A home Internet of Things intrusion detection method and system based on edge-cloud collaboration

Abstract

The present invention proposes a method and system for intrusion detection of home Internet of Things based on edge-cloud collaboration. The method for intrusion detection of home Internet of Things includes: obtaining intrusion behavior feature data from an intrusion behavior database, and establishing an offline base learner using the intrusion behavior feature data; detecting the intrusion behavior feature data in the operation process of the Internet of Things in real time, and establishing an online base learner using the real-time intrusion behavior feature data; and constructing an online learning intrusion detection model through the offline base learner and the online base learner. The system includes modules corresponding to the steps of the method; updating the intrusion behavior database in real time, and performing secondary enhancement training on the online base learner using the intrusion behavior database updated in real time.

Description

Technical Field

[0001] The present invention proposes a home Internet of Things intrusion detection method and system based on edge-cloud collaboration, belonging to the technical field of home Internet of Things detection. Background Art

[0002] With the development of IoT application technology in recent years, various industries such as people's livelihood, industry and commerce, and military are increasingly affected by IoT technology, so its security issues are becoming more and more important. Especially now that everyone relies on IoT all the time in their home life, it is urgent to establish a secure IoT security protection system in the face of malicious network attacks such as privacy exposure, identity impersonation, and malicious programs. Most of the current intrusion detection methods extract intrusion behavior features and store them in a feature library, compare the key features of the host's log or data traffic with the feature library to determine whether there is an intrusion in the network system, but this intrusion detection system usually consumes a lot of computing resources, which brings problems to the deployment of intrusion detection agents in IoT intrusion detection systems. Summary of the invention

[0003] The present invention provides a home IoT intrusion detection method and system based on edge-cloud collaboration, which is used to solve the problem that existing intrusion detection methods consume large computing resources. The technical solutions adopted are as follows:

[0004] A home Internet of Things intrusion detection method based on edge-cloud collaboration, the home Internet of Things intrusion detection method comprising:

[0005] Acquire intrusion behavior feature data from an intrusion behavior database, and establish an offline base learner using the intrusion behavior feature data;

[0006] Real-time detection of intrusion behavior feature data during the operation of the Internet of Things, and use of real-time intrusion behavior feature data to establish an online base learner;

[0007] Construct an online learning intrusion detection model through offline base learners and online base learners;

[0008] The intrusion behavior database is updated in real time, and the online base learner is trained for secondary enhancement using the intrusion behavior database updated in real time.

[0009] Further, intrusion behavior feature data is obtained from an intrusion behavior database, and an offline base learner is established using the intrusion behavior feature data, including:

[0010] Extracting a plurality of behavior feature data from the intrusion behavior database;

[0011] Using a deep learning model to train the plurality of behavior feature data to obtain trained offline data;

[0012] An offline base learner is constructed using the trained offline data.

[0013] Furthermore, the intrusion behavior feature data during the operation of the Internet of Things is detected in real time, and an online base learner is established using the real-time intrusion behavior feature data, including:

[0014] Before the Internet of Things is put into actual operation, a trial operation monitoring period is set according to the actual scale of the Internet of Things; wherein, during the trial operation monitoring period, logical isolation and physical isolation are set in the trial operation stage of the Internet of Things, so that users in the Internet of Things are allowed to access the external network, but the external network is not allowed to access the internal user network nodes of the Internet of Things;

[0015] During the trial operation monitoring period, detecting real-time network intrusion behavior for the home Internet of Things;

[0016] When a network intrusion behavior is detected, real-time intrusion behavior feature data corresponding to the current network intrusion behavior is obtained;

[0017] Using the real-time intrusion behavior feature data to construct multiple groups of online base learners;

[0018] After the multiple groups of online base learners are constructed, the Internet of Things is formally operated, and during the formal operation, intrusion behaviors existing in the Internet of Things are monitored in real time, and intrusion behavior feature data corresponding to the intrusion behaviors in the actual operation process are obtained;

[0019] The multiple groups of online base learners are trained online incrementally using the intrusion behavior feature data in the actual operation process.

[0020] Furthermore, the real-time updating of the intrusion behavior database and performing secondary enhancement training on the online base learner using the real-time updated intrusion behavior database include:

[0021] The intrusion behavior database is updated in real time by means of network information collection, so that the intrusion behavior characteristic data contained in the intrusion behavior database is continuously increased;

[0022] At the same time, the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information is detected, and the intrusion behavior characteristic data that has been collected into the intrusion behavior database is discarded to prevent the same data from being stored in the database for multiple times and occupying space. The specific steps include:

[0023] Step A1: Using formula (1), first determine whether detection and control operations are required based on the data length of the intrusion behavior feature data contained in the intrusion behavior collected from the network information.

