Data analysis method and system for internet of things terminal

Abstract

The application provides a data analysis method and system of an Internet of Things terminal, and the system comprises: a receiving module, which is used for receiving multi-source heterogeneous security data; a multi-source correlation analysis module, which is used for performing multi-source correlation analysis on the security data to obtain a correlation analysis result; a cause-effect correlation relationship analysis module, which is used for performing cause-effect correlation relationship analysis on discrete alarm events in the security data to obtain an attack scenario reconstruction result; an asset risk assessment module, which is used for calculating an asset risk comprehensive assessment value according to the security data; a threat identification module, which is used for performing threat identification on the security data through a feature detection layer, an anomaly analysis layer and an intelligence correlation layer to obtain a threat identification result; and a display module, which is used for visually displaying each result in the form of a multi-dimensional situation view, so as to comprehensively assess a network security situation from a global perspective, and present the security analysis result in an intuitive multi-dimensional form, thereby improving the efficiency of security situation awareness and decision support.

Description

Technical Field

[0001] This invention relates to the field of Internet of Things (IoT) technology, and in particular to a data analysis method and system for IoT terminals. Background Technology

[0002] With the rapid development of IoT technology, the number and types of power IoT terminal devices have exploded, continuously generating massive amounts of security-related data in the network environment. This data comes from different types of data sources, including terminal behavior logs, network traffic, security alerts, vulnerability information, and threat intelligence, exhibiting significant characteristics of multi-source and heterogeneity.

[0003] In existing technologies, security governance for the power Internet of Things (IoT) typically employs a single-point, discrete analysis approach. Different security devices or systems independently collect and process data, lacking effective data fusion mechanisms, resulting in severe data silos. Because various types of security data are stored in different systems with varying formats, collection frequencies, and semantic definitions, existing technologies struggle to perform unified correlation analysis and in-depth mining of this multi-source, heterogeneous data. Security analysts also cannot obtain a unified and complete security view, leading to a lack of overall understanding of the network's security posture. Summary of the Invention

[0004] This invention provides a data analysis method and system for IoT terminals. By aggregating multi-source heterogeneous security data from IoT terminals, performing multi-source correlation analysis, causal correlation analysis, comprehensive asset risk assessment, multi-layer threat identification, and multi-dimensional situation visualization, it enables a comprehensive assessment of network security situation from a global perspective and presents the security analysis results in an intuitive and multi-dimensional form, thereby improving the efficiency of security situation awareness and decision support.

[0005] To solve the above problems, the present invention adopts the following technical solution: This invention provides a data analysis system for an Internet of Things (IoT) terminal, comprising: The receiving module is used to receive multi-source heterogeneous security data from IoT terminals; The multi-source correlation analysis module is used to perform multi-source correlation analysis on the multi-source heterogeneous security data and obtain the correlation analysis results. The causal correlation analysis module is used to perform causal correlation analysis on discrete alarm events in the multi-source heterogeneous security data to obtain the attack scenario reconstruction results. The asset risk assessment module is used to calculate the comprehensive asset risk assessment value based on the multi-source heterogeneous security data. The threat identification module is used to identify threats in the multi-source heterogeneous security data through a feature detection layer, an anomaly analysis layer, and an intelligence association layer to obtain threat identification results. The feature detection layer is used to match the multi-source heterogeneous security data with known threats according to built-in alarm rules and a threat feature library. The anomaly analysis layer is used to identify abnormal behaviors in the multi-source heterogeneous security data that deviate from the baseline of normal terminal behavior. The intelligence association layer is used to perform real-time correlation analysis between the multi-source heterogeneous security data and associated threat intelligence data. The display module is used to visualize the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment values, and threat identification results in the form of a multi-dimensional situational view.

[0006] Furthermore, the data analysis system of the IoT terminal also includes: The handling module is used to generate handling instructions based on the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment value and threat identification results, and to send the handling instructions to network security devices for execution.

[0007] Preferably, the handling module is also used to build a visual orchestration node library and customize the event handling process through graphical drag-and-drop connection. The visual orchestration node library includes automated execution nodes, filtering nodes, manual intervention nodes and tagging nodes.

[0008] Preferably, the asset risk assessment module uses the following formula to calculate the comprehensive asset risk assessment value: ; The asset risk assessment module is also used to score the asset risk based on the comprehensive asset risk assessment value, obtain the asset risk score value, and generate an asset tag based on the asset risk score value.

[0009] Preferably, the normal behavior baseline of the terminal includes a network behavior baseline, an operational behavior baseline, and a service behavior baseline. The network behavior baseline includes the communication network address range, port distribution, traffic volume, and connection frequency. The operational behavior baseline includes the login time period, operation type, and instruction sequence. The service behavior baseline includes data transmission patterns and service operation procedures.

[0010] Furthermore, the display module also includes: The IoT asset topology management module is used to discover and maintain the list of IoT devices and the topology relationships between devices. It is also used to complete the addition, deletion, merging and refresh of asset topologies, the free switching of multiple business topologies, and the dynamic reflection of device online and offline status and network address changes. The access behavior visualization module is used to graphically present the access relationships and historical operation behaviors between IoT devices, applications and services, and to identify abnormal access patterns that deviate from the normal behavior baseline of the terminal.

