A method and system for early ransomware behavior identification based on the Internet of Things

Abstract

This invention relates to the field of IoT security and malware detection technology, and particularly to a method and system for early ransomware behavior identification based on IoT. The method includes the following steps: S1: Collecting IoT data and constructing IoT time-series data for various event types in chronological order; S2: Performing correlation analysis and clustering on the IoT time-series data to obtain its own cluster and specific clusters; S3: Determining the correlation feature range corresponding to normal behavior based on its own cluster and comparing it with the correlation feature range of specific clusters to obtain the comparison result. This invention utilizes the weak correlation and low fluctuation characteristics of IoT data, and through the construction of a time-series baseline, cluster evolution analysis, and operation log verification, accurately identifies disguised ransomware behavior, effectively reduces false alarms, and improves the accuracy and robustness of early detection.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security and malware detection technology, and in particular to a method and system for early behavior identification of ransomware based on the Internet of Things. Background Technology

[0002] As a critical infrastructure connecting the physical world and information systems, the Internet of Things (IoT) has its terminal devices widely deployed in industrial control and smart home scenarios. Ransomware attacks have intensified in recent years, with attackers exploiting the resource constraints and weak security of IoT devices to extort money by encrypting files or causing service disruptions. Early ransomware behaviors include preparatory actions such as file traversal, data reading, and backup / deletion, which are difficult to distinguish from normal system maintenance operations using traditional detection methods. Existing technologies primarily employ signature-based matching methods and rule-based anomaly detection, which can identify known ransomware in specific scenarios, providing a certain level of protection for IoT security.

[0003] However, existing methods have significant limitations when dealing with the inherent characteristics of IoT data. IoT data often exhibits low volatility and weak correlation between multiple data sources, while early ransomware behavior can trigger subtle changes in data access patterns. Signature-based detection cannot handle unknown variants, while rule-based detection is prone to misclassifying normal system maintenance, such as data compression and archiving, as malicious activity, resulting in a high false positive rate. Furthermore, the limited resources of IoT devices make it difficult to deploy complex real-time analysis models, further increasing the difficulty of early behavior identification.

[0004] Therefore, there is an urgent need to research a ransomware early behavior identification method that can make full use of the characteristics of IoT data to distinguish between malicious behavior and normal operation, thereby improving detection accuracy, reducing false alarms, and ensuring the security of IoT systems. Summary of the Invention

[0005] To overcome the high false positive rate of early ransomware behavior, this invention provides a method and system for identifying early ransomware behavior based on the Internet of Things.

[0006] The technical implementation scheme of the present invention is: a method for early behavior identification of ransomware based on the Internet of Things, comprising the following steps: S1: Collect IoT data and construct IoT time-series data for each event type in chronological order; S2: Perform correlation analysis and clustering on IoT time-series data to obtain its own cluster and specific clusters; S3: Determine the range of correlation features corresponding to normal behavior based on its own cluster and compare it with the range of correlation features of a specific cluster to obtain the comparison results; S4: Based on the comparison results, continuously track the update and merging process of specific clusters and calculate the overlap degree. Based on the overlap degree, identify suspected evolutionary clusters and determine the early behavior of ransomware based on the suspected evolutionary clusters. S5: Corrects early ransomware behavior based on the volatility of IoT data, obtaining corrected early ransomware behavior.

[0007] Preferably, the step of collecting IoT data and constructing IoT time-series data for each event type in chronological order includes: Calculate the correlation of IoT time-series data based on Pearson correlation coefficient; The volatility of IoT time-series data is calculated based on the standard deviation of the sliding window.

[0008] Preferably, the step of performing correlation analysis and clustering on IoT time-series data to obtain its own cluster and specific clusters includes: If the correlation between IoT time-series data is stable within a preset long time window, then the corresponding IoT time-series data pair will be used as its own correlation data pair. IoT time-series data other than its own correlated data pairs are treated as irrelevant time-series data. If irrelevant time-series data shows correlation within a preset short time window, then IoT time-series data pairs with correlation are treated as specific correlated data pairs. Extract time series segments from the IoT time series data in the data pairs with their own correlations, and cluster the time series segments to obtain their own clusters; Extract a preset short time window from the IoT time series data of specific correlation data pairs, and cluster the preset short time window to obtain specific clusters.

