Internet of Things intrusion detection system and method based on graph neural network

Abstract

The invention relates to the technical field of network security, and discloses an Internet of Things intrusion detection system and method based on a graph neural network. According to the system and the method, original flow data can be effectively collected from a network through a data collection and preprocessing module, IP address randomization, feature normalization and target coding are carried out, it is ensured that generated data is suitable for graph structure modeling, a graph structure construction module converts preprocessed data into graph structure representation, and the graph structure representation is realized. A clear network topology is formed by utilizing feature initialization of nodes and edges, the graph coding and feature extraction module deeply extracts and updates the features of the nodes and the edges through an improved graph encoder, the feature representation capability of the model is enhanced by introducing a contrast loss function, the recognition precision of potential intrusion behaviors is improved, and the recognition efficiency of the potential intrusion behaviors is improved. And the model training and classification judgment module performs accurate classification on the network traffic by using the trained model, identifies and outputs an intrusion detection result, and improves the accuracy and efficiency of intrusion detection in the Internet of Things environment.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and particularly to an Internet of Things intrusion detection system and method based on graph neural network. Background Art

[0002] With the sharp increase in the number of Internet of Things devices, network security issues have become increasingly prominent. Traditional network intrusion detection systems (Network Intrusion Detection Systems, NIDS) usually rely on flat data analysis methods and are difficult to capture the structured behavior of attacks. Therefore, in recent years, intrusion detection methods based on graph neural networks have gradually attracted the attention of researchers. GNN can utilize the topological structure of network traffic and better capture complex network relationships by aggregating information of nodes and their neighbors, improving the performance of intrusion detection. However, existing GNN methods still face challenges such as high computational complexity and low generalization ability when dealing with large-scale dynamic network structures.

[0003] Therefore, how to design an improved graph neural network model that can effectively process large-scale network traffic data in the Internet of Things environment has become an important topic in current network security research. Summary of the Invention

[0004] (1) Technical Problems to be Solved

[0005] Aiming at the deficiencies of the prior art, the present invention provides an Internet of Things intrusion detection system and method based on graph neural network. By introducing attention mechanism, gating mechanism, residual connection and graph contrast learning, the deficiencies in the existing methods are solved, thereby improving the detection ability of the system for network intrusion behavior.

[0006] (2) Technical Solutions

[0007] To achieve the above object, the present invention provides the following technical solutions: An Internet of Things intrusion detection system based on graph neural network, including a data collection and preprocessing module, a graph structure construction module, a graph encoding and feature extraction module, a contrast learning and feature enhancement module, and a model training and classification judgment module;

[0008] The data collection and preprocessing module collects raw traffic data from the network, performs IP address randomization, feature normalization and target encoding to generate data suitable for graph structure modeling;

[0009] The graph structure construction module converts the preprocessed raw traffic data into a graph structure representation, creates nodes and edges using a graph construction tool, and initializes the features of the nodes and edges;

[0010] The graph encoding and feature extraction module extracts and updates the node and edge features in the graph through an improved graph encoder, generating the embeddings of nodes and edges;

[0011] The contrastive learning and feature enhancement module conducts contrastive learning and fusion on the node and edge features. By introducing a contrastive loss function, it calculates the differences between positive and negative samples and minimizes the loss to enhance the feature representation ability of the model;

[0012] The model training and classification judgment module classifies and judges the network traffic through the trained model, identifies potential intrusion behaviors, and outputs the corresponding intrusion detection results.

[0013] Preferably, the formula for IP address randomization is as follows:

[0014]

[0015] In the formula, represents the randomized address, represents the original IP address, represents the hash function, represents the value of the randomization range, represents the modulo operation.

[0016] Preferably, the graph construction tool converts the network traffic data into a graph structure through the library, where the nodes represent network devices, the edges represent the communications between devices, and each node and edge is attached with corresponding features for subsequent graph neural network calculations. The graph data conversion uses the graph neural network library to convert the graph into a graph structure suitable for operations.

[0017] Preferably, the features of the nodes and edges are updated through the following formula:

[0018]

[0019] In the formula, represents the embedded feature, , represent two different nodes, and represent the embedding information of the previous layer of two different edges, represents the concatenation operation, represents the element-wise multiplication, represents the current updated layer number, represents the activation function operation, represents the weight information of the It means that the original features of the previous layer are allowed to be directly added to the output of the current layer.

