CN115348184B

CN115348184B - Internet of things data security event prediction method and system

Info

Publication number: CN115348184B
Application number: CN202210979624.7A
Authority: CN
Inventors: 高小虎
Original assignee: Jiangsu Vocational College of Business
Current assignee: Jiangsu Vocational College of Business
Priority date: 2022-08-16
Filing date: 2022-08-16
Publication date: 2024-01-26
Anticipated expiration: 2042-08-16
Also published as: CN115348184A

Abstract

The invention discloses a method and a system for predicting data security events of the Internet of things. And obtaining the data of the Internet of things. And detecting the data of the Internet of things to obtain a transmission vector set. And carrying out hash mapping on the data content vector to obtain a mapping vector. And inputting the mapping vector and the header vector into a security event prediction model to obtain a predicted security value. And if the predicted safety value is 0, discarding the data packet. After data information is mapped through the hash mapping table, the storage structure is controlled to store the training length position, the LTSM neural network is input, the data length can be reduced and becomes fixed, the detection of the neural network is faster, the association on the data information sequence is obtained, the output of the training content data at any position is controlled, and therefore the influence of unnecessary data on training is reduced. And inputting the header information into a DNN neural network, and judging together to accurately obtain a predicted safety value.

Description

Internet of things data security event prediction method and system

Technical Field

The invention relates to the technical field of computers, in particular to a method and a system for predicting data security events of the Internet of things.

Background

The problem of data interaction between the client and the server is that the receiving end receives data, but sometimes the phenomenon of unsafe data occurs, and the unsafe data can cause damage to the receiving end, so that the safety of the transmitted data needs to be judged. Since the transmission data is excessive and the transmission data is not data in an ideal state but is converted into binary data, the security problem is not easily solved.

Disclosure of Invention

The invention aims to provide a method and a system for predicting data security events of the Internet of things, which are used for solving the problems in the prior art.

In a first aspect, an embodiment of the present invention provides a method for predicting an internet of things data security event, including:

obtaining data of the Internet of things; the data of the Internet of things is information transmitted by a user request; the data of the Internet of things is application layer request information which is received by a receiving end and transmitted through a network;

detecting the data of the Internet of things to obtain a transmission vector set; the set of transmission vectors includes a header vector and a data content vector; the vector values in the data content vector represent the transmitted content;

hash mapping is carried out on the data content vector to obtain a mapping vector;

inputting the mapping vector and the header vector into a security event prediction model to obtain a predicted security value; the predicted security value being 1 indicates data transmission security; the predicted security value being 0 indicates that the transmission data is not secure;

and if the predicted safety value is 0, discarding the data packet.

Optionally, the security event prediction model includes a storage structure, an LTSM neural network, and a DNN neural network:

the input of the DNN neural network is a data content vector; the input of the storage structure is a data content vector; the inputs to the LTSM neural network are the header vector and the output of the memory structure.

Optionally, the obtaining, by detecting, the data of the internet of things, a set of transmission vectors includes:

obtaining an Internet of things protocol; the internet of things protocol is a communication protocol with a fixed receiving end; the internet of things protocol is an application layer protocol;

obtaining a plurality of initial positions according to the Internet of things data and an Internet of things protocol; the initial position is the position of various information in the transmitted internet of things data;

dividing the data of the Internet of things at a plurality of initial positions to obtain a plurality of transmission data sets; the transmission data set is a set formed by values of corresponding positions of an internet of things protocol;

and respectively forming a plurality of vectors by the values in the plurality of transmission data sets to obtain a transmission vector set.

Optionally, the hash mapping the data content vector to obtain a mapping vector includes:

obtaining a request length; the request length is the data length transmitted by the request;

sequentially combining the plurality of data content vectors according to the request length to obtain a plurality of combined data vectors; the vector length of the merged data vector is the request length;

obtaining a fixed length value; the fixed length value is a set length value;

based on the fixed length value and the combined data vector, a mapping vector is obtained through hash mapping.

Optionally, the obtaining the mapping vector by hash mapping based on the fixed length value and the merged data vector includes:

establishing a hash mapping table; the key value in the Ha Xiying table is a plurality of key value pairs arranged from 0;

dividing the combined data by a fixed length value to obtain a division length;

dividing the combined data vector into a plurality of data according to the dividing length to obtain a plurality of divided data;

searching the split data through a hash mapping table to obtain a plurality of mapping data;

forming a plurality of mapping data into a mapping vector; the length of the mapping vector is a fixed length value.

