A data security detection method and device of an edge Internet of Things device and an electronic device thereof

Abstract

The application provides a kind of edge Internet of Things equipment data security detection method, device and its electronic equipment, it is related to Internet of Things security technical field, comprising: constructing the multi-dimensional baseline model of normal behavior representation;In online running stage, the multi-dimensional online behavior characteristics of equipment are extracted in real time, and the multi-dimensional drift degree of its multi-dimensional baseline model is calculated;The trust metric value of equipment is recursively updated using the multi-dimensional drift degree, and compared with the dynamic decision strategy;When trust metric value triggers cooperative verification condition, group verification is initiated to neighbor device group, and the verification result based on group observation consistency analysis is obtained;According to the verification result, the security state determination and baseline evolution repair are executed to the equipment.The application, through the closed-loop linkage of lightweight drift measurement of multi-dimensional behavior baseline and distributed neighbor group verification, solves the problems of large detection overhead, high false alarm rate and single-point vulnerability in the prior art.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to a data security detection method, apparatus, and electronic device for edge IoT devices. Background Technology

[0002] Edge IoT devices (such as industrial sensors, smart meters, and environmental monitoring nodes) are typically deployed in unattended environments with severely limited computing and storage resources. The data they generate forms the basis for upper-level decision-making, and if they are subjected to data tampering, malicious injection, or device spoofing attacks, it will cause serious harm.

[0003] Current data security detection methods have the following problems: 1. Signature-based detection cannot cope with unknown attacks, and feature library updates are difficult to implement at the edge.

[0004] 2. Machine learning-based anomaly detection models are complex, difficult to deploy on low-power microcontrollers, and sensitive to changes in the deployment environment, resulting in a high false alarm rate.

[0005] 3. Detection based on a single behavioral baseline is susceptible to interference from wireless network fluctuations; more critically, when attackers progressively contaminate the device's own baseline, detection will become completely ineffective.

[0006] 4. All of the above methods rely on the isolated judgment of the device itself and lack self-correction capabilities. A single point of misjudgment or the breach of the security agent will cause the entire detection mechanism to collapse.

[0007] Therefore, a data security detection method, device and electronic equipment for edge IoT devices are proposed. Summary of the Invention

[0008] This specification provides a data security detection method, device, and electronic equipment for edge IoT devices. By using a lightweight drift measurement of multi-dimensional behavioral baselines and a closed-loop linkage of distributed neighbor group verification, it solves the problems of high detection overhead, high false alarm rate, and single-point vulnerability in the prior art.

[0009] This specification provides a data security detection method for edge IoT devices, including: During the security initialization window after the device is connected to the network, multi-dimensional behavioral data of the device is collected to construct a multi-dimensional baseline model representing normal behavior. During the online operation phase, the multidimensional online behavior features of the device are extracted in real time, and their multidimensional drift degree with the multidimensional baseline model is calculated. The trust metric of the device is recursively updated using the multidimensional drift degree and compared with the dynamic decision strategy. When the trust metric triggers the collaborative verification condition, a group verification is initiated to the neighboring device group to obtain the verification result based on the group observation consistency analysis; Based on the verification results, the device is subjected to a safety status assessment and baseline evolution repair.

[0010] Optionally, the multidimensional behavioral data includes at least data content features, resource consumption features, and wireless interaction timing features; the data content features include sensor measurements and their differential statistics; the resource consumption features include CPU utilization and memory usage; and the wireless interaction timing features include the mean and standard deviation of the data frame transmission interval and the mean and standard deviation of the received signal strength indication.

[0011] Optionally, constructing a multidimensional baseline model representing normal behavior specifically includes: Within the security initialization window, the raw time series of the multidimensional behavioral data is collected at fixed intervals; For each dimension of the time series, a segmented aggregation approximation method is used to reduce the dimensionality. The sequence of a preset length L is divided into M segments, and the mean value of each segment is taken to obtain the M-dimensional compressed features. Based on the compressed features, the statistics of each dimension are calculated and combined into a fixed-dimensional behavioral feature vector; Collect all normal behavior feature vectors within the window, calculate their mean vector, historical standard deviation of each component, and covariance matrix, and store them as a multidimensional baseline model.

[0012] Optionally, the calculation of the multidimensional drift degree specifically includes: For the behavioral feature vectors extracted online, the cosine similarity between the data content sub-vector and the corresponding baseline sub-vector is calculated to obtain the data content drift value; The resource drift value is obtained by taking the square root of the sum of squares of the differences between each component of the resource consumption sub-vector and the baseline mean, divided by the historical standard deviation of that component. The interaction drift value is obtained by calculating the Mahalanobis distance between the interaction time-series subvector and the baseline. The three drift values ​​are weighted and summed to obtain the multidimensional drift degree; the weight of each dimension is initially allocated according to the inverse of the historical variance of that dimension in the initialization phase, and is adaptively adjusted every fixed period during operation based on the recent observed variance.

[0013] Optionally, the recursive update of the device's trust metric using multidimensional drift and the comparison with the dynamic decision strategy specifically includes: The instantaneous anomaly fraction s is calculated based on the multidimensional drift degree D: s = min(D / θ) base ,1), where θ base The preset baseline threshold; Let the trust metric value before the update at the current time be T.old The updated trust metric T is calculated using the exponentially weighted moving average formula. new : T new =λ·T old +(1-λ)·(1-s), where λ is the forgetting factor, with a value range of 0.85~0.95; The device trust metric is changed from T old Updated to T new ; Set a safety threshold T high and lower limit threshold T low Record the multidimensional drift values ​​from the most recent K successful group validations to form a historical drift set, and calculate the preset quantile of this set as an adaptive reference value; when the current T... new Breaking below T low However, when the drift degree is less than or equal to the adaptive reference value, T will be... low Reduce the step size by a fixed step Δ to suppress false triggering; When T new Higher than T high At that time, baseline slow evolution is performed using a decay factor η: B←(1-η)·B+η·F online And update the covariance matrix and the historical standard deviation of each component; where B is the baseline mean vector, η is the decay factor, and F online This is the feature vector currently extracted online; When T new Between T low and T high In the meantime, only abnormal events are logged; When T new Breaking below T low And if it is not intercepted by adaptive adjustment, the collaborative verification condition is triggered.

