KR102199088B1 - SYSTEM AND METHOD FOR DETECTING ABNORMAL BEHAVIOR OF IoT DEVICE - Google Patents

Abstract

The present invention discloses a system and method for detecting abnormal behavior of an IoT device. The system for detecting an abnormal behavior of an IoT device according to an aspect of the present invention can effectively detect when the IoT device performs an abnormal behavior, thereby preventing information from being leaked or a control right by a malicious user.

Description

System and method for detecting abnormal behavior of IoT device {SYSTEM AND METHOD FOR DETECTING ABNORMAL BEHAVIOR OF IoT DEVICE}

The present invention relates to a system and method for detecting abnormal behavior of an IoT device, and more particularly, an IoT device that may be caused by a cyber attack by a hacker or the like in a smart home service environment using the Internet of Things (IoT). The present invention relates to a system and method for detecting abnormal behavior of an IoT device capable of providing a safe smart home service environment by detecting abnormal behavior of

The Internet of Things (IoT) refers to providing new services that individual objects could not provide by connecting tangible or intangible objects existing in the world in various ways. The Internet of Things literally means that'things' are'internet' or'the Internet composed of things'. Unlike the existing Internet, which consisted of computers and mobile phones that were capable of wireless Internet connection, the Internet of Things is an Internet composed of all objects in the world such as desks, cars, bags, trees, and pet dogs.

In the IoT, devices including sensors that collect information, that is, IoT devices, exist.

IoT devices may include various types of information, among which such information may include sensitive information, such as personal information, that may cause problems if it is leaked to others.

The Internet of Things is connected to a network such as the Internet, and can be affected by malicious users such as hackers. That is, when the IoT device is hacked by a malicious user, such as a hacker, problems such as stealing control and leakage of personal information may occur.

Korean Patent Registration No. 10-1679578 (announced on November 25, 2016)

The present invention has been proposed to solve the above problems, and when a cyber attack by a hacker or the like occurs in a smart home service environment using the Internet of Things (IoT), the behavior information of the IoT device is based on normal behavior. An object of the present invention is to provide a system and method for detecting abnormal behavior of an IoT device capable of providing a safe smart home service environment by detecting abnormal behavior compared with information.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by an embodiment of the present invention. In addition, it will be easily understood that the objects and advantages of the present invention can be realized by the means shown in the claims and combinations thereof.

A system for detecting an abnormal behavior of an IoT device according to an aspect of the present invention for achieving the above object includes: an IoT device that transmits behavior-based state information collected by an IoT sensor; And receiving behavior-based state information from the IoT device, comparing the behavior-based state information with previously stored normal behavior reference information to determine whether the IoT device has abnormal behavior, and controlling the IoT device or IoT It includes; a central control server for transmitting the device status information to the terminal of the user or the administrator.

The central control server includes: a storage unit for storing preset normal behavior reference information; A state information collection unit for receiving behavior-based state information collected by an IoT sensor from the IoT device; The behavior-based state information is compared with the behavior-based state information, and when the behavior-based state information deviates from (or does not match) the behavior-based state information, the IoT device that transmitted the behavior-based state information is abnormal. An act determination unit that determines that an act is being performed; And a control unit configured to block an operation of the IoT device when it is determined that the IoT device is an abnormal behavior as a result of the determination of the behavior.

The behavior determination unit compares the normal behavior reference information and the behavior-based state information, and transmits the behavior-based state information when the behavior-based state information deviates from (or does not match) the normal behavior reference information. An abnormal behavior suspecting unit that suspects that the IoT device is performing abnormal behavior; And at least one or more information by comparing the behavior-based state information transmitted by the IoT device that is suspected to be performing abnormal behavior with preset rule specification information (important information related to operation of the system related to control and/or personal information leakage). And an abnormal behavior determiner that determines that the IoT device that has transmitted the behavior-based state information is performing abnormal behavior when the behavior-based state information is matched.

