An internet of things terminal security communication method based on deep learning

Abstract

The application discloses a kind of based on deep learning's Internet of Things terminal security communication method, comprising the following steps: collecting communication data and state data in the process of Internet of Things terminal security communication, and pre-processing form basic data set;Communication data is reorganized, and message interaction track unit is formed;According to the phase evolution relationship and behavior-state corresponding relationship is organized in stages, and joint representation data is formed;The dynamic baseline corresponding to session phase is constructed and offset comparison is carried out, and risk preparation data is formed;Joint representation data and risk preparation data are input into improved TimeMixer risk evolution model, and output risk evolution representation and construct hierarchical risk state;Based on hierarchical risk state, security constraint set is constructed and security communication maintenance strategy is generated;Security communication maintenance strategy is decomposed into execution instruction and sent to execution layer execution.The application can improve the risk identification capability and security maintenance capability of Internet of Things terminal communication process.

Description

Technical Field

[0001] This invention relates to the field of IoT secure communication and intelligent risk control technology, and in particular to a deep learning-based IoT terminal secure communication method. Background Technology

[0002] With the widespread application of IoT terminals in scenarios such as industrial control, smart manufacturing, energy monitoring, and edge collaborative communication, technologies for security monitoring, risk identification, and control of terminal communication processes have received widespread attention. Existing secure communication methods for IoT terminals mainly rely on static rule matching, single traffic feature analysis, or traditional anomaly detection models for risk identification. However, these methods commonly suffer from the following problems in practical applications: The communication process of IoT terminals exhibits significant phased, interactive, and temporally correlated characteristics. Existing methods typically analyze only discrete messages, simple traffic statistics, or single-time-window features, making it difficult to accurately characterize the temporal adjacency, uplink / downlink correspondence, and response closure relationships between messages. This results in structural and phased anomalies during the communication process being difficult to identify effectively. Furthermore, there is a significant coupling relationship between IoT terminal communication behavior and device operating status, link quality, and task status. Most existing technologies process communication data and status data separately, lacking joint modeling of the phase evolution process and the correspondence between communication behavior and state changes. This leads to misjudgments and omissions under conditions of state drift, link fluctuations, or task switching. Given the dynamic changes in the normal communication mode of IoT terminals across different session stages, traditional fixed baselines, simple sliding thresholds, or conventional time-series models struggle to create dynamic baselines that match specific session stages, failing to accurately extract high-risk offset segments. Simultaneously, existing technologies typically only provide alarm results after risk detection, lacking mechanisms for constructing security constraints, filtering feasible regions, and implementing hierarchical execution for the current session. This makes it difficult to maintain secure communication control while ensuring communication continuity.

[0003] Therefore, how to provide a secure communication method for IoT terminals based on deep learning is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] One objective of this invention is to propose a secure communication method for IoT terminals based on deep learning. This invention fully utilizes a deep baseline extraction network, an improved TimeMixer risk evolution model, and a control barrier function to jointly model, identify risks, and maintain security control of communication data and state data during the secure communication process of IoT terminals. It describes in detail the technical process for achieving dynamic analysis and layered protection of secure terminal communication, and has the advantages of high accuracy in risk identification, strong secure communication maintenance capability, and good stability of the communication process.

[0005] A secure communication method for IoT terminals based on deep learning according to an embodiment of the present invention includes the following steps: Step 1: Collect communication data and status data during the secure communication process of IoT terminals, and preprocess them to form a basic dataset; Step 2: Reassemble the communication data according to time adjacency, uplink / downlink correspondence, and response closure relationship to form message interaction trajectory units; Step 3: Based on the stage evolution relationship in the terminal communication process and the correspondence between communication behavior and state changes, the message interaction trajectory unit is organized in stages to form joint representation data; Step 4: Divide the joint characterization data into multiple stage data subsets according to the session stage, and input them into the deep baseline extraction network to construct the dynamic baseline corresponding to the session stage. Then, perform offset comparison between the joint characterization data and the corresponding stage dynamic baseline to form risk preparation data. Step 5: Input the joint characterization data and risk preparation data into the improved TimeMixer risk evolution model. The improved TimeMixer risk evolution model introduces a multi-source channel grouping input mechanism and a multi-baseline offset guidance mechanism, outputs risk evolution characterization, and constructs a hierarchical risk state. Step 6: Construct a set of security constraints based on hierarchical risk states, use a control barrier function to filter the safe feasible region of the set of security constraints, and generate a secure communication maintenance strategy; Step 7: Decompose the secure communication maintenance policy into corresponding execution instructions and send them to the corresponding execution layer for execution.

[0006] Optionally, the communication data includes message sending time, message receiving time, message direction, message length, session identifier, target node identifier, and response association identifier, and the status data includes power consumption sampling value, device working status identifier, link quality identifier, and task status identifier; The communication data and status data are preprocessed, including time base unification, duplicate record elimination, abnormal record removal, missing record completion, and identifier merging. Source identifiers and stage retention identifiers are added to the preprocessed communication data and status data to form a basic dataset arranged in chronological order.

[0007] Optionally, step two specifically includes: The communication data of the same terminal in the same session is extracted from the basic dataset and arranged in time sequence according to the message sending time and message receiving time to form the original message sequence; The temporal adjacency relationship is identified based on the time interval between adjacent messages; the uplink and downlink correspondence is identified based on the correspondence between the sending and receiving directions; and the response closure relationship is identified based on the association identifier between the request and response messages. According to the time adjacency relationship, messages that appear consecutively and whose interval does not exceed the preset adjacency time threshold are grouped into the same candidate interaction segment. According to the uplink and downlink correspondence relationship, the sent messages and received messages in the candidate interaction segment are paired and organized. According to the response closure relationship, the request messages and response messages in the candidate interaction segment are checked for closure. Candidate interaction segments that simultaneously satisfy the conditions of temporal continuity, uplink and downlink pairing, and response closure are identified as message interaction trajectory units. Candidate interaction segments that do not satisfy the response closure relationship but satisfy temporal continuity and uplink / downlink correspondence retain their unclosed identifiers. Messages that do not satisfy the temporal adjacency relationship are re-designated as the starting point of new candidate interaction segments.

