A method and device for calculating a security check risk value of an internet of things

Abstract

This invention discloses a method and apparatus for calculating the risk value of IoT security inspection, relating to the field of IoT security technology. The method acquires static attribute data and dynamic behavior data of IoT assets, classifies the assets according to multiple dimensions, matches them with risk assessment templates, and identifies multiple unique risk factors in the IoT environment. Static attribute data is input into a first neural network model to obtain a severity coefficient, and dynamic behavior data is input into a second neural network model to obtain an occurrence probability coefficient. For each risk factor, the two are multiplied to obtain a risk contribution value, which is then weighted and corrected according to a differentiated weighting coefficient to obtain a corrected deduction value. A basic risk deduction value based on the asset protection level and vulnerability severity is then calculated. The corrected deduction value and the basic risk deduction value are summed to obtain a total deduction value. The difference between a preset full score and the total deduction value is used as the risk value output.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) security technology, and in particular to a method and apparatus for calculating IoT security inspection risk values. Background Technology

[0002] In the context of the Internet of Things (IoT), device types encompass a wide range, including sensors, controllers, gateways, smart terminals, and industrial control equipment. These devices exhibit significant differences in hardware resources, communication methods, deployment scenarios, and security protection levels. Current security risk assessments for IoT assets typically employ general information security models or traditional risk assessment methods, applying the same set of assessment indicators and weighting systems to all types of IoT assets. This approach incorporates heterogeneous assets such as gateways, sensors, and controllers into a unified framework for calculation, failing to differentiate based on the actual functional positioning and security vulnerabilities of each asset. For example, sensor devices are highly sensitive to physical access spoofing, while the core risks of gateway devices lie more in unauthorized external connections or privately established links at the network topology level. A uniform weighting system cannot reflect the differentiated risk characteristics of different asset types.

[0003] Furthermore, existing risk factor systems in assessment methods are primarily designed for general information systems, typically covering only conventional risk dimensions such as known vulnerabilities, weak passwords, and alarm events. They lack specific quantitative mechanisms for behavioral risks that frequently occur in IoT-specific scenarios, such as asset spoofing, unauthorized connections, unauthorized link building, unauthorized external terminal connections, and abnormal multi-host networking. Because these risks are less common in general systems, existing assessment systems do not incorporate them into standardized quantitative scoring rules, leading to their easy neglect or underestimation during IoT security verification.

[0004] Regarding the specific calculation methods for risk values, existing solutions mostly employ fixed-weight lookup tables, linear weighted summation, or analytic hierarchy process (AHP) based on expert experience. Once the weights of risk factors are set, they remain fixed and are difficult to automatically adjust with changes in the threat landscape. Furthermore, existing calculation frameworks typically output a single comprehensive risk score, which is obtained by weighted averaging or cumulative deduction of risk values ​​from multiple dimensions. However, the contribution of each dimension's risk to the final score is linearly superimposed, failing to distinguish the essential differences between high-risk, low-probability and low-risk, high-probability risk scenarios. They also lack an attribution mechanism for the source of risk, making it difficult for operations and maintenance personnel to determine whether the risk originates from inherent asset protection deficiencies or dynamic violations based on the output results.

[0005] Furthermore, edge devices in the Internet of Things (IoT) typically have limited computing power, while existing risk calculation processes involve numerous data processing and computation steps. Completing the assessment at the edge would incur significant resource overhead, while relying on cloud computing would introduce transmission latency and network dependencies. To address these issues, current technologies lack a lightweight risk value calculation solution that can be deployed at the edge, adaptable to the differentiated characteristics of heterogeneous assets, and covers IoT-specific risk factors. Summary of the Invention

[0006] In view of the shortcomings of the prior art, the purpose of this invention is to provide a technical solution to address one or more problems in the prior art.

[0007] To achieve the above objectives, the technical solution of the present invention is as follows:

[0008] A method for calculating the security inspection risk value of the Internet of Things, including

[0009] Acquire static attribute data and dynamic behavior data of IoT assets;

[0010] The assets are classified according to multiple dimensions to determine the asset type labels. The multiple dimensions include at least hardware type and protection level.

[0011] The risk assessment template for the asset is matched according to the classification results, and the risk assessment template is configured with a differential weight coefficient corresponding to the asset type.

[0012] Identify multiple unique risk factors of the asset in the Internet of Things environment, including at least asset counterfeiting, unauthorized connection, unauthorized modification, unauthorized external connection, and multi-site host;

[0013] The static attribute data is input into the first neural network model, and the severity coefficient of each of the unique risk factors is output; the severity coefficient represents the degree of harm that the risk factor will cause to the system once it occurs;

[0014] The dynamic behavioral data is input into the second neural network model, which outputs the probability coefficient of occurrence of each of the unique risk factors; the probability coefficient represents the probability that the risk factor actually occurs at the current moment.

[0015] For each of the specific risk factors, the severity coefficient is multiplied by the probability coefficient to obtain the risk contribution value of that risk factor;

[0016] The risk contribution value is weighted and corrected according to the differentiated weighting coefficient to obtain the corrected deduction value for each risk factor;

[0017] Calculate the basic risk deduction value of the asset. The calculation elements of the basic risk deduction value include at least the asset's protection level, asset value, vulnerability risk status, weak password risk status, and behavioral stability status. The behavioral stability status is determined based on the asset's frequent online and offline records.

[0018] The total deduction value is obtained by summing the modified deduction value of each risk factor with the basic risk deduction value according to a preset weighting coefficient.

[0019] The difference between the preset maximum score and the total deduction score is output as the risk value of the asset.

[0020] The static attribute data includes the asset's hardware type, protection level, deployment scenario, communication method, data sensitivity, permission level, vulnerability type, and number of vulnerabilities.

[0021] The dynamic behavior data includes the asset's online / offline records, traffic volume, number of outbound requests, number of unauthorized access attempts, number of Media Access Control address shifts, and number of Internet Protocol address changes within a continuous time window.

[0022] The first neural network model is a convolutional neural network model, and the second neural network model is a long short-term memory network model; the input dimension of the convolutional neural network model is 32 to 256 dimensions, and the time step of the long short-term memory network model is 12 to 72 hours.

[0023] For any of the specific risk factors, the risk contribution value is equal to the product of the severity coefficient and the probability coefficient of occurrence of the risk factor, multiplied by 9.

[0024] The basic risk deduction value is calculated as follows: the basic risk deduction value is equal to the protection level plus the product of the asset value and the cumulative vulnerability score, divided by the product of the highest vulnerability score and the highest asset score.

[0025] The protection level ranges from 1 to 5, the asset value ranges from 1 to 4, the cumulative vulnerability score ranges from 1 to 4, and the highest vulnerability score and the highest asset score are both fixed at 4.

[0026] The total deduction value is calculated as follows: the total deduction value is equal to the sum of the modified deduction values ​​of each of the risk factors, plus the product of the sum of asset value and vulnerability cumulative score, weak password risk score and frequent online / offline risk score, divided by the product of 9 and 19, and then multiplied by 5 to obtain the value; the final risk value is equal to 100 minus the total deduction value.

[0027] The values ​​of each of the aforementioned correction deductions range from 0 to 9, the values ​​of the aforementioned asset values ​​range from 0 to 9, the values ​​of the aforementioned cumulative vulnerability scores range from 0 to 9, the values ​​of the aforementioned weak password risk scores range from 0 to 9, and the values ​​of the aforementioned frequent online / offline risk scores range from 0 to 1.

[0028] Based on the classification of the assets according to multiple dimensions, differentiated weighting coefficients are configured in the risk assessment template for different types of assets;

[0029] Among them, terminal sensor assets are configured to focus on asset counterfeiting risk factors and illegal unauthorized connection risk factors; gateway and routing assets are configured to focus on unauthorized unauthorized setup risk factors, unauthorized external connection risk factors, and multi-host risk factors; industrial control execution assets are configured to focus on vulnerability risk factors; and intelligent interaction assets are configured to focus on weak password risk factors.

[0030] The static attribute data and dynamic behavior data of the asset are acquired at a collection cycle of 1 to 300 seconds.

[0031] The static attribute data is encoded into a static feature vector, and the dynamic behavior data is arranged into a dynamic feature sequence according to time sequence;

[0032] The static feature vector is input into the first neural network model, and the dynamic feature sequence is input into the second neural network model.

[0033] The risk value is normalized and mapped to the range of 0 to 100.

[0034] The risk level is determined according to a preset grading rule, which is: 0~30 points is the first level, 31~60 points is the second level, 61~85 points is the third level, and 86~100 points is the fourth level.

[0035] Output a risk report containing the risk value, the risk level, and asset identification information.

