Iot intrusion detection model training method and device, equipment and storage medium

Abstract

The application discloses an Internet of Things intrusion detection model training method and device, equipment and a storage medium, wherein the method comprises the following steps: extracting an Internet source domain data feature vector, an Internet of Things source domain data feature vector and an Internet of Things target domain data feature vector from all labeled Internet source domain data and Internet of Things source domain data and part of labeled Internet of Things target domain data by using a feature extractor; predicting the Internet source domain data feature vector, the Internet of Things source domain data feature vector and the Internet of Things target domain data feature vector by using a classifier to obtain a target classification result; calculating a loss function value according to the target classification result and a preset target loss function, and optimizing the Internet of Things intrusion detection model according to the loss function value. The application can assist in training a large number of Internet of Things intrusion detection models with few labels by means of Internet intrusion data and a small amount of Internet of Things intrusion data, so that the prediction accuracy of the model is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things, and in particular to an Internet of Things intrusion detection model training method and device, equipment and a storage medium. BACKGROUND

[0002] With the rapid development of the information age, more and more Internet of Things devices are applied in people's production and life, such as intelligent temperature detectors, intelligent cameras, etc. These devices are recording the monitored data at all times. Some data, such as the data recorded by intelligent cameras, often contain user privacy information. Therefore, how to ensure the security and reliability of Internet of Things devices and timely detect possible illegal intrusion behavior has become a crucial and urgent problem to be solved. SUMMARY

[0003] In view of the above, the present application provides an Internet of Things intrusion detection model training method, device, equipment and storage medium to solve the problem of privacy leakage caused by the intrusion risk of existing Internet of Things devices.

[0004] To solve the above technical problems, one technical solution adopted by the present application is to provide an Internet of Things intrusion detection model training method applied to training an Internet of Things intrusion detection model, the Internet of Things intrusion detection model comprising a feature extractor and a classifier, the method comprising: extracting an Internet source domain data feature vector, an Internet of Things source domain data feature vector and an Internet of Things target domain data feature vector from all labeled Internet source domain data and Internet of Things source domain data and part of labeled Internet of Things target domain data by using the feature extractor; predicting the Internet source domain data feature vector, the Internet of Things source domain data feature vector and the Internet of Things target domain data feature vector by using the classifier to obtain a target classification result; calculating a loss function value according to the target classification result and a preset target loss function, and optimizing the Internet of Things intrusion detection model according to the loss function value, the target loss function comprising a first loss function when the classifier classifies, a second loss function of fusing source domain data and target domain data, a third loss function based on predicted probability label distribution knowledge information migration, and a fourth loss function of taking spatial graph matching to match source domain data graph and target domain data graph.

[0005] As a further improvement of the present application, the first loss function value of the first loss function is calculated, comprising: predicting the Internet source domain data feature vector, the Internet of Things source domain data feature vector and the labeled Internet of Things target domain data feature vector by using the classifier to obtain a first classification result; comparing the first classification result of each feature vector with its corresponding label, calculating a first cross-entropy loss value, and then taking the average of all first cross-entropy loss values to obtain the first loss function value.

[0006] As a further improvement of the present application, the Internet of Things intrusion detection model further comprises an adversarial network; the second loss function value of the second loss function is calculated, comprising: marking the Internet source domain data feature vector and the Internet of Things source domain data feature vector as a first preset category, and marking the Internet of Things target domain data feature vector as a second preset category; inputting the Internet source domain data feature vector, the Internet of Things source domain data feature vector, the Internet of Things target domain data feature vector and the respective marked preset categories into the adversarial network for prediction to obtain a second classification result; comparing the second classification result of each feature vector with the preset category corresponding to itself, calculating the second loss value, and then taking the average of all second loss values to obtain the second loss function value.

[0007] As a further improvement of the present application, the third loss function value of the third loss function is calculated, comprising: using the classifier to predict the Internet source domain data feature vector to obtain a first prediction probability distribution vector, and to predict the Internet of Things source domain data feature vector to obtain a second prediction probability distribution vector; calculating a first mean vector of each category according to the first prediction probability distribution vector and the second prediction probability distribution vector corresponding to the same category; using the classifier to predict the labeled Internet of Things target domain data feature vector to obtain a third prediction probability distribution; calculating a third cross-entropy loss value of each labeled Internet of Things target domain data according to the first mean vector corresponding to the category to which each labeled Internet of Things target domain data belongs and the third prediction probability distribution, and then taking the average of all third cross-entropy loss values to obtain the third loss function value.

