Internet of Things equipment intrusion detection method based on edge computing and machine learning

Abstract

The invention relates to an internet of things equipment intrusion detection method based on edge computing and machine learning, and belongs to the technical field of network security intrusion detection. In order to solve the problems that resources of Internet of Things equipment are limited and attack behaviors are difficult to quickly and accurately discover, a lightweight first-level intrusion detection model deployed on an edge computing server is designed, and the attack behaviors can be quickly detected; a secondary intrusion detection model deployed in a cloud computing server is further designed, the model is based on a convolutional neural network and a bidirectional GRU, multiple attention mechanism designs are fused at the same time, and attack behaviors can be accurately detected. According to the invention, the network flow collected by the terminal equipment is detected in a mode that the two-stage intrusion detection models on the cloud computing server and the edge computing server cooperate, and the first-stage intrusion detection model is optimized and updated by using an incremental learning mechanism, so that the network intrusion detection accuracy is improved, the false alarm rate and the missing report rate are reduced, and the network intrusion detection efficiency is improved. And the security of the Internet of Things equipment is enhanced.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security intrusion detection, and specifically relates to an Internet of Things device intrusion detection method based on edge computing and machine learning. Background Art

[0002] With the development of IoT technology, applications such as smart home, smart city, and smart medical care have emerged, bringing great convenience and comfort to people's daily lives. According to statistics, by 2025, the number of global IoT connections will increase to 24.6 billion times. At the same time, IoT devices will face increasingly complex and diverse network intrusion threats, such as DoS attacks, password cracking, port scanning, routing attacks, etc. Intrusion detection methods based on machine learning, deep learning and other technical means can effectively detect abnormal network traffic and then implement targeted security protection. However, the computing resources of IoT devices are limited, and there are still many challenges in the training and deployment of intelligent intrusion detection models. Therefore, it is necessary to study an IoT intrusion detection method that combines artificial intelligence, cloud computing and edge computing to achieve intelligent and accurate detection of network intrusions by resource-constrained IoT devices. Summary of the invention

[0003] 1. Technical issues to be resolved

[0004] The technical problem to be solved by the present invention is: the problem of intrusion detection under the limitation of low bandwidth and few resources of the Internet of Things, and overcoming the problems of low accuracy and high false negative rate existing in the traditional mode of deploying intelligent intrusion detection models only on the terminal devices of the Internet of Things.

[0005] (II) Technical solution

[0006] In order to solve the above technical problems, the present invention provides an IoT device intrusion detection method based on edge computing and machine learning, comprising the following steps:

[0007] Step 1: Data collection and preprocessing

[0008] The IoT terminal device captures traffic data from the gateway and uploads it to the edge computing server, which pre-processes the traffic data. The pre-processing steps specifically include:

[0009] Step 11, feature extraction: for the original pcap format traffic data, extract the 78-dimensional features of the traffic;

[0010] Step 12: Data cleaning: For the extracted 78-dimensional features, fill in missing values, clean up erroneous data, and remove isolated points and noise;

[0011] Step 13, feature selection: For the cleaned feature data, a random forest model is constructed, the random forest model parameters that need to be adjusted are determined, and the parameters are optimized through the grid search method. After training is completed according to the searched parameters, feature selection is performed through the permutation importance algorithm to obtain the top 20 features with the highest importance scores;

[0012] Step 14: Resample the unbalanced data: For attack types with a small number of traffic data samples, use an unbalanced sample resampling method to expand the sample size;

[0013] Step 15, feature encoding: for the traffic sample set obtained in step 14, perform one-hot encoding on the non-numerical features such as protocol type and flag bit in the 20-dimensional features obtained in step 13;

[0014] Step 16: feature normalization: normalize the numerical features obtained in step 13;

[0015] Step 17, data set division: divide the traffic data set obtained after processing in steps 11 to 16 into a training set and a test set according to a ratio of 7:3;

[0016] Step 2: First-level intrusion detection model training

[0017] The training of the first-level intrusion detection model is carried out on a cloud computing server using a training set. The input of the first-level intrusion detection model is 80% of the training set obtained in step 1, and the structure of the model is LightGBM.