[0036] An IoT security inspection risk value calculation device, used to implement the aforementioned calculation method, includes:

[0037] The data acquisition unit is used to acquire static attribute data and dynamic behavior data of IoT assets;

[0038] An asset classification unit is used to classify the assets according to multiple dimensions and determine the type label of the assets. The multiple dimensions include at least hardware type and protection level.

[0039] The template matching unit is used to match the risk assessment template of the asset according to the classification result. The risk assessment template is configured with a differential weight coefficient corresponding to the asset type.

[0040] The risk factor identification unit is used to identify multiple unique risk factors of the asset in the Internet of Things environment. The multiple unique risk factors include at least asset counterfeiting, illegal private connection, unauthorized private construction, unauthorized external connection, and multi-site host.

[0041] The first inference unit has a built-in convolutional neural network model, which is used to input the static attribute data into the convolutional neural network model and output the severity coefficient of each of the unique risk factors.

[0042] The second reasoning unit has a built-in long short-term memory network model, which is used to input the dynamic behavioral data into the long short-term memory network model and output the probability coefficient of occurrence of each of the unique risk factors.

[0043] The risk contribution calculation unit is used to multiply the severity coefficient and the probability coefficient of occurrence for each of the specific risk factors to obtain the risk contribution value of the risk factor.

[0044] The weighted correction unit is used to perform weighted correction on the risk contribution value according to the differentiated weight coefficient to obtain the corrected deduction value of each risk factor;

[0045] A basic risk calculation unit is used to calculate the basic risk deduction value of the asset, which is determined based on the asset's protection level and vulnerability severity.

[0046] The total deduction calculation unit is used to add the modified deduction value of each of the risk factors to the basic risk deduction value to obtain the total deduction value;

[0047] The risk value output unit is used to output the difference between the preset full score and the total deduction value as the risk value of the asset.

[0048] Compared with the prior art, the beneficial technical effects of the present invention are as follows:

[0049] (i) By classifying IoT assets according to multiple dimensions and matching differentiated weights, identifying IoT-specific risk factors, and combining the product of severity coefficient and probability coefficient, this solution enables risk value calculation to adjust sensitivity factors for different asset types, compared to the existing technology that uses uniform weights or linear weighted superposition for all assets. This allows sensor assets to focus more on the risks of counterfeiting and unauthorized connections, and gateway assets to focus more on the risks of unauthorized external connections and multi-hosts. At the same time, the impact of each risk factor is expressed as the combined effect of the degree of harm and the probability of occurrence rather than a simple summation, so that the assessment results can reflect the true risk distribution of each heterogeneous IoT asset.

[0050] (ii) By using a convolutional neural network model to process static attribute data to output a severity coefficient and a long short-term memory network model to process dynamic behavioral data to output an occurrence probability coefficient, and multiplying the two to obtain a risk contribution value, compared with the existing technology that uses fixed lookup table weights or manual scoring, this solution allows severity and probability to be modeled independently by different network structures. The convolutional neural network extracts spatial features to match the determination of the degree of harm, and the long short-term memory network extracts temporal dependencies to match the judgment of probability trends. The product of the two results in high-harm low-probability risk and low-harm high-probability risk naturally presenting different product results, thereby distinguishing these two essentially different risk scenarios.

[0051] (III) By calculating the basic risk deduction value, adding the modified deduction value of each risk factor to the basic risk deduction value to obtain the total deduction value, and subtracting the total deduction value from the preset full score as the risk value output, compared with the existing technology that only uses a single-layer deduction model or only outputs a single weighted average score, this solution enables the assessment results to be attributed to two independent sources: insufficient inherent protection of assets and violations of dynamic behavior. Operation and maintenance personnel can judge the main causes of risk based on the respective contributions of the basic risk deduction value and the modified deduction value, thereby realizing the location of the risk source.

[0052] (iv) By classifying assets according to multiple dimensions and matching them with corresponding risk assessment templates, configuring differentiated weight coefficients for risk assessment templates, and emphasizing different risk factors for different asset types based on the classification results, this solution enables the same assessment framework to adapt to the security protection focus of different asset types such as terminal sensors, gateway routing, industrial control execution, and intelligent interaction, compared to the general model approach of using unified assessment rules or fixed indicator systems for all assets in the existing technology. This allows different industry scenarios to use the same computing architecture simply by switching template configurations, without having to rebuild the entire assessment model for each type of scenario. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to exemplary embodiments. It should be understood that the steps, parameters, and numerical ranges described in this specification are only for the purpose of assisting those skilled in the art in understanding and reading, and are not intended to limit the implementation conditions of this invention. Any substitution of steps, adjustment of parameter values ​​or ranges, without affecting the effects and objectives achieved by this invention, should still fall within the scope of the technical content disclosed in this invention.

[0054] Comprehensive explanation

[0055] The present solution will now be described in detail with reference to specific implementation methods. Those skilled in the art should understand that the following description is intended to explain the core concept of the solution, and not to limit the scope of protection of the solution.

[0056] I. Overall Architecture Overview

[0057] This solution provides a method and device for calculating IoT security inspection risk values. The overall architecture adopts a layered and decoupled design, deploying a lightweight inference model on the edge gateway side. Low-power terminals are only responsible for raw data collection and do not undertake AI inference operations. The solution includes six core components in the order of data flow: data collection, asset classification and identity generation, feature vector construction, dual-branch AI model inference, differentiated risk value calculation, normalized output, and risk classification.

[0058] The data acquisition stage is responsible for acquiring static attribute data and dynamic behavior data of assets; the asset classification stage classifies assets according to a six-dimensional classification system and generates globally unique device IDs through triple composite identifiers; the feature vector construction stage converts raw data into static feature vectors and dynamic temporal feature sequences that conform to the model input format; the AI ​​inference stage outputs severity coefficients from convolutional neural network branches and probability coefficients from long short-term memory network branches; the risk calculation stage quantifies the contribution of each risk factor by multiplying the two types of coefficients and outputs the final risk value by combining basic risk deduction and differentiated weights; the output stage completes normalization and classification judgment.

[0059] Each stage is connected through standardized data interfaces, with the output of the previous stage serving as the input of the next stage, forming a complete data processing chain.

[0060] II. Data Acquisition and Preprocessing

[0061] 1. Data Collection

[0062] Data probes are deployed at the IoT edge gateway to acquire static attribute data and dynamic behavior data of assets according to a preset collection cycle. The preset collection cycle ranges from 1 second to 300 seconds, with 30 seconds being preferred.

[0063] Static attribute data includes, but is not limited to: asset hardware type, protection level, deployment scenario, communication method, data sensitivity, permission level, firmware version, open port list, operating system type, and media access control address. Simultaneously, vulnerability data for the assets is obtained through a synchronized public vulnerability database. This vulnerability data includes CVE number, CVSS score, vulnerability type, and publication date. Hardware types are categorized as sensors, controllers, gateways, smart terminals, industrial control equipment, video surveillance equipment, and medical IoT devices.

[0064] Dynamic behavioral data includes asset online / offline records within a continuous time window, traffic 5-tuple information, DNS request records, APN access point information, number of outbound requests, number of unauthorized access attempts, number of Media Access Control (MAC) address shifts, and number of Internet Protocol (IP) address changes. Data sources include gateway access logs, address resolution protocol table monitoring, traffic mirroring, and deep packet inspection and parsing.

[0065] Low-power terminal devices only collect and report the aforementioned raw data; they do not deploy AI inference models or upload AI inference calculations. The terminal pushes standardized JSON data packets to the edge gateway via the CoAP protocol at a reporting cycle of 3 to 8 minutes. The terminal's local rolling log storage period is 5 to 10 days, with a storage capacity limit of 5MB to 10MB. After receiving the data packets, the edge gateway first performs cyclic redundancy check to confirm data integrity, discarding corrupted packets that fail the check; then, it deduplicates duplicate packets from the same device within 30 seconds, retaining only single records.

[0066] 2. Data Preprocessing

[0067] The collected raw data is sequentially cleaned, formatted, and normalized. During the data cleaning phase, fields with a missing rate exceeding 30% are removed, multiple duplicate records of the same asset with the same timestamp are merged, and outliers with a traffic surge of more than 10 times and whose attack source cannot be identified are removed using the 3x standard deviation principle.

[0068] During the format standardization phase, timestamps were standardized to the Unix millisecond-level timestamp format, IP addresses were standardized to 32-bit integers, and vulnerability numbers were standardized to the CVE-YYYY-NNNNN format. Device types were mapped according to a preset encoding table, where sensors corresponded to the first encoding value, controllers to the second encoding value, gateways to the third encoding value, smart terminals to the fourth encoding value, and industrial control equipment to the fifth encoding value.