[0008] As a further improvement of the present application, the fourth loss function value of the fourth loss function is calculated, comprising: predicting the unlabeled Internet of Things target domain data feature vectors by using the classifier to obtain the transition classification information of the unlabeled Internet of Things target domain data feature vectors; calculating the target mean feature vector of each class according to the Internet source domain data feature vectors, the Internet of Things source domain data feature vectors and the labeled Internet of Things target domain data feature vectors; calculating the cosine distance between each unlabeled Internet of Things target domain data feature vector and each target mean feature vector, and selecting the class corresponding to the target mean feature vector with the smallest cosine distance as the geometric classification information; for the unlabeled Internet of Things target domain data feature vectors with consistent information between the transition classification information and the geometric classification information, the consistent information is taken as the label of the unlabeled Internet of Things target domain data feature vectors; the data graphs are constructed for the Internet source domain data, the Internet of Things source domain data, the labeled Internet of Things target domain data and the unlabeled Internet of Things target domain data with consistent information respectively, the data graph comprises K nodes and edges connected between all nodes, each node corresponds to an intrusion mode; the first Euclidean distance between the nodes at both ends of each edge is calculated, and the first Euclidean distance is taken as the weight of the edge; the minimum spanning tree graph is constructed according to each data graph respectively, and then the minimum spanning tree graph is input into the pre-trained graph embedding network to obtain the graph embedding vector of each minimum spanning tree graph; the second Euclidean distance between all graph embedding vectors is calculated and summed to obtain the fourth loss function value.

[0009] As a further improvement of the present application, the target loss function is represented as:

[0010] L=L0-L1+L2+L3;

[0011] Wherein, L represents the target loss function, L0 represents the first loss function, L1 represents the second loss function, L2 represents the third loss function, and L3 represents the fourth loss function.

[0012] As a further improvement of the present application, the data amount of the Internet source domain data is more than the data amount of the Internet of Things source domain data, and the data amount of the labeled Internet of Things target domain data is less than the data amount of the unlabeled Internet of Things target domain data, and the Internet source domain data, the Internet of Things source domain data and the Internet of Things target domain data have different initial data feature spaces.

[0013] To solve the above technical problems, the present application adopts another technical solution: providing an Internet of Things intrusion detection model training device, comprising: a feature extraction module, configured to extract Internet source domain data feature vectors, Internet of Things source domain data feature vectors and Internet of Things target domain data feature vectors from all labeled Internet source domain data and Internet of Things source domain data and part of labeled Internet of Things target domain data; a classification prediction module, configured to predict the Internet source domain data feature vectors, the Internet of Things source domain data feature vectors and the Internet of Things target domain data feature vectors to obtain a target classification result; and an optimization module, configured to calculate a loss function value according to the target classification result and a preset target loss function, and optimize the Internet of Things intrusion detection model according to the loss function value, wherein the target loss function comprises a first loss function in the classification of a classifier, a second loss function of fusing source domain data and target domain data, a third loss function based on the migration of predicted probability label distribution knowledge information, and a fourth loss function of adopting spatial graph matching to match source domain data graphs and target domain data graphs.

[0014] To solve the above technical problems, the present application adopts another technical solution: providing a computer device, comprising a processor, a memory coupled to the processor, and program instructions stored in the memory, wherein the program instructions are executed by the processor to make the processor execute the steps of the Internet of Things intrusion detection model training method of any one of the above.

[0015] To solve the above technical problems, the present application adopts another technical solution: providing a storage medium storing program instructions capable of implementing the Internet of Things intrusion detection model training method or the Internet of Things intrusion detection model training method.

[0016] The present application has the following beneficial effects: the Internet of Things intrusion detection model training method of the present application uses labeled Internet intrusion data and Internet of Things intrusion data as source domain data, overcomes the strong heterogeneity between fields in the case of extremely scarce Internet of Things target domain data supervision information, thereby migrating key information to assist in training the Internet of Things intrusion detection model, and using the constructed target loss function, realizes migration based on label distribution knowledge information, so that the source domain and the target domain can be matched more finely, and the spatial graph matching method is also used to match the source domain data graph and the target domain data graph, so that the matching of the source domain and the target domain data is more fine in space, thereby making the Internet of Things intrusion detection model more accurate. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is a flowchart of the Internet of Things intrusion detection model training method of the embodiment of the present application;

[0018] Figure 2is a functional module schematic diagram of the Internet of Things intrusion detection model training device of the embodiment of the present application;

[0019] Figure 3 is a structural schematic diagram of the computer device of the embodiment of the present application;

[0020] Figure 4 is a structural schematic diagram of the storage medium of the embodiment of the present application. DETAILED DESCRIPTION

[0021] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of protection of the present application.

[0022] The terms "first", "second", "third" in the present application are only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features limited by "first", "second", "third" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "multiple" is at least two, such as two, three, etc., unless otherwise specifically limited. All directional indications (such as up, down, left, right, front, back, etc.) in the embodiments of the present application are only used to explain the relative positional relationship, movement condition, etc. between the components in a certain posture (as shown in the drawings), and if the certain posture changes, the directional indications also change accordingly. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally include steps or units not listed, or can optionally include other steps or units inherent to the process, method, product or device.

