Medical internet of things edge cloud intrusion detection method and device

Abstract

The application provides a medical Internet of Things edge cloud intrusion detection method and device. The application comprises the following steps: an edge gateway collects terminal traffic and extracts traffic features; the features are cleaned to remove sensitive identifiers and leakage fields; the feature abstract is screened according to feature sorting, and the attack probability is determined through a binary classification detector; normal and suspicious traffic is distinguished by combining a threshold value, and local release or uploading to the cloud is performed to complete multi-classification diagnosis and alarm. The scheme takes into account privacy protection and detection efficiency, and improves the security protection capability of the medical Internet of Things.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection technology, and in particular to a method and apparatus for intrusion detection in medical Internet of Things (IoT) edge cloud. Background Technology

[0002] As a crucial component of smart healthcare systems, the Internet of Things (IoT) in healthcare is widely applied to the remote monitoring and data interaction of terminal devices such as wearable sensors, bedside monitors, and infusion pumps. Among related technologies, a medical device internet system covering data acquisition, transmission, and analysis has been constructed through the collaborative operation of medical gateways, message queue telemetry transmission equipment, hospital networks, and cloud security centers. Specifically, this system encompasses the entire chain from terminal traffic generation to cloud security analysis, including key aspects such as network traffic feature extraction, attack detection, and alarm response, aiming to ensure the continuity and security of patient monitoring and telemedicine services.

[0003] However, existing intrusion detection methods, particularly centralized cloud-based solutions, directly upload large amounts of raw data packets, complete traffic characteristics, and direct identifiers such as addresses, ports, and timestamps, without performing lightweight initial screening and identifier cleaning at the edge. This can lead to a significant increase in bandwidth consumption and detection latency, while also posing privacy risks. Furthermore, while edge-based detection solutions can reduce upload volume, they are limited by gateway computing power and storage resources, making it difficult to handle multi-class diagnostic tasks for all attack groups. Additionally, they lack the opportunity for cloud-based correction when attack traffic is mistakenly classified as normal, thus impacting the overall security protection capabilities and deployment versatility of medical IoT systems. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] Therefore, the first objective of this invention is to propose a method for detecting intrusions into the edge cloud of the medical Internet of Things.

[0006] Another objective of this invention is to provide a medical Internet of Things (IoT) edge cloud intrusion detection device.

[0007] The third objective of this invention is to provide a computer device.

[0008] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0009] To achieve the above objectives, a first aspect of the present invention provides a method for intrusion detection in the edge cloud of a medical Internet of Things, comprising:

[0010] S10, the edge gateway acquires the network traffic generated by the medical IoT terminal and extracts the traffic characteristics of the network traffic; S20, perform identifier cleaning on the traffic features to remove or mask direct identifiers and leaking fields, and obtain a cleaned set of traffic features; S30, based on the feature ranking results obtained from pre-training, a preset number of features are selected from the cleaned traffic feature set to form a feature summary, and the feature summary is input into the binary classification detector deployed on the edge gateway to obtain the attack probability or attack score; S40, compare the attack probability or attack score with a preset threshold. When the comparison result indicates that the network traffic is normal traffic, perform local allow on the edge gateway side. When the comparison result indicates that the network traffic is suspicious traffic, send the feature digest to the cloud security center. The cloud security center performs multi-class attack diagnosis based on the feature digest, outputs attack family diagnosis results and triggers alarm response.

[0011] In one embodiment of the present invention, S10 includes: Extract one or more of the following as traffic features: packet length statistics, number of packets, number of bytes, duration, uplink and downlink statistics, connection status, protocol type, control flags, arrival interval, flow rate, and message length.

[0012] In one embodiment of the present invention, the direct identifier and the leaked field include: One or more of the following: source Internet Protocol address, destination Internet Protocol address, media access control address, source port, destination port, timestamp, packet sequence number, device identifier, session capture identifier, and dataset label.

[0013] In one embodiment of the present invention, after performing identifier cleaning on the traffic characteristics, the method further includes: The numerical features are imputed and scaled, and the low cardinality categorical features are encoded so that the cleaned traffic feature set can be shared by the edge binary classification detector and the cloud multi-classification detector.

