KR20220160849A - System for blocking external intrusion using smart home iot and method thereof - Google Patents

Abstract

The present invention relates to an external intrusion blocking system using smart home IoT and a method thereof. In accordance with the present invention, the external intrusion blocking method using the external intrusion blocking system based on smart home IoT, includes: a step in which in a state in which at least one IoT device is network-connected to an IoT hub, when an access requester requests access to the IoT device connected to the IoT hub through a user terminal, an external intrusion blocking system receives access log data of the IoT device from the IoT hub; a step in which an access log component with high significance is extracted from the access log data; a step in which the extracted access log component with high significance is applied to an intrusion detection model to determine whether the access log data of the access requester is a normal log; and a step in which when the access log data of the access requester is determined as an abnormal log-in, the network connection is initialized. In accordance with the present invention, the external intrusion blocking system can provide a security function through the lightening of an intrusion detection model, and can detect an intrusion without having an additional terminal attached to an IoT network, thereby reducing an additional cost burden on a user. Moreover, the external intrusion blocking system can automatically prevent IoT device hacking, thereby eliminating inconvenience in which a user needs to personally take action through a hacking prevention manual.

Description

External intrusion prevention system and method using smart home IoT {SYSTEM FOR BLOCKING EXTERNAL INTRUSION USING SMART HOME IOT AND METHOD THEREOF}

The present invention relates to an external intrusion prevention system and method using smart home IoT, and more particularly, by applying an access log element to a lightweight intrusion detection model to determine whether an external intruder is present, and in the case of an external intruder, a security function is provided. It relates to an external intrusion blocking system and method using smart home IoT that automatically detects external intrusion by performing

Today's Internet of Things (hereinafter referred to as "IoT") is equipped with network functions in various types of things to connect humans, objects, and data, and in our real life, IoT, artificial intelligence (AI, The smart home system using technologies such as Artificial Intelligence) is changing to become safer and more convenient.

The smart home system provides automation services based on IoT and is applied in various ways to our lives today, even if the user is outside, remotely performing tasks such as air conditioning, heating, and lighting control, gas valve locking, leakage current blocking, and outlet blocking. make control possible.

The smart home system uses the existing server and the cloud center server of the telecommunications company together, and the cloud center server of the telecommunications company reports the real-time status inside the house and enables the home devices to be operated wirelessly.

In this way, the convenience of life has increased by utilizing the smart home system, but with the development of these IoT technologies, cases of abuse are increasing.

In particular, there is a problem that security is weakened by interlocking IoT devices with data inside the house, increasing the risk of hacking, and this may cause situations such as invasion of privacy.

As such, while hacking crimes are increasing, currently commercialized IoT device solutions mainly adopt a method of hiding information by encrypting data, so there is no countermeasure in case an account is stolen.

In order to prevent this, the existing smart home IoT security solution is provided through a home gateway or an additional device, but there is a problem that it is difficult for users to access easily due to the cost of applying it.

In addition, AI lightweight algorithms used in existing IoT devices are optimized for small resources, and performance degradation may occur when large amounts of data are generated in various devices such as smart homes.

The background technology of the present invention is disclosed in Korean Patent Publication No. 10-2019-0048587 (published on May 9, 2019).

The technical problem to be achieved by the present invention is to apply the access log element to a lightweight intrusion detection model to check whether there is an external intruder, and in the case of an external intruder, to perform a security function to automatically detect an external intrusion using smart home IoT. It relates to an intrusion prevention system and method therefor.

According to an embodiment of the present invention for achieving this technical problem, in the external intrusion blocking method using a smart home IoT-based external intrusion blocking system, in a state in which one or more IoT devices are networked to an IoT hub, an access requestor uses a user terminal If access to the IoT device connected to the IoT hub is requested through Extracting high access log elements, and applying the extracted access log elements with high importance to an intrusion detection model to determine whether the access requestor's access log data is a normal login, and the access requestor's access log data and initializing a network connection when it is determined that the login is abnormal.

The external intrusion prevention system may further include receiving and collecting access log data of network access to the IoT device by the authorized user from the IoT hub.