Optionally, the training method of the security event prediction model includes:

obtaining a training set; the training set comprises a plurality of training data and a corresponding plurality of labeling data; the training data comprises training header data and training content data; the training content data is mapping data constructed in the history transmission process; the labeling data is 1 to indicate safety; the labeling data being 0 indicates unsafe;

based on the training content data, a training length position is obtained;

inputting the training data and the training length position into a safety event prediction model to obtain a training prediction safety value;

obtaining a loss value through a loss function by the training predicted safety value and the labeling data;

obtaining the current training iteration times of a safety event prediction model and the preset maximum iteration times of the training of the safety event prediction model;

and stopping training when the loss value is smaller than or equal to a threshold value or the training iteration number reaches the maximum iteration number, and obtaining a trained safety event prediction model.

Optionally, the obtaining the training length position based on the training content data includes:

searching training content data, and judging whether a value with a vector value of-1 in the training data exists in the data;

if the value of the vector value of the training content data is-1, obtaining the length position of the training content; the training content length position is the position of the first value equal to-1 in the training data.

Optionally, inputting the training data and the training length position into a safety event prediction model to obtain a training prediction safety value, including:

inputting training length positions and training content data in the training data into an LTSM neural network to obtain training content values; the training content value represents the sequential relationship of the data; the training content value of 1 indicates that the training content data is safe, and the training content value of 0 indicates that the training content data is unsafe;

inputting training header data in the training data into a DNN neural network to obtain a training header value; the training header value of 1 indicates that the training header data is safe, and the training header value of 0 indicates that the training header data is unsafe;

when the training content value is 1, the training header value is 1, and the training prediction safety value is set to be 1;

and when the training content value is 0 or the training header value is 0, setting the training prediction safety value to 0.

Optionally, inputting the training length position and training content data in the training data into the LTSM neural network to obtain a training content value, including:

inputting the training length position into a storage structure;

inputting a first vector value in the training content data into a first LTSM structure to obtain a first LTSM output value;

inputting a second vector value in the first LTSM output value and training content data into a second LTSM structure to obtain a second LTSM output value;

and inputting the LTSM structure by repeatedly inputting the LTSM output value and the vector in the training content data until reaching the training length position in the storage structure, thereby obtaining the training content value.

In a second aspect, an embodiment of the present invention provides a system for predicting an internet of things data security event, including:

the acquisition module is used for: obtaining data of the Internet of things; the data of the Internet of things is information transmitted by a user request; the data of the Internet of things is application layer request information which is received by a receiving end and transmitted through a network;

and a segmentation module: detecting the data of the Internet of things to obtain a transmission vector set; the set of transmission vectors includes a header vector and a data content vector; the vector values in the data content vector represent the transmitted content;

and a mapping module: hash mapping is carried out on the data content vector to obtain a mapping vector;

and a safety prediction module: inputting the mapping vector and the header vector into a security event prediction model to obtain a predicted security value; the predicted security value being 1 indicates data transmission security; the predicted security value being 0 indicates that the transmission data is not secure;

discarding module: and if the predicted safety value is 0, discarding the data packet.

Compared with the prior art, the embodiment of the invention achieves the following beneficial effects:

the embodiment of the invention also provides a method and a system for predicting the data security event of the Internet of things, wherein the method comprises the following steps: and obtaining the data of the Internet of things. The data of the Internet of things is information transmitted by a user request; the data of the Internet of things is application layer request information which is received by a receiving end and transmitted through a network. And detecting the data of the Internet of things to obtain a transmission vector set. The set of transmission vectors includes a header vector and a data content vector. The vector values in the data content vector represent the transmitted content. And carrying out hash mapping on the data content vector to obtain a mapping vector. And inputting the mapping vector and the header vector into a security event prediction model to obtain a predicted security value. The predicted security value of 1 indicates data transmission security. The predicted security value of 0 indicates that the transmission data is not secure. And if the predicted safety value is 0, discarding the data packet.