[0008] Optionally, step three specifically includes: The message interaction trajectory units are arranged in chronological order within the same session, and the stage affiliation of each message interaction trajectory unit in the session is determined according to the stage evolution relationship in the terminal communication process, forming a session stage sequence organized in stage order. Based on the connection relationship between adjacent message interaction trajectory units, the session phase sequence is organized into phases, so that message interaction trajectory units belonging to the same phase and connected continuously are merged into corresponding phase segments, and message interaction trajectory units whose phases change or whose connection is interrupted are divided into different phase segments. By associating each stage segment with the state changes within the corresponding time interval, a correspondence is established between the communication behavior changes and state changes within the same stage segment, forming a joint association unit within the stage; The joint associated units within a stage are uniformly represented to form joint representation data, which are then arranged according to the stage order in the session to obtain a staged joint representation sequence.

[0009] Optionally, step four specifically includes: The phased joint representation sequence is divided into multiple phase data subsets according to the session phase; The data subsets of each stage are input into the deep baseline extraction network: the adjacent joint representation data in the current session stage data subset are subjected to sliding convolution operation by a one-dimensional convolutional layer to obtain local temporal features reflecting local temporal changes. Then, the local temporal features are downsampled and compressed by a pooling layer with a preset pooling step size to obtain compressed temporal features. Subsequently, the compressed temporal features are cyclically encoded by a bidirectional gated recurrent layer along the forward and backward time directions respectively. The forward encoding result and the backward encoding result are concatenated according to the corresponding time position to obtain the bidirectional temporal encoding result. Finally, the bidirectional temporal encoding result is linearly mapped by a fully connected layer to obtain the stage prototype representation. The similarity between the stage prototype representation and each normal mode prototype vector corresponding to the current session stage in the prototype library is calculated one by one, and the normal mode prototype vector is selected. The selected normal mode prototype vector is input into the baseline reconstruction layer. The baseline reconstruction layer repeatedly expands the normal mode prototype vector according to the time length of the current stage data subset, and generates a dynamic baseline sequence corresponding to the current stage data subset time by time in combination with the time position order of the current stage data subset. The output layer outputs the dynamic baseline sequence. The offset of the current stage data subset is compared with the corresponding dynamic baseline sequence to obtain the offset results of each local time window; Based on the offset results, extract suspicious offset segments that reach the preset suspicious threshold but do not reach the preset abnormal threshold, extract key switching abnormal segments that are located within the preset time window before and after key switching and whose adjacent time position offset difference reaches the preset mutation threshold, extract continuous high offset segments whose offset results are continuously higher than the preset offset threshold within the preset local time window, and output the suspicious offset segments, key switching abnormal segments, and continuous high offset segments as risk preparation data.

[0010] Optionally, the improved TimeMixer risk evolution model includes an input module, a multi-scale decomposition module, a multi-scale mixing module, and an output module: The input module introduces a multi-source channel grouping input mechanism: the joint representation data and risk preparation data are constructed as independent input channels. The joint representation vector of each time step in the joint representation data channel is input into the first linear projection layer, and the risk preparation vector of each time step in the risk preparation data channel is input into the second linear projection layer, so that the joint representation data channel and the risk preparation data channel are mapped to the same feature dimension. Then, the same time position encoding is added to the two mapped channels, and they are spliced ​​on the feature dimension after being aligned one by one according to the time position to form a grouped input sequence. The grouped input sequence is input into the multi-scale decomposition module, and the original scale sequence and the downsampled scale sequence are constructed in the time dimension respectively. The trend component is extracted by the moving average of each scale sequence, and the fluctuation component is obtained by subtracting the trend component from the corresponding scale sequence. The trend sequence and fluctuation sequence are formed at each scale respectively. The trend and fluctuation sequences at each scale are input into the multi-scale mixing module. Within each scale, the trend and fluctuation sequences are mixed at the same scale. Between different scales, the local change features in the fine scale are transmitted to the coarse scale, and the overall change features in the coarse scale are transmitted back to the fine scale, forming a multi-scale time series representation. The output module introduces a multi-baseline offset guidance mechanism: the offset comparison results in the risk preparation data are constructed in chronological order, and the offset sequence is input into the offset projection layer to obtain the offset guidance sequence corresponding to the multi-scale time series representation at the time position. The offset guidance sequence is matched with the multi-scale time series representation one by one according to the time position, and the multi-scale time series representation and the corresponding offset guidance vector at each time position are combined dimension by dimension to form the risk evolution representation. Risk evolution representation is mapped to risk components to obtain multiple risk components corresponding to the current session. Each risk component is concatenated in chronological order, and the concatenated risk component sequence is hierarchically mapped to form a hierarchical risk state.

[0011] Optionally, step six specifically includes: Read the hierarchical risk state corresponding to the current session, extract the risk components corresponding to each time position of the current session, merge the risk components according to the control meaning, and form session hold-up constraints, target access constraints, transmission regulation constraints and link hold-up constraints respectively, which constitute the security constraint set of the current session; After forming a set of security constraints, the communication state at the current moment is constructed, which includes session hold-up state, target access state, transmission conditioning state, and link hold-up state. Construct candidate communication adjustment quantities, which include session persistence adjustment quantities, target access adjustment quantities, transmission adjustment quantities and link persistence adjustment quantities. Each candidate communication adjustment quantity represents a set of joint adjustment actions for the current session communication behavior. Apply the candidate communication adjustment quantities to the communication state at the current time to obtain the predicted communication state. After obtaining the predicted communication state, the control barrier function is used to express the set of security constraints. Control barrier constraints are established for session persistence constraints, target access constraints, transmission regulation constraints and link persistence constraints, respectively. During the candidate communication regulation screening process, each candidate communication regulation is substituted into the session persistence control barrier constraint, target access control barrier constraint, transmission regulation control barrier constraint, and link persistence control barrier constraint for judgment. When a candidate communication regulation makes any control barrier constraint invalid, it is determined that the current candidate communication regulation will cause the predicted communication state to exceed the safety constraint range and is deleted from the candidate set. When a candidate communication regulation makes all control barrier constraints valid, it is determined that the predicted communication state is still within the safety constraint range after the current candidate communication regulation is applied and the current candidate communication regulation is retained. All retained candidate communication modifiers are combined into a set of secure and feasible modifiers. Combinations of modifiers used to maintain secure communication in the current session are selected from the set of secure and feasible modifiers to form a secure communication maintenance strategy.