The access log data includes access detailed time (time-stamp), user ID (User ID), accessed IoT device name (Access Internet of Things device), requested operation command for the IoT device (Action), and user terminal device It may include at least one element among a user terminal device, an access IP, a port, and a protocol.

The step of extracting the access log elements includes applying the collected access log data of authorized users to the Gini coefficient of the decision tree, calculating the importance of each access log element, and selecting one or more access log elements in order of importance. can be extracted.

The intrusion detection model is implemented based on a random forest, and weights of the random forest model may be quantized to reduce weight.

If the number of times that the access requester is judged to be the abnormal login is the 2nd or more and the Nth or less, the management account is initialized and the corresponding IP is blocked, and if the number of times the abnormal login is determined to be the N+1th or more, the firmware Initializing and requesting a password change to a user terminal corresponding to an authorized user may be further included.

According to another embodiment of the present invention, in the external intrusion prevention system using smart home IoT, in a state where one or more IoT devices are network-connected to an IoT hub, an access requestor accesses the IoT device connected to the IoT hub through a user terminal. When access is requested, the external intrusion prevention system includes a communication unit that receives the access log data of the IoT device of the access requester from the IoT hub, an extraction unit that extracts an access log element of high importance from the access log data, and Applying the extracted access log elements of high importance to an intrusion detection model to determine whether the access requestor's access log data is a normal login, and if the access requester's access log data is determined to be an abnormal login, initialize the network connection includes a control unit.

As described above, according to the present invention, a security function is provided through lightening of an intrusion detection model and intrusion can be detected without attaching an additional terminal to the IoT network, thereby reducing the user's additional cost burden. In addition, since hacking of IoT devices is automatically prevented, users do not have to deal with hacking prevention manuals themselves. In addition, when an intrusion is detected through an intrusion detection model, the access of an external intruder is automatically blocked, thereby minimizing the user's hacking damage.

1 is a diagram for explaining an external intrusion prevention system using a smart home IoT according to an embodiment of the present invention.
2 is a diagram for explaining the configuration of an external intrusion prevention system using smart home IoT according to an embodiment of the present invention.
3A is an exemplary diagram for explaining a random forest.
Figure 3b is an exemplary view showing the result of measuring the accuracy using Figure 3a.
4 is a flowchart illustrating a method for blocking external intrusion using a smart home IoT-based external intrusion blocking system according to an embodiment of the present invention.
5 is an exemplary diagram for explaining step S420 of FIG. 4 .
6A and 6B are exemplary diagrams for explaining quantization of a random forest model.

Hereinafter, embodiments of the present invention will be described in detail so that those skilled in the art can easily practice with reference to the accompanying drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. In addition, in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a certain component is said to "include", it means that it may further include other components without excluding other components unless otherwise stated.

Then, with reference to the accompanying drawings, an embodiment of the present invention will be described in detail so that those skilled in the art can easily practice it.

Hereinafter, an external intrusion prevention system using a smart home IoT according to an embodiment of the present invention will be described using FIG. 1 .

1 is a diagram for explaining an external intrusion prevention system using a smart home IoT according to an embodiment of the present invention.

As shown in FIG. 1, the external intrusion prevention system 100 according to an embodiment of the present invention is connected to the user terminal 200, the IoT hub 300 and the IoT device 400 through a network.

First, the external intrusion blocking system 100 according to an embodiment of the present invention is an automated system that detects and responds to intrusion by analyzing access log data on a computer or network, and is an IoT accessed using a user terminal 200. The access log data of the device 400 is received through the IoT hub 300, and access log elements extracted according to importance are applied to an intrusion detection model to determine whether an external intruder is present, and in the case of an external intruder, the network initialize the connection

In this way, the external intrusion prevention system 100 can be implemented as a system for preventing attacks from external intruders through an intrusion detection model using the KDDCUP99 dataset including Dos, U2R, R2L, and Probe attack types. have.

Next, the user terminal 200 transmits access log data of the IoT device 400 for controlling the operation of the IoT device 400 by the user to the IoT hub 300.