[0009] Preferably, the step of determining the range of correlation features corresponding to normal behavior based on its own cluster and comparing it with the range of correlation features of a specific cluster to obtain a comparison result includes: The minimum baseline for normal behavior is determined based on the density distribution of its own clusters. The minimum baseline refers to the range of correlation characteristics corresponding to the core region with the highest density in its own clusters. The maximum baseline for normal behavior is determined based on the boundary of its own cluster. The maximum baseline refers to the range of correlation features corresponding to the farthest boundary of its own cluster in the feature space. During real-time detection, the correlation feature range of each newly generated specific cluster when it first appears is recorded, and the correlation feature range is compared with the minimum baseline and maximum baseline of normal behavior. The initial position state of the specific cluster relative to the baseline is marked. The initial position state includes being completely within the minimum baseline, between the minimum baseline and the maximum baseline, and completely outside the maximum baseline.

[0010] Preferably, the step of continuously tracking the update and merging process of specific clusters based on comparison results and calculating the overlap degree includes: When new IoT time-series data is added to an existing specific cluster, or when two or more specific clusters are merged, the correlation feature range of the updated or merged specific cluster is recalculated, and the position status of the specific cluster relative to the baseline is updated. Calculate the overlap between the merged specific cluster and each of the original specific clusters involved in the merger; the overlap is quantified using the Jaccard similarity coefficient, which is equal to the intersection size of the merged specific cluster and the original specific cluster in the correlation feature space divided by the union size.

[0011] Preferably, the step of determining suspected evolutionary clusters based on overlap and determining early ransomware behavior based on suspected evolutionary clusters includes: If the position of a specific cluster relative to the baseline changes from being completely outside the maximum baseline to being between the minimum baseline and the maximum baseline or completely within the minimum baseline, and the overlap between the merged specific cluster and at least one original specific cluster is greater than a preset overlap threshold, then the merged specific cluster is marked as a suspected evolutionary cluster. Obtain access logs of IoT time-series data corresponding to suspected evolutionary clusters. If an operation pattern exists in the access logs, then the specific correlation event corresponding to the suspected evolutionary cluster is determined to be early ransomware behavior. The operation pattern refers to the operation characteristic of simultaneously accessing multiple IoT time-series data that do not have their own correlation. The relevance features of specific related events identified as early-stage ransomware behaviors will be included in the ransomware behavior feature library for pattern matching and early warning in subsequent real-time detection.

[0012] Preferably, the modification of early ransomware behavior based on the volatility of IoT data to obtain modified early ransomware behavior includes: Obtain a preset short time window corresponding to a specific related event that is determined to be an early behavior of ransomware, and use the preset short time window as the time window to be corrected; Obtain all self-correlated data pairs within the time window to be corrected; For each self-correlated data pair, the sliding correlation sequence is calculated using the sliding Pearson correlation coefficient within the time window to be corrected, wherein the length of the sliding window is less than a preset short time window; The calculation results of each sliding window in the sliding correlation sequence are compared with the minimum baseline and maximum baseline of normal behavior.

[0013] Preferably, comparing the calculation result of each sliding window in the sliding correlation sequence with the minimum baseline and maximum baseline of normal behavior includes: If the calculation result is lower than the minimum baseline or exceeds the maximum baseline, it is determined as an associated disconnection event, and the disconnection start time and disconnection end time are recorded. If, after a disconnection event occurs, the calculation result of the subsequent sliding window returns to between the minimum and maximum baselines, it is considered a disconnection recovery event. The total number of events in which the correlation between data pairs was broken and then restored within the time window to be corrected is counted. The ratio of the total number of events to the total number of data pairs in the time window to be corrected is calculated to obtain the proportion of break-and-restore events. The percentage of disconnection recovery events is compared with a preset disconnection recovery threshold.

[0014] Preferably, comparing the proportion of disconnection recovery events with a preset disconnection recovery threshold includes: If the proportion of disconnection and recovery events is greater than the preset disconnection and recovery threshold, it is determined that the early ransomware behavior is a misjudgment caused by system resource occupation, and the early ransomware behavior is removed from the judgment result. If the proportion of disconnection and recovery events is less than or equal to the preset disconnection and recovery threshold, the determination result of the early ransomware behavior is maintained, and the correlation characteristics and volatility characteristics corresponding to the early ransomware behavior are jointly included in the ransomware behavior feature library.