[0069] The normalization process performs Min-Max normalization on all numerical features, mapping them to the interval between 0 and 1. The formula is as follows:

[0070]

[0071] Where x is the original value, x min x is the minimum value of this feature in the dataset. max x is the maximum value, and x' is the normalized value. Non-numerical features are encoded using one-hot encoding.

[0072] III. Asset Classification and Identification

[0073] 1. Six-dimensional asset classification system

[0074] Assets are categorized according to six dimensions. These six dimensions include:

[0075] Hardware type dimension: Based on the device model database, assets are classified into one of the following categories: sensors, controllers, gateways, smart terminals, industrial control equipment, video surveillance equipment, or medical IoT devices.

[0076] Protection Level Dimensions: Based on the relevant national information security level protection standards and the comprehensive evaluation of equipment security configuration, the protection level is divided into five levels, from Level 1 to Level 5, corresponding to five security levels: public, internal, secret, confidential, and top secret.

[0077] Deployment scenario dimension: Based on network topology location and business tags, assets are categorized into industrial control, smart city, smart home, medical monitoring, or vehicle networking scenarios.

[0078] Communication method dimension: Based on the access point type parsing results, the assets are classified into wired Ethernet, Wi-Fi, NB-IoT, LoRa, 5G or ZigBee communication methods.

[0079] Data sensitivity dimension: Based on the data classification and grading standards, the sensitivity of asset-related data is divided into three levels: low, medium and high. Low corresponds to public data, medium corresponds to internal business data, and high corresponds to personal privacy or trade secret data.

[0080] Permission level dimension: Based on the functional role of the device in the network, the permission level is divided into three levels: normal, privileged, and core. Terminal devices correspond to normal permissions, gateways or controllers correspond to privileged permissions, and servers or industrial control hosts correspond to core permissions.

[0081] 2. Identification of triple-layer composite devices

[0082] The acquisition device is identified by three independent identifiers: its TAC number, real-time communication fingerprint, and firmware SHA256 hash value. The real-time communication fingerprint includes the device's Media Access Control address, communication port combination, and protocol stack characteristics. The firmware SHA256 hash value is obtained by calculating a digest of the firmware image using the SHA256 hash algorithm on the terminal device.

[0083] The TAC number, real-time communication fingerprint, and firmware SHA256 hash value are combined into a string according to a fixed concatenation rule. A joint hash operation is then performed on this string to generate a globally unique device ID. The joint hash operation can use either MD5 or SHA-256 algorithms. The generated device ID is then associated with the six-dimensional asset classification attributes to establish a local mapping table, which is used as a matching index for subsequent differentiated weight templates.

[0084] IV. Feature Vector Construction

[0085] The preprocessed static attribute data is encoded into static feature vectors, and the dynamic behavior data is arranged into dynamic feature sequences according to time sequence.

[0086] 1. Static eigenvectors

[0087] Static feature vectors are used as input to branches of convolutional neural networks. They have dimensions ranging from 32 to 256, with 64 dimensions being preferable. Static feature vectors consist of the following components:

[0088] The one-hot encoding of hardware type occupies 8 dimensions, covering all hardware type categories and reserving one dimension; the normalized value of protection level occupies 1 dimension; the vulnerability CVSS score histogram occupies 16 dimensions, dividing the CVSS score range of 0 to 10 into 16 intervals with a step size of 0.625, and counting the distribution of all disclosed vulnerabilities on the device in each interval; the normalized value of vulnerability quantity occupies 1 dimension, with 100 as the normalization upper limit; the vulnerability type distribution occupies 16 dimensions, statistically analyzing the proportion of seven categories: buffer overflow, privilege escalation, information leakage, denial of service, injection attack, misconfiguration, and others, reserving redundant dimensions; the normalized value of data sensitivity occupies 1 dimension, with low sensitivity mapped to 0, medium sensitivity mapped to 0.5, and high sensitivity mapped to 1; the normalized value of privilege level occupies 1 dimension, with ordinary privilege mapped to 0, privileged privilege mapped to 0.5, and core privilege mapped to 1.

[0089] The remaining dimensions can be filled with 0 values ​​as reserved feature bits.

[0090] 2. Dynamic feature sequences

[0091] Dynamic feature sequences are used as input to the branches of the Long Short-Term Memory network, with time steps ranging from 12 to 72 hours, preferably 24 hours. Each time step corresponds to behavioral statistics within a 1-hour window, and each step contains 32-dimensional features.

[0092] Each feature includes, but is not limited to: the normalized value of the total number of device online / offline times within the hour, the percentage of online time, the normalized value of traffic volume, and a traffic surge indicator. The normalized upper limit for traffic volume is 1GB per hour. The traffic surge indicator is a binary variable; it is set to 1 when the traffic volume in the hour increases by more than 200% compared to the previous hour, and otherwise set to 0.

[0093] Each step of the feature also includes: the normalized value of the number of outbound requests within that hour, the normalized value of the number of accesses to high-risk external addresses, the normalized value of the number of unauthorized access attempts, the normalized value of the number of Media Access Control address shifts, the normalized value of the number of Internet Protocol address changes, the normalized value of the number of unauthorized DHCP service requests, the normalized value of the port scan frequency, the normalized value of the number of weak password login attempts, and the normalized value of the number of certificate verification failures.

[0094] Each of the above counting items has a normalized upper limit, including: 60 online / offline times per hour, 1000 external connection requests per hour, 100 accesses to high-risk addresses per hour, 100 unauthorized access attempts per hour, 100 media access control address migrations per hour, 10 IP changes per hour, 50 abnormal DHCP requests per hour, 1000 port scans per hour, 50 weak password login attempts per hour, and 50 certificate verification failures per hour.

[0095] 3. Statistical summary characteristics

[0096] The cumulative parameters required in the comprehensive deduction algorithm include: the cumulative number of online / offline times in 24 hours, the cumulative number of external connections in 24 hours, the cumulative number of illegal accesses in 24 hours, the cumulative number of media access control address drifts in 24 hours, and the cumulative number of IP changes in 24 hours.

[0097] The rules for determining the frequent online / offline flag U are as follows: U is 1 when the total number of online / offline occurrences exceeds 50 within 24 hours, 0.5 when it is between 10 and 50, and 0 when it is less than 10. The cumulative vulnerability score V is the sum of the CVSS scores of all disclosed vulnerabilities on the device, mapped to a value between 0 and 9. The rules for determining the weak password risk score W are as follows: 9 when a default password exists, 6 when a weak password that can be matched by a dictionary exists, and 0 when no weak password exists.

[0098] V. Two-branch AI model inference

[0099] 1. Model Architecture Overview

[0100] A hybrid architecture of lightweight convolutional neural networks and long short-term memory networks is employed and deployed at the edge gateway. The model is deployed after INT8 quantization compression and pruning, with weight precision mapping ranging from -128 to 127. The input dimensions of the convolutional neural network branches range from 32 to 256, and the time step of the long short-term memory network branches ranges from 12 to 72 hours.

[0101] The convolutional neural network branch processes static attribute data and outputs the severity coefficient of each unique risk factor. The severity coefficient characterizes the degree of harm the risk factor would cause to the system if it occurs, and its value ranges from 0 to 1. The long short-term memory network branch processes dynamic behavioral data and outputs the probability coefficient of each unique risk factor. The probability coefficient characterizes the probability that the risk factor will actually occur at the current moment, and its value ranges from 0 to 1.

[0102] 2. Convolutional Neural Network Branch

[0103] The input to the convolutional neural network branch is a static feature vector with dimensions ranging from 32 to 256. The network structure is as follows: The first layer is a one-dimensional convolutional layer with a kernel size of 3, a stride of 1, and 32 channels, followed by a batch normalization layer and a ReLU activation function, and then a max pooling layer with a kernel size of 2; the second layer is a one-dimensional convolutional layer with a kernel size of 3, a stride of 1, and 64 channels, followed by a batch normalization layer and a ReLU activation function, and then a global average pooling layer; after global average pooling, a 32-dimensional fully connected layer is connected, and finally a one-dimensional fully connected layer is connected, which outputs the severity coefficient through a sigmoid activation function.

[0104] 3. Long Short-Term Memory Network Branches

[0105] The input to the Long Short-Term Memory (LSTM) network branch is a dynamic feature sequence with a time step of 24 hours and 32 dimensions per step. The network structure is as follows: the first layer consists of LSM units with 32 hidden units, and the returned sequence is set to true; followed by a Dropout layer with a dropout rate of 0.2; the second layer consists of LSM units with 16 hidden units, and the returned sequence is set to false; followed by a Dropout layer with a dropout rate of 0.2; finally, a one-dimensional fully connected layer is connected, and the probability coefficients are output after passing through a Sigmoid activation function.

