CN107135093B

CN107135093B - Internet of things intrusion detection method and detection system based on finite automaton

Info

Publication number: CN107135093B
Application number: CN201710158735.0A
Authority: CN
Inventors: 付玉龙; 闫峥; 李晖
Original assignee: Xidian University
Current assignee: Xidian University
Priority date: 2017-03-17
Filing date: 2017-03-17
Publication date: 2020-05-05
Anticipated expiration: 2037-03-17
Also published as: CN107135093A

Abstract

The invention relates to an intrusion detection method and detection system for the Internet of Things based on finite automata. The finite automaton theory is used to model the general protocol group of networked terminals, and at the same time, real-time monitoring is performed for the actions performed by the Internet of Things terminals in interaction. , modeling, and matching it with the normal interaction behavior predicted by the finite automaton model, so as to judge the method of abnormal attack behavior. The present invention can use a simple composable label conversion model to represent the complex Internet of Things system, thus reducing the storage space requirement of the IDS to a great extent. At the same time, the complexity of the comparison algorithm we use is determined according to the depth of the Glued‑IOLTS (Composable Label Transformation Model) graph of the corresponding IoT device operating protocol. Therefore, this detection method based on finite automata traversal will It can be applied to the Internet of Things system. The invention has the characteristics of small volume, low resource occupation, high execution efficiency, convenient use and low input cost.

Description

Internet of things intrusion detection method and detection system based on finite automaton

Technical Field

The invention belongs to the technical field of Internet of things mobile communication network security, and particularly relates to an Internet of things intrusion detection method based on a finite automaton.

Background

The internet of things is a main trend of future network development, and the internet of things is a main direction of future 5G network development due to the fact that the internet of things can greatly expand the network boundary of the internet. Research and investment into the internet of things has gradually become a consensus of current high-tech companies. On one hand, the performance of most terminal equipment of the Internet of things is low, and the single-point computing capability is insufficient; the terminal equipment is widely distributed and is easily captured by the enemy; the network topology networking is flexible, and the attack and other characteristics are easy to launch from the inside of the network, so that the traditional safety protocol design scheme based on algorithm complexity is not suitable for protecting the safety of the equipment of the Internet of things any more. On the other hand, the intrusion detection system is a posterior security protection method and a security protection system which is highly approved by academia and industry.

The traditional intrusion detection system can prejudge the suspected network communication behavior of the attack according to the characteristics of the existing attack such as flow, behavior, statistical rules and the like, thereby protecting the safety of network equipment and users to a certain extent. A conventional Intrusion Detection System (IDS) is a system that analyzes system behavior data using intrusion detection techniques to detect intrusion behavior, i.e., a combination of hardware and software for intrusion detection. Although intrusion detection systems have been developed into many different categories, their basic processes are consistent and are broadly divided into several modules of information collection, information analysis, and result processing (as shown in fig. 1). Different intrusion detection systems differ in the data sources they employ, and in the information analysis and detection methods. In summary, the intrusion detection system, the latter shield of active defense, plays a very critical role in computer and network security.

The concept of intrusion detection was first proposed by Anderson in 1980 and thus began research on intrusion detection systems. Denning introduced the first IDS expert system in 1988, while Heberlein developed the first intrusion detection system NSM suitable for network systems in 1990. Research on intrusion detection systems has then gradually progressed towards distributed, large-scale detection. In recent years, along with the development of technologies such as mobile internet of things, intelligent hardware, virtual reality and the like, an intrusion detection method under the internet of things has become a mainstream trend of the current technology development, but the research on an intrusion identification system of the whole internet of things is still in a starting stage. Researchers mostly start to research on intrusion detection technologies suitable for the Internet of Things from various main aspects included in the IoT (Internet of Things) technology. Hichem et al proposed a dynamic intrusion detection method for IoT networks based on a hybrid usage of game theory based on a signature detection method and based on an anomaly detection method. And introducing a game-theometic method in an intrusion judgment stage, calculating an optimal NE value by establishing game models of an intruder and a normal user, and determining when to start an abnormal intrusion detection method by using the NE value. Chen et al propose a real-time pattern matching system for Internet of things devices using Complex Event Processing (CEP) technology. The method has the advantage of utilizing the event stream characteristics to make judgment, thereby reducing the false alarm rate of the traditional intrusion detection method. This approach, while increasing the consumption of system computing resources to some extent, does significantly reduce the feedback latency of the IDS system. Nadeem and Howarth summarize an intrusion detection system of a MANET network, which is a common network structure of the Internet of things, and analyze intrusion detection frameworks such as CRADs, GIDPs and the like facing the MANET network through analyzing and comparing an attack method and a detection algorithm of characteristics of the MANET network. Yan et al also propose an undesirable data detection and defense method for MANET networks based on a distributed trust management mechanism. Modia et al have studied intrusion threats and detection methods for a back-end cloud service system of the internet of things, generalize methods and principles for cloud system intrusion detection and defense in recent years, but have not given relevant suggestions for the development of future cloud system intrusion detection and defense. Although the existing methods and systems solve certain problems to be solved by the intrusion detection of the internet of things on different levels, the existing methods and systems still cannot provide corresponding evaluation for the whole internet of things system, namely, cannot solve the problem of consistency of evaluation standards such as data and models among all parts of the internet of things on the whole. As indicated in the general research of the existing IoT system intrusion detection method by Audrey et al, the research of the internet-of-things-oriented intrusion detection system needs to mainly solve the problems of "standardized variable evaluation system with high interaction capability" and "more underlying real data modeling".

