solely on external behavioral observations.

[0030] Through the above technical solution, this invention can significantly improve the accuracy and adaptability of IoT security risk assessment and access control. Dynamically adjusting the causal deviation threshold allows the system to flexibly adjust the anomaly judgment criteria based on the specific operating environment and state of key IoT devices, effectively reducing false alarms and missed alarms. Further adjustments based on the reliability of the self-test results of key IoT devices further enhance the robustness of anomaly judgment, enabling the system to make more informed decisions when faced with ambiguous or uncertain behavioral deviations. This multi-layered, adaptive threshold adjustment mechanism allows the IoT security protection system to better cope with increasingly complex attack methods and changing operating environments, improving overall security protection capabilities.

[0031] In some preferred embodiments, it is assumed that a smart manufacturing plant deploys various key IoT devices, such as industrial robots, CNC machine tools, and environmental sensors. These devices exhibit different normal communication behaviors and internal state fluctuations under different production tasks, shifts, and seasons (variations in ambient temperature and humidity). Using a fixed causal deviation threshold may lead to frequent false alarms during high-load operation of the equipment, while under low-load operation or specific environmental conditions, it may easily miss genuine anomalies.

[0032] The solution of this invention first continuously monitors historical data on the degree of causal deviation of these devices during long-term operation. For example, for an industrial robot, the degree of causal deviation of its internal motor current, joint angle, and communication frequency may fluctuate within a certain range when performing welding tasks; however, this range will be different when performing handling tasks. The system dynamically adjusts its causal deviation threshold based on the robot's specific model (equipment type), running time (running time), and the current temperature and humidity of the workshop (environmental parameters). For example, in a high-temperature environment in summer, the temperature of some parts of the robot may be slightly higher, causing a slight deviation in internal state parameters. The system will correspondingly relax the threshold to avoid false alarms.

[0033] Furthermore, when the degree of causal deviation fluctuates within the preset threshold range after the aforementioned dynamic adjustment, the system will readjust based on the reliability of the industrial robot's self-test results. For example, the robot periodically executes a self-test program, reporting the health status of its internal sensors, actuators, and control units. If the self-test results show that all systems are normal and the historical reliability of the self-test program is high, then even if the degree of causal deviation fluctuates slightly, the system may consider it a fluctuation within the normal range and further tighten the threshold to improve sensitivity to potential minor anomalies. Conversely, if the self-test results show that a sensor has intermittent failures, or the historical reliability of the self-test program is low, then even if the degree of causal deviation fluctuates little, the system may appropriately relax the threshold, or trigger an alarm when the degree of causal deviation increases slightly, to avoid missed detections due to unreliable self-test results. Finally, only when the degree of causal deviation exceeds the final threshold after two dynamic adjustments will the system determine that the industrial robot's current behavior belongs to an abnormal causal path and take corresponding safety measures.

[0034] This invention further proposes a step of readjusting the causal deviation threshold based on the reliability of the self-test results of key IoT devices, including: Obtain the self-inspection results of key IoT devices, where the self-inspection results refer to the result information used to characterize the internal operating status of key IoT devices; Acquire external behavior verification data of key IoT devices, where external behavior verification data refers to data used to externally verify the self-test results; According to the preset cross-validation rules, the self-test results and external behavior verification data are cross-compare. Based on the cross-comparison results, assess the reliability of the self-test results of key IoT devices; The causal deviation threshold is readjusted based on the reliability of the self-inspection results of key IoT devices.

[0035] Specifically, self-test results can be understood as status reports generated by critical IoT devices through the execution of preset diagnostic procedures or analysis of internal sensor data. For example, self-test results may include the health status of device hardware components, the operational status of software modules, configuration values ​​of internal parameters, and verification results of sensor readings. Its purpose is to provide a preliminary assessment of the device's internal operating status.

[0036] External behavioral verification data can be understood as data independently observed and collected from outside key IoT devices that reflects the actual behavior and functional performance of the devices. For example, external behavioral verification data may include communication logs between the device and external systems, physical signals output by the device, the environmental impact of the device's operations (such as temperature and pressure changes), and performance indicators obtained through third-party monitoring systems. Its purpose is to provide a perspective independent of the device itself to verify the authenticity and accuracy of its internal self-testing results.

[0037] In practical applications, cross-validation rules refer to a series of pre-configured logical judgment conditions and algorithms used to compare the consistency or discrepancies between the internal self-test results of critical IoT devices and external behavioral verification data. For example, if the self-test result reports that an actuator is in normal working condition, while external behavioral verification data (such as actuator output monitored by external sensors) shows that the actuator is abnormal, the cross-validation rule will determine that the two are inconsistent. Its purpose is to discover contradictions between self-test results and actual external behavior, thereby revealing the potential unreliability of the self-test results.

[0038] Assessing the reliability of self-test results for critical IoT devices can be understood as quantifying or qualitatively judging the trustworthiness of the self-test results based on cross-comparison results. For example, if the self-test results are highly consistent with external behavioral verification data, the reliability of the self-test results is assessed as high; conversely, if there are significant inconsistencies, the reliability is assessed as low. The aim is to provide an evidence-based reliability metric for subsequent adjustments to the causal deviation threshold.

[0039] Specifically, when the reliability of the self-test results is high, the internal state reflected by the results can be trusted more, allowing for more refined or aggressive adjustments to the causal deviation threshold. Conversely, when the reliability of the self-test results is low, a more conservative strategy may be needed to adjust the causal deviation threshold, or even no adjustment may be made temporarily, to avoid making incorrect decisions based on unreliable information. The aim is to ensure that the adjustment of the causal deviation threshold is based on reliable information, thereby improving the accuracy and robustness of anomaly detection.