[0012] Optionally, step seven specifically includes: The adjustment items in the secure communication maintenance strategy are analyzed to determine the execution object and execution method corresponding to each adjustment item, and the secure communication maintenance strategy is decomposed into a set of execution instructions; The set of execution instructions is allocated to the corresponding execution layer according to the execution object. Each execution layer executes the corresponding execution instructions and collects the execution results returned by each execution layer. The execution results are checked for consistency with the secure communication maintenance policy. When the execution results are consistent with the secure communication maintenance policy, the hierarchical control execution of the current session is completed.

[0013] The beneficial effects of this invention are: This invention reorganizes communication data according to temporal adjacency, uplink / downlink correspondence, and response closure to form message interaction trajectory units. This solves the problem that existing technologies, which rely solely on discrete messages or simple traffic statistics, cannot accurately characterize the communication interaction structure. This allows for a more accurate representation of continuous interaction behavior and abnormal interaction patterns in IoT terminal communication processes. Furthermore, by organizing the message interaction trajectory units in stages based on phase evolution relationships and the correspondence between communication behavior and state changes, joint representation data is formed. This addresses the problem of existing technologies processing communication data and state data separately, making it difficult to identify phased anomalies and state coupling anomalies. This improves the ability to identify complex session processes and communication-state mismatch risks. Finally, by dividing the joint representation data according to session stages and inputting it into a deep baseline extraction network, a dynamic baseline corresponding to the session stage is constructed. This baseline is then offset against the current stage data to form risk preparation data, solving the problems of fixed baselines and simple sliding baselines. The improved TimeMixer risk evolution model addresses the challenge of adapting thresholds to dynamic changes in normal modes across different session stages. This model effectively extracts suspicious offset segments, key switching anomalies, and continuous high offset segments. By incorporating joint characterization data and risk preparation data into a multi-source channel grouping input mechanism and a multi-baseline offset guidance mechanism, it solves the problem of existing time-series models struggling to simultaneously handle multi-source heterogeneous inputs and phased offset information. This results in a risk evolution characterization and hierarchical risk state that better aligns with the evolutionary patterns of communication scenarios. Furthermore, by constructing a set of security constraints based on hierarchical risk states and employing control barrier functions for security feasible domain screening, and then decomposing secure communication maintenance strategies into execution instructions sent to the corresponding execution layers, it addresses the lack of executable maintenance control mechanisms in existing technologies after risk detection. This approach maintains the secure communication continuity of the current session while limiting risk propagation, demonstrating significant engineering application value and system security implications. Attached Figure Description

[0014] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Fig. 1 This is a flowchart of a secure communication method for IoT terminals based on deep learning proposed in this invention; Fig. 2 This is a schematic diagram of a secure communication method for IoT terminals based on deep learning proposed in this invention; Fig. 3 This is a framework diagram of the improved TimeMixer risk evolution model in a deep learning-based secure communication method for IoT terminals proposed in this invention. Detailed Implementation

[0015] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0016] refer to Figs. 1-3 A secure communication method for IoT terminals based on deep learning includes the following steps: Step 1: Collect communication data and status data during the secure communication process of IoT terminals, and preprocess them to form a basic dataset; Step 2: Reassemble the communication data according to time adjacency, uplink / downlink correspondence, and response closure relationship to form message interaction trajectory units; Step 3: Based on the stage evolution relationship in the terminal communication process and the correspondence between communication behavior and state changes, the message interaction trajectory unit is organized in stages to form joint representation data; Step 4: Divide the joint characterization data into multiple stage data subsets according to the session stage, and input them into the deep baseline extraction network to construct the dynamic baseline corresponding to the session stage. Then, perform offset comparison between the joint characterization data and the corresponding stage dynamic baseline to form risk preparation data. Step 5: Input the joint characterization data and risk preparation data into the improved TimeMixer risk evolution model. The improved TimeMixer risk evolution model introduces a multi-source channel grouping input mechanism and a multi-baseline offset guidance mechanism to output risk evolution characterization and construct hierarchical risk states. Step 6: Construct a set of security constraints based on hierarchical risk states, use a control barrier function to filter the safe feasible region of the set of security constraints, and generate a secure communication maintenance strategy; Step 7: Decompose the secure communication maintenance policy into corresponding execution instructions and send them to the corresponding execution layer for execution.

[0017] In this embodiment, the communication data includes message sending time, message receiving time, message direction, message length, session identifier, target node identifier, and response association identifier, and the status data includes power consumption sampling value, device working status identifier, link quality identifier, and task status identifier. The communication data and status data are preprocessed. The preprocessing includes time base unification, duplicate record elimination, abnormal record removal, missing record completion, and identifier merging. Among them, time base unification is to perform time stamp correction on the communication data and status data according to a unified time base, and identifier merging is to merge the preprocessed data based on terminal identifier, session identifier, and time slice identifier. Abnormal record removal includes deleting records with reversed time, records without corresponding session identifiers, and isolated message records without response association identifiers. Missing record completion includes sequentially filling in missing status data within consecutive time slices with adjacent valid records. Add source identifiers and stage retention identifiers to the preprocessed communication data and status data to form a basic dataset arranged in chronological order.