In the internet of things, sensing devices with a large number of sensors, RFID (radio frequency identification) tag devices, CCTV (closed circuit television) network cameras and the like only having simple calculation and storage capabilities are used, so that the network boundary of the current internet is greatly expanded, and the functions of information acquisition and information service are provided for the future network. However, these sensing devices may work in an insecure environment, and due to the limitation of their computing capabilities, cannot protect themselves using a complex cryptographic mechanism, and are easily interfered, captured, decoded, and even tampered and embedded with malicious attack programs by adversaries, resulting in security attacks on other devices and core networks of the internet of things. Aiming at the potential safety hazard in the internet of things, a lightweight active defense mechanism is needed to protect the safety of the internet of things system.

Disclosure of Invention

In order to solve the problems that the performance of terminal equipment of the Internet of things is low and a complex cryptographic algorithm and a complex authentication protocol cannot be used due to insufficient single-point computing capability in the prior art, the invention provides the Internet of things intrusion detection method and detection system based on the finite automata. Meanwhile, the model of the system state machine is easy to understand, and the system state machine is convenient to use and low in investment cost. The technical problem to be solved by the invention is realized by the following technical scheme:

an Internet of things intrusion detection method based on finite automata comprises the following steps:

step 1, establishing a combinable label conversion model for carrying out standardized representation on channels among label conversion models by adopting a general protocol group of the terminal of the Internet of things through a finite automata theory, wherein the combinable label conversion model represents a plurality of label conversion models which are mutually connected through media, and is defined as a quadruple

Wherein S is_glu＝<S₁∪S₂∪…∪S_n∪S_M>，

L_glu＝<L₁∪L₂∪…∪L_n>，

s_lRepresenting a low-level state of the composable label transition model; m represents a medium for which the number of bits is equal to,

i.e. representing a transition within the medium M, wherein

Indicating a state s_iLow level representation of (a); s_MRepresenting the state of the medium, i, j and m all represent natural numbers and 1 < i < m, α represents the label in the label conversion model;

representing a plurality of label conversion models, wherein S is a set of all states of the depicted equipment, L is a set of main behavior abstract representation of the equipment, and T is the state transition of the label conversion models caused by one or more behaviors in L; s₀Is an initial state of the finite automaton, and L_ISet of input actions for causing a state transition of the tag transition model, L_OTo set the output behavior that causes the state transition of the tag transition model, and to make L_I∪L_oIs equal to L and

step 2, establishing an event database on the cloud server, wherein the data in the event database comprises data of a standard protocol, possible operation flows and abnormal action flows, and the event database directly accesses the IDS event analyzer;

the data of the standard protocol is the description of the standard protocol through the combinable label conversion model;

a possible operational flow is data created for data passing through a standard protocol;

the abnormal action flow is data of known abnormal intrusion events;

step 3, collecting control flow data on the Internet of things through an event monitor, repackaging the control flow data into requirement packaged data according to requirements, and sending the requirement packaged data to an event database and an IDS event analyzer;

step 41, the IDS event analyzer receives the requirement package data and analyzes the information of the requirement package data, identifies the internet of things device in the network device, generates a network topology view, and then records the ID information of the identified internet of things device;

step 42, the IDS event analyzer firstly groups the required packed data according to the network topology view and ID information, and the specific grouping step is: grouping the data packets with the same session ID into a group, and sorting the data packets with the same session ID according to the protocol type in a time sequence to generate grouped data;

then, the IDS event analyzer converts each group of grouped data into a conversion event stream through the combinable label conversion model, and the specific steps are as follows: acquiring the protocol type of the message sequence in each group of grouped data according to the protocol type in the data packet with the same session ID, comparing the protocol type of the message sequence with the data of the standard protocol to acquire a basic formalized action primitive of the protocol type of the message sequence, combining the action primitive with the information in each group of grouped data and expressing the grouped data as an automaton primitive, namely converting each group of grouped data into a conversion event stream;

step 43, the IDS event analyzer compares the transformed event stream with the abnormal action stream, and performs intrusion detection based on signature;

if the conversion event stream contains an event signature which is the same as the intrusion event signature in the abnormal action stream, judging the conversion event stream to be an abnormal intrusion event, and outputting an abnormal result to a response unit;

if the conversion event stream does not contain the event signature which is the same as the known intrusion event signature in the abnormal action stream, the conversion event stream is continuously compared with the data in the possible operation stream to judge whether the conversion event stream is an abnormal intrusion event, if the conversion event stream is judged to be the abnormal intrusion event, the abnormal intrusion event is recorded, and meanwhile, a judgment request is sent to a user;

if the user judges that the event is an abnormal intrusion event, outputting an abnormal result to a response unit, and extracting and storing the characteristics of the abnormal intrusion event into abnormal action flow data in an event database;

and 5, generating an intrusion risk warning report after the response unit receives the abnormal result.

Further, in step 43, the conversion event stream is continuously compared with the data in the possible operation stream, and a specific method for determining whether the conversion event stream is an abnormal intrusion event is as follows:

comparing the label of the conversion event stream with the label in the possible operation stream, and storing the conversion event stream with the same label as the label in the possible operation stream in an intermediate variable after the comparison;

when all the labels in the conversion event stream have the same label in the possible operation stream, if the corresponding end point state of the label in the possible operation stream is the end state of the corresponding label in the possible operation stream, the label is judged to be a safety behavior; otherwise, judging as a blocking abnormal invasion event;

when the labels of the conversion event stream are different in the labels in the possible operation streams, checking a first item causing the difference in the conversion event stream, and if the difference item is an item in the intermediate variable, judging that the conversion event stream is a replay abnormal intrusion event; otherwise, judging the conversion event flow as a fake abnormal intrusion event.

Further, the request packed data in step 3 includes source IP data, destination IP data, port number data, timestamp data, and protocol type data.