[0014] Optionally, the initiation of group verification and obtaining the group consensus verification result specifically includes: The device generates a random number (Nonce) and the current observation time window [t]. start ,t end The authentication request is broadcast in a single hop to k neighboring devices under the same gateway; where t start t is the start time of the current sliding time window that triggers the group validation condition. end The end time of the current sliding time window that triggers the group validation condition; After receiving a request, the neighboring device extracts the transmission interval sequence and received signal strength sequence of the device observed within the time window based on passive sniffing, calculates their mean and standard deviation, and optionally extracts the measurement values ​​of the same type of sensor. The neighboring device uses a pre-shared session key to encrypt the observation along with the Nonce to form an authentication response and sends it back; The requesting device verifies the timeliness and correspondence of the response via Nonce. After collecting at least (k / 2+1) valid responses, it determines whether the interaction is abnormal if the average transmission interval reported by more than half of the neighbors deviates from the average transmission interval in its own online characteristics by a preset proportion, or if the average received signal strength deviates from the average received signal strength in its own online characteristics by a preset threshold. For measurements from the same type of sensor, the spatial correlation between its own measurements and those reported by neighbors is further verified. The group consensus anomaly score is calculated to obtain the verification result.

[0015] Optionally, the step of performing security status determination and baseline evolution repair based on the verification results specifically includes: If the group consensus verification result indicates an anomaly, it is determined that the device has been subjected to a data security attack, device communication isolation is performed, and an alarm is reported. If the group consensus verification result indicates that everything is normal, then the device trust metric will be forcibly restored to the security threshold T. high The mean vector, historical standard deviation and covariance matrix of each component of the baseline model are reinitialized with the online behavioral feature vector extracted by the current sliding window. At the same time, the drift value that triggered this verification is added to the historical drift set for subsequent dynamic threshold adjustment.

[0016] This specification provides a data security detection device for edge IoT devices, comprising: The module is used to collect multi-dimensional behavioral data of the device during the security initialization window after the device joins the network, and to build a multi-dimensional baseline model representing normal behavior. The calculation module is used to extract the multidimensional online behavior features of the device in real time during the online operation phase, and calculate its multidimensional drift degree with the multidimensional baseline model; The update module is used to recursively update the trust metric of the device using the multidimensional drift degree and compare it with the dynamic decision strategy. The verification module is used to initiate group verification to the neighboring device group when the trust metric triggers the collaborative verification condition, and obtain the verification result based on the group observation consistency analysis. The repair module is used to perform safety status determination and baseline evolution repair on the device based on the verification results.

[0017] Optionally, the multidimensional behavioral data includes at least data content features, resource consumption features, and wireless interaction timing features; the data content features include sensor measurements and their differential statistics; the resource consumption features include CPU utilization and memory usage; and the wireless interaction timing features include the mean and standard deviation of the data frame transmission interval and the mean and standard deviation of the received signal strength indication.

[0018] Optionally, constructing a multidimensional baseline model representing normal behavior specifically includes: Within the security initialization window, the raw time series of the multidimensional behavioral data is collected at fixed intervals; For each dimension of the time series, a segmented aggregation approximation method is used to reduce the dimensionality. The sequence of a preset length L is divided into M segments, and the mean value of each segment is taken to obtain the M-dimensional compressed features. Based on the compressed features, the statistics of each dimension are calculated and combined into a fixed-dimensional behavioral feature vector; Collect all normal behavior feature vectors within the window, calculate their mean vector, historical standard deviation of each component, and covariance matrix, and store them as a multidimensional baseline model.

[0019] Optionally, the calculation of the multidimensional drift degree specifically includes: For the behavioral feature vectors extracted online, the cosine similarity between the data content sub-vector and the corresponding baseline sub-vector is calculated to obtain the data content drift value; The resource drift value is obtained by taking the square root of the sum of squares of the differences between each component of the resource consumption sub-vector and the baseline mean, divided by the historical standard deviation of that component. The interaction drift value is obtained by calculating the Mahalanobis distance between the interaction time-series subvector and the baseline. The three drift values ​​are weighted and summed to obtain the multidimensional drift degree; the weight of each dimension is initially allocated according to the inverse of the historical variance of that dimension in the initialization phase, and is adaptively adjusted every fixed period during operation based on the recent observed variance.

[0020] Optionally, the recursive update of the device's trust metric using multidimensional drift and the comparison with the dynamic decision strategy specifically includes: The instantaneous anomaly fraction s is calculated based on the multidimensional drift degree D: s = min(D / θ) base ,1), where θ base The preset baseline threshold; Let the trust metric value before the update at the current time be T. old The updated trust metric T is calculated using the exponentially weighted moving average formula. new : T new =λ·T old+(1-λ)·(1-s), where λ is the forgetting factor, with a value range of 0.85~0.95; The device trust metric is changed from T old Updated to T new ; Set a safety threshold T high and lower limit threshold T low Record the multidimensional drift values ​​from the most recent K successful group validations to form a historical drift set, and calculate the preset quantile of this set as an adaptive reference value; when the current T... new Breaking below T low However, when the drift degree is less than or equal to the adaptive reference value, T will be... low Reduce the step size by a fixed step Δ to suppress false triggering; When T new Higher than T high At that time, baseline slow evolution is performed using a decay factor η: B←(1-η)·B+η·F online And update the covariance matrix and the historical standard deviation of each component; where B is the baseline mean vector, η is the decay factor, and F online This is the feature vector currently extracted online; When T new Between T low and T high In the meantime, only abnormal events are logged; When T new Breaking below T low And if it is not intercepted by adaptive adjustment, the collaborative verification condition is triggered.