[0015] Preferably, an Internet of Things-based ransomware early behavior identification system includes: The IoT data acquisition and feature calculation module is used to collect IoT data to construct time-series data and calculate correlation and volatility. The correlation clustering and baseline construction module is used to identify self-correlated data pairs and specific correlation data pairs and cluster them to obtain self-clusters and specific clusters. Based on the self-clusters, the minimum and maximum baselines for normal behavior are determined. The evolution tracking and behavior determination module is used to track the updates and merges of specific clusters to calculate the overlap. Based on the overlap and access log operation patterns, it determines the early behavior of ransomware and incorporates it into the ransomware behavior feature library. The volatility correction and output module is used to correct the determination result of the proportion of disconnection and recovery events within the time window to be corrected based on its own correlation data, and output the early behavior of the ransomware after correction.

[0016] Beneficial Effects: This invention collects IoT data and constructs time-series data, calculates correlation and volatility, distinguishes between self-correlation and specific correlation, establishes minimum and maximum baselines for normal behavior, and achieves initial localization of abnormal patterns. It further tracks the update and merging process of specific clusters, quantifies overlap, and marks suspected evolving clusters. Combined with access log operation pattern verification, it accurately identifies early ransomware behaviors disguised as normal operations. Finally, based on volatility analysis of the proportion of disconnection and recovery events related to self-correlation, it effectively eliminates misjudgments caused by system resource consumption and incorporates trusted features into the ransomware behavior feature library. This invention fully utilizes the inherent characteristics of low volatility and weak correlation in IoT data, overcoming the shortcomings of traditional signature matching and rule detection in dealing with unknown variants and easily misjudging normal operation and maintenance as attacks. It significantly improves the accuracy and robustness of early ransomware behavior identification, providing efficient adaptive security protection capabilities for IoT systems. Attached Figure Description

[0017] Figure 1 This is a flowchart of an early ransomware behavior identification method based on the Internet of Things according to the present invention; Figure 2 This is a structural diagram of an Internet of Things-based early behavior recognition system for ransomware according to the present invention. Detailed Implementation

[0018] The present invention will now be described in detail with reference to specific embodiments. The illustrative embodiments and descriptions herein are used to explain the present invention, but are not intended to limit the present invention.

[0019] Example 1: A method for early ransomware behavior identification based on the Internet of Things, such as... Figure 1 As shown, it includes the following steps: S1: Collect IoT data and construct IoT time-series data for each event type in chronological order, including: Calculate the correlation of IoT time-series data based on Pearson correlation coefficient; The volatility of IoT time-series data is calculated based on the standard deviation of the sliding window.

[0020] It should be noted that IoT data is collected from sensor terminals, gateway devices, and cloud databases deployed in industrial control and smart home scenarios; event types refer to physical or system activity categories that trigger data recording, such as temperature changes, equipment switching, and network connections; constructing IoT time-series data in chronological order can preserve the logical sequence of events, providing an orderly data foundation for subsequent correlation and fluctuation analysis; taking a factory environment as an example, temperature sensors report values ​​once per minute to form temperature time-series data, and pressure sensors record synchronously to form pressure time-series data.

[0021] S2: Perform correlation analysis and clustering on IoT time-series data to obtain its own clusters and specific clusters, including: If the correlation between IoT time-series data is stable within a preset long time window, then the corresponding IoT time-series data pair will be used as its own correlation data pair. IoT time-series data other than its own correlated data pairs are treated as irrelevant time-series data. If irrelevant time-series data shows correlation within a preset short time window, then IoT time-series data pairs with correlation are treated as specific correlated data pairs. Extract time series segments from the IoT time series data in the data pairs with their own correlations, and cluster the time series segments to obtain their own clusters; Extract a preset short time window from the IoT time series data of specific correlation data pairs, and cluster the preset short time window to obtain specific clusters.