[0023] In this document, the term "embodiment" means that the specific features, structures or characteristics described in connection with the embodiment can be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily mean the same embodiment, nor is it independent or alternative to other embodiments. Those skilled in the art explicitly and implicitly understand that the embodiments described herein can be combined with other embodiments.

[0024] Figure 1 is a flowchart of the Internet of Things intrusion detection model training method of the embodiment of the present application. It should be noted that the method of the present application does not necessarily include Figure 1The flow sequence shown is limited. It should be noted that the Internet of Things intrusion detection model training method is used to train an Internet of Things intrusion detection model, which includes a feature extractor and a classifier, the feature extractor includes a two-layer fully connected neural network, and the classifier includes a one-layer fully connected neural network.

[0025] As shown in Figure 1 The Internet of Things intrusion detection model training method includes the following steps:

[0026] Step S101: Use the feature extractor to extract Internet source domain data feature vectors, Internet of Things source domain data feature vectors, and Internet of Things target domain data feature vectors from all labeled Internet source domain data and Internet of Things source domain data, and part of the labeled Internet of Things target domain data.

[0027] It should be noted that since the Internet of Things devices started relatively late, and the data collected by the Internet of Things devices has certain privacy, the existing data for Internet of Things intrusion detection is less and has certain quality problems, such as redundant records, missing values, etc. However, compared with the Internet of Things, the Internet started earlier, and it is relatively easy to capture Internet data information. If the Internet intrusion detection data can be used as an auxiliary, the intrusion detection knowledge information will be migrated to assist the intrusion detection of the Internet of Things, which will greatly improve the success rate of the intrusion detection of the Internet of Things. Therefore, in order to obtain good model training effect and make the prediction accuracy of the model higher, and overcome the challenge that the data amount of labeled Internet of Things target domain data is much less than that of unlabeled Internet of Things target domain data, and the Internet source domain data, Internet of Things source domain data and Internet of Things target domain data have different initial data feature spaces, the Internet intrusion data and a small amount of Internet of Things intrusion data (i.e. source domain) are used to assist the intrusion detection of a large amount of Internet of Things data (i.e. target task). Among them, the Internet source domain data and the Internet of Things source domain data are pre-acquired as sample data, and both have been pre-labeled, that is, each piece of data is marked as which type of attack or normal communication data, and the data amount of the Internet source domain data is much larger than that of the Internet of Things source domain data. The Internet of Things target domain data only has a small amount of labeled data and a large amount of unlabeled data much larger than the amount of labeled data.

[0028] It should be noted that there is strong heterogeneity between the Internet intrusion data and the Internet of Things intrusion data, and between the Internet of Things intrusion data and the Internet of Things intrusion data, which is reflected in the significant differences between the data domains, such as different features, different dimensions, different collection devices, different collection environments, different feature distributions, different class distributions, and the like. The main purpose of the present application is to assist in a large amount of Internet of Things intrusion detection with the aid of Internet intrusion data and a small amount of Internet of Things intrusion data in the presence of such great heterogeneity, and to ensure its accuracy.

[0029] Step S102: predicting the Internet source domain data feature vector, the Internet of Things source domain data feature vector, and the Internet of Things target domain data feature vector by using the classifier to obtain a target classification result.

[0030] Specifically, by inputting the Internet source domain data feature vector, the Internet of Things source domain data feature vector, and the Internet of Things target domain data feature vector into the classifier for prediction classification, the classification result corresponding to each Internet source domain data feature vector, Internet of Things source domain data feature vector, and Internet of Things target domain data feature vector is obtained, which includes a pre-set prediction category of the Internet of Things intrusion risk, and the probability distribution of the classification results of all data, i.e., a prediction probability distribution vector.

[0031] Step S103: calculating a loss function value according to the target classification result and a pre-set target loss function, and optimizing the Internet of Things intrusion detection model according to the loss function value, the target loss function including a first loss function when the classifier classifies, a second loss function of fusing the source domain data and the target domain data, a third loss function based on the knowledge information transfer of the prediction probability label distribution, and a fourth loss function of taking spatial graph matching to match the source domain data graph and the target domain data graph.

[0032] Specifically, after obtaining the classification result, the feature extractor and the classifier of the Internet of Things intrusion detection model are parameter-optimized using the classification result and a pre-constructed target loss function until a specified number of training times is reached or the accuracy of the Internet of Things intrusion model reaches a preset accuracy requirement. The target loss function includes a first loss function when the classifier classifies, a second loss function that fuses source domain data and target domain data, a third loss function that migrates based on predicted probability label distribution knowledge information, and a fourth loss function that adopts spatial graph matching to match source domain data graphs and target domain data graphs. The purpose of the second loss function is to reduce the difference between the source domain data and the target domain data, so that the classifier cannot identify whether the current data is source domain data or target domain data, and therefore the value of the second loss function should be as large as possible. The purpose of the third loss function is to migrate based on label distribution knowledge information for source domain data and target data with strong heterogeneity, so that the source domain data and the target domain data can be more finely matched. The purpose of the fourth loss function is to match the source domain data graph and the target domain data graph in a spatial graph matching manner, so that the matching of the source domain and the target domain data is more fine in space, so that the intrusion detection model becomes more accurate.