[0011] Furthermore, the display module also includes: The visual association search module is used to perform a penetrating association search of alarm data and log data by clicking on chart elements in reports and charts as search criteria.

[0012] Preferably, the display module is also used to display the device operating status, terminal type distribution, traffic data, alarm data and security events in the form of timeline, heat map or geographic map, and generate alarm time roadmap.

[0013] Furthermore, the data analysis system of the IoT terminal also includes: The asset profiling module is used to sort and cluster the asset fingerprint information of the multi-source heterogeneous security data to construct an asset profile. The asset fingerprint information includes network address, media access control address, vendor information and service information. The threat profiling module is used to analyze and profile the network addresses of threat sources in the multi-source heterogeneous security data, and to visualize threat characteristics from attack behavior, attack trends and outbound behavior.

[0014] This invention also provides a data analysis method for IoT terminals, applied to a data analysis system for IoT terminals. The system includes a receiving module, a multi-source correlation analysis module, a causal correlation analysis module, an asset risk assessment module, a threat identification module, and a display module. The method includes: The receiving module receives multi-source heterogeneous security data from IoT terminals; The multi-source correlation analysis module performs multi-source correlation analysis on the multi-source heterogeneous security data to obtain correlation analysis results. The causal correlation analysis module performs causal correlation analysis on discrete alarm events in the multi-source heterogeneous security data to obtain the attack scenario reconstruction results. The asset risk assessment module calculates a comprehensive asset risk assessment value based on the multi-source heterogeneous security data. The threat identification module performs threat identification on the multi-source heterogeneous security data through a feature detection layer, an anomaly analysis layer, and an intelligence association layer to obtain threat identification results. The feature detection layer is used to match the multi-source heterogeneous security data with known threats according to built-in alarm rules and a threat feature library. The anomaly analysis layer is used to identify abnormal behaviors in the multi-source heterogeneous security data that deviate from the baseline of normal terminal behavior. The intelligence association layer is used to perform real-time correlation analysis between the multi-source heterogeneous security data and associated threat intelligence data. The display module visualizes the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment values, and threat identification results in a multi-dimensional situational view.

[0015] Compared with the prior art, the technical solution of the present invention has at least the following advantages: First, by aggregating multi-source heterogeneous security data from IoT terminals and performing multi-source correlation analysis on the aggregated data, the correlation analysis results are obtained, achieving unified integration and correlation governance of scattered security data and breaking down data silos.

[0016] Secondly, by performing causal correlation analysis on discrete alarm events, the attack scenario reconstruction results are obtained, enabling in-depth mining of the causal relationship between isolated alarm events. This allows for accurate reconstruction of attack behavior sequences and attack paths, thereby accurately locating advanced threats and clearly understanding the attack chain and impact.

[0017] Furthermore, by working collaboratively through the feature detection layer, anomaly analysis layer, and intelligence association layer to identify threats from multi-source heterogeneous security data, a comprehensive threat identification system is achieved, encompassing everything from matching known threats to detecting unknown abnormal behaviors and real-time association with external intelligence. This significantly improves the comprehensiveness and timeliness of threat discovery.

[0018] Finally, by visualizing the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment values, and threat identification results in the form of a multi-dimensional situational view, the unified integration and multi-dimensional intuitive presentation of security analysis results are achieved, enabling security analysts to quickly obtain key information and improving the efficiency of security situational awareness and decision support. Attached Figure Description

[0019] Figure 1 This is a structural block diagram of an embodiment of the data analysis system for an IoT terminal of the present invention; Figure 2 This is a structural block diagram of an embodiment of the data analysis system for the Internet of Things terminal of the present invention; Figure 3 This is a flowchart of one embodiment of the data analysis method for IoT terminals of the present invention. Detailed Implementation

[0020] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0021] Please refer to Figure 1 As shown, the present invention provides a data analysis system for an Internet of Things (IoT) terminal, specifically including: Receiver module 11 is used to receive multi-source heterogeneous security data from IoT terminals; Multi-source correlation analysis module 12 is used to perform multi-source correlation analysis on the multi-source heterogeneous security data and obtain correlation analysis results; Causal correlation analysis module 13 is used to perform causal correlation analysis on discrete alarm events in the multi-source heterogeneous security data to obtain attack scenario reconstruction results; Asset risk assessment module 14 is used to calculate the comprehensive asset risk assessment value based on the multi-source heterogeneous security data; The threat identification module 15 is used to identify threats in the multi-source heterogeneous security data through a feature detection layer, an anomaly analysis layer, and an intelligence association layer to obtain threat identification results. The feature detection layer is used to match the multi-source heterogeneous security data with known threats according to built-in alarm rules and a threat feature library. The anomaly analysis layer is used to identify abnormal behaviors in the multi-source heterogeneous security data that deviate from the baseline of normal terminal behavior. The intelligence association layer is used to perform real-time correlation analysis between the multi-source heterogeneous security data and associated threat intelligence data. The display module 16 is used to visualize the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment values ​​and threat identification results in the form of a multi-dimensional situational view.