[0024]

[0025] Where E represents the control value of whether the intrusion behavior characteristics contained in the intrusion behavior collected by network information need to be detected; R_a 16 Indicates the hexadecimal form of the ath intrusion behavior feature data contained in the intrusion behavior collected from network information; r_i 16 represents the hexadecimal form of the i-th intrusion behavior feature data in the intrusion behavior database; len() represents the number of data bits of the hexadecimal number in the brackets; m represents the total number of intrusion behavior feature data contained in the intrusion behavior collected by the network information; n represents the total number of intrusion behavior feature data in the intrusion behavior database;

[0026] If E=1, it means that the intrusion behavior characteristics contained in the intrusion behavior collected by the network information need to be detected and controlled, and then continue with step A2 and step A3;

[0027] If E=0, it means that the intrusion behavior features contained in the intrusion behavior collected from the network information do not need to be detected and controlled, so there is no need to perform step A2 and step A3, and the intrusion behavior features contained in the intrusion behavior collected from the network information are directly collected into the intrusion behavior database;

[0028] Step A2: If detection and control operations are required, the intrusion behavior feature data contained in the intrusion behavior collected from the network information is compared with the intrusion behavior feature data in the database using formula (2) to obtain the discard value of each intrusion behavior feature data collected from the network information.

[0029]

[0030] Where M(a) represents the control value for discarding the ath intrusion behavior feature data contained in the intrusion behavior collected from network information;

[0031] If M(a)=1, it means that the ath intrusion behavior characteristic data contained in the intrusion behavior collected by the network information is controlled to be discarded;

[0032] If M(a)=0, it means that the ath intrusion behavior feature data contained in the intrusion behavior collected by the network information is discarded without control;

[0033] Step A3: Use formula (3) to determine whether all the intrusion behavior feature data contained in the intrusion behavior collected by the network information have been discarded. If all of them have been discarded, cancel the update of the intrusion behavior database and continue to collect new intrusion behavior through network information.

[0034]

[0035] Where Q represents the cancellation control value of the intrusion behavior database for this update; Z[] represents the zero test function. If the value in the brackets is 0, the function value is 1; if the value in the brackets is not 0, the function value is 0;

[0036] If Q=1, it means canceling the update of the intrusion behavior database and continuing to collect new intrusion behaviors through network information;

[0037] If Q=0, the discarded intrusion behavior feature data is not controlled to be collected into the intrusion behavior database;

[0038] Utilize the increased intrusion behavior feature data to continuously train and update the offline base learner in real time;

[0039] The online base learner is trained incrementally twice by iteratively updating the offline base learner in real time to enhance the capability of the online base learner.

[0040] A home Internet of Things intrusion detection system based on edge-cloud collaboration, the home Internet of Things intrusion detection system comprising:

[0041] An offline base learner establishment module, used to obtain intrusion behavior feature data from an intrusion behavior database and establish an offline base learner using the intrusion behavior feature data;

[0042] An online base learner building module is used to detect intrusion behavior feature data in real time during the operation of the Internet of Things, and to build an online base learner using the real-time intrusion behavior feature data;

[0043] An intrusion detection model building module is used to build an online learning intrusion detection model through an offline base learner and an online base learner;

[0044] The enhanced training module is used to update the intrusion behavior database in real time, and use the intrusion behavior database updated in real time to perform secondary enhanced training on the online base learner.

[0045] Furthermore, the offline base learner establishment module includes:

[0046] A data extraction module, used to extract a plurality of behavior feature data from the intrusion behavior database;

[0047] A deep learning training module, used to train the plurality of behavior feature data using a deep learning model to obtain trained offline data;

[0048] The offline base learner construction module is used to construct an offline base learner using the trained offline data.

[0049] Furthermore, the online base learner establishment module includes:

[0050] A trial operation time setting module is used to set a trial operation monitoring time period according to the actual scale of the Internet of Things before the Internet of Things is put into actual operation; wherein, during the trial operation monitoring time period, logical isolation and physical isolation are set in the trial operation stage of the Internet of Things, so that users in the Internet of Things are allowed to access the external network, but the external network is not allowed to access the internal user network nodes of the Internet of Things;

[0051] A real-time intrusion behavior detection module 1, used to detect real-time network intrusion behavior for the home Internet of Things during the trial operation monitoring period;

[0052] An intrusion behavior characteristic data acquisition module is used to acquire real-time intrusion behavior characteristic data corresponding to the current network intrusion behavior when a network intrusion behavior is detected;

[0053] A plurality of online base learner construction modules, used for constructing a plurality of online base learners using the real-time intrusion behavior feature data;

[0054] A second real-time intrusion behavior detection module is used to implement the formal operation of the Internet of Things after the multiple groups of online base learners are built, and to monitor the intrusion behaviors existing in the Internet of Things in real time during the formal operation, and to obtain the intrusion behavior feature data corresponding to the intrusion behavior in the actual operation process;

[0055] The online training module 1 is used to perform online incremental training on the multiple groups of online base learners using the intrusion behavior feature data in the actual operation process.

