An AI-based internet of things protocol unknown threat real-time sensing method

Abstract

This invention belongs to the fields of IoT security and artificial intelligence technology, and particularly relates to an AI-based real-time perception method for unknown threats in IoT protocols. Normal protocol traffic is collected and protocol-independent information is analyzed. A trained semantic representation model extracts semantic feature vectors and semantic role vectors. Devices are categorized based on device profiles, and semantic role equivalence classes are established by clustering similar devices according to their semantic role vectors. For each equivalence class, an intra-class constraint manifold, projection operator, and collective mutation subspace are established. After a message is assigned to its corresponding equivalence class, an intra-class deviation vector is calculated, which is decomposed into a collective deviation component, an individual deviation component, and a collective evolution consistency index. The threat level monotonically increases with the individual deviation magnitude, while the collective deviation decreases only when the consistency condition is met, and increases otherwise. A threshold exceeding the threshold indicates the presence of an unknown threat. The individual deviation direction is decoded and attributed to the protocol semantic unit as a threat semantic fingerprint, which is then output as a warning. No attack samples or protocol specifications are required.

Description

Technical Field

[0001] This invention belongs to the field of IoT security and artificial intelligence technology, and in particular relates to an AI-based method for real-time perception of unknown threats to IoT protocols. Background Technology

[0002] With the large-scale deployment of IoT devices, their communication protocols are highly heterogeneous, including both public standard protocols such as MQTT and CoAP, as well as a large number of vendor-defined proprietary protocols. Furthermore, IoT devices generally suffer from limited computing and storage resources and are often directly exposed to untrusted network environments, making threat detection a crucial aspect of ensuring IoT security. Existing detection solutions mainly fall into three categories: matching schemes based on known attack characteristics or signatures can only identify known threats already included in the signature database, and are completely ineffective against unknown threats; detection schemes based on statistical anomalies essentially only measure the degree of deviation of messages from normal statistical models. On the one hand, they cannot distinguish between normal protocol evolution and attack behavior, generating a large number of false alarms when normal evolution causes traffic statistical characteristics to drift; on the other hand, they do not utilize the unique characteristic of large-scale homogeneous IoT devices repeatedly executing the same protocol, limiting detection accuracy; verification schemes based on protocol state machines or manual rules rely on pre-configured protocol specifications, are not applicable to proprietary and unknown protocols, and the configuration and maintenance of protocol specifications require manual input and are costly. Therefore, existing technologies cannot detect unknown threats in IoT protocols in real time without the need for any known attack samples or pre-configured protocol specifications, and cannot reliably distinguish between normal protocol evolution and attack behavior, resulting in both unreported unknown threats and false alarms of normal evolution. Summary of the Invention

[0003] This invention addresses the technical problems existing in the real-time perception of unknown threats to IoT protocols, and proposes an AI-based method for real-time perception of unknown threats to IoT protocols that is reasonably designed, simple in method, and theoretically sound.

[0004] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0005] S1. Collect normal protocol communication traffic between IoT devices, and perform protocol-independent message segmentation on the normal protocol communication traffic to obtain a normal protocol message sequence;

[0006] S2. The normal protocol message sequence is subjected to semantic feature extraction using a trained semantic representation model to obtain semantic feature vectors and semantic role vectors. The semantic representation model is obtained by joint self-supervised training of semantic reconstruction, cross-instance role consistency constraints and session state transition prediction using normal protocol messages as samples. It is used to encode the field attributes, inter-field associations and state transition semantics of messages under the condition of no protocol syntax prior. The semantic role vector is used to represent the semantic role that normal protocol messages in the normal protocol message sequence assume in the protocol session.

[0007] S3. Based on the device profile, the IoT devices are classified into device categories. Based on the semantic role vector and with the device category as a constraint, normal protocol messages of the same type of device and different sessions that assume the same semantic role are classified into semantic role equivalence classes through unsupervised clustering. A semantic role equivalence class partitioning model is established. Normal protocol messages in the same semantic role equivalence class assume the same semantic role. Normal protocol messages of different device categories are not classified into the same semantic role equivalence class.