[0033] Further, the target loss function can be represented as:

[0034] L = L0-L1+L2+L3;

[0035] Wherein, L represents the target loss function, L0 represents the first loss function, L1 represents the second loss function, L2 represents the third loss function, and L3 represents the fourth loss function.

[0036] Further, in the embodiment, the step of calculating the first loss function value of the first loss function specifically includes:

[0037] 1.1, using the classifier to predict the Internet source domain data feature vector, the Internet of Things source domain data feature vector and the labeled Internet of Things target domain data feature vector, and obtaining the first classification result.

[0038] Specifically, the classifier is used to classify and predict all labeled Internet source domain data feature vectors, Internet of Things source domain data feature vectors and Internet of Things target domain data feature vectors, thereby obtaining the first classification result.

[0039] 1.2, compare the first classification result of each feature vector with the label corresponding to itself, calculate the first cross-entropy loss value, and then take the average of all first cross-entropy loss values to obtain the first loss function value.

[0040] Specifically, the first loss function can be represented as:

[0041]

[0042] wherein n N is the number of internet source domain data, n I is the number of internet of things source domain data, L ce represents cross-entropy loss, C() represents a classifier, f() represents a feature extractor, x i represents the i-th data in the source domain data, y i represents the label corresponding to the i-th data.

[0043] Further, in the embodiment, the internet of things intrusion detection model further comprises an adversarial network, which is used for adversarial learning to realize fusion of multi-source domain data. The adversarial network is a one-layer gradient reversal neural network, which can realize classification of the source domain data and the target domain data. The step of calculating the second loss function value of the second loss function specifically comprises:

[0044] 2.1, mark the internet source domain data feature vector and the internet of things source domain data feature vector as a first preset category, and mark the internet of things target domain data feature vector as a second preset category.

[0045] Specifically, in the embodiment, the first preset category and the second preset category are pre-set, the first preset category is used as the label of the source domain data, and the second preset category is used as the label of the target domain data.

[0046] 2.2, input the internet source domain data feature vector, the internet of things source domain data feature vector, the internet of things target domain data feature vector and the respective marked preset categories into the adversarial network for prediction to obtain a second classification result.

[0047] Specifically, the adversarial network is used to classify and predict the distribution of the internet source domain data feature vector, the internet of things source domain data feature vector and the internet of things target domain data feature vector marked with the preset category labels, to obtain a second classification result. The second classification result records whether each feature vector is the first preset category or the second preset category.

[0048] 2.3, compare the second classification result of each feature vector with the preset category corresponding thereto, calculate a second loss value, and then take an average of all the second loss values to obtain a second loss function value.

[0049] Specifically, the second classification result is compared with the preset category label corresponding to each feature vector, a second loss value is calculated, and then an average of all the second loss values is taken to obtain a second loss function value.

[0050] wherein the second loss function can be represented as:

[0051]

[0052] wherein, n L represents the number of labeled IoT target domain data, n U represents the number of unlabeled IoT target domain data, a i represents the feature vector of the ith source domain data, a i represents the feature vector of the jth target domain data, and D() represents the adversarial network.

[0053] It should be noted that the adversarial network in the embodiment is only used in the process of training the IoT intrusion detection model, for predicting whether the source domain data and the target domain data are the first preset category or the second preset category, and the purpose of the adversarial network is to make the classifier unable to identify whether the data currently being classified is the source domain data or the target domain data. Therefore, the greater the second loss function value is, the lower the identification accuracy of the adversarial network is, thereby reducing the difference between the source domain data and the target domain data, making the classifier unable to identify whether the feature vector currently being classified is the feature vector of the source domain data or the feature vector of the target domain data, promoting the fusion between the source domain data and the target domain data, and reducing the influence caused by the heterogeneity between the source domain data and the target domain data.

[0054] Further, in the embodiment, the specific steps of calculating the third loss function value of the third loss function include:

[0055] 3.1, predicting the Internet source domain data feature vector by using the classifier to obtain a first prediction probability distribution vector, and predicting the IoT source domain data feature vector to obtain a second prediction probability distribution vector.

[0056] 3.2, calculating a first mean vector of each category according to the first prediction probability distribution vector and the second prediction probability distribution vector corresponding to the same category.

