A hybrid model abnormal traffic detection system and method based on ELM and deep forest

Abstract

The present invention provides a hybrid model abnormal traffic detection system and method based on ELM and deep forest. The system includes feature extraction and dimension reduction of real-time traffic, and hybrid detection based on ELM and deep forest model is used for the traffic features after dimension reduction. The detection method mainly includes using the ELM algorithm deployed on the member nodes in the wireless sensor network to quickly detect the traffic, using the deep forest model at the upper node Sink node of the member node to perform secondary detection on the abnormal traffic detected by the member node, and finally giving the abnormal traffic detection result, and finally storing the traffic data in a temporary database at the management node, and using the original data set and the new data set to refer to the evaluation indicators such as accuracy and AUC to tune the deep forest model. The present invention can complete the abnormal traffic detection on resource-constrained nodes such as wireless sensors, reduce the energy consumption of abnormal detection of each node, and also improve the accuracy of abnormal detection results.

Description

Technical Field

[0001] The present invention relates to the field of network security detection technology, and specifically but not limited to, to an abnormal traffic detection system and method based on a hybrid model of ELM and deep forest. Background Art

[0002] According to the Internet Security Threat Report (ISTR), at present, there are some cryptojacking criminals in the Internet environment who use cryptojacking scripts to make some devices unusable due to high CPU usage, and network attacks occur frequently and are difficult to prevent. In addition, with the popularization of IoT systems, many IoT systems composed of resource-constrained terminals such as wireless sensors have become targets of attacks by malicious third parties due to large-scale use and long-term environmental openness. There is an increasing demand for fast, low-power abnormal traffic detection.

[0003] Existing intrusion detection usually relies on traditional machine learning and deep learning algorithms, treats anomaly detection as a binary classification problem, and uses normal data and abnormal data to establish supervised, semi-supervised or unsupervised learning models, which has achieved good results. In particular, deep learning algorithms that have been successful in visual tasks have been widely tried and applied in the field of abnormal traffic by relevant research institutions at home and abroad in recent years.

[0004] Deep learning uses training of multiple single-layer nonlinear networks to discover and characterize the complex structural features within the problem, so it can express the essential characteristics of the data, has strong generalization capabilities, and has increasingly higher accuracy in abnormal traffic detection. However, it also requires increasing computational overhead, has too many hyperparameters, and learning performance is heavily dependent on careful parameter tuning. There are too many interference factors in training, and a large amount of training data is required. It has a slow convergence speed and takes a long time, making it difficult to apply to tasks with only small-scale training data.

[0005] To address the above issues, deep forests have fewer hyperparameters than deep neural networks and are more robust to hyperparameter settings. Deep forests are deep models based on non-differentiable modules that generate deep forests with three characteristics: layer-by-layer processing, feature conversion within the model, and sufficient model complexity. In most cases, excellent performance can be achieved using the same default settings even on different data in different fields.

[0006] Extreme Learning Machine (ELM) has the advantages of requiring fewer parameters, occupying fewer resources, fast training speed and high learning efficiency. ELM is a single hidden layer feedforward neural network SLFNs learning algorithm, which has the advantages of strong learning ability and approximation of complex nonlinear functions. The solution is direct, and the final solution process will become a Moore-Penrose generalized inverse problem of solving a matrix. It only needs to set the number of hidden layer neurons to start training the model. From the application point of view, ELM can reduce energy consumption while ensuring a high detection rate, and is more suitable for resource-constrained wireless sensor networks. Summary of the invention

[0007] In response to one or more problems in the prior art, the present invention proposes a hybrid model abnormal traffic detection system and method based on ELM and deep forest to complete abnormal traffic detection on resource-constrained nodes such as wireless sensors, with high detection efficiency and accuracy.