The behavior-based state information is characterized in that it is state information according to the operation of the components included in the IoT device.

A method of detecting an abnormal behavior of an IoT device in a system including an IoT device that transmits behavior-based state information collected by an IoT sensor according to another aspect of the present invention for achieving the above object, wherein the central control server , Storing preset normal behavior reference information; Receiving, by a central control server, behavior-based state information collected by the IoT sensor from the IoT device; The central control server compares the normal behavior reference information and the behavior-based state information, and transmits the behavior-based state information when the behavior-based state information deviates from (or does not match) the normal behavior standard information. Determining that an IoT device is performing an abnormal behavior; And blocking, by the central control server, an operation of the IoT device when it is determined that the IoT device is an abnormal behavior as a result of the behavior determination.

The determining that the IoT device that has transmitted the behavior-based state information is performing an abnormal behavior may include comparing the normal behavior reference information and the behavior-based state information, and when the behavior-based state information deviates from the normal behavior reference information. (Or, if they do not match) suspecting that the IoT device that has transmitted the behavior-based state information is performing abnormal behavior; And at least one or more information by comparing the behavior-based state information transmitted by the IoT device that is suspected to be performing abnormal behavior with preset rule specification information (important information related to operation of the system related to control and/or personal information leakage). And determining that the IoT device that has transmitted the behavior-based state information is performing an abnormal behavior when is matched.

The behavior-based state information is characterized in that it is state information according to the operation of the components included in the IoT device.

According to an aspect of the present invention, when an IoT device performs an abnormal behavior, it is effective to effectively detect it and prevent information from being leaked or control right by a malicious user.

The effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those of ordinary skill in the technical field to which the present invention belongs from the following description. .

The following drawings attached to the present specification illustrate preferred embodiments of the present invention, and serve to further understand the technical idea of the present invention along with specific details for carrying out the present invention. It should not be interpreted as being limited to the information described.
1 is a schematic configuration diagram of a system for detecting abnormal behavior of an IoT device according to an embodiment of the present invention;
2 is a schematic functional block diagram of a central control server according to an embodiment of the present invention;
3 is a functional block diagram of an action determination unit according to an embodiment of the present invention;
4 is a flowchart of a method of detecting an abnormal behavior of an IoT device according to an embodiment of the present invention;
5 is a flowchart of a method of detecting an abnormal behavior of an IoT device according to another embodiment of the present invention.

The above-described objects, features, and advantages will become more apparent through the following detailed description in connection with the accompanying drawings, whereby those of ordinary skill in the technical field to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Throughout the specification, when a certain part "includes" a certain component, it means that other components may be further included rather than excluding other components unless otherwise stated. In addition, “… A term such as “sub” means a unit that processes at least one function or operation, which may be implemented by hardware or software, or a combination of hardware and software.

1 is a schematic configuration diagram of a system for detecting abnormal behavior of an IoT device according to an embodiment of the present invention, FIG. 2 is a schematic functional block diagram of a central control server according to an embodiment of the present invention, and FIG. 3 is A functional block diagram of an action determination unit according to an embodiment of the present invention.

Referring to FIG. 1, a system for detecting an abnormal behavior of an IoT device according to the present embodiment includes an IoT device 100 and a central control server 200.

The IoT device 100 includes an IoT sensor that collects behavior-based state information, and transmits the behavior-based state information collected by the IoT sensor through a network. The number of IoT devices 100 may be one, and may be one or more. The IoT device 100 may refer to a device that is connected to the Internet of Things to transmit and receive information, and remotely control the user. For example, the IoT device 100 may be a refrigerator, a washing machine, or the like, and in this embodiment, it will be described as being a drone. Here, the behavior-based state information may be state information according to the operation of each component included in the IoT device 100. For example, when the IoT device 100 is a drone, the behavior-based status information is status information according to the operation of components included in the drone, such as motor information, communication information, battery information, various sensor information, execution cycle information, and command information. I can.