A detection system of an Internet of things intrusion detection method based on finite automata comprises a modeling unit, a label conversion unit and a label conversion unit, wherein the modeling unit is used for establishing the combinable label conversion model;

an event database for storing data of standard protocols, possible operation flows and abnormal action flows, and directly accessing the IDS event analyzer;

the event database includes:

the standard protocol library is used for storing the data of the quasi protocol described by the combinable label conversion model;

the normal action library is used for storing possible operation action flows created by data of a standard protocol;

the abnormal action library is used for storing an abnormal action flow of a known abnormal intrusion event;

the event monitor is used for collecting control flow data on the Internet of things, repackaging the control flow data into requirement packaged data according to requirements and sending the requirement packaged data to the event database and the IDS event analyzer;

an IDS event analyzer for converting the packed data into converted event flow through the combinable label conversion model and judging whether the converted event flow is abnormal invasion event;

the IDS event analyzer comprises:

the network structure learning module is used for receiving the requirement packaging data, analyzing the information of the requirement packaging data, identifying the Internet of things equipment in the network equipment, generating a network topology view, recording the ID information of the identified Internet of things equipment and sending the ID information to the action flow abstraction module;

the action flow abstraction module is used for receiving the network topology view and the ID information, firstly grouping the required packed data according to the network topology view and the ID information, and then converting each group into a conversion event flow through the combinable label conversion model;

the intrusion detection module is used for detecting the abnormal intrusion event of the conversion event stream and outputting an abnormal result;

and the response unit is used for generating an intrusion risk warning report after receiving the abnormal result.

Further, the intrusion detection module includes a detection analysis sub-module, configured to compare the tag of the conversion event stream with the tag in the possible operation stream, and store the conversion event stream having the same tag as the tag in the possible operation stream in an intermediate variable after the comparison;

The invention has the beneficial effects that:

the invention is an Intrusion Detection method and a Detection system specially designed for the Internet of things system based on the automaton theory, and because of the application of the formalization method, the invention can use a simple combinable label conversion model to represent the complicated Internet of things system, thereby reducing the requirement of IDS (Intrusion Detection Systems) on the storage space to a great extent. Meanwhile, the complexity of the comparison algorithm used by the user is determined according to the depth of a glue-IOLTS (combinable label conversion model) graph of a corresponding Internet of things device operation protocol, and the device can not run a particularly complex program in consideration of the limitation of Internet of things device resources, so that the detection method based on finite automata traversal can be applied to an Internet of things system. Based on the above willing, the invention has the characteristics of small volume, less occupied resource and high execution efficiency compared with the traditional intrusion detection system. Meanwhile, the model of the system state machine is easy to understand, and the system state machine is convenient to use and low in investment cost.

The present invention will be described in further detail with reference to the accompanying drawings and examples.

Drawings

FIG. 1 is a schematic diagram of a conventional intrusion detection system;

FIG. 2 is a schematic diagram of an IEEE802.15.4 star topology;

figure 3 is a schematic diagram of an ieee802.15.4 mesh topology;

FIG. 4 is a schematic diagram of an IEEE802.15.4 cluster tree topology;

FIG. 5 is a schematic diagram of a form of a network attack replaying an anomalous intrusion event;

FIG. 6 is a schematic diagram of a form of network attack blocking an anomalous intrusion event;

FIG. 7 is a schematic diagram of a form of a network attack to forge an anomalous intrusion event;

FIG. 8 is a diagram of a finite automaton for NSPK based symmetric key protocol to securely connect two devices in accordance with the present invention;

FIG. 9 is a schematic diagram of a system reference architecture of the Internet of things of the present invention;

FIG. 10 is a schematic diagram of an intrusion detection system architecture according to the present invention;

FIG. 11 is a schematic diagram of a request packet process of the present invention;

FIG. 12 is a diagram of a hardware architecture in accordance with an embodiment of the present invention;

FIG. 13 is a diagram illustrating a method for packetizing data on demand according to an embodiment of the present invention.

Detailed Description

To further explain the technical means and effects of the present invention adopted to achieve the intended purpose, the following detailed description of the embodiments, structural features and effects of the present invention will be made with reference to the accompanying drawings and examples.

(1) Reference model of Internet of things

The internet of things is a comprehensive heterogeneous network, which may include multiple network types including WSN, MANET, Zigbee and the like, so that it is difficult for our research on the security of the internet of things to obtain a uniform representation method. However, generally speaking, the internet of things system needs to have three basic properties, namely: unique identification, object communication capability and the ability to perceive the external environment. Under the current TCP/IP network architecture, the unique identity refers to an IP address. However, as is known, in the IPv4 mechanism commonly used at present, the IP address has become a scarce resource, and it is basically impossible to uniquely identify a network participant by the IP address. Although the number of usable addresses is expanded by the IPv6, the number of addresses provided by the IPv6 cannot meet the requirement for future mass-connected Internet of things devices. Therefore, in the currently approved networking method of the internet of things, internet of things routing (IoT Gateway) becomes an essential existence. For example, in IEEE802.15.4, internet of things is implemented by a personal network tuner (PAN). Based on this, we believe that the network structure of the future internet of things will generally present a central state, and the topology thereof can refer to the setting of ieee 802.15.4. As shown in fig. 2 to 4, R denotes an RFD (Reduced Function Device) and F denotes an FFD (full Function Device).