[0008] The technical solution to achieve the purpose of the present invention is:

[0009] A hybrid model abnormal traffic detection method based on ELM and deep forest, characterized by comprising:

[0010] Step 1: Perform data cleaning, feature extraction and data dimension reduction on the real-time traffic data collected by the bottom member nodes in the resource-constrained nodes of the wireless sensor;

[0011] Step 2: Deploy the extreme learning machine ELM model and the deep forest model at different nodes in the wireless sensor network to perform mixed abnormal traffic detection and output the abnormal traffic detection results;

[0012] Step 3: The management node in the wireless sensor retrains the deep forest model on the updated data set based on accuracy and AUC as evaluation indicators, where AUC is the area under the ROC curve.

[0013] Furthermore, in the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention, step 1 specifically includes:

[0014] S1-1: Remove dirty data such as non-numeric values ​​NAN and infinite values ​​Infinity in real-time traffic data;

[0015] S1-2: For the captured complete network information, refer to the botnet dataset for the Internet of Things (BOT-IOT dataset) published by the Canberra Network Range Laboratory of the University of New South Wales, select 30-dimensional data that has a greater impact on abnormal traffic detection, and add 14 new features based on the 30-dimensional features, mainly statistical data such as the total number of packets for each source / destination IP;

[0016] S1-3: Normalize and standardize the processed data to form pre-processed traffic data with a total of 54 dimensional features.

[0017] Furthermore, in the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention, step 2 specifically includes:

[0018] Step 2-1: Deploy the ELM model to the member nodes through the management node in the wireless sensor;

[0019] Step 2-2: Deploy the deep forest model to the sink node through the management node in the wireless sensor;

[0020] Step 2-3: Perform ELM fast detection on the real-time traffic data after dimensionality reduction in the member node, and add data features to the traffic data according to the detection result. If the detection result is normal traffic, its data feature is marked as a normal value and passed; if the detection result is abnormal traffic, its data feature is marked as an abnormal value;

[0021] Step 2-4: Delete the data feature mark of the abnormal traffic in the sink node, and then use the deep forest model to perform secondary detection on the aforementioned abnormal traffic. According to the secondary detection results, add data features to the traffic data as its final feature value, and aggregate and integrate the data into the management node.

[0022] Furthermore, in the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention, the pre-training process of the ELM model deployed in step 2-1 includes:

[0023] Step 2-1-1: Input training sample X train , the sample size is [row0,col0], the BOT-IOT dataset preprocessed in step 1 is divided into a training set and a test set according to the ratio of 8:2, X train is the training set, row0 is the number of training samples, col0 is the feature dimension of training samples; the number of hidden layer units is n, n is a positive integer;

[0024] Step 2-1-2: Initialize the weight w and bias b of the ELM model, where the value range of w is [col0,n] and the value range of b is [row0,n];

[0025] Step 2-1-3: According to the formula h = g (w x train +b) Calculate the nonlinear mapping of the ELM model, where g(x) is the activation function, h is the nonlinear mapping of the ELM model, and X train For training samples, the output of the hidden layer is obtained by finding the inverse matrix H of h, and the size of H is [n, row0];

[0026] Step 2-1-4: Perform one-hot encoding on the data labels in the data set and calculate β=H·T, where the data label indicates whether the data is abnormal traffic, T is the value of the label data after one-hot encoding, and β represents the output weight, which is [n,2].

[0027] Step 2-1-5: Input real-time traffic data X test Calculate h1 = g(w·X test +b), h1 is the nonlinear mapping of the real-time flow data under test in the ELM model, and is used with β to calculate the flow detection result. The calculation formula is: result = h1·β;

[0028] Step 2-1-6: Classify the traffic detection results to obtain abnormal traffic and normal traffic;

[0029] Step 2-1-7: Save the trained weights w, bias b, and inverse matrix H as the parameters required to deploy the ELM model.