At this time, the user terminal 200 is a portable user terminal, and may be implemented as a device capable of exchanging information by connecting to a network wired or wirelessly, such as a notebook computer, smart pad, or smartphone, and the user terminal 400 ) is implemented as a smart phone or smart pad, it is possible to access the external intrusion prevention system 100 through a pre-installed application.

Next, the IoT hub 300 is connected to one or more IoT devices 400 through a network, and stores access log data of network access to the IoT device transmitted from the user terminal 200 .

Here, the IoT hub 300 may be implemented integrally with the external intrusion prevention system 100 .

Next, the IoT device 400 includes at least one of a lighting device, an air conditioner, a refrigerator, a washing machine, and a heating device provided indoors, and is network-connected to the IoT hub 300.

Hereinafter, the configuration of an external intrusion prevention system using smart home IoT according to an embodiment of the present invention will be described with reference to FIG. 2 .

2 is a diagram for explaining the configuration of an external intrusion prevention system 100 using smart home IoT according to an embodiment of the present invention.

As shown in FIG. 2 , the external intrusion prevention system 100 using smart home IoT according to an embodiment of the present invention includes a communication unit 110, an extraction unit 120, and a control unit 130.

First, in a state where the IoT hub 300 and one or more IoT devices 400 are connected to the network, an access requestor requests access log data for the IoT device 400 connected to the IoT hub 300 through the user terminal 200. .

Then, the communication unit 110 receives the access log data of the IoT device 400 of the access requester from the IoT hub 300.

At this time, the user terminal 200 transmits access log data of the IoT device 400 for controlling the operation of the IoT device 400 to the IoT hub 300.

In addition, the access log data includes access detailed time (time-stamp), user ID (User ID), accessed IoT device name (Access Internet of Things device), requested operation command for the IoT device (Action), and user terminal device It includes at least one element among user terminal device, access IP, port, and protocol.

In addition, the communication unit 110 may collect access log data of network access to the IoT device 400 by the authorized user and transmit the collected data to the IoT hub 300 .

Next, the extractor 120 extracts an access log element having a high importance from the access log data.

At this time, the extraction unit 120 applies the collected access log data of the authorized user to the Gini's coefficient of the decision tree, calculates the importance of each access log element, and calculates the importance of one or more access logs in order of importance. elements can be extracted.

Next, the control unit 130 determines whether the access log data of the access requester is a normal login by applying the extracted access log element having a high importance to the intrusion detection model.

And, when it is determined that the access log data of the access requester is an abnormal login, the control unit 130 initializes the network connection between the IoT hub 300 and the IoT device 400.

And, if the number of times it is determined that the access requester has been abnormally logged in is from the second to the Nth, the control unit 130 may initialize the management account and block the corresponding IP.

In addition, if the number of times it is determined that the abnormal login is equal to or greater than the N+1th time, the controller 130 may initialize the firmware and request a password change to the user terminal 200 corresponding to the authorized user.

In addition, the intrusion detection model is implemented based on a random forest, and weights of the random forest model are quantized and lightened.

At this time, random forest is an ensemble technique used for data classification among machine learning algorithms, and randomly extracts original data, performs learning on several decision trees, and classifies data by average predicted value (regression analysis).

That is, the intrusion detection model according to an embodiment of the present invention is built based on a random forest and classifies an external intruder and a user to determine whether there is an external intruder.

3A is an exemplary diagram for explaining a random forest, and FIG. 3B is an exemplary diagram illustrating a result of measuring accuracy using FIG. 3A.

As shown in FIG. 3A, the random forest uses 7 parameters, and the accuracy varies depending on the number of decision trees and the maximum depth of each tree.

Therefore, as shown in FIG. 3B, when the number of decision trees is 12 and the maximum depth of each tree is 5, it can be seen that the accuracy is the best at 0.884848, but it may vary depending on the learning data applied by the user. .

Hereinafter, an external intrusion blocking method using the smart home IoT-based external intrusion blocking system 100 according to an embodiment of the present invention will be described using FIG. 4 .

4 is a flowchart illustrating a method for blocking external intrusion using a smart home IoT-based external intrusion blocking system according to an embodiment of the present invention.

First, the external intrusion prevention system 100 receives and collects access log data of network access to the IoT device 400 by an authorized user from the IoT hub 300 (S410).