[0020] Preferably, the graph encoder introduces an attention mechanism, a gating mechanism, and a residual connection to handle the complex network relationships between models.

[0021] Preferably, the fusion of the nodes and edges is achieved through the following formula:

[0022]

[0023]

[0024] In the formula, is the joint probability distribution, and are the marginal probability distributions, and represent two embedding vectors, represents the label, which is a binary variable, represents the Euclidean distance between two vectors, represents the distance between negative sample pairs for calculation, is used to ensure that the distance does not fall below the threshold, and the mutual information is a measure for quantifying the dependence between two variables.

[0025] Preferably, the contrast loss function is as follows:

[0026]

[0027] In the formula, represents the value of the contrast loss function, represents the label, 1 for the same class and 0 for different classes, represents the boundary parameter, represents the distance function, represents the feature extraction function, represents the sample, represents the positive sample.

[0028] Preferably, the formula for calculating the difference between the positive and negative samples is as follows:

[0029]

[0030] In the formula, represents the sample and the sample is the Euclidean distance between them, and are respectively the samples and the sample Feature embedding.

[0031] Preferably, the recognition of potential intrusion behavior is carried out through the following conditional formula:

[0032]

[0033] In the formula, represents the final classification decision, represents the probability of the output being a positive class given the input , represents the input sample, represents the decision threshold.

[0034] An Internet of Things intrusion detection method based on a graph neural network includes the following steps:

[0035] S1. Collect the original traffic data from the network, perform IP address randomization, feature normalization, and target encoding to generate data suitable for graph structure modeling;

[0036] S2. Convert the preprocessed data into a graph structure representation, use a graph construction tool to create nodes and edges, and initialize the features;

[0037] S3. Through an improved graph encoder, extract and update the features of the nodes and edges in the graph to generate the embedding representations of the nodes and edges;

[0038] S4. Perform contrastive learning and fusion on the node and edge features to enhance the feature representation ability of the model;

[0039] S5. Through the trained model, classify and judge the network traffic, identify potential intrusion behaviors, and output the intrusion detection results.

[0040] Compared with the prior art, the present invention provides an Internet of Things intrusion detection system and method based on a graph neural network, having the following beneficial effects:

[0041] 1. Through the improved graph encoder of the present invention, the system can efficiently extract key features in network traffic and improve the accuracy of intrusion detection.

[0042] 2. By introducing contrastive learning and a gating mechanism, the present invention effectively filters out noise data and improves the adaptability to complex network environments.

[0043] 3. The present invention supports processing large-scale network traffic data, is applicable to various Internet of Things application scenarios, has good scalability, provides an efficient and robust intrusion detection solution for network security in the Internet of Things environment, and has broad application prospects and commercial value. Description of the Drawings

[0044] Figure 1 This is a schematic diagram of the system process of the present invention;

[0045] Figure 2 This is a schematic diagram of the method steps of the present invention. Specific implementation manner

[0046] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0047] In view of the problems that existing GNN methods still face high computational complexity and low generalization ability when dealing with large-scale dynamic network structures, an Internet of Things intrusion detection system based on graph neural network is proposed. Please refer to Figure 1 , this system includes a data collection and preprocessing module, a graph structure construction module, a graph encoding and feature extraction module, a contrast learning and feature enhancement module, and a model training and classification judgment module;

[0048] In the data collection and preprocessing module, the system collects raw traffic data from the network. This process is realized by deploying a packet capture tool (such as Wireshark or tcpdump) to monitor and record network traffic in real time. The collected raw data includes information such as source IP address, destination IP address, port number, protocol type, and packet size. To improve the anonymity of the data and protect user privacy, the system randomizes the source IP address. Specifically, the original IP address is converted into a new randomized IP address using a cryptographic hash function:

[0049]

[0050] Among them, is the number of available IP addresses. This process ensures the diversity of the new IP addresses in the network, making it difficult to trace intrusion behaviors, thereby enhancing the generalization ability of the model and the privacy protection of the data;

