Risk portrait-based internet of things edge device protocol access management and control method, system and device

Abstract

The present application belongs to the technical field of Internet of Things edge computing and network security, and particularly relates to an Internet of Things edge device protocol access control method, system and device based on risk profiling. A plurality of risk information original observation values are collected, which are divided into three categories of basic factors, amplification factors and hard triggers according to risk action mechanisms. The risk information original observation values are mapped to normalized scores through a scoring function. The normalized scores corresponding to the basic factors are weighted and summed to form a basic risk value. The normalized scores corresponding to the amplification factors are coupled through multiplication to form an amplification coefficient. The normalized scores corresponding to the hard triggers are directly weighted and added as a fixed increment. The final risk value is calculated based on the basic risk value, the amplification coefficient and the fixed increment. The final risk value is mapped to four discrete risk levels. Compared with the traditional JWT token scheme, the present application realizes an upgrade from single static authentication to multi-dimensional dynamic evaluation, and is suitable for access trust control of multi-protocol heterogeneous terminals in various scenarios.

Description

Technical Field

[0001] This invention belongs to the field of IoT edge computing and network security technology, specifically relating to a method, system, and device for managing IoT edge device protocol access based on risk profiling. Background Technology

[0002] With edge IoT agents breaking down core functionalities into multiple containerized microservices, numerous differentiated security risks arise when devices from different regions and using different protocols connect to the edge IoT agent. Existing solutions generally use JWT (JSON Web Token) tokens for device authentication and authorization management. The following are prominent defects in practical applications: In traditional solutions, devices are authenticated via JWT tokens after being connected. Once the token is verified, the device gains the same trust level and access permissions in all subsequent processing containers.

[0003] JWT tokens have a globally consistent security level, lacking differentiated control capabilities, resulting in high-risk protocol devices and low-risk protocol devices receiving the same processing policies. Summary of the Invention

[0004] The purpose of this invention is to provide a method, system, and apparatus for managing and controlling IoT edge device protocol access based on risk profiling.

[0005] The method for managing IoT edge device protocol access based on risk profiling includes the following steps: S1. During the terminal access and protocol parsing phases of the edge IoT agent, the original observation values ​​of risk information of the terminal devices accessing the edge IoT agent are collected from several dimensions and classified into three categories according to the risk action mechanism: basic factors, amplification factors and hard triggers. S2. The original observations of risk information of the basic factor and the amplification factor are mapped to normalized scores through a scoring function, and the original observations of risk information of the hard trigger are represented as 0 or 1 as their normalized scores. S3. Weighted summation of the normalized scores corresponding to the basic factors to form the basic risk value; The normalized scores corresponding to the amplification factor are coupled by multiplication to form the amplification coefficient; The normalized scores corresponding to the hard triggers are directly weighted and summed as a fixed increment; The final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment. S4. Map the final risk value to the discrete risk level of the four terminal devices connected to the edge IoT agent.

[0006] S1 collects raw observations of risk information from terminal devices connected to the edge IoT agent from several dimensions, and classifies them into three categories according to the risk action mechanism: basic factors, amplification factors, and hard triggers. Risk information collected from terminal devices connected to the edge IoT agent across several dimensions includes: terminal identity, data protocol type, business region to which the device belongs, message structure integrity, message operation type, deviation of historical access behavior, number of abnormal accesses, whether it is the first access, and whether there are any unauthorized access records. Among them, terminal identity, data protocol type, and the business region to which the device belongs are the basic factors; Message structure integrity, message operation type, deviation of historical access behavior, and number of abnormal accesses are divided into amplification factors; Whether it's the first time accessing the site and whether there are any unauthorized access records are considered hard triggers.

[0007] In S2, the raw observations of the risk information of hard triggers are represented as 0 or 1 as their normalized scores, specifically: The original observation value d8 of the risk information regarding whether it is the first access and the original observation value d9 of the risk information regarding whether there is an unauthorized access record are directly represented as Boolean variables: d8∈{0,1} and d9∈{0,1}, and their normalized scores s8 and s9 are equal to the values ​​of d8 and d9, respectively. Wherein, d8=1 indicates that the terminal is accessing for the first time and has no historical behavior profile, d8=0 indicates that it is not accessing for the first time; d9=1 indicates that the terminal has a confirmed history of unauthorized access, d9=0 indicates that there is no unauthorized access record.

