An Internet of Things intrusion detection method and device based on partial domain adaptation

Abstract

The present invention discloses an Internet of Things intrusion detection method and device based on partial domain adaptation, including: s , obtain the source domain feature extractor F S and intrusion detection classifier C; based on the source domain data with private labels and the target data with shared labels, obtain classifier D; according to the source domain data x s The corresponding source domain classifier D outputs the source domain data x s The weight ω s ; Based on source domain feature extractor F S , weight ω s , source domain data x s , target data x t , obtain the target domain feature extractor F t ; Based on the target domain feature extractor F t , classifier D and intrusion detection classifier C, construct an intrusion detection model; input the target domain data to be tested into the intrusion detection model to obtain the intrusion detection results. The present invention can not only achieve good attack detection performance in the case of a large number of labeled data samples, but also detect unknown attacks.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things intrusion detection, and in particular to an Internet of Things intrusion detection method and device based on partial domain adaptation. Background Art

[0002] The field of IoT intrusion detection has been widely studied. For anomaly-based IoT intrusion detection, many researchers use machine learning algorithms to detect network attacks. For example, [Y. Mirsky, T. Doitshman, Y. Elovici, and A. Shabtai, "Kitsune: an ensemble of autoencoders for online network intrusion detection," arXiv preprint arXiv:1802.09089, 2018.] proposed an online network intrusion detection technique based on an ensemble of autoencoders, which can effectively detect most attacks in the IoT and is plug-and-play. [A. Singla, E. Bertino, and D. Verma. Preparing network intrusion detection deeplearning models with minimal data using adversarial domain adaptation. The 15th ACM Asia Conference on Computer and Communications Security, pages 127-140, 2020] uses an adversarial domain adaptation method to address the problem of lacking labeled training data in the dataset. This method is applicable to source and target datasets with the same or different feature spaces. Results show that their model can achieve good performance even when the number of labeled target samples is very small. Juan Zhao et al. proposed HeTL [J.Zhao,S.Shetty,and JWPan,"Feature-based transfer learning for networksecurity."In MILCOM 2017-2017IEEE Military Communications Conference,pages17-22,2017.] and CeHTL [J.Zhao,S.Shetty,JWPan,C.Kamhoua,and K.Kwiat,"Transferlearning for detecting unknown network attacks,"EURASIP JInfo.Secur.vol.2019,article no.1,Feb.2019.], which use feature-based transfer learning to detect unknown attacks. It finds similarities between two different attacks, DoS and R2L, and learns optimized representations that remain unchanged when the attack behavior changes.Both of these methods are unsupervised domain adaptation techniques that consider the same label space, while the present invention focuses on a different label space. Chinese patent application CN112203282A discloses a 5G IoT intrusion detection method and system based on federated transfer learning. This system uses fine-tuning to transfer knowledge from a public dataset to a private IoT dataset. This system cannot address the issue of different label spaces between the source and target domains. Furthermore, the system models intrusion detection as a binary classification problem, which can only identify whether traffic contains an attack, but not the specific attack category. The present invention, however, can identify attack categories within a shared label space.

[0003] However, traditional IPv6-based IoT intrusion detection technologies focus on routing attacks within wireless sensor networks. These attacks are protocol-constrained and only applicable to specific IoT networks. Intrusion detection systems using machine learning rely on training large datasets of labeled data packets to detect attacks. However, obtaining large labeled datasets is difficult, and due to the heterogeneous nature of IoT systems, each IoT network has its own unique network traffic characteristics. Attack detection based on transfer learning typically assumes that the source and target domains share the same label space, which has certain limitations. Summary of the Invention

[0004] To address these issues, the present invention proposes a method and device for IoT intrusion detection based on partial domain adaptation. This approach addresses the issue of inconsistent label spaces by identifying samples that may originate from external classes and suppressing knowledge transfer from these samples. This approach trains a highly accurate network intrusion detection model by migrating the rich labeled datasets of the traditional internet to unlabeled datasets of the IoT. Furthermore, the present invention can leverage knowledge from the traditional internet to detect unknown attacks in the IoT, making online intrusion detection more suitable for practical IoT applications.

