An IoT network protocol identification method based on edge computing gateway

Abstract

The present invention discloses an IoT network protocol identification method based on an edge computing gateway. The steps of the present invention are as follows: 1. The edge gateway server establishes serial port communication and Socket communication with the underlying device and the client respectively; 2. The edge gateway server reads the data from the serial port or TCP buffer. Since the length of each data in the collected data is inconsistent, the data must be preprocessed to facilitate the processing of the convolutional neural network (CNN) model; 3. The convolutional neural network (CNN) model is built; 4. A federated learning model is built. The present invention designs a FedIdentify protocol identification model, integrates the convolutional neural network (CNN) model into the edge gateway, and the device uploads data to the gateway. Each gateway builds its own convolutional neural network model and Softmax classifier to classify the industrial control network data protocol. The present invention adopts a federated learning framework, combined with a convolutional neural network model, which can accurately identify various network packet protocols while ensuring the privacy of device data.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to an IoT network protocol identification method based on an edge computing gateway. Background Art

[0002] Currently, with the rapid development of IoT technology and the advent of the Industry 4.0 era, the Industrial Internet of Things (IIoT) has become a part of our daily lives and production. Leveraging IIoT technology, modern sensors and controllers, equipped with sensing and monitoring capabilities, are integrated into industrial production processes, enabling real-time data collection, intelligent analysis, and mobile communications. This has significantly improved industrial manufacturing and enabled the transformation of traditional industrial manufacturing towards modern, intelligent manufacturing, achieving a significant breakthrough. Overall, IIoT technology offers numerous advantages, including security, real-time performance, automation, embedded capabilities, interoperability, and connectivity.

[0003] The Industrial Internet of Things (IIoT) has become a crucial component of my country's strategic emerging industries. It plays a vital role in sectors such as energy, supply chain, oil, mining, and transportation. Edge computing gateways, in particular, play a core role in collecting, storing, and forwarding edge data in intelligent manufacturing. However, as the IIoT continues to expand and connect more and more industrial equipment and production machinery, numerous challenges arise in device access and data processing. For example, the diverse communication protocols of connected devices make traditional port identification-based maintenance costly and incapable of meeting the access needs of a large number of devices with heterogeneous protocols.

[0004] With the continuous advancement of artificial intelligence technology, the Industrial Internet of Things (IIoT) will have even greater potential for growth, and this is also its future development trend. Traditional machine learning solutions for protocol recognition require migrating data collected by each factory from local devices to a centralized cloud server for training. However, transferring data from local devices to the centralized cloud still presents significant challenges. For example, confidential information from each factory could be leaked to competitors, and the transmission of all this data consumes significant bandwidth resources. Furthermore, large amounts of data can place significant strain on centralized cloud servers. Summary of the Invention

[0005] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide an IoT network protocol identification method based on an edge computing gateway. The present invention integrates an industrial control network protocol identification model into the edge gateway. This model introduces a federated learning framework, enabling heterogeneous devices in the Industrial Internet of Things to collaboratively train the industrial control network protocol identification model. Secondly, a convolutional neural network (CNN) model is embedded in the edge gateway server of each device to automatically extract data features and classify industrial control protocol data. This supports the identification and parsing of dozens of industrial control protocols while addressing the data privacy issues of each device.

[0006] The purpose of the present invention is achieved through the following technical solutions:

[0007] A method for identifying IoT network protocols based on an edge computing gateway. The construction of an industrial control network protocol identification model in the method includes data collection, data preprocessing, building a convolutional neural network (CNN) model, and building a federated learning framework. The steps are as follows:

[0008] Step 1: The edge gateway server establishes serial communication and socket communication with the underlying device and client respectively;

[0009] Step 2: The edge gateway server reads the data from the serial port or TCP buffer. Since the length of each piece of data in the collected data is inconsistent, the data must be preprocessed to facilitate processing by the convolutional neural network (CNN) model:

[0010] 2-1. Trim each data entry into a vector x of length 784 bytes. If the length is larger than 784 bytes, retain the first 784 bytes; if the length is smaller than 784 bytes, fill it with zeros.

