CN112600694B - Internet of things security monitoring and management method, system and medium - Google Patents

Abstract

The invention provides a method, system and medium for the security monitoring and management of the Internet of Things. On the basis of the SNMP protocol, it integrates the observer mechanism, inter-cluster routing, confirmation mechanism and retransmission mechanism; The advanced polling priority algorithm, in conjunction with the observer mechanism, improves the network management agent's ability to proactively notify the management station of specific events while reducing data acquisition redundancy. In order to perfect the application of this method in the Internet of Things environment, the observer mechanism is optimized by using hierarchical routing, which not only reduces the redundancy of agent data but also improves the reliability of communication.

Description

Internet of things security monitoring and management method, system and medium

technical field

The present invention relates to the field of network security, in particular to a method, system and medium for security monitoring and management of the Internet of Things.

Background technique

The Internet of Things is a huge network formed by combining various information sensing devices with the Internet to realize the interconnection of people, machines and things at any time and any place. IoT encompasses objects such as smart washing machines, smart refrigerators, smart microwave ovens, smartphones, smart meters, and smart vehicles. The connection of these smart objects with the Internet can realize many valuable and excellent applications, such as smart home, smart building, smart transportation, digital health, smart grid and smart city, effectively promoting the intelligent development of these aspects, making limited resources More reasonable use and distribution, thus improving the efficiency and benefits of the industry. With the development of communication technology and wearable devices, the Internet of Things has been flourishing.

When billions of devices are connected to the Internet, obviously a lot of data is generated. Compared with the traditional Internet, the Internet of Things has the characteristics of large network scale and high dynamics. Therefore, a security monitoring and network management protocol suitable for the Internet of Things needs to meet the following characteristics: (1) Versatility: the new protocol does not require additional Under the conditions of hardware, it can better support most existing IoT devices; (2) Lightweight: Due to the limited computing power and energy consumption of IoT devices, the new protocol should be lightweight; (3) Timeliness: due to Due to the dynamic nature of IoT devices, the new protocol should ensure that the delivered data is valid; (4) reliability: the new protocol should ensure that the data can be successfully delivered and executed in most cases; (5) security: The new protocol should ensure that the state information of IoT devices is not leaked.

At present, the Simple Network Management Protocol (SNMP) has become the default de facto standard in the field of network management because of its simplicity, high efficiency and high compatibility. SNMP enables network administrators to manage network performance, discover and resolve network problems, and plan for network growth. Receive random messages (and event reports) through SNMP to inform the network management system that there is a problem in the network. In the SNMP protocol, there are mainly two ways for the management station to obtain device parameter data: active and passive. The network management station obtains MIB information by sending request information to the network management agent at a certain frequency, which is the active acquisition of the status of the network equipment by the management station. In addition, the network management agent can actively report to the management station through Trap information when certain errors occur. This is a passive data acquisition method for the network management station, which often enables the management station to understand and deal with errors in a timely manner. Therefore, the SNMP protocol is a standard protocol that meets the functional requirements of IoT security monitoring and network management. However, the dynamic and complex nature of the Internet of Things has brought challenges to the security monitoring and network management of the SNMP protocol in the Internet of Things, which are mainly reflected in three aspects:

1. The SNMP protocol concentrates the data collection and processing tasks on the management station for operation, making it difficult to work efficiently in the IoT environment with complex topology.

2. The existing SNMP protocol does not take into account the limited energy consumption and computing resources of IoT devices, and the timeliness of data in the IoT environment cannot be guaranteed.

3. The SNMP protocol is based on the UDP transmission method, which inevitably makes the reliability and security of data transmission unable to be guaranteed. In the Internet of Things environment, it is necessary to ensure low computing resource consumption while improving reliability.

Contents of the invention

In view of the defects in the prior art, the object of the present invention is to provide a method, system and medium for the security monitoring and management of the Internet of Things.