[0008] S4. Establish the intra-class constrained manifold of the normal protocol message, the projection operator of the intra-class constrained manifold, and the collective mutation subspace through the manifold learning algorithm. Calculate the intra-class deviation vector of the normal protocol message and decompose the intra-class deviation vector into a collective deviation component and an individual deviation component. The collective deviation component is the projection component of the intra-class deviation onto the collective mutation subspace, and the individual deviation component is the orthogonal cofactor of the intra-class deviation minus the collective deviation component. Calculate the collective evolution consistency index of the collective deviation component. The collective evolution consistency index characterizes the degree of fit between the collective deviation component and the historical evolutionary main direction within the collective mutation subspace, as well as the temporal stability of the collective deviation component within a preset time window.

[0009] S5. Calculate the threat level of the normal protocol message. The threat level increases monotonically with the magnitude of the individual deviation component. When the collective deviation component satisfies the collective evolutionary consistency condition, the threat level decreases monotonically with the magnitude of the collective deviation component. When the collective deviation component does not satisfy the collective evolutionary consistency condition, the threat level increases monotonically with the magnitude of the collective deviation component. The collective evolutionary consistency condition is determined based on the collective evolutionary consistency index. Furthermore, the threat level increases when the normal protocol message violates the cross-field logical consistency constraint.

[0010] S6. When the threat level exceeds the adaptive threshold, it is determined that the normal protocol message carries an unknown threat, and the deviation direction of the individual deviation component is output as a threat semantic fingerprint to generate real-time perception warning information. The unknown threat is an attack behavior that does not match the attack pattern in the known attack feature library.

[0011] Preferably, the training formula for the model used to encode the multidimensional semantic information of the protocol message, obtained through AI training in S2, is as follows:

[0012] , ,

[0013] , ,

[0014] in, For total training losses, For semantic reconstruction, for, For cross-instance role consistency items, The weighting coefficients for the session state transition prediction term. For session state transition prediction, Let the mathematical expectation of the distribution that the normal protocol message set follows be... For a training sample, For the message The semantic feature vector obtained by the encoder, The message is obtained by reconstructing from this semantic representation. For the mathematical expectation of the set of cross-instance same-role message pairs, For a collection of cross-instance, same-role message pairs, The message at the current moment in the session. This is the next message that immediately follows in the conversation. For the message semantic role vectors, For the message semantic role vectors, For the mathematical expectation of the set of adjacent message pairs within the same session, For the set of adjacent message pairs within the same session, This is the semantic role vector of the current message. This is the semantic role vector for the next message. Given the role vector of the current message, the model predicts the conditional probability of the role vector of the next message.

[0015] Preferably, the formula for calculating the intra-class deviation vector of normal protocol messages arriving in real time in S4 is as follows:

[0016] , ,

[0017] in, This is the intra-class deviation vector. For the first The semantic feature vector of a real-time arrival protocol message. For the first Intra-class constrained manifold projection operator for class messages, The normal protocol message is classified as the first Semantic role equivalence class For the first Message type at time Cross-instance collective evolution baseline, The number of messages within the window. For the first in the sliding window The semantic feature vector of a message, For the summation vernier, the formula for calculating the collective deviation component is:

[0018] , ,

[0019] in, For the collective deviation component, For the first The basis matrix of the collective variant subspace of the class. The normal protocol message is classified as the first Semantic role equivalence class To use the collective coefficients It is a diagonal matrix composed of diagonal elements. This is the transpose of the basis matrix. This is the intra-class deviation vector. For the first Collectivity coefficient in each direction, Let Variance be the cross-instance consistent variation variance in the i-th direction. For the first Single-instance noise variance in each direction, For the first in this type of collective mutation subspace The formula for calculating the individual deviation component in a collective direction is as follows:

[0020] ,

[0021] in, For individual deviation components, This is the intra-class deviation vector. For the first The basis matrix of the collective variant subspace of the class. As the transpose of the basis matrix, the formula for calculating the collective evolutionary consistency index of the collective deviation components is:

[0022] ,

[0023] in, As an indicator of collective evolutionary consistency, These are the weighting coefficients. This represents the collective deviation component vector of the current normal protocol messages. Let be the principal component direction vector of the collective variant subspace extracted from historical normal data. Preset time window The standard deviation of the internal collective deviation from the component modulus. Preset time window The mean of the deviation of the internal collective from the component modulus, To prevent the removal of the zero constant.

[0024] Preferably, the formula for calculating the threat level of real-time arriving protocol messages in S5 is as follows:

[0025] , ,

[0026] in, The threat level of protocol messages arriving in real time. For individual deviation components, For the collective deviation component, For the first Individuals deviate from the baseline. Synchronization sensitivity coefficient This represents the average deviation of all individual messages within the current window, excluding this message, from the modulus. The number of messages within the window. To sum the cursor, iterate through every message in the window except the current message. For the first in the window Individual deviation components of each message.

[0027] Compared with the prior art, the advantages and positive effects of the present invention are as follows:

[0028] 1. It can detect unknown threats without known attack samples or pre-configured protocol specifications; the semantic representation model, semantic role equivalence class, intra-class constrained manifold, projection operator and collective mutation subspace are all established solely from normal protocol messages, without relying on attack samples and protocol specifications throughout the process.

[0029] 2. By decomposing intra-class deviations into collective deviation components and individual deviation components, normal protocol evolution and attack behavior can be distinguished, and false alarms can be reduced. The threat level increases monotonically with the increase of the individual deviation component magnitude and decreases monotonically with the increase of the collective deviation component magnitude, thus suppressing normal evolution and highlighting attacks.

[0030] 3. It can output real-time and interpretable early warnings of unknown threats; if the threat level exceeds the adaptive threshold, it is determined to be an unknown threat, and the threat semantic fingerprint of the individual deviation direction is output to generate real-time early warning information. This fingerprint can be reused and does not need to be converted into a signature based on the attack payload. Attached Figure Description

[0031] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 This is a schematic diagram of the structure of an AI-based IoT protocol for real-time perception of unknown threats. Detailed Implementation

[0033] To better understand the above-mentioned objectives, features, and advantages of the present invention, the present invention will be further described below in conjunction with the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other.

[0034] Numerous specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways than those described herein, and therefore the invention is not limited to the specific embodiments disclosed in the following specification.

[0035] Examples, such as Figure 1As shown, normal protocol communication traffic between IoT devices is collected, and the normal protocol communication traffic is segmented into protocol-independent messages to obtain a normal protocol message sequence. For each normal protocol message in the normal protocol message sequence, a trained semantic representation model is used to extract semantic features, resulting in a semantic feature vector and a semantic role vector. The semantic representation model is a model trained by AI using normal protocol messages as samples to encode multi-dimensional semantic information of protocol messages. The semantic feature vector is used to represent at least one semantic information of normal protocol messages in field attributes, inter-field associations, and inter-message state transitions. The semantic role vector is used to represent the semantic role played by normal protocol messages in the protocol session. This constitutes the input stage of the entire invention, solving the prerequisite problem of understanding IoT protocol messages under the condition of not knowing the protocol and having no attack samples. The collected raw protocol communication traffic is segmented into protocol-independent segments according to message boundaries to obtain independent protocol messages. The segmentation process does not depend on any protocol specification and can be uniformly applied to public protocols, private protocols, and unknown protocols. Each protocol message is input into a semantic representation model trained by AI, using normal protocol messages as samples. The model automatically learns the protocol semantics and outputs two results: a semantic feature vector and a semantic role vector. The semantic feature vector encodes the message's content information regarding field attributes, inter-field relationships, and inter-message state transitions, used for subsequent measurement of intra-class deviation. The semantic role vector encodes the semantic role the message assumes in the protocol session, used to classify the message into the corresponding semantic role equivalence class. These two vectors serve role localization and deviation measurement, respectively. Using this method, protocol semantics can be understood without writing protocol specifications, and modeling can be completed without any attack samples. This overcomes the problem of existing solutions relying on protocol parsing and manual rules, which cannot cover private protocols. Furthermore, it provides a computable semantic space for subsequent establishment of semantic role equivalence classes, decomposition of collective and individual deviations, and calculation of threat levels, forming the foundation for the entire detection method. The training formula for the AI-trained model used to encode the multi-dimensional semantic information of protocol messages is as follows:

[0036] , ,

[0037] , ,

[0038] in, For total training losses, For semantic reconstruction, for, For cross-instance role consistency items, The weighting coefficients for the session state transition prediction term. For session state transition prediction, Let the mathematical expectation of the distribution that the normal protocol message set follows be... For a training sample, For the message The semantic feature vector obtained by the encoder, The message is obtained by reconstructing from this semantic representation. For the mathematical expectation of the set of cross-instance same-role message pairs, For a collection of cross-instance, same-role message pairs, The message at the current moment in the session. This is the next message that immediately follows in the conversation. For the message semantic role vectors, For the message semantic role vectors, For the mathematical expectation of the set of adjacent message pairs within the same session, For the set of adjacent message pairs within the same session, This is the semantic role vector of the current message. This is the semantic role vector for the next message. Given the role vector of the current message, the model predicts the conditional probability of the role vector of the next message. The total training loss is composed of a weighted sum of the semantic reconstruction term, the cross-instance role consistency term, and the session state transition prediction term. The semantic reconstruction term uses a normal protocol message as a sample, compresses it into a semantic representation using a semantic encoder, and then reconstructs it using a decoder. The square of the magnitude difference between the original message and the reconstructed message is used as the reconstruction error, and the expected value is taken over the set of normal protocol messages to ensure the model retains the message content structure without manual annotation. The cross-instance role consistency term uses message pairs that assume the same semantic role across devices, sessions, and time periods as samples, and the square of the magnitude difference between their semantic role vectors is used as the error. Taking the expected value of message pairs helps messages with the same semantic role to cluster in the role vector space, removing differences in device session durations and providing a separable representation for unsupervised clustering of semantic role equivalence classes. The session state transition prediction term uses adjacent message pairs within the same session as samples, and uses the negative log-likelihood of the model's conditional probability prediction of the next message's role vector given the current message's role vector as the error, taking the expected value of adjacent message pairs. This allows the model to learn the state transition structure of the protocol session, supporting the encoding of the message state transition dimension in the semantic feature vector. Weight coefficients are used to adjust the relative contributions of the three terms. The combined effect of these three self-supervised signals enables the model to learn a multi-dimensional semantic representation that simultaneously carries content structure, cross-instance role consistency, and session state transition structure, even without attack samples, protocol specifications, or manual annotation. This provides a directly supportive representational foundation for subsequent establishment of semantic role equivalence classes, calculation of intra-class deviation, decomposition of collective and individual deviations, and calculation of threat level.