[0030] Furthermore, in the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention, the pre-training process of the deep forest model deployed in step 2-2 includes:

[0031] Step 2-2–1: Select deep forest classifiers, namely XGBoost classifier, random forest classifier and extreme random tree classifier. Set the maximum depth of XGBoost classifier to 5, the target to multi-classification, the learning rate to 0.1, and the random forest classifier and extreme random tree classifier to use the default parameter settings;

[0032] Step 2-2-2: Use the processed BOT-IOT model to perform deep forest training and save the deep forest training results.

[0033] Furthermore, in the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention, step 3 specifically includes:

[0034] Step 3-1: Deploy the optimized deep forest model in the user-oriented management node and configure the deep forest parameters;

[0035] Step 3-2: Pre-store the marked traffic data from each sink node into a temporary database and set the upper limit of data storage;

[0036] Step 3-3: When the pre-stored quantity reaches the storage limit, extract the data features as labels, mix them with the original data set and divide them into training set and test set, and use accuracy and AUC as evaluation indicators to tune the deep forest model;

[0037] Step 3-4: The management node loads the tuned model into the sink node.

[0038] Furthermore, in the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention, the deep forest model tuning in step 3-3 adopts K-fold cross validation method, which specifically includes:

[0039] Step 3-3-1: Back up the original data set;

[0040] Step 3-3-2: The original data set is divided into a training set and a test set. The data features in the temporary database are taken out as a label set, and the label set is merged with the training set in the original data set to form a new data set.

[0041] Step 3-3-3: Divide the new data set into k groups, select one of them as the validation set, and the remaining k-1 groups as the training set;

[0042] Step 3-3-4: Use a deep forest composed of a random forest classifier, an XGBoost classifier, an extreme random tree classifier, and a logistic regression classifier to construct a deep forest algorithm model;

[0043] Step 3-3-5: Find the model with the smallest error in the validation set for each of the k-1 folds. If the number of training times is less than k, return to step 3-3-3;

[0044] Step 3-3-6: Take the model with the smallest error in each fold in the validation set and put it into the test set to test the error, and calculate the average performance on the test set each time;

[0045] Step 3-3-7: The evaluation values ​​are selected as accuracy and AUC value, and the average value of the new model is compared with the performance of the original model. If the performance is improved, the deep forest model is updated and the data set is updated. Otherwise, the original deep forest model is continued to be used and the data stored this time is deleted.

[0046] An abnormal traffic detection system based on a hybrid model of ELM and deep forest based on any of the above detection methods, comprising:

[0047] The real-time traffic data feature extraction and dimension reduction module is used to perform data cleaning, feature extraction and data dimension reduction on the real-time traffic data collected by the bottom member nodes in the resource-limited nodes of the wireless sensor;

[0048] The abnormal traffic detection module is used to deploy the ELM model and the deep forest model at different nodes in the wireless sensor network to perform mixed abnormal traffic detection and output the abnormal traffic detection results;

[0049] The deep forest model training module is used for the management node in the wireless sensor to retrain the deep forest model on the updated data set based on the accuracy and AUC as evaluation indicators, where AUC is the area under the ROC curve.

[0050] Compared with the prior art, the present invention adopts the above technical solution and has the following technical effects:

[0051] The hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention is used for resource-constrained nodes such as wireless sensors, and performs hybrid detection based on ELM and deep forest model on the preprocessed traffic characteristics. In the wireless sensor network, according to the different divisions of labor of different nodes in the network, ELM and deep forest models are deployed respectively, and multi-layer coordination greatly reduces the energy consumption of abnormal detection of each node, and also can improve the accuracy of abnormal detection results. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings are used to provide a further understanding of the present invention and are used together with the description to explain the embodiments of the present invention, but do not constitute a limitation of the present invention. In the accompanying drawings:

[0053] Figure 1 This is a flow chart of the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention.

[0054] Figure 2 This is an architecture diagram of the hybrid model abnormal traffic detection system based on ELM and deep forest of the present invention.

[0055] Figure 3 Schematic diagram of the ELM model of the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention.

