An IoT malicious traffic detection device to combat concept drift
By designing a multi-module IoT malicious traffic detection device, using feature extraction and clustering technology to detect and adapt to concept drift in the Internet of Things system, the problem of poor robustness of malicious traffic detection in the Internet of Things system is solved, and more efficient and accurate detection results are achieved.
Patent Information
- Application Number
- CN202310148030.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-02-22
- Publication Date
- 2025-04-15
- Estimated Expiration
- 2043-02-22
Smart Images
Figure CN116170212B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of malicious traffic detection, and provides an IoT malicious traffic detection device for combating concept drift. Background Art
[0002] In recent years, with the rapid growth of the use of the Internet and mobile devices, the Internet of Things (IoT) has also begun to build and develop rapidly. Although the Internet of Everything brings great convenience to people, the low-security IoT devices also bring great security risks. IoT terminal devices usually use radio frequency identification (RFID) technology, sensor networks, etc., collect data from the external physical world through cameras, sensors and other devices, and then use short-range limited and wireless transmission technologies such as Bluetooth and infrared to transmit data. These devices have low system complexity, few computing resources, and relatively weak security protection measures. Therefore, the IoT has a worse ability to resist network attacks, often becoming a gap in Internet security protection, and greatly threatening the privacy and security of users.
[0003] Currently, the use of machine learning or deep learning to analyze network traffic is already a mainstream method. However, there are still many challenges in using ML models in IoT systems. Time and resource constraints are the main problems in IoT data analysis due to the low power and low cost requirements of IoT devices. On the other hand, IoT data is usually dynamic and non-stationary streaming data due to the ever-changing nature of IoT systems and applications. In real-world IoT systems, the physical events monitored by IoT sensors may change over time, and unpredictable abnormal events may occasionally occur. In addition, IoT device components will age and need to be updated or replaced regularly. These factors may lead to inevitable changes in the statistical distribution of IoT data streams, which is called concept drift. The occurrence of concept drift may cause IoT system failure or performance degradation.
[0004] In order to reduce the impact of drift data on model training, researchers have proposed some methods.
[0005] In the paper "KNN Classifier with Self Adjusting Memory for Heterogeneous Concept Drift", a self-adjusting memory with k nearest neighbors (SAM-KNN) algorithm is proposed, which uses KNN to train learners and uses a dual memory method to store new and old useful data to adapt to current and previous concepts. The paper "Extremely Fast Decision Tree" proposes an incremental learning method called Hoeffding Anytime Tree (HATT), which selects and splits nodes immediately when the confidence level is reached, instead of determining the best split in the Hoeffding tree. This strategy makes HATT more efficient and accurate in adapting to concept drift. However, they usually take a long time to execute. Summary of the invention
[0006] In view of the above-mentioned prior art problems, the purpose of the present invention is to provide an IoT malicious traffic detection device that resists concept drift, and the main purpose is to solve the problem of poor robustness of the malicious traffic detection system when processing online dynamic IoT drift traffic data. The main scheme includes a traffic data processing module, an initial model training module, a concept drift detection module and a concept drift adaptation module. First, the Pcap package of the historical traffic data is extracted into a feature vector by the traffic data processing module, and feature screening, unique hot encoding and normalization are performed on it; after the processed feature vector is compressed by the autoencoder, clustering is performed by contrastive learning, and then the representative subset of each cluster is selected to obtain the initial detection model; after feature extraction and feature processing of the online data, the obtained feature vector is also compressed by the autoencoder and sent to the initial model for detection. If a drift warning is issued, the feature vector is collected in the adaptive window, otherwise, the traffic data classification is successful, and then the next data is processed; when the adaptive window starts to collect data, if the drift data does not exceed half of the adaptive window within an adaptive window time, the feature item vector of the adaptive window is cleared. Otherwise, the detection model is updated by the feature vector collected in the adaptive window.