In this case, the network may refer to a network capable of transmitting and receiving data through an Internet protocol using various wired and wireless communication technologies such as an Internet network, an intranet network, a mobile communication network, and a satellite communication network. On the other hand, networks include closed networks such as LAN (Local Area Network) and WAN (Wide Area Network), open networks such as the Internet, as well as Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), and GSM ( Global System for Mobile Communication), Long Term Evolution (LTE), Evolved Packet Core (EPC), and other networks, as well as next-generation networks and computing networks to be implemented in the future. In addition, the IoT sensor may refer to a configuration that is included in the IoT device 100 located within a home and/or within a predetermined area forming a network for smart service and collects information. Meanwhile, externally, a user (manager, user) monitors and remotely monitors the status of the IoT device 100 located in a home and/or within a certain area forming a network through a smart service control terminal (eg, a smart phone, a terminal, etc.) In order to perform control, the smart control terminal transmits a control signal to the IoT sensor through the gateway, so that the IoT sensor can monitor the state of each device and perform remote control.

The central control server 200 is connected to the IoT device 100 through a network to receive information, and receives behavior-based status information from the IoT device 100. The central control server 200 compares the behavior-based state information received from the IoT device 100 with normal behavior reference information to determine whether the IoT device 100 has an abnormal behavior. In this case, the normal behavior reference information may be stored in advance, and may mean information collected by a sensor when the IoT device 100 operates in a normal state. The normal behavior reference information may be set in advance by a user and/or an administrator and stored in a separate storage space (database), and the IoT device 100 determined to perform a normal operation (i.e., abnormal behavior described later) Information may be received and stored from the IoT device 100 except for the IoT device 100 determined to perform an operation. The central control server 200 controls the IoT device 100 that has transmitted the behavior-based state information according to the result of comparing the behavior-based state information received from the IoT device 100 with the normal behavior reference information (blocking the operation, etc.). ) Or, the state information of the IoT device 100 may be transmitted to a user and/or an administrator terminal. Accordingly, when the IoT device 100 determined to be an abnormal behavior exists, the central control server 200 controls the corresponding IoT device 100 to block the operation, thereby leaking personal information stored in the IoT device 100 It can be prevented from occurring or an accident can be prevented due to a malfunction due to the takeover of control right. In addition, the central control server 200 transmits the current state information of the IoT device 100, which is determined to be an abnormal behavior, to the user and/or administrator's terminal, so that the IoT device ( 100) can also be controlled.

Meanwhile, as shown in FIG. 2, the central control server 200 may include a storage unit 210, a state information collection unit 220, an action determination unit 230, and a control unit 240.

The storage unit 210 may store preset normal behavior reference information as described above. In this case, the storage unit 210 may be a database linked to a server. Meanwhile, the database may be located in a space separate from the server, or may be located inside the server.

The state information collection unit 220 receives behavior-based state information collected by the IoT sensor from the IoT device 100. At this time, the behavior-based state information of the IoT device 100 received by the state information collection unit 220 may be stored in the storage unit 210 described above.

The behavior determination unit 230 compares the normal behavior reference information stored in the storage unit 210 with the behavior-based state information received from the IoT device 100, and when the behavior-based state information deviates from the normal behavior reference information (or If they do not match), it may be determined that the IoT device 100 that has transmitted the behavior-based state information is performing abnormal behavior. For example, when the IoT device 100 is a drone, the behavior-based state information transmitted by the IoT device 100 may include motor information, communication information, battery information, various sensor information, execution cycle information, command information, etc. have. In this case, the storage unit 210 may store normal behavior reference information generated when the IoT device 100 is normally operated. For example, when the reference information value of the command information is set to take a picture or transmit photographing information as the normal behavior reference information, the command information included in the behavior-based state information transmitted by the IoT device 100 is other information than the above-described information. , In the case of moving to a location coordinate outside a certain range, the behavior determination unit 230 may determine that the IoT device 100 is hacked by a malicious user such as a hacker and the IoT device 100 is performing abnormal behavior. have.