[0056] Furthermore, the home Internet of Things intrusion detection method includes:

[0057] An updating module, used to update the intrusion behavior database in real time by means of network information collection, so that the intrusion behavior feature data contained in the intrusion behavior database is continuously increased;

[0058] At the same time, the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information is detected, and the intrusion behavior characteristic data that has been collected into the intrusion behavior database is discarded to prevent the same data from being stored in the database for multiple times and occupying space. The specific steps include:

[0059] Step A1: Using formula (1), first determine whether detection and control operations are required based on the data length of the intrusion behavior feature data contained in the intrusion behavior collected from the network information.

[0060]

[0061] Where E represents the control value of whether the intrusion behavior characteristics contained in the intrusion behavior collected by network information need to be detected; R_a 16 Indicates the hexadecimal form of the ath intrusion behavior feature data contained in the intrusion behavior collected from network information; r_i 16 represents the hexadecimal form of the i-th intrusion behavior feature data in the intrusion behavior database; len() represents the number of data bits of the hexadecimal number in the brackets; m represents the total number of intrusion behavior feature data contained in the intrusion behavior collected by the network information; n represents the total number of intrusion behavior feature data in the intrusion behavior database;

[0062] If E=1, it means that the intrusion behavior characteristics contained in the intrusion behavior collected by the network information need to be detected and controlled, and then continue with step A2 and step A3;

[0063] If E=0, it means that the intrusion behavior features contained in the intrusion behavior collected from the network information do not need to be detected and controlled, so there is no need to perform step A2 and step A3, and the intrusion behavior features contained in the intrusion behavior collected from the network information are directly collected into the intrusion behavior database;

[0064] Step A2: If detection and control operations are required, the intrusion behavior feature data contained in the intrusion behavior collected from the network information is compared with the intrusion behavior feature data in the database using formula (2) to obtain the discard value of each intrusion behavior feature data collected from the network information.

[0065]

[0066] Where M(a) represents the control value for discarding the ath intrusion behavior feature data contained in the intrusion behavior collected from network information;

[0067] If M(a)=1, it means that the ath intrusion behavior characteristic data contained in the intrusion behavior collected by the network information is controlled to be discarded;

[0068] If M(a)=0, it means that the ath intrusion behavior feature data contained in the intrusion behavior collected by the network information is discarded without control;

[0069] Step A3: Use formula (3) to determine whether all the intrusion behavior feature data contained in the intrusion behavior collected by the network information have been discarded. If all of them have been discarded, cancel the update of the intrusion behavior database and continue to collect new intrusion behavior through network information.

[0070]

[0071] Where Q represents the cancellation control value of the intrusion behavior database for this update; Z[] represents the zero test function. If the value in the brackets is 0, the function value is 1; if the value in the brackets is not 0, the function value is 0;

[0072] If Q=1, it means canceling the update of the intrusion behavior database and continuing to collect new intrusion behaviors through network information;

[0073] If Q=0, the discarded intrusion behavior feature data is not controlled to be collected into the intrusion behavior database;

[0074] An offline base learner update training module is used to continuously train and update the offline base learner in real time using the increased intrusion behavior feature data;

[0075] The second online training module is used to perform secondary incremental training on the online base learner by iteratively updating the offline base learner in real time, so as to enhance the capability of the online base learner.

[0076] Beneficial effects of the present invention:

[0077] The present invention proposes a method and system for intrusion detection of home Internet of Things based on edge-cloud collaboration, which meets the requirements of the intrusion system for data timeliness through online learning integration technology, thereby improving the reliability and timeliness of the system. The lightweight intrusion detection system can not only provide global guidance for network security, but also reduce the pressure of network communication transmission and speed up the response speed of intrusion detection. At the same time, the reliability and security of the intrusion detection system are effectively improved by means of online learning and offline learning, and the false alarm rate is effectively reduced. On the other hand, the compatibility of the method and system for intrusion detection of home Internet of Things described in the present invention can be further improved by setting an online base learner and an offline base learner, thereby effectively improving its application generalization. BRIEF DESCRIPTION OF THE DRAWINGS

[0078] Figure 1 is a flow chart of the method of the present invention;

[0079] Figure 2 The system block diagram of the system of the present invention. DETAILED DESCRIPTION

[0080] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0081] The embodiment of the present invention proposes a home IoT intrusion detection method based on edge-cloud collaboration, such as Figure 1 As shown, the home IoT intrusion detection method includes:

[0082] S1. Acquire intrusion behavior feature data from an intrusion behavior database, and establish an offline base learner using the intrusion behavior feature data;

[0083] S2, real-time detection of intrusion behavior feature data during the operation of the Internet of Things, and use of real-time intrusion behavior feature data to establish an online base learner;

[0084] S3, constructing an online learning intrusion detection model through offline base learners and online base learners;

[0085] S4. updating the intrusion behavior database in real time, and performing secondary enhancement training on the online base learner using the intrusion behavior database updated in real time.