[0021] Optionally, the initiation of group verification and obtaining the group consensus verification result specifically includes: The device generates a random number (Nonce) and the current observation time window [t]. start ,t end The authentication request is broadcast in a single hop to k neighboring devices under the same gateway; where t start t is the start time of the current sliding time window that triggers the group validation condition. end The end time of the current sliding time window that triggers the group validation condition; After receiving a request, the neighboring device extracts the transmission interval sequence and received signal strength sequence of the device observed within the time window based on passive sniffing, calculates their mean and standard deviation, and optionally extracts the measurement values ​​of the same type of sensor. The neighboring device uses a pre-shared session key to encrypt the observation along with the Nonce to form an authentication response and sends it back; The requesting device verifies the timeliness and correspondence of the response via Nonce. After collecting at least (k / 2+1) valid responses, it determines whether the interaction is abnormal if the average transmission interval reported by more than half of the neighbors deviates from the average transmission interval in its own online characteristics by a preset proportion, or if the average received signal strength deviates from the average received signal strength in its own online characteristics by a preset threshold. For measurements from the same type of sensor, the spatial correlation between its own measurements and those reported by neighbors is further verified. The group consensus anomaly score is calculated to obtain the verification result.

[0022] Optionally, the step of performing security status determination and baseline evolution repair based on the verification results specifically includes: If the group consensus verification result indicates an anomaly, it is determined that the device has been subjected to a data security attack, device communication isolation is performed, and an alarm is reported. If the group consensus verification result indicates that everything is normal, then the device trust metric will be forcibly restored to the security threshold T. high The mean vector, historical standard deviation and covariance matrix of each component of the baseline model are reinitialized with the online behavioral feature vector extracted by the current sliding window. At the same time, the drift value that triggered this verification is added to the historical drift set for subsequent dynamic threshold adjustment.

[0023] This specification also provides an electronic device, wherein the electronic device includes: A processor; and a memory storing computer-executable instructions, which, when executed, cause the processor to perform any of the methods described above.

[0024] This specification also provides a computer-readable storage medium that stores one or more programs that, when executed by a processor, implement any of the methods described above.

[0025] This invention effectively eliminates numerous false alarms caused by wireless interference by relying solely on a single dimension (such as network traffic) through joint drift analysis of behavior across three dimensions: data content, resource consumption, and wireless interaction timing. Furthermore, the adaptive adjustment of the weights for each dimension further enhances noise resistance. Baseline construction and online drift measurement are both based on Piecewise Aggregate Approximation (PAA) and lightweight distance calculations (cosine similarity, normalized Euclidean distance, and Mahalanobis distance), requiring no complex model inference. All calculations can be performed in real-time on a Cortex-M microcontroller. Group verification requires only a small number of encrypted message exchanges, eliminating the need for additional hardware or centralized gateway processing. Through exponentially weighted moving average updates of trust levels, a slow baseline evolution mechanism, and adaptive downward shifting of the lower limit threshold based on historical drift distribution, the device can automatically adapt to normal drifts such as sensor aging and seasonal changes, significantly reducing the frequency of false triggers caused by environmental changes. When an attacker attempts to progressively contaminate the device's own baseline, the multidimensional drift gradually accumulates anomalies. Once group verification is triggered, the passive observation characteristics of neighboring devices are no longer controlled by the attacked device, forming independent distributed verification, which can effectively detect chronic baseline contamination attacks. Meanwhile, even if a device's security agent is compromised, collective consensus can still prevent the attack from spreading, eliminating the vulnerability of traditional single-point detection. After collective verification determines that everything is normal, the system automatically restores the trust level to a safe level and recalibrates the baseline using current observations. This allows for rapid self-healing of detection interruptions caused by sudden environmental changes, and the device can continue to provide reliable security protection without requiring a reset or manual intervention. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 A schematic diagram illustrating the principle of a data security detection method for an edge IoT device provided in the embodiments of this specification; Figure 2 This is a schematic diagram of the structure of a data security detection device for an edge IoT device provided in an embodiment of this specification; Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this specification; Figure 4 This is a schematic diagram of a computer-readable medium provided for embodiments of this specification. Detailed Implementation

[0028] The following description is intended to disclose the present invention and enable those skilled in the art to implement it. The preferred embodiments described below are merely examples, and other obvious variations will occur to those skilled in the art. The basic principles of the invention defined in the following description can be applied to other embodiments, modifications, improvements, equivalents, and other technical solutions that do not depart from the spirit and scope of the invention.

[0029] The following is in conjunction with the appendix Figures 1-4 Exemplary embodiments of the invention will be described more fully here. However, exemplary embodiments can be implemented in many forms and should not be construed as limiting the invention to the embodiments set forth herein. Rather, these exemplary embodiments are provided to make the invention more comprehensive and complete, and to facilitate a full communication of the inventive concept to those skilled in the art. The same reference numerals in the figures denote the same or similar elements, components, or parts, and therefore repeated descriptions of them are omitted.

[0030] Subject to the technical concept of this invention, the features, structures, characteristics or other details described in a particular embodiment may be combined in one or more other embodiments in a suitable manner.

[0031] In the description of specific embodiments, the features, structures, characteristics, or other details described in this invention are intended to enable those skilled in the art to fully understand the embodiments. However, it is not excluded that those skilled in the art can practice the technical solutions of this invention without one or more of the specific features, structures, characteristics, or other details.

[0032] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0033] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0034] The terms “and / or” or “and / or” include all combinations of any one or more of the listed items.

[0035] Figure 1 A schematic diagram illustrating the principle of a data security detection method for an edge IoT device provided in this specification, comprising: S110: During the security initialization window after the device joins the network, collect multi-dimensional behavioral data of the device and construct a multi-dimensional baseline model representing normal behavior. In the specific implementation described in this specification, after the vibration sensor nodes deployed in the industrial field are powered on and connected to the network, they first enter a 24-hour security initialization window to ensure that the environment is free from attacks. The security agent inside the device synchronously collects the vibration amplitude and its first-order difference from the sensor, the CPU utilization and memory usage of the MCU, and the data frame transmission interval and received signal strength indication (RSSI) between the device and the gateway, with a period of 10 seconds. A multi-dimensional baseline model is then constructed based on this collected data.

[0036] S120: During the online operation phase, the multidimensional online behavior features of the device are extracted in real time, and the multidimensional drift degree between the device and the multidimensional baseline model is calculated. In the specific implementation of this specification, after entering the online operation phase, the security agent maintains a sliding window with a width of 10 minutes to extract multidimensional behavioral features of the online system in real time and calculate the multidimensional drift of the online features relative to the baseline model.