[0040] This invention effectively solves the reliability problem that may arise from relying solely on internal self-test results by introducing external behavioral verification data and cross-referencing it with the self-test results of key IoT devices. Specifically, when a key IoT device reports its internal state as normal, the system does not blindly accept this result but verifies it using independently acquired external behavioral verification data. For example, if the device's self-test reports that a certain sensor is working normally, but an external monitoring system detects abnormal data output from that sensor, a pre-defined cross-validation rule can identify this inconsistency between the internal report and external observation. It is precisely this dual verification mechanism that makes the reliability assessment of the key IoT device's self-test results more accurate and objective. Based on this, the causal deviation threshold is readjusted according to the assessed reliability, ensuring that the threshold adjustment is based on more reliable information. This avoids misjudgments or omissions caused by unreliable self-test results, significantly improving the accuracy and robustness of abnormal behavior detection.

[0041] Through the above technical solution, this invention effectively addresses the potential unreliability of self-test results from critical IoT devices, thereby significantly improving the accuracy and robustness of causal deviation threshold adjustment. By introducing external behavioral verification data and performing cross-comparison, the authenticity of self-test results can be independently verified, ensuring that the reliability assessment used for threshold adjustment is based on a comprehensive judgment of multi-source information. Compared to solutions relying solely on internal device self-tests, this invention can more effectively identify tampered or faulty self-test reports, avoiding inappropriate adjustments to the causal deviation threshold due to erroneous information. Therefore, this invention maintains high-precision abnormal behavior detection capabilities even when critical IoT devices face internal faults or malicious attacks, reducing false alarm and false negative rates, thus comprehensively enhancing the security protection capabilities of IoT systems.

[0042] In some preferred embodiments, a specific example is given below. Assume a critical industrial robot in a smart manufacturing plant is configured as an IoT device. This robot periodically performs a self-test procedure and generates self-test results, such as reporting that its motor drive system, sensor array, and control unit are all functioning normally. To verify the reliability of these self-test results, the system simultaneously acquires external behavioral verification data of the robot. For example, vision sensors installed in the robot's work area collect the robot's motion trajectory and posture information in real time; current sensors monitor the actual current consumption of the robot's joint motors; and network traffic analysis tools are used to bypass and listen to the communication data between the robot and the control server, parsing its protocols and command words. Subsequently, according to preset cross-validation rules, the system compares the self-test results with the external behavioral verification data. For example, if the self-test result reports that a certain motor drive system is normal, but the current sensor data shows abnormal current fluctuations in the motor, or the vision sensor observes a deviation in the robot's motion trajectory, the cross-validation rules will determine that the self-test results are inconsistent with the external behavior. Based on this cross-comparison result, the system evaluates the reliability of the industrial robot's self-test results. For example, if multiple inconsistencies exist, the reliability of the self-test results will be assessed as low; if there is a high degree of consistency, it will be assessed as high. Ultimately, based on the assessed reliability of the self-test results, the system will readjust the causal deviation threshold. For instance, when the reliability of the self-test results is low, the system may adopt a more conservative strategy, such as slightly increasing the causal deviation threshold to slightly reduce its sensitivity to abnormal behavior and avoid false alarms due to unreliable self-test information; while when the reliability of the self-test results is high, the system may make more precise adjustments to the causal deviation threshold based on the internal state reflected in the self-test results to optimize the performance of anomaly detection. In this way, even if the robot's self-test system itself is affected, the solution of this invention can be independently verified externally to ensure that the adjustment of the causal deviation threshold is based on reliable information, thereby maintaining a high level of safety protection.

[0043] The steps for obtaining the self-test results of key IoT devices mentioned above may include the following: Send self-test instructions to critical IoT devices, including instructions to run a self-test program or to start a self-test sequence. During the execution of self-test commands by critical IoT devices, the internal status information of the critical IoT devices is acquired in real time. Based on the self-test instructions and the internal status information of the key IoT devices, determine the self-test results of the key IoT devices.

[0044] Specifically, a self-test command can be understood as a command that triggers the internal diagnostic mechanisms of critical IoT devices, aiming to prompt the device to check its own hardware and software status. This self-test command can manifest as a command to run a self-test program, instructing the device to execute pre-programmed diagnostic software modules; or as a command to initiate a self-test sequence, performing tests on each functional module of the device according to preset steps and order. These commands are typically sent through a security management platform or dedicated diagnostic interface to ensure their legitimacy and security.

[0045] In the context of critical IoT devices executing self-test commands, real-time acquisition of the device's internal status information refers to the continuous collection of various internal operating parameters and status data throughout the entire self-diagnosis cycle. This internal status information may include, but is not limited to, CPU utilization, memory usage, sensor readings, firmware version, health status of key components, error logs, and the status of internal communication links. The purpose of real-time acquisition is to comprehensively and dynamically understand the actual operating status of the device during the self-test process, providing detailed data support for subsequent self-test result determination.

[0046] In practical applications, determining the self-test results of critical IoT devices based on self-test commands and their internal status information involves a comprehensive analysis and evaluation of the execution of the sent self-test commands and the real-time acquired internal status information. For example, it can compare whether the device's internal status information after executing the self-test command meets the expected normal range or preset diagnostic criteria. If all tests pass, the self-test result may indicate that the device is operating normally; if an anomaly exists, the self-test result will detail the type, location, and severity of the anomaly. The purpose is to generate a diagnostic report that quantitatively or qualitatively characterizes the device's internal operating status, serving as an important basis for assessing the reliability of the device's self-test results.