[0057] Specifically, the category refers to a risk category that can be obtained after the feature vector is classified by the classifier, such as a DoS attack risk, a password attack risk, etc. After obtaining the first prediction probability distribution vector and the second prediction probability distribution vector, the first prediction probability distribution vector and the second prediction probability distribution vector are divided by category, and then the first prediction probability distribution vector and the second prediction probability distribution vector corresponding to each category are averaged to obtain a first mean vector of each category.

[0058] 3.3, predicting the labeled IoT target domain data feature vector by using the classifier to obtain a third prediction probability distribution.

[0059] 3.4, calculate a third cross-entropy loss value of each labeled IoT target domain data according to the first mean vector and the third predicted probability distribution corresponding to the category to which each labeled IoT target domain data belongs, and then take an average of all third cross-entropy loss values to obtain a third loss function value.

[0060] Specifically, the third loss function can be represented as:

[0061]

[0062] p i = softmax(C(f(a i )));

[0063]

[0064] wherein L2 is the second loss function, a is a weighting coefficient, b i is a label of the ith labeled IoT target domain data, is the first mean vector of the b i th category of the source domain, p i is the third predicted probability distribution of the ith labeled IoT target domain data, T is a temperature parameter used to control the smoothness of the distribution, and k indicates the kth category.

[0065] Further, in the embodiment, the specific steps of calculating the fourth loss function value of the fourth loss function include:

[0066] 4.1, using the classifier to predict the unlabeled IoT target domain data feature vector to obtain transition classification information of the unlabeled IoT target domain data feature vector.

[0067] Specifically, the transition classification information is a classification result obtained by the classifier in the classification prediction of the unlabeled IoT target domain data feature vector, and after obtaining the transition classification information, the transition classification information is taken as a transition label of the unlabeled IoT target domain data.

[0068] 4.2, calculate a target mean feature vector of each category according to the Internet source domain data feature vector, the IoT source domain data feature vector, and the labeled IoT target domain data feature vector.

[0069] Specifically, the Internet source domain data feature vector, the IoT source domain data feature vector, and the labeled IoT target domain data feature vector are divided by category, and then the mean of all feature vectors corresponding to each category is calculated, that is, the target mean feature vector of each category is obtained.

[0070] 4.3、Calculate the cosine distance between each unlabeled IoT target domain data feature vector and each target mean feature vector, and select the class corresponding to the target mean feature vector with the smallest cosine distance as the geometric classification information.

[0071] 4.4、For the unlabeled IoT target domain data feature vector whose transition classification information is consistent with the geometric classification information, take the consistent information as the label of the unlabeled IoT target domain data feature vector.

[0072] Specifically, the transition classification information of the unlabeled IoT target domain data feature vector is compared with its corresponding geometric classification information to confirm whether they are consistent; if consistent, the unlabeled IoT target domain data feature vector is retained; if inconsistent, the unlabeled IoT target domain data feature vector is discarded.

[0073] 4.5、Respectively construct data graphs for the Internet source domain data, the IoT source domain data, the labeled IoT target domain data, and the unlabeled IoT target domain data with consistent information, and the data graph includes K nodes and edges connecting each pair of nodes, and each node corresponds to an intrusion mode.

[0074] 4.6、Calculate the first Euclidean distance between the nodes at both ends of each edge, and take the first Euclidean distance as the weight of the edge.

[0075] 4.7、Respectively construct a minimum spanning tree graph according to each data graph, and then input the minimum spanning tree graph into a pre-trained graph embedding network to obtain a graph embedding vector of each minimum spanning tree graph.

[0076] 4.8、Calculate the second Euclidean distance between each pair of graph embedding vectors and sum them up to obtain a fourth loss function value.

[0077] Specifically, after obtaining the unlabeled IoT target domain data feature vector consistent with the transition classification information and the geometric classification information, four data graphs are constructed, which are the Internet source domain data graph, the IoT source domain data graph, the labeled IoT target domain data graph, and the unlabeled IoT target domain data graph based on the consistent information. In each data graph, it has K nodes corresponding to K intrusion modes, and each node is the mean vector of the data belonging to the kth category in the corresponding data. Each data graph is a complete graph, that is, all nodes are connected to each other, and the weight of each edge is the Euclidean distance between the two nodes of the edge. Then, for each data graph, construct its minimum spanning tree, and the algorithms that can be used include but are not limited to Prim algorithm. Then, input the four minimum spanning tree graphs obtained into the pre-trained graph embedding network to obtain the graph embedding vector of each minimum spanning tree graph, and the graph embedding network includes but is not limited to graph neural network, etc., which can be used after pre-training on social media relationship graph and other data sets. Then, calculate the Euclidean distance between the graph embedding vectors of the four minimum spanning tree graphs obtained, and sum them up as the fourth loss function value. By matching the data graphs, more refined intrusion class matching can be achieved while preserving the relationship between the intrusion classes in the geometric space, thereby achieving more refined and more accurate IoT intrusion detection.