That is, when an authorized user makes a network access request to the IoT device 400 to the IoT hub 300 using his/her user terminal 200, the IoT hub 300 transmits the access log data received from the user to external intrusion. forward to the interception system (100).

Here, the external intrusion prevention system 100 includes access detailed time (time-stamp), user ID (User ID), accessed IoT device name (Access Internet of Things device), and operation command (Action) for the requested IoT device. , User terminal device name (User terminal device), access IP, access (Port) and protocol (Protocol), including at least one element of the access log data can be received from the IoT hub 300 and collected.

Next, the external intrusion prevention system 100 applies the access log data collected in step S410 to the Gini coefficient of the decision tree, calculates the importance of each access log element, and selects one or more access log elements in order of high importance. Extract (S420).

At this time, the external intrusion prevention system 100 calculates the impurity of each node in the decision tree through the Gini coefficient in the decision tree, and removes the access log element of low importance from the collected access log data of the authorized user. have.

Here, the Gini coefficient is a coefficient for detecting the impurity of data constituting a node in the decision tree, and the impurity can be calculated using Equation 1 below.

는 각 샘플이 해당 클래스에 속할 확률을 나타낸다.Here, K is the number of classes of data,

represents the probability that each sample belongs to that class.

At this time, in the embodiment of the present invention, since external intrusion is checked, the number of classes of data for K may be two for an authorized user and an unauthorized external intruder.

Based on the Gini coefficient calculated through Equation 1, when the Gini coefficient decreases at the next node, it can be seen that the purity of the data increases.

In addition, the external intrusion prevention system 100 first calculates the importance of the node of the decision tree through the following Equation 2 in order to calculate the importance of the access log element.

는 노드의 중요도이고,

는 부모 노드의 가중치 불순도이고,

및

은 자식 노드들의 가중치 불순도이다. here,

is the importance of the node,

is the weight impurity of the parent node,

and

is the weight impurity of child nodes.

As shown in Equation 2, the importance of a node is obtained by subtracting the sum of the weight impurity of child nodes from the weight impurity of the parent node. The higher the node importance value at a node, the lower the impurity.

Then, the external intrusion prevention system 100 calculates the importance of the access log element through Equation 3 below.

은 각각의 접근 로그 요소의 중요도이고,

은 모든 노드의 중요도이고,

은 해당 요소를 기준으로 분리된 모든 노드의 중요도의 합이다. here,

is the importance of each access log element,

is the importance of all nodes,

is the sum of the importance of all nodes separated based on the corresponding element.

That is, the importance of each access log element in the access log data is a value obtained by dividing the sum of the importance of all nodes separated based on the corresponding element by the importance of all nodes.

Through this, the external intrusion prevention system 100 calculates the importance of each access log element through the Gini coefficient of the decision tree for the access log data, removes the access log element of low importance, and removes one or more access log elements in order of high importance. Extract log elements.

5 is an exemplary diagram for explaining step S420 of FIG. 4 .

As shown in FIG. 5, the external intrusion prevention system 100 calculates the impurity of the access log data through the Gini coefficient of the decision tree, and calculates the importance for each access log element.

As shown in the example of FIG. 5, the importance of access detail time is 0.552792, the importance of access IP is 0.182973, the importance of user terminal device name is 0.152349, the importance of accessed IoT device name is 0.95485, and the requested IoT device The importance of the operation command for may be 0.016401.

Therefore, the external intrusion prevention system 100 accesses one or more of access detailed time, access IP, user terminal device name, accessed IoT device name, and operation command for the requested IoT device 400, which are of high importance among access log data. Log elements can be extracted.

In this way, in the state in which the importance of each access log element is determined through steps S410 and S420, the external intrusion prevention system 100 determines whether the access requester who has accessed the IoT hub 300 is an authorized user or an external intrusion prevention system 100 using the importance of each access log element. to determine whether an intruder is

Hereinafter, a method for the external intrusion prevention system 100 to distinguish whether a person requesting access to the IoT network is an authorized user or an external intruder through steps S430 to S480 will be described.