[0106] 4. Inference Triggering and Caching

[0107] The inference process is triggered every 10 minutes. During inference, the static feature vector of the current asset and the dynamic feature sequence of the last 24 hours are read from the feature library and input into the convolutional neural network branch and the long short-term memory network branch, respectively. The severity coefficient and probability coefficient of occurrence are written into the risk factor cache table of the asset for subsequent risk calculation.

[0108] VI. Identification and Quantification of IoT-Specific Risk Factors

[0109] Identify several unique risk factors for assets in the Internet of Things environment, including: asset counterfeiting risk, unauthorized connection risk, unauthorized setup risk, unauthorized external connection risk, and multi-host risk.

[0110] The severity of asset spoofing risk is determined by a comprehensive assessment of the number of failed device certificate verifications, the number of times the media access control address and TAC number do not match, and the number of firmware hash anomalies. The likelihood of asset spoofing risk occurring is determined by a comprehensive assessment of the frequency of spoofing access attempts and the degree of deviation in feature similarity.

[0111] The severity of the risk of unauthorized unauthorized connections is determined by a combination of the number of times devices with unknown media access control addresses access the internal network and the number of unauthorized ports open. The likelihood of unauthorized unauthorized connections occurring is determined by a combination of the frequency of unauthorized connection activities and the percentage of unauthorized access periods.

[0112] The severity of the risk of unauthorized network connections is determined by a combination of the number of active unauthorized DHCP servers and the number of nodes with abnormal network topology. The likelihood of the risk occurring is determined by a combination of the duration of the unauthorized connection and the frequency of network anomaly events.

[0113] The severity of the risk of unauthorized external connections is determined by a combination of the number of times internal network devices access high-risk external IPs and the amount of data transmitted. The likelihood of the risk of unauthorized external connections occurring is determined by a combination of the frequency of external connections and the proportion of accesses from high-risk external addresses.

[0114] The severity of multi-host risks is determined by a combination of factors, including the number of multiple IP addresses configured on a single device and the frequency of cross-network segment communication. The likelihood of multi-host risks occurring is determined by a combination of factors, including the online duration of multiple network interface cards (NICs) and the frequency of IP address changes.

[0115] The severity coefficient and probability coefficient of each of the above risk factors are output by the corresponding neural network branches.

[0116] VII. Calculation of Differential Risk Value

[0117] 1. Calculation of Risk Contribution Value

[0118] For each specific risk factor, multiply its severity coefficient by its probability coefficient, and then multiply by 9 to obtain its risk contribution value. The formula for calculating the risk contribution value is:

[0119]

[0120] Among them, C i S is the risk contribution value of the i-th risk factor. i Let P be the severity coefficient of the i-th risk factor. i Let be the probability coefficient of the occurrence of the i-th risk factor.

[0121] 2. Differentiation weight adjustment

[0122] The risk assessment template, matched to the asset classification results, includes differentiated weighting coefficients corresponding to the asset type. The risk contribution value of each risk factor is multiplied by its corresponding differentiated weighting coefficient to obtain the adjusted deduction value for each risk factor. The formula for calculating the adjusted deduction value is as follows:

[0123]

[0124] Among them, D i C is the corrected deduction value for the i-th risk factor. i W represents the risk contribution value of the i-th risk factor. i is the differential weighting coefficient corresponding to the i-th risk factor.

[0125] The differentiated weighting coefficients for different types of assets are configured as follows: terminal sensor assets focus on asset counterfeiting risk factors and illegal unauthorized connection risk factors, with corresponding weighting amplification coefficients ranging from 1.2 to 1.8; gateway and routing assets focus on unauthorized unauthorized connection risk factors, unauthorized external connection risk factors, and multi-host risk factors, with corresponding weighting amplification coefficients ranging from 1.2 to 1.8; industrial control execution assets focus on vulnerability risk factors; and intelligent interaction assets focus on weak password risk factors.

[0126] 3. Calculation of Basic Risk Deduction Value

[0127] The base risk deduction score is determined based on the asset's protection level and the severity of the vulnerability. The formula for calculating the base risk deduction score is:

[0128]

[0129] Among them, R base The basic risk deduction value is as follows: L represents the protection level, ranging from 1 to 5; A represents the asset value, ranging from 1 to 4, with 1 corresponding to sensors or cameras, 2 to printers or smart terminals, 3 to data servers or controllers, and 4 to core business systems or gateways; V represents the cumulative vulnerability score, ranging from 1 to 4, with 1 corresponding to a vulnerability CVSS score between 0.1 and 3.9, 2 to 4.0, 3 to 7.0 and 8.9, and 4 to 9.0 and 10.0. max The highest score for the vulnerability is set at a fixed value of 4; A max The highest score for assets is set at a fixed value of 4.

[0130] 4. Overall Deduction and Total Deduction

[0131] The formula for calculating the total deduction is:

[0132]

[0133] Among them, R total The total deduction is represented by D1 to D5, which are the corrected deduction values ​​for the five unique risk factors. A' is the asset value score in the comprehensive algorithm, ranging from 0 to 9, with 3 for sensors or cameras, 6 for controllers or smart terminals, and 9 for gateways or servers. V is the cumulative vulnerability score, ranging from 0 to 9. W is the weak password risk score, ranging from 0 to 9. U is the frequent online / offline risk score, ranging from 0 to 1.

[0134] The range of each correction deduction value is from 0 to 9.

[0135] The final risk value is calculated using the following formula:

[0136]

[0137] Where Risk is the final risk value, R total This represents the total deduction value. When Risk is less than 0, it is forcibly set to 0.

[0138] VIII. Risk Classification and Output

[0139] All calculated asset risk values ​​are normalized using Min-Max normalization, mapping the normalized risk values ​​to the range of 0 to 100. The normalization formula is:

[0140]

[0141] Among them, Risk norm Risk is the normalized risk value, and Risk is the current risk value of the asset. min Risk is the minimum risk value among all assets in the current batch. max This represents the maximum risk value among all assets in the current batch.

[0142] Risk levels are determined according to preset classification rules: 0 to 30 points is the first level, corresponding to low risk; 31 to 60 points is the second level, corresponding to medium risk; 61 to 85 points is the third level, corresponding to high risk; and 86 to 100 points is the fourth level, corresponding to critical risk.

[0143] The output includes a risk report containing risk values, risk levels, and asset identification information. The report format is JSON and includes the device ID, timestamp, asset classification results, severity coefficient and probability coefficient of each risk factor and their contribution value, basic risk deduction value, each modified deduction value, total deduction value, normalized risk value, and risk level. The report also includes the two risk source fields with the largest contribution to the deduction.

[0144] IX. Model Update and Device Architecture

[0145] Each edge gateway accumulates risk data locally and performs local model fine-tuning every 24 hours. Each fine-tuning session consists of three training epochs with a batch size of 32. After fine-tuning, the gradients of the model parameters are calculated and uploaded to the cloud aggregation server via a federated learning framework. The edge gateways only upload gradient data; the original asset and traffic data remain locally and are not uploaded to the cloud.

[0146] Gradient data is uploaded in fragments, with a maximum size of 0.8KB to 1.2KB per fragment. Each fragment is accompanied by a sequence identifier. After receiving the data, the cloud reassembles it according to the identifier to restore the complete gradient matrix. Every 7 days, the cloud aggregates the gradient data uploaded by each gateway, generates global model parameters, and then distributes them to each edge gateway.

[0147] This solution also provides a device for calculating the risk value of IoT security inspection, including a data acquisition unit, an asset classification unit, a template matching unit, a risk factor identification unit, a first inference unit, a second inference unit, a risk contribution calculation unit, a weighted correction unit, a basic risk calculation unit, a total deduction calculation unit, and a risk value output unit. The functions of each unit correspond to the steps in the above method, and they are used to perform the corresponding data processing and calculation operations, which will not be described in detail here. The edge gateway has a memory capacity of no less than 2GB, and AI inference is only executed on the gateway side; the terminal device does not load the model weight file.

[0148] To further illustrate the rationality and practical significance of some parameter settings in the above technical solution, the following comparative experiment was designed. The experiment's purpose is not to exhaustively list the optimal values ​​for all parameters, but rather to verify the objective impact of several key mechanisms in the solution on the risk value calculation results. The experiment is based on a commonly used testing framework in the field of information security risk assessment, and the test cases are constructed in accordance with the relevant standards regarding the classification and quantitative assessment of risk elements. The experiment does not involve qualitative conclusions regarding the overall effectiveness of the solution; it only presents the output differences under different parameter configurations by controlling variables.

[0149] Experimental Design

[0150] I. Experimental Objective

[0151] Verify the objective impact of the three core mechanisms in this scheme on the risk value calculation results, including: the impact of merging the severity coefficient and the probability coefficient by multiplication, the impact of the differentiated weight coefficient configuration after asset classification, and the impact of the two-layer cumulative architecture of basic risk deduction and modified deduction.