[0037] S130: The trust metric of the device is recursively updated using the multidimensional drift degree and compared with the dynamic decision strategy; In the specific implementation of this specification, the drift degree is used to recursively and smoothly update the trust metric of the device, and the updated trust degree is compared with the dynamic threshold strategy.

[0038] S140: When the trust metric triggers the collaborative verification condition, a group verification is initiated to the neighboring device group to obtain the verification result based on the group observation consistency analysis; In the specific implementation of this specification, when the trust level falls below the trigger condition, the device initiates a group verification request to five pre-configured neighbor devices under the same gateway, performs consistency analysis based on the behavioral data passively observed by the neighbors, and obtains the group consensus verification result.

[0039] S150: Based on the verification results, perform a safety status determination and baseline evolution repair on the device.

[0040] In the specific implementation of this specification, the verification results determine whether the device has suffered a data security attack: if an anomaly is detected, the device is isolated and an alarm is triggered; if normal, the trust level is restored and the baseline model is updated. This method runs entirely on a Cortex-M4 microcontroller and requires no cloud intervention.

[0041] Optionally, the multidimensional behavioral data includes at least data content features, resource consumption features, and wireless interaction timing features; the data content features include sensor measurements and their differential statistics; the resource consumption features include CPU utilization and memory usage; and the wireless interaction timing features include the mean and standard deviation of the data frame transmission interval and the mean and standard deviation of the received signal strength indication.

[0042] In the specific implementation of this specification, the multidimensional behavioral data specifically includes three dimensions. The first dimension is the data content feature, which, for a vibration sensor, collects the acceleration amplitude x, calculates the first-order difference Δx in real time, and statistically analyzes its mean μ within a time window. Δx and standard deviation σ Δx The second dimension is resource consumption characteristics, obtained by reading / proc or system APIs to obtain CPU utilization u(t) and memory usage m(t), and calculating the window mean μ. u and μ m The third dimension is the wireless interaction timing feature. It records the time of each data frame sent to the gateway to calculate the transmission interval I_send(t). Simultaneously, it obtains the corresponding received signal strength RSSI(t) from the wireless transceiver chip register and calculates the average transmission interval μ within the window. I and standard deviation σ I and the mean value of RSSI, μ rssi and standard deviation σ rssi The above eight statistical components constitute a fixed-length behavioral feature vector, and subsequent baseline construction and drift calculation are based on these three-dimensional features.

[0043] Optionally, constructing a multidimensional baseline model representing normal behavior specifically includes: Within the security initialization window, the raw time series of the multidimensional behavioral data is collected at fixed intervals; For each dimension of the time series, a segmented aggregation approximation method is used to reduce the dimensionality. The sequence of a preset length L is divided into M segments, and the mean value of each segment is taken to obtain the M-dimensional compressed features. Based on the compressed features, the statistics of each dimension are calculated and combined into a fixed-dimensional behavioral feature vector; Collect all normal behavior feature vectors within the window, calculate their mean vector, historical standard deviation of each component, and covariance matrix, and store them as a multidimensional baseline model.

[0044] In the specific implementation of this specification, when constructing the multidimensional baseline model, a set of the above three-dimensional raw data is collected every 10 seconds within a 24-hour safe initialization window, accumulating to 8640 sets of samples. For the raw time series of each dimension, a segmented aggregation approximation is used for dimensionality reduction: taking the transmission interval of the interactive timing sequence as an example, a sliding window length of L=64 sampling points is taken, which is divided into M=8 segments. The mean of all sampling points within each segment is calculated to obtain an 8-dimensional compressed sequence to eliminate instantaneous noise. For the data content difference sequence, PAA is not performed; instead, the mean μ of the first-order difference within the window is directly calculated. Δx and standard deviation σ Δx The mean and standard deviation of resource consumption and RSSI sequences are also calculated after PAA. Finally, each window yields an 8-dimensional behavioral feature vector F=[μ Δx ,σ Δx ,μ u ,μ m ,μ I ,σ I ,μ rssi ,σ rssi ] T Collect all normal behavior feature vectors within the initialization window and calculate their mean vector B. init σ, the historical standard deviation vector of each component init and covariance matrix Σ init These three elements together form a multidimensional baseline model and are written into the device's Flash storage for use during the online phase.

[0045] Optionally, the calculation of the multidimensional drift degree specifically includes: For the behavioral feature vectors extracted online, the cosine similarity between the data content sub-vector and the corresponding baseline sub-vector is calculated to obtain the data content drift value; The resource drift value is obtained by taking the square root of the sum of squares of the differences between each component of the resource consumption sub-vector and the baseline mean, divided by the historical standard deviation of that component. The interaction drift value is obtained by calculating the Mahalanobis distance between the interaction time-series subvector and the baseline. The three drift values ​​are weighted and summed to obtain the multidimensional drift degree; the weight of each dimension is initially allocated according to the inverse of the historical variance of that dimension in the initialization phase, and is adaptively adjusted every fixed period during operation based on the recent observed variance.

[0046] In the specific implementation of this specification, during online operation, the device extracts the online feature vector F in real time using a 10-minute sliding window. online Calculating the multidimensional drift degree D involves three steps: First, extract the data content sub-vector F. data =[μ Δx ,σ Δx ] and baseline Bdata Calculate the cosine similarity to obtain the data content drift value. The second step is to take the resource sub-vector F. resource =[μ u ,μ m The mean B corresponding to the baseline resource and historical standard deviation σ resource Calculate the normalized Euclidean drift value D resource =||(F resource -B resource ). / σ resource ||, where . / denotes calculating the L2 norm after element-wise division; the third step is to take the interaction sub-vector F. inter =[μ I ,σ I ,μ rssi ,σ rssi ] and baseline B inter The covariance matrix Σ inter Calculate the Mahalanobis distance D inter =sqrt((F inter -B inter ) T Σ inter {-1} (F inter -B inter The initial weights α, β, and γ are all 1 / 3. Every hour the system runs, the variance of recent observations in each dimension is calculated. k Recalculate the weights w k =1 / var k Then, normalization is performed to obtain new weights, reducing the weights of volatile dimensions. The final multidimensional drift degree D = α·D data +β·D resource +γ·D inter This allows for the suppression of noise while maintaining sensitivity to anomalous behavior.