[0022] Specifically, multi-source heterogeneous security data can originate from IoT terminal risk detection engines, IoT terminal fingerprinting engines, and external systems. Data generated by the IoT terminal risk detection engine includes vulnerability alerts, weak password alerts, unauthorized external connection alerts, spoofing access alerts, and intrusion prevention alerts; data generated by the IoT terminal fingerprinting engine includes asset information and access behavior data; and data generated by external systems includes threat intelligence data and log data.

[0023] Furthermore, multi-source heterogeneous security data can be aggregated through various acquisition methods, including the Syslog protocol, Kafka message queues, SNMP protocol, and application programming interfaces (APIs). Since data from different data sources differs in format, semantic definition, and acquisition frequency, the receiving module performs standardization processing on the received multi-source heterogeneous security data. Standardization processing includes data cleaning, data formatting, asset tagging, and unified paradigm processing, thereby converting the multi-source heterogeneous security data into security data of a unified format.

[0024] The multi-source correlation analysis module integrates multi-dimensional, heterogeneous security data from various sources, including asset fingerprints, vulnerability information, threat intelligence, and network logs, to perform correlation analysis and data governance. Specifically, it automatically correlates the source network address, vulnerability identifier, affected asset identifier, and alarm type in an attack event to form a complete attack event chain. Through multi-source correlation analysis, it breaks down data silos, merging and governing scattered alarm, vulnerability, asset, and traffic data to achieve global risk assessment. Furthermore, the module intelligently correlates detailed attack evidence, multi-dimensional latent threat intelligence, and abnormal behavior based on traffic visualization, automatically sorting out and presenting the attack chain and a comprehensive threat landscape.

[0025] The causal correlation analysis module employs a dynamic Bayesian alarm correlation graph model to analyze the causal relationships between discrete alarm events. This model analyzes the causal relationships between discrete alarm events from the perspective of a dynamic Bayesian graph, introducing a manual judgment mechanism to update model weights based on the ant colony algorithm. Through this model, the causal correlation analysis module can effectively reconstruct attack scenarios from security device alarms, identify unknown multi-step attack behaviors, achieve high computational efficiency, discover more complete attack fragments, and realize the correlation reconstruction and attack attribution of complex targeted network attack scenarios.

[0026] The asset risk assessment module calculates a comprehensive asset risk assessment value based on multiple dimensions, including asset vulnerability and threat level. Asset vulnerability includes vulnerability information and weak password information, while threat level includes the frequency and type of attacks.

[0027] Preferably, the asset risk assessment module uses the following formula to calculate the comprehensive asset risk assessment value: ; In addition, the asset risk assessment module is also used to score the asset risk based on the comprehensive asset risk assessment value, obtain the asset risk score value, and generate asset tags based on the asset risk score value, thereby realizing the quantitative assessment and dynamic updating of asset risk.

[0028] The threat identification module can adopt a multi-layered threat perception architecture, which, through the collaborative work of the feature detection layer, anomaly analysis layer and intelligence association layer, can achieve full-coverage threat identification, from accurate matching of known threats to proactive discovery of unknown anomalies.

[0029] The feature detection layer is used to match known threats to multi-source heterogeneous security data based on built-in alarm rules and a threat signature database. The built-in alarm rules and threat signature database cover the characteristic patterns of common attack types. The feature detection layer achieves accurate matching and identification of known threats by comparing multi-source heterogeneous security data with these characteristic patterns.

[0030] The anomaly analysis layer can use statistical analysis algorithms, machine learning algorithms, and sequence analysis algorithms to establish a baseline of normal terminal behavior and identify abnormal behaviors that deviate from this baseline. Statistical analysis algorithms are used to identify statistically significant abnormal behaviors such as distributed denial-of-service attacks and port scanning; machine learning algorithms use unsupervised learning to discover unknown abnormal patterns; and sequence analysis algorithms are used to identify abnormal processes that do not conform to business logic.

[0031] Preferably, the terminal's normal behavior baseline includes network behavior baseline, operational behavior baseline, and business behavior baseline. The network behavior baseline includes the communication network address range, port distribution, traffic volume, and connection frequency. The operational behavior baseline includes login time period, operation type, and command sequence. The business behavior baseline includes data transmission patterns and business operation procedures. The terminal's normal behavior baseline can be constructed using a combination of historical data statistics and manual calibration. Specifically, historical data under normal terminal operation is collected, the normal range and thresholds of each indicator are calculated, and administrators can manually adjust the thresholds. When the terminal behavior data monitored in real time exceeds the threshold, the anomaly analysis layer triggers an alarm and performs secondary verification using threat intelligence and feature detection to reduce the false alarm rate.

[0032] The intelligence association layer connects to cloud-based threat intelligence and authoritative third-party intelligence databases to associate malicious network addresses with domain names, malicious samples, and attack organizations. By performing real-time correlation analysis between local security data and external threat intelligence, the intelligence association layer can obtain the latest threat information in a timely manner, thereby improving the timeliness and accuracy of threat identification.