[0047] The present invention proactively triggers the internal diagnostic mechanism of key IoT devices by sending specific self-test commands, thereby systematically acquiring real-time internal status information of the devices during the self-test process. This proactive triggering and real-time monitoring mechanism ensures that the acquired internal status information directly and comprehensively reflects the current operating status of the devices. By comprehensively analyzing the execution of these self-test commands and the internal status information, the self-test results of key IoT devices can be accurately determined, providing a solid data foundation for subsequent evaluation of the reliability of the self-test results.

[0048] The above technical solution enables the proactive, systematic, and real-time acquisition of self-test results from critical IoT devices. This method not only ensures the comprehensiveness and timeliness of the self-test results but also significantly improves their accuracy and reliability through detailed analysis of the internal state information during the execution of self-test commands. This provides high-quality input data for dynamically adjusting causal deviation thresholds based on the reliability of the self-test results from critical IoT devices, thereby enhancing the accuracy and responsiveness of the entire IoT security risk assessment and access control method.

[0049] The steps for obtaining external behavior verification data for critical IoT devices include: During the execution of self-test commands by critical IoT devices, communication data between critical IoT devices and external devices is collected in real time, and the protocol is parsed and features are extracted. The features include communication target address, communication port, protocol type, data payload length, and command word or function code. Real-time acquisition of the external functional performance of key IoT devices after executing self-test commands; Based on the extracted features and the external functional performance of key IoT devices after executing self-test commands, external behavior verification data of key IoT devices are formed.

[0050] In this context, real-time acquisition of communication data between critical IoT devices and external devices during the execution of self-test commands involves continuously capturing all data packets exchanged between the critical IoT device and external network entities when executing its internal self-test program commands or initiating a self-test sequence command, through network interfaces or bypass monitoring. Protocol parsing of this communication data aims to identify the type of communication protocol, such as TCP, UDP, HTTP, and MQTT, and to separate components such as protocol headers and data payloads from the raw data stream. Furthermore, features are extracted from the parsed communication data; these features are key attributes used to characterize communication behavior. Specifically, the communication destination address indicates the destination of the data packet, the communication port identifies the target application or service, the protocol type clarifies the set of rules followed by the communication, the data payload length reflects the amount of information transmitted, and the command word or function code directly indicates the specific operation or request being performed by the device. The extraction of these features makes quantitative analysis of the device's external behavior possible.

[0051] Meanwhile, real-time acquisition of the external functional performance of key IoT devices after executing self-test commands refers to obtaining the actual functional output or business execution results of the device in the external environment by observing the physical state of the device's external interfaces, sensor readings, actuator actions, or through device reports received from external systems, after the self-test command has been executed or during its execution. For example, whether a smart valve opens or closes correctly after a self-test, whether a sensor outputs the expected measurement value, or whether a controller sends the correct control signals to other devices.

[0052] Therefore, based on the extracted features and the external functional performance of key IoT devices after executing self-test commands, external behavior verification data for key IoT devices is formed. This data aggregates the communication details and external functional performance of the device during self-testing, providing a comprehensive external perspective for subsequent independent verification of the device's self-test results.

[0053] The present invention provides external behavioral verification data by real-time acquisition of communication data between a critical IoT device and external devices during the execution of self-test commands, followed by protocol parsing to extract key features. Simultaneously, it acquires the device's external functional performance after executing the self-test commands. The principle behind this process is that while the device's self-test results reflect its internal operating state, they may be subject to tampering or false alarms. By independently observing the device's communication behavior and functional output from an external perspective, an objective and independent verification basis can be obtained. When the device's internal self-test results are cross-referenced with the external behavioral verification data, significant inconsistencies indicate lower reliability of the self-test results, thus enabling a more accurate assessment of the authenticity of the critical IoT device's self-test results.

[0054] Through the above technical solution, this invention provides a comprehensive and reliable method for obtaining external behavioral verification data of critical IoT devices. This method not only focuses on the device's internal self-test report but also constructs an independent verification mechanism by monitoring its external communication and functional performance in real time. This significantly enhances the accuracy of assessing the reliability of self-test results for critical IoT devices, effectively avoiding the risk of failing to detect anomalies in a timely manner due to distorted self-test results caused by internal device malfunctions or malicious tampering. Therefore, when subsequently readjusting the causal deviation threshold, a more accurate assessment of the reliability of the self-test results can be made, resulting in more reasonable and precise threshold adjustments, thereby improving the overall robustness and security of the IoT security risk assessment and access control method.

[0055] This invention further proposes a step of readjusting the causal deviation threshold based on the reliability of the self-test results of key IoT devices, including: Based on the cross-validation rules and their input data, an encryption verification benchmark is established, whereby the encryption verification benchmark refers to the encrypted digest value or digital signature benchmark used for integrity comparison. The cross-validation rules file and the configuration parameters used to collect input data are periodically compared with the encryption verification benchmark to obtain the verification results. Deploy independent security audit probes. These probes periodically collect raw samples of external behavior verification data through bypass listening or dedicated security interfaces, and independently verify them to obtain independent verification results. Based on the verification results and independent verification results, evaluate the completeness of the cross-validation rules and their input data; Before each adjustment of the causal deviation threshold, the impact of the adjustment on the historical anomaly event identification rate is simulated to obtain the simulation impact results. The historical anomaly event identification rate refers to the proportion of historical anomaly events correctly identified as anomalies in the sample. Based on the key IoT device types, the importance of the task, and the frequency and type of historical anomalies, the step size and frequency corresponding to the causal deviation threshold are dynamically adjusted when it is adjusted again, so as to obtain the adjusted step size and frequency. Based on the reliability of the self-inspection results of key IoT devices, the cross-validation rules and the completeness of their input data, the simulation impact results, and the adjusted step size and frequency, the causal deviation threshold is adjusted again. Periodically obtain the latest vulnerability information, attack patterns and threat landscape from external security information sources to obtain external security landscape information; An alarm is triggered when the result of readjusting the causal deviation threshold contradicts external security situation information.