[0086] The working principle of the above technical solution is: first, the intrusion behavior feature data is obtained from the intrusion behavior database, and the intrusion behavior feature data is used to establish an offline base learner; then, the intrusion behavior feature data during the operation of the Internet of Things is detected in real time, and the online base learner is established using the real-time intrusion behavior feature data; subsequently, an online learning intrusion detection model is constructed through the offline base learner and the online base learner; finally, the intrusion behavior database is updated in real time, and the online base learner is trained for secondary enhancement using the real-time updated intrusion behavior database.

[0087] The home IoT intrusion detection method based on edge-cloud collaboration proposed in this embodiment uses an online ensemble learning intrusion detection model. First, the offline data is trained using a deep learning model to build an offline base learner; then, multiple groups of online base learners are built based on the continuously supplemented data. The online base learners are obtained through online incremental training, and the online base learner capabilities are enhanced by iterating the offline base learners.

[0088] The effect of the above technical solution is: the home Internet of Things intrusion detection method based on edge-cloud collaboration proposed in this embodiment meets the requirements of the intrusion system for data timeliness through online learning integration technology, thereby improving the reliability and timeliness of the system. The lightweight intrusion detection system can not only provide global guidance for network security, but also reduce the pressure of network communication transmission and speed up the response speed of intrusion detection. At the same time, the reliability and security of the intrusion detection system are effectively improved through the two methods of online learning and offline learning, and the false alarm rate is effectively reduced. On the other hand, the compatibility of the home Internet of Things intrusion detection method described in this embodiment can be further improved by setting an online base learner and an offline base learner, thereby effectively improving its application generalization.

[0089] In one embodiment of the present invention, intrusion behavior feature data is obtained from an intrusion behavior database, and an offline base learner is established using the intrusion behavior feature data, including:

[0090] S101, extracting a plurality of behavior feature data from the intrusion behavior database;

[0091] S102, training the plurality of behavior feature data using a deep learning model to obtain trained offline data;

[0092] S103: construct an offline base learner using the trained offline data.

[0093] The working principle of the above technical solution is: first, extract multiple behavior feature data from the intrusion behavior database; then, use the deep learning model to train the multiple behavior feature data to obtain trained offline data; finally, use the trained offline data to construct an offline base learner.

[0094] The effect of the above technical solution is: the above method can effectively improve the complexity of the offline base learner construction and training process, thereby effectively improving the construction and training efficiency of the offline base learner. At the same time, the above method can effectively improve the reliability and timeliness of the offline base learner while simplifying the training and construction complexity of the offline base learner.

[0095] An embodiment of the present invention detects intrusion behavior feature data in real time during the operation of the Internet of Things, and uses the real-time intrusion behavior feature data to establish an online base learner, including:

[0096] S201. Before the Internet of Things is put into actual operation, a trial operation monitoring period is set according to the actual scale of the Internet of Things; wherein, during the trial operation monitoring period, logical isolation and physical isolation are set in the trial operation stage of the Internet of Things, so that users in the Internet of Things are allowed to access the external network, but the external network is not allowed to access the internal user network nodes of the Internet of Things;

[0097] S202, detecting real-time network intrusion behavior for the home Internet of Things during the trial operation monitoring period;

[0098] S203, when a network intrusion behavior is detected, obtaining real-time intrusion behavior feature data corresponding to the current network intrusion behavior;

[0099] S204, constructing multiple groups of online base learners using the real-time intrusion behavior feature data;

[0100] S205, after the multiple groups of online base learners are constructed, the formal operation of the Internet of Things is implemented, and during the formal operation, the intrusion behaviors existing in the Internet of Things are monitored in real time, and the intrusion behavior feature data corresponding to the intrusion behaviors in the actual operation process are obtained;

[0101] S206: Perform online incremental training on the multiple groups of online base learners using the intrusion behavior feature data in the actual operation process.