According to a method for security monitoring and management of the Internet of Things provided by the present invention, in the Internet of Things, the management station actively obtains the status of the network equipment, and the polling priority algorithm based on statistical characteristics is used for dynamic information according to the statistical characteristics of the managed objects. Adaptively adjust access frequency, including:

Step 11: After multiple polls, calculate the deviation degree D(i) between the value V _i of the i-th managed object and the average value:

为被管理对象历史取值的平均值；Among them, V _j is the value obtained from the jth round of polling of the managed object,

It is the average value of the historical value of the managed object;

Step 12: Determine the polling cycle T(i) and priority P of each managed object:

T(i)=F(D(i))

Among them, P _n is the current priority of the nth managed object, the setting of F() needs to make T(i) and D(i) negatively correlated, C is an object that can be set to ensure the same polling cycle have different priorities;

Step 13: The management station inserts the managed object into the polling queue according to the current priority P _n of the managed object. If the same priority occurs, the polling cycle is compared, and the one with the smaller cycle is inserted first;

Step 14: The polling queue is updated every time it is completed, and a new priority and polling cycle of each managed object is generated. If the queue has been completed, the polling process is ended, otherwise, jump to step 13.

Preferably, in order to reduce the redundancy caused by the invalid data obtained by polling, it also includes a data acquisition method based on the observer mechanism, and the managed object can actively notify the management station without having to respond to the GetRequest request from the management station again and again, based on observation The data acquisition methods of the mechanism include:

Step 20: The management station sends a subscription request message to the network management agent, including the information of the management station, the data rule to be observed and the identifier OID of the observation object;

Step 21: After receiving the message, the network management agent stores the observer information into the subscriber list, and stores the corresponding data rule and the observation object OID into the subscription request;

Step 22: The network management agent observes the value of the object of the management information base (MIB) according to the subscription requirement, and actively notifies the observer when the change of the value satisfies the preset rule.

Preferably, the data forwarding method using hierarchical routing cooperates with the data acquisition method based on the observer mechanism, and the data forwarding method includes:

Step 30: Each time the management station requests a subscription from the network management agent, attach a random number of 0 to 1, the current CPU idle rate U and time of the management station;

Step 31: The network management agent calculates the communication delay d between the management station and the network management agent by comparing the time when the request is received, and generates a threshold T(n):

Among them, p is the ratio of the number of cluster head nodes to the total number of nodes, r is the number of rounds of current work, G is the set of nodes that have not become cluster head nodes in the network, in the W _b function, A and B are control factors, U(i) is the current CPU idle rate of node i, U _max is the maximum idle rate in all management stations, d(i) is the communication delay from node i to the network management agent, and d _avg is the average delay from all current nodes to the network management agent;

Step 32: Compare the random number generated by the management station with the corresponding T(n). If the random number is smaller than T(n), the node is selected as the cluster head candidate node for this round. If there are multiple nodes selected as the cluster The first candidate node, from which the management station with the smallest communication delay with the network management agent is selected as the cluster head node of the current round;

Step 33: When the set subscription requirements are met, the network management agent sends the notification information together with the corresponding subscription table to the management station serving as the cluster head node. After receiving the information, the management station forwards the notification information to the remaining observers in the subscription table Or, complete the current round of data forwarding work.

Preferably, the communication between the network management agent and the cluster head management station and the communication between the cluster head management station and the remaining nodes in the cluster adopt a confirmation retransmission method, and the confirmation retransmission method includes:

Step 40: After the network management agent sends the subscription information and the subscription form to the cluster head management station, the cluster head management station sends a confirmation message to the network management agent;

Step 41: If the network management agent receives the confirmation message, then end the communication, otherwise jump to step 42;

Step 42: Search the number of retransmissions in the network management agent, if the number of retransmissions reaches the preset threshold, then jump to step 43, otherwise the network management agent re-transmits the information;

Step 43: The network management agent selects any other node from the cluster head candidate nodes as a new cluster head, and forwards information to the new cluster head.

According to a security monitoring and management system of the Internet of Things provided by the present invention, in the Internet of Things, the management station actively obtains the status of network equipment, and the polling priority algorithm based on statistical characteristics For dynamic information, according to the statistical characteristics of the managed objects Adaptively adjust access frequency, including:

Module M11: After multiple polls, calculate the deviation degree D(i) between the value V _i of the i-th managed object and the average value:

为被管理对象历史取值的平均值；Among them, V _j is the value obtained from the jth round of polling of the managed object,

It is the average value of the historical value of the managed object;

Module M12: Determine the polling cycle T(i) and priority P of each managed object:

T(i)=F(D(i))

Among them, P _n is the current priority of the nth managed object, the setting of F() needs to make T(i) and D(i) negatively correlated, C is an object that can be set to ensure the same polling cycle have different priorities;

Module M13: The management station inserts the managed object into the polling queue according to the current priority P _n of the managed object, and compares the polling cycle if the same priority occurs, and inserts the one with the smaller cycle first;

Module M14: The polling queue is updated every time it is completed, and a new priority and polling cycle of each managed object is generated. If the queue has been completed, the polling process is ended, otherwise, the module M13 executes the work.