[0014] In one embodiment of the present invention, the feature ranking result is obtained through an offline training phase, the offline training phase including: Perform identifier cleaning on the training traffic in the same way as during the runtime phase; rank the cleaned features based on supervised relevance scores, ANOVA F-values, mutual information, model importance, or a combination thereof; The feature indices to be retained are determined based on the preset feature budget K; We trained an edge model for binary classification of normal and attack groups, and a cloud model for multi-class classification of attack groups, respectively.

[0015] In one embodiment of the present invention, the preset threshold is calibrated based on at least one of cloud upgrade ratio, false alarm rate, false alarm rate and number of uploaded bytes, so that the edge gateway achieves a preset balance between the risk of false alarm and cloud communication overhead. The cloud upgrade ratio is determined by the ratio of the number of traffic identified as suspicious and sent to the cloud security center to the total number of traffic, and the number of uploaded bytes is determined by the byte length of the serialized feature digest.

[0016] In one embodiment of the present invention, an offline training phase is further included, the offline training phase comprising: Obtain historical medical IoT traffic samples and perform identifier cleaning on the samples; The cleaned features are sorted using a feature sorter to obtain a sorted feature list; Select the K value and determine the Top-K feature index based on the edge gateway's computational budget, bandwidth budget, and diagnostic quality requirements; The edge binary classification detector and the cloud multi-class detector are trained using Top-K feature summaries; the candidate thresholds are calibrated by iterating through the validation set to determine the preset threshold.

[0017] To achieve the above objectives, a second aspect of the present invention provides a medical IoT edge cloud intrusion detection device, comprising: The traffic acquisition feature extraction module is used by the edge gateway to acquire network traffic generated by medical IoT terminals and extract the traffic features of the network traffic. The data cleaning module is used to perform identifier cleaning on the traffic features, remove or mask direct identifiers and leaking fields, and obtain a cleaned set of traffic features. The feature filtering and detection module is used to select a preset number of features from the cleaned traffic feature set according to the feature ranking results obtained through pre-training, form a feature summary, and input the feature summary into a binary classification detector deployed on the edge gateway to obtain the attack probability or attack score. The traffic identification and linkage handling module is used to compare the attack probability or attack score with a preset threshold. When the comparison result indicates that the network traffic is normal traffic, local passage is performed on the edge gateway side. When the comparison result indicates that the network traffic is suspicious traffic, the feature digest is sent to the cloud security center. The cloud security center performs multi-class attack diagnosis based on the feature digest, outputs attack family diagnosis results, and triggers alarm response.

[0018] The medical IoT edge cloud intrusion detection method and apparatus of this invention can reduce network bandwidth consumption and privacy exposure risks, while improving edge detection efficiency and fine-grained diagnosis of cloud-based attackers.

[0019] To achieve the above objectives, a third aspect of this application provides a computer device, including a processor and a memory; wherein the processor runs a program corresponding to the executable program code by reading executable program code stored in the memory, for implementing the method described in the first aspect embodiment.

[0020] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the method described in the first aspect.

[0021] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0022] Figure 1 This is a flowchart of a medical IoT edge cloud intrusion detection method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the system structure according to an embodiment of the present invention; Figure 3 This is a flowchart of the operation phase detection according to an embodiment of the present invention; Figure 4 This is a flowchart of offline training and deployment according to an embodiment of the present invention; Figure 5 It is the Top- according to the embodiment of the present invention K Feature summary structure diagram; Figure 6 This is a structural diagram of a medical IoT edge cloud intrusion detection device according to an embodiment of the present invention; Figure 7 It is a computer device according to an embodiment of the present invention. Detailed Implementation

[0023] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] The following description, with reference to the accompanying drawings, describes a medical IoT edge cloud intrusion detection method and apparatus according to an embodiment of the present invention.