[0018] For the preset parameters, on the basis of defining the parameter range, the cuckoo search algorithm is used to find the optimal parameters for the LightGBM model used for primary intrusion detection;

[0019] The cloud computing server sends the trained primary intrusion detection model and the confidence threshold matrix Θ to the edge computing server, which then deploys the model. The element θ in the confidence threshold matrix Θ is i It is calculated by the average confidence when the i-th type of sample is misclassified as other types during the training process of the first-level intrusion detection model;

[0020] Step 3: Secondary intrusion detection model training

[0021] The training of the secondary intrusion detection model is completed on the cloud computing server. The secondary intrusion detection model includes a spatial feature extraction module, a temporal feature extraction module, and a spatiotemporal feature fusion module;

[0022] (1) Spatial feature extraction module: The input of this spatial feature extraction module is the same as the input of LightGBM in step 2. The spatial feature extraction module uses multiple convolution kernels of different scales to perform feature extraction in parallel, forming three convolution paths, thereby extracting spatial features of different granularities;

[0023] In the first convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 5, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*3 and a step size of 2; the second convolution layer contains 32 one-dimensional convolution kernels, the convolution kernel length is 5, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*3 and the step size is 2;

[0024] In the second convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 3, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*3 and a step size of 2; the second convolution layer that follows contains 32 one-dimensional convolution kernels, the convolution kernel length is 3, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*3 and the step size is 2;

[0025] In the third convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 2, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*4 and a step size of 2; the second convolution layer that follows contains 32 one-dimensional convolution kernels, the convolution kernel length is 2, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*4 and the step size is 2;

[0026] The features of dimension (batch_size, 32, 3) obtained by three parallel convolutions are aggregated and transformed into features of dimension (batch_size, 3, 32, 3) and then sent to the spatial feature fusion module in the spatial feature extraction module, where batch_size is the batch size of model training; the spatial feature fusion module is composed of a channel attention module and a spatial attention module in series; wherein the channel attention module first implements adaptive maximum pooling and adaptive average pooling in parallel; the outputs of the two pooling layers in the channel attention module are passed through a shared multi-layer perceptron containing a fully connected layer, an activation function layer, and a fully connected layer in the channel attention module to learn the weight of each channel; finally, the output results obtained by the multi-layer perceptron are summed element by element and sent to the spatial attention module; the spatial attention module receives the output results of the channel attention module through maximum pooling and convolution pooling, merges the output results, and finally processes the merged features through one convolution; finally, the convolution result is flattened to obtain the final output of the spatial feature extraction module, thereby facilitating the fusion of the extracted spatial features and temporal features;

[0027] (2) Time feature extraction module: The input of the time feature extraction module is the traffic sequence obtained through preprocessing in step 1. The input traffic sequence is first processed by the bidirectional GRU in the time feature extraction module. The bidirectional GRU contains two hidden layers with 128 neural units. The output of the bidirectional GRU is further input into the self-attention layer in the time feature extraction module. The self-attention layer learns the self-attention weight through the first fully connected layer and the softmax layer, and uses the self-attention weight to calculate the output of the bidirectional GRU. Finally, it passes through the second fully connected layer in the time feature extraction module to output the extracted traffic time feature.

[0028] (3) Spatiotemporal feature fusion module: The output results of the spatial feature extraction module and the temporal feature extraction module are spliced ​​and then fused and analyzed through three fully connected layers to learn the spatiotemporal correlation characteristics of the traffic and finally output the detection results;

[0029] Step 4: Cloud-edge collaborative intrusion detection performance evaluation

[0030] Step 41: First, use the first-level intrusion detection model on the edge computing server to detect the test set obtained in step 1; if the first-level intrusion detection model detects the sample as a certain type of attack traffic, and the confidence is higher than the corresponding threshold θ, θ is an element in θ, then directly output the attack type; if the first-level intrusion detection model detects the sample as normal traffic, or the detection result is a certain type of attack but the confidence is lower than the threshold θ, there is a possibility that the first-level intrusion detection model misses or misreports the attack behavior, and at this time, the edge computing server uploads the traffic data obtained after preprocessing to the second-level intrusion detection model on the cloud computing server for further detection;

[0031] Step 42: Using the traffic data uploaded by the edge computing server as input, using the secondary intrusion detection model on the cloud computing server to perform attack detection and output the detection results;

[0032] Step 43: Statistically analyze the test results of the primary intrusion detection model and the secondary intrusion detection model respectively, and use preset indicators to evaluate the performance of the primary intrusion detection model and the two-stage collaborative intrusion detection model.