[0056] The cryptographic verification benchmark can be understood as a security fingerprint, its purpose being to ensure that the cross-validation rules used to evaluate the reliability of self-test results and their input data have not been maliciously tampered with during transmission, storage, and processing. Specifically, the benchmark can be a cryptographic digest value calculated using a hash algorithm (such as SHA-256) or a digital signature issued by a trusted third party. Periodically comparing the cross-validation rule file and the configuration parameters used to collect input data with the cryptographic verification benchmark aims to promptly detect any unauthorized modifications, thereby ensuring the accuracy of subsequent evaluations.

[0057] Furthermore, the deployment of independent security audit probes aims to provide an independent third-party verification mechanism unaffected by critical IoT devices or their management systems. This probe can bypass network traffic monitoring or directly obtain raw samples of external behavioral verification data through a dedicated secure interface. Independent verification prevents data forgery or tampering caused by compromised device or management systems, thereby increasing the credibility of external behavioral verification data. Based on the verification results and independent verification results, the integrity of cross-validation rules and their input data can be comprehensively evaluated, ensuring the reliability of the basis used for threshold adjustments.

[0058] Furthermore, before each readjustment of the causal deviation threshold, the impact of the adjustment on the historical anomaly detection rate is simulated. This aims to pre-assess the potential risks and effectiveness of the adjustment strategy. The historical anomaly detection rate refers to the proportion of known anomaly samples that the system can correctly identify. Simulation helps prevent a decline in the system's ability to detect known threats due to inappropriate adjustments. Based on the type of critical IoT device, the importance of the task, and the frequency and type of historical anomalies, the step size and frequency of subsequent readjustments of the causal deviation threshold are dynamically adjusted. This aims to make the threshold adjustment process more flexible and refined to adapt to the specific security needs of different devices and application scenarios. For example, for high-risk, high-value critical devices, smaller step sizes and higher adjustment frequencies can be used to ensure higher security sensitivity.

[0059] This invention's solution effectively prevents the risk of cross-validation rules and input data being tampered with by establishing an encrypted verification benchmark and periodically performing integrity comparisons, thus ensuring the reliability of the threshold adjustment basis. Simultaneously, deploying independent security audit probes to independently collect and verify original samples of external behavioral verification data through side-channel monitoring or dedicated interfaces further strengthens the trust chain of data sources, avoiding risks arising from single points of failure or internal system compromise. Furthermore, simulating the impact on the identification rate of historical anomalies before each adjustment allows the threshold adjustment strategy to be pre-evaluated and optimized, avoiding the problem of reduced system detection capabilities due to blind adjustments. Dynamically adjusting the step size and frequency of threshold adjustments makes the adjustment process more flexible and adaptable to the specific needs of different devices and tasks. Finally, periodically acquiring the latest vulnerability information, attack patterns, and threat landscape from external security information sources and comparing the internal adjustment results with external security landscape information, triggering alarms when contradictions exist, enables the system to promptly detect potential defects in internal adjustments or changes in the external threat environment, thereby providing more comprehensive security situation awareness and early warning capabilities.

[0060] Through the above technical solution, this invention can significantly improve the reliability, security, and adaptability of the causal deviation threshold readjustment process. This solution not only ensures the integrity and credibility of the adjustment basis through multiple verification mechanisms, but also avoids potential negative impacts through pre-simulation evaluation, and, combined with external security posture information, enables the threshold adjustment to better cope with evolving network threats. Therefore, the system can more accurately and promptly identify abnormal behavior of critical IoT devices, effectively reducing false alarms and false negatives, thereby comprehensively improving the overall effectiveness of IoT security risk assessment and access control.

[0061] In some preferred embodiments, a specific example is given below. Assume a smart factory environment with a critical IoT device—an industrial robot—responsible for high-precision assembly tasks. First, to ensure the integrity of the cross-validation rules and their input data used to evaluate the reliability of the robot's self-test results, the system establishes encrypted verification benchmarks for these rule files and data acquisition configuration parameters, such as calculating their SHA-256 hash values. The system periodically (e.g., hourly) recalculates the hash values ​​of these files and compares them with preset encrypted verification benchmarks to ensure they have not been tampered with. Second, to provide independent external verification, the system deploys an independent security audit probe. This probe bypasses the Ethernet communication between the industrial robot and the production line controller, periodically collecting raw samples of external behavior verification data generated when the robot executes self-test commands, and independently performing protocol parsing and verification. For example, the probe verifies whether the control commands issued by the robot are as expected and whether its response data is within the normal range. Based on the internal verification results and the verification results of the independent audit probe, the system comprehensively evaluates the integrity of the cross-validation rules and their input data. Furthermore, before each planned readjustment of the causal deviation threshold for industrial robots, the system utilizes a historical anomaly database (e.g., known attacks or malfunctions of robots in the past year) to simulate the impact of the adjustment on the recognition rate of historical anomalies. If the simulation results show that the adjusted threshold leads to a significant decrease in the recognition rate of certain known attack patterns, the adjustment plan will be re-evaluated. Simultaneously, the system dynamically adjusts the step size and frequency of the causal deviation threshold during readjustment based on the type of industrial robot (e.g., high-precision assembly robot), the importance of the task (e.g., core production processes), and the frequency and type of historical anomalies. For example, for robots in core production processes, a smaller adjustment step size and a higher adjustment frequency may be used to ensure higher security sensitivity. Finally, the system comprehensively considers the reliability of the self-test results of key IoT devices, the integrity of cross-validation rules and their input data, the simulation impact results, and the adjusted step size and frequency to readjust the causal deviation threshold. In addition, the system periodically obtains the latest vulnerability information, attack patterns, and threat posture from external security information sources (e.g., industrial control system security vulnerability databases, threat intelligence platforms) to obtain external security posture information. If the result of readjusting the causal deviation threshold (e.g., the threshold is relaxed) contradicts external security situation information (e.g., a new type of attack against this type of robot has been recently discovered to be active), the system will immediately trigger an alarm, prompting the security administrator that there may be unidentified threats or improper internal adjustments, requiring manual intervention and further analysis.