[0026] Figure 1 This is a flowchart of a medical IoT edge cloud intrusion detection method according to an embodiment of the present invention, such as... Figure 1 As shown, it includes: S10, the edge gateway acquires the network traffic generated by the medical IoT terminal and extracts the traffic characteristics of the network traffic; S20, perform identifier cleaning on the traffic features to remove or mask direct identifiers and leaking fields, and obtain a cleaned set of traffic features; S30, based on the feature ranking results obtained from pre-training, a preset number of features are selected from the cleaned traffic feature set to form a feature summary, and the feature summary is input into the binary classification detector deployed on the edge gateway to obtain the attack probability or attack score; S40, compare the attack probability or attack score with a preset threshold. When the comparison result indicates that the network traffic is normal traffic, perform local allow on the edge gateway side. When the comparison result indicates that the network traffic is suspicious traffic, send the feature digest to the cloud security center. The cloud security center performs multi-class attack diagnosis based on the feature digest, outputs attack family diagnosis results and triggers alarm response.

[0027] like Figure 2 As shown, the system of the present invention includes a medical IoT terminal 1, an edge gateway 2, a cloud security center 3, and an offline training module 11. The medical IoT terminal 1 may include wearable sensors, bedside monitors, infusion pumps, medical gateways, MQTT terminals, or other medical devices with network communication capabilities. The edge gateway 2 is deployed at the hospital's local area network, ward gateway, edge server, or secure access device to process traffic from the medical IoT terminal 1 locally. The cloud security center 3 is used to receive summaries of suspicious traffic and perform attack family diagnosis, alerts, and responses.

[0028] Furthermore, the edge gateway 2 includes a traffic feature extraction module 4, an identifier cleaning module 5, and a Top- K Feature summarization module 6, edge binary classification detector 7, and threshold determination module 8. Traffic feature extraction module 4 extracts statistical features, protocol features, direction features, byte count features, duration features, and connection state features from data packets, unidirectional flows, bidirectional flows, or sessions. Identifier cleaning module 5 removes one or more of the following: source Internet Protocol address, destination Internet Protocol address, Media Access Control address, source port, destination port, timestamp, packet sequence number, device identifier, collection identifier, and dataset label. Top- KFeature summarization module 6 selects K features based on the feature index generated during the training phase to obtain Top- K Feature summary 13. Edge binary classification detector 7 outputs attack probability or attack score based on the summary. Threshold determination module 8 compares the attack probability or attack score with threshold calibration parameter 17 to determine whether traffic enters the local allow branch 14 or the cloud upgrade branch 15.

[0029] Furthermore, the cloud security center 3 includes a cloud-based multi-classification detector 9 and an alarm response module 10. The cloud-based multi-classification detector 9, based on the Top-level data uploaded by the cloud upgrade branch 15, performs an alarm response based on the data. K Feature summary 13, output attack family diagnostic results 16. Alarm response module 10 generates security alarms, blocking suggestions, traffic tags, handling work orders or security audit records based on attack family diagnostic results 16.

[0030] like Figure 3 As shown, the operational phase of the present invention may include the following steps.

[0031] Step S1: Edge gateway 2 receives network traffic from medical IoT terminal 1. The network traffic can be data packets, one-way streams, or bidirectional streams formed by TCP, UDP, MQTT, HTTP, Modbus, dedicated medical device protocols, or combinations thereof.

[0032] In step S2, the traffic feature extraction module 4 extracts features from the network traffic to form an initial traffic feature vector. The initial traffic feature vector may include one or more of the following: packet length statistics, number of packets, number of bytes, duration, uplink and downlink statistics, connection status, protocol type, control flags, arrival interval, flow rate, and message length.

[0033] In step S3, the identifier cleaning module 5 performs cleaning processing on the initial traffic feature vector to obtain a cleaned traffic feature set 12. The cleaning process includes at least removing or masking direct identifiers and leaked fields; furthermore, it may include missing value imputation, outlier pruning, numerical scaling transformation, low-cardinality class encoding, and field version alignment. Through this step, subsequent model decisions do not rely on specific addresses, ports, times, or device identities.

[0034] Step S4, Top- K Feature summarization module 6 selects K features from the cleaned traffic feature set 12 according to the feature index determined in the offline training phase, forming a Top-... K Feature Summary 13. The Top- K Feature summary 13 may include feature index, feature name, feature value, normalization parameter version and summary version number, but may not include original data packet, Internet Protocol address, port number, timestamp or device direct identifier.