[0008] In S3, the normalized scores corresponding to the basic factors are weighted and summed to form the basic risk value, specifically: , in, R base is the basic risk value. , , Based on the basic factor weights, For terminal identity normalization scoring, Normalize the scoring for data protocol types. The equipment is assigned a normalized score for its business region.

[0009] In S3, the normalized score corresponding to the amplification factor is coupled through multiplication to form the amplification coefficient, specifically: , in, M amp is the magnification factor. This is a message structure integrity amplification factor. To normalize the score for message structure integrity, This is a scaling factor for message operation types. For message operation type normalization scoring, This is an amplification factor for the number of abnormal accesses. Normalize the score for the number of abnormal visits. The raw observation values ​​for risk information regarding whether it is the first time accessed. The amplification factor for the j-th original observation of risk information is... Let be the normalized score of the j-th original observation of risk information, where j is the j-th original observation of risk information.

[0010] In S3, the scores corresponding to the hard triggers are directly weighted and summed as a fixed increment, specifically: , in, R The trigger is a fixed increment. This is an overlay factor indicating whether it is the first time the device has been connected. The raw observation values ​​for risk information regarding whether it is the first time accessed. The presence of an overlay factor indicating whether unauthorized access records exist. The raw observations are for risk information regarding whether there are records of unauthorized access.

[0011] In S3, the final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment, specifically as follows: , Where R is the final risk value, R base is the basic risk value. M amp is the magnification factor. R The trigger is a fixed increment.

[0012] In S4, the final risk value is mapped to the discrete risk levels of the four terminal devices accessing the edge IoT agent, specifically: If the first threshold ≤ the final risk value < the second threshold, then the terminal device connected to the edge IoT agent will be marked as LI trust level; If the second threshold is less than or equal to the final risk value and less than the third threshold, then the terminal device connected to the edge IoT agent will be marked as L2 level of concern. If the third threshold is less than or equal to the final risk value and less than the fourth threshold, the terminal device connected to the edge IoT agent will be marked as L3 high-risk level. If the fourth threshold is less than or equal to the final risk value and less than or equal to the fifth threshold, then the terminal device connected to the edge IoT agent will be marked as L4 blocking level.

[0013] The IoT edge device protocol access control system based on risk profiling is used to implement a method for controlling IoT edge device protocol access based on risk profiling, including: The risk data acquisition module collects raw observations of risk information from terminal devices accessing the edge IoT agent from several dimensions during the terminal access and protocol parsing phases of the edge IoT agent. Based on the risk action mechanism, these observations are categorized into three types: basic factors, amplification factors, and hard triggers. The scoring module maps the original observations of risk information of the basic factor and the amplification factor to normalized scores through a scoring function, and represents the original observations of risk information of the hard trigger as 0 or 1 as its normalized score. The final risk value calculation module performs a weighted summation of the normalized scores corresponding to the basic factors to form the basic risk value; The normalized scores corresponding to the amplification factor are coupled by multiplication to form the amplification coefficient; The normalized scores corresponding to the hard triggers are directly weighted and summed as a fixed increment; The final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment. The risk mapping module maps the final risk value to the discrete risk level of the four terminal devices connected to the edge IoT agent.

[0014] An IoT edge device protocol access control device based on risk profiling includes a processor and a memory, wherein the processor executes a computer program stored in the memory to implement an IoT edge device protocol access control method based on risk profiling.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention overcomes the limitation of JWT tokens relying solely on the single dimension of device identity, integrating information from nine dimensions to construct a comprehensive risk profile. Compared to the binary "pass / reject" judgment of JWT tokens, this invention outputs a precise mapping of continuous risk scores to four discrete levels, improving the granularity of security control from "whether it is trustworthy" to "how trustworthy it is," thus increasing the fineness by an order of magnitude.