Meanwhile, even if the IoT device 100 is not hacked by a malicious user such as a hacker, if a temporary device error occurs, the behavior-based state information and the normal behavior reference information in the case of normal operation may be inconsistent. have.

Accordingly, the behavior determination unit 230 may include an abnormal behavior suspicion unit 231 and an abnormal behavior determination unit 233 as shown in FIG. 3 in order to determine whether an abnormal behavior exists in such a case. .

The abnormal behavior suspicion unit 231 compares the normal behavior standard information with the behavior-based state information, and transmits the behavior-based state information when the behavior-based state information deviates from (or does not match) the normal behavior standard information. It can be suspected that (100) is doing abnormal behavior. For example, when the IoT device 100 is a drone, if the communication information included in the behavior-based state information transmitted by the IoT device 100 is not the IP address specified in the normal behavior reference information, the abnormal behavior suspect unit 231 It may be suspected that the IoT device 100 that has transmitted the behavior-based state information is performing abnormal behavior.

The abnormal behavior determination unit 233 compares the behavior-based state information transmitted by the IoT device 100 suspected of performing an abnormal behavior with preset rule specification information, and if at least one or more information does not match, the behavior-based state It may be determined that the IoT device 100 that has transmitted the information is performing an abnormal behavior. In this case, the rule specification information may be important information related to the operation of the system related to the control of the IoT device 100 and/or the leakage of personal information, and may be stored in a separate storage (database) of the server. For example, the rule specification information may include command information, and when information such as moving to a location coordinate outside a certain range as command information is included, it may be determined as an abnormal behavior. In addition, the rule specification information may include execution period information. When an excessively large number of commands are executed within a preset time as the execution period information, it may be determined as an abnormal behavior. For example, as described above, by comparing the behavior-based state information of the IoT device 100 suspected of performing abnormal behavior by the abnormal behavior suspicious unit 231 and information defined as rule specification information, at least one or more information If they match, it may be determined that the IoT device 100 that has transmitted the behavior-based state information is performing an abnormal behavior. For example, if the information defined as rule specification information is command information and execution cycle information as described above, the behavior-based state transmitted by the IoT device 100 suspected of performing abnormal behavior by the abnormal behavior determination unit 233 If at least one or more pieces of information are matched by comparing the information with the defined rule specification information, it may be determined that the IoT device 100 transmitting the behavior-based state information is performing an abnormal behavior.

On the other hand, the abnormal behavior determination unit 233 compares the behavior-based state information transmitted by the IoT device 100 suspected of performing an abnormal behavior with preset rule specification information, and if all do not match, the IoT device 100 It can be judged that is doing normal behavior. In other words, the behavior-based state information of the IoT device 100 may not match the preset normal behavior reference information due to a temporary error of the device, but the behavior-based state information of the IoT device 100 suspected of abnormal behavior The IoT device 100 performing abnormal behavior may be more accurately detected by comparing it with other information, that is, rule specification information, which is important information related to the operation of the system related to the control of the IoT device 100 and/or the leakage of personal information.

That is, as described above, according to the embodiment of FIG. 3, it is possible to more accurately determine whether the IoT device 100 is hacked by determining whether the IoT device 100 has an abnormal behavior over two steps.

The control unit 240 overall controls the central control server 200. The controller 240 may block an operation of the IoT device that has transmitted the behavior-based state information when it is determined that the IoT device 100 is an abnormal behavior as a result of the determination by the behavior determination unit 230.

Hereinafter, a method of detecting abnormal behavior of the IoT device 100 in the system for detecting abnormal behavior of the IoT device described above will be described with reference to FIGS. 4 to 5.

4 is a flowchart of a method of detecting an abnormal behavior of an IoT device according to an embodiment of the present invention.