[0022] It should be noted that the preset long window is set based on the sampling frequency of IoT data and the cycle of physical process changes. For example, for temperature data, a 24-hour window is used. The historical data is traversed using a sliding window method. The mean and standard deviation of the Pearson correlation coefficient of each IoT time series data pair within the window are calculated. If the standard deviation is lower than the preset stability threshold, the correlation is determined to be stable, and the IoT time series data pair is taken as its own correlation data pair. The self-correlation data pair represents the normal physical relationship, such as the negative correlation between temperature and humidity, which constitutes the normal behavior benchmark. The preset short time window is set to the second to minute level according to the duration of the ransomware attack. For example, a 300-second window is used to capture the correlation of irrelevant time series data in the temporary performance of abnormal events. IoT time series data other than its own correlated data pairs are regarded as irrelevant time series data. If the absolute value of the Pearson correlation coefficient calculated within the preset short time window of irrelevant time series data is higher than the preset correlation threshold, then the IoT time series data pairs with correlation are regarded as specific correlated data pairs. Such data pairs indicate potential abnormal events, such as a fire causing a temporary synchronous response of temperature and smoke sensors. A time series segment refers to a continuous data sequence within a time range corresponding to a pair of data with which it is correlated. Density clustering algorithm is used to cluster time series segments to obtain self-clusters, which reflect different categories of normal correlation patterns, such as negative correlation between temperature and humidity and positive correlation between pressure and flow. Density clustering algorithm is also used to cluster preset short time windows to obtain specific clusters, which represent different types of abnormal events, such as fires and equipment failures. To ensure that the clustering results are not affected by different physical dimensions, the time series segments need to be normalized before clustering, for example, by using the Z-score standardization method to make the mean of each feature sequence 0 and the variance 1. The length of the preset long time window and short time window is determined statistically based on the data sampling frequency and the typical duration of the attack behavior. For example, the long time window is 24 hours to cover the entire period, and the short time window is 5 minutes to match the duration of the early probing behavior of ransomware. The preset stability threshold and preset association threshold are set by analyzing the distribution of historical normal data. For example, the stability threshold is set to the 95th quantile of the standard deviation of the Pearson correlation coefficient within the long time window, and the association threshold is set to the lower limit of the 99% confidence interval of the distribution of the absolute value of the correlation coefficient of normal data.

[0023] S3: Determine the range of correlation features corresponding to normal behavior based on its own cluster and compare it with the range of correlation features of a specific cluster to obtain the comparison results, including: The minimum baseline for normal behavior is determined based on the density distribution of its own clusters. The minimum baseline refers to the range of correlation characteristics corresponding to the core region with the highest density in its own clusters. The maximum baseline for normal behavior is determined based on the boundary of its own cluster. The maximum baseline refers to the range of correlation features corresponding to the farthest boundary of its own cluster in the feature space. During real-time detection, the correlation feature range of each newly generated specific cluster when it first appears is recorded, and the correlation feature range is compared with the minimum baseline and maximum baseline of normal behavior. The initial position state of the specific cluster relative to the baseline is marked. The initial position state includes being completely within the minimum baseline, between the minimum baseline and the maximum baseline, and completely outside the maximum baseline.

[0024] It should be noted that the core region with the highest density of its own clusters corresponds to the minimum baseline of the correlation characteristics. This region represents the most typical and most frequently occurring normal behavior pattern. Using this as a benchmark can strictly identify minor anomalies that deviate from the core. The furthest boundary of a self-cluster in the feature space corresponds to the maximum baseline. This boundary encompasses the maximum fluctuation range of normal behavior. Exceeding this range will inevitably result in an abnormal event. The range of correlation characteristics when a specific cluster first appears is quantified by calculating the feature vector boundary of all data points within the cluster. Recording the first appearance position helps to capture the original characteristics of the stage of anomaly generation and provides an initial reference for subsequent evolutionary analysis. The initial position status marker indicates the positional relationship of a specific cluster relative to the normal baseline. If it is completely within the minimum baseline, it means that the event highly matches the most typical normal behavior and is very likely a normal event. If it is between the minimum and maximum baselines, it means that the event is on the edge of normal fluctuation and needs to be further judged in combination with other features. If it is completely outside the maximum baseline, it means that the event deviates significantly from the normal range and has a high probability of being abnormal. Taking the factory environment as an example, the core area of ​​temperature and humidity clusters corresponds to the dense area of ​​negative correlation between temperature and humidity, and the boundary area corresponds to the extreme range of correlation. If a fire causes a temporary strong correlation between temperature and smoke sensors, forming a new specific cluster, and the cluster exceeds the boundary, it is directly judged as abnormal.

[0025] S4-1: Based on the comparison results, continuously track the update and merging process of specific clusters and calculate the overlap degree, including: When new IoT time-series data is added to an existing specific cluster, or when two or more specific clusters are merged, the correlation feature range of the updated or merged specific cluster is recalculated, and the position status of the specific cluster relative to the baseline is updated. Calculate the overlap between the merged specific cluster and each of the original specific clusters involved in the merger; the overlap is quantified using the Jaccard similarity coefficient, which is equal to the intersection size of the merged specific cluster and the original specific cluster in the correlation feature space divided by the union size.