[0078] Further, after training the IoT intrusion detection model and using the IoT intrusion detection model for intrusion detection, specifically including:

[0079] Obtaining IoT detection data to be detected;

[0080] Inputting the IoT intrusion detection data into the IoT intrusion detection model, and extracting the feature vector from the IoT detection data by the feature extractor;

[0081] Inputting the feature vector into the classifier of the IoT intrusion detection model for classification prediction to obtain the target prediction category with the highest probability;

[0082] Outputting the target prediction category.

[0083] The Internet of Things intrusion detection model training method of the embodiment of the present application overcomes the strong heterogeneity between fields by taking the labeled Internet intrusion data and the Internet of Things intrusion data as the source domain data in the case that the target domain data supervision information of the Internet of Things is extremely scarce, thereby migrating the key information, assisting in training the Internet of Things intrusion detection model, and using the constructed target loss function to realize the migration based on the label distribution knowledge information, so that the source domain and the target domain can be matched more finely, and the source domain data graph and the target domain data graph are matched in the space graph matching mode, so that the matching of the source domain and the target domain data is more fine in the space, thereby making the Internet of Things intrusion detection model more accurate.

[0084] Figure 2 is a functional module schematic diagram of the Internet of Things intrusion detection model training device of the embodiment of the present application. As shown in the figure, Figure 2 the Internet of Things intrusion detection model training device 20 comprises

[0085] a feature extraction module 21, configured to extract the Internet source domain data feature vector, the Internet of Things source domain data feature vector and the Internet of Things target domain data feature vector from the pre-acquired all-labeled Internet source domain data and Internet of Things source domain data and part-labeled Internet of Things target domain data;

[0086] a classification prediction module 22, configured to predict the Internet source domain data feature vector, the Internet of Things source domain data feature vector and the Internet of Things target domain data feature vector to obtain a target classification result;

[0087] an optimization module 23, configured to calculate a loss function value according to the target classification result and a preset target loss function, and optimize the Internet of Things intrusion detection model according to the loss function value, wherein the target loss function comprises a first loss function in the classification of a classifier, a second loss function of fusing the source domain data and the target domain data, a third loss function based on the migration of the predicted probability label distribution knowledge information, and a fourth loss function of taking the space graph matching to match the source domain data graph and the target domain data graph.

[0088] Optionally, the operation of the optimization module 23 for calculating the first loss function value of the first loss function specifically comprises: predicting the Internet source domain data feature vector, the Internet of Things source domain data feature vector and the labeled Internet of Things target domain data feature vector by using the classifier to obtain a first classification result; comparing the first classification result of each feature vector with the label corresponding to itself, calculating a first cross-entropy loss value, and then taking the average value of all the first cross-entropy loss values to obtain the first loss function value.

[0089] Optionally, the Internet of Things intrusion detection model further comprises an adversarial network; the second loss function value of the optimization module 23 calculating the second loss function value specifically comprises: marking the Internet source domain data feature vector and the Internet of Things source domain data feature vector as a first preset category, and marking the Internet of Things target domain data feature vector as a second preset category; inputting the Internet source domain data feature vector, the Internet of Things source domain data feature vector, the Internet of Things target domain data feature vector and the respective marked preset categories into the adversarial network for prediction to obtain a second classification result; comparing the second classification result of each feature vector with the preset category corresponding to itself, calculating the second loss value, and then taking the average of all second loss values to obtain the second loss function value.

[0090] Optionally, the operation of the optimization module 23 calculating the third loss function value of the third loss function specifically comprises: predicting the Internet source domain data feature vector by using the classifier to obtain a first prediction probability distribution vector, and predicting the Internet of Things source domain data feature vector to obtain a second prediction probability distribution vector; calculating a first mean vector of each category according to the first prediction probability distribution vector and the second prediction probability distribution vector corresponding to the same category; predicting the labeled Internet of Things target domain data feature vector by using the classifier to obtain a third prediction probability distribution; calculating a third cross-entropy loss value of each labeled Internet of Things target domain data according to the first mean vector corresponding to the category to which each labeled Internet of Things target domain data belongs and the third prediction probability distribution, and then taking the average of all third cross-entropy loss values to obtain the third loss function value.