[0039] Based on the semantic role vectors, normal protocol messages are categorized into semantic role equivalence classes using unsupervised clustering, and a semantic role equivalence class partitioning model is established accordingly. Normal protocol messages within the same semantic role equivalence class assume the same protocol semantic role. These semantic role equivalence classes are aggregated across devices and sessions. For each semantic role equivalence class, based on the semantic feature vectors of the normal protocol messages in that class, a manifold learning algorithm is used to establish the intra-class constrained manifold, the projection operator of the intra-class constrained manifold, and the collective mutation subspace for that class of messages. The intra-class constrained manifold represents the range of normal semantic values ​​for that class of messages. The projection operator of the intra-class constrained manifold is used to project semantic feature vectors onto the intra-class constrained manifold. The collective mutation subspace is constructed using the mutation direction that changes consistently across instances during the normal evolution of this type of message as the basis vector. For real-time arriving protocol messages, the semantic representation model is used to extract semantic features, obtaining their semantic feature vectors and semantic role vectors. Based on the semantic role vectors, the semantic role equivalence class partitioning model established during the training phase is used to classify the real-time arriving protocol messages into their corresponding semantic role equivalence classes. This is used to determine the semantic role equivalence class to which the real-time arriving protocol messages belong and their corresponding semantic role equivalence classes. The corresponding normal metric benchmark is as follows: During the training phase, normal protocol messages are classified into semantic role equivalence classes using unsupervised clustering based on semantic role vectors, and a semantic role equivalence class partitioning model is established. Messages of the same class assume the same protocol semantic role and are aggregated across devices and sessions. Subsequently, for each semantic role equivalence class, based on the semantic feature vectors of normal protocol messages in that class, a manifold learning algorithm is used to establish the intra-class constrained manifold, the projection operator of the intra-class constrained manifold, and the collective mutation subspace of that class of messages. The intra-class constrained manifold represents the normal semantic value range of that class of messages, and the projection operator is used to project the semantic feature vectors onto the manifold. The collective mutation subspace is constructed using the mutation direction that changes consistently across instances during the normal evolution of this type of message as the basis vector. The above modeling process uses only normal protocol messages, without using attack samples or relying on protocol specifications. During real-time detection, semantic feature vectors and semantic role vectors are extracted from real-time arriving protocol messages using a semantic representation model. Based on the semantic role vectors, the semantic role equivalence class partitioning model established during the training phase is used to classify them into the corresponding semantic role equivalence class. This allows the intra-class constraint manifold, projection operator, and collective mutation subspace of that class to calculate intra-class deviations, which are then decomposed into collective deviation components and individual deviation components. This approach ensures that the deviation metric of each real-time message is based on a benchmark established from normal messages within its respective semantic role equivalence class, providing a foundation for distinguishing between normal protocol evolution and attack behavior in the absence of attack samples and protocol specifications.

[0040] Using the projection operator established for the semantic role equivalence class during the training phase, the intra-class deviation vector of the semantic feature vector of the real-time arriving protocol message relative to the intra-class constraint manifold of that class is calculated. The intra-class deviation vector is then decomposed into a collective deviation component and an individual deviation component. The collective deviation component is the projection of the intra-class deviation onto the collective variability subspace, and the individual deviation component is the orthogonal residual after subtracting the collective deviation component from the intra-class deviation. The formula for calculating the intra-class deviation vector is:

[0041] , ,

[0042] in, This is the intra-class deviation vector. For the first The semantic feature vector of a real-time arrival protocol message. For the first Intra-class constrained manifold projection operator for class messages, The normal protocol message is classified as the first Semantic role equivalence class For the first Message type at time Cross-instance collective evolution baseline, The number of messages within the window. For the first in the sliding window The semantic feature vector of a message, For the summation vernier, the formula for calculating the collective deviation component is:

[0043] , ,

[0044] in, For the collective deviation component, For the first The basis matrix of the collective variant subspace of the class. The normal protocol message is classified as the first Semantic role equivalence class To use the collective coefficients It is a diagonal matrix composed of diagonal elements. This is the transpose of the basis matrix. This is the intra-class deviation vector. For the first Collectivity coefficient in each direction, Let Variance be the cross-instance consistent variation variance in the i-th direction. For the first Single-instance noise variance in each direction, For the first in this type of collective mutation subspace The formula for calculating the individual deviation component in a collective direction is as follows:

[0045] ,

[0046] in, For individual deviation components, This is the intra-class deviation vector. For the first The basis matrix of the collective variant subspace of the class. This is the transpose of the basis matrix. First, using the semantic feature vector of the real-time message as the reference position, the static normal reference and the dynamic collective reference are successively subtracted to obtain the intra-class deviation vector. The static normal reference is obtained by projecting the semantic feature vector of the normal protocol message onto the projection operator of the intra-class constrained manifold, and is used to subtract legitimate fluctuations within the normal value range. The dynamic collective reference is the mean of the semantic feature vectors of all messages of this type within the sliding window, representing the semantic position of the device group at this moment, and is used to subtract group collective drift caused by firmware upgrades, parameter adjustments, etc., thus retaining only the net deviation that cannot be normally interpreted. Then, the intra-class deviation vector is transformed to each collective through the transpose of the collective variogram subspace basis matrix. The coordinates of the directions are then shrunk by a diagonal matrix with the collectiveness coefficient as the diagonal element to restore the collective deviation component. The collectiveness coefficient is the proportion of the cross-instance consistency variance variance in that direction to the total variance variance in that direction. This ensures that deviations in directions dominated by collective consistency changes are fully absorbed into the collective component, while deviations in directions dominated by single-instance noise are automatically left to the individual component, preventing noisy collective directions from masking individual attacks. Finally, the collective deviation component is obtained by subtracting the total intra-class deviation from the individual deviation component, ensuring the completeness of the decomposition and retaining only the deviation components unique to normal protocol messages. This serves as the monotonically increasing input for threat level calculation as the modulus increases. Each of these elements is responsible for defining the normal range, tracking collective evolution, distinguishing between collective and individual variations, and ensuring the completeness of the decomposition. This ensures that normal evolution is attributed to the collective component and suppressed by threat level, while attacks are attributed to the individual component and the threat level is highlighted. This achieves low false alarm perception of unknown threats even without attack samples or protocol specifications. The formula for calculating the collective evolution consistency index of the collective deviation component is:

[0047] ,

[0048] in, As an indicator of collective evolutionary consistency, These are the weighting coefficients. This represents the collective deviation component vector of the current normal protocol messages. Let be the principal component direction vector of the collective variant subspace extracted from historical normal data. Preset time window The standard deviation of the internal collective deviation from the component modulus. Preset time window The mean of the deviation of the internal collective from the component modulus, To prevent the removal of the zero constant.

[0049] Based on the monotonically mapping relationship between the magnitude of the individual deviation component and the magnitude of the collective deviation component, the threat level of the real-time arriving protocol message is calculated. The threat level monotonically increases with the magnitude of the individual deviation component and monotonically decreases with the magnitude of the collective deviation component. The formula for calculating the threat level of the real-time arriving protocol message is:

[0050] , ,

[0051] in, The threat level of protocol messages arriving in real time. For individual deviation components, For the collective deviation component, For the first Individuals deviate from the baseline. Synchronization sensitivity coefficient This represents the average deviation of all individual messages within the current window, excluding this message, from the modulus. The number of messages within the window. To sum the cursor, iterate through every message in the window except the current message. For the first in the window The threat level is calculated using the portion of the individual deviation component of a normal protocol message that exceeds the baseline deviation of the individual deviation component of the semantic role equivalence class as the numerator, ensuring that the numerator approaches zero under normal conditions and is significantly positive during attacks. The denominator is the square root of the sum of the squares of the collective deviation component and the individual deviation from the baseline, ensuring that the threat level increases monotonically with respect to the individual deviation component of normal protocol messages and decreases monotonically with respect to the collective deviation component of normal protocol messages, while also ensuring that the threat level is a dimensionless scalar and the denominator is never zero. This is then multiplied by a synchronization suppression term, which is calculated by multiplying the average of the individual deviation component magnitudes of all messages except this message within the sliding window by the individual deviation component. The ratio of deviations from the baseline serves as a measure of the deviation level of other messages, and is adjusted by a synchronization sensitivity coefficient. The number of messages within the window is reduced by one to exclude the current message itself, and the summation cursor and exclusion conditions ensure that only other messages are counted. When the deviation level of other messages is close to the baseline, the suppression term is close to 1, and the threat level is mainly determined by the individual deviation of the normal protocol message itself. When the deviation level of other messages is significantly higher than the baseline, the suppression term is less than 1, and the threat level is suppressed, thereby avoiding misjudging the deviation of other messages as an attack of this message. Finally, a dimensionless threat level is obtained, which is used to compare with an adaptive threshold to determine whether a normal protocol message carries an unknown threat.