[0026] It's important to note that updating a specific cluster means new anomalous data points are continuously added to the existing cluster, reflecting the continuation of the anomalous event over time. Merging, on the other hand, refers to the merging of multiple specific clusters with similar characteristics into a new cluster, representing the convergent evolution of different anomalous types in the feature space. Tracking the update and merging process essentially captures the dynamic trajectory of anomalous patterns from their emergence to development. This is because early ransomware behavior often manifests as gradual probing rather than sudden, isolated events; its characteristics gradually emerge and merge over time to form composite patterns. The range of correlated features after updating or merging is broader than the original cluster, covering the expanded feature space of the anomalous event. Recalculating this range and refreshing the location status allows observation of the anomalous pattern gradually migrating towards the baseline of normal behavior. A change in location status from outside the baseline to inside the baseline indicates that malicious behavior is attempting to... The camouflage blends into the normal operating background. The overlap between the merged specific cluster and each of the original specific clusters involved in the merger is quantified using the Jaccard similarity coefficient. This coefficient calculates the ratio of the intersection to the union of feature spaces, reflecting the degree of preservation of original feature components during the merger process. A high overlap indicates that the merged cluster and a certain original cluster have a high degree of overlap in feature space, indicating that the original feature dominates in the evolution. A low overlap indicates that the merged cluster and the original cluster have significant differences in features, indicating the formation of a new abnormal pattern different from the original type. Taking ransomware as an example, if the overlap between the file traversal abnormal cluster and the network connection abnormal cluster is as high as 0.9 with the original file traversal cluster, it is inferred that file traversal behavior dominates in the evolution. If the overlap with both is less than 0.3, it suggests the emergence of a new attack pattern that combines the features of both types but is essentially different.

[0027] S4-2: Identify suspected evolutionary clusters based on overlap, and determine early ransomware behaviors based on these clusters, including: If the position of a specific cluster relative to the baseline changes from being completely outside the maximum baseline to being between the minimum baseline and the maximum baseline or completely within the minimum baseline, and the overlap between the merged specific cluster and at least one original specific cluster is greater than a preset overlap threshold, then the merged specific cluster is marked as a suspected evolutionary cluster. Obtain access logs of IoT time-series data corresponding to suspected evolutionary clusters. If an operation pattern exists in the access logs, then the specific correlation event corresponding to the suspected evolutionary cluster is determined to be early ransomware behavior. The operation pattern refers to the operation characteristic of simultaneously accessing multiple IoT time-series data that do not have their own correlation. The relevance features of specific related events identified as early-stage ransomware behaviors will be included in the ransomware behavior feature library for pattern matching and early warning in subsequent real-time detection.

[0028] It should be noted that after merging, the position of a specific cluster relative to the baseline changes from outside the maximum baseline to between the minimum and maximum baselines or completely within the minimum baseline. This change indicates that the originally significantly abnormal pattern gradually approaches the normal range during the evolution process, and has the potential to disguise itself as normal behavior. At the same time, if the overlap between the merged cluster and at least one of the original specific clusters is higher than a preset threshold, it indicates that the dominant feature components of the original abnormality are retained during the evolution process, and it has not completely transformed into a completely new type. When both conditions are met, the merged cluster retains the abnormal nature while showing a trend of penetrating into normality, which is consistent with the attack logic of ransomware's early behavior of gradual probing and gradual disguise. Therefore, it is marked as a suspected evolutionary cluster. Access logs of IoT time-series data within the time window corresponding to suspected evolutionary clusters are obtained. Process identifiers, operation objects, and timestamps are extracted from the system layer. The access logs are used to reconstruct the specific behavioral details of data access. The operation mode is defined as the same process simultaneously accessing multiple IoT time-series data that have no inherent correlation within a short time window. For example, temperature and camera data have no inherent physical correlation, but they are read by the same process. This mode is highly consistent with the early behavior of ransomware traversing and scanning data files. The existence of this operation mode means that there is actual malicious operation behind the specific correlation at the statistical level. Therefore, it is judged as early behavior of ransomware. The correlation features corresponding to the judgment results are included in the ransomware behavior feature library. The correlation features specifically refer to the range of Pearson correlation coefficient, cluster center position and distance from the baseline of the event in the feature space. The feature library provides a matching benchmark for subsequent real-time detection and realizes rapid early warning of newly emerging similar patterns. The preset overlap threshold is determined based on the evolutionary patterns of historical anomalous events or through cross-validation. For example, an empirical value between 0.6 and 0.8 is used to ensure that the dominant features in the evolution can be identified while avoiding the misjudgment of noise as evolutionary behavior.