[0047] Optionally, the recursive update of the device's trust metric using multidimensional drift and the comparison with the dynamic decision strategy specifically includes: The instantaneous anomaly fraction s is calculated based on the multidimensional drift degree D: s = min(D / θ) base ,1), where θ base The preset baseline threshold; Let the trust metric value before the update at the current time be T. old The updated trust metric T is calculated using the exponentially weighted moving average formula. new : T new =λ·T old +(1-λ)·(1-s), where λ is the forgetting factor, with a value range of 0.85~0.95; The device trust metric is changed from T old Updated to T new ; Set a safety threshold T high and lower limit threshold T low Record the multidimensional drift values ​​from the most recent K successful group validations to form a historical drift set, and calculate the preset quantile of this set as an adaptive reference value; when the current T... new Breaking below T low However, when the drift degree is less than or equal to the adaptive reference value, T will be... low Reduce the step size by a fixed step Δ to suppress false triggering; When T new Higher than T high At that time, baseline slow evolution is performed using a decay factor η: B←(1-η)·B+η·F online And update the covariance matrix and the historical standard deviation of each component; where B is the baseline mean vector, η is the decay factor, and F online This is the feature vector currently extracted online; When T new Between T low and T high In the meantime, only abnormal events are logged; When T new Breaking below T low And if it is not intercepted by adaptive adjustment, the collaborative verification condition is triggered.

[0048] In the specific implementation of this specification, after obtaining the drift degree D, a reference threshold θ is set. base =0.3, calculate the instantaneous anomaly score s=min(D / 0.3,1). The current trust level value stored on the device is T. old (Initially 1.0), the new trust level T is calculated using the exponentially weighted moving average formula. new =0.9·T old +0.1·(1-s), after completion, T old Updated to T new The system has a preset security threshold T. high =0.8, lower limit threshold T low The initial value is 0.4. Simultaneously, maintain a queue of length K=5 to store the drift degree D values ​​for the five most recent successful group validations. When T... new ≤T low At that time, check if the queue is full and if the current D value is ≤ 90th percentile of the D values ​​in the queue; if so, it means the current drift is within an acceptable historical range, and T is set to... low The fixed step size Δ is reduced by 0.02 to suppress false triggers and verification is skipped. When T new ≥T highAt that time, perform baseline slow evolution: update the baseline mean B←0.95·B+0.05·F with a decay factor η=0.05. online And recursively update the historical standard deviation and covariance matrix. When T new Between T low With T high During this period, only abnormal events are recorded. When T... new Breaking below T low Furthermore, if it is not dynamically adjusted and blocked, the group verification condition is triggered.

[0049] Optionally, the initiation of group verification and obtaining the group consensus verification result specifically includes: The device generates a random number (Nonce) and the current observation time window [t]. start ,t end The authentication request is broadcast in a single hop to k neighboring devices under the same gateway; where t start t is the start time of the current sliding time window that triggers the group validation condition. end The end time of the current sliding time window that triggers the group validation condition; After receiving a request, the neighboring device extracts the transmission interval sequence and received signal strength sequence of the device observed within the time window based on passive sniffing, calculates their mean and standard deviation, and optionally extracts the measurement values ​​of the same type of sensor. The neighboring device uses a pre-shared session key to encrypt the observation along with the Nonce to form an authentication response and sends it back; The requesting device verifies the timeliness and correspondence of the response via Nonce. After collecting at least (k / 2+1) valid responses, it determines whether the interaction is abnormal if the average transmission interval reported by more than half of the neighbors deviates from the average transmission interval in its own online characteristics by a preset proportion, or if the average received signal strength deviates from the average received signal strength in its own online characteristics by a preset threshold. For measurements from the same type of sensor, the spatial correlation between its own measurements and those reported by neighbors is further verified. The group consensus anomaly score is calculated to obtain the verification result.

[0050] In the specific implementation of this specification, after triggering group verification, device A generates a 16-byte random number Nonce and sets a time window [t-5min,t...]. now The system sends an authentication request to five neighboring devices via single-hop broadcast. Upon receiving the request, neighboring device B retrieves all data frames from A within that window from its own receive buffer and calculates the average sending interval μ based on the timestamps. I_B and standard deviation σ I_B It reads the RSSI value of the corresponding frame from the radio register and calculates the mean value μ of the RSSI. RSSI_B and standard deviation σRSSI_B If B is also a vibration sensor, the mean value of its own vibration amplitude within that window is also calculated. B B uses the session key pre-shared with A to set {Nonce,μ I_B ,σ I_B ,μ RSSI_B ,σ RSSI_B ,[ B The encrypted response is sent back. A verifies the response timeliness via Nonce, and begins consistency checking after collecting at least three valid responses: if more than half of the μ... I_B With A itself online μ I If the deviation exceeds 30%, the marking interaction interval is abnormal; if more than half of the μ values ​​are abnormal, the marking interaction interval is abnormal. RSSI_B With A itself μ rssi If the deviation exceeds 15dBm, the channel is marked as abnormal; for the vibration mean, if A's own window mean... A Reported by at least two neighbors B If the deviation exceeds 5 times the historical standard deviation, the data content is marked as abnormal. If any single item is abnormal or the total number of abnormal items is ≥2, the group consensus score is judged as abnormal; otherwise, it is normal.

[0051] Optionally, the step of performing security status determination and baseline evolution repair based on the verification results specifically includes: If the group consensus verification result indicates an anomaly, it is determined that the device has been subjected to a data security attack, device communication isolation is performed, and an alarm is reported. If the group consensus verification result indicates that everything is normal, then the device trust metric will be forcibly restored to the security threshold T. high The mean vector, historical standard deviation and covariance matrix of each component of the baseline model are reinitialized with the online behavioral feature vector extracted by the current sliding window. At the same time, the drift value that triggered this verification is added to the historical drift set for subsequent dynamic threshold adjustment.