[0052] When the threat level exceeds the adaptive threshold, the arriving protocol message is determined to carry an unknown threat, and the deviation direction of the individual deviation component is output as a threat semantic fingerprint, generating real-time awareness and early warning information. The unknown threat is an attack behavior that does not match the attack pattern in the known attack feature library. The determination is completed by comparing the continuous threat level with the adaptive threshold. Because the distribution of normal protocol behavior changes over time, an adaptive threshold calibrated online based on normal traffic is used instead of a fixed threshold to avoid threshold failure. When the threat level exceeds the threshold, the normal protocol message is determined to carry an unknown threat, and the deviation direction of the individual deviation component of the normal protocol message is output as a threat semantic fingerprint. Because the individual deviation component is a unique attack component of the normal protocol message, its direction indicates which dimensions of protocol semantic consistency the attack has disrupted, carrying more complete information than a single threat level value. It can be used for comparison and perception with subsequent similar unknown threats without needing to be converted into a signature based on a specific attack payload. Real-time awareness and early warning information is then generated for the security system to handle. Simultaneously, the unknown threat is defined by not matching the attack pattern in the known attack feature library, indicating that the detection does not rely on known feature matching. This step addresses the issues of implementing deviation measurement into detection and judgment, the incompatibility of fixed thresholds with the evolution of normal behavior, the unexplainable nature of existing alarms, and the inability of existing feature database matching schemes to detect unknown threats.

[0053] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments for application in other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for real-time perception of unknown threats in IoT protocols based on AI, characterized in that, Includes the following steps: S1. Collect normal protocol communication traffic between IoT devices, and perform protocol-independent message segmentation on the normal protocol communication traffic to obtain a normal protocol message sequence; S2. The trained semantic representation model is used to extract semantic features from the normal protocol message sequence to obtain semantic feature vectors and semantic role vectors. The trained semantic representation model is obtained by joint self-supervised training of semantic reconstruction, cross-instance role consistency constraints and session state transition prediction using normal protocol messages as samples. It is used to encode the field attributes, inter-field associations and state transition semantics of messages under the condition of no protocol syntax prior. The semantic role vector is used to represent the semantic role played by normal protocol messages in the protocol session in the normal protocol message sequence. S3. Based on the device profile, the IoT devices are classified into device categories. Based on the semantic role vector and with the device category as a constraint, normal protocol messages of the same type of device and different sessions that assume the same semantic role are classified into semantic role equivalence classes through unsupervised clustering. A semantic role equivalence class partitioning model is established. Normal protocol messages in the same semantic role equivalence class assume the same semantic role. Normal protocol messages of different device categories are not classified into the same semantic role equivalence class. S4. Establish the intra-class constrained manifold of the normal protocol message, the projection operator of the intra-class constrained manifold, and the collective mutation subspace through the manifold learning algorithm. Calculate the intra-class deviation vector of the normal protocol message and decompose the intra-class deviation vector into a collective deviation component and an individual deviation component. The collective deviation component is the projection component of the intra-class deviation onto the collective mutation subspace, and the individual deviation component is the orthogonal cofactor of the intra-class deviation minus the collective deviation component. Calculate the collective evolution consistency index of the collective deviation component. The collective evolution consistency index characterizes the degree of fit between the collective deviation component and the historical evolutionary main direction within the collective mutation subspace, as well as the temporal stability of the collective deviation component within a preset time window. S5. Calculate the threat level of the normal protocol message. The threat level increases monotonically with the magnitude of the individual deviation component. When the collective deviation component satisfies the collective evolution consistency condition, the threat level decreases monotonically with the magnitude of the collective deviation component. When the collective deviation component does not satisfy the collective evolution consistency condition, the threat level increases monotonically with the magnitude of the collective deviation component. The collective evolution consistency condition is determined based on the collective evolution consistency index. The threat level increases when the normal protocol message violates the cross-field logical consistency constraint. S6. When the threat level exceeds the adaptive threshold, it is determined that the normal protocol message carries an unknown threat, and the deviation direction of the individual deviation component is output as a threat semantic fingerprint to generate real-time perception warning information. The unknown threat is an attack behavior that does not match the attack pattern in the known attack feature library.