[0102] The working principle of the above technical solution is as follows: first, before the Internet of Things is put into actual operation, a trial operation monitoring time period is set according to the actual scale of the Internet of Things; wherein, during the trial operation monitoring time period, logical isolation and physical isolation are set in the trial operation stage of the Internet of Things, so that users in the Internet of Things are allowed to access the external network, but the external network is not allowed to access the internal user network nodes of the Internet of Things; then, during the trial operation monitoring time period, real-time network intrusion behavior is detected for the home Internet of Things; then, when the network intrusion behavior is detected, the real-time intrusion behavior feature data corresponding to the current network intrusion behavior is obtained; then, multiple groups of online base learners are constructed using the real-time intrusion behavior feature data; then, after the multiple groups of online base learners are constructed, the formal operation of the Internet of Things is implemented, and during the formal operation, the intrusion behavior existing in the Internet of Things is monitored in real time, and the intrusion behavior feature data corresponding to the intrusion behavior in the actual operation process is obtained; finally, the multiple groups of online base learners are incrementally trained online using the intrusion behavior feature data in the actual operation process.

[0103] The effect of the above technical solution is: the above method can effectively improve the complexity of the online base learner construction and training process, thereby effectively improving the construction and training efficiency of the online base learner. At the same time, the above method can effectively improve the reliability and timeliness of the online base learner while simplifying the training and construction complexity of the online base learner.

[0104] In one embodiment of the present invention, the real-time updating of the intrusion behavior database and performing secondary enhancement training on the online base learner using the real-time updated intrusion behavior database include:

[0105] S401, updating the intrusion behavior database in real time by means of network information collection, so that the intrusion behavior feature data contained in the intrusion behavior database is continuously increased;

[0106] At the same time, the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information is detected, and the intrusion behavior characteristic data that has been collected into the intrusion behavior database is discarded to prevent the same data from being stored in the database for multiple times and occupying space. The specific steps include:

[0107] Step A1: Using formula (1), first determine whether detection and control operations are required based on the data length of the intrusion behavior feature data contained in the intrusion behavior collected from the network information.

[0108]

[0109] Where E represents the control value of whether the intrusion behavior characteristics contained in the intrusion behavior collected by network information need to be detected; R_a 16 Indicates the hexadecimal form of the ath intrusion behavior feature data contained in the intrusion behavior collected from network information; r_i 16 represents the hexadecimal form of the i-th intrusion behavior feature data in the intrusion behavior database; len() represents the number of data bits of the hexadecimal number in the brackets; m represents the total number of intrusion behavior feature data contained in the intrusion behavior collected by the network information; n represents the total number of intrusion behavior feature data in the intrusion behavior database;

[0110] If E=1, it means that the intrusion behavior characteristics contained in the intrusion behavior collected by the network information need to be detected and controlled, and then continue with step A2 and step A3;

[0111] If E=0, it means that the intrusion behavior features contained in the intrusion behavior collected from the network information do not need to be detected and controlled, so there is no need to perform step A2 and step A3, and the intrusion behavior features contained in the intrusion behavior collected from the network information are directly collected into the intrusion behavior database;

[0112] Step A2: If detection and control operations are required, the intrusion behavior feature data contained in the intrusion behavior collected from the network information is compared with the intrusion behavior feature data in the database using formula (2) to obtain the discard value of each intrusion behavior feature data collected from the network information.

[0113]

[0114] Where M(a) represents the control value for discarding the ath intrusion behavior feature data contained in the intrusion behavior collected from network information;

[0115] If M(a)=1, it means that the ath intrusion behavior characteristic data contained in the intrusion behavior collected by the network information is controlled to be discarded;

[0116] If M(a)=0, it means that the ath intrusion behavior feature data contained in the intrusion behavior collected by the network information is discarded without control;

[0117] Step A3: Use formula (3) to determine whether all the intrusion behavior feature data contained in the intrusion behavior collected by the network information have been discarded. If all of them have been discarded, cancel the update of the intrusion behavior database and continue to collect new intrusion behavior through network information.

[0118]

[0119] Where Q represents the cancellation control value of the intrusion behavior database for this update; Z[] represents the zero test function. If the value in the brackets is 0, the function value is 1; if the value in the brackets is not 0, the function value is 0;

[0120] If Q=1, it means canceling the update of the intrusion behavior database and continuing to collect new intrusion behaviors through network information;

[0121] If Q=0, the discarded intrusion behavior feature data is not controlled to be collected into the intrusion behavior database;

[0122] S402, using the increased intrusion behavior feature data to continuously train and update the offline base learner in real time;

[0123] S403, performing secondary incremental training on the online base learner through the iterative real-time updated offline base learner to enhance the capability of the online base learner.