Referring to FIG. 4, the method of detecting an abnormal behavior of the IoT device 100 includes, by the central control server 200, storing preset normal behavior reference information (S410), and an IoT sensor from the IoT device 100 Receiving the behavior-based state information collected by (S420), comparing the behavior-based state information with the normal behavior reference information, and when the behavior-based state information deviates from the normal behavior standard information (or does not match) ), the step of determining that the IoT device 100 that has transmitted the behavior-based state information is performing an abnormal behavior (S430) and when the IoT device 100 is determined to be an abnormal behavior, the IoT device 100 Blocking the operation of (S440).

In step S410, the central control server 200 may receive and store normal behavior reference information from an administrator in advance. Here, the normal behavior reference information may be stored in advance, and may mean information collected by a sensor when the IoT device 100 operates in a normal state. The normal behavior reference information may be set in advance by a user and/or an administrator and stored in a separate storage space (database), and the IoT device 100 determined to perform a normal operation (i.e., abnormal behavior described later) Information may be received and stored from the IoT device 100 except for the IoT device 100 determined to perform an operation.

In step S420, the central control server 200 may receive behavior-based state information collected by the IoT sensor from the IoT device 100 and store it in a separate storage space. Here, the behavior-based state information may be state information according to the operation of each component included in the IoT device 100.

In step S430, the central control server 200 compares the behavior-based state information received from the IoT device 100 with normal behavior reference information to determine whether the IoT device 100 has an abnormal behavior. The central control server 200 compares the normal behavior reference information and the behavior-based state information, and transmits the behavior-based state information when the behavior-based state information deviates from (or does not match) the normal behavior standard information. It is determined that an IoT device 100 is performing an abnormal behavior.

In step S440, the central control server 200 controls the IoT device 100 that has transmitted the behavior-based state information according to the result of comparing the behavior-based state information received from the IoT device 100 with the normal behavior reference information ( Operation blocking, etc.), or the state information of the IoT device 100 may be transmitted to a user and/or an administrator terminal.

5 is a flowchart of a method of detecting an abnormal behavior of an IoT device according to another embodiment of the present invention.

Referring to FIG. 5, first, the central control server 200 stores preset normal behavior reference information (S510). Here, the normal behavior reference information may be stored in advance, and may mean information collected by a sensor when the IoT device 100 operates in a normal state. The normal behavior reference information may be set in advance by a user and/or an administrator and stored in a separate storage space (database), and the IoT device 100 determined to perform a normal operation (i.e., abnormal behavior described later) Information may be received and stored from the IoT device 100 except for the IoT device 100 determined to perform an operation.

Next, the central control server 200 receives behavior-based state information collected by the IoT sensor from the IoT device 100 (S520). Here, the behavior-based state information may be state information according to the operation of each component included in the IoT device 100.

Next, the central control server 200 compares the normal behavior standard information and the behavior-based state information, and transmits the behavior-based state information when the behavior-based state information deviates from (or does not match) the normal behavior standard information. It is suspected that the IoT device 100 is performing an abnormal behavior (S530).

Next, the central control server 200 compares the behavior-based state information transmitted by the IoT device 100 suspected of performing an abnormal behavior with preset rule specification information, and if at least one or more information does not match, the behavior It is determined that the IoT device 100 that has transmitted the base state information is performing an abnormal behavior (S540).

Next, the central control server 200 blocks the operation of the IoT device 100 when it is determined that the IoT device 100 is an abnormal behavior as a result of the behavior determination (S550).

The methods according to the embodiments of the present invention may be implemented as an application or in the form of program instructions that can be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded in the computer-readable recording medium may be specially designed and configured for the present invention, and may be known and usable to those skilled in the computer software field. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floptical disks. media) and hardware devices specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of the program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

While this specification includes many features, such features should not be construed as limiting the scope or claims of the invention. In addition, features described in separate embodiments of the present specification may be combined and implemented in a single embodiment. Conversely, various features described in a single embodiment of the present specification may be individually implemented in various embodiments, or may be properly combined and implemented.