2. The method for real-time perception of unknown threats in IoT protocols based on AI according to claim 1, characterized in that, The training formula for the semantic representation model in S2 is as follows: ， ， ， ， in, For total training losses, For semantic reconstruction, for, For cross-instance role consistency items, These are the weighting coefficients for the session state transition prediction term. For session state transition prediction, Let the mathematical expectation of the distribution that the normal protocol message set follows be... For a training sample, For the message The semantic feature vector obtained by the encoder, The message is obtained by restoring the semantic representation. For the mathematical expectation of the set of cross-instance same-role message pairs, For a collection of cross-instance, same-role message pairs, The message at the current moment in the session. This is the next message that immediately follows in the conversation. For the message semantic role vectors, For the message semantic role vectors, For the mathematical expectation of the set of adjacent message pairs within the same session, For the set of adjacent message pairs within the same session, This is the semantic role vector of the current message. This is the semantic role vector for the next message. Given the role vector of the current message, the model predicts the conditional probability of the role vector of the next message.

3. The method for real-time perception of unknown threats in IoT protocols based on AI according to claim 1, characterized in that, The formula for calculating the intra-class deviation vector of normal protocol messages arriving in real time in S4 is as follows: ， ， in, This is the intra-class deviation vector. For the first The semantic feature vector of a real-time arrival protocol message. For the first Intraclass constrained manifold projection operator for class messages, The normal protocol message is classified as the first Semantic role equivalence class For the first Message type at time Cross-instance collective evolution baseline, The number of messages within the window. For the first in the sliding window The semantic feature vector of a message, For the summation vernier, the formula for calculating the collective deviation component is: ， ， in, For the collective deviation component, For the first The basis matrix of the collective variant subspace of the class. The normal protocol message is classified as the first Semantic role equivalence class To use the collective coefficients It is a diagonal matrix composed of diagonal elements. This is the transpose of the basis matrix. This is the intra-class deviation vector. For the first Collectivity coefficient in each direction, Let Variance be the cross-instance consistent variation variance in the i-th direction. For the first Single-instance noise variance in each direction, For the first in this type of collective mutation subspace The formula for calculating the individual deviation component in a collective direction is as follows: ， in, For individual deviation components, This is the intra-class deviation vector. For the first The basis matrix of the collective variant subspace of the class. As the transpose of the basis matrix, the formula for calculating the collective evolutionary consistency index of the collective deviation components is: ， in, As an indicator of collective evolutionary consistency, These are the weighting coefficients. This represents the collective deviation component vector of the current normal protocol messages. Let be the principal component direction vector of the collective variant subspace extracted from historical normal data. Preset time window The standard deviation of the internal collective deviation from the component modulus. Preset time window The mean of the deviation of the internal collective from the component modulus, To prevent the removal of the zero constant.

4. The method for real-time perception of unknown threats in IoT protocols based on AI according to claim 1, characterized in that, The formula for calculating the threat level of real-time arriving protocol messages in S5 is as follows: ， ， in, The threat level of protocol messages arriving in real time. For individual deviation components, For the collective deviation component, For the first Individuals deviate from the baseline. Synchronization sensitivity coefficient This represents the average deviation of all individual messages within the current window, excluding this message, from the modulus. The number of messages within the window. To sum the cursor, iterate through every message in the window except the current message. For the first in the window Individual deviation components of each message.

Images