[0011] 2-2. Divide the value of each component in vector x by 256 and normalize the value to the range [0,1). This process can eliminate the influence of different features, make the model converge quickly, and reduce the order of magnitude difference of each device data;

[0012] 2-3. Graphically process vector x. Convert the normalized vector x into a grayscale image and sequentially place every 28 components into a row of the matrix to obtain a 28*28 two-dimensional matrix.

[0013] 2-4. IDX conversion: Convert the generated grayscale image to the IDX format. IDX files are a common file format for machine learning and contain all the pixels and statistical information of a set of images.

[0014] Step 3: Building a Convolutional Neural Network (CNN) model:

[0015] 3-1. First, divide the preprocessed dataset into training set, validation set and test set;

[0016] 3-2. Input layer: pre-processed 28*28 two-dimensional matrix data;

[0017] 3-3. Convolutional layer C1: Deconvolve the two-dimensional matrix with 32 3×3 convolution kernels to extract features. The convolution step size is 1 and the SELU activation function is used to improve the nonlinear expression ability of the neural network model and accelerate convergence.

[0018] 3-4. Pooling layer S1: Perform maximum pooling on the feature map output by convolutional layer C1, with a filter set to 2×2, to obtain 32 14×14 feature images;

[0019] 3-5. Convolutional layer C2: Convolves the 32 14×14 feature images output by pooling layer S1 with 64 3×3 convolution kernels to further extract features. The convolution stride is 1, and finally activated with the SELU activation function to obtain 64 14×14 feature maps.

[0020] 3-6. Pooling layer S2: Perform maximum pooling on the feature map output by C2 with a filter size of 2×2, obtaining 64 7×7 feature images.

[0021] 3-7. Fully Connected Layer FC1: Flattens the 64 7×7 feature images output by Pooling Layer S2, compressing the data into a one-dimensional vector of length 3136. FC1 layer has 784 neurons, which are fully connected to the compressed one-dimensional vector and activated using the SELU function.

[0022] 3-8 fully connected FC2 layers: FC2 has 28 neurons and uses the Dropout strategy to discard 50% of the features to prevent overfitting;

[0023] 3-9 Output: Use the Softmax classifier to classify the features output by FC2, output the probability distribution of the samples, and obtain the recognition results.

[0024] Step 4: Build a federated learning model

[0025] Use the FATE framework to build a horizontal federated learning model. The specific process is as follows:

[0026] 4-1. The central server generates and initializes the convolutional neural network model based on the configuration;

[0027] 4-2. Initialize the convolutional neural network model weights w t The data is sent to the edge gateway corresponding to each device. After receiving the global model, the edge gateway performs multiple local iterative calculations and encrypts the trained model parameters or the gradient of the model parameters using differential privacy before uploading them to the central server. in, is the new weight, η t is the learning rate of the t-th iteration cycle, is the self-loss of the k-th device in the t-th iteration;

[0028] 4-3. The central server aggregates the model parameters or gradients of the model parameters received from each edge gateway of each client and uses the aggregated model parameters as the initial parameters w for the next update t+1 Sent to each client:

[0029] Repeat the above process until the model iteration reaches convergence.

[0030] The beneficial effects of the present invention are as follows:

[0031] The present invention constructs an IoT network protocol identification method based on an edge computing gateway, which breaks through the protocol identification method in traditional gateways that requires protocol identification based on ports or manual configuration. The convolutional neural network (CNN) model built in step 3 is used to accurately identify the industrial control data protocol in the Internet of Things. Then, through step 4, the CNN model is embedded in the FATE federated learning framework, which solves the problem of traditional machine learning requiring data to be centralized on a central server for training, ensuring data privacy. In addition, because federated learning only requires the edge gateway to upload model parameters or the gradient of model parameters, it reduces the consumption of network bandwidth and the pressure on centralized cloud servers to store large amounts of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a training flow chart of the present invention.

[0033] Figure 2 This is a neural network algorithm model diagram of the present invention.

[0034] Figure 3 This is a diagram of the federated learning architecture of the present invention. DETAILED DESCRIPTION

[0035] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0036] like Figure 1 As shown in the figure, FedIdentify is mainly divided into four parts: data collection, data preprocessing, CNN model construction, and federated learning framework construction.