[0035] Step S5, edge binary classification detector 7 pairs Top- K Feature summary 13 is used for inference to output attack probability or attack score. s ( x The edge binary classification detector 7 can be implemented using random forest, gradient boosting tree, lightweight neural network, logistic regression, decision tree, or a combination thereof.

[0036] Step S6, the threshold determination module 8 determines the attack probability or attack score. s ( x ) and threshold τ Comparison. When s ( x ) <τ When the traffic is determined to be normal or low-risk, it is allowed to proceed through local branch 14. s ( x ) ≥τ At that time, the traffic was determined to be suspicious and entered the cloud upgrade branch 15.

[0037] Step S7, for traffic entering the cloud upgrade branch 15, edge gateway 2 will... K Feature digest 13 is sent to Cloud Security Center 3. Because the uploaded object is a digest rather than the original data packet or the complete feature set, the number of uploaded bytes and direct identifier exposure can be reduced.

[0038] Step S8, Cloud-based multi-class detector 9 based on Top- K Feature Summary 13 outputs Attack Family Diagnostic Results 16. Attack Family Diagnostic Results 16 may include scanning attacks, brute-force attacks, denial-of-service attacks, distributed denial-of-service attacks, data injection attacks, abnormal telemetry attacks, or normal review results.

[0039] In step S9, the alarm response module 10 generates alarms, handling suggestions, blocking strategies, audit logs, or operation and maintenance notices based on the attack family diagnosis results 16.

[0040] like Figure 4 As shown, the offline training module 11 is used to generate the models and parameters required for the edge gateway 2 and the cloud security center 3.

[0041] In one embodiment of the present invention, the offline training module 11 first acquires historical medical IoT traffic samples and performs identifier cleaning on the training set, validation set, and test set in the same manner as during the runtime phase. To avoid data leakage, the feature sorter only fits the data on the training set. The feature sorter can use ANOVA F-value, mutual information, model importance, SHAP value, chi-square statistic, or a combination thereof to obtain a feature sorting list. Based on the computational budget, bandwidth budget, and diagnostic quality requirements of the edge gateway 2, a K value is selected and the Top-value is determined. K Feature index.

[0042] Furthermore, the offline training module 11 uses Top- K The edge binary classification detector 7 is trained using feature summaries to output a binary classification result or attack probability between normal and attack traffic; simultaneously, the cloud multi-class detector 9 is trained to classify suspicious traffic into attack families. The edge binary classification detector 7 and the cloud multi-class detector 9 can share the same cleaning rules and feature summary structure to avoid feature inconsistencies between training and operation.

[0043] Furthermore, during the threshold calibration process, the offline training module 11 can iterate through the candidate thresholds on the validation set. τ The cloud upgrade ratio, false positive rate, false negative rate, and number of bytes uploaded are calculated. The cloud upgrade ratio can be expressed as:

[0044] in, n To verify the sample size, s ( xi ) is the first i The attack probability or attack score of each sample. If BK Indicates Top- K The length of the serialized feature summary in bytes. Bd Let represent the byte length of the serialized features after all cleaning is performed. The reduction ratio compared to uploading all cleaned features can be expressed as:

[0045] Deployers can select thresholds based on the hospital network's security level, alarm tolerance, and bandwidth budget. For example, in intensive care scenarios, the threshold can be lowered to reduce false negatives; in scenarios with limited bandwidth or high false alarm costs, the threshold can be increased and combined with manual verification.

[0046] like Figure 5 As shown, Top- KFeature digest 13 can be represented as key-value pairs, arrays, tables, binary serialized objects, or message queue records. Each digest unit may include a feature index, feature name, feature value, data type, and normalized version. The digest header may include a digest version, model version, K-value, non-directly identified encoding of the gateway number, and a checksum field. The digest does not carry the original data packet, source address, destination address, port number, original timestamp, or direct device identifier.

[0047] In one embodiment of the present invention, the edge gateway 2 generates and sends a Top-Level report only when the threshold determination module 8 determines the traffic to be suspicious. K Feature Summary 13. For locally allowed branch 14, edge gateway 2 may retain only local logs, counters, or short-term caches without sending a summary of the traffic to cloud security center 3.