[0016] This invention no longer relies on the single identity information in a JWT token to determine permissions. Instead, it introduces the protocol type dimension as a fundamental factor, quantifying the security attributes of the protocol itself into a risk score. It detects the actual protocol type and security configuration used by the device, with different protocols corresponding to different score values. This score directly participates in the weighted summation of the base risk value, ensuring that devices using high-risk protocols receive a higher base risk score from the outset, thus mapping to a higher risk level and triggering stricter container isolation policies. Devices using low-risk protocols, on the other hand, are assigned to a normal protocol container pool for normal processing.

[0017] This invention supports risk reassessment and level adjustment at the second level, breaking the static mode of JWT tokens. When device behavior is abnormal (such as sending malformed messages or attempting unauthorized operations), the risk score responds immediately, the isolation level is upgraded instantly, compressing the attacker's exploit window from the JWT token's validity period to the second level, and reducing the attack spread rate to near zero. Detailed Implementation

[0018] To further understand the content of this invention, the invention will be described in detail with reference to the embodiments.

[0019] This invention relates to a method for managing and controlling IoT edge device protocol access based on risk profiling, which includes the following steps: S1. During the terminal access and protocol parsing phases of the edge IoT agent, the original observation values ​​of risk information of the terminal devices accessing the edge IoT agent are collected from several dimensions and classified into three categories according to the risk action mechanism: basic factors, amplification factors, and hard triggers.

[0020] Specifically, during the terminal access and protocol parsing phases, raw observations of risk information were collected from nine dimensions in Table 1. These nine dimensions are categorized into three types based on their mechanism of action: basic factors, amplification factors, and hard triggers. Table 1. Dimensions of Raw Observations for Collected Risk Information

[0021] The data collected from each dimension is as follows: Original observations of terminal identity risk information (d1): the authentication method and authentication strength of the data collection device, including five authentication levels and information on the remaining validity period of the certificate; Raw observations of risk information for data protocol types (d2): Collects the types of industrial protocols used for communication by the acquisition device and their security configuration status, covering mainstream industrial control and IoT protocols such as OPC UA, IEC 61850, IEC 104, PROFINET, EtherNet / IP, MQTT, HTTP, CoAP, Modbus TCP, DL / T645, PROFIBUS, and CAN. The protocol security level is determined based on the actual security negotiation results detected during the handshake phase (whether encryption is enabled and whether authentication is enabled). Raw observations of risk information for the business area to which the device belongs (d3): Collect network partition information where the device is located, including six area levels: core production area, business support area, DMZ area, office access area, visitor / IoT area, and direct Internet access area; Original observations of risk information on message structure integrity (d4): The message compliance score is output by the protocol parsing engine. The detection items include protocol header format compliance check1, field value range legality check2, message length consistency check3, checksum / CRC pass check4, and nesting structure depth check5. The value of each detection item is 0 or 1. Raw observations (d5) of risk information for message operation types: Identify the operation types contained in the message, including five risk levels: read-only query, data write, configuration change, management operation, and permission change; Risk information raw observations of historical access behavior deviation (d6): measures the degree of deviation of current access behavior from the historical baseline. It is calculated using the cosine similarity of multidimensional behavior vectors. Each component of the behavior vector covers statistics such as request frequency, access ratio of each protocol, and access frequency of each resource in each time period. Risk information for abnormal access counts (raw observations, d7): The cumulative number of abnormal accesses within a specified time window (24 hours recommended); Original observation value (d8) of risk information indicating whether it is the first access: Boolean identifier, first access indicates no historical behavior profile, and the uncertainty is extremely high; Original observation (d9): Boolean identifier, where unauthorized access records are confirmed security event histories.

[0022] The raw observations of risk information from different dimensions are divided into three categories: basic factors, amplification factors, and hard triggers. Risk information collected from terminal devices connected to the edge IoT agent across several dimensions includes: terminal identity, data protocol type, business region to which the device belongs, message structure integrity, message operation type, deviation of historical access behavior, number of abnormal accesses, whether it is the first access, and whether there are any unauthorized access records. Among them, terminal identity, data protocol type, and the business region to which the device belongs are the basic factors; Message structure integrity, message operation type, deviation of historical access behavior, and number of abnormal accesses are divided into amplification factors; Whether it's the first time accessing the site and whether there are any unauthorized access records are considered hard triggers.