[0124] The working principle of the above technical solution is: first, the intrusion behavior database is updated in real time through network information collection, so that the intrusion behavior feature data contained in the intrusion behavior database is continuously increased; then, the increased intrusion behavior feature data is used to continuously train and update the offline base learner in real time; finally, the online base learner is incrementally trained twice by iteratively updating the offline base learner in real time to enhance the ability of the online base learner.

[0125] The effect of the above technical solution is: by updating the intrusion behavior database and updating the offline base learner to perform secondary reinforcement training on the online base learner, the reliability and timeliness of the online base learner can be effectively improved, thereby improving the reliability of the overall intrusion detection. It can not only provide global guidance for network security, but also reduce the pressure on network communication transmission and speed up the response speed of intrusion detection.

[0126] At the same time, the formula (1) of step A1 is used to first determine whether a detection and control operation is required based on the data length of the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information, so that when the detection and control operation is not required, the intrusion behavior characteristic data is automatically collected into the intrusion behavior database to prevent unnecessary calculation of the working efficiency of the imaging system; then, the formula (2) of step A2 is used to compare the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information with the intrusion behavior characteristic data in the database to obtain a discard value for each intrusion behavior characteristic data collected from the network information, so that the intrusion behavior characteristic data already in the database is discarded to prevent the same data from being stored in the database multiple times and occupying space; finally, the formula (3) of step A3 is used to determine whether all the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information are discarded. If all are discarded, the update of the intrusion behavior database is canceled, and new intrusion behaviors are continuously collected through network information to prevent the operation step of updating the intrusion behavior database from being started when no data is entered, resulting in useless control and processing.

[0127] The embodiment of the present invention proposes a home IoT intrusion detection system based on edge-cloud collaboration, such as Figure 2 As shown, the home Internet of Things intrusion detection system includes:

[0128] An offline base learner establishment module, used to obtain intrusion behavior feature data from an intrusion behavior database and establish an offline base learner using the intrusion behavior feature data;

[0129] An online base learner building module is used to detect intrusion behavior feature data in real time during the operation of the Internet of Things, and to build an online base learner using the real-time intrusion behavior feature data;

[0130] An intrusion detection model building module is used to build an online learning intrusion detection model through an offline base learner and an online base learner;

[0131] The enhanced training module is used to update the intrusion behavior database in real time, and use the intrusion behavior database updated in real time to perform secondary enhanced training on the online base learner.

[0132] The working principle of the above technical solution is: first, the intrusion behavior feature data is obtained from the intrusion behavior database through the offline base learner establishment module, and the offline base learner is established using the intrusion behavior feature data; then, the online base learner establishment module is used to detect the intrusion behavior feature data in the operation process of the Internet of Things in real time, and the online base learner is established using the real-time intrusion behavior feature data; then, the intrusion detection model construction module is used to construct an online learning intrusion detection model through the offline base learner and the online base learner; finally, the intrusion behavior database is updated in real time using the enhancement training module, and the online base learner is subjected to secondary enhancement training using the real-time updated intrusion behavior database.

[0133] The home IoT intrusion detection system based on edge-cloud collaboration proposed in this embodiment uses an online ensemble learning intrusion detection model. First, the offline data is trained using a deep learning model to build an offline base learner; then, multiple groups of online base learners are built based on the continuously supplemented data. The online base learners are obtained through online incremental training, and the online base learner capabilities are enhanced by iterating the offline base learners.

[0134] The effect of the above technical solution is: a home Internet of Things intrusion detection system based on edge-cloud collaboration proposed in this embodiment meets the requirements of the intrusion system for data timeliness through online learning integration technology, thereby improving the reliability and timeliness of the system. The lightweight intrusion detection system can not only provide global guidance for network security, but also reduce the pressure of network communication transmission and speed up the response speed of intrusion detection. At the same time, the reliability and security of the intrusion detection system are effectively improved by both online learning and offline learning, and the false alarm rate is effectively reduced. On the other hand, the setting of online base learners and offline base learners can further improve the compatibility of the home Internet of Things intrusion detection system described in this embodiment, thereby effectively improving its application generalization.

[0135] In one embodiment of the present invention, the offline base learner establishment module includes:

[0136] A data extraction module, used to extract a plurality of behavior feature data from the intrusion behavior database;

[0137] A deep learning training module, used to train the plurality of behavior feature data using a deep learning model to obtain trained offline data;

[0138] The offline base learner construction module is used to construct an offline base learner using the trained offline data.

[0139] The working principle of the above technical solution is: first, use the data extraction module to extract multiple behavior feature data from the intrusion behavior database; then, use the deep learning model through the deep learning training module to train the multiple behavior feature data to obtain trained offline data; finally, use the offline base learner construction module to construct an offline base learner using the trained offline data.