[0005] To achieve the above technical objectives, the technical solutions of the present invention include:

[0006] An Internet of Things intrusion detection method based on partial domain adaptation, the steps of which include:

[0007] For source domain data x s Label the target domain data, wherein the label includes: a shared label or a private label

[0008] Based on the source domain data x in the source domain s And the corresponding labels, train a feature extractor and the first classifier to obtain the source domain feature extractor F S and intrusion detection classifier C;

[0009] The source domain data with private labels and the target data with shared labels are input into the source domain feature extractor FS With the initial target domain feature extractor, and based on the source domain data feature z′ s and the target domain data feature z′ t , train the second classifier and obtain classifier D;

[0010] According to the source domain data x s The corresponding source domain classifier D outputs the source domain data x s The weight ω s ;

[0011] Based on the source domain feature extractor F S , weight ω s , source domain data x s And corresponding labels, target data x t And the corresponding labels, train the initial target domain feature extractor and the third classifier, and obtain the target domain feature extractor F t ;

[0012] According to the target domain feature extractor F t , classifier D and intrusion detection classifier C, build an intrusion detection model;

[0013] Input the target domain data to be tested into the intrusion detection model to obtain the intrusion detection results.

[0014] Furthermore, the source domain feature extractor F is obtained by the following steps: S And the intrusion detection classifier C:

[0015] 1) Extract source domain data x s TCP stream and UDP stream;

[0016] 2) Generate source domain data x based on TCP stream and UDP stream s Statistical characteristics of

[0017] 3) Each source domain data x s The statistical features of the feature extractor are input into the feature extractor, and the output z of the feature extractor is s Input the first classifier for joint training;

[0018] 4) Obtain the source domain feature extractor F by minimizing the loss function S and intrusion detection classifier C.

[0019] Furthermore, the source domain feature extractor F SThe structure of the intrusion detection classifier C includes: two convolutional layers, two maximum pooling layers, a flattening layer, and two fully connected layers; the structure of the intrusion detection classifier C includes: neurons activated by the sigmoid function, where the number of neurons corresponds to the number of attack classes in the source domain data; the structure of the initial target domain feature extractor includes: two convolutional layers, two maximum pooling layers, a flattening layer, and two fully connected layers; the structure of the second classifier includes: two fully connected layers; the structure of the third classifier includes: three fully connected layers;

[0020] Furthermore, the method of training the second classifier includes minimizing a cross-loss function.

[0021] Furthermore, the weight ω s =1-D(z S ), where the source domain data x s Input source domain feature extractor F S , get feature z S .

[0022] Furthermore, the method of training the initial target domain feature extractor and the third classifier includes: maximizing the cross loss function of the third classifier and minimizing the cross loss function of the initial target domain feature extractor.

[0023] Furthermore, the intrusion detection results are obtained through the following steps:

[0024] 1) Set a threshold φ;

[0025] 2) Input the target domain data to be tested into the target domain feature extractor F t , get feature z;

[0026] 3) Input feature z into classifier D to obtain anomaly score s t ;

[0027] 4) If the anomaly score s t If it is higher than the threshold φ, the unknown attack is considered as the intrusion detection result;

[0028] If the anomaly score s t If it is not higher than the threshold φ, the feature z is input into the intrusion detection classifier C, and the obtained attack category is used as the intrusion detection result.

[0029] Furthermore, the threshold in is the target domain data, n t is the number of target domain data, and ε is the numerical fluctuation.

[0030] A storage medium stores a computer program, wherein the computer program is configured to execute the above method when running.

[0031] An electronic device includes a memory and a processor, wherein the memory stores a program for executing the above method.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] 1. A model that can effectively detect IoT attacks can be trained without a large amount of labeled data samples.