[0007] In order to achieve the above object, the present invention adopts the following technical solution:
[0008] An IoT malicious traffic detection device for combating concept drift includes the following devices:
[0009] Traffic data processing module: First, the Pcap package of historical traffic data is extracted through the CICflowmeter tool to obtain the preliminary feature vector A of the traffic data; then the features of feature vector A are filtered, uniquely encoded and normalized to obtain feature vector B;
[0010] Initial model training module: Through contrastive learning and combined with autoencoder, two samples of the same type in feature vector B are taken as positive sample pairs, and two samples of different types are taken as negative sample pairs. These sample pairs are compressed into low-dimensional space through autoencoder, and contrastive loss function is constructed to make the Euclidean distance of positive sample pairs as small as possible and the Euclidean distance of negative sample pairs as large as possible. Then clustering can obtain several compact clusters, and then select representative subsets of each cluster to obtain the initial detection model.
[0011] Concept drift detection module: The Pcap package of the captured online traffic data is used to obtain the feature vector C through the traffic data processing module; the feature vector C is compressed by the automatic encoder in the initial model training module and input into the initial detection model, and the distance D from the feature vector C to the nearest cluster centroid is calculated. If the absolute value of the difference between the distance D and the median of the point in the cluster to the cluster centroid is greater than the set threshold, the traffic data is considered to have drifted, a drift warning is issued, and the vector data is collected in the adaptive window. Otherwise, it is considered that no drift has occurred and the traffic data is successfully classified.
[0012] Concept drift adaptation module: As the concept drift detection module continuously processes online traffic data, the feature vector data in the adaptive window will continue to increase. When the drift data does not exceed half of the adaptive window within a continuous adaptive window size time, the feature item vector data of the adaptive window is cleared. Otherwise, the detection model is retrained and updated by re-training the feature vectors and representative subsets collected in the adaptive window.
[0013] In the above technical solution, the specific implementation steps of the flow data processing module are as follows:
[0014] The CICflowmeter tool is used to extract features from the Pcap package of the flow data to obtain the preliminary feature vector A of the flow data, and the commonly used port numbers and protocol numbers of the feature vector A are counted. In order to further facilitate the training of the model, the feature vector A is further processed after it is read. First, the useless Flow ID and the unused features in the feature vector are removed by feature screening to reduce the dimension, and then the discrete feature values are converted into continuous 0, 1 one-hot vectors by one-hot encoding, and the commonly used port numbers and protocol numbers are used as new features of the feature vector, and those uncommon ports are classified into one type of features, and the uncommon protocol numbers are classified into another type of features. The values of these newly added features are all 0 or 1, 1 means that the sample contains the feature, and 0 means that the feature is not included. After that, the continuous feature values are processed by normalization, and they are all mapped to the range of 0 to 1 to avoid the influence of different levels of values between feature values on the model. After the feature vector A is processed by the above feature screening, one-hot encoding and normalization, the feature vector B is obtained.
[0015] In the above technical solution, the specific implementation steps of the initial model training module are as follows:
[0016] First, the feature vector B is compressed into a low-dimensional space through an automatic encoder; then two samples of the same type in the compressed feature vector B are taken as positive sample pairs, and two samples of different types are taken as negative sample pairs. The Euclidean distance of the positive sample pairs is taken as the numerator of the loss function, and the Euclidean distance of the negative sample pairs is taken as the denominator of the loss function. The distance between positive samples is shortened by minimizing the loss function, while the distance between negative samples is pushed away. Then clustering can obtain the initial detection model of several tight clusters; then the centroid c of each cluster is calculated i , from each sample point in the cluster to the centroid c i The median of the distances d i and median absolute difference MAD i , i takes the value from 0 to the number of clusters, and selects each cluster that contains i +MAD i The points of the circle with a radius of are taken as representative subsets, and the representative subsets are retained. The adaptive window size is defined as W according to the number of representative subsets of each type of cluster.
[0017] In the above technical solution, the specific implementation steps of the concept drift detection module are as follows:
[0018] The Pcap package of the captured online traffic data is passed through the traffic data processing module to obtain the feature vector C; the feature vector C is compressed by the automatic encoder in the initial model training module, and its distance to the nearest centroid c is calculated. i The distance D, when |Dd i | and MAD i When the ratio is greater than a certain threshold α, the eigenvector C is drift data, a drift warning is issued and the data is collected into the adaptive window. Otherwise, it is considered that no drift has occurred, and the traffic data is successfully classified, and then the next Pcap packet of traffic data is processed.