[0033] The visualization module is used to present the results of correlation analysis, attack scenario reconstruction, comprehensive asset risk assessment, and threat identification in a multi-dimensional situational view. This multi-dimensional situational view can include a network-wide situational view, an attack situational view, an asset situational view, and a vulnerability situational view. The network-wide situational view displays core indicators such as the total number of assets, threat event statistics, risk distribution, and alarm trends. The attack situational view displays the location of threat sources, attack paths, and information on affected terminals in a geographic or terminal topology format, supporting drill-down to view details of threat events. The asset situational view displays information such as terminal asset distribution, asset value levels, vulnerability distribution, and threat history, supporting filtering and querying by asset type and business scenario. The vulnerability situational view displays vulnerability level distribution, vulnerability type statistics, and a ranking of high-risk vulnerabilities, supporting tracing the scope of vulnerability impact.

[0034] This invention provides a data analysis system for IoT terminals. By aggregating multi-source heterogeneous security data from IoT terminals and performing multi-source correlation analysis on the aggregated data, it obtains correlation analysis results, achieving unified integration and correlation governance of scattered security data and breaking down data silos. Secondly, by performing causal correlation analysis on discrete alarm events, it obtains attack scenario reconstruction results, enabling in-depth mining of causal relationships between isolated alarm events. This accurately reconstructs attack behavior sequences and attack paths, thereby precisely locating advanced threats and clearly understanding the attack chain and impact. Furthermore, through the collaborative work of a feature detection layer, anomaly analysis layer, and intelligence correlation layer, it performs threat identification on multi-source heterogeneous security data, achieving full-coverage threat identification from known threat matching to unknown abnormal behavior detection to real-time correlation with external intelligence, significantly improving the comprehensiveness and timeliness of threat discovery. Finally, by visualizing the correlation analysis results, attack scenario reconstruction results, comprehensive asset risk assessment values, and threat identification results in a multi-dimensional situational view, it achieves unified integration and multi-dimensional intuitive presentation of security analysis results, enabling security analysts to quickly obtain key information and improving the efficiency of security situational awareness and decision support.

[0035] In one embodiment, the data analysis system for the IoT terminal further includes: The handling module is used to generate handling instructions based on the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment value and threat identification results, and to send the handling instructions to network security devices for execution.

[0036] In this embodiment, the handling module comprehensively judges the nature, scope of impact, and urgency of the security incident based on the correlation analysis results output by the multi-source correlation analysis module, the attack scenario reconstruction results output by the causal correlation analysis module, the comprehensive asset risk assessment value output by the asset risk assessment module, and the threat identification results output by the threat identification module, and generates corresponding handling instructions. These handling instructions include network address blocking instructions, device isolation instructions, and policy issuance instructions.

[0037] The handling module issues handling instructions to network security devices for execution. These network security devices include a network firewall, an access control system, and a risk detection engine. Specifically, the network firewall controls access to the corresponding network addresses based on the received network address blocking instructions; the access control system isolates the corresponding terminal devices based on the received device isolation instructions; and the risk detection engine updates its detection policies based on the received policies.

[0038] In addition, the handling module also provides work order management functionality. Upon generating a handling instruction, the module automatically creates a handling work order, assigns responsibility, sets a handling time limit, and provides a reminder before the time limit expires. After handling is completed, the module records all handling process information, including handling time, personnel involved, actions taken, and results, forming a complete handling record.

[0039] For operations involving network address blocking or device isolation, the handling module also provides a blocking approval function, which conducts approval and control before the handling instructions are issued to ensure the compliance of the handling operations. This enables accountability and compliance control of the handling operations, and greatly improves the efficiency and standardization of emergency response.

[0040] Preferably, the handling module also includes a built-in visual orchestration node library and allows for the customization of event handling processes through a graphical drag-and-drop connection method, achieving automated response and standardized handling of security events. The visual orchestration node library can include automated execution nodes, filtering nodes, manual intervention nodes, and tagging nodes. Users can connect nodes such as alarm verification nodes, impact analysis nodes, handling action nodes, and result feedback nodes to form a complete event handling process through graphical drag-and-drop connections. This event handling process supports preset templates and custom configurations, enabling one-click, closed-loop handling of security events.

[0041] In one embodiment, please refer to Figure 2 As shown, the display module also includes: The IoT asset topology management module 161 is used to discover and maintain the list of IoT devices and the topology relationships between devices. It is also used to complete the addition, deletion, merging and refresh of asset topologies, the free switching of multiple business topologies, and the dynamic reflection of device online and offline status and network address changes. The access behavior visualization module 162 is used to graphically present the access relationships and historical operation behaviors between IoT devices, applications and services, and to identify abnormal access patterns that deviate from the normal behavior baseline of the terminal.

[0042] Specifically, the IoT asset topology management module can automatically discover IoT devices in the network environment through a combination of active probing and passive traffic analysis. Active probing includes sending probe packets to scan network address ranges and collect device response information; passive traffic analysis includes monitoring network traffic and extracting device network addresses, media access control addresses, vendor information, and service information from traffic packets. Based on the discovery results, the IoT asset topology management module builds and maintains an IoT device list, which records each device's unique identifier, network address, media access control address, device type, vendor information, operating system information, open port information, and associated service information.