[0034] 2. The model can detect unknown attacks.

[0035] 3. The present invention implements this method on two intrusion detection datasets, one from the traditional Internet and the other from the Internet of Things. The experimental results show that when there is less unlabeled data in the Internet of Things, better attack detection performance can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 Flowchart of the method of the present invention.

[0037] Figure 2 The unknown attack detection result of the present invention.

[0038] Figure 3 The detection effect of the present invention is compared with that of other methods. DETAILED DESCRIPTION

[0039] The following will be combined with the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the embodiments described are only specific embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0040] The intrusion detection framework proposed in the present invention is based on the partial domain adaptation method. In a specific scenario where the source dataset and the target dataset have different label spaces, partial domain adaptation is used to transfer knowledge from the rich public label datasets on the traditional Internet, and a high-precision label-free intrusion detection model for the Internet of Things is trained. Based on this intrusion detection framework, unknown attacks in the Internet of Things can be identified and can be used for intrusion detection in the Internet of Things. Figure 1 As shown in the figure, it mainly includes three modules: data preprocessing, partial pre-adaptation training, and online attack detection.

[0041] 1. Data Preprocessing

[0042] First, the raw network packets of the traditional Internet and the Internet of Things are preprocessed. We use the CICFlowMentor tool to extract the same statistical features so that the source domain and the target domain have the same feature space. It generates bidirectional flows from PCAP files and extracts statistical time-related features from these flows. Generally speaking, a unidirectional flow refers to a group of packets with the same protocol type, source IP address, destination IP address, source port, and destination port. Therefore, a bidirectional flow can be defined as a group of network packets moving forward or backward between two endpoints. In order to obtain time-related statistical information, feature extraction should be performed on bidirectional flows within a limited time period. Specifically, a TCP flow ends when the TCP connection ends, while a UDP flow ends when a certain set time is exceeded.

[0043] At this stage, we also analyze the intrusion detection classifier C(Fs(x S )) was pre-trained. x S Representing the source domain samples, Fs represents the source domain feature extractor, which consists of two convolutional layers (64 and 128 filters), two maximum pooling layers, a flat layer, and two fully connected layers (128 and 64 neurons). The attack classifier C consists of neurons activated by the sigmoid function (the number of neurons corresponds to the number of attack classes of the source samples). Fs is used to extract the features of the source domain samples, and C is used to classify the source samples into benign or attack classes, such as DDoS, Web attacks, port scanning, botnets, brute force cracking, etc. Please note that Fs and C will be used in the following PDA training and online intrusion detection stages (fixed), respectively. The model C(Fs(x S )) is obtained by minimizing the loss function and learning the parameters of Fs and C, which can be expressed as:

[0044]

[0045] Among them, Ls is the cross entropy loss function of multi-classification in the source domain.

[0046] 2. Detection model training

[0047] The goal of this stage is to achieve knowledge transfer and partial domain adaptation. This paper proposes a partial domain adaptation method based on weighted adversarial networks to help label space alignment. Two domain classifiers D and D0 and two feature extractors Fs and Ft are used. Fs is obtained in the preprocessing stage. Ft represents the target domain feature extractor, which has the same network structure as Fs but different network parameters. The output of the feature extractor will be input into D0 and D. D and D0 are commonly used neural networks. D consists of 2 fully connected layers with 20 and 10 neurons respectively; D0 consists of 3 fully connected layers with 50, 40, and 10 neurons respectively.

[0048] The training process includes three training parts (learning D, D0 and Ft). First, Fs and Ft sample the source data and target data xs and xt respectively, and output zs and zt. D takes the source feature zs marked as 1 (from the private label space) and the target feature zt marked as 0 (from the shared label space) as input, and outputs D(z) = p(y = 1 | z) = σ(a(z)). σ is the logistic sigmoid function, a(z) is the output of the last fully connected layer, and p represents the probability. When D converges to the optimum, the output of D is the possibility that the sample comes from the source domain, that is, given a sample feature z, the probability that it comes from the private label space. By minimizing the objective function of D, its ability to distinguish between source samples and target samples is improved, which is expressed as:

[0049]

[0050] Among them, L D is the cross loss function about the domain classifier D, E represents the expectation, E x～Ps(x) Indicates that the expectation is calculated for all samples from the source domain.