[0018] In this embodiment, step two specifically includes: The communication data of the same terminal in the same session is extracted from the basic dataset and arranged in time sequence according to the message sending time and message receiving time to form the original message sequence; The temporal adjacency relationship is identified based on the time interval between adjacent messages; the uplink and downlink correspondence is identified based on the correspondence between the sending and receiving directions; and the response closure relationship is identified based on the association identifier between the request and response messages. According to the time adjacency relationship, messages that appear consecutively and whose interval does not exceed the preset adjacency time threshold are grouped into the same candidate interaction segment. According to the uplink and downlink correspondence, the sent and received messages in the candidate interaction segment are paired and organized. According to the response closure relationship, the request and response messages in the candidate interaction segment are checked for closure. Candidate interaction segments that simultaneously satisfy the conditions of temporal continuity, uplink and downlink pairing, and response closure are identified as message interaction trajectory units. Candidate interaction segments that do not satisfy the response closure relationship but satisfy temporal continuity and uplink / downlink correspondence retain their unclosed identifiers. Messages that do not satisfy the temporal adjacency relationship are re-designated as the starting point of new candidate interaction segments.

[0019] In this embodiment, step three specifically includes: The message interaction trajectory units are arranged in chronological order within the same session, and the stage affiliation of each message interaction trajectory unit in the session is determined according to the stage evolution relationship in the terminal communication process, forming a session stage sequence organized in stage order. The stage evolution relationship refers to the relationship between the various communication stages of the terminal in a secure communication session, which occur in chronological order and are connected to each other. Based on the connection relationship between adjacent message interaction trajectory units, the session phase sequence is organized into phases, so that message interaction trajectory units belonging to the same phase and connected continuously are merged into corresponding phase segments, and message interaction trajectory units whose phases change or whose connection is interrupted are divided into different phase segments. Here, the connection relationship refers to whether adjacent message interaction trajectory units are connected continuously in time, session and phase. Each stage segment is associated with the state changes within the corresponding time interval, so that the communication behavior changes and state changes within the same stage segment are established to form a joint association unit within the stage. Here, state change refers to the change in the terminal's operating state relative to the previous moment, the previous time slice, or the previous stage. The joint associated units within a stage are uniformly represented to form joint representation data, which are then arranged according to the stage order in the session to obtain a staged joint representation sequence.

[0020] In this embodiment, step four specifically includes: The phased joint representation sequence is divided into multiple phase data subsets according to the session phase. Each phase data subset is a set of joint representation data belonging to the same session phase and arranged in chronological order. The data subsets of each stage are input into the deep baseline extraction network: the adjacent joint representation data in the current session stage data subset are subjected to sliding convolution operation by a one-dimensional convolutional layer to obtain local temporal features reflecting local temporal changes. Then, the local temporal features are downsampled and compressed by a pooling layer with a preset pooling step size to obtain compressed temporal features. Subsequently, the compressed temporal features are cyclically encoded by a bidirectional gated recurrent layer along the forward and backward time directions respectively. The forward encoding result and the backward encoding result are concatenated according to the corresponding time position to obtain the bidirectional temporal encoding result. Finally, the bidirectional temporal encoding result is linearly mapped by a fully connected layer to obtain the stage prototype representation. The similarity is calculated one by one between the stage prototype representation and each normal mode prototype vector corresponding to the current session stage in the prototype library. The similarity calculation is to accumulate the differences between the stage prototype representation and each normal mode prototype vector in each corresponding dimension, and determine the normal mode prototype vector with the smallest accumulation result as the closest normal mode prototype vector; or to accumulate the products of the stage prototype representation and each normal mode prototype vector in each corresponding dimension, and determine the normal mode prototype vector with the largest accumulation result as the closest normal mode prototype vector. The selected normal mode prototype vector is input into the baseline reconstruction layer. The baseline reconstruction layer repeatedly expands the normal mode prototype vector according to the time length of the current stage data subset, and generates a dynamic baseline sequence corresponding to the current stage data subset time by time in combination with the time position order of the current stage data subset. The output layer outputs the dynamic baseline sequence. The current stage data subset is offset compared with the corresponding dynamic baseline sequence. The offset comparison involves calculating the difference between the current stage data subset and the dynamic baseline sequence at each corresponding time position, and accumulating or averaging the difference within a preset local time window to obtain the offset result for each local time window. Based on the offset results, extract suspicious offset segments that reach the preset suspicious threshold but do not reach the preset abnormal threshold, extract key switching abnormal segments that are located within the preset time window before and after key switching and whose adjacent time position offset difference reaches the preset mutation threshold, extract continuous high offset segments whose offset results are continuously higher than the preset offset threshold within the preset local time window, and output the suspicious offset segments, key switching abnormal segments, and continuous high offset segments as risk preparation data.

[0021] This implementation divides the phased joint representation sequence into multiple phase data subsets according to the session phase, inputs them into a deep baseline extraction network, constructs a dynamic baseline corresponding to the current session phase, and compares the current phase data with the dynamic baseline position by position to form risk preparation data. The beneficial effects of this are: firstly, it overcomes the problem of existing technologies struggling to adapt to differences in normal communication patterns across different session phases when using set baselines or uniform thresholds; secondly, it overcomes the difficulty of traditional static templates and simple statistical methods in simultaneously representing local fluctuation characteristics, temporal dependencies, and differences in normal patterns across phases; and thirdly, it improves the ability to distinguish between local anomalies, abrupt anomalies, and persistent offset anomalies, thereby enabling more accurate extraction of high-value risk segments and providing more reliable input for subsequent risk evolution modeling and hierarchical risk state construction.