[0140] The effect of the above technical solution is: the above method can effectively improve the complexity of the offline base learner construction and training process, thereby effectively improving the construction and training efficiency of the offline base learner. At the same time, the above method can effectively improve the reliability and timeliness of the offline base learner while simplifying the training and construction complexity of the offline base learner.

[0141] In one embodiment of the present invention, the online base learner establishment module includes:

[0142] A trial operation time setting module is used to set a trial operation monitoring time period according to the actual scale of the Internet of Things before the Internet of Things is put into actual operation; wherein, during the trial operation monitoring time period, logical isolation and physical isolation are set in the trial operation stage of the Internet of Things, so that users in the Internet of Things are allowed to access the external network, but the external network is not allowed to access the internal user network nodes of the Internet of Things;

[0143] A real-time intrusion behavior detection module 1, used to detect real-time network intrusion behavior for the home Internet of Things during the trial operation monitoring period;

[0144] An intrusion behavior characteristic data acquisition module is used to acquire real-time intrusion behavior characteristic data corresponding to the current network intrusion behavior when a network intrusion behavior is detected;

[0145] A plurality of online base learner construction modules, used for constructing a plurality of online base learners using the real-time intrusion behavior feature data;

[0146] A second real-time intrusion behavior detection module is used to implement the formal operation of the Internet of Things after the multiple groups of online base learners are built, and to monitor the intrusion behaviors existing in the Internet of Things in real time during the formal operation, and to obtain the intrusion behavior feature data corresponding to the intrusion behavior in the actual operation process;

[0147] The online training module 1 is used to perform online incremental training on the multiple groups of online base learners using the intrusion behavior feature data in the actual operation process.

[0148] The working principle of the above technical solution is as follows: Step 1, before the Internet of Things is put into actual operation, a trial operation monitoring time period is set according to the actual scale of the Internet of Things by using a trial operation time setting module; wherein, during the trial operation monitoring time period, logical isolation and physical isolation are set in the trial operation stage of the Internet of Things, so that users in the Internet of Things are allowed to access the external network, but the external network is not allowed to access the internal user network nodes of the Internet of Things;

[0149] Step 2, using the real-time intrusion behavior detection module 1 to detect real-time network intrusion behavior for the home Internet of Things during the trial operation monitoring period;

[0150] Step 3, when a network intrusion behavior is detected, the intrusion behavior characteristic data acquisition module acquires real-time intrusion behavior characteristic data corresponding to the current network intrusion behavior;

[0151] Step 4, using multiple groups of online base learner construction modules to construct multiple groups of online base learners using the real-time intrusion behavior feature data;

[0152] Step 5, using the real-time intrusion behavior detection module 2 to implement the formal operation of the Internet of Things after the multiple groups of online base learners are built, and monitor the intrusion behaviors existing in the Internet of Things in real time during the formal operation, and obtain the intrusion behavior feature data corresponding to the intrusion behavior in the actual operation process;

[0153] Step 6: Perform online incremental training on the multiple groups of online base learners using the intrusion behavior feature data in the actual operation process through the online training module 1.

[0154] The effect of the above technical solution is: the above method can effectively improve the complexity of the online base learner construction and training process, thereby effectively improving the construction and training efficiency of the online base learner. At the same time, the above method can effectively improve the reliability and timeliness of the online base learner while simplifying the training and construction complexity of the online base learner.

[0155] In one embodiment of the present invention, the enhanced training module includes:

[0156] An updating module, used to update the intrusion behavior database in real time by means of network information collection, so that the intrusion behavior feature data contained in the intrusion behavior database is continuously increased;

[0157] At the same time, the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information is detected, and the intrusion behavior characteristic data that has been collected into the intrusion behavior database is discarded to prevent the same data from being stored in the database for multiple times and occupying space. The specific steps include:

[0158] Step A1: Using formula (1), first determine whether detection and control operations are required based on the data length of the intrusion behavior feature data contained in the intrusion behavior collected from the network information.

[0159]

[0160] Where E represents the control value of whether the intrusion behavior characteristics contained in the intrusion behavior collected by network information need to be detected; R_a 16 Indicates the hexadecimal form of the ath intrusion behavior feature data contained in the intrusion behavior collected from network information; r_i 16 represents the hexadecimal form of the i-th intrusion behavior feature data in the intrusion behavior database; len() represents the number of data bits of the hexadecimal number in the brackets; m represents the total number of intrusion behavior feature data contained in the intrusion behavior collected by the network information; n represents the total number of intrusion behavior feature data in the intrusion behavior database;

[0161] If E=1, it means that the intrusion behavior characteristics contained in the intrusion behavior collected by the network information need to be detected and controlled, and then continue with step A2 and step A3;

[0162] If E=0, it means that the intrusion behavior features contained in the intrusion behavior collected from the network information do not need to be detected and controlled, so there is no need to perform step A2 and step A3, and the intrusion behavior features contained in the intrusion behavior collected from the network information are directly collected into the intrusion behavior database;

[0163] Step A2: If detection and control operations are required, the intrusion behavior feature data contained in the intrusion behavior collected from the network information is compared with the intrusion behavior feature data in the database using formula (2) to obtain the discard value of each intrusion behavior feature data collected from the network information.