[0033] The present invention also provides a system for the Internet of Things intrusion detection method.

[0034] (III) Beneficial effects

[0035] Aiming at the problem that the IoT devices have limited resources and are difficult to quickly and accurately detect attack behaviors, the present invention designs a lightweight first-level intrusion detection model deployed on the edge computing server, which can quickly detect attack behaviors; further designs a second-level intrusion detection model deployed on the cloud computing server, which is based on convolutional neural networks and bidirectional GRU, and integrates multiple attention mechanism designs, and can accurately detect attack behaviors. The present invention detects the network traffic collected by the terminal device in a coordinated manner of the two-level intrusion detection models on the cloud computing server and the edge computing server, and optimizes and updates the first-level intrusion detection model using the incremental learning mechanism, thereby improving the accuracy of network intrusion detection, reducing the false alarm rate and missed alarm rate, and enhancing the security of the IoT devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is a flow chart of the method of the present invention;

[0037] Figure 2 Schematic diagram of the structure of the two-level intrusion detection model designed for the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0039] The present invention proposes an intrusion detection method for the Internet of Things based on edge computing and machine learning. In this method, the Internet of Things terminal device first collects network traffic, then uploads it to the edge computing server for traffic data preprocessing, and uses the lightweight LightGBM model deployed on the edge computing server to complete the first-level attack detection, and quickly filters most abnormal network behaviors. For the data with low confidence of the attack type output by the detection and the detection result of normal traffic, it is further uploaded to the cloud computing server, and the intrusion detection model based on deep learning on the cloud computing server performs secondary attack detection. The secondary intrusion detection model includes a spatial feature extraction module that integrates one-dimensional convolutional neural network, channel attention, and spatial attention, a temporal feature extraction module that combines bidirectional GRU and attention mechanism, and a spatiotemporal feature fusion module that performs correlation analysis on two types of traffic features, which can realize attack detection of Internet of Things devices with low false alarm rate and false negative rate. At the same time, for the attack traffic data missed by the edge computing server, according to the detection results of the cloud computing server, the model is optimized by incremental learning to improve the intrusion detection capability of the edge end.

[0040] This method mainly includes the following five processes: data collection and preprocessing, first-level intrusion detection model training, second-level intrusion detection model training, cloud-edge collaborative intrusion detection performance evaluation, and first-level intrusion detection model update.

[0041] Step 1: Data collection and preprocessing

[0042] The IoT terminal device captures traffic data from the gateway and uploads it to the edge computing server, which pre-processes the traffic data. The pre-processing steps specifically include:

[0043] Step 11, feature extraction: for the original pcap format traffic data, use the CICFlowmeter tool to extract the 78-dimensional features of the traffic;

[0044] Step 12: Data cleaning: For the extracted 78-dimensional features, the quality and effectiveness of the traffic data are improved by filling in missing values, cleaning erroneous data, and removing isolated points and noise;

[0045] Step 13, feature selection: For the cleaned feature data, a random forest model is constructed, the random forest model parameters that need to be adjusted are determined, and the parameters are optimized through the grid search method. After training is completed according to the searched parameters, feature selection is performed through the permutation importance algorithm; the specific process is as follows:

[0046] Construct a random forest model and determine the parameters of the random forest model that need to be adjusted, including the number of trees, the maximum depth of the tree, the minimum number of samples required for internal node re-division, etc. Set the search range for each parameter, and use the classification accuracy as an indicator to find the optimal parameter through the grid search method. Save the model after completing the training based on the searched parameters, and perform feature selection through the permutation importance algorithm to obtain the top 20 features with the highest importance scores.

[0047] Step 14: Resample the unbalanced data: For attack types with a small number of traffic data samples, use unbalanced sample resampling methods such as SMOTE to expand the sample size. In step 13 above, key features were selected based on real high-dimensional traffic features. Here, step 14 further expands a small amount of attack data, and the resulting sample is a 20-dimensional sample with the most critical features in the original traffic.