[0051] Since the value of D(z) can represent the possibility of samples from the shared label space or the private label space, an importance weight ω(z) is set s ) is assigned to each source sample to adjust its influence on the subsequent domain adaptation process. The weight is composed of the probability p of the sample from the source domain and the target domain s (z S ) and p t (z S ) is calculated and expressed as

[0052]

[0053] if If is higher, the sample can be completely distinguished from the target domain, which means it is more likely to come from the private label space distribution of the source Internet domain. Such samples will be given smaller weights to suppress their impact on knowledge transfer. On the contrary, smaller This means that it is difficult for D to determine the domain to which the sample belongs. They may come from shared label spaces, such as DDoS, Botnet, and Scan categories. These types of samples are very necessary because they will have a positive impact on domain adaptation. Therefore, they are given a higher weight.

[0054] In order to distinguish the weighted source features z s and target feature z t , D0 is introduced as the second domain classifier. The formula is as follows,

[0055]

[0056] Where λ is a trade-off parameter that measures the degree of suppression of the private label space.

[0057] Finally, train Ft to minimize the loss of Ft, expressed as

[0058]

[0059] Among them, L ω is the cross loss function.

[0060] Note that only the gradients of D0 will be backpropagated to update Ft, since they are learned from the weighted source samples. This process is repeated several times. After training, the extracted target data features can be directly put into the classifier C for classification.

[0061] 3. Online attack detection

[0062] After the above two stages, we obtain the classifier C, the target domain feature extractor Ft, and the domain classifier D. We combine them to design a new online intrusion detection model. This network intrusion detection model can not only detect specific attacks in the shared label space of the Internet of Things, but also detect unknown attacks with the help of D. In this stage, we fix Ft, D, and C and do not update any of their structures and internal parameters. The new test data is first subjected to feature extraction by Ft. Then the result Ft(x t ) into D and get an anomaly score, denoted as s t =D(Ft(x t )), which is the probability value representing the similarity with the target domain data during the training process. The abnormal score of each target training sample A measure of the abnormality of a sample. Specifically, samples belonging to the shared label space will produce a lower value (close to 0), while samples from the private label space will produce a larger value (close to 1), which reflects that the corresponding sample is more likely to be a new, unseen attack class in the Internet of Things. The larger the score, the greater the difference in the target label space distribution. In order to detect unknown attacks, a cutoff threshold φ is set. A simple method is to set φ to the average score of the target training samples, We assume that it represents data from a shared label space, where n t is the number of training samples in the target domain. Therefore, Here, ε means numerical fluctuation, that is, φ can be flexibly designed according to different situations.

[0063] The process of online intrusion detection: If new samples from the private label space, such as web attacks, appear during the testing phase, their scores are likely to be higher than the set threshold φ, and therefore they will be labeled as unknown attacks. Conversely, if the score is not higher than φ, the corresponding sample is considered to be from the shared label space. Because the classifier C learns to match the feature extractor output to a specific attack category, it can be directly used to predict the sample type of the target domain. Our scheme supports online detection. After offline training, a personalized intrusion detection model is obtained for each IoT. The intrusion detection model does not require any parameter changes during the online intrusion detection phase. Therefore, it is suitable for real-time intrusion detection and can meet the lightweight deployment requirements of IoT.

[0064] Three experiments were conducted to evaluate the effectiveness of the present invention.