[0051] Next, to enhance the model's ability to process data, the system converts the source IP address, destination IP address, and port number into string format and concatenates them to form a new field to represent the source and destination of network traffic. At the same time, the system performs feature normalization on numerical features such as packet length using standardization techniques to bring the features within the same dimensional range. This process is achieved by calculating the mean and standard deviation of each feature. For categorical features (such as protocol type), the system uses target encoding techniques to map them to the average value of the target variable, thus converting them into effective numerical features. Through the combination of these technical means, the system generates a data format suitable for graph structure modeling, laying a solid foundation for the effective training and inference of subsequent graph neural networks;

[0052] In the graph structure construction module, the system converts the preprocessed original traffic data into a graph structure representation and uses a graph construction tool (such as the NetworkX library) to model the network traffic data. First, the system defines the nodes and edges of the graph based on the characteristics of the network traffic. Each node represents a device in the network (such as a router, switch, or terminal device), and the edge represents the communication relationship between devices, specifically the transmission connection of packets. By parsing the source IP address and destination IP address in the preprocessed data, the system uses the unique identifier of the device as the node. Next, during the construction of the edge, the system determines the existence of the edge based on the transmission direction and frequency of the traffic, which can truly reflect the interaction between different devices;

[0053] Once the nodes and edges are created, the system initializes the features for each node and edge, thus providing rich context information for the graph neural network. For example, the node can include features such as the type, status, and number of connections of the device, while the edge can contain features such as the transmission protocol, packet size, and transmission rate. At this stage, the node features are usually initialized as all - 1 vectors to ensure non - biased input at the initial stage of model training. At the same time, the edge features will be set directly according to the network traffic data to ensure that the dynamic changes of the network topology can be effectively captured;

[0054] Through the above steps, the system successfully expresses the network traffic data in the form of a graph structure, laying a foundation for the calculation and feature learning of subsequent graph neural networks, enabling the model to effectively extract complex relationship information between nodes;

[0055] In the graph encoding and feature extraction module, the system effectively extracts and updates the node and edge features in the graph through an improved graph encoder, thus generating high - dimensional node and edge embedding representations. This improved graph encoder combines multiple advanced techniques, such as attention mechanism, gating mechanism, and residual connection, to enhance the model's understanding of complex network structures and its feature representation ability;

[0056] Among them, the graph encoder SAGELayer defines a message passing and feature update mechanism based on linear layers, uses attention mechanism and gating mechanism to weight the information of nodes and edges. During the forward propagation process, it updates the features of all nodes and edges in the graph by capturing all neighbor features. At each layer, the node features are updated as shown in the following equation:

[0057]

[0058] Among them, represents the embedded feature, and represent two different nodes, and represent the embedded information of the previous layer on two different edges, represents the concatenation operation, represents the element-wise multiplication, represents the current updated layer number, represents the activation function operation, represents the weight information of the layer, represents allowing the direct addition of the original features of the previous layer to the output of the current layer, which helps to alleviate the problem of vanishing gradients in deep networks, promote feature retention. At the same time, the SAGE model includes multiple SAGELayer layers for extracting the features of nodes and edges layer by layer, and finally outputs the embedded representation of the nodes;

[0059] In the contrastive learning and feature enhancement module, the system enhances the feature representation ability and classification performance of the model by performing contrastive learning and feature fusion on node and edge features. In this process, the system first generates positive and negative sample pairs to enhance the sensitivity of the model to the differences between normal traffic and abnormal traffic. Specifically, the positive sample pairs are obtained by slightly perturbing the original graph structure to ensure that its main structural features remain unchanged, while the negative samples are obtained by introducing significant perturbations to simulate random and abnormal network behaviors, thus providing challenges for the model;

[0060] To quantify the differences between positive and negative samples, the system introduces a contrastive loss function, such as the contrastive loss in information theory, and its form is:

[0061]

[0062] Among them, represents the value of the contrastive loss function, represents the label, 1 for the same class, 0 for different classes, represents the margin parameter, represents the distance function, denotes the feature extraction function, denotes the sample, denotes the positive sample. By minimizing this loss function, the system can distinguish samples of different categories to the greatest extent and improve the discriminative ability of the model;

[0063] During the contrastive learning process, the ContrastiveFusionModel is used to fuse node and edge features, and the mutual information is calculated as a regularization term to optimize the feature representation ability of the model, as shown by the following two formulas:

[0064]