[0091] Optionally, the operation of the optimization module 23 calculating the fourth loss function value of the fourth loss function specifically comprises: predicting the unlabeled Internet of Things target domain data feature vectors by using the classifier to obtain transition classification information of the unlabeled Internet of Things target domain data feature vectors; calculating target mean feature vectors of each class according to the Internet source domain data feature vectors, the Internet of Things source domain data feature vectors and the labeled Internet of Things target domain data feature vectors; calculating the cosine distance between each unlabeled Internet of Things target domain data feature vector and each target mean feature vector, and selecting the class corresponding to the target mean feature vector with the smallest cosine distance as the geometric classification information; for the unlabeled Internet of Things target domain data feature vectors with consistent information between the transition classification information and the geometric classification information, taking the consistent information as the label of the unlabeled Internet of Things target domain data feature vectors; constructing data graphs for the Internet source domain data, the Internet of Things source domain data, the labeled Internet of Things target domain data and the unlabeled Internet of Things target domain data with consistent information, wherein the data graph comprises K nodes and edges connecting two nodes, each node corresponds to an intrusion mode; calculating the first Euclidean distance between the nodes at both ends of each edge, and taking the first Euclidean distance as the weight of the edge; constructing a minimum spanning tree graph according to each data graph, and then inputting the minimum spanning tree graph into the pre-trained graph embedding network to obtain the graph embedding vector of each minimum spanning tree graph; calculating the second Euclidean distance between all graph embedding vectors and summing them up to obtain the fourth loss function value.

[0092] Optionally, the target loss function is represented as:

[0093] L = L0-L1+L2+L3;

[0094] Wherein, L represents the target loss function, L0 represents the first loss function, L1 represents the second loss function, L2 represents the third loss function, and L3 represents the fourth loss function.

[0095] Optionally, the data amount of the Internet source domain data is more than the data amount of the Internet of Things source domain data, and the data amount of the labeled Internet of Things target domain data is less than the data amount of the unlabeled Internet of Things target domain data, and the Internet source domain data, the Internet of Things source domain data and the Internet of Things target domain data have different initial data feature spaces.

[0096] For other details of the implementation of the technical solutions of each module in the above-mentioned embodiment of the Internet of Things intrusion detection model training device, please refer to the description in the above-mentioned embodiment of the Internet of Things intrusion detection model training method, which will not be repeated here.

[0097] It should be noted that the various embodiments of the present specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between embodiments can be mutually referred to. For device embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts refer to the part of the method embodiment.

[0098] Please refer to Figure 3 , Figure 3 The figure is a structural schematic diagram of the computer device of the embodiment of the present application. As shown in the figure, the computer device 30 comprises a processor 31 and a memory 32 coupled with the processor 31. The memory 32 stores program instructions. When the program instructions are executed by the processor 31, the processor 31 executes the steps of the Internet of Things intrusion detection model training method described in any of the above embodiments. Figure 3

[0099] The processor 31 can also be referred to as a CPU (Central Processing Unit). The processor 31 can be an integrated circuit chip with signal processing capability. The processor 31 can also be a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application-Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0100] Please refer to Figure 4 , Figure 4 The figure is a structural schematic diagram of the storage medium of the embodiment of the present application. The storage medium of the embodiment of the present application stores program instructions 41 capable of implementing the above-mentioned Internet of Things intrusion detection model training method. The program instructions 41 can be stored in the above-mentioned storage medium in the form of a software product, including a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor execute all or part of the steps of the method described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a ROM (Read-Only Memory), a RAM (Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes, or a computer, a server, a mobile phone, a tablet computer, etc.

[0101] ​In several embodiments provided in the present application, it should be understood that the disclosed computer device, apparatus and method can be implemented in other manners. For example, the embodiments of the apparatus described above are merely schematic; for example, the division of the units is only a logical function division; there can be another division manner for the actual implementation; for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections between the units can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0102] In addition, each function unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can exist physically independently, or two or more units can be integrated into one unit. The integrated unit can be implemented in the form of hardware or software function unit. The above is merely an implementation manner of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent flow transformation using the content of the present application specification and drawings, or direct or indirect application in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A method for training an Internet of Things (IoT) intrusion detection model, characterized in that, It is applied to training an IoT intrusion detection model, which includes a feature extractor and a classifier, and the method includes: The feature extractor is used to extract Internet source domain data feature vectors, IoT source domain data feature vectors, and IoT target domain data feature vectors from all the pre-acquired tagged Internet source domain data and IoT source domain data, as well as some tagged IoT target domain data. The classifier is used to predict the feature vectors of the Internet source domain data, the Internet of Things source domain data, and the Internet of Things target domain data to obtain the target classification result. The loss function value is calculated based on the target classification result and the preset target loss function, and the IoT intrusion detection model is optimized based on the loss function value. The target loss function includes a first loss function when classifying by the classifier, a second loss function that fuses source domain data and target domain data, a third loss function based on knowledge information transfer of predicted probability label distribution, and a fourth loss function that uses spatial graph matching to match source domain data graph and target domain data graph. Calculating the value of the fourth loss function includes: The classifier is used to predict the feature vector of unlabeled IoT target domain data to obtain transitional classification information of the feature vector of unlabeled IoT target domain data. The target mean feature vector for each category is calculated based on the Internet source domain data feature vector, the Internet of Things source domain data feature vector, and the labeled Internet of Things target domain data feature vector. Calculate the cosine distance between each unlabeled IoT target domain data feature vector and each target mean feature vector, and select the category corresponding to the target mean feature vector with the smallest cosine distance as the geometric classification information; For unlabeled IoT target domain data feature vectors that are consistent with the transition classification information and the geometric classification information, the consistent information shall be used as the label of the unlabeled IoT target domain data feature vector. A data graph is constructed for the Internet source domain data, the Internet of Things source domain data, the tagged Internet of Things target domain data, and the untagged Internet of Things target domain data with consistent information. The data graph includes K nodes and edges connecting all nodes to each other. Each node corresponds to an intrusion method. Calculate the first Euclidean distance between the two endpoints of each edge, and use the first Euclidean distance as the weight of the edge; A minimum spanning tree graph is constructed for each data graph, and then the minimum spanning tree graph is input into a pre-trained graph embedding network to obtain the graph embedding vector of each minimum spanning tree graph. The second Euclidean distance between each pair of all the graph embedding vectors is calculated and summed to obtain the fourth loss function value.