[0019] In the above technical solution, the specific implementation steps of the concept drift adaptation module are as follows:
[0020] When the adaptive window receives the first feature vector data, the timing starts. If the number of feature vectors in the adaptive window does not exceed half of W within a continuous adaptive window size time, the data in the adaptive window is cleared. Otherwise, the detection model is retrained and updated by collecting feature vectors in the adaptive window and retaining representative subsets.
[0021] The present invention provides an IoT malicious traffic detection method for counteracting concept drift, which is divided into four parts: traffic data processing module, initial model training module, concept drift detection module and concept drift adaptation module. The method mainly includes the following steps:
[0022] S1: Extract features from the Pcap package of the flow data using the CICflowmeter tool to obtain a preliminary feature vector A of the flow data; filter, unique-hot encode and normalize the features of feature vector A to obtain feature vector B;
[0023] S2: Compress the feature vector B obtained by the autoencoder, and then use the idea of contrastive learning to construct positive sample pairs of the same type and negative sample pairs of different types, then cluster and select representative subsets to obtain the initial detection model;
[0024] S3: The Pcap package of the captured online traffic data is used to obtain the feature vector C through the traffic data processing module; the feature vector C is compressed by the automatic encoder in the initial model training module and then input into the initial detection model. If the traffic data drifts, it is collected in the adaptive window; otherwise, the traffic data is successfully classified and the next traffic data is processed;
[0025] S4: When the adaptive window receives the first feature vector data, the timing starts. If the number of feature vectors in the adaptive window does not exceed half of W within a continuous adaptive window size time, the data in the adaptive window is cleared. Otherwise, the detection model is updated by the feature vectors collected in the adaptive window.
[0026] Compared with the prior art, the present invention has the following beneficial effects:
[0027] 1. This invention uses a clustering method based on comparative learning to make the clustering of similar data more compact and the difference between different types of data greater, and detects drift data based on distance, so that the model can detect drift data more timely and accurately.
[0028] Second, the invention separates offline training from online testing, and can put offline training on the server, reducing the cost of IoT devices;
[0029] 3. The present invention selects a representative subset after clustering and combines it with an adaptive window to greatly reduce the update overhead of the detection model. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] Figure 1 It is the overall architecture diagram of the present invention. DETAILED DESCRIPTION
[0031] The present invention will be further described below in conjunction with the accompanying drawings and specific implementation methods.
[0032] An IoT malicious traffic detection device for combating concept drift, characterized by comprising the following components:
[0033] Traffic data processing module: First, the Pcap package of historical traffic data is extracted through the CICflowmeter tool to obtain the preliminary feature vector A of the traffic data; then the features of feature vector A are screened, one-hot encoded and normalized to obtain feature vector B.
[0034] Initial model training module: Through contrastive learning method and combined with autoencoder, two samples of the same type in feature vector B are taken as positive sample pairs, and two samples of different types are taken as negative sample pairs. These sample pairs are compressed into low-dimensional space through autoencoder, and contrastive loss function is constructed to make the Euclidean distance of positive sample pairs as small as possible and the Euclidean distance of negative sample pairs as large as possible. Then clustering can obtain several compact clusters, and then select representative subsets of each cluster to obtain the initial detection model.
[0035] Concept drift detection module: The Pcap package of the captured online traffic data is used to obtain the feature vector C through the traffic data processing module; the feature vector C is compressed by the automatic encoder in the initial model training module and input into the initial detection model, and the distance D from the feature vector C to the nearest cluster centroid is calculated. If the absolute value of the difference between the D value and the median of the point in the cluster to the centroid is greater than the set threshold, the traffic data may drift, a drift warning is issued, and the vector data is collected in the adaptive window. Otherwise, it is considered that no drift has occurred, and the traffic data is successfully classified.