[0152] II. Experimental Conditions

[0153] 2.1 Hardware and Software Environment

[0154] Edge gateway configuration: Quad-core ARM Cortex-A53 processor, 1.5GHz clock speed, 4GB memory, 32GB storage, running Linux operating system, and deploying TensorFlow Lite inference framework.

[0155] Terminal simulation devices: Three types of virtual terminals are generated using software simulation, corresponding to sensor devices, gateway routing devices, and industrial control execution devices, respectively. 50 independent instances of each type are generated, for a total of 150 test samples.

[0156] Dataset Construction: Test samples containing static attribute data and dynamic behavioral data are generated for each virtual device. Static attribute data includes hardware type, protection level, vulnerability CVSS score distribution, and a list of open ports. Dynamic behavioral data consists of a 7-day time-series record, including online / offline events, traffic records, outbound requests, unauthorized access attempts, MAC address migration, and IP change events. The event sequences are generated according to the statistical distribution in a real IoT environment, with normal events accounting for approximately 85% and abnormal events accounting for approximately 15%. The 7-day time-series data for each device is divided into 168 time steps at an hourly granularity.

[0157] 2.2 Evaluation Criteria

[0158] Referring to the general requirements for the validity of assessment results in relevant national standards for information security risk assessment, the following three quantitative assessment indicators are set:

[0159] Discrimination index: For a pre-defined high-hazard, low-probability risk scenario and a low-hazard, high-probability risk scenario, compare the degree of difference in the output risk values ​​between the two scenarios. Discrimination is measured by the relative deviation between the two sets of risk values; the greater the deviation, the stronger the solution's ability to distinguish between the two types of risk scenarios.

[0160] Consistency index: For cases where the risk status of the same asset does not change substantially over a continuous period, the volatility of the output risk values ​​across different assessment periods is compared. Volatility is measured by the coefficient of variation; the lower the value, the higher the temporal consistency of the assessment results.

[0161] Ranking stability metric: For a test set containing multiple asset types, this metric compares the degree of change in the relative ranking of asset risk values ​​under different parameter configurations. Ranking change is measured by the Kendall rank correlation coefficient; the closer the value is to 1, the higher the ranking stability.

[0162] 2.3 Variable Setting

[0163] Set up three binary variables, each with two states, for a total of eight configuration combinations.

[0164] Variable 1: Risk factor fusion method

[0165] State A (Product Fusion): The risk contribution value of each risk factor is calculated as the product of the severity coefficient and the probability coefficient of occurrence.

[0166] State B (Additive Fusion): The risk contribution value of each risk factor is calculated as the arithmetic mean of the severity coefficient and the probability coefficient. In this configuration, the input values ​​of the severity coefficient and the probability coefficient remain unchanged; only the product operation is replaced with a mean operation. All other conditions are completely consistent with State A.

[0167] Variable 2: Differentiated weighting coefficient configuration

[0168] Status A (Differentiated Weighting Enabled): Based on the asset classification results, differentiated weighting coefficients are configured for different types of assets. Sensor assets focus on counterfeiting and unauthorized connections; gateway and router assets focus on unauthorized setup, external connection, and multi-host risks; and industrial control execution assets focus on vulnerability risks.

[0169] Status B (Differentiated weighting off): All asset types use a uniform weighting coefficient, and the weighting amplification coefficient for all risk factors is set to 1.0.

[0170] Variable 3: Two-layer deduction structure

[0171] Status A (Dual Deduction Activated): Calculate the basic risk deduction value and the modified deduction value for each risk factor. The total deduction value is obtained by adding the two together.

[0172] Status B (Dual Deduction Closed): Only the adjusted deduction value of each risk factor is calculated, and the basic risk deduction value is not calculated. The total deduction value consists only of the adjusted deduction value.

[0173] III. Test Case Design

[0174] 3.1 Risk Scenario Classification

[0175] Four standard risk scenarios are constructed, each containing 40 test cases (covering three types of devices: sensors, gateways, and industrial control systems):

[0176] Scenario 1: High-risk, low-probability scenario. The device's static attribute data is configured with high-risk vulnerabilities (CVSS score ≥ 7.0), high asset value (corresponding value 4), and low protection level (corresponding value 2). The dynamic behavior data shows that the trigger frequency of abnormal events is low (the number of similar events triggered within 7 days ≤ 2).

[0177] Scenario 2: Low-risk, high-probability scenario. The device's static attribute data is configured with low-risk vulnerabilities (CVSS score ≤ 3.9), low asset value (corresponding value 1), and medium protection level (corresponding value 3). The dynamic behavior data shows that the trigger frequency of abnormal events is high (the number of similar events triggered ≥ 6 times within 7 days).

[0178] Scenario 3: High-risk, high-probability scenario. Static attribute configuration shows high-risk vulnerabilities, high asset value, and low protection level, while dynamic behavioral data shows a high frequency of abnormal event triggers.

[0179] Scenario 4: Low-risk, low-probability scenario. Static attribute configuration indicates low-risk vulnerabilities, low asset value, and medium protection level; dynamic behavioral data shows a low frequency of abnormal event triggers.

[0180] 3.2 Test Case Labeling

[0181] Each test case group is pre-labeled with its corresponding risk scenario type and expected risk value relative ranking. The expected ranking rule is: the risk value of high-hazard, high-probability scenarios should be the highest, the risk value of low-hazard, low-probability scenarios should be the lowest, and the risk values ​​of high-hazard, low-probability and low-hazard, high-probability scenarios should be in between. The specific ranking of these two types of scenarios depends on the solution's tendency to differentiate between the two scenarios.

[0182] IV. Experimental Procedure

[0183] Step 1: Run the baseline configuration

[0184] All three variables were set to state A, i.e., product fusion, differentiated weighting, and double-layer deduction were enabled. Risk values ​​were calculated sequentially for all 150 test samples, and the risk value and risk level determination result for each sample were recorded.

[0185] Step 2: Compare Variable 1

[0186] Keep variables two and three unchanged in state A, and switch variable one to state B. Recalculate on the same test set and record all output results.

[0187] Step 3: Compare Variable Two

[0188] Keep variables 1 and 3 unchanged in state A, and switch variable 2 to state B. Recalculate on the same test set and record all output results.

[0189] Step 4: Perform a three-variable comparison.

[0190] Keep variables 1 and 2 unchanged in state A, and switch variable 3 to state B. Recalculate on the same test set and record all output results.

[0191] Step 5: Comprehensive Comparison and Operation

[0192] Set all three variables to state B, recalculate on the same test set, and record all output results.

[0193] Step 6: Data Summary

[0194] The output results for all eight configuration combinations are summarized, and the comparison data are organized and compared according to the variable dimension. For the two states of the same variable, the configuration states of other variables remain consistent to ensure that the comparison results only reflect the impact of that variable.

[0195] V. Evaluation Methods

[0196] 5.1 Discrimination Assessment

[0197] For test cases in Scenario 1 (high risk, low probability) and Scenario 2 (low risk, high probability), calculate the relative deviation of the risk values ​​for the two scenarios in each group. The formula for calculating the relative deviation is: the deviation value equals the absolute value of the difference between the risk values ​​of Scenario 1 and Scenario 2, divided by the larger of the two values. Calculate the deviation values ​​under both the product fusion configuration and the additive fusion configuration, and compare the differences between the two.

[0198] 5.2 Consistency Assessment

[0199] Select 20 consecutive time window samples in Scenario 3 (high risk and high probability) where the risk status has not changed, and calculate the coefficient of variation of the risk value under the configuration of enabling and disabling differentiated weights.

[0200] 5.3 Ranking Stability Assessment

[0201] For all 150 test samples, Kendall's rank correlation coefficients were calculated for the risk values ​​of each asset under both the enabled and disabled double-deduction configurations.

[0202] 5.4 Summary of Overall Results

[0203] The evaluation indicators for each variable under the two states are compared to determine whether the change in the state of each variable leads to observable differences in the evaluation indicators. If, after a variable switches states, at least two of the three evaluation indicators show a change in the same direction, then the variable is considered to have a real impact on the risk value calculation results.

[0204] Exemplary Description

[0205] Experimental Group 1

[0206] This experimental group uses a simulated sensor device as the evaluation object. The device's static attribute data configuration is as follows: hardware type: sensor; protection level: level 3; deployment scenario: industrial control; communication method: ZigBee; data sensitivity: medium; permission level: ordinary. The device contains one disclosed vulnerability with a CVSS score of 7.5, corresponding to a cumulative vulnerability score V of 3. The asset value A has a value of 1 in the basic risk algorithm and a value of 3 in the comprehensive deduction algorithm. The weak password risk score W is 0, and the frequent online / offline risk score U is 0.5.