2. The IoT intrusion detection model training method according to claim 1, characterized in that, Calculating the value of the first loss function of the first loss function includes: The classifier is used to predict the feature vectors of the Internet source domain data, the Internet of Things source domain data, and the labeled Internet of Things target domain data to obtain a first classification result. The first classification result of each feature vector is compared with its corresponding label, and the first cross-entropy loss value is calculated. Then, the average value of all the first cross-entropy loss values ​​is taken to obtain the first loss function value.

3. The IoT intrusion detection model training method according to claim 1, characterized in that, The IoT intrusion detection model also includes adversarial networks; Calculating the value of the second loss function includes: The Internet source domain data feature vector and the Internet of Things source domain data feature vector are labeled as a first preset category, and the Internet of Things target domain data feature vector is labeled as a second preset category; The feature vectors of the Internet source domain data, the feature vectors of the Internet of Things source domain data, the feature vectors of the Internet of Things target domain data, and their respective preset categories are input into the adversarial network for prediction to obtain a second classification result. The second classification result of each feature vector is compared with its corresponding preset category, and the second loss value is calculated. Then, the average of all the second loss values ​​is taken to obtain the second loss function value.

4. The IoT intrusion detection model training method according to claim 1, characterized in that, Calculating the value of the third loss function includes: The classifier is used to predict the feature vector of the Internet source domain data to obtain a first predicted probability distribution vector, and the feature vector of the Internet of Things source domain data is predicted to obtain a second predicted probability distribution vector. The first mean vector of each category is calculated based on the first and second predicted probability distribution vectors corresponding to the same category. The classifier is used to predict the feature vector of labeled IoT target domain data to obtain a third prediction probability distribution; The third cross-entropy loss value of each labeled IoT target domain data is calculated based on the first mean vector and the third predicted probability distribution corresponding to the category to which each labeled IoT target domain data belongs. Then, the average value of all the third cross-entropy loss values ​​is taken to obtain the third loss function value.

5. The IoT intrusion detection model training method according to claim 1, characterized in that, The target loss function is expressed as: L = L0 - L1 + L2 + L3; Where L represents the target loss function, L0 represents the first loss function, L1 represents the second loss function, L2 represents the third loss function, and L3 represents the fourth loss function.

6. The method for training an IoT intrusion detection model according to claim 1, characterized in that, The amount of data in the Internet source domain data is greater than the amount of data in the IoT source domain data, and the amount of data in the tagged IoT target domain data is less than the amount of data in the untagged IoT target domain data. Furthermore, the Internet source domain data, the IoT source domain data, and the IoT target domain data have different initial data feature spaces.

7. An IoT intrusion detection model training device utilizing the IoT intrusion detection model training method of claim 1, characterized in that, include: The feature extraction module is used to extract feature vectors of Internet source domain data, Internet source domain data, and Internet target domain data from all the pre-acquired tagged Internet source domain data and Internet of Things source domain data, as well as some tagged Internet target domain data. The classification prediction module is used to predict the feature vectors of the Internet source domain data, the Internet of Things source domain data, and the Internet of Things target domain data to obtain the target classification result. The optimization module is used to calculate the loss function value based on the target classification result and the preset target loss function, and optimize the IoT intrusion detection model based on the loss function value. The target loss function includes a first loss function when classifying by the classifier, a second loss function that fuses source domain data and target domain data, a third loss function based on knowledge information transfer of predicted probability label distribution, and a fourth loss function that uses spatial graph matching to match source domain data graph and target domain data graph.

8. A computer device, characterized in that, The computer device includes a processor and a memory coupled to the processor, the memory storing program instructions that, when executed by the processor, cause the processor to perform the steps of the IoT intrusion detection model training method as described in any one of claims 1-6.

9. A storage medium, characterized in that, The system stores program instructions capable of implementing the IoT intrusion detection model training method as described in any one of claims 1-6.

Images