Next, in a state in which the IoT hub 300 and one or more IoT devices 400 are connected to the network, the external intrusion prevention system 100 uses the access log data of the IoT device 400 to control the operation of the IoT device from the user terminal. is received through the IoT hub 300 (S430).

That is, in step S430, access log data is received from the access requester who has accessed the IoT hub 300 through the IoT hub 300.

Next, the external intrusion prevention system 100 extracts an access log element of high importance from the access log data (S440).

Here, the external intrusion prevention system 100 may extract an access log element of high importance from the access log data according to the importance of the access log element calculated through step S420.

For example, assuming that the access detail time is the highest in importance of the access log element, the external intrusion prevention system 100 extracts an access log element for the access detail time from access log data.

Next, the external intrusion prevention system 100 determines whether the access log data of the access requester is a normal log-in by applying the access log element of high importance extracted in step S420 to the intrusion detection model.

That is, the external intrusion prevention system 100 applies the access log element with high importance extracted through the importance of each access log element calculated in step S420 to the intrusion detection model to determine whether the access log data of the access requestor is normal login. can judge

Here, the intrusion detection model is implemented based on a random forest, and weights of the random forest model can be quantized and lightened.

Here, quantization refers to substituting a relatively large real number (float) of 32b bits in size with a discrete int value of small size 8 bits (bit).

In this case, since the random forest model can be learned and implemented using real values, quantization can be performed using real values.

6A and 6B are exemplary diagrams for explaining quantization of a random forest model.

As shown in FIG. 6A, in order to lighten the random forest model, the intrusion detection model quantizes the training data represented by real numbers and the state values (weights, node states) of the model that has been trained, thereby performing calculation and judgment processing. can be lightened.

In addition, quantization is performed through mapping in which real values within a certain range are returned as specific values, and the range may be determined according to the distribution of data within a range that does not affect accuracy as much as possible.

Through this, the random forest model is compressed to a low bit as a whole, reducing the size while maintaining precision.

Therefore, as shown in FIG. 6B, when the original weight range is -0.3 to -0.25, the quantized weight is -0.2, and when the original weight range is -0.25 to -0.1, quantization is performed. The processed and weighted weight is -0.1, and when the range of the original weight is -0.1 to 0.1, the quantized and lightened weight is 0, and when the range of the original weight is 1.0 to 1.5, the quantized The reduced weight becomes 0.25, and when the range of the original weight is 1.5 to 2.5, the quantized weight becomes 2.

Next, the external intrusion prevention system 100 may determine whether the access log data of the access requestor is a normal login by using an intrusion detection model based on a random forest.

Here, when it is determined that the access log data of the access requester who has accessed the IoT hub is a normal log-in, the external intrusion prevention system 100 allows the user to control the operation of the IoT device 400 by using the user terminal 200 and the IoT device ( 300) and connected (S450).

If it is determined that the access log data of the access requester accessing the IoT hub is an abnormal login, the number of abnormal logs detected is detected.

At this time, if it is determined that the access log data of the access requester is an abnormal login for the first time, the external intrusion prevention system 100 may initialize the network connection (S460).

That is, if the number of times that the access log data of the access requester is detected as abnormal login is 1, the external intrusion prevention system 100 initializes the IoT network connection between the IoT hub 300 and the IoT device 400.

Then, if the number of times that it is determined that the access requester is abnormally logged in is from the second to the Nth, the external intrusion prevention system 100 initializes the management account and blocks the corresponding IP (S470).

At this time, assuming that N is 5, if the number of times it is determined that the access requester is abnormally logged in is 2 or more and 5 or less, the external intrusion prevention system 100 initializes the management account and blocks the corresponding IP.

If the number of times it is determined that the access requester has been logged in abnormally is N+1th or more, the external intrusion prevention system 100 initializes the firmware and sends a password change request to the user terminal 200 corresponding to the authorized user. Do (S480).

That is, when the number of times that the access requester is determined to be an abnormal login is 6 or more, the external intrusion prevention system 100 initializes the firmware and requests a password change to the user terminal 200 corresponding to the authorized user.