(1) Attack type

Aiming at the network characteristics of the internet of things, the following three attack scenes are considered to possibly appear and are difficult to defend in the internet of things equipment through a traditional password mechanism:

attack scenario 1: replay abnormal intrusion events (replay attack)

As shown in fig. 5, this is a relatively traditional network attack form, and an attacker User2 implements an attack on the internet of things system by monitoring communication between the User1 and the internet of things system. Such as a fake signature attack, a replay attack, etc. The defense against such attacks traditionally requires the use of an identity authentication mechanism, and thus the resource consumption of the internet of things equipment is large.

Attack scenario 2: blocking abnormal intrusion event (blocking attack, jam-attack)

As shown in fig. 6, due to the openness of the internet of things system, an attacker-controlled internet of things device may also apply for joining the internet of things. Such attacker devices may have more powerful computing power and resources, and may obtain relevant information of the internet of things by monitoring broadcasts and the like, and launch DoS/DDoS and other types of attacks on the network.

Attack scenario 3: fake abnormal intrusion event (fake attack, fake-attack,)

As shown in fig. 7, due to the dynamic characteristics of the network structure of the internet of things system, an authorized device may be captured by an attacker, and software such as trojans, viruses and the like is injected on the authorized device to form a threat to the whole internet of things system. Since such a device is itself an authorized device, it will be able to join the network again, so that attacks can be made on the system from within the network. This type of attack would be difficult to protect by traditional key-based methods.

Aiming at the three types of internet of things attack scenes, the concept of intrusion detection in the traditional network needs to be introduced, and a posterior active safety protection method suitable for internet of things equipment is provided. However, in the existing research, although a corresponding detection method has been proposed on different network structure levels (such as MANET network, WSN network, Zigbee network, etc.) related to the internet of things, an intrusion detection method facing the whole internet of things system with a standardized evaluation system has not been proposed yet.

The technical scheme for realizing the invention is as follows: aiming at the characteristics that the performance of the equipment of the Internet of things is low, only specific and simple interaction functions can be provided usually, and the transmission and interaction modes are relatively fixed, the finite automaton theory is adopted to model a general protocol group of the networking terminal, and meanwhile, the action executed by the terminal of the Internet of things in interaction is monitored and modeled in real time, and is matched with the normal interaction behavior predicted by the finite automaton model, so that the scheme of the abnormal attack behavior is judged. The specific definition and steps are as follows:

combined label switching system (blue-IOLTS)

According to the IoT alliance proposed IoT-a (Internet of Things-Architecture) Architecture and Hannelore et al proposed Internet of Things hierarchical reference Architecture (RILA), a typical Internet of Things system will accomplish aggregation and management of multiple layers around the Internet of Things devices (Things), and the key to the implementation of the Internet of Things system is how to achieve standardization between different Things.

To achieve this, the currently popular approach is an extension to the application of the Context Toolkit (Context Toolkit) framework proposed by andink. Namely, the context (context) condition of the current system operation and the target (goal) of the system are analyzed, so as to determine the action of the next step. However, this method has a problem that not all context can be expressed in a standardized manner, and therefore, in the context toolkit framework, these context elements that cannot be immediately standardized are further referred to as high-level contexts, which are generally difficult to process. To solve this standardization problem, we first propose the concept of combinable tag transformation model by extending the system automata (automata) model.

The traditional finite automata model can effectively model and analyze a computer system by utilizing the knowledge of set theory and graph theory. In a finite automaton, we typically define the system as a triple, i.e., a triplet<S,L,T>Where S represents the set of all states of the device being characterized, L represents the set of device primary behavior abstraction representations, and T represents the transition of the state of the system caused by some behavior or behaviors within L. If in a finite automaton, the initial state s of the device can be specified₀And classifying the behavior causing the system state transition into an input behavior set L_IAnd output behavior set L_oAnd let L_I∪L_OIs equal to L and

then the system's corresponding quadruple<s₀,S,L,T>Referred to as a label conversion model (IOLTS). In practice, each IOLTS may represent a separate system, however in a network environment, the systems we are looking at are typically interrelated. To be able to represent these interrelated systems in a system state machine, we have extended the tag transformation model, proposing the concept of the combinable tag transformation model, the glue-IOLTS. A glue-IOLTS is based on IOLTS, in order to realize the communication and conversion among different systems, further divide the system state into two categories: high level state(s)_u) And low level state(s)_l). The high-level state is used to connect and transition with the internal state of the same system, and the low-level state is used to represent the state and information transfer between IOLTS systems. With such a simple classification representation, channels between different IOLTS systems can be represented by a label switching model.

Defining: a combinable label transformation model (blue-IOLTS) represents a series of label transformation models (IOLTS)

And a medium (M) connecting these systems, which can be defined as a quadruplet

Wherein S is_glu＝<S₁∪S₂∪…∪S_n∪S_M>，

L_glu＝<L₁∪L₂∪…∪L_n>，

Attention is paid to

I.e. representing a transition within a connection medium M, wherein

Indicating a state s_iThe lower level of (a). i. j and m both represent natural numbers and 1 < i < m, which represents the ordinal number of S in the S set. s_iAnd s_jα corresponds to any input or output event, namely a label in IOLTS

With the use of glue-IOLTS, we can conveniently represent a connected system, for example, two devices that complete a secure connection based on the symmetric key protocol of NSPK, and can simply represent the state machine of the system shown in FIG. 8.

By using the combinable label transformation model, the cont mutext information + Goals ═ Actions model used in IOT-A can be passed through the state transition T_MAre shown. Meanwhile, because highly abstract formal statements are used in the model, the standardization problem of the expression is solved at the definition level, so that the method disclosed by the invention can overcome the standardization problem of the traditional Context Toolkit framework.