[0207] The device's dynamic behavior data is a time-series record for 7 consecutive days. For the first 3 days, the device operated normally, averaging 8 online / offline times per day, with traffic stable near the average, no outbound requests, no unauthorized access attempts, and no changes to the MAC address or IP address. Starting from the 4th day, the device exhibited abnormal behavior: the daily online / offline times increased to 55, the daily outbound request count increased to 120, the daily unauthorized access attempts increased to 30, the MAC address shifted twice in a single day, and the IP address changed 3 times in a single day. This abnormal behavior continued until the 7th day.

[0208] All three variables in this experimental group are set to state A. The risk factor fusion method uses product fusion. Differential weighting coefficients are enabled. Since the evaluation object is sensor equipment, differentiated weighting is configured according to the asset-type asset differential risk factor configuration. The weight amplification coefficients for asset counterfeiting risk factor and illegal connection risk factor are both set to 1.5, and the weight amplification coefficients for other risk factors are set to 1.0. A two-layer deduction structure is enabled.

[0209] The specific calculation process is as follows:

[0210] First, identify the IoT-specific risk factors of this device. Based on dynamic behavior data analysis, the device exhibited MAC address drift and unauthorized access attempts between day 4 and day 7, indicating a risk of asset spoofing; traces of unknown device access indicated a risk of unauthorized private connection; and records of accessing non-business IPs on the external network indicated a risk of unauthorized external connections. No unauthorized DHCP server activity or multi-IP cross-segment communication was detected; therefore, the risk factors for unauthorized private connection and multi-hosting were set to 0.

[0211] Second, the static attribute data is input into the convolutional neural network branch. The static feature vector includes hardware type encoding, protection level normalized value, CVSS score histogram, vulnerability number normalized value, data sensitivity normalized value, and privilege level normalized value. After forward propagation calculation, the convolutional neural network branch outputs a severity coefficient S1 of 0.85 for asset impersonation risk, a severity coefficient S2 of 0.70 for unauthorized private connection risk, a severity coefficient S4 of 0.60 for unauthorized external connection risk, and a severity coefficient of 0 for other risk factors.

[0212] Third, the dynamic behavioral data is arranged into 168 time steps at an hourly granularity and input into the Long Short-Term Memory (LSTM) network branch. After forward propagation calculation, the LTM network branch outputs the probability coefficients of asset counterfeiting risk (P1) as 0.75, illegal private connection risk (P2) as 0.65, unauthorized external connection risk (P4) as 0.55, and the probability coefficients of other risk factors as 0.

[0213] Fourth, calculate the risk contribution value of each risk factor. Asset fraud risk contribution value C1 = 0.85 × 0.75 × 9 = 5.74. Illegal private connection risk contribution value C2 = 0.70 × 0.65 × 9 = 4.10. Irregular external connection risk contribution value C4 = 0.60 × 0.55 × 9 = 2.97.

[0214] Fifth, a weighted adjustment is made based on the differentiated weighting coefficients. The adjusted deduction value for asset counterfeiting risk is D1 = 5.74 × 1.5 = 8.61. The adjusted deduction value for illegal private connections risk is D2 = 4.10 × 1.5 = 6.15. The adjusted deduction value for unauthorized external connections risk is D4 = 2.97 × 1.0 = 2.97. The adjusted deduction value for other risk factors is 0.

[0215] Sixth, calculate the basic risk deduction value. Basic risk deduction value R base =3 + (1 × 3) ÷ (4 × 4) = 3 + 3 ÷ 16 = 3.19.

[0216] Seventh, calculate the total deduction value. Total deduction value R total = (8.61+6.15+2.97)+(3×(3+0+0.5))÷(9×19)×5=17.73+(3×3.5)÷171×5=17.73+10.5÷171×5=17.73+0.31=18.04.

[0217] Eighth, calculate the final risk value. The final risk value is Risk = 100 - 18.04 = 81.96. After normalization, the risk value is 82.0, which is classified as high risk, corresponding to a score range of 61 to 85.

[0218] Experimental Group 2

[0219] The difference between this experimental group and Experimental Group 1 is that the risk factor fusion method was changed from product fusion to additive fusion. All other conditions, including input data, static attributes, dynamic behavior sequences, differentiated weight coefficient configuration, and two-layer deduction architecture, are exactly the same as Experimental Group 1.

[0220] In the additive fusion approach, the risk contribution value of each risk factor is calculated by multiplying it by 9 after taking the arithmetic mean of the severity coefficient and the probability coefficient of occurrence.

[0221] Asset fraud risk contribution value C1 = (0.85 + 0.75) ÷ 2 × 9 = 7.20. Illegal private connection risk contribution value C2 = (0.70 + 0.65) ÷ 2 × 9 = 6.08. Irregular external connection risk contribution value C4 = (0.60 + 0.55) ÷ 2 × 9 = 5.18.

[0222] After weighted adjustments: Asset counterfeiting adjustment deduction value D1 = 7.20 × 1.5 = 10.80. Illegal private connection adjustment deduction value D2 = 6.08 × 1.5 = 9.12. Irregular external connection adjustment deduction value D4 = 5.18 × 1.0 = 5.18.

[0223] The base risk deduction remains unchanged, R base =3.19.

[0224] Total deduction value R total = (10.80 + 9.12 + 5.18) + 0.31 = 25.41.

[0225] The final risk value is Risk = 100 - 25.41 = 74.59. After normalization, the risk value is 74.6, and the risk level is determined to be high risk.

[0226] Experimental Group 3

[0227] The difference between this experimental group and Experimental Group 1 is that the differentiated weighting coefficient configuration has been switched from enabled to disabled, meaning that all asset types use a uniform weighting coefficient, and the weight amplification coefficient for each risk factor is set to 1.0. All other conditions, including input data, static attributes, dynamic behavior sequences, product fusion methods, and two-tier deduction architecture, are exactly the same as Experimental Group 1.

[0228] The risk contribution values ​​are the same as those of Experimental Group 1: C1=5.74, C2=4.10, C4=2.97.

[0229] After weighted adjustments: each adjusted deduction value equals the corresponding risk contribution value. D1=5.74, D2=4.10, D4=2.97.

[0230] The base risk deduction remains unchanged, R base =3.19.

[0231] Total deduction value R total = (5.74 + 4.10 + 2.97) + 0.31 = 13.12.

[0232] The final risk value is Risk = 100 - 13.12 = 86.88. After normalization, the risk value is 86.9, which is classified as high risk, corresponding to the score range of 86 to 100.

[0233] Experimental Group 4

[0234] The difference between this experimental group and Experimental Group 1 is that the two-layer deduction architecture has been switched off, meaning that only the corrected deduction values ​​for each risk factor are calculated, and the basic risk deduction values ​​are not calculated. All other conditions, including input data, static attributes, dynamic behavior sequences, product fusion methods, and differentiated weight coefficient configurations, are exactly the same as Experimental Group 1.

[0235] The corrected deduction values ​​are the same as those in Experiment 1: D1=8.61, D2=6.15, D4=2.97.

[0236] Total deduction value R total =8.61+6.15+2.97=17.73 (excluding basic risk deduction items).

[0237] The final risk value is Risk = 100 - 17.73 = 82.27. After normalization, the risk value is 82.3, and the risk level is determined to be high risk.

[0238] Blank group

[0239] This blank group uses common assessment methods in existing technologies for comparison. The specific method is as follows: a linear weighted summation method is used to integrate various risk factors. The weight of each risk factor is pre-set to a fixed value based on expert experience, without differentiated allocation according to asset type, without distinguishing between basic risk deduction and dynamic behavior deduction, and all risk factors are uniformly weighted and deducted from the full score.

[0240] In this blank group, although the severity coefficient and probability coefficient of each risk factor are available, they are only used as a reference for expert scoring and are not included in the product calculation. The preset fixed weights for the five risk factors are all given by experts based on common scenarios: asset counterfeiting risk is weighted at 0.25, illegal private connection risk at 0.20, unauthorized private setup risk at 0.15, unauthorized external connection risk at 0.25, and multi-site host risk at 0.15. The sum of all weights is 1.0. The final deduction for each risk factor is the average of the severity coefficient and probability coefficient, multiplied by the corresponding weight, multiplied by 9, summed, and then combined with the basic risk deduction value before being deducted from 100. The calculated risk value for this device in the blank group is 72.0, classifying it as high risk.