Preferably, in order to reduce the redundancy caused by the invalid data obtained by polling, it also includes a data acquisition method based on the observer mechanism, and the managed object can actively notify the management station without having to respond to the GetRequest request from the management station again and again, based on observation The data acquisition methods of the mechanism include:

Module M20: The management station sends a subscription request message to the network management agent, including the information of the management station, the data rules to be observed and the identifier OID of the observation object;

Module M21: After receiving the message, the network management agent stores the observer information into the subscriber list, and stores the corresponding data rule and the observation object OID into the subscription request;

Module M22: The network management agent observes the values of the objects in the management information base (MIB) according to subscription requirements, and actively notifies the observer when the value changes meet the preset rules.

Preferably, the data forwarding method using hierarchical routing cooperates with the data acquisition method based on the observer mechanism, and the data forwarding method includes:

Module M30: each time the management station requests subscription from the network management agent, attach a random number from 0 to 1, the current CPU idle rate U and time of the management station;

Module M31: The network management agent calculates the communication delay d between the management station and the network management agent by comparing the time when the request is received, and generates a threshold T(n):

Among them, p is the ratio of the number of cluster head nodes to the total number of nodes, r is the number of rounds of current work, G is the set of nodes that have not become cluster head nodes in the network, in the W _b function, A and B are control factors, U(i) is the current CPU idle rate of node i, U _max is the maximum idle rate in all management stations, d(i) is the communication delay from node i to the network management agent, and d _avg is the average delay from all current nodes to the network management agent;

Module M32: Compare the random number generated by the management station with the corresponding T(n), if the random number is less than T(n), then the node is selected as the cluster head candidate node for this round, if multiple nodes are selected as the cluster The first candidate node, from which the management station with the smallest communication delay with the network management agent is selected as the cluster head node of the current round;

Module M33: When the set subscription requirements are met, the network management agent sends the notification information together with the corresponding subscription table to the management station serving as the cluster head node. After receiving the information, the management station forwards the notification information to the remaining observers in the subscription table Or, complete the current round of data forwarding work.

Preferably, the communication between the network management agent and the cluster head management station and the communication between the cluster head management station and the remaining nodes in the cluster adopt a confirmation retransmission method, and the confirmation retransmission method includes:

Module M40: After the network management agent sends the subscription information and subscription form to the cluster head management station, the cluster head management station sends a confirmation message to the network management agent;

Module M41: If the network management agent receives the confirmation message, the communication ends, otherwise, the module M42 performs work;

Module M42: Search the number of retransmissions in the network management agent. If the number of retransmissions reaches the preset threshold, the module M43 will execute the work, otherwise the network management agent will re-transmit the information;

Module M43: The network management agent selects any other node from the cluster head candidate nodes as a new cluster head, and forwards information to the new cluster head.

According to the present invention, a computer-readable storage medium storing a computer program is provided, and when the computer program is executed by a processor, the steps of the above-mentioned Internet of Things security monitoring and management method are realized.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention integrates the polling priority algorithm based on statistical features and the observer mechanism for the first time to solve the security monitoring and management problems in the scene with complex topology and limited resources of the Internet of Things. It first uses the polling algorithm based on statistical features to access dynamic information, Adaptively adjust access frequency and effectively reduce polling for non-dynamic objects. On this basis, this method delegates the task of observing data changes from the management station to the management agent through the observer mechanism, reducing the redundancy caused by polling invalid data. In addition, the hierarchical routing is added to cooperate with the observer mechanism, and the inter-cluster routing protocol is used to further reduce the consumption of communication resources and computing resources generated by multiple management stations subscribing to the same network management agent at the same time. Finally, the present invention pays attention to the balance between the reliability of data transmission and the limitation of computing resources in the Internet of Things, adopts the confirmation mechanism and the retransmission mechanism to ensure that the information can be reliably transmitted to the target node, and improves the application of the observer mechanism in the Internet of Things environment .