[0029] S5: Corrects early ransomware behavior based on the volatility of IoT data, obtaining corrected early ransomware behavior, including: Obtain a preset short time window corresponding to a specific related event that is determined to be an early behavior of ransomware, and use the preset short time window as the time window to be corrected; Obtain all self-correlated data pairs within the time window to be corrected; For each self-correlated data pair, the sliding correlation sequence is calculated using the sliding Pearson correlation coefficient within the time window to be corrected, wherein the length of the sliding window is less than a preset short time window; The calculation result of each sliding window in the sliding correlation sequence is compared with the minimum baseline and maximum baseline of normal behavior; If the calculation result is lower than the minimum baseline or exceeds the maximum baseline, it is determined as an associated disconnection event, and the disconnection start time and disconnection end time are recorded. If, after a disconnection event occurs, the calculation result of the subsequent sliding window returns to between the minimum and maximum baselines, it is considered a disconnection recovery event. The total number of events in which the correlation between data pairs was broken and then restored within the time window to be corrected is counted. The ratio of the total number of events to the total number of data pairs in the time window to be corrected is calculated to obtain the proportion of break-and-restore events. Compare the percentage of disconnection recovery events with a preset disconnection recovery threshold; If the proportion of disconnection and recovery events is greater than the preset disconnection and recovery threshold, it is determined that the early ransomware behavior is a misjudgment caused by system resource occupation, and the early ransomware behavior is removed from the judgment result. If the proportion of disconnection and recovery events is less than or equal to the preset disconnection and recovery threshold, the determination result of the early ransomware behavior is maintained, and the correlation characteristics and volatility characteristics corresponding to the early ransomware behavior are jointly included in the ransomware behavior feature library.

[0030] It should be noted that the time window to be corrected is used to lock in the time range that requires further verification. Limiting the verification scope to this window avoids introducing data interference from irrelevant periods, ensuring that the correction process focuses on the misjudged event itself. Acquiring all self-correlation data pairs within the time window to be corrected is used to confirm whether the originally stable physical correlations were disrupted during the suspected malicious activity. Self-correlation data pairs represent normal physical laws, such as the negative correlation between temperature and humidity. If ransomware consumes system resources, causing data collection delays or packet loss, these laws will be temporarily disrupted. Calculating the sliding correlation sequence is used to confirm the continuity of self-correlation within the time window to be corrected. During the continuous change process, the sliding correlation sequence is obtained by calculating the Pearson correlation coefficient point by point using a sliding window length smaller than a preset short time window. A smaller sliding window length can capture the microscopic details of correlation changes. For example, by calculating the temperature and humidity correlation coefficient point by point within a one-hour correction window using a 30-second sliding window, a brief decrease in correlation can be detected. When the calculation result of the sliding window is lower than the minimum baseline or higher than the maximum baseline, it indicates that the originally stable physical correlation has disappeared within a certain sub-period, and is therefore judged as a correlation break event. For example, the negative correlation between temperature and humidity briefly changes to no correlation or positive correlation. This phenomenon is caused by data anomalies due to system resource consumption. When a break event occurs... After the event, the calculation results of the subsequent sliding window returned to between the minimum and maximum baselines, indicating that the correlation stabilized after a brief disruption. Therefore, this was identified as a correlation recovery event, similar to how the temperature and humidity correlation returned to a negative correlation range after a break. An increased proportion of disconnection-recovery events indicates frequent recovery of the correlation data within the window to be corrected, reflecting drastic fluctuations in system resources and suggesting that early ransomware behavior was misjudged due to resource consumption. A decreased proportion of disconnection-recovery events indicates that the correlation remained relatively stable, resource consumption did not significantly interfere with data collection, and the original assessment as early ransomware behavior was highly credible. A preset disconnection-recovery threshold was used. Based on the statistical settings of the frequency of disconnections caused by fluctuations in system resource usage during normal operation, such as using the 95th percentile or dynamically adjusting according to the false alarm rate requirements; if the proportion of disconnection recovery events is greater than the preset disconnection recovery threshold, it is judged as a false judgment caused by system resource usage and the result is removed; if the proportion is less than or equal to the threshold, the original judgment is maintained and the Pearson correlation coefficient range, cluster center position and volatility characteristics corresponding to the event are included in the ransomware behavior feature library; this step effectively eliminates false positive events caused by system load fluctuations by quantifying the impact of resource usage on its own correlation, thereby solving the defect of traditional methods that misjudge equipment abnormalities as malicious behavior.