[0056] Figure 4 Schematic diagram of the deep forest model of the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention.

[0057] Figure 5 This is a k-fold cross-validation graph of the hybrid model abnormal traffic detection method based on ELM and deep forest of the present invention. DETAILED DESCRIPTION

[0058] In order to further understand the present invention, preferred embodiments of the present invention are described below in conjunction with examples. However, it should be understood that these descriptions are only for further illustrating the features and advantages of the present invention, rather than limiting the claims of the present invention.

[0059] The description in this section is only for several typical embodiments, and the present invention is not limited to the scope of the embodiments. The combination of different embodiments, the mutual replacement of some technical features in different embodiments, and the mutual replacement of the same or similar prior art means with some technical features in the embodiments are also within the scope of the description and protection of the present invention.

[0060] A hybrid model abnormal traffic detection method based on ELM and deep forest, such as Figure 1 As shown in the figure, it is realized through three modules: real-time traffic data feature extraction and dimension reduction module, abnormal traffic detection module, and deep forest model training module, including:

[0061] S1: Real-time traffic data feature extraction and dimension reduction module, first cleans the real-time traffic data collected by the underlying member nodes in resource-constrained nodes such as wireless sensors, then extracts features and reduces the data dimension. Specifically:

[0062] S11: Remove the non-numeric NAN and infinite numeric Infinity dirty data in real-time traffic.

[0063] S12: For the captured complete network information, refer to the BOT-IOT dataset to select 30-dimensional data that has a greater impact on abnormal traffic detection, such as the text representation of the transaction protocol in the network flow, the source IP address, the target IP address, etc. In order to improve the detection capability of the classifier, 14 new features are added based on the 30-dimensional features, mainly statistical data such as the total number of packets for each source / target IP.

[0064] S13: normalize and standardize the processed data to form pre-processed traffic data with a total of 54 dimensional features.

[0065] S2: Abnormal traffic detection module, which performs hybrid abnormal traffic detection by deploying ELM and deep forest models at different nodes in the wireless sensor network and outputs abnormal traffic detection results. Specifically:

[0066] S21: Deploy the ELM model to the member nodes through the management node in the wireless sensor.

[0067] Preferably, the deployed ELM model pre-training process includes:

[0068] Step a1: Input training sample X train , the sample size is [row0,col0], and the number of hidden layer units is n; here the sample size is [4000000,54]. After testing, the number of hidden layer units n is selected as 109.

[0069] Step a2: Initialize the weights w and biases b of the ELM model. At this time, the size of w is [col0,n] and the size of b is [row0,n]. The content of w is a random number in the range, and b is initialized to an array of all 0s;

[0070] Step a3: According to the formula h=g(w·X train +b) obtain the nonlinear mapping of ELM, where g(x) is the activation function, which can be sigmoid, Gaussian, multiquadric and other activation functions. The output of the hidden layer is obtained by finding the inverse matrix H of h, and the size of H is [n, row0];

[0071] The multiquadric activation function is also a radial basis function, which is a real-valued function whose value depends only on the distance from the far point. The inverse quadratic function and the inverse multiquadric function can be selected as and This pre-training chooses the inverse multi-quadratic function.

[0072] Step a4: Perform one-hot encoding on the data labels in the dataset to obtain T, whose size is [row0,2]. Use H from step a3 to obtain β=H·T through the formula, and the size of β is [n,2].

[0073] Step a5: Input real-time traffic X test Calculate h1 = g(w·X test +b), and calculate with β to obtain the flow detection result result = h1·β.

[0074] Step a6: classify the obtained result into abnormal traffic and normal traffic by performing result = [item.tolist().index(max(item.tolist()))for item in result].

[0075] Step a7: Save the trained w, b, and H, which are the parameters required to deploy the ELM model.

[0076] S22: Deploy the deep forest model to the sink node through the management node in the wireless sensor.