Description of drawings

Other characteristics, objects and advantages of the present invention will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

Fig. 1 is the improved protocol model of the Internet of Things security monitoring and management solved by the present invention;

Fig. 2 is the polling process based on statistical features proposed by the present invention;

Fig. 3 is the SNMP protocol model under the observer mechanism proposed by the present invention;

Fig. 4 is the improvement direction that the observer mechanism that the present invention proposes adopts hierarchical routing;

Fig. 5 is the flow process that cluster organization forms;

Fig. 6 is the flow process of network management agent and cluster head management station communication that the present invention proposes;

Fig. 7 is the flow process of inter-node communication in the cluster proposed by the present invention;

Figure 8 is the Internet of Things scene modeled by Opnet;

Fig. 9 is the average time delay contrast of this method and traditional SNMP protocol;

Fig. 10 is this method and the network instantaneous load contrast of traditional SNMP agreement;

Figure 11 is a comparison of the average network load between this method and the traditional SNMP protocol.

Detailed ways

The present invention will be described in detail below in conjunction with specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but do not limit the present invention in any form. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

As shown in Figure 1, the present invention provides a security monitoring and management method for the Internet of Things. Considering the characteristics of limited computing power and high dynamics in the Internet of Things environment, this method integrates observers for the first time on the basis of the SNMP protocol. Mechanism, inter-cluster routing, confirmation mechanism, and retransmission mechanism; effective communication in the case of limited resources of IoT devices, realizing security monitoring and network management in IoT.

The example of the present invention assumes that the security monitoring and management of the Internet of Things is carried out in a site of 100m*100m, and is improved based on the SNMPv1 protocol, as shown in Figure 8. The model contains three main parts. NMS (Network Manage System) is the network management system, which is responsible for the management and data acquisition of agents; Router is a routing device, which connects NMS and Agent, and is responsible for communication and management between stations. The communication between the station and the network management agent; Agent is the network management agent, responsible for local control of IoT devices. Since the simulation only analyzes the communication between the network management agent and the management station, the database running on the network management agent is regarded as MIB when modeling. In addition, App_Config is an application definition module, and Prof_Config is a business specification definition module, which is used to configure related services used in the simulation model. Task_Config is a task definition module that configures related execution operations for each node.

As shown in Figure 2 and Figure 3, when implementing the SNMP protocol, the NMS will send request information to the Agent at a certain frequency to obtain MIB information. Due to the large number of devices and the large amount of data generated in the above IoT scenarios, the polling algorithm using a fixed frequency in the traditional SNMP protocol will inevitably generate a large amount of unnecessary data redundancy, and even fail to respond to errors in a timely manner. NMS to access, reducing the efficiency of the SNMP protocol in the Internet of Things. At the same time, considering the limited energy consumption and computing resources of IoT devices such as NMS and Agent, a polling priority algorithm based on statistical characteristics is added to NMS, so that it can only access static data when the device is initialized and reduce access to devices that do not change much. information, the specific process is:

Step 0: Initialize the polling period T of all objects and set it to a fixed value T ₀ .

Step 1: After two rounds of polling, calculate the degree of deviation D(i) between the value V _i of the managed object and the average value:

Step 2: Determine the polling cycle T and priority P of each managed object:

T(i)=F(D(i))

Wherein, the value of F() is set to 0.01*D(i), and the value of C is set to 1.01 ⁿ .

Step 3: P _n is the current priority of the nth managed object, and the NMS inserts it into the polling list according to the current priority P _n of each managed object. If the values of P _n are the same, compare T, and the one with the shorter cycle will be the first insert.

Step 4: The polling queue is updated every time it is completed, and a new priority and polling cycle of each object is generated. If the queue has been completed, then end the polling process, otherwise jump to step 3.

As shown in Figure 4, this method further sets the observer mechanism in the protocol to reduce the redundancy caused by the invalid data obtained by polling, that is, the NMS can be actively notified when the data of the IoT device changes, and the specific process is as follows:

Step 0: The NMS sends a subscription request message to the Agent, which contains the information of the NMS, the data rule to be observed and the identifier OID of the observed object.

Step 1: After the Agent receives the request information, it stores the observer information in the subscriber list, and stores the corresponding data rule and the observation object OID in the subscription request.

Step 2: The Agent observes the value of the MIB object according to the subscription requirements, and actively notifies all observers in the subscription table when the value changes meet the rules.