[0023] S2. The original observations of risk information for the basic factor and the amplification factor are mapped to normalized scores through a scoring function, and the original observations of risk information for the hard trigger are represented as 0 or 1 as their normalized scores.

[0024] Furthermore, higher scores indicate greater risk, and the scoring functions for each dimension are as follows: The core of terminal identity is authentication strength. The authentication level is the original observed value d1 of the terminal identity risk information. The weaker the authentication method, the higher the risk. The normalized score s1 of terminal identity is mapped as follows: Table 2. Normalized score s1 mapping relationship of terminal identity

[0025] The raw observation d2 of the risk information for the data protocol type includes the protocol's inherent vulnerability v. p And whether to enable transmission encryption p , The specific calculation method for the data protocol type normalization score is as follows: , in, α For the risk factor of the agreement, a value of 0.6 is recommended; Vulnerability of the protocol itself p And whether to enable transmission encryption p The value selection method is shown in Table 3: Table 3. Vulnerabilities of the Protocol Itself p And whether to enable transmission encryption p Value retrieval method

[0026] Logical explanation: Vulnerability of the protocol itself v p The main considerations are three factors: whether the protocol has a built-in authentication mechanism, the complexity of the protocol stack and the number of known vulnerabilities, and the ease with which instructions can be injected or tampered with.

[0027] Enable transmission encryption? p The value is 0 or 1, reflecting whether the protocol actually enables transmission encryption in typical industrial deployments (rather than whether the specification supports encryption—IEC 104 specification allows TLS, but field deployments are almost entirely in plaintext, therefore e...). p =0). The same protocol should take different scores under different security configurations. The system maintains a protocol-security policy mapping table and dynamically selects the value based on the security negotiation result detected during the actual handshake phase (for example, if SecurityPolicy=None is detected during the OPC UA handshake, then 0.70 is used instead of 0.06).

[0028] The original observation value d3 of the risk information of the business area to which the equipment belongs and the normalized score of the business area to which the equipment belongs The mapping relationship is shown in Table 4.

[0029] Table 4 Normalized Score Values ​​for the Business Region to which the Equipment Belongs

[0030] The initial observations of risk information regarding message structure integrity included five detection results. The compliance score output by the protocol parsing engine Mapped to Message structure integrity normalized score, 100 points represents full compliance: ; , in, w k denoted as the weight of the detection item, k being the kth detection item. The specific detection items and their weight values ​​are shown in Table 5.

[0031] Table 5. Detection Items and Weight Values

[0032] Furthermore, d5 and The message operation type normalized scoring mapping relationship is as follows: If d5 is a read-only query =0.10; If d5 represents data written... =0.35; If d5 indicates a configuration change... =0.60; If d5 is an administrative operation =0.80; If d5 indicates a permission change... =0.95.

[0033] Furthermore, let the historical behavior baseline vector be b, and the original observation value d6 of the risk information of historical access behavior deviation be the current behavior vector c. Each vector represents a statistical measure of a type of behavior characteristic (such as the request frequency of each time period, the access ratio of each protocol, the access frequency of each resource, etc.).

[0034] First, calculate the normalized cosine similarity: , Then, a sigmoid transformation is applied to map the deviation to a risk score, amplifying cases with large deviations, to obtain a normalized score for the deviation of historical visit behavior. : .

[0035] Furthermore, The specific values ​​for the normalized score of abnormal access counts are: , in, This is the half-saturation point; a value of 25 is recommended. Raw observations for risk information regarding the number of abnormal visits. .