[0062] This invention further proposes that when it is determined that the current behavior of a critical IoT device belongs to an abnormal causal path, and the current behavior of the critical IoT device is inconsistent with its functional responsibilities and current task context, the method also includes the following steps: Send permission adjustment instructions to dynamically modify the network access control list of the port where the critical IoT device is located, so as to downgrade the access permission of the critical IoT device to the lowest level. The lowest level refers to the permission level that only allows the critical IoT device to communicate securely with the security management platform. Send a network isolation command to remove the network port or virtual LAN where the critical IoT device is located from the production network and assign it to a preset isolated virtual LAN. The isolated virtual LAN only allows the critical IoT device to communicate with the security audit server. Send security alert information to the security management platform.

[0063] Specifically, sending permission adjustment commands refers to the security management platform or automated security policy engine sending control commands to network devices (such as switches, routers, or firewalls) to update the network access control lists associated with the network ports connected to critical IoT devices. This access control list is dynamically modified to restrict the network communication capabilities of critical IoT devices, downgrading their access permissions to the lowest level. The lowest level can be understood as a strictly restricted permission state. In this state, critical IoT devices are only allowed to perform necessary secure communication with the pre-set security management platform, such as sending heartbeats, receiving security policy updates, or uploading log information. This ensures that the devices can still be monitored and managed under controlled conditions, while simultaneously cutting off potential malicious interactions with other resources in the production network.

[0064] Sending a network isolation command can be understood as a further threat containment measure. This command, issued by the security management platform or network controller, instructs the network infrastructure (such as a smart switch or SDN controller) to logically or physically remove the physical network port or logical VLAN of the critical IoT device from the normal production network. The device is then reassigned to a pre-defined isolated VLAN. An isolated VLAN is a network area specifically designed to handle anomalous or infected devices. Its network policy is strictly configured to allow only critical IoT devices to communicate with the security audit server. Its purpose is to completely sever any potential threat propagation paths between anomalous devices and the production environment, while allowing security personnel to conduct in-depth forensic analysis and security audits of the devices.

[0065] In practical applications, sending a security alert to the security management platform means that after the aforementioned permission adjustments and network isolation measures are implemented, the system will automatically generate and send a detailed alert notification to the security management platform. This alert is intended to promptly notify security operations personnel so that they can respond quickly and initiate manual intervention procedures. The alert typically includes key information such as the identifier of the abnormal device, the type of abnormal behavior detected, the timestamp that triggered the alert, and the automated response measures already taken, ensuring that the security team has a comprehensive understanding of the event's context.

[0066] This invention addresses the limitations of existing solutions that lack timely and automated response mechanisms after detecting serious security risks. Specifically, by immediately implementing measures such as permission adjustment, network isolation, and alarm notifications when a critical IoT device exhibits an abnormal causal path and its behavior is inconsistent with its functional responsibilities and task context, the solution effectively overcomes these limitations. Sending permission adjustment commands quickly restricts the network activity of abnormal devices, minimizing their potential malicious impact and preventing further access to or damage to other critical resources. Furthermore, sending network isolation commands completely isolates the device from the production network, cutting off the threat propagation path, ensuring the overall security of the production environment, and providing a controlled environment for subsequent security analysis and handling. Simultaneously, sending security alarm information to the security management platform ensures that security operations personnel can be promptly informed and intervene, thus forming a closed-loop security management process from detection to response, significantly improving the resilience and security of the IoT system.

[0067] Through the above technical solution, this invention enables rapid response and effective containment of abnormal behavior in critical IoT devices. When an abnormal causal path is detected and the behavior is inconsistent with functional responsibilities and task context, immediate permission downgrading and network isolation measures are taken, minimizing the impact and damage of potential security threats on the entire IoT system. This not only effectively prevents the further spread of malicious behavior and protects critical data and system resources, but also buys valuable response time for the security team to conduct in-depth incident investigations and recovery. Furthermore, real-time security alerts ensure the transparency and traceability of incidents, significantly improving the response efficiency and management level of IoT security incidents, thereby providing more robust security protection for critical IoT devices.