[0065] The first is to evaluate the basic ability of multi-class classification of target IoT attacks. The second is to demonstrate the detection ability of unknown attacks. The third purpose is to verify the versatility of our method, that is, the effectiveness of our method for traditional non-partial domain adaptation problems. In the experiment, mini-batch stochastic gradient descent is used for optimization. We set the batch learning rate to 0.1, the batch size to 64, the number of training iterations to about 100, and the batch size to 32. To verify the effectiveness of our method. We use accuracy (ACC), true positive rate (TPR), false positive rate (FPR), f1 score (f1) and area under the ROC curve (AUC) to evaluate the method. We use CIC-IDS2017

[22] as the source domain. It is taken from the traditional Internet and contains benign, latest common attacks. Its data collection lasted for five days. Monday is a normal day with only normal traffic, and the other four days contain various attacks, including brute force, network attacks, infiltration, botnets and DDoS. We choose the IoT dataset [8] as the target domain. It is extracted from IP camera video surveillance networks and smart home networks, and includes benign attacks and nine types of attacks, three of which we use as shared classes.

[0066] To verify the ability of our method to identify specific categories of IoT attacks, we selected labeled source data samples containing five attack categories and one benign category to train a classification model. The source domain has two private label spaces (brute force and web attacks). The source and target domains share three common attacks (DDoS, botnet, and scanning attacks), which can be considered a shared label space. Scanning attacks refer to OS scanning, and botnet malware refers to Mirai. We split the IoT dataset into multiple parts as target domains, each containing one benign category with fewer than or equal to three attack categories. Therefore, the source domain is CIC-IDS2017, with six classes denoted as C6, and the target domain is the IoT dataset, where n = 2, 3, or 4 represents the number of categories. We model this as a multi-class classification problem. We then train an IoT feature extractor using weighted adversarial PDA. Finally, we construct an online NID classification model by concatenating Ft, D, and C. We evaluate its performance in detecting the category (benign or specific attack type) of the target sample. We repeat the experiment five times and take the average metric. As shown in Table 1, our method achieved an average accuracy of 87.42%. Clearly, our method also performed well in terms of AUC. This demonstrates that even with different label spaces, PDA can effectively align the two domains by assigning different weights to source samples from different label spaces, thereby effectively transferring knowledge gained from the labeled source Internet domain to the unlabeled IoT domain for accurate classification. We conducted experiments written in Python and executed on Windows 10 with an i7-9750H CPU and 8GB of RAM.

[0067] Table 1 Model results

[0068]

[0069] The online intrusion detection model of the present invention can not only classify target samples, but also identify unknown attacks that have not occurred in the target domain during the training phase. Figure 2As shown, the blue dots represent samples from the shared label space (benign and SYN-DoS categories). Over time, a new attack (red dot) was discovered in the IoT, one not previously seen in the IoT. Clearly, the anomaly scores for unknown attack samples are higher than those for known class samples. By setting a threshold, we can easily identify unknown attack classes. We consider samples exceeding the set threshold to be unknown attacks. The blue line below is the average score for known samples from the shared label space. To develop a better unknown anomaly detector, we can measure the performance of different thresholds around the average. The orange dashed line above represents a threshold we can select, which detects 98.19% of unknown attacks and produces a FPR of 2.50%, which is better than the average performance. Therefore, utilizing D-space and private space can effectively detect unknown attacks, which is of great significance for intrusion detection.

[0070] Finally, to verify the versatility of the proposed scheme, we evaluate the traditional non-partial DA problem and compare it with two typical DA methods: DANN [Y. Ganin, et al.: "Domain-adversarial training of neural networks," J. Mach. Learn. Res. Vol. 17, no. 1, pp. 2096-2030, 2016.] and DDC [

[32]

[0071] E.Tzeng, J.Hoffman, N.Zhang, K.Saenko, and T.Darrell, “Deep domain confusion: Maximizing for domain invariance,” arXiv preprint arXiv:1412.3474, 2014.] compared, e.g. Figure 3 As shown. We choose CIC-IDS2017 (benign and five attack types) as the source domain (C6) and the IoT dataset (benign and one attack type) as the target domain. We model it as a binary classification problem, that is, predicting whether the sample is benign or attack. In this way, the source domain and the target domain have the same label space. The results are shown in the figure. We observe that the NID model trained with our method outperforms the DDC method and has no obvious degradation compared with the DANN method. The results also show that in scheme C6, our method has a TPR of 45.4% (FPR=0.01), which is higher than DANN. Therefore, the scheme has good versatility and is not only suitable for partial domain adaptation problems, but also for general domain adaptation problems.