Secondly, implementing safety detection in the environment of the Internet of things:

the method provided by the inventor finds out potential abnormal behaviors by acquiring and standardizing control flow data in the equipment of the Internet of things in real time and comparing the control flow data with a behavior prediction model on execution and specification provided when corresponding equipment is registered. To achieve our detection goal, we need the deployment of the internet of things system around the IOT-a architecture and the RILA reference model, and the recommended architecture is shown in fig. 9.

In actual execution, the functions of different layers will be implemented on different interactive devices. Under the reference model, the control flow information of the internet of things equipment is analyzed and managed by the data management layer equipment. Therefore, the data acquisition devices required by the users can be deployed on the data management layer device, the acquired data are uploaded to the cloud server, and the strong computing power of the cloud server is utilized for analysis and processing. And finally, feeding back the result to the data management layer equipment to provide a basis for processing the non-secure data. The architecture diagram of our security detection system is shown in fig. 10:

the specific process of safety detection and management is divided into the following steps:

Wherein S is_glu＝<S₁∪S₂∪…∪S_n∪S_M>，

L_glu＝<L₁∪L₂∪…∪L_n>，

s_uRepresenting high level states of a combinable label transformation model, s_lRepresenting a low-level state of the composable label transition model; m represents a medium for which the number of bits is equal to,

i.e. representing a transition within the medium M, wherein

Indicating a state s_iLow level representation of (a); s_MRepresenting the state of the medium;

representing a plurality of label conversion models, wherein S is a set of all states of the depicted equipment, L is a set of main behavior abstract representation of the equipment, and T is the state transition of the label conversion models caused by one or more behaviors in L; s₀Is an initial state of the finite automaton, and L_OSet of input actions for causing a state transition of the tag transition model, L_OTo set the output behavior that causes the state transition of the tag transition model, and to make L_I∪L_oIs equal to L and

step 2, establishing an event database on the cloud server, wherein the data in the event database comprises data of a standard protocol, possible operation flows and abnormal action flows, and the event database directly accesses the IDS event analyzer; in our approach, network events are described as abstract action streams, and such network actions can be described in terms of our proposed GULED-IOLTS model.

the abnormal action flow is data of known abnormal intrusion events;

the event database includes a standard protocol library for storing quasi-protocol data describing the standard protocol by a combinable tag translation model, a normal action library for storing possible action flows created by the standard protocol data, and an abnormal action library for storing abnormal action flows of known abnormal intrusion events. These three databases should be stored on the cloud and have direct access to the event analyzer.

Step 3, collecting control flow data on the Internet of things through an event monitor, repackaging the control flow data into requirement packaged data according to requirements, and sending the requirement packaged data to an event database and an IDS event analyzer; the requirement packed data comprises source IP data, destination IP data, port number data, timestamp data and protocol type data.

Steps 41-43 are performed by the IDS event analyzer. Wherein step 41 is performed by the network structure learning module, step 42 is performed by the action flow abstraction module, and step 43 is performed by the intrusion detection module.

And step 41, the IDS event analyzer receives the requirement packed data and analyzes the information of the requirement packed data, identifies the Internet of things equipment in the network equipment, generates a network topology view, and then records the ID information of the identified Internet of things equipment.

Step 41 first requires sending the collected demand packaged data to the network structure learning module for the IDS system to obtain a general view of the network topology. Because the internet of things equipment can be distinguished through the unique ID, the internet of things equipment can be distinguished from other equipment by analyzing collected data packet information, such as a source IP, a destination IP, a port number, a timestamp, a protocol type and the like. For example, because internet of things devices are typically connected to the same internet of things gateway, the first three fields of IPv4 addresses of these devices will likely comply with certain laws. In this case, by counting the frequency of each IPv4 field, we can authenticate the IP segment of the internet of things device. These unique IDs of the IoT devices will be recorded and sent to the action flow abstraction module.

as shown in fig. 11, the demand packaged data collected from the IoT also needs to be sent into the action flow abstraction module. Through this module, packets will be assigned based on device attributes, session IDs, timestamps, and protocol types identified with the aid of a network structure learning module and a standard protocol library. With the detected information, the network traffic can be classified into a sequence of messages. We then need to convert these messages into an abstract action flow. To this end, the help of a standard protocol library is required. From the result of the message assignment, together with the protocol type information for each packet data, we can know the primary protocol type of the message so selected. Then, after we obtain the protocol type of the selected message, we can search the standard protocol library for the basic formalized action primitive. And by comparing with each packet data we can represent the packet data as an automaton primitive. One network action corresponds to one tag, and the network action flow is a sequence formed by a plurality of network actions, namely a tag sequence formed by a plurality of tags, namely a message sequence.

and if the user judges the abnormal intrusion event, outputting an abnormal result to a response unit, and extracting and storing the characteristics of the abnormal intrusion event into the abnormal action flow.

After the transition event stream is obtained (transition trace), a two-step intrusion detection phase is required. The first stage is to compare the converted event stream converted into automaton primitives with the data in the abnormal action library for signature-based intrusion detection. If an event stream does not contain known intrusion event segments (signatures), such event stream will be subjected to the second stage of intrusion determination, i.e. it needs to be compared with the possible operation streams in the normal action library to determine whether there is an abnormality in the event stream. If the judgment result is abnormal, the intrusion system records the event and submits the judgment of manual intervention. If the abnormal event is judged to be abnormal manually, the abnormal result is fed back and output, and the characteristics of the event are extracted and stored in the abnormal action library. The intrusion judgment of the second stage comprises the following specific processes:

when the same walk exists in the combinable label conversion model diagram of the conversion event stream, if the end state of the walk is the end state of converting the grouped data into the conversion event stream, the conversion event stream is judged to be safe; otherwise, judging as a blocking abnormal invasion event;

when the conversion event flow does not have corresponding walking in the combinable label conversion model diagram and the walking of the conversion event flow is already terminated, comparing the walking causing the cycle termination with the walking of the possible operation flow, and if the walking same as the walking causing the cycle termination exists in the possible operation flow, judging that the abnormal invasion event is replayed; if there is no walk in the operational flow that is the same as the walk causing the loop termination, it is determined to be a false abnormal intrusion event.