[0022] In this embodiment, the improved TimeMixer risk evolution model includes an input module, a multi-scale decomposition module, a multi-scale mixing module, and an output module: The input module introduces a multi-source channel grouping input mechanism: the joint representation data and risk preparation data are constructed as independent input channels. The joint representation vector of each time step in the joint representation data channel is input into the first linear projection layer, and the risk preparation vector of each time step in the risk preparation data channel is input into the second linear projection layer, so that the joint representation data channel and the risk preparation data channel are mapped to the same feature dimension. Then, the same time position encoding is added to the two mapped channels, and they are spliced ​​on the feature dimension after being aligned one by one according to the time position to form a grouped input sequence. The grouped input sequence is input into the multi-scale decomposition module, and the original scale sequence and downsampled scale sequence are constructed in the time dimension respectively. The trend component is extracted by the moving average of each scale sequence, and the fluctuation component is obtained by subtracting the trend component from the corresponding scale sequence. Thus, the trend sequence and fluctuation sequence are formed at each scale respectively. The trend and fluctuation sequences at each scale are input into the multi-scale mixing module. Within each scale, the trend and fluctuation sequences are mixed at the same scale to extract the time-dependent features within that scale. Between different scales, the local change features in the fine scale are transferred to the coarse scale, and the overall change features in the coarse scale are transferred back to the fine scale, thus completing the cross-scale mixing of the trend and fluctuation sequences and forming a multi-scale time series representation. The output module introduces a multi-baseline offset guidance mechanism: the offset comparison results in the risk preparation data are constructed into an offset sequence in chronological order, and the offset sequence is input into the offset projection layer to obtain the offset guidance sequence corresponding to the multi-scale time series representation at the time position; the offset guidance sequence is matched with the multi-scale time series representation one by one according to the time position, and the multi-scale time series representation and the corresponding offset guidance vector at each time position are combined dimension by dimension, so that the multi-scale time series representation corresponding to the time position with higher offset degree in the offset guidance sequence has a higher proportion in the output result, while the multi-scale time series representation corresponding to the time position with lower offset degree maintains its original proportion, forming a risk evolution representation; Risk evolution representation is mapped to risk components to obtain multiple risk components corresponding to the current session. Each risk component is concatenated in chronological order, and the concatenated risk component sequence is hierarchically mapped to form a hierarchical risk state.

[0023] The improved TimeMixer risk evolution model is similar to the original TimeMixer model in that it adopts an overall architecture of input module, multi-scale decomposition module, multi-scale mixing module and output module. Both models decompose the input sequence at multiple time scales to extract trend components and fluctuation components, and complete the time series feature modeling through same-scale mixing and cross-scale mixing, and finally output the corresponding time series representation results.

[0024] The difference between the two is that this implementation introduces a multi-source channel grouping input mechanism in the input module, which maps and aligns the joint characterization data and risk preparation data by channel before splicing them into the input; and introduces a multi-baseline offset guidance mechanism in the output module, which constructs the offset comparison results into an offset guidance sequence and combines it with the multi-scale time series characterization position by position, thereby increasing the weight of the time series characterization corresponding to the significant offset position.

[0025] The above improvements address the issues that the original TimeMixer is only applicable to unified time-series inputs and has difficulty directly processing parallel inputs of joint communication representations and risk preparation data. They also solve the problems that the original model has difficulty in explicitly utilizing stage dynamic baseline offset information and is not sensitive enough to local high offsets and key switching anomalies. This improves the pertinence, anomaly location capability, and accuracy of hierarchical risk state construction in IoT terminal secure communication scenarios.

[0026] In this embodiment, step six specifically includes: Read the hierarchical risk state corresponding to the current session, extract the risk components corresponding to each time position of the current session, merge the risk components according to the control meaning, and form session hold-up constraints, target access constraints, transmission regulation constraints and link hold-up constraints respectively, which constitute the security constraint set of the current session; After forming a set of security constraints, the communication state at the current moment is constructed. The communication state at the current moment includes session hold-up state, target access state, transmission conditioning state, and link hold-up state. The session hold-up state is used to characterize the continuous maintenance state of the current session, the target access state is used to characterize the access state of the current session to external targets, the transmission conditioning state is used to characterize the transmission strength state of the current session, and the link hold-up state is used to characterize the link hold-up state of the current session. Construct candidate communication adjustment quantities, which include session persistence adjustment quantities, target access adjustment quantities, transmission adjustment quantities, and link persistence adjustment quantities. Each candidate communication adjustment quantity represents a set of joint adjustment actions for the current session communication behavior. Apply the candidate communication adjustment quantities to the communication state at the current time to obtain the predicted communication state. The predicted communication state is the state after the candidate communication adjustment quantities are executed at the next time. After obtaining the predicted communication state, the control barrier function is used to express the set of security constraints. Control barrier constraints are established for session persistence constraints, target access constraints, transmission regulation constraints and link persistence constraints respectively. Each control barrier constraint is used to determine whether the current communication state and the predicted communication state are still within the allowable range relative to the corresponding constraint item. During the candidate communication regulation screening process, each candidate communication regulation is substituted into the session persistence control barrier constraint, target access control barrier constraint, transmission regulation control barrier constraint, and link persistence control barrier constraint for judgment. When a candidate communication regulation makes any control barrier constraint invalid, it is determined that the current candidate communication regulation will cause the predicted communication state to exceed the safety constraint range and is deleted from the candidate set. When a candidate communication regulation makes all control barrier constraints valid, it is determined that the predicted communication state is still within the safety constraint range after the current candidate communication regulation is applied and the current candidate communication regulation is retained. All retained candidate communication modifiers are combined into a set of secure and feasible modifiers. Combinations of modifiers used to maintain secure communication in the current session are selected from the set of secure and feasible modifiers to form a secure communication maintenance strategy.