[0072] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for intrusion detection in the Internet of Things based on partial domain adaptation, comprising the following steps: For source domain data x s and labeling the target domain data with a label, wherein the label comprises: a shared label or a private label; Based on the source domain data x in the source domain s And the corresponding labels, train a feature extractor and the first classifier to obtain the source domain feature extractor F S and intrusion detection classifier C; The source domain data with private labels and the target data with shared labels are input into the source domain feature extractor F S With the initial target domain feature extractor, and based on the source domain data feature z′ s and the target domain data feature z′ t , train the second classifier and obtain classifier D; According to the source domain data x s The corresponding source domain classifier D outputs the source domain data x s The weight ω s ; Based on the source domain feature extractor F S , weight ω s , source domain data x s And corresponding labels, target data x t And the corresponding labels, train the initial target domain feature extractor and the third classifier, and obtain the target domain feature extractor F t ; According to the target domain feature extractor F t , classifier D and intrusion detection classifier C, build an intrusion detection model; Input the target domain data to be tested into the intrusion detection model to obtain the intrusion detection results.

2. The method according to claim 1, wherein The source domain feature extractor F is obtained by the following steps S And the intrusion detection classifier C: 1) Extract source domain data x s TCP stream and UDP stream; 2) Generate source domain data x based on TCP stream and UDP stream s Statistical characteristics of 3) Each source domain data x s The statistical features of the feature extractor are input into the feature extractor, and the output z of the feature extractor is s Input the first classifier for joint training; 4) Obtain the source domain feature extractor F by minimizing the loss function S and intrusion detection classifier C.

3. The method according to claim 1, wherein Source domain feature extractor F S The structure of includes: two convolutional layers, two maximum pooling layers, one flattening layer and two fully connected layers; the structure of the intrusion detection classifier C includes: neurons activated by the sigmoid function, where the number of neurons corresponds to the number of attack classes in the source domain data; the structure of the initial target domain feature extractor includes: two convolutional layers, two maximum pooling layers, one flattening layer and two fully connected layers; the structure of the second classifier includes: 2 fully connected layers; the structure of the third classifier includes: 3 fully connected layers.

4. The method according to claim 1, wherein The method of training the second classifier includes minimizing the cross-loss function.

5. The method according to claim 1, wherein The weight ω s =1-D(z S ), where the source domain data x s Input source domain feature extractor F S , get feature z S .

6. The method according to claim 1, wherein The method of training the initial target domain feature extractor and the third classifier includes: maximizing a cross loss function of the third classifier and minimizing a cross loss function of the initial target domain feature extractor.

7. The method according to claim 1, wherein The intrusion detection results are obtained by following the steps below: 1) Set a threshold φ; 2) Input the target domain data to be tested into the target domain feature extractor F t , get feature z; 3) Input feature z into classifier D to obtain anomaly score s t ; 4) If the anomaly score s t If it is higher than the threshold φ, the unknown attack is considered as the intrusion detection result; If the anomaly score s t If it is not higher than the threshold φ, the feature z is input into the intrusion detection classifier C, and the obtained attack category is used as the intrusion detection result.

8. The method according to claim 7, wherein Threshold in is the target domain data, n t is the number of target domain data, and ε is the numerical fluctuation.

9. A storage medium storing a computer program, wherein: The computer program is configured to execute the method according to any one of claims 1 to 8 when executed.

10. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 8.

Images