[0036] Concept drift adaptation module: As the concept drift detection module continuously processes online traffic data, the feature vector data in the adaptive window will continue to increase. If the drift data does not exceed half of the adaptive window within a continuous adaptive window size time, the feature item vector of the adaptive window is cleared. Otherwise, the detection model is updated by the feature vectors collected in the adaptive window.
[0037] In the above technical solution, the specific implementation steps of the flow data processing module are as follows:
[0038] The CICflowmeter tool is used to extract features from the Pcap package of the flow data to obtain the preliminary feature vector A of the flow data, and the commonly used port numbers and protocol numbers of the feature vector A are counted. In order to further facilitate the training of the model, the feature vector A is further processed after it is read. First, the features that have little effect on classification in the feature vector are removed through feature screening to reduce the dimension, such as: Flow ID, etc. Then, the problem of discrete eigenvalues is solved by one-hot encoding, and in order to prevent the data dimension from exploding during one-hot encoding due to the large number of different eigenvalues of port and protocol features. The commonly used port numbers and protocol numbers are used as new features of the feature vector, and those uncommon port and protocol numbers are classified into two other categories of features. Their values are all 0 or 1, 1 means that the sample contains the feature, and 0 means that the feature is not contained. After that, the continuous eigenvalues are processed by normalization, and they are all mapped to the range of 0 to 1 to avoid the impact of different levels of values between eigenvalues on the model. Finally, the processed feature vector B is obtained.
[0039] In the above technical solution, the specific implementation steps of the initial model training module are as follows:
[0040] First, the feature vector B is compressed into a low-dimensional space through an automatic encoder; then two samples of the same type in the compressed feature vector B are taken as positive sample pairs, and two samples of different types are taken as negative sample pairs. The Euclidean distance of the positive sample pair is taken as the numerator of the loss function, and the Euclidean distance of the negative sample pair is taken as the denominator of the loss function. The distance between positive samples is shortened by minimizing the loss function, while the distance between negative samples is pushed away. Then clustering can obtain the initial detection model of several tight clusters; then the centroid c of each cluster is calculated. i , from the point in the cluster to c i The median of the distances d i and median absolute difference MAD i (i ranges from 0 to the number of clusters). Next, select the clusters that are contained in the cluster centered at the centroid. i +MAD i The points of the circle with a radius of are taken as representative subsets. In addition, the adaptive window size is reasonably defined as W according to the number of representative subsets of each cluster.
[0041] In the above technical solution, the specific implementation steps of the concept drift detection module are as follows:
[0042] The Pcap package of the captured online traffic data is passed through the traffic data processing module to obtain the feature vector C; the feature vector C is compressed by the automatic encoder in the initial model training module, and its c to the tightest center of mass is calculated. i Distance D, when |Dd i | and MAD iWhen the ratio of is greater than a certain threshold α (α value is set according to experience), the eigenvector C is drift data, and a drift warning is issued and the data is collected into the adaptive window. Otherwise, it is considered that no drift has occurred, and the traffic data is successfully classified. Then the next Pcap packet of traffic data is processed.
[0043] In the above technical solution, the specific implementation steps of the concept drift adaptation module are as follows:
[0044] When the adaptive window receives the first feature vector data, the timing starts. If the number of feature vectors in the adaptive window does not exceed half of W within a continuous adaptive window size time, the data in the adaptive window is cleared. Otherwise, the detection model is fine-tuned by the feature vectors collected in the adaptive window.