As shown in Figure 5, Figure 6, and Figure 7, in this example, there are multiple management stations that manage the same network management agent, so after adding the observer mechanism to the protocol, it becomes a network management agent that is The case where multiple management stations request a subscription. Then, when the set subscription requirements are met and the notification mechanism is triggered, the network management agent has to send a notification to all subscribers, which imposes a burden on the agent's communication resources and increases its energy consumption. By adding hierarchical routing technology to cooperate with the observer mechanism, we can improve the application of SNMP protocol in the Internet of Things. The improved protocol only notifies one NMS among all subscribers each time the notification mechanism is triggered, and the NMS is responsible for forwarding the notification information to other subscribers. Considering the power consumption of IoT devices, the LEACH protocol is selected as the basis for improvement. It dynamically selects the cluster head node for forwarding according to the geographical location of each device, the remaining energy and the number of nodes in the cluster members. The specific process is as follows:

Step 0: Each time the NMS requests subscription from the Agent, in addition to requesting subscription information, attach a random number from 0 to 1, the current CPU idle rate U and time of the NMS.

Step 1: The Agent calculates the communication delay d between the NMS and the Agent by comparing the time when the request is received, and generates a threshold T(n) based on this

Step 2: Compare the random number generated by NMS with its corresponding T(n). If the random number is smaller than T(n), the node is selected as the cluster head candidate node in this round. If there are multiple nodes selected as the cluster head Candidate nodes, from which the management station with the smallest communication delay with the Agent is selected as the cluster head node of this round.

Step 3: When the notification mechanism is triggered, the Agent sends the notification information together with the corresponding subscription table to the NMS acting as the cluster head node. After receiving the information, the NMS forwards the notification information to other NMSs in the subscription table.

The traditional SNMP protocol uses the UDP protocol to transmit SNMP messages for the convenience and real-time performance of information transmission, which causes problems of reliability and security in the transmission process. When communicating in this example, it is necessary to ensure low computing resource consumption while improving reliability. For the communication between the Agent and the cluster head NMS and between the cluster head NMS and other NMSs, a confirmation mechanism and a retransmission mechanism are added to the SNMP protocol to ensure that the information can be reliably transmitted to the target node. After the Agent sends the subscription information and subscription form to the cluster head NMS, the cluster head NMS should send a confirmation message to the Agent, indicating that it has been successfully received. Otherwise, the Agent resends information to the cluster head NMS, and if the number of retransmissions reaches the threshold N, the Agent selects any other NMS from the cluster head candidate nodes as the new cluster head. The specific flow of communication between NMSs is as follows:

Step 0: After the cluster head NMS receives the information from the Agent, it forwards the subscription information through the UDP protocol according to the subscription table.

Step 1: After receiving the subscription information, other NMSs in the cluster return confirmation information to the cluster head NMS.

Step 2: If the cluster head NMS receives the confirmation message, the communication ends, otherwise, jump to step 3.

Step 3: Find the number of retransmissions in the cluster head NMS, if the number of retransmissions reaches the threshold, jump to step 4, otherwise, the cluster head NMS retransmits the information.

Step 4: The cluster head NMS considers the node invalid, removes the node from the subscription table and sends the updated subscription table to the Agent.

The improved protocol proposed by the invention makes the network performance show good stability. Fig. 9 is the simulation result of 0.5 hours for the security monitoring and management situation managed by the same agent with 10 management stations selected. Considering that the stability of network performance can be expressed by the degree of delay fluctuation, the simulation compares the communication delay of the traditional SNMP protocol and the improved protocol, corresponding to the simulation results of the traditional SNMP protocol and the improved protocol respectively. From Figure 9, it can be found that after the communication delays of the two eventually stabilize, the average delay before and after the improvement tends to be 0.4 microseconds, while the average delay of the improved protocol tends to be stable faster, and the overall fluctuation is also smaller. Small. The results show that the Internet of Things security monitoring and management method designed by the method of the present invention can make the above Internet of Things scene have higher reliability through inter-cluster routing.

In addition, considering that the available resources of IoT devices are limited, the resulting data redundancy and communication costs are one of the key indicators to measure their practicality. In the simulation, we use network load to illustrate the above indicators. Compared with the application of the traditional SNMP protocol in the Internet of Things, the security monitoring and management method for the Internet of Things proposed by the present invention has lower instantaneous network load, as shown in FIG. 10 . In the simulation, we used the improved SNMPv1 protocol modeled by Opnet Modeler, as shown in Figure 11, we compared the average network load of the protocol before and after the improvement in the application of the Internet of Things to illustrate the resource consumption of the overall communication process. Before the improvement, the average network load tends to be 1600b/s, but after the improvement, the average network load tends to be 800b/s, which is about 50% lower. Because the polling priority algorithm based on statistical characteristics, the observer mechanism and inter-cluster routing cooperate with each other in this method, the data redundancy and communication burden between the network management agent and the management station are effectively reduced.