[0077] Preferably, the deployed deep forest model pre-training process includes:

[0078] Step b1: Select deep forest classifiers, namely XGBoost classifier, random forest classifier and extreme random tree classifier. Set the maximum depth of XGBoost classifier to 5, the target to multi-classification, the learning rate to 0.1, and the random forest classifier and extreme random tree classifier to use default parameter settings.

[0079] Step b2: Use the processed BOT-IOT model to perform deep forest training and save the deep forest training results.

[0080] S23: The traffic data after dimensionality reduction is first subjected to ELM fast detection in the member node, and a data feature detection_result is added to the traffic data according to the detection result. If the detection result is normal traffic, detection_result is marked as a normal value '0' and passed. If abnormal traffic is detected, it is marked as abnormal '1'.

[0081] S24: After the data marked as abnormal traffic in the sink node is identified, the detection_result feature value is deleted first, and the deep forest model is used for secondary detection. The detection_result value is determined based on the result, and the data is aggregated and fused into the management node for processing.

[0082] S3: Deep forest model training module. The management node in the wireless sensor retrains the deep forest model on the updated data set based on evaluation indicators such as accuracy and AUC.

[0083] Preferably, the deep forest model training module specifically includes:

[0084] S31: Deploy the optimized deep forest algorithm in the user-oriented management node and configure the deep forest parameters.

[0085] S32: Pre-store the marked traffic data from each sink node into a temporary database, and set the upper limit of data storage to 10,000.

[0086] S33: When the pre-stored quantity reaches the set threshold, the detection_result feature is extracted as a label, mixed with the original data set, and split into a training set and a test set. The deep forest model is tuned according to evaluation indicators such as accuracy and AUC.

[0087] Preferably, the tuning algorithm used in this example is the K-fold cross validation method, such as Figure 5 As shown:

[0088] Step c1: Back up the original data set.

[0089] Step c2: The original data set is divided into a training set and a test set. The detection_result feature is taken out from the temporary database as the label set, and then it is merged with the training set in the original data set to form a new data set.

[0090] Step c3: The new data set is divided into k groups, one of which is selected as the validation set, and the remaining k-1 groups are used as training sets, where k is 10.

[0091] Step c4: Use a deep forest composed of a random forest classifier, an XGBoost classifier, an extreme random tree classifier, and a logistic regression classifier to construct a deep forest algorithm model;

[0092] Step c5: Find the model with the smallest error in each of the k-1 folds in the validation set. If the number of training times is less than k, return to step c3;

[0093] Step c6: Take the model with the smallest error in each fold in the validation set and put it into the test set to test the error, and calculate the average performance on the test set each time.

[0094] Step c7: The evaluation values ​​are selected as accuracy and AUC value, and the average value of the new model is compared with the performance of the original model. If the performance is improved, the deep forest model is updated and the data set is updated. Otherwise, the original deep forest model is continued to be used and the new data stored this time is deleted.

[0095] The evaluation indicators include:

[0096] Accuracy The model classifies the test set, and the number of samples classified correctly is n correct Total sample N total proportion.

[0097] Recall The ratio of all correctly classified positive samples TP to all positive samples (TP+FN), where the positive samples are positive data, i.e., the number of abnormal traffic, i.e., how much of all abnormal traffic has been detected.

[0098] The ratio of all correctly classified positive samples to all samples predicted as positive (TP+FP), that is, the proportion of selected traffic is abnormal traffic

[0099] Precision and recall are generally used at the same time, and F1 evaluates the two comprehensively.

[0100] AUC is the area under the ROC curve. The ROC curve describes the relationship between the true positive rate and the false positive rate. The higher the better.

[0101] Square root error y i is the true value, is the predicted value, n is the number of samples, and the Euclidean distance is used.

[0102] Mean square error

[0103] S34: The management node loads the tuned model into the sink node.