By adopting the neural network, the safety information can be obtained more accurately. Header information and data information in the internet of things data are separated, and various characteristics of the header information and the data information can be used. After data information is mapped through the hash mapping table, the storage structure is controlled to store the training length position, the LTSM neural network is input, the data length can be reduced and becomes fixed, the detection of the neural network is faster, the association on the data information sequence is obtained, the output of the training content data at any position is controlled, and therefore the influence of unnecessary data on training is reduced. And inputting the header information into a DNN neural network, and judging together to accurately obtain a predicted safety value.

Drawings

Fig. 1 is a flowchart of a method for predicting an internet of things data security event according to an embodiment of the present invention.

Fig. 2 is a schematic structural diagram of a security event prediction model in an internet of things data security event prediction system according to an embodiment of the present invention.

Fig. 3 is a schematic block diagram of an electronic device according to an embodiment of the present invention.

The marks in the figure: a bus 500; a receiver 501; a processor 502; a transmitter 503; a memory 504; bus interface 505.

Detailed Description

The present invention will be described in detail with reference to the accompanying drawings.

Example 1

As shown in fig. 1, an embodiment of the present invention provides a method for predicting an internet of things data security event, where the method includes:

s101: obtaining data of the Internet of things; the data of the Internet of things is information transmitted by a user request; the data of the Internet of things is application layer request information which is received by a receiving end and transmitted through a network.

The Internet of things data is information transmitted between the client and the server.

S102: detecting the data of the Internet of things to obtain a transmission vector set; the set of transmission vectors includes a header vector and a data content vector; the vector values in the data content vector represent the transmitted content.

S103: hash mapping is carried out on the data content vector to obtain a mapping vector;

s104: and inputting the mapping vector and the header vector into a security event prediction model to obtain a predicted security value. The predicted security value of 1 indicates data transmission security. The predicted security value of 0 indicates that the transmission data is not secure.

The structural schematic diagram of the security event prediction model is shown in fig. 2.

S105: and if the predicted safety value is 0, discarding the data packet.

obtaining an Internet of things protocol; the internet of things protocol is a communication protocol with a fixed receiving end. The internet of things protocol is an application layer protocol.

In this embodiment, the internet of things protocol is the HTTP protocol.

By the method, header information and data information in the internet of things data are separated, and the predicted safety value can be accurately obtained in the subsequent safety judgment according to various characteristics of the header information and the data information.

obtaining a request length; the request length is the data length transmitted by the request.

Sequentially combining the plurality of data content vectors according to the request length to obtain a plurality of combined data vectors; the vector length of the merged data vector is the request length.

A fixed input length is obtained. The fixed length value is a set length value.

By the method, the data with the same request are organized into one vector, and the security of the transmitted data is judged by the vector.

establishing a hash mapping table; and a plurality of key value pairs with the key value of 0 as an initial value are constructed in the Ha Xiying table.

In this embodiment, the Ha Xiying table has a plurality of key value pairs. The key words of the key value pairs are segmented binary; the partial hash map is shown in table 1.

TABLE 1

100	101	110	111	1000
					4	5	6	7	8

Dividing the combined data by a fixed length value to obtain a division length.

Wherein there is a remainder if the combined data is divided by the fixed length value. The quotient is added 1 to obtain the segmentation length. If 20 divided by 7, the division length is 3.

And dividing the merged data vector into a plurality of data according to the dividing length to obtain a plurality of divided data.

And searching the split data through the hash mapping table to obtain a plurality of mapping data.

The plurality of mapping data is organized into a mapping vector. The length of the mapping vector is a fixed length value.

The initial value of the vector value in the mapping vector is-1, and when no mapping vector is replaced, the vector value is still-1.

By the method, the fixed-length input can be used when the neural network input is performed later through the hash mapping table. And the data length can be reduced, so that the detection of the neural network is faster.

obtaining a training set; the training set comprises a plurality of training data and a corresponding plurality of labeling data; the training data is a mapping vector constructed in the history transmission process; the labeling data is 1 to indicate safety; the labeling data of 0 indicates unsafe.

And obtaining preprocessing training data based on the training data.

Inputting the training data into a safety event prediction model to obtain a training prediction safety value;

and obtaining the loss value through a loss function by the training predicted safety value and the labeling data.

Wherein the loss function is a binary cross entropy loss function.

And obtaining the current training iteration times of the safety event prediction model and the preset maximum iteration times of the training of the safety event prediction model.