[0036] The raw observations of the risk information of hard triggers are represented as 0 or 1 as their normalized scores, specifically: The original observation value d8 of the risk information regarding whether it is the first access and the original observation value d9 of the risk information regarding whether there is an unauthorized access record are directly represented as Boolean variables: d8∈{0,1} and d9∈{0,1}, and their normalized scores s8 and s9 are equal to the values ​​of d8 and d9, respectively. Wherein, d8=1 indicates that the terminal is accessing for the first time and has no historical behavior profile, d8=0 indicates that it is not accessing for the first time; d9=1 indicates that the terminal has a confirmed history of unauthorized access, d9=0 indicates that there is no unauthorized access record.

[0037] S3. Weighted summation of the normalized scores corresponding to the basic factors to form the basic risk value; The normalized scores corresponding to the amplification factor are coupled by multiplication to form the amplification coefficient; The normalized scores corresponding to the hard triggers are directly weighted and summed as a fixed increment; The final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment.

[0038] The final risk score is calculated by combining the base weighted score, the amplification factor, and the hard trigger factor. The basic risk value is formed by weighted summation of the normalized scores corresponding to the basic factors, as follows: , in, R base is the basic risk value. , , Based on the basic factor weights, For terminal identity normalization scoring, Normalize the scoring for data protocol types. The equipment is assigned a normalized score for its business region, with specific values ​​shown in Table 6.

[0039] Table 6. Values ​​of Basic Factor Weights

[0040] The normalized scores corresponding to the amplification factor are coupled through multiplication to form the amplification coefficient. To avoid double penalty from d6 and d8 for the same risk source of "no historical profile," d6 does not participate in the amplification calculation when d8=1. Specifically: , in, M amp is the magnification factor. This is a message structure integrity amplification factor. To normalize the score for message structure integrity, This is a scaling factor for message operation types. For message operation type normalization scoring, This is an amplification factor for the number of abnormal accesses. Normalize the score for the number of abnormal visits. The raw observation values ​​for risk information regarding whether it is the first time accessed. The amplification factor for the j-th original observation of risk information is... Let be the normalized score of the j-th original observation of risk information, where j is the j-th original observation of risk information.

[0041] Recommended magnification factor values ​​are shown in Table 7: Table 7 Recommended Amplification Factor Values

[0042] The scores corresponding to the hard triggers are directly weighted and summed as a fixed increment, specifically: , in, R The trigger is a fixed increment. This is an overlay factor indicating whether it is the first time the device has been connected. The raw observation values ​​for risk information regarding whether it is the first time accessed. The presence of an overlay factor indicating whether unauthorized access records exist. The raw observations are for risk information regarding whether there are records of unauthorized access.

[0043] Recommended values ​​for the superposition factor are: =0.15; =0.25.

[0044] The final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment. The sum of the amplified base weighted result and the hard trigger is taken, with the upper limit truncated to 1. Specifically: , Where R is the final risk value, R base is the basic risk value. M amp is the magnification factor. R The trigger is a fixed increment.

[0045] In particular, when When =1 (unauthorized access records exist), an additional lower limit protection mechanism is activated: R = max(R, 0.60). Terminals with unauthorized access records have a risk score of no less than 0.60.

[0046] S4. Map the final risk value to the discrete risk level of the four terminal devices connected to the edge IoT agent.

[0047] Specifically: If the first threshold ≤ the final risk value < the second threshold, then the terminal device connected to the edge IoT agent will be marked as LI trust level; If the second threshold is less than or equal to the final risk value and less than the third threshold, then the terminal device connected to the edge IoT agent will be marked as L2 level of concern. If the third threshold is less than or equal to the final risk value and less than the fourth threshold, the terminal device connected to the edge IoT agent will be marked as L3 high-risk level. If the fourth threshold is less than or equal to the final risk value and less than or equal to the fifth threshold, then the terminal device connected to the edge IoT agent will be marked as L4 blocking level.

[0048] The final risk value R is mapped to four discrete risk levels, each corresponding to a different container operation strategy, as shown in Table 8: Table 8 Risk Level Classification

[0049] The threshold should be calibrated using ROC curves on historical security event data. The default values ​​mentioned above can be used during initial deployment.