[0045] The present invention provides an IoT malicious traffic detection method for counteracting concept drift, which is divided into four parts: traffic data processing module, initial model training module, concept drift detection module and concept drift adaptation module. The method mainly includes the following steps:
[0046] S1: Extract features from the Pcap package of the flow data using the CICflowmeter tool to obtain a preliminary feature vector A of the flow data; filter, unique-hot encode and normalize the features of feature vector A to obtain feature vector B;
[0047] S2: Compress the feature vector B obtained by the autoencoder, and then use the idea of contrastive learning to construct positive sample pairs of the same type and negative sample pairs of different types, then cluster and select representative subsets to obtain the initial detection model;
[0048] S3: The Pcap package of the captured online traffic data is used to obtain the feature vector C through the traffic data processing module; the feature vector C is compressed by the automatic encoder in the initial model training module and then input into the initial detection model. If the traffic data drifts, it is collected in the adaptive window; otherwise, the traffic data is successfully classified and the next traffic data is processed;
[0049] S4: When the adaptive window receives the first feature vector data, the timing starts. If the number of feature vectors in the adaptive window does not exceed half of W within a continuous adaptive window size time, the data in the adaptive window is cleared. Otherwise, the detection model is retrained and updated by re-training the feature vectors and representative subsets collected in the adaptive window.
Claims
1. An IoT malicious traffic detection device for combating concept drift, characterized in that: Includes the following modules: Traffic data processing module: First, the Pcap package of historical traffic data is extracted through the CICflowmeter tool to obtain the preliminary feature vector A of the traffic data; then the features of feature vector A are screened, uniquely encoded and normalized to obtain feature vector B; Initial model training module: Through contrastive learning and combined with autoencoder, two samples of the same type in feature vector B are taken as positive sample pairs, and two samples of different types are taken as negative sample pairs. These sample pairs are compressed into low-dimensional space through autoencoder, and contrastive loss function is constructed to make the Euclidean distance of positive sample pairs as small as possible and the Euclidean distance of negative sample pairs as large as possible. Then clustering can obtain several compact clusters, and then select representative subsets of each cluster to obtain the initial detection model. Concept drift detection module: The Pcap package of the captured online traffic data is used to obtain the feature vector C through the traffic data processing module; The feature vector C is compressed by the automatic encoder in the initial model training module and then input into the initial detection model. The distance D from the feature vector C to the nearest cluster centroid is calculated. If the absolute value of the difference between the distance D and the median of the point in the cluster to the cluster centroid is greater than the set threshold, the flow data is considered to have drifted, a drift warning is issued, and the vector data is collected in the adaptive window. Otherwise, it is considered that no drift has occurred and the flow data is successfully classified. Concept drift adaptation module: As the concept drift detection module continuously processes online traffic data, the feature vector data in the adaptive window will continue to increase. If the drift data does not exceed half of the adaptive window within a continuous adaptive window size, the feature vector data of the adaptive window will be cleared. Otherwise, the detection model will be retrained and updated by using the feature vectors and representative subsets collected in the adaptive window. The specific implementation steps of the initial model training module are as follows: First, the feature vector B is compressed into a low-dimensional space through an automatic encoder; then two samples of the same type in the compressed feature vector B are taken as positive sample pairs, and two samples of different types are taken as negative sample pairs. The Euclidean distance of the positive sample pairs is taken as the numerator of the loss function, and the Euclidean distance of the negative sample pairs is taken as the denominator of the loss function. The distance between positive samples is shortened by minimizing the loss function, while the distance between negative samples is pushed away. Then clustering can obtain the initial detection model of several tight clusters; then the centroid c of each cluster is calculated i , from each sample point in the cluster to the centroid c i The median of the distances d i and median absolute difference MAD i , i takes the value from 0 to the number of clusters, and selects each cluster that contains i +MAD i The points of the circle with a radius of are taken as representative subsets, and the representative subsets are retained. The adaptive window size is defined as W according to the number of representative subsets of each type of cluster.
2. According to claim 1, the IoT malicious traffic detection device for combating concept drift is characterized in that: The specific implementation steps of the traffic data processing module are as follows: The CICflowmeter tool is used to extract features from the Pcap package of the flow data to obtain the preliminary feature vector A of the flow data, and the commonly used port numbers and protocol numbers of the feature vector A are counted. In order to further facilitate the training of the model, after reading the feature vector A, it is further processed. First, the useless Flow ID and the unused features in the classification are removed by feature screening to reduce the dimension, and then the discrete feature values are converted into continuous 0, 1 one-hot vectors by one-hot encoding. The commonly used port numbers and protocol numbers are used as new features of the feature vector, and those uncommon ports are classified into one type of features, and the uncommon protocol numbers are classified into another type of features. The values of these newly added features are all 0 or 1, 1 indicates that the sample contains the feature, and 0 indicates that the feature is not included. After that, the continuous feature values are processed by normalization, and they are all mapped to the range of 0 to 1 to avoid the impact of different levels of values between the feature values on the model. After the feature vector A is screened, one-hot encoded and normalized, the feature vector B is obtained.