[0043] Furthermore, the IoT asset topology management module can construct inter-device topology relationships based on the IoT device list and communication traffic data between devices. These relationships include physical connectivity and logical access. Physical connectivity reflects the device's hierarchical position and connection path within the network topology; logical access reflects the access permissions and data flow between devices based on business requirements. The IoT asset topology management module visualizes these relationships in a topology diagram, which supports zooming, dragging, and drill-down operations.

[0044] In one embodiment, the IoT asset topology management module can also be used to add, delete, merge, and refresh asset topologies. Adding operations support manual entry of device information or batch import of device lists; deleting operations support removing offline or obsolete device nodes; merging operations support integrating multiple sub-topologies into a unified topology view; and refreshing operations support rescanning the network and updating topology data. Through these operations, users can flexibly adjust the topology display content according to actual management needs.

[0045] Furthermore, the IoT asset topology management module also supports seamless switching between multiple business topologies. Specifically, users can construct different business topology views based on asset tags, including geographic location tags, affiliated business system tags, and importance level tags. For example, users can construct a regional topology view based on geographic location tags, displaying the distribution and connectivity of devices in different geographical areas; users can construct a business topology view based on affiliated business system tags, displaying the access relationships and data flow of devices within the same business system. By freely switching between multiple business topologies, users can quickly focus on key assets and business areas from different management perspectives.

[0046] The access behavior visualization module is used to graphically present the access relationships and historical operational behaviors between IoT devices, applications, and services, and to identify abnormal access patterns that deviate from the normal behavior baseline of terminals. Specifically, the module extracts access behavior information from network traffic data, including source network address, destination network address, source port, destination port, communication protocol, access time, and data transmission volume. Based on this access behavior information, the module constructs an access relationship graph between IoT devices, applications, and services. Nodes in the graph represent IoT device, application, or service instances, and edges represent access connections between nodes. Edge attributes include access frequency, access duration, and data transmission volume. The module visualizes the access relationship graph as a force-directed graph or Sankey diagram, intuitively presenting the distribution of access traffic and hotspot connections in the network.

[0047] Furthermore, the access behavior visualization module records historical changes in access relationships, forming historical operational behavior data. Users can select a specific time period using the timeline control, and the access behavior visualization module displays a snapshot of access relationships within that time period, supporting comparisons of access relationship changes at different points in time and identifying the evolution trend of access patterns.

[0048] Furthermore, the access behavior visualization module uses time-series analysis algorithms to process historical operational behavior data and establish a baseline for normal access patterns between node pairs. This baseline includes normal access time periods, normal access frequency ranges, and normal data transmission volume ranges. When real-time monitored access behavior exceeds this baseline, the access behavior visualization module determines it as an abnormal access pattern. For example, when an IoT device initiates high-frequency connection requests to unfamiliar destination network addresses during abnormal times, or when the data transmission volume of an application instance suddenly increases to several times its historical average, the access behavior visualization module identifies the access behavior as an abnormal access pattern deviating from the terminal's normal behavior baseline.

[0049] Furthermore, the access behavior visualization module can also combine machine learning models to further analyze abnormal access patterns. The machine learning model is trained based on historical normal access data and known abnormal access samples, learning the feature distribution of normal access behavior. When the access behavior visualization module detects a suspected abnormal access pattern, it inputs the suspected abnormal access pattern into the machine learning model, which outputs an anomaly confidence score. When the anomaly confidence score exceeds a preset threshold, the access behavior visualization module confirms the access behavior as an abnormal access pattern, highlights the abnormal access connection in the access relationship graph, and generates an abnormal access alarm message.

[0050] In this embodiment, by automatically discovering and maintaining the list of IoT devices and the topological relationships between them, full-scale perception and dynamic management of IoT assets are achieved, ensuring the accuracy and timeliness of asset information. Secondly, by supporting the addition, deletion, merging, and refreshing of asset topologies, as well as the free switching between multiple business topologies, flexible configuration and multi-perspective management of asset topologies are realized, meeting the asset management needs of different business scenarios. Furthermore, by dynamically reflecting device online / offline status and network address changes, real-time synchronization of topology data with the actual network status is achieved, providing accurate asset status information for the dynamic adjustment of security policies. Further, by graphically presenting the access relationships and historical operational behaviors between IoT devices, applications, and services, an intuitive visualization of network access traffic is achieved, enabling security analysts to quickly understand data flow and access patterns in the network. Finally, by identifying abnormal access patterns that deviate from the baseline of normal terminal behavior, a shift from passive alerting to proactive hunting is achieved, enabling early warning and intervention before abnormal access behavior causes actual harm, improving the timeliness and proactivity of threat discovery.

[0051] In one embodiment, the display module further includes: The visual association search module is used to perform a penetrating association search of alarm data and log data by clicking on chart elements in reports and charts as search criteria.

[0052] In this embodiment, the display module also includes a visualization-based retrieval module. In various statistical reports and topology charts, users can directly click on chart elements or data items as search criteria to achieve a penetrating, correlated retrieval of alarm data and log data, thereby realizing interactive analysis where what you see is what you get.