[0050] Unlike the single-point authentication mode of the JWT token scheme, the protocol risk profile of this invention supports continuous dynamic assessment: data from various dimensions is continuously collected during device operation, the risk score is dynamically updated with real-time data, and the risk level is automatically adjusted according to the score changes. When the device behavior changes from normal to abnormal, the risk level can be raised from L1 to L3 or L4 within seconds, triggering the corresponding container isolation policy, without waiting for the JWT token to expire.

[0051] The IoT edge device protocol access control system based on risk profiling is used to implement the aforementioned IoT edge device protocol access control method based on risk profiling, including: The risk data acquisition module collects raw observations of risk information from terminal devices accessing the edge IoT agent from several dimensions during the terminal access and protocol parsing phases of the edge IoT agent. Based on the risk action mechanism, these observations are categorized into three types: basic factors, amplification factors, and hard triggers. The scoring module maps the original observations of risk information of the basic factor and the amplification factor to normalized scores through a scoring function, and represents the original observations of risk information of the hard trigger as 0 or 1 as its normalized score. The final risk value calculation module performs a weighted summation of the normalized scores corresponding to the basic factors to form the basic risk value; The normalized scores corresponding to the amplification factor are coupled by multiplication to form the amplification coefficient; The normalized scores corresponding to the hard triggers are directly weighted and summed as a fixed increment; The final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment. The risk mapping module maps the final risk value to the discrete risk level of the four terminal devices connected to the edge IoT agent.

[0052] An IoT edge device protocol access control device based on risk profiling includes a processor and a memory, wherein the processor executes a computer program stored in the memory to implement an IoT edge device protocol access control method based on risk profiling.

Claims

1. A method for managing and controlling IoT edge device protocol access based on risk profiling, characterized in that, Includes the following steps: S1. During the terminal access and protocol parsing phases of the edge IoT agent, the original observation values ​​of risk information of the terminal devices accessing the edge IoT agent are collected from several dimensions and classified into three categories according to the risk action mechanism: basic factors, amplification factors and hard triggers. S2. The original observations of risk information of the basic factor and the amplification factor are mapped to normalized scores through a scoring function, and the original observations of risk information of the hard trigger are represented as 0 or 1 as their normalized scores. S3. Weighted summation of the normalized scores corresponding to the basic factors to form the basic risk value; The normalized scores corresponding to the amplification factor are coupled by multiplication to form the amplification coefficient; The normalized scores corresponding to the hard triggers are directly weighted and summed as a fixed increment; The final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment. S4. Map the final risk value to the discrete risk level of the four terminal devices connected to the edge IoT agent.

2. The IoT edge device protocol access control method based on risk profiling according to claim 1, characterized in that, S1 collects raw observations of risk information from terminal devices connected to the edge IoT agent from several dimensions, and classifies them into three categories according to the risk action mechanism: basic factors, amplification factors, and hard triggers. Risk information collected from terminal devices connected to the edge IoT agent across several dimensions includes: terminal identity, data protocol type, business region to which the device belongs, message structure integrity, message operation type, deviation of historical access behavior, number of abnormal accesses, whether it is the first access, and whether there are any unauthorized access records. Among them, terminal identity, data protocol type, and the business region to which the device belongs are the basic factors; Message structure integrity, message operation type, deviation of historical access behavior, and number of abnormal accesses are divided into amplification factors; Whether it's the first time accessing the site and whether there are any unauthorized access records are considered hard triggers.

3. The IoT edge device protocol access control method based on risk profiling according to claim 1, characterized in that, In S2, the raw observations of the risk information of hard triggers are represented as 0 or 1 as their normalized scores, specifically: The raw observations of risk information for hard triggers include the raw observation d8 of whether it is the first access and the raw observation d9 of whether there is an unauthorized access record; The original observation value d8 of the risk information regarding whether it is the first access and the original observation value d9 of the risk information regarding whether there is an unauthorized access record are directly represented as Boolean variables: d8∈{0,1} and d9∈{0,1}, and their normalized scores s8 and s9 are equal to the values ​​of d8 and d9, respectively. Wherein, d8=1 indicates that the terminal is accessing for the first time and has no historical behavior profile, d8=0 indicates that it is not accessing for the first time; d9=1 indicates that the terminal has a confirmed history of unauthorized access, d9=0 indicates that there is no unauthorized access record.