[0031] Example 2: Based on Example 1, an IoT-based early ransomware behavior identification system, such as... Figure 2 As shown, it includes: The IoT data acquisition and feature calculation module is used to collect IoT data to construct time-series data and calculate correlation and volatility. The correlation clustering and baseline construction module is used to identify self-correlated data pairs and specific correlation data pairs and cluster them to obtain self-clusters and specific clusters. Based on the self-clusters, the minimum and maximum baselines for normal behavior are determined. The evolution tracking and behavior determination module is used to track the updates and merges of specific clusters to calculate the overlap. Based on the overlap and access log operation patterns, it determines the early behavior of ransomware and incorporates it into the ransomware behavior feature library. The volatility correction and output module is used to correct the determination result of the proportion of disconnection and recovery events within the time window to be corrected based on its own correlation data, and output the early behavior of the ransomware after correction.

[0032] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for early behavior identification of ransomware based on the Internet of Things, characterized in that, Includes the following steps: S1: Collect IoT data and construct IoT time-series data for each event type in chronological order; S2: Perform correlation analysis and clustering on IoT time-series data to obtain its own cluster and specific clusters; S3: Determine the range of correlation features corresponding to normal behavior based on its own cluster and compare it with the range of correlation features of a specific cluster to obtain the comparison results; S4: Based on the comparison results, continuously track the update and merging process of specific clusters and calculate the overlap degree. Based on the overlap degree, identify suspected evolutionary clusters and determine the early behavior of ransomware based on the suspected evolutionary clusters. S5: Corrects early ransomware behavior based on the volatility of IoT data, obtaining corrected early ransomware behavior.

2. The method for early ransomware behavior identification based on the Internet of Things according to claim 1, characterized in that, The process of collecting IoT data and constructing IoT time-series data for each event type in chronological order includes: Calculate the correlation of IoT time-series data based on Pearson correlation coefficient; The volatility of IoT time-series data is calculated based on the standard deviation of the sliding window.

3. The method for early ransomware behavior identification based on the Internet of Things as described in claim 1, characterized in that, The process of performing correlation analysis and clustering on IoT time-series data to obtain its own clusters and specific clusters includes: If the correlation between IoT time-series data is stable within a preset long time window, then the corresponding IoT time-series data pair will be used as its own correlation data pair. IoT time-series data other than its own correlated data pairs are treated as irrelevant time-series data. If irrelevant time-series data shows correlation within a preset short time window, then IoT time-series data pairs with correlation are treated as specific correlated data pairs. Extract time series segments from the IoT time series data in the data pairs with their own correlations, and cluster the time series segments to obtain their own clusters; Extract a preset short time window from the IoT time series data of specific correlation data pairs, and cluster the preset short time window to obtain specific clusters.

4. The method for early ransomware behavior identification based on the Internet of Things according to claim 1, characterized in that, The process of determining the range of correlation features corresponding to normal behavior based on its own cluster and comparing it with the range of correlation features of a specific cluster to obtain the comparison result includes: The minimum baseline for normal behavior is determined based on the density distribution of its own clusters. The minimum baseline refers to the range of correlation characteristics corresponding to the core region with the highest density in its own clusters. The maximum baseline for normal behavior is determined based on the boundary of its own cluster. The maximum baseline refers to the range of correlation features corresponding to the farthest boundary of its own cluster in the feature space. During real-time detection, the correlation feature range of each newly generated specific cluster when it first appears is recorded, and the correlation feature range is compared with the minimum baseline and maximum baseline of normal behavior. The initial position state of the specific cluster relative to the baseline is marked. The initial position state includes being completely within the minimum baseline, between the minimum baseline and the maximum baseline, and completely outside the maximum baseline.

5. A method for early ransomware behavior identification based on the Internet of Things as described in claim 1, characterized in that, The process of continuously tracking the update and merging process of specific clusters based on comparison results and calculating the overlap degree includes: When new IoT time-series data is added to an existing specific cluster, or when two or more specific clusters are merged, the correlation feature range of the updated or merged specific cluster is recalculated, and the position status of the specific cluster relative to the baseline is updated. Calculate the overlap between the merged specific cluster and each of the original specific clusters involved in the merger; the overlap is quantified using the Jaccard similarity coefficient, which is equal to the intersection size of the merged specific cluster and the original specific cluster in the correlation feature space divided by the union size.