[0048] Step 15, feature encoding: for the traffic sample set obtained in step 14, perform one-hot encoding on the non-numerical features such as protocol type and flag bit in the 20-dimensional features obtained in step 13;

[0049] Step 16: feature normalization: use the min-max normalization method to normalize the numerical features obtained in step 13;

[0050] Step 17, data set division: the traffic data set (traffic sequence) obtained after processing in steps 11 to 16 is divided into a training set and a test set in a ratio of 7:3.

[0051] Step 2: First-level intrusion detection model training

[0052] The training of the first-level intrusion detection model is carried out using a training set on a cloud computing server with sufficient computing resources. The input of the first-level intrusion detection model is 80% of the training set obtained in step 1, and the structure of the model is LightGBM, which performs well in engineering applications.

[0053] This method focuses on eight parameters that have a greater impact on the algorithm performance, including learning rate, maximum number of leaves, maximum tree depth, maximum number of trees, feature subsampling ratio, data subsampling ratio, and regularization parameter. On the basis of defining the parameter range, the cuckoo search algorithm is used to find the optimal parameters for the LightGBM model used for primary intrusion detection.

[0054] In the cuckoo search algorithm, the objective function is defined as the weighted false alarm rate and false alarm rate of the model intrusion detection, with the weights of 0.5. The population size is defined as 200, and each individual is a one-dimensional vector containing 8 elements, which corresponds to 8 algorithm parameters to be searched. The number of iterations is set to 150, the probability of individual abandonment is 0.25, and the Levy flight step coefficient is set to 0.8. During the Levy flight process, for the new position to which the individual transforms, the corresponding integer parameters such as the maximum number of leaves, the maximum tree depth, and the maximum number of trees are rounded off, and the boundary control is performed according to the parameter range defined at the beginning to ensure the feasibility of the solution during the population iteration process.

[0055] The cloud computing server sends the trained first-level intrusion detection model and confidence threshold matrix Θ to the edge computing server, which then deploys the model. i It is calculated by the average confidence value when the i-th type of samples are misclassified as other types during the training process of the first-level intrusion detection model.

[0056] Step 3: Secondary intrusion detection model training

[0057] The training of the secondary intrusion detection model is completed on the cloud computing server. The secondary intrusion detection model mainly consists of a spatial feature extraction module, a temporal feature extraction module, and a spatiotemporal feature fusion module.

[0058] (1) Spatial feature extraction module: The input of this spatial feature extraction module is the same as the input of LightGBM in step 2. This spatial feature extraction module uses multiple convolution kernels of different scales to perform feature extraction in parallel, forming multiple convolution paths, thereby extracting spatial features of different granularities.

[0059] In the first convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 5, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*3 and a step size of 2; the second convolution layer that follows contains 32 one-dimensional convolution kernels, the convolution kernel length is 5, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*3 and the step size is 2.

[0060] In the second convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 3, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*3 and a step size of 2; the second convolution layer that follows contains 32 one-dimensional convolution kernels, the convolution kernel length is 3, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*3 and the step size is 2.

[0061] In the third convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 2, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*4 and a step size of 2; the second convolution layer that follows contains 32 one-dimensional convolution kernels, the convolution kernel length is 2, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*4 and the step size is 2.

[0062] The features of dimension (batch_size, 32, 3) obtained by three parallel convolutions are aggregated and transformed into features of dimension (batch_size, 3, 32, 3) and then sent to the spatial feature fusion module in the spatial feature extraction module, where batch_size is the batch size of model training. The spatial feature fusion module is composed of a channel attention module and a spatial attention module in series, which can improve the performance of the model by focusing on the key parts of the feature information graph.

[0063] Among them, the channel attention module first implements adaptive maximum pooling and adaptive average pooling in parallel; the outputs of the two pooling layers in the channel attention module are passed through the shared multi-layer perceptron in the channel attention module, which contains a fully connected layer, an activation function layer, and a fully connected layer, to learn the weight of each channel; finally, the output results obtained by the multi-layer perceptron are summed element by element and sent to the spatial attention module; the spatial attention module receives the output results of the channel attention module through maximum pooling and convolution pooling, and merges the output results, and finally processes the merged features through one convolution; finally, the convolution result is flattened to obtain the final output of the spatial feature extraction module, thereby facilitating the fusion of the extracted spatial features and temporal features.