3. According to claim 1, the IoT malicious traffic detection device for combating concept drift is characterized in that: The specific implementation steps of the concept drift detection module are as follows: The Pcap package of the captured online traffic data is used to obtain the feature vector C through the traffic data processing module; the feature vector C is compressed by the automatic encoder in the initial model training module, and its distance to the nearest centroid c is calculated. i The distance D, when |Dd i | and MAD i When the ratio is greater than a certain threshold α, the feature vector C is drift data, a drift warning is issued and the data is collected into the adaptive window. Otherwise, it is considered that no drift has occurred, and the traffic data is successfully classified, and then the next Pcap packet of traffic data is processed.
4. According to claim 1, the IoT malicious traffic detection device for combating concept drift is characterized in that: The specific implementation steps of the concept drift adaptation module are as follows: When the adaptive window receives the first feature vector data, the timing starts. If the number of feature vectors in the adaptive window does not exceed half of W within a continuous adaptive window size time, the data in the adaptive window is cleared. Otherwise, the detection model is retrained and updated by collecting feature vectors in the adaptive window and retaining representative subsets.
5. A method for detecting malicious IoT traffic against concept drift, characterized in that: The following steps are involved: S1: Extract features from the Pcap package of the flow data using the CICflowmeter tool to obtain a preliminary feature vector A of the flow data; The features of feature vector A are filtered, one-hot encoded and normalized to obtain feature vector B; S2: Compress the feature vector B obtained by the autoencoder, and then use the idea of contrastive learning to construct positive sample pairs of the same type and negative sample pairs of different types, and then cluster and select representative subsets to obtain the initial detection model; First, the feature vector B is compressed into a low-dimensional space through an automatic encoder; then two samples of the same type in the compressed feature vector B are taken as positive sample pairs, and two samples of different types are taken as negative sample pairs. The Euclidean distance of the positive sample pairs is taken as the numerator of the loss function, and the Euclidean distance of the negative sample pairs is taken as the denominator of the loss function. The distance between positive samples is shortened by minimizing the loss function, while the distance between negative samples is pushed away. Then clustering can obtain the initial detection model of several tight clusters; then the centroid c of each cluster is calculated i , from each sample point in the cluster to the centroid c i The median of the distances d i and median absolute difference MAD i , i takes the value from 0 to the number of clusters, and selects each cluster that contains i +MAD i The points of the circle with a radius of are taken as representative subsets, and the representative subsets are retained. The adaptive window size is defined as W according to the number of representative subsets of each cluster; S3: The Pcap package of the captured online traffic data is processed by the traffic data processing module to obtain the feature vector C; The feature vector C is compressed by the automatic encoder in the initial model training module and then input into the initial detection model. If the flow data drifts, it is collected in the adaptive window. Otherwise, the flow data is successfully classified and the next flow data is processed. The Pcap package of the captured online traffic data is used to obtain the feature vector C through the traffic data processing module; After the feature vector C is compressed by the autoencoder in the initial model training module, its nearest centroid c is calculated i The distance D, when |Dd i | and MAD i When the ratio is greater than a certain threshold α, the feature vector C is drift data, and a drift warning is issued and the data is collected into the adaptive window. Otherwise, it is considered that no drift has occurred, and the traffic data is successfully classified, and then the next Pcap packet of traffic data is processed; S4: When the adaptive window receives the first feature vector data, the timing starts. If the number of feature vectors in the adaptive window does not exceed half of W within a continuous adaptive window size time, the data in the adaptive window is cleared. Otherwise, the detection model is retrained and updated by re-training the feature vectors and representative subsets collected in the adaptive window.