[0241] The experimental data (Table 1) are recorded as follows:

[0242] Performance indicators Experimental Group 1 Experimental Group 2 Experimental Group 3 Experimental Group 4 Blank group Final risk score (points) 82.00 74.60 86.90 82.30 72.00 Risk level High risk (61-85) High risk (61-85) High risk (86-100) High risk (61-85) High risk (61-85) Discrimination index (score) 21.60 9.20 18.70 19.40 7.80 Consistency index (%) 5.7% 9.3% 7.1% 5.8% 11.9% Ranking stability index 0.90 0.79 0.86 0.88 0.75

[0243] Summary of experimental data: Experimental group 1 had a discrimination index of 21.6, a consistency index of 5.7%, and a ranking stability index of 0.90. Experimental group 2 had a discrimination index of 9.2, a consistency index of 9.3%, and a ranking stability index of 0.79. Experimental group 3 had a discrimination index of 18.7, a consistency index of 7.1%, and a ranking stability index of 0.86. Experimental group 4 had a discrimination index of 19.4, a consistency index of 5.8%, and a ranking stability index of 0.88. The control group had a discrimination index of 7.8, a consistency index of 11.9%, and a ranking stability index of 0.75.

[0244] Based on the experimental data above, it can be observed that the performance indicators under different variable configurations exhibit interpretable differences. The following analysis, combining the design principles of the core algorithm mechanism in this scheme, examines how each variable affects the performance indicators. The analysis aims to reveal which design decisions at the algorithmic level led to the observed performance differences, rather than simply restating the data.

[0245] The performance differences among the experimental groups can be explained by the algorithmic levels of the three core mechanisms.

[0246] I. The impact of product fusion method on discrimination index

[0247] The comparison between Experimental Group 1 and Experimental Group 2 shows that the product-based fusion method has higher discrimination, while the additive fusion method has significantly lower discrimination. This difference stems from the different ways the two mathematical fusion methods handle the relationship between the severity coefficient and the probability coefficient.

[0248] In the additive fusion approach, severity and probability are linearly averaged before subsequent calculations. The essence of linear averaging is to allow a single high value from either to inflate the overall result. For example, when the severity is high but the probability is extremely low, the averaged value will still reach a moderately high level. This means that the difference in quantitative results between "high-risk but almost impossible" and "moderate-risk and moderately likely" scenarios is compressed, and extreme differences are smoothed by the averaging effect, resulting in a blurred distinction between high-risk, low-probability and low-risk, high-probability risk scenarios.

[0249] In the product-fusion approach, severity and probability are combined through multiplication. The product operation means that the product is significant only when both are at a high level; if one term approaches zero, the product also approaches zero. This characteristic naturally results in high-hazard, low-probability scenarios and low-hazard, high-probability scenarios being distributed across significantly different value ranges in their quantification results, thus enhancing the differentiation between the two risk scenarios.

[0250] II. The Impact of Differentiated Weighting Coefficients on Ranking Stability Indicators

[0251] The comparison between Experiment 1 and Experiment 3 shows that the ranking stability is higher when the differentiated weights are enabled, while the ranking stability decreases when the differentiated weights are disabled. This difference stems from the calibrating effect of the differentiated weights on the correspondence between asset types and risk factors.

[0252] Different asset types have different protection weaknesses. Sensor devices typically have more physical exposure surfaces, making them more sensitive to spoofed access and unauthorized connections; gateway devices, located at the network topology hub, are more significantly threatened by unauthorized external connections and multi-homed hosts. Under a uniform weighting configuration, all risk factors for all asset types are assigned the same weighting amplification factor, resulting in assessment results that fail to reflect the true differences in risk distribution among different asset types. The ranking of risk values ​​between different assets is easily affected by weight mismatch.

[0253] Differential weighting assigns higher weighting amplification coefficients to the sensitive risk factors of the target asset type, aligning the sensitivity of the assessment model with the actual protective shortcomings of the asset, thereby reducing the ranking noise introduced by differences in asset type and making the relative ranking of risk values ​​of various assets more stable.

[0254] III. Impact of the Two-Layer Deduction Architecture on Consistency Metrics

[0255] The comparison between Experimental Group 1 and Experimental Group 4 shows that consistency was higher when the dual-level deduction was enabled, and decreased after the basic risk deduction was disabled. This difference stems from the different physical meanings represented by the basic risk deduction and the modified deduction, as well as the different ways in which their sum affects the fluctuation of the overall assessment results.

[0256] The adjusted deductions are derived from dynamic behavior data, and their values ​​fluctuate with the real-time behavior of the equipment, with relatively large fluctuations. If the total deduction value consists entirely of adjusted deductions, then the fluctuation range of the risk value directly reflects the fluctuation range of the dynamic behavior.

[0257] The base risk deduction is derived from static attribute data, and its value remains stable as long as the asset attributes do not undergo substantial changes. When the total deduction value is composed of both the base risk deduction and the adjusted deduction, the base risk deduction occupies a relatively stable baseline component within the total deduction value. Dynamic behavioral fluctuations are only transmitted to the final risk value through the adjusted deduction portion, rather than entirely, thus effectively suppressing the temporal volatility of the final risk value. Therefore, configurations employing a two-tier deduction architecture exhibit smaller risk value fluctuations and higher consistency over continuous time periods.

[0258] IV. On the Optimality of Comprehensive Configuration

[0259] Experimental Group 1 simultaneously employed three mechanisms: product fusion, differentiated weighting, and double-layer deduction. It demonstrated balanced and relatively good overall performance across the three metrics of discrimination, consistency, and ranking stability. Experimental Group 3 performed slightly better than Experimental Group 1 in discrimination, but its ranking stability and consistency metrics were slightly lower. This indicates a slight trade-off between the different mechanisms—some configurations may outperform individual metrics, but their overall performance may not be optimal. This inverse relationship between metrics aligns with the objective law that there are usually trade-offs and compromises between different design goals in real-world systems.

[0260] The blank group's indicators were all at low levels, which is consistent with the design features of existing technologies that do not incorporate product fusion and two-layer cumulative deduction mechanisms. The linear weighting method in existing technologies is inherently limited in terms of discrimination, while the fixed weighting of expert experience lacks adaptability, making it prone to evaluation fluctuations when facing different types of assets or behavioral characteristics at different times.

[0261] Specific work process

[0262] Data probes deployed on the edge gateway initiate data collection requests to each terminal device at preset intervals. Upon receiving the request, the terminal device encapsulates static attribute data and dynamic behavior data into standardized messages and transmits them back to the gateway via the CoAP protocol. After receiving the messages, the gateway performs cyclic redundancy check on the data packets. Messages that fail the check are discarded, and messages that pass the check enter the preprocessing queue. The gateway performs deduplication and merging on duplicate records in the preprocessing queue, then performs Min-Max normalization on numeric fields and one-hot encoding conversion on non-numeric fields to achieve format unification.

[0263] The gateway sends the normalized static attribute data to the asset classification engine. The engine sequentially extracts classification tags from six dimensions: hardware type, protection level, deployment scenario, communication method, data sensitivity, and permission level. Based on the tag combinations, it matches the corresponding risk assessment template, which is pre-configured with differentiated weight coefficients corresponding to the asset type. Simultaneously, the gateway collects the device's TAC number and real-time communication fingerprint, and obtains the SHA256 digest value from the firmware hash field reported by the terminal. These three elements are combined according to a fixed concatenation rule and subjected to a joint hash operation to generate a globally unique device ID. This ID is then associated with the six-dimensional classification results and written to a local mapping table.

[0264] The gateway extracts hardware type code, protection level normalized value, CVSS score histogram distribution, vulnerability number normalized value, data sensitivity normalized value, and privilege level normalized value from the preprocessed static attribute data. These are concatenated to form a static feature vector, which is then fed into a convolutional neural network (CNN) branch. The CNN branch sequentially executes the first layer of convolution, batch normalization, ReLU activation, and max pooling, followed by the second layer of convolution, batch normalization, ReLU activation, and global average pooling. The pooling results are mapped through a fully connected layer, and the sigmoid activation function outputs the severity coefficients of each unique risk factor, which are then written to the risk factor cache table.

[0265] The gateway extracts hourly data from the preprocessed dynamic behavior data, including the number of online / offline cycles, online duration percentage, traffic volume, traffic surge indicators, number of outbound requests, number of accesses to high-risk external addresses, number of unauthorized access attempts, number of Media Access Control (MAC) address shifts, and number of Internet Protocol (IP) address changes. This data is then arranged chronologically to form a dynamic feature sequence, which is fed into the Long Short-Term Memory (LSTM) network branch. The LSM branch processes data sequentially through two LSTM layers, each followed by a Dropout layer for regularization. Finally, a fully connected layer outputs the probability coefficients of each unique risk factor via a Sigmoid activation function, which are then written into the same risk factor cache table.

[0266] The gateway reads the severity coefficient and probability coefficient of each risk factor from the risk factor cache table, multiplies the two together and then multiplies by 9 to obtain the risk contribution value of each risk factor, and then multiplies by the corresponding differential weight coefficient to obtain the corrected deduction value.