[0064] (2) Time feature extraction module: The input of the time feature extraction module is the traffic sequence obtained through preprocessing in step 1. The input traffic sequence is first processed by the bidirectional GRU in the time feature extraction module. The bidirectional GRU contains two hidden layers with 128 neural units. The output of the bidirectional GRU is further input into the self-attention layer in the time feature extraction module. The self-attention layer learns the self-attention weight through the first fully connected layer and the softmax layer, and uses the self-attention weight to calculate the output of the bidirectional GRU. Finally, it passes through the second fully connected layer in the time feature extraction module to output the extracted traffic time feature.

[0065] (3) Spatiotemporal feature fusion module: The output results of the spatial feature extraction module and the temporal feature extraction module are concatenated and then fused and analyzed through three fully connected layers to learn the spatiotemporal correlation characteristics of the traffic and finally output the detection results.

[0066] Step 4: Cloud-edge collaborative intrusion detection performance evaluation

[0067] Step 41: First, use the first-level intrusion detection model on the edge computing server to detect the test set obtained in step 1; if the first-level intrusion detection model detects the sample as a certain type of attack traffic, and the confidence is higher than the corresponding threshold θ (θ is an element in θ), then directly output the attack type; if the first-level intrusion detection model detects the sample as normal traffic, or the detection result is a certain type of attack but the confidence is lower than the threshold θ, there is a possibility that the first-level intrusion detection model misses or misreports the attack behavior. At this time, the edge computing server uploads the traffic data obtained after preprocessing to the second-level intrusion detection model on the cloud computing server for further detection;

[0068] Step 42: Using the traffic data uploaded by the edge computing server as input, using the secondary intrusion detection model on the cloud computing server to perform attack detection and output the detection results;

[0069] Step 43: Statistically analyze the test results of the primary intrusion detection model and the secondary intrusion detection model respectively, and use indicators such as accuracy, precision, false alarm rate, false negative rate, F1 score, etc. to evaluate the performance of the primary intrusion detection model and the two-level collaborative intrusion detection model (primary and secondary intrusion detection models);

[0070] Step 44, compare the detection results of the first-level intrusion detection model and the second-level intrusion detection model; when the detection results of the two models are inconsistent, the feature vector of the traffic and the corresponding category are fed back to the edge computing server for the next step of optimizing and updating the first-level intrusion detection model.

[0071] Step 5: Update the first-level intrusion detection model

[0072] The first-level intrusion detection model is updated on the edge computing server and executed in an incremental learning manner; the data used includes samples and corresponding labels that are misclassified by the first-level intrusion detection model fed back by the cloud computing server, as well as 20% of the training set that are not used in steps 2 and 3; the 20% training set can simulate the newly discovered attack samples in the daily operation and maintenance of IoT terminal devices. Through incremental learning, new trees are added and learned based on the LightGBM model obtained in step 2, and the first-level intrusion detection model trained in the early stage is optimized. At the same time, the corresponding confidence threshold θ is readjusted according to the incremental learning results; finally, the first-level intrusion detection model is re-evaluated using the test set to verify the performance improvement effect.

[0073] It can be seen that the IoT intrusion detection method based on edge computing and machine learning of the present invention can realize accurate identification of network intrusion behavior through the processes of collecting network traffic by IoT terminal devices, preprocessing and first-level attack detection by edge computing servers on network traffic data packets, conducting second-level attack detection by cloud computing servers, and updating first-level intrusion detection models by edge computing servers.