[0065]

[0066] In the formula, is the joint probability distribution, and are the marginal probability distributions, and denote two embedding vectors, denotes the label, which is a binary variable, denotes the Euclidean distance between two vectors, denotes the distance between negative sample pairs used for calculation, is used to ensure that the distance will not be lower than the threshold, and the mutual information is a measure used to quantify the dependence between two variables. In graph contrastive learning, maximizing the mutual information between node or edge embeddings can enhance the model's understanding of the graph structure;

[0067] The system also calculates the similarity between positive sample pairs to ensure that the distance between similar data in the feature space is as small as possible, while the distance between samples of different categories is enlarged. Through such a mechanism, the system not only strengthens the ability to capture complex information in the feature space but also improves the model's ability to handle the robustness and uncertainty of features. Finally, after contrastive learning and feature fusion processing, the obtained node and edge embeddings can provide a richer and more insightful feature basis for subsequent classification judgments, providing strong support for the anomaly detection of network traffic;

[0068] In the model training and classification judgment module, the system classifies and judges network traffic through a trained graph neural network model to identify potential intrusion behaviors. First, in the model training stage, the system adopts a combination of cross-entropy loss function and contrastive learning loss function to optimize the model's parameters. The cross-entropy loss function is used to handle multi-class classification problems and can effectively measure the gap between the prediction result and the true label. The contrastive learning loss function promotes the proximity of similar samples and the separation of different samples in the feature space. This dual loss function makes the model more accurate in capturing traffic features, thereby improving the classification accuracy.

[0069] Once the model is trained and reaches a satisfactory performance, the system enters the testing stage. In this stage, the processed network traffic data is input into the trained model. The model classifies each network flow as normal traffic or abnormal traffic by predicting the edge labels of the network flow. Such a prediction process utilizes the embedded representations of nodes and edges in the graph and combines the model's deep understanding of network traffic features to ensure the accuracy of discrimination. According to the prediction results, the system can not only identify potential intrusion behaviors but also further analyze specific attack types, such as distributed denial-of-service attack (DDoS), ordinary denial-of-service attack (DoS), SQL injection attack, etc. Finally, these classification results and detection information will be output to help security personnel take necessary response measures to enhance the security and reliability of the overall network.

[0070] Please refer to Figure 2 , an Internet of Things intrusion detection method based on graph neural network, comprising the following steps:

[0071] S1. Collect original traffic data from the network, perform IP address randomization, feature normalization, and target encoding to generate data suitable for graph structure modeling;

[0072] S2. Convert the preprocessed data into a graph structure representation, use a graph construction tool to create nodes and edges, and initialize the features;

[0073] S3. Through an improved graph encoder, extract and update the features of nodes and edges in the graph to generate embedded representations of nodes and edges;

[0074] S4. Perform contrastive learning and fusion on the features of nodes and edges to enhance the feature representation ability of the model;

[0075] S5. Through the trained model, classify and judge network traffic, identify potential intrusion behaviors, and output intrusion detection results.

[0076] Embodiment:

[0077] To verify the effectiveness of the present invention, we conducted experiments on multiple publicly available datasets. The experimental results show that the Internet of Things intrusion detection system of the present invention performs excellently in various classification tasks;

[0078] Dataset selection: We selected multiple Internet of Things network traffic datasets, including the NF-BoT-IoT-v2, NF-ToN-IoT-v2, and NF-CSE-CIC-IDS2018-v2 datasets. These datasets cover a variety of common attack types and are widely representative;

[0079] Experimental settings: On each dataset, we conducted multiple experiments on the system, training and evaluating the model for binary classification tasks (normal traffic and attack traffic) and multi-classification tasks (specific attack types) respectively;

[0080] Experimental results: The experimental results show that the system of the present invention has achieved high accuracy, precision, and recall rates in both binary classification and multi-classification tasks. In particular, it shows significant advantages when detecting complex attack patterns.

[0081] In summary, the present invention provides an efficient and robust intrusion detection solution for network security in the Internet of Things environment, with broad application prospects and commercial value.