4. The IoT edge device protocol access control method based on risk profiling according to claim 1, characterized in that, In S3, the normalized scores corresponding to the basic factors are weighted and summed to form the basic risk value, specifically: ， in, R base is the basic risk value. , , Based on the basic factor weights, For terminal identity normalization scoring, Normalize the scoring for data protocol types. The equipment is assigned a normalized score for its business region.

5. The IoT edge device protocol access control method based on risk profiling according to claim 1, characterized in that, In S3, the normalized score corresponding to the amplification factor is coupled through multiplication to form the amplification coefficient, specifically: ， in, M amp is the magnification factor. This is a message structure integrity amplification factor. To normalize the score for message structure integrity, This is a scaling factor for message operation types. For message operation type normalization scoring, This is an amplification factor for the number of abnormal accesses. Normalize the score for the number of abnormal visits. The raw observation values ​​for risk information regarding whether it is the first time accessed. The amplification factor for the j-th original observation of risk information is... Let be the normalized score of the j-th original observation of risk information, where j is the j-th original observation of risk information.

6. The IoT edge device protocol access control method based on risk profiling according to claim 1, characterized in that, In S3, the scores corresponding to the hard triggers are directly weighted and summed as a fixed increment, specifically: ， in, R The trigger is a fixed increment. This is an overlay factor indicating whether it is the first time the device has been connected. The raw observation values ​​for risk information regarding whether it is the first time accessed. The presence of an overlay factor indicating whether unauthorized access records exist. The raw observations are for risk information regarding whether there are records of unauthorized access.

7. The IoT edge device protocol access control method based on risk profiling according to claim 1, characterized in that, In S3, the final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment, specifically as follows: ， Where R is the final risk value, R base is the basic risk value. M amp is the magnification factor. R The trigger is a fixed increment.

8. The IoT edge device protocol access control method based on risk profiling according to claim 1, characterized in that, In S4, the final risk value is mapped to the discrete risk levels of the four terminal devices accessing the edge IoT agent, specifically: If the first threshold ≤ the final risk value < the second threshold, then the terminal device connected to the edge IoT agent will be marked as LI trust level; If the second threshold is less than or equal to the final risk value and less than the third threshold, then the terminal device connected to the edge IoT agent will be marked as L2 level of concern. If the third threshold is less than or equal to the final risk value and less than the fourth threshold, the terminal device connected to the edge IoT agent will be marked as L3 high-risk level. If the fourth threshold is less than or equal to the final risk value and less than or equal to the fifth threshold, then the terminal device connected to the edge IoT agent will be marked as L4 blocking level.

9. A risk-profile-based IoT edge device protocol access control system, used to implement the risk-profile-based IoT edge device protocol access control method according to any one of claims 1-8, characterized in that, include: The risk data acquisition module collects raw observations of risk information from terminal devices accessing the edge IoT agent from several dimensions during the terminal access and protocol parsing phases of the edge IoT agent. Based on the risk action mechanism, these observations are categorized into three types: basic factors, amplification factors, and hard triggers. The scoring module maps the original observations of risk information of the basic factor and the amplification factor to normalized scores through a scoring function, and represents the original observations of risk information of the hard trigger as 0 or 1 as its normalized score. The final risk value calculation module performs a weighted summation of the normalized scores corresponding to the basic factors to form the basic risk value; The normalized scores corresponding to the amplification factor are coupled by multiplication to form the amplification coefficient; The normalized scores corresponding to the hard triggers are directly weighted and summed as a fixed increment; The final risk value is calculated based on the base risk value, the amplification factor, and the fixed increment. The risk mapping module maps the final risk value to the discrete risk level of the four terminal devices connected to the edge IoT agent.

10. An IoT edge device protocol access control device based on risk profiling, characterized in that, It includes a processor and a memory, wherein when the processor executes a computer program stored in the memory, it implements the IoT edge device protocol access control method based on risk profiling as described in any one of claims 1-8.

Images