[0037] Step 1: The industrial gateway establishes serial communication (such as Modbus-RTU) and socket communication with the underlying device and client respectively;

[0038] Step 2: After receiving the data, pre-process the data, normalize the data packet and convert it into a 28×28 two-dimensional matrix;

[0039] Step 3: Build a convolutional neural network model, such as Figure 2 As shown, the workflow includes the following parts:

[0040] 3-1. First, divide the preprocessed dataset into training set, validation set and test set;

[0041] 3-2. Input layer: pre-processed 28*28 two-dimensional matrix data;

[0042] 3-3. Convolutional layer C1: Deconvolve the two-dimensional matrix with 32 3×3 convolution kernels to extract features. The convolution step size is 1 and the SELU activation function is used to improve the nonlinear expression ability of the neural network model and accelerate convergence.

[0043] 3-4. Pooling layer S1: Perform maximum pooling on the feature map output by convolutional layer C1, with a filter set to 2×2, to obtain 32 14×14 feature images;

[0044] 3-5. Convolutional layer C2: Convolves the 32 14×14 feature images output by pooling layer S1 with 64 3×3 convolution kernels to further extract features. The convolution stride is 1, and finally activated with the SELU activation function to obtain 64 14×14 feature maps.

[0045] 3-6. Pooling layer S2: Perform maximum pooling on the feature map output by C2 with a filter size of 2×2, obtaining 64 7×7 feature images.

[0046] 3-7. Fully Connected Layer FC1: Flattens the 64 7×7 feature images output by Pooling Layer S2, compressing the data into a one-dimensional vector of length 3136. FC1 layer has 784 neurons, which are fully connected to the compressed one-dimensional vector and activated using the SELU function.

[0047] 3-8 fully connected FC2 layers: FC2 has 28 neurons and uses the Dropout strategy to discard 50% of the features to prevent overfitting;

[0048] 3-9 Output: Use the Softmax classifier to classify the features output by FC2, output the probability distribution of the samples, and obtain the recognition results.

[0049] Step 4: Use the FATE framework to build a federated learning model, such as Figure 3 As shown:

[0050] 4-1. The central server generates and initializes the convolutional neural network model based on the configuration;

[0051] 4-2. Initialize the convolutional neural network model weights w t The data is sent to the edge gateway corresponding to each device. After receiving the global model, the edge gateway performs multiple local iterative calculations and encrypts the trained model parameters or the gradient of the model parameters using differential privacy before uploading them to the central server. in, is the new weight, η t is the learning rate of the t-th iteration cycle, is the self-loss of the k-th device in the t-th iteration;

[0052] 4-3. The central server aggregates the model parameters or gradients of the model parameters received from each edge gateway of each client and uses the aggregated model parameters as the initial parameters w for the next update t+1 Sent to each client:

[0053] 4-4. Repeat the above process until the model iteration reaches convergence.

[0054] In order to evaluate the performance of the model, the present invention established an experimental platform to simulate the IoT edge gateway data acquisition system. The present invention selected the DAPRA2000 public dataset and the KDD-CUP99 dataset as input data. In the experiment, the present invention used three Raspberry Pi development boards as edge gateways and a desktop computer as a central server to simulate the federated learning environment built in step 4. All Raspberry Pis use ARM architecture Cortex-ATM system microprocessors, the desktop computer runs Ubuntu 20.04, and the hardware configuration is Inter(R) Core(TM) i5-1035G1 CPU and 16GB of running memory.

[0055] This method randomly divides the input data into training and test sets at a ratio of 80% and 20%, and then randomly distributes the training set to three edge gateways, simulating a scenario where the local edge gateway dataset maintains privacy and the dataset size is limited. This experiment uses six application layer protocols from the dataset for recognition: HTTP, MODBUS, SSH, TELNET, SMTP, and MQTT. Recognition accuracy is used as the evaluation criterion. The comparison of the training results with the commonly used centralized CNN model is shown in the following table:

[0056]

[0057] Experimental results show that the IoT network protocol identification method based on edge computing gateway constructed by the present invention can accurately identify the protocol. At the same time, since during the experimental iteration process of the present invention, the edge gateway and the central server communicate only to transmit model parameters or gradients, not all data, data privacy is guaranteed and the pressure on the centralized cloud server is relieved.