[0082] Although the embodiments of the present invention have been shown and described, it will be understood by those of ordinary skill in the art that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. An Internet of Things intrusion detection system based on graph neural network, characterized in that: It includes a data collection and preprocessing module, a graph structure construction module, a graph encoding and feature extraction module, a contrastive learning and feature enhancement module, and a model training and classification judgment module; The data collection and preprocessing module collects raw traffic data from the network, performs IP address randomization, feature normalization, and target encoding to generate data suitable for graph structure modeling; The graph structure construction module converts the preprocessed raw traffic data into a graph structure representation, creates nodes and edges using a graph construction tool, and initializes the features of the nodes and edges; The graph encoding and feature extraction module extracts and updates the features of nodes and edges in the graph through an improved graph encoder to generate embeddings of nodes and edges; The contrastive learning and feature enhancement module performs contrastive learning and fusion on the features of nodes and edges. By introducing a contrastive loss function, it calculates the difference between positive and negative samples and minimizes the loss to enhance the feature representation ability of the model; The model training and classification judgment module classifies and judges network traffic through the trained model, identifies potential intrusion behaviors, and outputs corresponding intrusion detection results.

2. The Internet of Things intrusion detection system based on a graph neural network according to claim 1, wherein: The formula for the IP address randomization is as follows: In the formula, represents the randomized address, represents the original IP address, represents the hash function, represents the value of the randomization range, represents the modulo operation.

3. The Internet of Things intrusion detection system based on a graph neural network according to claim 2, wherein: The graph construction tool converts network traffic data into a graph structure through a library, where nodes represent network devices, edges represent communications between devices, and each node and edge is attached with corresponding features for subsequent graph neural network calculations. The graph data conversion is achieved by using a graph neural network library , which converts the graph into a graph structure suitable for 4. The Internet of Things intrusion detection system based on a graph neural network according to claim 3, characterized in that: The features of the nodes and edges are updated through the following formula: In the formula, represents the embedded feature, , represent two different nodes, and represent the embedding information of the upper layer of two different edges, represents the concatenation operation, represents the element-wise multiplication, represents the currently updated layer number, represents the activation function operation, represents the weight information of the layer, represents allowing the original features of the previous layer to be directly added to the output of the current layer.

5. The Internet of Things intrusion detection system based on a graph neural network according to claim 4, characterized in that: The graph encoder introduces an attention mechanism, a gating mechanism, and a residual connection to handle complex network relationships between models.

6. The Internet of Things intrusion detection system based on a graph neural network according to claim 5, characterized in that: The fusion of the nodes and edges is achieved through the following formula: In the formula, is the joint probability distribution, and are the marginal probability distributions, and represent two embedding vectors, represents the label, which is a binary variable, represents the Euclidean distance between two vectors, represents the distance between negative sample pairs used for calculation, is used to ensure that the distance will not be lower than the threshold, and the mutual information is a measure used to quantify the dependence between two variables.

7. An Internet of Things intrusion detection system based on a graph neural network according to claim 6, characterized in that: The contrastive loss function is as follows: In the formula, represents the value of the contrast loss function, represents the label, where 1 indicates the same class and 0 indicates a different class, represents the boundary parameter, represents the distance function, represents the feature extraction function, represents the sample, represents the positive sample.

8. The Internet of Things intrusion detection system based on a graph neural network according to claim 7, characterized in that: The formula for calculating the difference between positive and negative samples is as follows: In the formula, represents the and the Euclidean distance between the samples, and are the feature embeddings of the samples and the respectively.

9. The Internet of Things intrusion detection system based on graph neural network according to claim 8, wherein: The identification of potential intrusion behaviors is carried out through the following conditional formula: In the formula, represents the final classification decision, represents the probability of the output being the positive class given the input , represents the input sample, represents the decision threshold.

10. An Internet of Things intrusion detection method based on graph neural network, characterized in that, It includes the following steps: S1. Collect raw traffic data from the network, perform IP address randomization, feature normalization, and target encoding to generate data suitable for graph structure modeling; S2. Convert the preprocessed data into a graph structure representation, create nodes and edges using a graph construction tool, and initialize the features; S3. Extract and update the features of nodes and edges in the graph through an improved graph encoder to generate embedding representations of nodes and edges; S4. Perform contrastive learning and fusion on the features of nodes and edges to enhance the feature representation ability of the model; S5. Classify and judge network traffic through the trained model, identify potential intrusion behaviors, and output intrusion detection results.

Images