[0104] The present invention provides an abnormal traffic detection system and method for resource-constrained nodes such as wireless sensors, and performs hybrid detection based on ELM and deep forest model on pre-processed traffic characteristics. In the wireless sensor network, ELM and deep forest model are deployed respectively according to the division of labor of different nodes in the network, and multi-layer coordination greatly reduces the energy consumption of abnormal detection of each node, and also improves the accuracy of abnormal detection results.

[0105] The description and application of the present invention here are illustrative, and it is not intended to limit the scope of the present invention to the above-mentioned embodiments. The effects or advantages involved in the specification may not be reflected in the actual experimental examples due to the uncertainty of specific condition parameters or other factors, and the effects or advantages are not used to limit the scope of the invention. The deformation and change of the embodiments disclosed here are possible, and the replacement of the embodiments and the various equivalent parts are well known to those of ordinary skill in the art. It should be clear to those skilled in the art that the present invention can be implemented in other forms, structures, arrangements, proportions, and with other components, materials and parts without departing from the spirit or essential features of the present invention. Other deformations and changes can be made to the embodiments disclosed here without departing from the scope and spirit of the present invention.

Claims

1. A hybrid model abnormal traffic detection method based on ELM and deep forest, characterized in that: include: Step 1: Perform data cleaning, feature extraction and data dimension reduction on the real-time traffic data collected by the bottom member nodes in the resource-constrained nodes of the wireless sensor; Step 2: Deploy the extreme learning machine ELM model and the deep forest model at different nodes in the wireless sensor network to perform mixed abnormal traffic detection and output the abnormal traffic detection results; specifically including: Step 2-1: Deploy the ELM model to the member nodes through the management node in the wireless sensor; Step 2-2: Deploy the deep forest model to the sink node through the management node in the wireless sensor; Step 2-3: Perform ELM fast detection on the real-time traffic data after dimensionality reduction in the member node, and add data features to the traffic data according to the detection result. If the detection result is normal traffic, its data feature is marked as a normal value and passed; if the detection result is abnormal traffic, its data feature is marked as an abnormal value; Step 2-4: Delete the data feature mark of abnormal traffic in the aggregation node, and then use the deep forest model to perform secondary detection on the aforementioned abnormal traffic. According to the secondary detection result, add data features to the traffic data as its final feature value, and aggregate and fuse the data into the management node; Step 3: The management node in the wireless sensor retrains the deep forest model on the updated data set based on accuracy and AUC as evaluation indicators, where AUC is the area under the ROC curve.

2. The hybrid model abnormal traffic detection method based on ELM and deep forest according to claim 1 is characterized in that: Step 1 specifically includes: S1-1: Eliminate dirty data with non-numeric values ​​and infinite values ​​in real-time traffic data; S1-2: For the captured complete network information, refer to the BOT-IOT data set to select 30-dimensional data that has a greater impact on abnormal traffic detection, add 14-dimensional new features based on the 30-dimensional features, and calculate the total number of packets for each source / destination IP; S1-3: Normalize and standardize the processed data to form pre-processed traffic data with a total of 54 dimensional features.

3. The hybrid model abnormal traffic detection method based on ELM and deep forest according to claim 1 is characterized in that: The pre-training process of the ELM model deployed in step 2-1 includes: Step 2-1-1: Input training sample X train , the sample size is [row0,col0], the BOT-IOT data set preprocessed in step 1 is divided into a training set and a test set according to a ratio of 8:2, row0 is the number of training samples, col0 is the feature dimension of the training samples; the number of hidden layer units is n, n is a positive integer; Step 2-1-2: Initialize the weight w and bias b of the ELM model, where the value range of w is [col0,n] and the value range of b is [row0,n]; Step 2-1-3: According to the formula h = g (w x train +b) Calculate the nonlinear mapping of the ELM model, where g(x) is the activation function, h is the nonlinear mapping of the ELM model, and X train For training samples, the output of the hidden layer is obtained by finding the inverse matrix H of h, and the size of H is [n, row0]; Step 2-1-4: Perform one-hot encoding on the data labels in the data set and calculate β = H·T, where the data label indicates whether the data is abnormal traffic, T is the value of the label data after one-hot encoding, and β represents the output weight, which is [n, 2]; Step 2-1-5: Input real-time traffic data X test Calculate h1 = g(w·X test +b), h1 is the nonlinear mapping of the real-time flow data under test in the ELM model, and is used with β to calculate the flow detection result. The calculation formula is: result = h1·β; Step 2-1-6: Classify the traffic detection results to obtain abnormal traffic and normal traffic; Step 2-1-7: Save the trained weights w, bias b, and inverse matrix H as the parameters required to deploy the ELM model.