[0053] Preferably, the display module is also used to display the device operating status, terminal type distribution, traffic data, alarm data and security events in the form of timeline, heat map or geographic map, and generate alarm time roadmap.

[0054] Specifically, the display module acquires multi-dimensional security data from the receiving module, including device operating status, terminal type distribution, traffic data, alarm data, and security events. The display module performs time-dimensional alignment processing on this multi-dimensional security data, aggregating and indexing it according to a unified time granularity to obtain time-seriesd security posture data.

[0055] The display module presents time-series security posture data in a timeline format, generating a timeline view. Specifically, the module overlays device operating status as a line chart onto the timeline view, showing the changing trend of device online rate; it overlays terminal type distribution as a stacked area chart onto the timeline view, showing the evolution of the number of different types of devices over time; it overlays traffic data as a bar chart onto the timeline view, showing the distribution patterns of traffic peaks and troughs; it marks alarm data as scatter points on the timeline view, with different alarm levels distinguished by different colors and sizes of scatter points; and it marks security events as flag icons on the timeline view. Clicking a flag icon allows users to drill down to view event details. Through the timeline view, users can intuitively grasp the evolution of the security posture over time and quickly locate the time point when an anomaly occurred.

[0056] The display module presents time-series security posture data as a heatmap, generating a heatmap view. Specifically, the module divides the network address space into multiple address segments and time into multiple time slices, calculating the alarm density or traffic intensity of each address segment within each time slice. The calculation results are encoded with color intensity to generate a two-dimensional heatmap matrix. The horizontal axis of the heatmap matrix represents time, and the vertical axis represents network address segments. The color intensity of the matrix cells indicates the security activity intensity of the corresponding network address segment within the corresponding time slice. Thus, through the heatmap view, users can quickly identify high-alarm areas and high-incidence periods, intuitively presenting the spatiotemporal distribution characteristics of threats.

[0057] The display module divides the geographic area into multiple geographic grids and time into multiple time slices. It calculates the security event density of each geographic grid within each time slice and encodes the results using color intensity to generate a geographic heatmap. The geographic heatmap is overlaid on the geographic base map, using color gradients to show the differences in security activity intensity across different geographic areas. Thus, through the geographic heatmap view, users can intuitively identify geographic clusters and spread trends of threats.

[0058] Furthermore, the display module presents time-series security situation data as a geographic map, generating a geographic map view. Specifically, the display module can query the corresponding geographic location information based on the device's network address, and mark the device's operating status, alarm data, and security events as icons on the corresponding locations on the geographic map. The geographic map supports multi-level zooming, allowing users to drill down from the national view to the provincial, municipal, and park views. At different zoom levels, the display module automatically adjusts the data aggregation granularity to ensure the clarity and readability of the geographic map view. The icons in the geographic map view support click-to-interact functionality; when a user clicks an icon, the display module shows detailed information about the corresponding device, historical alarm records, and associated security events.

[0059] Furthermore, the display module integrates the timeline view, heatmap view, and geographic map view to generate an alarm time roadmap. When a user selects a time period in the timeline view, the heatmap view and geographic map view update synchronously, displaying only the data within that time period. When a user selects a network address range or geographic region in the heatmap view, the timeline view and geographic map view update synchronously, displaying only the data for that network address range or geographic region. When a user selects a geographic location in the geographic map view, the timeline view and heatmap view update synchronously, displaying only the data for that geographic location. Thus, through this view linkage mechanism, the alarm time roadmap achieves multi-dimensional cross-analysis across time, network space, and geographic space dimensions.

[0060] In one embodiment, the data analysis system for the IoT terminal further includes: The asset profiling module is used to sort and cluster the asset fingerprint information of the multi-source heterogeneous security data to construct an asset profile. The asset fingerprint information includes network address, media access control address, vendor information and service information. The threat profiling module is used to analyze and profile the network addresses of threat sources in the multi-source heterogeneous security data, and to visualize threat characteristics from attack behavior, attack trends and outbound behavior.

[0061] In this embodiment, the asset profiling module extracts asset fingerprint information, such as network address, media access control address, vendor information, and service information, from multi-source heterogeneous security data to establish an asset basic information database. The asset profiling module performs cluster analysis on the assets in the asset basic information database, grouping assets within the same network address range, manufactured by the same vendor, and operating the same service protocol into the same asset group. Based on the asset basic information database and the cluster analysis results, the asset profiling module constructs an asset profile that includes basic asset attributes, network attributes, vulnerability attributes, and association attributes.

[0062] The threat profiling module extracts threat source network addresses from multi-source heterogeneous security data and performs correlation analysis to form threat source groups. The module analyzes attack behavior of these threat source network addresses, including attack frequency statistics, attack type distribution, attack target range, and attack time patterns; it also performs attack trend analysis, including attack intensity trends, attack technology evolution trends, and attack target shift trends; and it performs outbound behavior analysis, including outbound target address distribution, outbound communication frequency, outbound data volume characteristics, and outbound protocol types. The module integrates the analysis results to construct a threat profile and visualizes it using radar charts, line graphs, and relationship graphs.