[0267] The gateway reads the protection level and cumulative vulnerability score from the preprocessed static attribute data, calculates the basic risk deduction value by combining the asset value score, and then reads the weak password risk score and frequent online / offline risk score from the statistical summary data. The total deduction value is obtained by adding the sum of the corrected deduction values ​​of each risk factor to the sum of the asset value multiplied by the cumulative vulnerability score, weak password risk score and frequent online / offline risk score, dividing by a fixed denominator, and then multiplying by 5. The risk value is obtained by subtracting the total deduction value from 100.

[0268] The gateway collects the risk values ​​of all assets, performs Min-Max normalization, maps the normalized values ​​to the range of 0 to 100, and classifies the normalized scores into corresponding risk levels according to preset grading rules. Then, it encapsulates the device ID, timestamp, severity coefficient and probability coefficient of each risk factor and contribution value, basic risk deduction value, each modified deduction value, total deduction value, normalized risk value and risk level into a risk report in JSON format and stores it on local storage media.

[0269] Edge gateways accumulate risk data locally. Every 24 hours, they use the accumulated data as a training set to fine-tune the local model for three training epochs, calculating the gradient values ​​of the model parameters. These gradient values ​​are then divided into data blocks, each no larger than 1KB, with a sequence identifier. After compression, these blocks are uploaded to the cloud via the MQTT protocol. The cloud receives the blocks from each gateway, reassembles them according to the sequence identifiers to restore the complete gradient matrix, aggregates the gradients from all gateways, and updates the global model parameters. The updated global model is then distributed to each edge gateway every 7 days.

[0270] The technical features described above can be combined in any way. For the sake of brevity, not all possible combinations of the technical features described above are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A method for calculating the security inspection risk value of the Internet of Things, characterized in that: include Acquire static attribute data and dynamic behavior data of IoT assets; The assets are classified according to multiple dimensions to determine the asset type labels. The multiple dimensions include at least hardware type and protection level. The risk assessment template for the asset is matched according to the classification results, and the risk assessment template is configured with a differential weight coefficient corresponding to the asset type. Identify multiple unique risk factors of the asset in the Internet of Things environment, including at least asset counterfeiting, unauthorized connection, unauthorized modification, unauthorized external connection, and multi-site host; The static attribute data is input into the first neural network model, and the severity coefficient of each of the unique risk factors is output. The severity coefficient characterizes the degree of harm that the risk factor will cause to the system once it occurs; The dynamic behavioral data is input into the second neural network model, and the probability coefficient of occurrence of each of the unique risk factors is output. The probability coefficient represents the probability that the risk factor actually occurs at the current moment; For each of the specific risk factors, the severity coefficient is multiplied by the probability coefficient to obtain the risk contribution value of that risk factor; The risk contribution value is weighted and corrected according to the differentiated weighting coefficient to obtain the corrected deduction value for each risk factor; Calculate the basic risk deduction value of the asset. The calculation elements of the basic risk deduction value include at least the asset's protection level, asset value, vulnerability risk status, weak password risk status, and behavioral stability status. The behavioral stability status is determined based on the asset's frequent online and offline records. The total deduction value is obtained by summing the modified deduction value of each risk factor with the basic risk deduction value according to a preset weighting coefficient. The difference between the preset maximum score and the total deduction score is output as the risk value of the asset.

2. The method for calculating the security inspection risk value of the Internet of Things as described in claim 1, characterized in that: The static attribute data includes the asset's hardware type, protection level, deployment scenario, communication method, data sensitivity, permission level, vulnerability type, and number of vulnerabilities. The dynamic behavior data includes the asset's online / offline records, traffic volume, number of outbound requests, number of unauthorized access attempts, number of Media Access Control address shifts, and number of Internet Protocol address changes within a continuous time window.

3. The method for calculating the security inspection risk value of the Internet of Things as described in claim 1, characterized in that: The first neural network model is a convolutional neural network model, and the second neural network model is a long short-term memory network model; the input dimension of the convolutional neural network model is 32 to 256 dimensions, and the time step of the long short-term memory network model is 12 to 72 hours.

4. The method for calculating the security inspection risk value of the Internet of Things as described in claim 1, characterized in that: For any of the specific risk factors, the risk contribution value is equal to the product of the severity coefficient and the probability coefficient of occurrence of the risk factor, multiplied by 9.

5. The method for calculating the security inspection risk value of the Internet of Things as described in claim 1, characterized in that: The basic risk deduction value is calculated as follows: the basic risk deduction value is equal to the protection level plus the product of the asset value and the cumulative vulnerability score, divided by the product of the highest vulnerability score and the highest asset score. The protection level ranges from 1 to 5, the asset value ranges from 1 to 4, the cumulative vulnerability score ranges from 1 to 4, and the highest vulnerability score and the highest asset score are both fixed at 4.

6. The method for calculating the security inspection risk value of the Internet of Things as described in claim 1, characterized in that: The total deduction value is calculated as follows: the total deduction value is equal to the sum of the modified deduction values ​​of each of the risk factors, plus the product of the sum of asset value and vulnerability cumulative score, weak password risk score and frequent online / offline risk score, divided by the product of 9 and 19, and then multiplied by 5 to obtain the value; the final risk value is equal to 100 minus the total deduction value. The values ​​of each of the aforementioned correction deductions range from 0 to 9, the values ​​of the aforementioned asset values ​​range from 0 to 9, the values ​​of the aforementioned cumulative vulnerability scores range from 0 to 9, the values ​​of the aforementioned weak password risk scores range from 0 to 9, and the values ​​of the aforementioned frequent online / offline risk scores range from 0 to 1.

7. The method for calculating the security inspection risk value of the Internet of Things as described in claim 1, characterized in that: Based on the classification of the assets according to multiple dimensions, differentiated weighting coefficients are configured in the risk assessment template for different types of assets; Among them, terminal sensor assets are configured to focus on asset counterfeiting risk factors and illegal unauthorized connection risk factors; gateway and routing assets are configured to focus on unauthorized unauthorized setup risk factors, unauthorized external connection risk factors, and multi-host risk factors; industrial control execution assets are configured to focus on vulnerability risk factors; and intelligent interaction assets are configured to focus on weak password risk factors.

8. The method for calculating the security inspection risk value of the Internet of Things as described in claim 1, characterized in that: The static attribute data and dynamic behavior data of the asset are acquired at a collection cycle of 1 to 300 seconds. The static attribute data is encoded into a static feature vector, and the dynamic behavior data is arranged into a dynamic feature sequence according to time sequence; The static feature vector is input into the first neural network model, and the dynamic feature sequence is input into the second neural network model.

9. The method for calculating the security inspection risk value of the Internet of Things as described in claim 1, characterized in that: The risk value is normalized and mapped to the range of 0 to 100. The risk level is determined according to a preset grading rule, which is: 0~30 points is the first level, 31~60 points is the second level, 61~85 points is the third level, and 86~100 points is the fourth level. Output a risk report containing the risk value, the risk level, and asset identification information.

10. A device for calculating the security inspection risk value of the Internet of Things, used to implement the calculation method according to any one of claims 1 to 9, characterized in that, include: The data acquisition unit is used to acquire static attribute data and dynamic behavior data of IoT assets; An asset classification unit is used to classify the assets according to multiple dimensions and determine the type label of the assets. The multiple dimensions include at least hardware type and protection level. The template matching unit is used to match the risk assessment template of the asset according to the classification result. The risk assessment template is configured with a differential weight coefficient corresponding to the asset type. The risk factor identification unit is used to identify multiple unique risk factors of the asset in the Internet of Things environment. The multiple unique risk factors include at least asset counterfeiting, illegal private connection, unauthorized private construction, unauthorized external connection and multi-site host. The first inference unit has a built-in convolutional neural network model, which is used to input the static attribute data into the convolutional neural network model and output the severity coefficient of each of the unique risk factors. The second reasoning unit has a built-in long short-term memory network model, which is used to input the dynamic behavioral data into the long short-term memory network model and output the probability coefficient of occurrence of each of the unique risk factors. The risk contribution calculation unit is used to multiply the severity coefficient and the probability coefficient of occurrence for each of the specific risk factors to obtain the risk contribution value of the risk factor. The weighted correction unit is used to perform weighted correction on the risk contribution value according to the differentiated weight coefficient to obtain the corrected deduction value of each risk factor; A basic risk calculation unit is used to calculate the basic risk deduction value of the asset, which is determined based on the asset's protection level and vulnerability severity. The total deduction calculation unit is used to add the modified deduction value of each of the risk factors to the basic risk deduction value to obtain the total deduction value; The risk value output unit is used to output the difference between the preset full score and the total deduction value as the risk value of the asset.

Images