[0052] In the specific implementation of this specification, when the group consensus verification result is abnormal, the security agent confirms that device A has been subjected to data tampering or node spoofing attacks. It immediately calls the wireless driver interface to shut down RF transceiver, enters a silent isolation state, and sends a "last breath" alarm message to the gateway at maximum power. The message contains the device ID, alarm type, and the last drift value D. The gateway forwards this to the management platform to trigger a security response. If the group verification result is normal, it indicates that the decrease in trust level was caused by environmental changes or natural baseline drift, rather than a real attack. At this time, device A will change its trust value T. old Forced recovery to T high (0.8), and use the online feature vector F of the current sliding window.online The baseline mean vector B is directly replaced, and the historical standard deviations of each component are reset to their initial values ​​from the initialization phase. The covariance matrix is ​​also reset to the identity matrix. Simultaneously, the drift value D that triggered this verification is added to the historical drift queue of length 5 for subsequent lower limit threshold T. low Dynamic adjustments were made. After the repair was completed, the equipment resumed its regular safety testing cycle, achieving closed-loop testing and self-healing.

[0053] This invention effectively eliminates numerous false alarms caused by wireless interference by relying solely on a single dimension (such as network traffic) through joint drift analysis of behavior across three dimensions: data content, resource consumption, and wireless interaction timing. Furthermore, the adaptive adjustment of the weights for each dimension further enhances noise resistance. Baseline construction and online drift measurement are both based on Piecewise Aggregate Approximation (PAA) and lightweight distance calculations (cosine similarity, normalized Euclidean distance, and Mahalanobis distance), requiring no complex model inference. All calculations can be performed in real-time on a Cortex-M microcontroller. Group verification requires only a small number of encrypted message exchanges, eliminating the need for additional hardware or centralized gateway processing. Through exponentially weighted moving average updates of trust levels, a slow baseline evolution mechanism, and adaptive downward shifting of the lower limit threshold based on historical drift distribution, the device can automatically adapt to normal drifts such as sensor aging and seasonal changes, significantly reducing the frequency of false triggers caused by environmental changes. When an attacker attempts to progressively contaminate the device's own baseline, the multidimensional drift gradually accumulates anomalies. Once group verification is triggered, the passive observation characteristics of neighboring devices are no longer controlled by the attacked device, forming independent distributed verification, which can effectively detect chronic baseline contamination attacks. Meanwhile, even if a device's security agent is compromised, collective consensus can still prevent the attack from spreading, eliminating the vulnerability of traditional single-point detection. After collective verification determines that everything is normal, the system automatically restores the trust level to a safe level and recalibrates the baseline using current observations. This allows for rapid self-healing of detection interruptions caused by sudden environmental changes, and the device can continue to provide reliable security protection without requiring a reset or manual intervention.

[0054] Figure 2 A schematic diagram of a data security detection device for an edge IoT device provided in this embodiment of the specification includes: Module 10 is used to collect multi-dimensional behavioral data of the device within the security initialization window after the device joins the network, and to build a multi-dimensional baseline model representing normal behavior. The calculation module 20 is used to extract the multidimensional online behavior features of the device in real time during the online operation phase, and calculate its multidimensional drift degree with the multidimensional baseline model. The update module 30 is used to recursively update the trust metric of the device using the multidimensional drift degree and compare it with the dynamic decision strategy. The verification module 40 is used to initiate group verification to the neighboring device group when the trust metric triggers the collaborative verification condition, and obtain the verification result based on the group observation consistency analysis. The repair module 50 is used to perform a safety status determination and baseline evolution repair on the device based on the verification results.

[0055] Optionally, the multidimensional behavioral data includes at least data content features, resource consumption features, and wireless interaction timing features; the data content features include sensor measurements and their differential statistics; the resource consumption features include CPU utilization and memory usage; and the wireless interaction timing features include the mean and standard deviation of the data frame transmission interval and the mean and standard deviation of the received signal strength indication.

[0056] Optionally, constructing a multidimensional baseline model representing normal behavior specifically includes: Within the security initialization window, the raw time series of the multidimensional behavioral data is collected at fixed intervals; For each dimension of the time series, a segmented aggregation approximation method is used to reduce the dimensionality. The sequence of a preset length L is divided into M segments, and the mean value of each segment is taken to obtain the M-dimensional compressed features. Based on the compressed features, the statistics of each dimension are calculated and combined into a fixed-dimensional behavioral feature vector; Collect all normal behavior feature vectors within the window, calculate their mean vector, historical standard deviation of each component, and covariance matrix, and store them as a multidimensional baseline model.

[0057] Optionally, the calculation of the multidimensional drift degree specifically includes: For the behavioral feature vectors extracted online, the cosine similarity between the data content sub-vector and the corresponding baseline sub-vector is calculated to obtain the data content drift value; The resource drift value is obtained by taking the square root of the sum of squares of the differences between each component of the resource consumption sub-vector and the baseline mean, divided by the historical standard deviation of that component. The interaction drift value is obtained by calculating the Mahalanobis distance between the interaction time-series subvector and the baseline. The three drift values ​​are weighted and summed to obtain the multidimensional drift degree; the weight of each dimension is initially allocated according to the inverse of the historical variance of that dimension in the initialization phase, and is adaptively adjusted every fixed period during operation based on the recent observed variance.

[0058] Optionally, the recursive update of the device's trust metric using multidimensional drift and the comparison with the dynamic decision strategy specifically includes: The instantaneous anomaly fraction s is calculated based on the multidimensional drift degree D: s = min(D / θ) base ,1), where θ base The preset baseline threshold; Let the trust metric value before the update at the current time be T. old The updated trust metric T is calculated using the exponentially weighted moving average formula. new : T new =λ·T old +(1-λ)·(1-s), where λ is the forgetting factor, with a value range of 0.85~0.95; The device trust metric is changed from T old Updated to T new ; Set a safety threshold T high and lower limit threshold T low Record the multidimensional drift values ​​from the most recent K successful group validations to form a historical drift set, and calculate the preset quantile of this set as an adaptive reference value; when the current T... new Breaking below T low However, when the drift degree is less than or equal to the adaptive reference value, T will be... low Reduce the step size by a fixed step Δ to suppress false triggering; When T new Higher than T high At that time, baseline slow evolution is performed using a decay factor η: B←(1-η)·B+η·F online And update the covariance matrix and the historical standard deviation of each component; where B is the baseline mean vector, η is the decay factor, and F online This is the feature vector currently extracted online; When T new Between T low and T high In the meantime, only abnormal events are logged; When T new Breaking below T low And if it is not intercepted by adaptive adjustment, the collaborative verification condition is triggered.