[0068] In some preferred embodiments, a specific example is given below. Suppose that in a smart manufacturing plant, a critical IoT device (e.g., a PLC controller for controlling a robotic arm on a production line) is detected to have significantly deviated communication behavior parameters from a behavioral pattern baseline during the execution of its authorized tasks. Further causal path determination reveals a severe causal deviation between its internal state changes and the expected external functional performance of the received operational command sequence. For example, the PLC controller receives a "start robotic arm" command, but its internal state shows the robotic arm operating at an unexpected high speed and sending abnormal control signals. Simultaneously, the system determines that this behavior is inconsistent with its preset "robotic arm control" function and "normal production" task context. At this point, the solution of this invention will immediately activate a response mechanism. First, the safety management platform sends a permission adjustment command to the network switch connected to the PLC controller. This command dynamically modifies the network access control list of the switch port, downgrading the PLC controller's access permissions to the lowest level, enabling it to only communicate securely with the safety management platform (e.g., sending logs and receiving diagnostic commands), but preventing it from communicating with other devices on the production line or external servers. Following this, the system sends a network isolation command. This command logically removes the network port where the PLC controller resides, or its associated virtual local area network (VLAN), from the factory's production network and assigns it to a pre-defined isolated VLAN. Within this isolated VLAN, the PLC controller is only permitted to communicate with the security audit server, allowing security experts to remotely diagnose and analyze it for forensically without further impacting normal production operations or spreading potential threats. Simultaneously, a detailed security alarm is immediately sent to the factory's security management platform, notifying security personnel that the PLC controller has experienced a causal path anomaly and has been automatically downgraded and isolated. The alarm includes the PLC controller's unique identifier, a detailed description of the abnormal behavior, the time of occurrence, and the automated response measures taken, enabling the security team to quickly intervene, assess the risk, and develop subsequent manual intervention and recovery plans. Through these measures, potential malicious control or production disruption risks are rapidly contained, ensuring the stability and security of the factory's production environment.

[0069] This invention further proposes that security alarm information include the identification of key IoT devices, details of abnormal behavior, timestamps, and detailed source tracing information corresponding to abnormal causal paths.

[0070] Specifically, the identifier of a critical IoT device refers to a unique code or name used to uniquely identify the IoT device exhibiting anomalous behavior, such as the device's serial number, MAC address, IP address, or logical name registered in the security management platform. The purpose of this identifier is to quickly locate and identify specific affected devices. Anomalous behavior details refer to a detailed description of the anomalous behavior occurring on the device, which may include, but is not limited to, the source and destination addresses of anomalous communication, communication ports, protocol types, data payload content summaries, anomalous operation instructions, and anomalous state changes. These details help security analysts understand the nature and scope of the anomalous behavior. A timestamp refers to the precise point in time when an anomalous event occurs or is detected, usually expressed in a uniform time format (such as UTC time). The purpose of a timestamp is to provide the temporal context of the event, facilitating the sequencing, correlation, and tracing of events. Detailed tracing information corresponding to causal path anomalies refers to the logical chain and related data discovered during the causal path determination process that led to the anomaly. This can include the sequence of operation instructions that caused the causal deviation, anomalous changes in the internal state of the critical IoT device, differences between expected and actual observations, and specific causal relationship entries involved in the causal logic mapping table. This tracing information aims to reveal the underlying causes and development paths of the anomalous behavior.

[0071] The solution of this invention includes the identifier of key IoT devices, details of abnormal behavior, timestamps, and detailed tracing information corresponding to the abnormal causal path in security alarm information. This enables the security management platform to immediately obtain comprehensive and in-depth information about the abnormal event upon receiving the alarm. The identifier of key IoT devices ensures that the alarm accurately points to the affected device; the details of abnormal behavior provide the superficial characteristics of the event, which helps to initially determine the type of threat; the timestamp provides a precise time coordinate of the event's occurrence, facilitating correlation analysis; and the detailed tracing information corresponding to the abnormal causal path reveals the internal logic and root cause of the abnormal behavior, which is crucial for understanding attack intent, assessing potential impact, and developing effective response strategies.

[0072] refer to Figure 2 The present invention also proposes an Internet of Things (IoT) security risk assessment and access control system for implementing the above-mentioned IoT security risk assessment and access control method. The system includes: The acquisition module acquires the device's functional responsibility information and the device's operational scope information under different task states. The functional responsibility information includes the device type and a list of core functions corresponding to the device type. The module is established to collect communication data of the device during the execution of authorized tasks, and establishes a behavior pattern benchmark of the device under the corresponding task based on functional responsibility information and operation scope information. The behavior pattern benchmark is a set of normal behavior patterns established based on the compliant communication data of the device under the corresponding task. The processing module acquires the device's current communication data in real time, extracts communication behavior parameters from it, and compares the communication behavior parameters with the behavior pattern benchmark to determine the degree of behavior deviation. The judgment module determines whether the device's current behavior is consistent with its functional responsibilities and current task context when the degree of deviation from the preset conditions is reached, based on the preset functional responsibility information and task context rules. The task context rules refer to the judgment rules that are pre-configured for the target resources that the device is allowed to access, the types of operations that are allowed to be performed, and the order of operations that are allowed in different task states. Adjust the module and, based on the judgment results, adjust the device's access permissions.

[0073] Specifically, the acquisition module is responsible for collecting basic security context information from IoT devices. The functional responsibility information acquired by this module defines the device's expected role and core functions; for example, the core function of a smart camera is video capture and transmission. Simultaneously, this module also acquires information about the device's operational scope in different task states. For instance, in the "monitoring" task state, the smart camera is allowed to transmit data to a video server, but in the "configuration" task state, it is allowed to communicate with a management terminal. This information provides the foundational data for subsequent behavior pattern establishment and anomaly detection.