The automatic discrimination algorithm based on the intrusion decision of the second phase of the system represented by our proposed Glued-IOLTS is as follows:

interpretation of the code: we use the JAVA-like language to represent this algorithm. In this algorithm, an array l of type Label is input_idsAnd an array T of type Transition_sysWherein Label represents L in the combinable Label conversion model_gluI.e., a collection of tags; transition represents T in combinable tag transformation model_gluWherein l is_idsRepresenting the data collected by the collection end (converted into a representation form of transition); t is_sysRepresenting the corresponding protocol system (possible operation flow) stored in the normal behavior library, which may be represented by a finite automaton. The output is l to be investigated_idsThe results may be secure, fake-attack, jam-attack, and replay-attack.

The algorithm proceeds as follows:

defining the array t _ temp of Transition type, t _ next as intermediate variables, result of String type, and flag of int type, and making flag equal to 0.

When running a program, first at a given T_sysMiddle search heel_idsThe first transition stored in the array has the same transition represented by label,and saves the result in t temp. Then, for each transitiont in t _ temp_iComparing the t_iAt T_sysLabel and l of the next transition in (1)_idsIf the corresponding next label in the sequence is consistent, if not, t is determined_iRemove from t _ temp; if they are consistent, t is_iIs recorded in t _ temp and the contents of t _ temp are backed up in t _ temp _ bac. This comparison process is then repeated until l is traversed_idsOr t _ temp is empty. In this process, the program will align l_idsLabel in (1) is recorded as l_pass。

When the segment ends, if we are at T_sysTherein find out l_idsFor all labels, we need to further examine the corresponding transition at the end of the examination at T_sysThe end state of (1). If the end state of this transition is exactly T_sysThen we can judge the l_idsIs secure, the program returns secure. Otherwise, the corresponding l_idsMay contain a Jam-attack and the program returns "Jam-attack".

If the program is in comparison l_idsIn_nAt the end of time since t _ temp is empty, then all transitions in t _ temp _ bac_jComparing t_jAnd l is the next label_passIn_i. If the results are the same, t is added_jIs recorded in t _ temp and t _ temp _ bac is updated. Then look up l in t _ temp_n. If l is_nIs found, will l_nRecord to_passIn (1). If l is considered_passAfter the label in (1) is detected, the corresponding l still can not be found_nThen we judge the corresponding l_idsMust contain the corresponding modifications. This is a program return "fake-attack". At the same time, if l_passIn which contains l_nThen such a_idsPossibly involving replay of a preceding field and therefore possibly a replay attack, the program returning "replay-attack"

And 5, generating an intrusion risk warning report after the response unit receives the abnormal result. The response unit generates a report to alert the internet of things of the risk of intrusion. In the report, three types of attacks will be identified through analysis of the exceptional context, which will correspond to the previously proposed attack scenarios, respectively.

the event database includes:

the IDS event analyzer comprises:

the intrusion detection module comprises a detection analysis submodule and a detection analysis submodule, wherein the detection analysis submodule is used for judging that when the same walk exists in the combinable label conversion model diagram of the conversion event stream, if the end state of the walk is the end state of converting the grouped data into the conversion event stream, the safety behavior is judged; otherwise, judging as a blocking abnormal invasion event;

when the conversion event flow does not have corresponding walking in the combinable label conversion model diagram and the walking of the conversion event flow is already terminated, comparing the walking causing the cycle termination with the walking of the possible operation flow, and if the walking same as the walking causing the cycle termination exists in the possible operation flow, judging that the abnormal invasion event is replayed; if the same walking as the walking causing the loop termination does not exist in the possible operation flow, judging the abnormal intrusion event as a fake;

The invention is an intrusion detection method specially designed for the Internet of things system based on the automata theory, and because of the application of the formalization method, the method can use a simple label transfer system to represent the complicated Internet of things system, thereby reducing the requirement of the IDS system on the storage space to a great extent. Meanwhile, the complexity of the comparison algorithm used by the user is determined according to the depth of a Glued-IOLTS graph of a corresponding Internet of things device operation protocol, and the device does not run a particularly complex program in consideration of the limitation of Internet of things device resources, so that the detection method based on the finite automaton traversal can be applied to the Internet of things system. Based on the above willing, the invention has the characteristics of small volume, less occupied resource and high execution efficiency compared with the traditional intrusion detection system. Meanwhile, the model of the system state machine is easy to understand, and the system state machine is convenient to use and low in investment cost. An easy-to-use interactive GUI management interface is developed for the method, so that the state condition of the system on the Internet of things and the comparison condition of the system and a standard prediction model can be conveniently and visually checked, and the deployment and the use of a user are facilitated.

In a test environment, we carried out the content of the present invention, and the design of the platform for the test is shown in fig. 12.

In the test, 2 Raspberry pies (Raspberry Pi 3) are used as RFD devices, 1 Android mobile phone is used as FFD devices, a router with a port mirroring function is selected as a PAN device, and a wireless port on the router is mirrored to a port connected with a server to monitor data. Although the test environment simplifies the communication volume in the Internet of things, the test environment has good expansibility and typicality.