[0048] In one embodiment of the present invention, the traffic of the medical IoT terminal 1 can be characterized at three granularities: packet level, unidirectional flow level, and bidirectional flow level. The edge gateway 2 selects one or more of these granularities based on its device capabilities. For gateways capable of maintaining short-term session states, bidirectional flow level features can be used preferentially; for gateways with more limited resources, unidirectional flow level or packet level features can be used as early alarm criteria.

[0049] In one embodiment of the present invention, the threshold calibration parameter 17 can be configured according to department, equipment type, protocol type, time period, or security level. The edge gateway 2 can periodically receive updated thresholds, model versions, and Top-level information from the cloud security center 3. K Feature index.

[0050] In one embodiment of the present invention, after the cloud-based multi-class detector 9 outputs the attack family diagnosis result 16, the confirmed sample, false positive sample or false negative sample can be returned to the offline training module 11 for updating the feature sorter, edge binary detector 7, cloud-based multi-class detector 9 and threshold calibration parameter 17.

[0051] In one embodiment of the present invention, the identifier cleaning module 5 can also remove physiological measurement fields or business-sensitive fields, retaining only network behavior characteristics, thereby adapting to a more stringent data minimization strategy.

[0052] The embodiments of this invention also have the following technical effects: The edge gateway only undertakes binary classification screening of normal and attack traffic, reducing the complexity of the edge-side model and the inference load. Only traffic deemed suspicious is escalated to the cloud security center; normal traffic is allowed to pass locally at the edge, thereby reducing the number of cloud requests and communication overhead. The uploaded object is a cleaned Top-K feature digest, rather than the original data packet, complete traffic record, address, port, timestamp, or direct device identifier, thereby reducing the exposure of original traffic and direct identifiers. The cloud security center only performs multi-class attack family diagnosis on suspicious traffic, enabling the system to obtain fine-grained attack categories such as scanning, brute-force attacks, denial-of-service, distributed denial-of-service, and data injection while maintaining the lightweight nature of the edge. The threshold can be calibrated based on the cloud upgrade ratio, false positive rate, false negative rate, and number of uploaded bytes, allowing deployers to make measurable configurations for missed detection risks, alarm pressure, and bandwidth budgets.

[0053] To achieve the above embodiments, such as Figure 6 As shown, this embodiment also provides a medical IoT edge cloud intrusion detection device 10, including: The traffic acquisition feature extraction module 100 is used by the edge gateway to acquire network traffic generated by medical IoT terminals and extract the traffic features of the network traffic. The data cleaning module 200 is used to perform identifier cleaning on the traffic features, remove or mask direct identifiers and leaking fields, and obtain a cleaned set of traffic features. The feature filtering and detection module 300 is used to select a preset number of features from the cleaned traffic feature set according to the feature ranking results obtained through pre-training, form a feature summary, and input the feature summary into a binary classification detector deployed on the edge gateway to obtain the attack probability or attack score. The traffic discrimination and linkage handling module 400 is used to compare the attack probability or attack score with a preset threshold. When the comparison result indicates that the network traffic is normal traffic, local passage is performed on the edge gateway side. When the comparison result indicates that the network traffic is suspicious traffic, the feature digest is sent to the cloud security center. The cloud security center performs multi-class attack diagnosis based on the feature digest, outputs attack family diagnosis results, and triggers alarm response.

[0054] This invention provides a medical IoT edge cloud intrusion detection device that can reduce network bandwidth overhead and privacy exposure risks, while improving edge-side detection efficiency and fine-grained diagnosis of cloud-based attackers.

[0055] To implement the methods of the above embodiments, the present invention also provides a computer device, such as... Figure 7As shown, the computer device 600 includes a memory 601 and a processor 602; wherein, the processor 602 reads executable program code stored in the memory 601 to run a program corresponding to the executable program code, so as to implement the various steps of the method described above.