[0074] The establishment module, based on information provided by the acquisition module, learns and constructs a baseline of the device's normal behavior patterns by observing communication data during authorized tasks. For example, for the aforementioned smart camera, under normal monitoring tasks, its communication frequency, data packet size, and protocol type with the video server are recorded and form a behavioral pattern baseline. This baseline represents the set of compliant communication behaviors of the device under a specific task and is an important reference for identifying abnormal behavior.

[0075] The processing module continuously monitors the real-time communication data of IoT devices. This module extracts key communication behavior parameters from the real-time data, such as source / destination IP address, port, protocol type, data payload length, and command words. These extracted parameters are then compared with a behavior pattern benchmark constructed by the setup module. This comparison quantifies the degree of deviation between the device's current behavior and its normal behavior pattern.

[0076] The judgment module is triggered when the degree of behavioral deviation reaches a preset threshold. This module combines the functional responsibility information provided by the acquisition module with pre-configured task context rules to conduct an in-depth analysis of the device's current behavior. The task context rules specify in detail the resources that the device is allowed to access, the types of operations that can be performed, and the order of operations under a specific task. In this way, even if behavioral deviations exist, the system can determine whether the deviation still conforms to the device's responsibilities and the legal requirements of the current task, thereby avoiding false alarms.

[0077] Based on the analysis results from the judgment module, the adjustment module dynamically adjusts the device's access permissions. If the judgment result indicates that the device's current behavior is inconsistent with its functional responsibilities or current task context, the module will take corresponding permission adjustment measures, such as restricting the device's network access capabilities, isolating it in a specific security area, or completely blocking its communication with certain resources, in order to effectively curb potential security threats.

[0078] This invention's system modularizes each step of the IoT security risk assessment and access control method, enabling continuous monitoring and dynamic management of IoT device behavior. The acquisition module establishes a static security profile of device behavior, providing foundational data for subsequent behavior benchmark establishment and deviation judgment. The benchmark establishment module learns compliant behaviors to construct a dynamic behavior pattern benchmark, enabling the system to identify abnormal behaviors. The processing module compares device behavior with the benchmark in real time, quantifying the degree of deviation. When a deviation is detected, the judgment module further performs in-depth analysis based on the device's responsibilities and task context to avoid misjudgments. Finally, the adjustment module precisely adjusts the device's access permissions based on the judgment results, effectively addressing potential security threats.

[0079] The content disclosed above is only a preferred and feasible embodiment of the present invention, and is not intended to limit the scope of protection of the present invention. Therefore, all equivalent technical changes made based on the content of the present invention specification and drawings are included within the scope of protection of the present invention. Furthermore, the elements therein can be updated as technology develops.

Claims

1. A method for IoT security risk assessment and access control, characterized in that, The method includes the following steps: Obtain the functional responsibility information of the device and the operating range information of the device in different task states. The functional responsibility information includes the device type and the core function list corresponding to the device type. Collect communication data of the device during the execution of authorized tasks, and establish a behavioral pattern benchmark of the device under the corresponding task based on functional responsibility information and operation scope information. The behavioral pattern benchmark is a set of normal behavioral patterns established based on the compliant communication data of the device under the corresponding task. The device acquires current communication data in real time, extracts communication behavior parameters from it, and compares the communication behavior parameters with the behavior pattern benchmark to determine the degree of behavior deviation. When the degree of behavioral deviation reaches the preset conditions, the device’s current behavior is determined to be consistent with its functional responsibilities and current task context based on the preset functional responsibility information and task context rules. The task context rules refer to the pre-configured judgment rules for the target resources that the device is allowed to access, the types of operations that are allowed to be performed, and the order of operations that are allowed in different task states. Adjust the device's access permissions based on the assessment results; After the degree of behavioral deviation reaches a preset condition, and when the device is a critical IoT device, the method further includes performing causal path determination on the critical IoT device. The steps of causal path determination include: Establish a causal logic mapping table for key IoT devices. The causal logic mapping table records the causal relationship between the operation instructions of key IoT devices, the internal state of key IoT devices and expected changes in internal state, and expected external functional performance. The internal state of key IoT devices refers to the internal hardware and software working conditions and internal parameter state of key IoT devices at the current operating moment. The expected external functional performance refers to the functional output result or business execution result presented to the outside world after the key IoT devices perform the corresponding operation. Real-time acquisition of operation command sequences and internal status information of key IoT devices; Based on the real-time operation command sequence of key IoT devices and the internal state information of key IoT devices, the matching causal relationship path is searched in the causal logic mapping table to infer the expected result of the corresponding operation. The expected results are compared with the actual observed internal state changes and external functional performance of key IoT devices to determine the degree of causal deviation. The degree of causal deviation is an indicator that quantifies the magnitude of the deviation of the actual observed internal state changes and external functional performance from the expected results. When the degree of causal deviation exceeds the preset causal deviation threshold, the current behavior of the key IoT device is determined to be abnormal in the causal relationship path. The causal relationship path determination results are combined with preset functional responsibility information and task context rules as the basis for judging whether the current behavior of key IoT devices is consistent with their functional responsibilities and current task context.

2. The IoT security risk assessment and access control method as described in claim 1, characterized in that, When the degree of causal deviation exceeds a preset causal deviation threshold, the steps to determine that the current behavior of a critical IoT device belongs to an abnormal causal path include: Continuously monitor historical data on the degree of causal deviation, and dynamically adjust the causal deviation threshold based on the type of key IoT device, the uptime of key IoT devices, and environmental parameters; When the degree of causal deviation fluctuates within the preset range of the dynamically adjusted causal deviation threshold, the causal deviation threshold is readjusted again based on the reliability of the self-inspection results of key IoT devices. When the degree of causal deviation exceeds the final adjusted causal deviation threshold, the current behavior of the critical IoT device is determined to be an abnormal causal path.