[0063] In one embodiment, the data analysis system for the IoT terminal further includes: The management and control module is used for unified upgrades and maintenance, policy management, configuration backup, and monitoring settings of firewalls, endpoint detection and response systems, intrusion prevention systems, network application firewalls, and vulnerability scanners. It also handles policy creation, deletion, viewing, editing, distribution, and logging. The control module is also used to customize role permission configurations and to logically isolate the multi-source heterogeneous security data according to the management area.

[0064] In this embodiment, the control module establishes a communication connection with network security devices through a standard management interface. The standard management interface includes a Secure Shell protocol, a Network Configuration Protocol (NIC), and an Application Programming Interface (API). The control module obtains the current version information, operating status information, and policy configuration information of each network security device through the standard management interface, and then summarizes and displays all the information on a unified control interface.

[0065] The management and control module performs unified upgrades and maintenance on network security devices. Specifically, the module detects the software version of each device, downloads the upgrade package from the version server when a new version is available, distributes the upgrade package to the corresponding device through a standard management interface, monitors the upgrade process, and records the upgrade results.

[0066] The management and control module manages network security devices through policy settings. Users can create, delete, view, edit, distribute, or record policies via the policy management interface provided by the module. Policies include access control policies, intrusion detection rules, vulnerability scanning task configurations, and alarm response policies. The management and control module distributes the edited policies to the target devices through a standard management interface and records the policy distribution time, the personnel who distributed the policies, and the device confirmation results.

[0067] The management and control module performs configuration backups for network security devices. It automatically retrieves complete configuration information for each device according to a preset backup cycle and stores this information in a encrypted configuration backup repository. When a device experiences configuration loss or requires rollback, the management and control module retrieves the corresponding version of the configuration information from the configuration backup repository and restores it to the target device.

[0068] The management and control module monitors and configures network security devices. It sets the monitoring frequency and alarm thresholds for each device, and collects real-time operational metrics such as CPU utilization, memory usage, network throughput, and number of connection sessions. When these metrics exceed alarm thresholds, it generates an alarm indicating a device malfunction.

[0069] In one embodiment, the control module is also used to customize role permission configurations, including system administrators, security administrators, and audit administrators. System administrators are responsible for system parameter configuration and user account management; security administrators are responsible for security policy configuration and threat handling operations; and audit administrators are responsible for operation log auditing and compliance checks. The control module supports creating custom roles based on preset roles and assigning permissions to these custom roles, including module access permissions, data viewing permissions, operation execution permissions, and approval process permissions.

[0070] Furthermore, the control module logically isolates multi-source heterogeneous security data according to management regions. Management regions are divided based on organizational structure or network topology, including a global management region and multiple sub-domain management regions. The control module configures an independent data view for each management region, containing only security data belonging to that region. Administrators in each management region can only view and manipulate security data within the scope of their data view and cannot access data across management regions. Through this logical isolation mechanism, the control module achieves secure isolation of data and fine-grained control of permissions between different management regions.

[0071] In this embodiment, centralized control of security devices is achieved through unified upgrades, maintenance, policy management, configuration backup, and monitoring settings for various network security devices. This reduces the complexity of device management and meets the centralized control requirements of graded protection. Furthermore, customized role-based permission configuration enables fine-grained allocation of permissions and clear responsibilities. Finally, logical isolation by management area achieves secure data isolation and hierarchical management, thereby ensuring data security and permission compliance.

[0072] Please refer to Figure 3 As shown, the present invention also provides a data analysis method for IoT terminals, applied to a data analysis system for IoT terminals. The system includes a receiving module, a multi-source correlation analysis module, a causal correlation analysis module, an asset risk assessment module, a threat identification module, and a display module. The method includes: S11, The receiving module receives multi-source heterogeneous security data from the IoT terminal; S12. The multi-source correlation analysis module performs multi-source correlation analysis on the multi-source heterogeneous security data to obtain the correlation analysis results; S13. The causal relationship analysis module performs causal relationship analysis on the discrete alarm events in the multi-source heterogeneous security data to obtain the attack scenario reconstruction result. S14. The asset risk assessment module calculates the comprehensive asset risk assessment value based on the multi-source heterogeneous security data. S15. The threat identification module performs threat identification on the multi-source heterogeneous security data through a feature detection layer, an anomaly analysis layer, and an intelligence association layer to obtain threat identification results. The feature detection layer is used to match the multi-source heterogeneous security data with known threats according to the built-in alarm rules and the threat feature library. The anomaly analysis layer is used to identify abnormal behaviors in the multi-source heterogeneous security data that deviate from the normal behavior baseline of the terminal. The intelligence association layer is used to perform real-time correlation analysis between the multi-source heterogeneous security data and the associated threat intelligence data. S16. The display module visualizes the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment value and threat identification results in the form of a multi-dimensional situational view.

[0073] The specific implementation of the methods in the above embodiments has been described in detail in the embodiments of the relevant system, and will not be elaborated further here.