[0074] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for intrusion detection of IoT devices based on edge computing and machine learning, characterized in that: The following steps are involved: Step 1: Data collection and preprocessing The IoT terminal device captures traffic data from the gateway and uploads it to the edge computing server, which pre-processes the traffic data. The preprocessing steps specifically include: Step 11, feature extraction: for the original pcap format traffic data, extract the 78-dimensional features of the traffic; Step 12: Data cleaning: For the extracted 78-dimensional features, fill in missing values, clean up erroneous data, and remove isolated points and noise; Step 13, feature selection: For the cleaned feature data, a random forest model is constructed, the random forest model parameters that need to be adjusted are determined, and the parameters are optimized through the grid search method. After training is completed according to the searched parameters, feature selection is performed through the permutation importance algorithm to obtain the top 20 features with the highest importance scores; Step 14: Resample the unbalanced data: For attack types with a small number of traffic data samples, use an unbalanced sample resampling method to expand the sample size; Step 15, feature encoding: for the traffic sample set obtained in step 14, perform one-hot encoding on the non-numerical features such as protocol type and flag bit in the 20-dimensional features obtained in step 13; Step 16: feature normalization: normalize the numerical features obtained in step 13; Step 17, data set division: divide the traffic data set obtained after processing in steps 11 to 16 into a training set and a test set according to a ratio of 7:3; Step 2: First-level intrusion detection model training The training of the first-level intrusion detection model is carried out on a cloud computing server using a training set. The input of the first-level intrusion detection model is 80% of the training set obtained in step 1, and the structure of the model is LightGBM. For the preset parameters, on the basis of defining the parameter range, the cuckoo search algorithm is used to find the optimal parameters for the LightGBM model used for primary intrusion detection; The cloud computing server sends the trained primary intrusion detection model and the confidence threshold matrix Θ to the edge computing server, which then deploys the model. The element θ in the confidence threshold matrix Θ is i It is calculated by the average confidence when the i-th type of sample is misclassified as other types during the training process of the first-level intrusion detection model; Step 3: Secondary intrusion detection model training The training of the secondary intrusion detection model is completed on the cloud computing server. The secondary intrusion detection model includes a spatial feature extraction module, a temporal feature extraction module, and a spatiotemporal feature fusion module; (1) Spatial feature extraction module: The input of this spatial feature extraction module is the same as the input of LightGBM in step 2. The spatial feature extraction module uses multiple convolution kernels of different scales to perform feature extraction in parallel, forming three convolution paths, thereby extracting spatial features of different granularities; In the first convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 5, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*3 and a step size of 2; the second convolution layer contains 32 one-dimensional convolution kernels, the convolution kernel length is 5, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*3 and the step size is 2; In the second convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 3, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*3 and a step size of 2; the second convolution layer that follows contains 32 one-dimensional convolution kernels, the convolution kernel length is 3, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*3 and the step size is 2; In the third convolution path, the first convolution layer contains 64 one-dimensional convolution kernels, the convolution kernel length is 2, and the convolution step is 2; this layer is followed by a maximum pooling layer with a pooling window size of 1*4 and a step size of 2; the second convolution layer that follows contains 32 one-dimensional convolution kernels, the convolution kernel length is 2, and the convolution step is 2; the pooling window size of the final maximum pooling layer is 1*4 and the step size is 2; The features of dimension (batch_size, 32, 3) obtained by three parallel convolutions are aggregated and transformed into features of dimension (batch_size, 3, 32, 3) and then sent to the spatial feature fusion module in the spatial feature extraction module, where batch_size is the batch size of model training; the spatial feature fusion module is composed of a channel attention module and a spatial attention module in series; wherein the channel attention module first implements adaptive maximum pooling and adaptive average pooling in parallel; the outputs of the two pooling layers in the channel attention module are passed through a shared multi-layer perceptron containing a fully connected layer, an activation function layer, and a fully connected layer in the channel attention module to learn the weight of each channel; finally, the output results obtained by the multi-layer perceptron are summed element by element and sent to the spatial attention module; the spatial attention module receives the output results of the channel attention module through maximum pooling and convolution pooling, merges the output results, and finally processes the merged features through one convolution; finally, the convolution result is flattened to obtain the final output of the spatial feature extraction module, thereby facilitating the fusion of the extracted spatial features and temporal features; (2) Time feature extraction module: The input of the time feature extraction module is the traffic sequence obtained through preprocessing in step 1. The input traffic sequence is first processed by the bidirectional GRU in the time feature extraction module. The bidirectional GRU contains two hidden layers with 128 neural units. The output of the bidirectional GRU is further input into the self-attention layer in the time feature extraction module. The self-attention layer learns the self-attention weight through the first fully connected layer and the softmax layer, and uses the self-attention weight to calculate the output of the bidirectional GRU. Finally, it passes through the second fully connected layer in the time feature extraction module to output the extracted traffic time feature. (3) Spatiotemporal feature fusion module: The output results of the spatial feature extraction module and the temporal feature extraction module are spliced ​​and then fused and analyzed through three fully connected layers to learn the spatiotemporal correlation characteristics of the traffic and finally output the detection results; Step 4: Cloud-edge collaborative intrusion detection performance evaluation Step 41: First, use the first-level intrusion detection model on the edge computing server to detect the test set obtained in step 1; if the first-level intrusion detection model detects the sample as a certain type of attack traffic, and the confidence is higher than the corresponding threshold θ, θ is an element in θ, then directly output the attack type; if the first-level intrusion detection model detects the sample as normal traffic, or the detection result is a certain type of attack but the confidence is lower than the threshold θ, there is a possibility that the first-level intrusion detection model misses or misreports the attack behavior, and at this time, the edge computing server uploads the traffic data obtained after preprocessing to the second-level intrusion detection model on the cloud computing server for further detection; Step 42: Using the traffic data uploaded by the edge computing server as input, using the secondary intrusion detection model on the cloud computing server to perform attack detection and output the detection results; Step 43: Statistically analyze the test results of the primary intrusion detection model and the secondary intrusion detection model respectively, and use preset indicators to evaluate the performance of the primary intrusion detection model and the two-stage collaborative intrusion detection model.