4. The hybrid model abnormal traffic detection method based on ELM and deep forest according to claim 1 is characterized in that: The pre-training process of the deep forest model deployed in step 2-2 includes: Step 2-2–1: Select deep forest classifiers, namely XGBoost classifier, random forest classifier and extreme random tree classifier. Set the maximum depth of XGBoost classifier to 5, the target to multi-classification, the learning rate to 0.1, and the random forest classifier and extreme random tree classifier to use the default parameter settings; Step 2-2-2: Use the processed BOT-IOT model to perform deep forest training and save the deep forest training results.

5. The hybrid model abnormal traffic detection method based on ELM and deep forest according to claim 1 is characterized in that: Step 3 specifically includes: Step 3-1: Deploy the optimized deep forest model in the user-oriented management node and configure the deep forest parameters; Step 3-2: Pre-store the marked traffic data from each aggregation node into a temporary database and set a data storage upper limit; Step 3-3: When the pre-stored quantity reaches the storage limit, extract the data features as labels, mix them with the original data set and divide them into training set and test set, and use accuracy and AUC as evaluation indicators to tune the deep forest model; Step 3-4: The management node loads the tuned model into the sink node.

6. The hybrid model abnormal traffic detection method based on ELM and deep forest according to claim 5 is characterized in that: The deep forest model tuning in step 3-3 uses the K-fold cross-validation method, which includes: Step 3-3-1: Back up the original data set; Step 3-3-2: The original data set is divided into a training set and a test set. The data features in the temporary database are taken out as a label set, and the label set is merged with the training set in the original data set to form a new data set. Step 3-3-3: Divide the new data set into k groups, select one of them as the validation set, and the remaining k-1 groups as the training set; Step 3-3-4: Use a deep forest composed of a random forest classifier, an XGBoost classifier, an extreme random tree classifier, and a logistic regression classifier to construct a deep forest algorithm model; Step 3-3-5: Find the model with the smallest error in the validation set for each of the k-1 folds. If the number of training times is less than k, return to step 3-3-3; Step 3-3-6: Take the model with the smallest error in each fold in the validation set and put it into the test set to test the error, and calculate the average performance on the test set each time; Step 3-3-7: The evaluation values ​​are selected as accuracy and AUC value, and the average value of the new model is compared with the performance of the original model. If the performance is improved, the deep forest model is updated and the data set is updated. Otherwise, the original deep forest model is continued to be used and the data stored this time is deleted.

7. A system based on the hybrid model abnormal traffic detection method based on ELM and deep forest according to any one of claims 1 to 6, characterized in that: include: The real-time traffic data feature extraction and dimension reduction module is used to perform data cleaning, feature extraction and data dimension reduction on the real-time traffic data collected by the bottom member nodes in the resource-limited nodes of the wireless sensor; The abnormal traffic detection module is used to deploy the ELM model and the deep forest model at different nodes in the wireless sensor network to perform mixed abnormal traffic detection and output the abnormal traffic detection results; The deep forest model training module is used for the management node in the wireless sensor to retrain the deep forest model on the updated data set based on the accuracy and AUC as evaluation indicators, where AUC is the area under the ROC curve.

Images