[0027] In this embodiment, step seven specifically includes: The adjustment items in the secure communication maintenance strategy are analyzed to determine the execution object and execution method corresponding to each adjustment item, and the secure communication maintenance strategy is decomposed into a set of execution instructions; The set of execution instructions is distributed to the corresponding execution layer according to the execution object. Specifically, the execution instructions corresponding to the IoT terminal are sent to the terminal local holding execution layer, the execution instructions corresponding to the gateway are sent to the gateway proxy execution layer, the execution instructions corresponding to the edge node are sent to the edge takeover execution layer, and the execution instructions corresponding to the session control are sent to the session freeze execution layer. Each execution layer executes the corresponding execution instructions and collects the execution results returned by each execution layer. The execution results are checked for consistency with the secure communication maintenance policy. When the execution results are consistent with the secure communication maintenance policy, the hierarchical control execution of the current session is completed.

[0028] Example 1: To verify the feasibility of this invention in practice, it was applied to a secure communication scenario for IoT terminals in a discrete manufacturing workshop. The workshop includes CNC machine tools, servo drives, vibration sensors, temperature sensors, and industrial gateways, with a total of 96 terminals, 8 gateways, and 2 edge nodes. A hybrid network of industrial Ethernet and wireless supplementary links was used. The system ran continuously for 14 days, with a sampling period of 1 second, a minimum statistical unit for communication sessions of 30 seconds, a sliding update window of 12 time slices for the phase data subset, a key switching observation window of 6 time slices before and after the switch, and a local offset detection window of 5 time slices. Normal production data from the first 9 days was used as baseline operating data. For the last 5 days, five types of risk events were artificially injected: abnormal communication frequency, abnormal target access, key switching disturbances, amplified link fluctuations, and state mismatch. A total of 32,840 valid sessions were obtained, including 28,620 normal sessions and 4,220 abnormal sessions.

[0029] In this scenario, communication data between the terminal and the gateway, as well as terminal operating status data, are first collected. Communication data includes message sending time, message receiving time, message direction, message length, session identifier, target node identifier, and response association identifier; status data includes power consumption sampling values, device operating status identifier, link quality identifier, and task status identifier. After time-stamp correction, abnormal record removal, missing data completion, and identifier merging, a basic dataset is formed. Subsequently, message interaction trajectory units are generated based on temporal adjacency, uplink / downlink correspondence, and response closure relationships. Then, joint representation data is formed based on stage evolution relationships and the correspondence between communication behavior and state changes. For dynamic baseline construction, the joint representation data is divided into stage data subsets according to session stages and fed into a deep baseline extraction network. The network uses one-dimensional convolutional layers to extract local temporal features, pooling layers to perform downsampling, bidirectional gated recurrent layers to extract dependencies, and fully connected layers to output stage prototype representations. These representations are then matched with normal mode prototype vectors in a prototype library to reconstruct the current stage's dynamic baseline. In offset comparison, the threshold for suspicious offsets is set to 0.18, the threshold for anomalies is set to 0.32, and the threshold for continuous high offsets is set to 0.41. In the improved TimeMixer, joint representation data and risk preparation data are mapped to a unified feature dimension via two linear projections, and then input into the model using a multi-source channel grouping input mechanism. At the output, the offset results are constructed into an offset guidance sequence, which is combined position-by-position with multi-scale time series representations to enhance the risk evolution representation at high-risk moments. In step six, a set of security constraints is constructed for session persistence, target access, transmission regulation, and link persistence. Candidate communication regulation quantities are screened using a control barrier function to output a secure communication persistence strategy. Finally, the corresponding execution layers of the terminal, gateway, and edge nodes complete the strategy execution.

[0030] To demonstrate the effectiveness of this invention, this embodiment sets up four comparison methods: fixed threshold rule method (Method 1), static baseline plus BiLSTM method (Method 2), original TimeMixer method (Method 3), and method using only deep baseline extraction network without introducing the improved TimeMixer mechanism (Method 4). The complete method of this invention is used as a control group. Evaluation metrics include anomaly detection accuracy, F1 score, false alarm rate, false negative rate, key switching anomaly detection rate, risk stratification consistency rate, service retention rate, and policy execution success rate. Average alarm lead time is added to measure the forward-looking risk identification capability. The comprehensive experimental results are shown in Table 1 below: Table 1. Overall Results of the Invention and Comparative Methods in IoT Terminal Secure Communication Scenarios

[0031] As shown in Table 1, the fixed threshold rule method can still work in scenarios with clear rules and large anomaly amplitudes. However, due to its inability to characterize the message interaction structure and stage evolution features, its ability to identify complex anomalies near link fluctuations and key switching is significantly insufficient, resulting in high false positive and false negative rates. The static baseline plus BiLSTM method shows a significant improvement over the rule method, indicating that the introduction of time-series learning has a certain modeling capability for terminal communication anomalies. However, its baseline is still a fixed baseline and cannot adapt to changes in normal patterns under different session stages. Therefore, it still has misjudgments in the boundary fluctuations of the periodic upload stage and the keep-alive stage. The original TimeMixer further improves the overall recognition performance by using multi-scale modeling. However, since the input is a uniform time series and the output lacks baseline offset guidance, its ability to capture local high-offset segments and key switching disturbances is still limited. After introducing a deep baseline extraction network, the dynamic baseline can be generated stage by stage for a subset of stage data, making anomaly detection change from "global deviation" to "intra-stage deviation". Therefore, the key switching anomaly recognition rate and risk stratification consistency rate both increase significantly. The complete method of this invention adds a multi-source channel grouping input mechanism and a multi-baseline offset guidance mechanism, so that the joint characterization data and risk preparation data can be used in a unified manner on the same time axis. The model can see "what the current behavior is" and "how much it deviates from the baseline" at the same time. Therefore, it achieves the best in terms of anomaly identification accuracy, F1 value, false alarm rate, false alarm rate and average alarm lead time.