Although the operations have been described in a specific order in the drawings, it should not be understood that such operations are performed in a specific order as shown, or as a series of consecutive sequences, or that all described operations are performed to obtain a desired result. Multitasking and parallel processing can be advantageous in certain environments. In addition, it should be understood that classification of various system components in the above-described embodiments does not require such classification in all embodiments. The above-described app components and systems may generally be implemented as a package in a single software product or multiple software products.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those of ordinary skill in the technical field to which the present invention belongs. It is not limited by the drawings.

100: IoT device
200: central control server
210: storage unit
220: status information collection unit
230: behavior judgment unit
231: Suspected abnormal behavior
233: abnormal behavior determination unit
240: control unit

Claims (7)

An IoT device that transmits behavior-based state information collected by an IoT sensor; And
Receives behavior-based state information from the IoT device, compares the behavior-based state information with previously stored normal behavior reference information to determine whether the IoT device is abnormal, and controls the IoT device or IoT device according to the determination result. Including; a central control server for transmitting the status information of the user or the administrator's terminal
The central control server,
A storage unit for storing preset normal behavior reference information;
A state information collection unit for receiving behavior-based state information collected by an IoT sensor from the IoT device;
The behavior-based state information is compared with the behavior-based state information, and when the behavior-based state information deviates from (or does not match) the behavior-based state information, the IoT device that transmitted the behavior-based state information is abnormal. An act determination unit that determines that an act is being performed; And
Including; a control unit that blocks the operation of the IoT device when the IoT device is determined to be an abnormal behavior as a result of the behavior determination,
The behavior determination unit,
When the behavior-based state information is out of (or does not match) the behavior-based state information by comparing the normal behavior reference information with the behavior-based state information, the IoT device that transmitted the behavior-based state information is an abnormal behavior. Suspicion of abnormal behavior suspected of being engaged in; And
By comparing the behavior-based state information transmitted by the IoT device that is suspected to be performing the abnormal behavior with preset rule specification information (important information related to the operation of the system related to control and/or personal information leakage), at least one or more information Including; an abnormal behavior determination unit that determines that the IoT device that has transmitted the behavior-based state information is performing abnormal behavior if it matches,
The behavior-based state information,
A system for detecting abnormal behavior of an IoT device, characterized in that it is status information according to the operation of components included in the IoT device. delete delete delete In a method for detecting abnormal behavior of an IoT device in a system including an IoT device that transmits behavior-based state information collected by an IoT sensor,
Storing, by the central control server, preset normal behavior reference information;
Receiving, by a central control server, behavior-based state information collected by the IoT sensor from the IoT device;
The central control server compares the normal behavior reference information and the behavior-based state information, and transmits the behavior-based state information when the behavior-based state information deviates from (or does not match) the normal behavior standard information. Determining that an IoT device is performing an abnormal behavior; And
Including, by the central control server, blocking the operation of the IoT device when it is determined that the IoT device is an abnormal behavior as a result of the behavior determination,
The step of determining that the IoT device that has transmitted the behavior-based state information is performing an abnormal behavior,
When the behavior-based state information is out of (or does not match) the behavior-based state information by comparing the normal behavior reference information with the behavior-based state information, the IoT device that transmitted the behavior-based state information is an abnormal behavior. Suspecting that you are doing; And
By comparing the behavior-based state information transmitted by the IoT device that is suspected to be performing the abnormal behavior with preset rule specification information (important information related to the operation of the system related to control and/or personal information leakage), at least one or more information If matched, determining that the IoT device that has transmitted the behavior-based state information is performing an abnormal behavior; Including,
The behavior-based state information,
A method of detecting abnormal behavior of an IoT device, which is status information according to an operation of components included in the IoT device.

delete delete

Images