3. The IoT security risk assessment and access control method as described in claim 2, characterized in that, The steps for readjusting the causal deviation threshold based on the reliability of the self-test results of key IoT devices include: Obtain the self-inspection results of key IoT devices, where the self-inspection results refer to the result information used to characterize the internal operating status of key IoT devices; Acquire external behavior verification data of key IoT devices, where external behavior verification data refers to data used to externally verify the self-test results; According to the preset cross-validation rules, the self-test results and external behavior verification data are cross-compare. Based on the cross-comparison results, assess the reliability of the self-test results of key IoT devices; The causal deviation threshold is readjusted based on the reliability of the self-inspection results of key IoT devices.

4. The IoT security risk assessment and access control method as described in claim 3, characterized in that, The steps to obtain self-test results for critical IoT devices include: Send self-test instructions to critical IoT devices, including instructions to run a self-test program or to start a self-test sequence. During the execution of self-test commands by critical IoT devices, the internal status information of the critical IoT devices is acquired in real time. Based on the self-test instructions and the internal status information of the key IoT devices, determine the self-test results of the key IoT devices.

5. The IoT security risk assessment and access control method as described in claim 4, characterized in that, The steps for obtaining external behavior verification data for critical IoT devices include: During the execution of self-test commands by critical IoT devices, communication data between critical IoT devices and external devices is collected in real time, and the protocol is parsed and features are extracted. The features include communication target address, communication port, protocol type, data payload length, and command word or function code. Real-time acquisition of the external functional performance of key IoT devices after executing self-test commands; Based on the extracted features and the external functional performance of key IoT devices after executing self-test commands, external behavior verification data of key IoT devices are formed.

6. The IoT security risk assessment and access control method as described in claim 3, characterized in that, The steps for readjusting the causal deviation threshold based on the reliability of the self-test results of key IoT devices include: Based on the cross-validation rules and their input data, an encryption verification benchmark is established, whereby the encryption verification benchmark refers to the encrypted digest value or digital signature benchmark used for integrity comparison. The cross-validation rules file and the configuration parameters used to collect input data are periodically compared with the encryption verification benchmark to obtain the verification results. Deploy independent security audit probes. These probes periodically collect raw samples of external behavior verification data through bypass listening or dedicated security interfaces, and independently verify them to obtain independent verification results. Based on the verification results and independent verification results, evaluate the completeness of the cross-validation rules and their input data; Before each adjustment of the causal deviation threshold, the impact of the adjustment on the historical anomaly event identification rate is simulated to obtain the simulation impact results. The historical anomaly event identification rate refers to the proportion of historical anomaly events correctly identified as anomalies in the sample. Based on the key IoT device types, the importance of the task, and the frequency and type of historical anomalies, the step size and frequency corresponding to the causal deviation threshold are dynamically adjusted when it is adjusted again, so as to obtain the adjusted step size and frequency. The causal deviation threshold is adjusted again based on the reliability of the self-inspection results of key IoT devices, the cross-validation rules and the completeness of their input data, the simulation impact results, and the adjusted step size and frequency. Periodically obtain the latest vulnerability information, attack patterns and threat landscape from external security information sources to obtain external security landscape information; An alarm is triggered when the result of readjusting the causal deviation threshold contradicts external security situation information.

7. The IoT security risk assessment and access control method as described in claim 1, characterized in that, When it is determined that the current behavior of a critical IoT device belongs to an abnormal causal path, and the current behavior of the critical IoT device is inconsistent with its functional responsibilities and current task context, the method further includes the following steps: Send permission adjustment instructions to dynamically modify the network access control list of the port where the critical IoT device is located, so as to downgrade the access permission of the critical IoT device to the lowest level. The lowest level refers to the permission level that only allows the critical IoT device to communicate securely with the security management platform. Send a network isolation command to remove the network port or virtual LAN where the critical IoT device is located from the production network and assign it to a preset isolated virtual LAN. The isolated virtual LAN only allows the critical IoT device to communicate with the security audit server. Send security alert information to the security management platform.

8. The IoT security risk assessment and access control method as described in claim 7, characterized in that, Security alert information includes the identifier of critical IoT devices, details of abnormal behavior, timestamps, and detailed source tracing information corresponding to abnormal causal paths.

9. An Internet of Things (IoT) security risk assessment and access control system, employing the IoT security risk assessment and access control method as described in claim 1, characterized in that, The system includes: The acquisition module acquires the device's functional responsibility information and the device's operational scope information under different task states. The functional responsibility information includes the device type and a list of core functions corresponding to the device type. The module is established to collect communication data of the device during the execution of authorized tasks, and establishes a behavior pattern benchmark of the device under the corresponding task based on functional responsibility information and operation scope information. The behavior pattern benchmark is a set of normal behavior patterns established based on the compliant communication data of the device under the corresponding task. The processing module acquires the device's current communication data in real time, extracts communication behavior parameters from it, and compares the communication behavior parameters with the behavior pattern benchmark to determine the degree of behavior deviation. The judgment module determines whether the device's current behavior is consistent with its functional responsibilities and current task context when the degree of deviation from the preset conditions is reached, based on the preset functional responsibility information and task context rules. The task context rules refer to the judgment rules that are pre-configured for the target resources that the device is allowed to access, the types of operations that are allowed to be performed, and the order of operations that are allowed in different task states. Adjust the module and, based on the judgment results, adjust the device's access permissions.

Images