[0059] Optionally, the initiation of group verification and obtaining the group consensus verification result specifically includes: The device generates a random number (Nonce) and the current observation time window [t]. start ,t end The authentication request is broadcast in a single hop to k neighboring devices under the same gateway; where t start t is the start time of the current sliding time window that triggers the group validation condition. end The end time of the current sliding time window that triggers the group validation condition; After receiving a request, the neighboring device extracts the transmission interval sequence and received signal strength sequence of the device observed within the time window based on passive sniffing, calculates their mean and standard deviation, and optionally extracts the measurement values ​​of the same type of sensor. The neighboring device uses a pre-shared session key to encrypt the observation along with the Nonce to form an authentication response and sends it back; The requesting device verifies the timeliness and correspondence of the response via Nonce. After collecting at least (k / 2+1) valid responses, it determines whether the interaction is abnormal if the average transmission interval reported by more than half of the neighbors deviates from the average transmission interval in its own online characteristics by a preset proportion, or if the average received signal strength deviates from the average received signal strength in its own online characteristics by a preset threshold. For measurements from the same type of sensor, the spatial correlation between its own measurements and those reported by neighbors is further verified. The group consensus anomaly score is calculated to obtain the verification result.

[0060] Optionally, the step of performing security status determination and baseline evolution repair based on the verification results specifically includes: If the group consensus verification result indicates an anomaly, it is determined that the device has been subjected to a data security attack, device communication isolation is performed, and an alarm is reported. If the group consensus verification result indicates that everything is normal, then the device trust metric will be forcibly restored to the security threshold T. high The mean vector, historical standard deviation and covariance matrix of each component of the baseline model are reinitialized with the online behavioral feature vector extracted by the current sliding window. At the same time, the drift value that triggered this verification is added to the historical drift set for subsequent dynamic threshold adjustment.

[0061] The functions of the apparatus in this embodiment have been described in the above method embodiments. Therefore, for any parts not detailed in this embodiment, please refer to the relevant descriptions in the foregoing embodiments, which will not be repeated here.

[0062] Based on the same inventive concept, embodiments of this specification also provide an electronic device.

[0063] The following describes embodiments of the electronic device of the present invention, which can be considered as specific implementations of the methods and apparatus embodiments of the present invention described above. Details described in the embodiments of the electronic device of the present invention should be considered as supplements to the methods or apparatus embodiments described above; details not disclosed in the embodiments of the electronic device of the present invention can be implemented with reference to the methods or apparatus embodiments described above.

[0064] Figure 3 This is a schematic diagram of an electronic device provided as an embodiment of this specification. Refer to the following... Figure 3 The electronic device 300 according to this embodiment of the present invention will be described. Figure 3 The electronic device 300 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0065] like Figure 3 As shown, the electronic device 300 is presented in the form of a general-purpose computing device. The components of the electronic device 300 may include, but are not limited to: at least one processing unit 310, at least one storage unit 320, a bus 330 connecting different system components (including storage unit 320 and processing unit 310), a display unit 340, etc.

[0066] The storage unit stores program code that can be executed by the processing unit 310, causing the processing unit 310 to perform the steps described in the processing method section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 310 can perform, for example... Figure 1 The steps are shown.

[0067] The storage unit 320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 3201 and / or a cache storage unit 3202, and may further include a read-only memory unit (ROM) 3203.

[0068] The storage unit 320 may also include a program / utility 3204 having a set (at least one) program module 3205, such program module 3205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0069] Bus 330 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0070] Electronic device 300 can also communicate with one or more external devices 400 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable viewers to interact with electronic device 300, and / or with any device that enables electronic device 300 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 350. Furthermore, electronic device 300 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 360. Network adapter 360 can communicate with other modules of electronic device 300 via bus 330. It should be understood that, although... Figure 3As not shown, other hardware and / or software modules may be used in conjunction with electronic device 300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0071] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described in this invention can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this invention can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, or network device, etc.) to execute the method described above according to this invention. When the computer program is executed by a data processing device, it enables the computer-readable medium to implement the method described above, i.e.: as... Figure 1 The method shown.

[0072] Figure 4 This is a schematic diagram of a computer-readable medium provided for embodiments of this specification.

[0073] accomplish Figure 1 The computer program of the method shown can be stored on one or more computer-readable media. A computer-readable medium can be a readable signal medium or a readable storage medium. A readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof.

[0074] The computer-readable storage medium may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable storage medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0075] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the audience's computing device, partially on the audience's device, as a standalone software package, partially on the audience's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the audience's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0076] In summary, the present invention can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that in practice, general-purpose data processing devices such as microprocessors or digital signal processors (DSPs) can be used to implement some or all of the functions of some or all of the components according to the embodiments of the present invention. The present invention can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such programs implementing the present invention can be stored on a computer-readable medium or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0077] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the present invention is not inherently related to any specific computer, virtual device, or electronic device, and various general-purpose devices can also implement the present invention. The above descriptions are merely specific embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0078] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0079] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A data security detection method for edge IoT devices, characterized in that, include: During the security initialization window after the device is connected to the network, multi-dimensional behavioral data of the device is collected to construct a multi-dimensional baseline model representing normal behavior. During the online operation phase, the multidimensional online behavior features of the device are extracted in real time, and their multidimensional drift degree with the multidimensional baseline model is calculated. The trust metric of the device is recursively updated using the multidimensional drift degree and compared with the dynamic decision strategy. When the trust metric triggers the collaborative verification condition, a group verification is initiated to the neighboring device group to obtain the verification result based on the group observation consistency analysis; Based on the verification results, the device is subjected to a safety status assessment and baseline evolution repair.