[0032] Further analysis reveals that the anomaly detection accuracy of the complete method of this invention is 4.46 percentage points higher than that of the original TimeMixer, the F1 score is increased by 0.046, the false alarm rate decreases by 2.93 percentage points, and the missed alarm rate decreases by 4.74 percentage points. This indicates that the invention not only improves the anomaly detection capability but also significantly reduces false alarms. The key switching anomaly detection rate increased from 83.62% to 94.92%, indicating that the dynamic baseline formed by the deep baseline extraction network in step four is more sensitive to local mutations before and after key switching. The risk stratification consistency rate increased from 85.74% to 93.87%, indicating that the improved TimeMixer, under the guidance of multi-source channel group input and offset, provides a more stable stratified expression of risk evolution results. The service retention rate and policy execution success rate reached 95.11% and 96.27%, respectively, indicating that the security constraint screening and execution strategies constructed in steps six and seven do not simply interrupt the session but, while limiting the spread of risk, maintain necessary communication links as much as possible, which is more in line with the continuous production requirements of the Industrial Internet of Things from an engineering application perspective. The average alarm lead time reaches 23.6 seconds, which is 8.7 seconds longer than the original TimeMixer. This indicates that the present invention can not only identify anomalies that have already occurred, but also output risk states that can be controlled earlier.

[0033] As can be seen from this embodiment, the present invention solves the problems of existing technologies in simultaneously handling communication interaction structure, stage differences, state coupling, and subsequent risk control by reconstructing message interaction trajectories, staged joint representation, constructing dynamic baselines through deep baseline extraction networks, improving TimeMixer risk evolution modeling, and generating security maintenance strategies based on control barrier functions. The results are: more accurate anomaly identification, stronger key switching anomaly capture capability, more stable risk stratification, lower false positives and false negatives, and better service continuity. Therefore, it demonstrates significant practical value and technical advantages in secure communication scenarios for industrial IoT terminals.

[0034] The above are merely preferred embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A secure communication method for IoT terminals based on deep learning, characterized in that, Includes the following steps: Step 1: Collect communication data and status data during the secure communication process of IoT terminals, and preprocess them to form a basic dataset; Step 2: Reassemble the communication data according to time adjacency, uplink / downlink correspondence, and response closure relationship to form message interaction trajectory units; Step 3: Based on the stage evolution relationship in the terminal communication process and the correspondence between communication behavior and state changes, the message interaction trajectory unit is organized in stages to form joint representation data; Step 4: Divide the joint characterization data into multiple stage data subsets according to the session stage, and input them into the deep baseline extraction network to construct the dynamic baseline corresponding to the session stage. Then, perform offset comparison between the joint characterization data and the corresponding stage dynamic baseline to form risk preparation data. Step 5: Input the joint characterization data and risk preparation data into the improved TimeMixer risk evolution model. The improved TimeMixer risk evolution model introduces a multi-source channel grouping input mechanism and a multi-baseline offset guidance mechanism, outputs risk evolution characterization, and constructs a hierarchical risk state. Step 6: Construct a set of security constraints based on hierarchical risk states, use a control barrier function to filter the safe feasible region of the set of security constraints, and generate a secure communication maintenance strategy; Step 7: Decompose the secure communication maintenance policy into corresponding execution instructions and send them to the corresponding execution layer for execution.

2. The IoT terminal secure communication method based on deep learning according to claim 1, characterized in that, The communication data includes message sending time, message receiving time, message direction, message length, session identifier, target node identifier, and response association identifier; the status data includes power consumption sampling value, device working status identifier, link quality identifier, and task status identifier. The communication data and status data are preprocessed, including time base unification, duplicate record elimination, abnormal record removal, missing record completion, and identifier merging. Source identifiers and stage retention identifiers are added to the preprocessed communication data and status data to form a basic dataset arranged in chronological order.

3. The secure communication method for IoT terminals based on deep learning according to claim 1, characterized in that, Step two specifically includes: The communication data of the same terminal in the same session is extracted from the basic dataset and arranged in time sequence according to the message sending time and message receiving time to form the original message sequence; The temporal adjacency relationship is identified based on the time interval between adjacent messages; the uplink and downlink correspondence is identified based on the correspondence between the sending and receiving directions; and the response closure relationship is identified based on the association identifier between the request and response messages. According to the time adjacency relationship, messages that appear consecutively and whose interval does not exceed the preset adjacency time threshold are grouped into the same candidate interaction segment. According to the uplink and downlink correspondence, the sent messages and received messages in the candidate interaction segment are paired and organized. According to the response closure relationship, the request messages and response messages in the candidate interaction segment are checked for closure. Candidate interaction segments that simultaneously satisfy the conditions of temporal continuity, uplink and downlink pairing, and response closure are identified as message interaction trajectory units. Candidate interaction segments that do not satisfy the response closure relationship but satisfy temporal continuity and uplink / downlink correspondence retain their unclosed identifiers. Messages that do not satisfy the temporal adjacency relationship are re-designated as the starting point of new candidate interaction segments.

4. The IoT terminal secure communication method based on deep learning according to claim 1, characterized in that, Step three specifically includes: The message interaction trajectory units are arranged in chronological order within the same session, and the stage affiliation of each message interaction trajectory unit in the session is determined according to the stage evolution relationship in the terminal communication process, forming a session stage sequence organized in stage order. Based on the connection relationship between adjacent message interaction trajectory units, the session phase sequence is organized into phases, so that message interaction trajectory units belonging to the same phase and connected continuously are merged into corresponding phase segments, and message interaction trajectory units whose phases change or whose connection is interrupted are divided into different phase segments. By associating each stage segment with the state changes within the corresponding time interval, a correspondence is established between the communication behavior changes and state changes within the same stage segment, forming a joint association unit within the stage; The joint associated units within a stage are uniformly represented to form joint representation data, which are then arranged according to the stage order in the session to obtain a staged joint representation sequence.