6. A method for early ransomware behavior identification based on the Internet of Things as described in claim 1, characterized in that, The process of identifying suspected evolutionary clusters based on overlap, and determining early ransomware behavior based on these clusters, includes: If the position of a specific cluster relative to the baseline changes from being completely outside the maximum baseline to being between the minimum baseline and the maximum baseline or completely within the minimum baseline, and the overlap between the merged specific cluster and at least one original specific cluster is greater than a preset overlap threshold, then the merged specific cluster is marked as a suspected evolutionary cluster. Obtain access logs of IoT time-series data corresponding to suspected evolutionary clusters. If an operation pattern exists in the access logs, then the specific correlation event corresponding to the suspected evolutionary cluster is determined to be early ransomware behavior. The operation pattern refers to the operation characteristic of simultaneously accessing multiple IoT time-series data that do not have their own correlation. The relevance features of specific related events identified as early-stage ransomware behaviors will be included in the ransomware behavior feature library for pattern matching and early warning in subsequent real-time detection.

7. A method for early ransomware behavior identification based on the Internet of Things according to claim 1, characterized in that, The method of correcting early ransomware behavior based on the volatility of IoT data to obtain corrected early ransomware behavior includes: Obtain a preset short time window corresponding to a specific related event that is determined to be an early behavior of ransomware, and use the preset short time window as the time window to be corrected; Obtain all self-correlated data pairs within the time window to be corrected; For each self-correlated data pair, the sliding correlation sequence is calculated using the sliding Pearson correlation coefficient within the time window to be corrected, wherein the length of the sliding window is less than a preset short time window; The calculation results of each sliding window in the sliding correlation sequence are compared with the minimum baseline and maximum baseline of normal behavior.

8. A method for early ransomware behavior identification based on the Internet of Things according to claim 7, characterized in that, The step of comparing the calculation result of each sliding window in the sliding correlation sequence with the minimum baseline and maximum baseline of normal behavior includes: If the calculation result is lower than the minimum baseline or exceeds the maximum baseline, it is determined as an associated disconnection event, and the disconnection start time and disconnection end time are recorded. If, after a disconnection event occurs, the calculation result of the subsequent sliding window returns to between the minimum and maximum baselines, it is considered a disconnection recovery event. The total number of events in which the correlation between data pairs was broken and then restored within the time window to be corrected is counted. The ratio of the total number of events to the total number of data pairs in the time window to be corrected is calculated to obtain the proportion of break-and-restore events. The percentage of disconnection recovery events is compared with a preset disconnection recovery threshold.

9. A method for early ransomware behavior identification based on the Internet of Things according to claim 8, characterized in that, The step of comparing the proportion of disconnection recovery events with a preset disconnection recovery threshold includes: If the proportion of disconnection and recovery events is greater than the preset disconnection and recovery threshold, it is determined that the early ransomware behavior is a misjudgment caused by system resource occupation, and the early ransomware behavior is removed from the judgment result. If the proportion of disconnection and recovery events is less than or equal to the preset disconnection and recovery threshold, the determination result of the early ransomware behavior is maintained, and the correlation characteristics and volatility characteristics corresponding to the early ransomware behavior are jointly included in the ransomware behavior feature library.

10. An Internet of Things (IoT)-based early ransomware behavior identification system, used to implement the IoT-based early ransomware behavior identification method according to any one of claims 1-9, characterized in that, include: The IoT data acquisition and feature calculation module is used to collect IoT data to construct time-series data and calculate correlation and volatility. The correlation clustering and baseline construction module is used to identify self-correlated data pairs and specific correlation data pairs and cluster them to obtain self-clusters and specific clusters. Based on the self-clusters, the minimum and maximum baselines for normal behavior are determined. The evolution tracking and behavior determination module is used to track the updates and merges of specific clusters to calculate the overlap. Based on the overlap and access log operation patterns, it determines the early behavior of ransomware and incorporates it into the ransomware behavior feature library. The volatility correction and output module is used to correct the determination result of the proportion of disconnection and recovery events within the time window to be corrected based on its own correlation data, and output the early behavior of the ransomware after correction.

Images