Those skilled in the art know that, in addition to realizing the system provided by the present invention and its various devices, modules, and units in a purely computer-readable program code mode, the system provided by the present invention and its various devices can be completely programmed by logically programming the method steps. , modules, and units implement the same functions in the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by the present invention can be regarded as a hardware component, and the devices, modules, and units included in it for realizing various functions can also be regarded as hardware components. The structure; the devices, modules, and units for realizing various functions can also be regarded as not only the software modules for realizing the method, but also the structures in the hardware components.

Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art may make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. In the case of no conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims (5)

1. A method for monitoring and managing the safety of the Internet of things is characterized in that in the process of actively acquiring the state of network equipment by a management station in the Internet of things, a polling priority algorithm based on statistical characteristics adaptively adjusts the access frequency of dynamic information according to the statistical characteristics of a managed object, and comprises the following steps:

step 11: passing through multiple wheelsAfter inquiry, the value V of the ith managed object is calculated _i Degree of deviation from average D (i):

wherein, V _j The resulting value is polled for managed objects jth,

averaging historical values of the managed objects;

step 12: determining the polling period T (i) and the priority P of each managed object:

T(i)＝F(D(i))

wherein, P _n Setting F () to make T (i) and D (i) negatively correlated, C being a settable parameter, ensuring that objects with the same polling period have different priorities;

step 13: the management station follows the current priority P of the managed object _n Inserting the managed object into a polling queue, comparing polling periods if the managed object has the same priority, and inserting the managed object into the polling queue first when the period is short;

step 14: updating the polling queue after each completion to generate new priorities and polling periods of the managed objects, if the queue is completed, ending the polling process, otherwise, skipping to the step 13;

in order to reduce redundancy caused by invalid data obtained by polling, the data acquisition method based on the observer mechanism is further included, the managed object can actively inform the management station without responding to a GetRequest request from the management station once and again, and the data acquisition method based on the observer mechanism comprises the following steps:

step 20: the management station sends a message requesting subscription to the network management agent, wherein the message comprises information of the management station, a data rule expected to be observed and an identifier OID of an observed object;

step 21: after receiving the message, the network management agent stores the information of the observer into a subscriber list and stores the corresponding data rule and the observed object OID into a subscription requirement;

step 22: the network management agent observes the value of an object in a management information base MIB according to subscription requirements, and actively informs an observer when the change of the value meets a preset rule;

the data forwarding method adopting hierarchical routing is matched with the data acquisition method based on the observer mechanism, and the data forwarding method comprises the following steps:

and step 30: attaching a random number of 0-1, the current CPU idle rate U and time of the management station when the management station requests a subscription to the network management agent each time;

step 31: the network management agent calculates the communication time delay d between the management station and the network management agent and generates a threshold value T (n) by comparing the time of receiving the request:

wherein p is the proportion of the cluster head node number to the total node number, r is the number of current working rounds, G is the set of nodes which do not become cluster head nodes in the network, W _b In the function, A and B are control factors, U (i) is the current CPU idle rate of node i, U (i) _max For the maximum idle rate in all management stations, d (i) is the communication delay from node i to the network management agent, d _avg The average time delay from all the current nodes to the network management agent is obtained;

step 32: comparing the random number generated by the management station with the corresponding T (n), if the random number is smaller than the T (n), selecting the node as a cluster head candidate node of the current round, and if a plurality of nodes are selected as the cluster head candidate nodes, selecting the management station with the minimum communication time delay with the network management agent as the cluster head node of the current round;

step 33: when the set subscription requirement is met, the network management agent sends the notification information and the corresponding subscriber list to the management station serving as the cluster head node, and the management station forwards the notification information to other observers in the subscriber list after receiving the notification information, so that the data forwarding work of the round is completed.

2. The internet of things safety monitoring and management method according to claim 1, wherein a confirmation retransmission method is adopted for communication between the network management agent and the cluster head management station and communication between the cluster head management station and other nodes in the cluster, and the confirmation retransmission method comprises the following steps:

step 40: after the network management agent sends subscription information and a subscriber list to the cluster head management station, the cluster head management station sends a confirmation message to the network management agent;

step 41: if the network management agent receives the confirmation message, the communication is ended, otherwise, the step 42 is skipped;

step 42: searching retransmission times in the network management agent, if the retransmission times reach a preset threshold value, jumping to step 43, otherwise, the network management agent retransmits the information again;

step 43: and the network management agent selects any other node from the cluster head candidate nodes as a new cluster head and forwards information to the new cluster head.