A. The concrete implementation method of data acquisition and modeling comprises the following steps:

network traffic monitoring and analyzing software, such as network tools like Wireshark, Snort, Tcpdump, etc., can be installed on the server to acquire and monitor network data. In this example, we install Wireshark on the server and specify that it analyzes packets for network interfaces connected to the PAN. When software such as Wireshake is used, the software can analyze the packet header of the data to obtain the protocol type used in transmission. Therefore, in this step, the protocol format corresponding to the acquired data can be conveniently obtained. Therefore, according to the corresponding protocol format, the standardized format of the current acquired data can be pre-judged, so that the conversion from the streaming data to the standardized data representation through the combinable label conversion model is realized.

For the network data obtained in the foregoing, we can implement preliminary aggregation of relevant data according to some characteristics (standardized representation) of the data, such as sid, port number, time, and other information. For example, we can connect the data with the same source ip and adjacent time segments together in time sequence for uniform consideration. It is assumed here that the timestamps of all the acquired data are not uniform, i.e. a distinction can be made in the time dimension. Thus, after obtaining the previously aggregated data set, we can select a time window N and use N to truncate the current data set, thereby obtaining data sets in different time slices of time length N. For example, in fig. 13, for a TCP protocol packet of an internet of things system, we can obtain a corresponding behavior stream by slicing time. By the method, interactive data traffic on different Internet of things equipment terminals can be obtained.

B. The standard library, the abnormal action library and the normal action library are realized by the following methods:

for the construction of a database, MySQL is installed on a corresponding server, 3 different forms are built, and a standard protocol, abnormal action flow and possible operation flow are stored respectively. In the standard library, since network events can be represented as transitions of the blue-IOLTS, we only need to record the start point (state), the end point (state), the tag (label) and the protocol type (type). Standard protocol libraries need to be built and accumulated manually to achieve coverage of common protocols. The normal action library can be obtained by generalizing the standard library. We obtain the normal action library by varying transitions in the alignment protocol library using Fuzzy and robust security building methods of the corresponding system. The abnormal action library is automatically generated according to the training of data in the actual operation. The data structure recorded in the abnormal action library is slightly different from that in the normal action library, and it needs to record a context, so it needs to record a pre-condition (pre-con), a post-condition (after-con), and a keyword (key-word).

C. Method for realizing safety detection

Security detection is the process of comparing the collected data stream, as expressed in a standardized form, with predicted behavior obtained from a standard action library to determine whether the current behavior is normal and what attacks may be present. In the present invention, we classify possible attacks into three categories: namely, forgery attacks, replay attacks, and blocking attacks. A blocking attack means that an attacker may take an unknown behavior to issue a request to a corresponding system, again with the aim of exhausting the communication and computing resources of the system. The attacks are derived from a large number of attacks, such as DoS attacks and DDoS attacks, and after it is determined that a counterfeit attack behavior may occur on a corresponding device, the device needs to be correspondingly monitored, so as to determine whether the DoS/DDoS attacks occur. The forgery attack means that an attacker roughly knows the message type required in a communication protocol, so that the attacker artificially manufactures information with the same format but unmatched content and sends the information to an attacker. Many common network attacks are characterized by spoofing attacks, such as ip flooding attacks, where an attacker is attacking a victim by spoofing ip packets. And replay attacks, i.e. attacks in which the attacker records the normal behavior that has been used before or used by other users, are played back by the attacker to the attacked device. Such attacks may also underlie DoS/DDoS attacks and may also introduce more complex types of synthetic attacks, such as zero-day attacks and the like.

In the scheme, a corresponding graphical user interface is designed to reveal the whole comparison process, and through the algorithm and the program designed by the user, the event stream acquired in real time can be compared, possible abnormal events can be judged, and the possible abnormal events can be warned to an administrator of the Internet of things. The administrator can later use our software to perform a follow-up check on the alarm to clearly determine whether the alarm is correct. By the method, the false alarm rate of the invention can be greatly reduced.

The foregoing is a more detailed description of the invention in connection with specific preferred embodiments and it is not intended that the invention be limited to these specific details. For those skilled in the art to which the invention pertains, several simple deductions or substitutions can be made without departing from the spirit of the invention, and all shall be considered as belonging to the protection scope of the invention.

Claims

1. a kind of Internet of Things intrusion detection method based on finite automata, is characterized in that: comprise the following steps:

Step 1, using finite automata theory to establish a composable label conversion model for standardizing the channel between the label conversion models for the general protocol group of the Internet of Things terminals. The composable label conversion model represents multiple interconnected through media. A label transformation model, and the composable label transformation model is defined as a quadruple

where, S _glu =<S ₁ ∪S ₂ ∪...∪S _n ∪S _M >,

L _glu =<L ₁ ∪L ₂ ∪...∪L _n >,

s _l represents the low-level state of the composable label transformation model; M represents the medium,

is a transformation within medium M, where

represents the low-level representation of state _si ; S _M represents the state of the medium; i, j and m all represent natural numbers and 1<i<m; d represents the label in the label conversion model;

Represents multiple label transition models, S is the set of all states of the described device, L is the set of abstract representations of the main behavior of the device, T is the transition of the state of the label transition model caused by one or more behaviors in L ; s ₀ is the initial state of the finite automaton, and L _I is the set of input behaviors that cause the state transition of the label transition model, L _O is the set of output behaviors that cause the state transition of the label transition model, and make L _I ∪L _O =L and

s′ _i represents another state point in the S set that is connected to _si ; Si represents the S set in the _ith label conversion model, and Ti represents the set of T in the _ith label conversion model;

μ represents an internal behavior of a label conversion model itself, that is, the behavior will not make other label conversion models produce visible input or output, but will make its own state transfer;

The set of labels representing all outputs of the 1st state in the ith label transition model;

The set of labels representing all inputs of the 1st state in the jth label transition model;

represents the initial state of n label transformation models, i.e.