The maximum iteration number of training the safety event prediction model preset in this embodiment is 1200.

By the method, training data with vector length smaller than the number of the neurons input by the neural network in the safety event prediction model is complemented by-1 because of the fixed reason of the neurons input by the neural network, but the influence of the part needs to be eliminated when the part is lost because the part has no meaning in the training process. The true length is obtained and then the length is not calculated at the time of the loss value.

By the method, the end of the data truly used for training is found.

inputting training length positions and training content data in the training data into an LTSM neural network to obtain training content values; the training content value represents the sequential relationship of the data; the training content value of 1 indicates that the training content data is safe, and the training content value of 0 indicates that the training content data is unsafe.

Inputting training header data in the training data into a DNN neural network to obtain a training header value; the training preamble value of 1 indicates that the training preamble data is safe, and the training preamble value of 0 indicates that the training preamble data is unsafe.

And when the training content value is 1, the training header value is 1, and the training prediction safety value is set to be 1.

By the method, the training content data are input into the LTSM neural network to extract information due to the sequence relation of the training content data. And the header information is independently extracted during training, so that DNN neural networks are used for extracting the information.

inputting the training length position into a storage structure;

By the method, the storage structure is controlled to store the training length position, and the output of the training content data is controlled at the position, so that the influence of unnecessary data on training is reduced.

By the method, header information and data information in the internet of things data are separated, and the predicted safety value can be accurately obtained in the subsequent safety judgment according to various characteristics of the header information and the data information. Data having the same request is organized into a vector, and the security of the transmitted data is judged by the vector. By hashing the mapping table, a fixed length input can be used when the neural network input is performed later. And the data length can be reduced, so that the detection of the neural network is faster. Because of the fixed input neurons in the neural network, training data with vector length smaller than the number of the input neurons of the neural network in the safety event prediction model is complemented by-1. Because the training content data has a sequence relation, the training content data is input into the LTSM neural network to extract information. And the header information is independently extracted during training, so that DNN neural networks are used for extracting the information. The control storage structure stores the training length position and controls the output position of the training content data, so that the influence of unnecessary data on training is reduced.

Example 2

Based on the method for predicting the data security event of the Internet of things, the embodiment of the invention also provides a system for predicting the data security event of the Internet of things, which comprises an acquisition module, a segmentation module, a mapping module, a security prediction module and a discarding module.

The acquisition module is used for acquiring the data of the Internet of things. The internet of things data is information transmitted by a user request. The data of the Internet of things is application layer request information which is received by a receiving end and transmitted through a network.

The segmentation module is used for obtaining a transmission vector set through detection of the internet of things data. The set of transmission vectors includes a header vector and a data content vector. The vector values in the data content vector represent the transmitted content.

The mapping module is used for carrying out hash mapping on the data content vector to obtain a mapping vector.

The safety prediction module is used for inputting the mapping vector and the header vector into a safety event prediction model to obtain a predicted safety value; the predicted security value being 1 indicates data transmission security; the predicted security value of 0 indicates that the transmission data is not secure.

And the discarding module is used for discarding the data packet if the predicted security value is 0.

The specific manner in which the various modules perform the operations in the systems of the above embodiments have been described in detail herein with respect to the embodiments of the method, and will not be described in detail herein.

An embodiment of the present invention further provides an electronic device, as shown in fig. 3, including a memory 504, a processor 502, and a computer program stored in the memory 504 and capable of running on the processor 502, where the steps of any one of the methods for predicting an internet of things data security event described above are implemented when the processor 502 executes the program.

Where in FIG. 3 a bus architecture (represented by bus 500), bus 500 may include any number of interconnected buses and bridges, with bus 500 linking together various circuits, including one or more processors, represented by processor 502, and memory, represented by memory 504. Bus 500 may also link together various other circuits such as peripheral devices, voltage regulators, power management circuits, etc., as are well known in the art and, therefore, will not be described further herein. Bus interface 505 provides an interface between bus 500 and receiver 501 and transmitter 503. The receiver 501 and the transmitter 503 may be the same element, i.e. a transceiver, providing a means for communicating with various other apparatus over a transmission medium. The processor 502 is responsible for managing the bus 500 and general processing, while the memory 504 may be used to store data used by the processor 502 in performing operations.