3. The utility model provides a thing networking safety monitoring and management system which characterized in that, in the initiative acquisition process of management station to the network equipment state in the thing networking, for dynamic information, the polling priority algorithm based on statistical character adjusts the access frequency according to the statistical character self-adaptation of managed object, includes:

a module M11: after a plurality of polling, the value V of the ith managed object is calculated _i Degree of deviation from average D (i):

wherein, V _j The resulting value is polled for managed objects jth,

averaging historical values of the managed objects;

a module M12: determining the polling period T and the priority P of each managed object:

T(i)＝F(D(i))

wherein, P _n Setting F () to make T (i) and D (i) negatively correlated, C being a settable parameter, for the current priority of the nth managed object, ensuring that objects with the same polling period have different priorities;

a module M13: the management station follows the current priority P of the managed object _n Inserting the managed object into a polling queue, comparing polling periods if the managed object has the same priority, and inserting the managed object into the polling queue first when the period is short;

a module M14: updating the polling queue after each completion to generate new priorities and polling periods of each managed object, ending the polling process if the queue is completed, otherwise jumping to a module M13 to execute work;

in order to reduce redundancy caused by invalid data obtained by polling, the data acquisition method based on the observer mechanism is further included, the managed object can actively inform the management station without responding to a GetRequest request from the management station for a time, and the data acquisition method based on the observer mechanism comprises the following steps:

a module M20: the management station sends a message requesting subscription to the network management agent, wherein the message comprises information of the management station, a data rule expected to be observed and an identifier OID of an observed object;

a module M21: after receiving the message, the network management agent stores the information of the observer into a subscriber list and stores the corresponding data rule and the observation object OID into a subscription requirement;

a module M22: the network management agent observes the value of an object of a management information base MIB according to subscription requirements, and actively informs an observer when the change of the value meets a preset rule;

the data forwarding method adopting hierarchical routing is matched with the data acquisition method based on the observer mechanism, and the data forwarding method comprises the following steps:

module M30: attaching a random number of 0-1, the current CPU idle rate U of the management station and time when the management station requests a subscription from a network management agent each time;

module M31: the network management agent calculates the communication time delay d between the management station and the network management agent and generates a threshold value T (n) by comparing the time when the request is received:

wherein p is the proportion of the cluster head node number to the total node number, r is the number of current working rounds, G is the set of nodes which do not become the cluster head in the network, and W _b In the function, A and B are control factors, U (i) is the current CPU idle rate of node i, U (i) _max For the maximum idle rate in all management stations, d (i) is the communication delay from node i to the network management agent, d _avg Average time delay from all current nodes to the network management agent;

the module M32: comparing the random number generated by the management station with the corresponding T (n), if the random number is smaller than the T (n), selecting the node as a cluster head candidate node of the current round, and if a plurality of nodes are selected as the cluster head candidate nodes, selecting the management station with the minimum communication time delay with the network management agent as the cluster head node of the current round;

a module M33: when the set subscription requirement is met, the network management agent sends the notification information and the corresponding subscriber list to the management station serving as the cluster head node, and the management station receives the information and forwards the notification information to other observers in the subscriber list to complete the data forwarding work of the current round.

4. The internet of things safety monitoring and management system according to claim 3, wherein a confirmation retransmission method is adopted for communication between the network management agent and the cluster head management station and communication between the cluster head management station and other nodes in the cluster, and the confirmation retransmission method comprises the following steps:

a module M40: after the network management agent sends subscription information and a subscriber list to the cluster head management station, the cluster head management station sends a confirmation message to the network management agent;

a module M41: if the network management agent receives the confirmation message, the communication is ended, otherwise, the network management agent jumps to the module M42 to execute the work;

module M42: searching retransmission times in the network management agent, if the retransmission times reach a preset threshold value, skipping to a module M43 to execute work, otherwise, the network management agent retransmits the information again;

module M43: and the network management agent selects any other node from the cluster head candidate nodes as a new cluster head and forwards information to the new cluster head.

5. A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the method for monitoring and managing security of internet of things of any one of claims 1 to 2.

Images