As described above, according to an embodiment of the present invention, a security function is provided through a light weight intrusion detection model, and intrusion can be detected without attaching an additional terminal to the IoT network, thereby reducing the user's additional cost burden. In addition, since hacking of IoT devices is automatically prevented, users do not have to deal with hacking prevention manuals themselves. In addition, when an intrusion is detected through an intrusion detection model, the access of an external intruder is automatically blocked, thereby minimizing the user's hacking damage.

Although the present invention has been described with reference to the embodiments shown in the drawings, this is only exemplary, and those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical scope of protection of the present invention should be determined by the technical spirit of the appended claims.

100: external intrusion prevention system, 110: communication department,
120: extraction unit, 130: control unit,
200: user terminal, 300: IoT hub,
400: IoT device

Claims (12)

In the external intrusion blocking method using a smart home IoT-based external intrusion blocking system,
In a state in which one or more IoT devices are network-connected to an IoT hub, when an access requester requests access to the IoT device connected to the IoT hub through a user terminal, the external intrusion prevention system provides access to the IoT device of the access requestor. Receiving log data from the IoT hub;
Extracting an access log element of high importance from the access log data;
Applying the extracted access log elements of high importance to an intrusion detection model to determine whether the access log data of the access requestor is a normal login; and
External intrusion blocking method comprising the step of initializing a network connection when it is determined that the access log data of the access requester is an abnormal login. According to claim 1,
The external intrusion blocking system further comprises receiving and collecting access log data of network access to the IoT device by an authorized user from an IoT hub. According to claim 1,
The access log data,
Access detailed time (Time-stamp), user ID (User ID), accessed IoT device name (Access Internet of Things device), requested IoT device operation command (Action), user terminal device name (User terminal device) , an access IP, a port (Port), and an external intrusion blocking method including at least one element among protocols (Protocol). According to claim 1,
Extracting the access log element,
An external intrusion prevention method that applies the collected access log data of authorized users to the Gini coefficient of the decision tree, calculates the importance of each access log element, and extracts one or more access log elements in order of importance. According to claim 1,
The intrusion detection model,
It is implemented based on a random forest,
Weights of the random forest model are quantized and lightweight external intrusion blocking method. According to claim 1,
If the number of times that the access requester is determined to be the abnormal login is from the 2nd to the Nth, the management account is initialized and the corresponding IP is blocked,
External intrusion blocking method further comprising the step of initializing firmware and requesting a password change to a user terminal corresponding to an authorized user when the number of times it is determined that the abnormal login is N+1th or more. In the external intrusion prevention system using smart home IoT,
In a state in which one or more IoT devices are network-connected to an IoT hub, when an access requester requests access to the IoT device connected to the IoT hub through a user terminal, the external intrusion prevention system provides access to the IoT device of the access requestor. A communication unit receiving log data from the IoT hub;
An extractor for extracting an access log element of high importance from the access log data, and
Applying the extracted access log elements of high importance to an intrusion detection model to determine whether the access requestor's access log data is a normal login, and if the access requester's access log data is determined to be an abnormal login, initialize the network connection An external intrusion prevention system including a control unit. According to claim 7,
The communication department,
An external intrusion prevention system for receiving and collecting access log data of network access to the IoT device by an authorized user from an IoT hub. According to claim 7,
The access log data,
Access detailed time (Time-stamp), user ID (User ID), accessed IoT device name (Access Internet of Things device), requested IoT device operation command (Action), user terminal device name (User terminal device) , Access IP, port (Port) and protocol (Protocol), an external intrusion prevention system including at least one element. According to claim 7,
The extraction part,
An external intrusion prevention system that applies the collected access log data of authorized users to the Gini coefficient of the decision tree, calculates the importance of each access log element, and extracts one or more access log elements in order of importance. According to claim 7,
The intrusion detection model,
It is implemented based on a random forest,
Weights of the random forest model are quantized and lightweight external intrusion prevention system. According to claim 7,
The control unit,
If the number of times that the access requester is determined to be the abnormal login is from the 2nd to the Nth, the management account is initialized and the corresponding IP is blocked,
An external intrusion prevention system for initializing firmware and requesting a password change to a user terminal corresponding to an authorized user when the number of times it is determined that the abnormal login is N+1th or more.

Images