[0058] The above embodiment merely represents one embodiment of the present invention, and its description is relatively specific and detailed, but it should not be construed as limiting the scope of the present invention. It should be understood that those skilled in the art can devise many other modifications and embodiments, which will fall within the scope and spirit of the principles disclosed in this application.

Claims

1. A method for identifying IoT network protocols based on edge computing gateway, characterized in that The construction of the industrial control network protocol identification model in the method includes data collection, data preprocessing, convolutional neural network (CNN) model construction, and federated learning framework construction. The steps are as follows: Step 1: The edge gateway server establishes serial communication and socket communication with the underlying device and client respectively; Step 2: The edge gateway server reads the data from the serial port or TCP buffer. Since the length of each piece of data in the collected data is inconsistent, the data must be preprocessed to facilitate processing by the convolutional neural network (CNN) model. Step 3: Build the convolutional neural network CNN model; Step 4: Build a federated learning model; Step 2 is implemented as follows: Step 2-1. Trim each data entry into a vector x of length 784 bytes. If the length is larger than 784 bytes, retain the first 784 bytes. If the length is smaller than 784 bytes, fill it with 0. Step 2-2. Divide the value of each component in vector x by 256 and normalize the value to the interval [0, 1). This eliminates the influence of different features, enables the model to converge quickly, and reduces the order of magnitude difference of each device data. Step 2-3. Graphically process vector x; convert the normalized vector x into a grayscale image, and sequentially place every 28 components into a row of the matrix to obtain a 28*28 two-dimensional matrix; Step 2-4. IDX conversion: Convert the generated grayscale image to the IDX format. IDX files are a common file format for machine learning and contain all the pixels and statistical information of a set of images. The construction of the convolutional neural network CNN model described in step 3 is specifically implemented as follows: Step 3-1. First, divide the preprocessed dataset into training set, validation set, and test set; Step 3-2. Input layer: preprocessed 28*28 two-dimensional matrix data; Step 3-3. Convolutional layer C1: Deconvolve the two-dimensional matrix with 32 3×3 convolution kernels to extract features. The convolution step size is 1 and the SELU activation function is used to improve the nonlinear expression ability of the neural network model and accelerate the convergence speed. Step 3-4. Pooling layer S1: Perform maximum pooling on the feature map output by convolutional layer C1, with the filter set to 2×2, to obtain 32 14×14 feature images; Step 3-5. Convolutional layer C2: Convolve the 32 14×14 feature images output by pooling layer S1 with 64 3×3 convolution kernels to continue extracting features. The convolution step is 1 and finally activated with the SELU activation function to obtain 64 14×14 feature maps. Step 3-6. Pooling layer S2: Perform maximum pooling on the feature map output by C2 with a filter size of 2×2, obtaining 64 7×7 feature images; Step 3-7. Fully connected layer FC1: Flatten the 64 7×7 feature images output by pooling layer S2, compressing the data into a one-dimensional vector of length 3136. FC1 layer has 784 neurons, which are fully connected to the compressed one-dimensional vector and activated using the SELU function. Steps 3-8: Fully connected FC2 layer: FC2 has 28 neurons and uses the Dropout strategy to discard 50% of the features to prevent overfitting; Step 3-9 output: Use the Softmax classifier to classify the features output by FC2, output the probability distribution of the sample, and obtain the recognition result.

2. The IoT network protocol identification method based on edge computing gateway according to claim 1 is characterized in that The specific implementation of building a federated learning model as described in step 4 is as follows: Use the FATE framework to build a horizontal federated learning model. The specific process is as follows: Step 4-1. The central server generates and initializes the convolutional neural network model based on the configuration; Step 4-2. Initialize the convolutional neural network model weights w t The data is sent to the edge gateway corresponding to each device. After receiving the global model, the edge gateway performs multiple local iterative calculations and encrypts the trained model parameters or the gradient of the model parameters using differential privacy before uploading them to the central server. in, is the new weight, η t is the learning rate of the t-th iteration cycle, is the self-loss of the k-th device in the t-th iteration; Step 4-3. The central server aggregates the model parameters or gradients of the model parameters received from each edge gateway of each client and uses the aggregated model parameters as the initial parameters w for the next update. t+1 Sent to each client: Step 4-4. Repeat the above process until the model is iterated to convergence.

Images