The embodiment of the invention also provides a computer readable storage medium, on which a computer program is stored, the program when executed by a processor implementing the steps of any one of the methods for predicting the data security event of the internet of things described above and the related data.

The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general-purpose systems may also be used with the teachings herein. The required structure for a construction of such a system is apparent from the description above. In addition, the present invention is not directed to any particular programming language. It will be appreciated that the teachings of the present invention described herein may be implemented in a variety of programming languages, and the above description of specific languages is provided for disclosure of enablement and best mode of the present invention.

In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.

Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the various inventive aspects. However, the disclosed method should not be construed as reflecting the intention that: i.e., the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art will appreciate that the modules in the apparatus of the embodiments may be adaptively changed and disposed in one or more apparatuses different from the embodiments. The modules or units or components of the embodiments may be combined into one module or unit or component and, furthermore, they may be divided into a plurality of sub-modules or sub-units or sub-components. Any combination of all features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or units of any method or apparatus so disclosed, may be used in combination, except insofar as at least some of such features and/or processes or units are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings), may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will appreciate that while some embodiments herein include some features but not others included in other embodiments, combinations of features of different embodiments are meant to be within the scope of the invention and form different embodiments. For example, in the following claims, any of the claimed embodiments can be used in any combination.

Various component embodiments of the invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that some or all of the functions of some or all of the components in an apparatus according to embodiments of the present invention may be implemented in practice using a microprocessor or Digital Signal Processor (DSP). The present invention can also be implemented as an apparatus or device program (e.g., a computer program and a computer program product) for performing a portion or all of the methods described herein. Such a program embodying the present invention may be stored on a computer readable medium, or may have the form of one or more signals. Such signals may be downloaded from an internet website, provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, third, etc. do not denote any order. These words may be interpreted as names.

Claims

1. The method for predicting the data security event of the Internet of things is characterized by comprising the following steps of

if the predicted safety value is 0, discarding the data packet;

hash mapping is carried out on the data content vector to obtain a mapping vector, and the method comprises the following steps:

obtaining a fixed length value; the fixed length value is a set length value;

based on the fixed length value and the combined data vector, obtaining a mapping vector through hash mapping;

the obtaining a mapping vector based on the fixed length value and the merged data vector through hash mapping comprises the following steps:

dividing the combined data by a fixed length value to obtain a division length;

2. The internet of things data security event prediction method according to claim 1, wherein the security event prediction model comprises a storage structure, an LSTM neural network and a DNN neural network:

the input of the DNN neural network is a header vector; the input of the storage structure is a data content vector; the inputs to the LSTM neural network are data content vectors and outputs of the storage structure.

3. The method for predicting the data security event of the internet of things according to claim 1, wherein the step of obtaining the set of transmission vectors by detecting the data of the internet of things comprises:

4. The method for predicting the data security event of the internet of things according to claim 1, wherein the training method for the security event prediction model comprises the following steps:

based on the training content data, a training length position is obtained;

5. The method for predicting the data security event of the internet of things according to claim 4, wherein the obtaining the training length position based on the training content data comprises:

6. The method for predicting the data security event of the internet of things according to claim 4, wherein inputting the training data and the training length position into the security event prediction model to obtain the training predicted security value comprises:

inputting the training length position and training content data in the training data into an LSTM neural network to obtain a training content value; the training content value represents the sequential relationship of the data; the training content value of 1 indicates that the training content data is safe, and the training content value of 0 indicates that the training content data is unsafe;

7. The method for predicting the data security event of the internet of things according to claim 6, wherein inputting the training length position and the training content data in the training data into the LSTM neural network to obtain the training content value comprises:

inputting the training length position into a storage structure;

inputting a first vector value in the training content data into a first LSTM structure to obtain a first LSTM output value;

inputting a second vector value in the first LSTM output value and training content data into a second LSTM structure to obtain a second LSTM output value;

and inputting the LSTM output value and the vector in the training content data into the LSTM structure for a plurality of times until reaching the training length position in the storage structure, thereby obtaining the training content value.

8. The system for predicting the data security event of the Internet of things is characterized by comprising the following components:

discarding module: if the predicted safety value is 0, discarding the data packet;

obtaining a fixed length value; the fixed length value is a set length value;

dividing the combined data by a fixed length value to obtain a division length;