2. The method according to claim 1, characterized in that Step 4 also includes step 44, comparing the detection results of the first-level intrusion detection model and the second-level intrusion detection model; when the detection results of the two models are inconsistent, the feature vector of the traffic and the corresponding category are fed back to the edge computing server for the next step of optimizing and updating the first-level intrusion detection model.

3. The method according to claim 2, characterized in that The method also includes step 5, updating the first-level intrusion detection model: The first-level intrusion detection model is updated on the edge computing server using incremental learning. The data used include samples and corresponding labels that are misclassified by the first-level intrusion detection model fed back by the cloud computing server, as well as 20% of the training set that are not used in steps 2 and 3. The 20% training set can simulate newly discovered attack samples in the daily operation and maintenance of IoT terminal devices. Through incremental learning, new trees are added and learned based on the LightGBM model obtained in step 2 to optimize the previously trained first-level intrusion detection model, and the corresponding confidence threshold θ is readjusted according to the incremental learning results. Finally, the test set is used to re-evaluate the first-level intrusion detection model to verify the performance improvement effect.

4. The method according to claim 1, characterized in that In step 11, the CICFlowmeter tool is used to extract 78-dimensional features of the flow.

5. The method according to claim 1, characterized in that In step 13, the random forest model parameters that need to be adjusted include the number of trees, the maximum depth of the tree, and the minimum number of samples required for internal node re-division; for each parameter, the search range is set separately, and the classification accuracy is used as an indicator to find the optimal parameter through the grid search method.

6. The method according to claim 1, characterized in that In step 14, the SMOTE method is used to expand the sample size.

7. The method according to claim 1, characterized in that In step 16, the min-max normalization method is used to normalize the numerical features in the features obtained in step 13.

8. The method according to claim 1, characterized in that In step 2, the optimal parameters are found for the learning rate, maximum number of leaves, maximum tree depth, maximum number of trees, feature subsampling ratio, data subsampling ratio, and regularization parameter. In the cuckoo search algorithm, the objective function is defined as the weighted false alarm rate and false negative rate of the model intrusion detection, and the weights are both 0.

5. The population size is defined as 200, and each individual is a one-dimensional vector containing 8 elements, corresponding to 8 algorithm parameters to be searched. The number of iterations is set to 150, the probability of an individual being abandoned is 0.25, and the Levy flight step coefficient is set to 0.

8. During the Levy flight process, for the new position to which the individual transforms, the corresponding integer parameters such as the maximum number of leaves, the maximum tree depth, and the maximum number of trees are rounded off, and the boundary control is performed according to the parameter range defined at the beginning.

9. The method according to claim 1, characterized in that In step 43, the performance of the first-level intrusion detection model and the two-level collaborative intrusion detection model are evaluated using indicators such as accuracy, precision, false alarm rate, false negative rate, and F1 score.

10. A system for implementing the method according to any one of claims 1 to 9.

Images