[0074] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0075] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A data analysis system for an Internet of Things (IoT) terminal, characterized in that, include: The receiving module is used to receive multi-source heterogeneous security data from IoT terminals; The multi-source correlation analysis module is used to perform multi-source correlation analysis on the multi-source heterogeneous security data and obtain the correlation analysis results. The causal correlation analysis module is used to perform causal correlation analysis on discrete alarm events in the multi-source heterogeneous security data to obtain the attack scenario reconstruction results. The asset risk assessment module is used to calculate the comprehensive asset risk assessment value based on the multi-source heterogeneous security data. The threat identification module is used to identify threats in the multi-source heterogeneous security data through a feature detection layer, an anomaly analysis layer, and an intelligence association layer to obtain threat identification results. The feature detection layer is used to match the multi-source heterogeneous security data with known threats according to built-in alarm rules and a threat feature library. The anomaly analysis layer is used to identify abnormal behaviors in the multi-source heterogeneous security data that deviate from the baseline of normal terminal behavior. The intelligence association layer is used to perform real-time correlation analysis between the multi-source heterogeneous security data and associated threat intelligence data. The display module is used to visualize the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment values, and threat identification results in the form of a multi-dimensional situational view.

2. The data analysis system for an IoT terminal according to claim 1, characterized in that, Also includes: The handling module is used to generate handling instructions based on the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment value and threat identification results, and to send the handling instructions to network security devices for execution.

3. The data analysis system for IoT terminals according to claim 2, characterized in that, The handling module is also used to build a visual orchestration node library and customize the event handling process through graphical drag-and-drop connection. The visual orchestration node library includes automated execution nodes, filtering nodes, manual intervention nodes and tag nodes.

4. The data analysis system for an IoT terminal according to claim 1, characterized in that, The asset risk assessment module uses the following formula to calculate the comprehensive asset risk assessment value: ； The asset risk assessment module is also used to score the asset risk based on the comprehensive asset risk assessment value, obtain the asset risk score value, and generate an asset tag based on the asset risk score value.

5. The data analysis system for an IoT terminal according to claim 1, characterized in that, The normal behavior baseline of the terminal includes network behavior baseline, operation behavior baseline and service behavior baseline. The network behavior baseline includes the communication network address range, port distribution, traffic volume and connection frequency. The operation behavior baseline includes login time period, operation type and instruction sequence. The service behavior baseline includes data transmission rules and service operation process.

6. The data analysis system for an IoT terminal according to claim 1, characterized in that, The display module also includes: The IoT asset topology management module is used to discover and maintain the list of IoT devices and the topology relationships between devices. It is also used to complete the addition, deletion, merging and refresh of asset topologies, the free switching of multiple business topologies, and the dynamic reflection of device online and offline status and network address changes. The access behavior visualization module is used to graphically present the access relationships and historical operation behaviors between IoT devices, applications and services, and to identify abnormal access patterns that deviate from the normal behavior baseline of the terminal.

7. The data analysis system for an IoT terminal according to claim 1, characterized in that, The display module also includes: The visual association search module is used to perform a penetrating association search of alarm data and log data by clicking on chart elements in reports and charts as search criteria.

8. The data analysis system for an IoT terminal according to claim 1, characterized in that, The display module is also used to display the device operating status, terminal type distribution, traffic data, alarm data and security events in the form of timeline, heat map or geographic map, and generate alarm time roadmap.

9. The data analysis system for an IoT terminal according to claim 1, characterized in that, Also includes: The asset profiling module is used to sort and cluster the asset fingerprint information of the multi-source heterogeneous security data to construct an asset profile. The asset fingerprint information includes network address, media access control address, vendor information and service information. The threat profiling module is used to analyze and profile the network addresses of threat sources in the multi-source heterogeneous security data, and to visualize threat characteristics from attack behavior, attack trends and outbound behavior.

10. A data analysis method for an Internet of Things (IoT) terminal, characterized in that, A data analysis system for IoT terminals, comprising a receiving module, a multi-source correlation analysis module, a causal correlation analysis module, an asset risk assessment module, a threat identification module, and a display module, wherein the method includes: The receiving module receives multi-source heterogeneous security data from IoT terminals; The multi-source correlation analysis module performs multi-source correlation analysis on the multi-source heterogeneous security data to obtain correlation analysis results. The causal correlation analysis module performs causal correlation analysis on discrete alarm events in the multi-source heterogeneous security data to obtain the attack scenario reconstruction results. The asset risk assessment module calculates a comprehensive asset risk assessment value based on the multi-source heterogeneous security data. The threat identification module performs threat identification on the multi-source heterogeneous security data through a feature detection layer, an anomaly analysis layer, and an intelligence association layer to obtain threat identification results. The feature detection layer is used to match the multi-source heterogeneous security data with known threats according to built-in alarm rules and a threat feature library. The anomaly analysis layer is used to identify abnormal behaviors in the multi-source heterogeneous security data that deviate from the baseline of normal terminal behavior. The intelligence association layer is used to perform real-time correlation analysis between the multi-source heterogeneous security data and associated threat intelligence data. The display module visualizes the correlation analysis results, attack scenario reconstruction results, asset risk comprehensive assessment values, and threat identification results in a multi-dimensional situational view.

Images