s ₀ representing the first label transformation model,

s ₀ representing the nth label translation model;

S ₁ ∪S ₂ ∪...∪S _n ∪S _M in S ₁ , S ₂ , ..., _Sn represents the state set of the i-th to n-th label transition model;

Step 2, establish an event database on the cloud server, the data in the event database includes the data of the standard protocol, the possible operation flow and the abnormal action flow, and the event database directly accesses the IDS event analyzer;

The data of the standard protocol is the description of the standard protocol through the composable label conversion model;

The possible operation streams are data created through standard protocols;

The abnormal action flow is the data of known abnormal intrusion events;

Step 3, collect the control flow data on the Internet of Things through the event monitor, and repackage the control flow data into the demand packaged data according to the requirements and send it to the event database and the IDS event analyzer;

Step 41, the IDS event analyzer receives the demand package data and analyzes the information of the demand package data, identifies the IoT device in the network device, and generates a network topology view, and then records the ID information of the identified IoT device;

Step 42, the IDS event analyzer firstly groups the demand packaged data according to the network topology view and ID information. The specific grouping steps are: grouping the data packets with the same session ID into one group, and simultaneously grouping the data packets with the same session ID into one group. The data packets are sorted in chronological order according to the protocol type to generate packet data;

Then, the IDS event analyzer converts each group of packet data into a conversion event stream through the composable tag conversion model, and the specific steps are: acquiring the protocol of the message sequence in each group of packet data according to the protocol type in the data packets with the same session ID. Then compare the protocol type of the message sequence with the data of the standard protocol, obtain the basic formalized action primitive of the protocol type of the message sequence, and compare the action primitive with the information in each group of packet data. After the combination, the grouped data is represented as an automaton primitive, that is, each group of grouped data is converted into a transformation event stream;

Step 43, the IDS event analyzer compares the conversion event flow with the abnormal action flow, and performs signature-based intrusion detection;

If the conversion event stream contains the same event signature as the intrusion event signature in the abnormal action stream, it is judged as an abnormal intrusion event, and the abnormal result is output to the response unit;

If the conversion event stream does not contain the same event signature as the known intrusion event signature in the abnormal action stream, the conversion event stream continues to compare with the data in the possible operation stream to determine whether it is an abnormal intrusion event. If there is an abnormal intrusion event, the abnormal intrusion event will be recorded, and a judgment request will be sent to the user at the same time;

If the user determines that it is an abnormal intrusion event, the abnormal result is output to the response unit, and the characteristics of the abnormal intrusion event are extracted and stored in the abnormal action flow data in the event database;

Step 5, the response unit generates a warning intrusion risk report after receiving the abnormal result.

2. a kind of Internet of Things intrusion detection method based on finite automata according to claim 1, is characterized in that: in described step 43, the conversion event flow continues to compare with the data in the possible operation flow, and judges whether it is The specific method for judging abnormal intrusion events is as follows:

Compare the label of the transition event flow with the label in the possible operation flow, and store the transition event flow with the same label as the label in the possible operation flow in an intermediate variable after the comparison;

When all the tags in the conversion event flow have the same tag in the possible operation flow, if the corresponding end point state of the tag in the possible operation flow is the termination state of the corresponding tag in the possible operation flow, it is judged as a safe behavior; Otherwise, it is judged that the abnormal intrusion event is blocked;

When there is a difference between the labels of the conversion event stream and the labels of the possible operation streams, check the first item in the conversion event stream that causes the difference, and if the difference item is an item in the intermediate variable, judge that the conversion event stream is The abnormal intrusion event is replayed; otherwise, the converted event stream is judged to be a forged abnormal intrusion event.

3. a kind of Internet of Things intrusion detection method based on finite automata according to claim 1 and 2, is characterized in that: in described demand packaged data in described step 3, comprise source IP data, destination IP data, port number data, timestamp data, and protocol type data.

4. The detection system of a finite automaton-based Internet of Things intrusion detection method according to claim 3, characterized in that: comprising a modeling unit for establishing the composable label conversion model;

Event database, used to store data of standard protocols, possible operation flow and abnormal action flow, and directly access IDS event analyzer;

The event database includes:

Standard protocol library for storing quasi-protocol data describing standard protocols through composable label transformation models;

A normal action library to store possible operational action flows created by data through standard protocols;

Abnormal action library, used to store abnormal action flow of known abnormal intrusion events;

The event monitor is used to collect control flow data on the Internet of Things, and repackage the control flow data into demand packaged data according to requirements and send it to the event database and IDS event analyzer;

The IDS event analyzer is used to convert the demand package data into a conversion event stream through a composable tag conversion model, and determine whether the conversion event stream is an abnormal intrusion event;

The IDS event analyzer includes:

The network structure learning module is used to receive the demand package data and analyze the information of the demand package data, identify the IoT devices in the network equipment, generate a network topology view, and then record the ID information of the identified IoT devices and send it to Action flow abstraction module;

The action flow abstraction module is used to receive the network topology view and ID information, firstly group the demand package data according to the network topology view and ID information, and then convert each grouping through the composable label transformation model to transform the event stream;

The intrusion detection module is used to detect abnormal intrusion events by converting the event stream and output abnormal results;

The response unit is used to generate a warning intrusion risk report after receiving abnormal results.

5. The detection system of a finite automaton-based Internet of Things intrusion detection method according to claim 4, wherein the intrusion detection module comprises a detection and analysis sub-module, which is used to compare the label of the conversion event stream with the possible The tags in the operation flow are compared, and after the comparison, the conversion event flow with the same tag as the tag in the possible operation flow is stored in the intermediate variable;