5. The IoT terminal secure communication method based on deep learning according to claim 1, characterized in that, Step four specifically includes: The phased joint representation sequence is divided into multiple phase data subsets according to the session phase; The data subsets of each stage are input into the deep baseline extraction network: the adjacent joint representation data in the current session stage data subset are subjected to sliding convolution operation by a one-dimensional convolutional layer to obtain local temporal features reflecting local temporal changes. The local temporal features are downsampled and compressed by a pooling layer with a preset pooling step size to obtain compressed temporal features. The compressed temporal features are cyclically encoded by a bidirectional gated recurrent layer along the forward and reverse time directions respectively. The forward encoding result and the reverse encoding result are concatenated according to the corresponding time position to obtain the bidirectional temporal encoding result. The bidirectional temporal encoding result is linearly mapped by a fully connected layer to obtain the stage prototype representation. The similarity between the stage prototype representation and each normal mode prototype vector corresponding to the current session stage in the prototype library is calculated one by one, and the normal mode prototype vector is selected. The selected normal mode prototype vector is input into the baseline reconstruction layer. The baseline reconstruction layer repeatedly expands the normal mode prototype vector according to the time length of the current stage data subset, and generates a dynamic baseline sequence corresponding to the current stage data subset time by time in combination with the time position order of the current stage data subset. The output layer outputs the dynamic baseline sequence. The offset of the current stage data subset is compared with the corresponding dynamic baseline sequence to obtain the offset results of each local time window; Based on the offset results, extract suspicious offset segments that reach the preset suspicious threshold but do not reach the preset abnormal threshold, extract key switching abnormal segments that are located within the preset time window before and after key switching and whose adjacent time position offset difference reaches the preset mutation threshold, extract continuous high offset segments whose offset results are continuously higher than the preset offset threshold within the preset local time window, and output the suspicious offset segments, key switching abnormal segments, and continuous high offset segments as risk preparation data.

6. The secure communication method for IoT terminals based on deep learning according to claim 1, characterized in that, The improved TimeMixer risk evolution model includes an input module, a multi-scale decomposition module, a multi-scale mixing module, and an output module: The input module introduces a multi-source channel grouping input mechanism: the joint representation data and risk preparation data are constructed as independent input channels. The joint representation vector of each time step in the joint representation data channel is input into the first linear projection layer, and the risk preparation vector of each time step in the risk preparation data channel is input into the second linear projection layer, so that the joint representation data channel and the risk preparation data channel are mapped to the same feature dimension. The same time position encoding is added to the two mapped channels, and they are spliced ​​on the feature dimension after being aligned one by one according to the time position to form a grouped input sequence. The grouped input sequence is input into the multi-scale decomposition module, and the original scale sequence and the downsampled scale sequence are constructed in the time dimension respectively. The trend component is extracted by the moving average of each scale sequence, and the fluctuation component is obtained by subtracting the trend component from the corresponding scale sequence. The trend sequence and fluctuation sequence are formed at each scale respectively. The trend and fluctuation sequences at each scale are input into the multi-scale mixing module. Within each scale, the trend and fluctuation sequences are mixed at the same scale. Between different scales, the local change features in the fine scale are transmitted to the coarse scale, and the overall change features in the coarse scale are transmitted back to the fine scale, forming a multi-scale time series representation. The output module introduces a multi-baseline offset guidance mechanism: the offset comparison results in the risk preparation data are constructed in chronological order, and the offset sequence is input into the offset projection layer to obtain the offset guidance sequence corresponding to the multi-scale time series representation at the time position. The offset guidance sequence is matched with the multi-scale time series representation one by one according to the time position, and the multi-scale time series representation and the corresponding offset guidance vector at each time position are combined dimension by dimension to form the risk evolution representation. Risk evolution representation is mapped to risk components to obtain multiple risk components corresponding to the current session. Each risk component is concatenated in chronological order, and the concatenated risk component sequence is hierarchically mapped to form a hierarchical risk state.

7. The IoT terminal secure communication method based on deep learning according to claim 1, characterized in that, Step six specifically includes: Read the hierarchical risk state corresponding to the current session, extract the risk components corresponding to each time position of the current session, merge the risk components according to the control meaning, and form session hold-up constraints, target access constraints, transmission regulation constraints and link hold-up constraints respectively, which constitute the security constraint set of the current session; After forming a set of security constraints, the communication state at the current moment is constructed, which includes session hold-up state, target access state, transmission conditioning state, and link hold-up state. Construct candidate communication adjustment quantities, which include session persistence adjustment quantities, target access adjustment quantities, transmission adjustment quantities and link persistence adjustment quantities. Each candidate communication adjustment quantity represents a set of joint adjustment actions for the current session communication behavior. Apply the candidate communication adjustment quantities to the communication state at the current time to obtain the predicted communication state. After obtaining the predicted communication state, the control barrier function is used to express the set of security constraints. Control barrier constraints are established for session persistence constraints, target access constraints, transmission regulation constraints and link persistence constraints, respectively. During the candidate communication regulation screening process, each candidate communication regulation is substituted into the session persistence control barrier constraint, target access control barrier constraint, transmission regulation control barrier constraint, and link persistence control barrier constraint for judgment. When the candidate communication regulation makes any control barrier constraint invalid, it is determined that the current candidate communication regulation will cause the predicted communication state to exceed the safety constraint range and is removed from the candidate set. When the candidate communication regulation makes all control barrier constraints valid, it is determined that the predicted communication state is still within the safety constraint range after the current candidate communication regulation is applied and the current candidate communication regulation is retained. All retained candidate communication modifiers are combined into a set of secure and feasible modifiers. Combinations of modifiers used to maintain secure communication in the current session are selected from the set of secure and feasible modifiers to form a secure communication maintenance strategy.

8. The secure communication method for IoT terminals based on deep learning according to claim 1, characterized in that, Step seven specifically includes: The adjustment items in the secure communication maintenance strategy are analyzed to determine the execution object and execution method corresponding to each adjustment item, and the secure communication maintenance strategy is decomposed into a set of execution instructions; The set of execution instructions is allocated to the corresponding execution layer according to the execution object. Each execution layer executes the corresponding execution instructions and collects the execution results returned by each execution layer. The execution results are checked for consistency with the secure communication maintenance policy. When the execution results are consistent with the secure communication maintenance policy, the hierarchical control execution of the current session is completed.

Images