[0056] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0057] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0058] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A medical Internet of Things edge cloud intrusion detection method, characterized in that, include: S10, the edge gateway acquires the network traffic generated by the medical IoT terminal and extracts the traffic characteristics of the network traffic; S20, perform identifier cleaning on the traffic features to remove or mask direct identifiers and leaking fields, and obtain a cleaned set of traffic features; S30, based on the feature ranking results obtained from pre-training, a preset number of features are selected from the cleaned traffic feature set to form a feature summary, and the feature summary is input into the binary classification detector deployed on the edge gateway to obtain the attack probability or attack score; S40, compare the attack probability or attack score with a preset threshold. When the comparison result indicates that the network traffic is normal traffic, perform local allow on the edge gateway side. When the comparison result indicates that the network traffic is suspicious traffic, send the feature digest to the cloud security center. The cloud security center performs multi-class attack diagnosis based on the feature digest, outputs attack family diagnosis results, and triggers an alarm response.

2. The method of claim 1, wherein, S10 includes: Extract one or more of the following as traffic features: packet length statistics, number of packets, number of bytes, duration, uplink and downlink statistics, connection status, protocol type, control flags, arrival interval, flow rate, and message length.

3. The method of claim 1, wherein, The direct identifier and leaked fields include: One or more of the following: source Internet Protocol address, destination Internet Protocol address, media access control address, source port, destination port, timestamp, packet sequence number, device identifier, session capture identifier, and dataset label.

4. The method of claim 1, wherein, After performing identifier cleaning on the traffic characteristics, the method further includes: The numerical features are imputed and scaled, and the low cardinality categorical features are encoded so that the cleaned traffic feature set can be shared by the edge binary classification detector and the cloud multi-classification detector.

5. The method of claim 1, wherein, The feature ranking result is obtained through an offline training phase, which includes: Perform identifier cleaning on the training traffic in the same way as during the runtime phase; rank the cleaned features based on supervised relevance scores, ANOVA F-values, mutual information, model importance, or a combination thereof; The feature indices to be retained are determined based on the preset feature budget K; We trained an edge model for binary classification of normal and attack groups, and a cloud model for multi-class classification of attack groups, respectively.

6. The method of claim 1, wherein, The preset threshold is calibrated based on at least one of cloud upgrade ratio, false alarm rate, false alarm rate and number of uploaded bytes, so that the edge gateway achieves a preset balance between the risk of false alarm and cloud communication overhead. The cloud upgrade ratio is determined by the ratio of the number of traffic identified as suspicious and sent to the cloud security center to the total number of traffic, and the number of uploaded bytes is determined by the byte length of the serialized feature digest.

7. The method of claim 1, wherein, It also includes an offline training phase, which includes: Obtain historical medical IoT traffic samples and perform identifier cleaning on the samples; The cleaned features are sorted using a feature sorter to obtain a sorted feature list; Select the K value and determine the Top-K feature index based on the edge gateway's computational budget, bandwidth budget, and diagnostic quality requirements; The edge binary classification detector and the cloud multi-class detector are trained using Top-K feature summaries; the candidate thresholds are calibrated by iterating through the validation set to determine the preset threshold. 8.A medical Internet of Things edge cloud intrusion detection device, characterized in that, include: The traffic acquisition feature extraction module is used by the edge gateway to acquire network traffic generated by medical IoT terminals and extract the traffic features of the network traffic. The data cleaning module is used to perform identifier cleaning on the traffic features, remove or mask direct identifiers and leaking fields, and obtain a cleaned set of traffic features. The feature filtering and detection module is used to select a preset number of features from the cleaned traffic feature set according to the feature ranking results obtained through pre-training, form a feature summary, and input the feature summary into a binary classification detector deployed on the edge gateway to obtain the attack probability or attack score. The traffic identification and linkage handling module is used to compare the attack probability or attack score with a preset threshold. When the comparison result indicates that the network traffic is normal traffic, local passage is performed on the edge gateway side. When the comparison result indicates that the network traffic is suspicious traffic, the feature digest is sent to the cloud security center. The cloud security center performs multi-class attack diagnosis based on the feature digest, outputs attack family diagnosis results, and triggers alarm response.

9. A computer device, comprising: Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the method as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium having stored thereon a computer program, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

Images