2. The data security detection method for edge IoT devices as described in claim 1, characterized in that, The multidimensional behavioral data includes at least data content features, resource consumption features, and wireless interaction timing features; the data content features include sensor measurements and their differential statistics; the resource consumption features include CPU utilization and memory usage; and the wireless interaction timing features include the mean and standard deviation of the data frame transmission interval and the mean and standard deviation of the received signal strength indication.

3. The data security detection method for edge IoT devices as described in claim 2, characterized in that, The construction of a multidimensional baseline model representing normal behavior specifically includes: Within the security initialization window, the raw time series of the multidimensional behavioral data is collected at fixed intervals; For each dimension of the time series, a segmented aggregation approximation method is used to reduce the dimensionality. The sequence of a preset length L is divided into M segments, and the mean value of each segment is taken to obtain the M-dimensional compressed features. Based on the compressed features, the statistics of each dimension are calculated and combined into a fixed-dimensional behavioral feature vector; Collect all normal behavior feature vectors within the window, calculate their mean vector, historical standard deviation of each component, and covariance matrix, and store them as a multidimensional baseline model.

4. The data security detection method for edge IoT devices as described in claim 3, characterized in that, The calculation of the multidimensional drift specifically includes: For the behavioral feature vectors extracted online, the cosine similarity between the data content sub-vector and the corresponding baseline sub-vector is calculated to obtain the data content drift value; The resource drift value is obtained by taking the square root of the sum of squares of the differences between each component of the resource consumption sub-vector and the baseline mean, divided by the historical standard deviation of that component. The interaction drift value is obtained by calculating the Mahalanobis distance between the interaction time-series subvector and the baseline. The three drift values ​​are weighted and summed to obtain the multidimensional drift degree; the weight of each dimension is initially allocated according to the inverse of the historical variance of that dimension in the initialization phase, and is adaptively adjusted every fixed period during operation based on the recent observed variance.

5. The data security detection method for edge IoT devices as described in claim 1, characterized in that, The process of recursively updating the device's trust metric using multidimensional drift and comparing it with a dynamic decision strategy specifically includes: The instantaneous anomaly fraction s is calculated based on the multidimensional drift degree D: s = min(D / θ) base ,1), where θ base The preset baseline threshold; Let the trust metric value before the update at the current time be T. old The updated trust metric T is calculated using the exponentially weighted moving average formula. new : T new =λ·T old +(1-λ)·(1-s), where λ is the forgetting factor, with a value range of 0.85~0.95; The device trust metric is changed from T old Updated to T new ; Set a safety threshold T high and lower limit threshold T low Record the multidimensional drift values ​​from the most recent K successful group validations to form a historical drift set, and calculate the preset quantile of this set as an adaptive reference value; when the current T... new Breaking below T low However, when the drift degree is less than or equal to the adaptive reference value, T will be... low Reduce the step size by a fixed step Δ to suppress false triggering; When T new Higher than T high At that time, baseline slow evolution is performed using a decay factor η: B←(1-η)·B+η·F online And update the covariance matrix and the historical standard deviation of each component; where B is the baseline mean vector, η is the decay factor, and F online This is the feature vector currently extracted online; When T new Between T low and T high In the meantime, only abnormal events are logged; When T new Breaking below T low And if it is not intercepted by adaptive adjustment, the collaborative verification condition is triggered.

6. The data security detection method for edge IoT devices as described in claim 1 or 5, characterized in that, The process of initiating group verification and obtaining group consensus verification results specifically includes: The device generates a random number (Nonce) and the current observation time window [t]. start ,t end The authentication request is broadcast in a single hop to k neighboring devices under the same gateway; where t start t is the start time of the current sliding time window that triggers the group validation condition. end The end time of the current sliding time window that triggers the group validation condition; After receiving a request, the neighboring device extracts the transmission interval sequence and received signal strength sequence of the device observed within the time window based on passive sniffing, calculates their mean and standard deviation, and optionally extracts the measurement values ​​of the same type of sensor. The neighboring device uses a pre-shared session key to encrypt the observation along with the Nonce to form an authentication response and sends it back; The requesting device verifies the timeliness and correspondence of the response via Nonce. After collecting at least (k / 2+1) valid responses, it determines whether the interaction is abnormal if the average transmission interval reported by more than half of the neighbors deviates from the average transmission interval in its own online characteristics by a preset proportion, or if the average received signal strength deviates from the average received signal strength in its own online characteristics by a preset threshold. For measurements from the same type of sensor, the spatial correlation between its own measurements and those reported by neighbors is further verified. The group consensus anomaly score is calculated to obtain the verification result.

7. The data security detection method for edge IoT devices as described in claim 6, characterized in that, The process of determining the security status and performing baseline evolution repair based on the verification results specifically includes: If the group consensus verification result indicates an anomaly, it is determined that the device has been subjected to a data security attack, device communication isolation is performed, and an alarm is reported. If the group consensus verification result indicates that everything is normal, then the device trust metric will be forcibly restored to the security threshold T. high The mean vector, historical standard deviation and covariance matrix of each component of the baseline model are reinitialized with the online behavioral feature vector extracted by the current sliding window. At the same time, the drift value that triggered this verification is added to the historical drift set for subsequent dynamic threshold adjustment.

8. A data security detection device for edge IoT devices, characterized in that, include: The module is used to collect multi-dimensional behavioral data of the device during the security initialization window after the device joins the network, and to build a multi-dimensional baseline model representing normal behavior. The calculation module is used to extract the multidimensional online behavior features of the device in real time during the online operation phase, and calculate its multidimensional drift degree with the multidimensional baseline model; The update module is used to recursively update the trust metric of the device using the multidimensional drift degree and compare it with the dynamic decision strategy. The verification module is used to initiate group verification to the neighboring device group when the trust metric triggers the collaborative verification condition, and obtain the verification result based on the group observation consistency analysis. The repair module is used to perform safety status determination and baseline evolution repair on the device based on the verification results.

9. An electronic device, characterized in that, The electronic device includes: A processor; and a memory storing computer-executable instructions, which, when executed, cause the processor to perform the data security detection method for an edge IoT device as claimed in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which, when executed by a processor, implement the data security detection method for an edge IoT device according to any one of claims 1-7.

Images