[0164]

[0165] Where M(a) represents the control value for discarding the ath intrusion behavior feature data contained in the intrusion behavior collected from network information;

[0166] If M(a)=1, it means that the ath intrusion behavior characteristic data contained in the intrusion behavior collected by the network information is controlled to be discarded;

[0167] If M(a)=0, it means that the ath intrusion behavior feature data contained in the intrusion behavior collected by the network information is discarded without control;

[0168] Step A3: Use formula (3) to determine whether all the intrusion behavior feature data contained in the intrusion behavior collected by the network information have been discarded. If all of them have been discarded, cancel the update of the intrusion behavior database and continue to collect new intrusion behavior through network information.

[0169]

[0170] Where Q represents the cancellation control value of the intrusion behavior database for this update; Z[] represents the zero test function. If the value in the brackets is 0, the function value is 1; if the value in the brackets is not 0, the function value is 0;

[0171] If Q=1, it means canceling the update of the intrusion behavior database and continuing to collect new intrusion behaviors through network information;

[0172] If Q=0, the discarded intrusion behavior feature data is not controlled to be collected into the intrusion behavior database;

[0173] An offline base learner update training module is used to continuously train and update the offline base learner in real time using the increased intrusion behavior feature data;

[0174] The second online training module is used to perform secondary incremental training on the online base learner by iteratively updating the offline base learner in real time, so as to enhance the capability of the online base learner.

[0175] The working principle of the above technical solution is: first, using the update module to update the intrusion behavior database in real time through network information collection, so that the intrusion behavior feature data contained in the intrusion behavior database is continuously increased; then, using the offline base learner to update the training module, it is used to continuously train and update the offline base learner in real time using the increased intrusion behavior feature data; finally, using the online training module 2 to perform secondary incremental training on the online base learner through the iterative real-time updated offline base learner, so as to enhance the ability of the online base learner.

[0176] The effect of the above technical solution is: by updating the intrusion behavior database and updating the offline base learner to perform secondary reinforcement training on the online base learner, the reliability and timeliness of the online base learner can be effectively improved, thereby improving the reliability of the overall intrusion detection. It can not only provide global guidance for network security, but also reduce the pressure on network communication transmission and speed up the response speed of intrusion detection.

[0177] At the same time, the formula (1) of step A1 is used to first determine whether a detection and control operation is required based on the data length of the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information, so that when the detection and control operation is not required, the intrusion behavior characteristic data is automatically collected into the intrusion behavior database to prevent unnecessary calculation of the working efficiency of the imaging system; then, the formula (2) of step A2 is used to compare the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information with the intrusion behavior characteristic data in the database to obtain a discard value for each intrusion behavior characteristic data collected from the network information, so that the intrusion behavior characteristic data already in the database is discarded to prevent the same data from being stored in the database multiple times and occupying space; finally, the formula (3) of step A3 is used to determine whether all the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information are discarded. If all are discarded, the update of the intrusion behavior database is canceled, and new intrusion behaviors are continuously collected through network information to prevent the operation step of updating the intrusion behavior database from being started when no data is entered, resulting in useless control and processing.

[0178] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A home IoT intrusion detection method based on edge-cloud collaboration, characterized in that: The home internet of things intrusion detection method comprises: Acquire intrusion behavior feature data from an intrusion behavior database, and establish an offline base learner using the intrusion behavior feature data; Real-time detection of intrusion behavior feature data during the operation of the Internet of Things, and use of real-time intrusion behavior feature data to establish an online base learner; Construct an online learning intrusion detection model through offline base learners and online base learners; updating the intrusion behavior database in real time, and performing secondary enhancement training on the online base learner using the intrusion behavior database updated in real time; The real-time updating of the intrusion behavior database and performing secondary enhancement training on the online base learner using the real-time updated intrusion behavior database include: The intrusion behavior database is updated in real time by means of network information collection, so that the intrusion behavior characteristic data contained in the intrusion behavior database is continuously increased; At the same time, the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information is detected, and the intrusion behavior characteristic data that has been collected into the intrusion behavior database is discarded to prevent the same data from being stored in the database for multiple times and occupying space. The specific steps include: Step A1: Using formula (1), first determine whether detection and control operations are required based on the data length of the intrusion behavior feature data contained in the intrusion behavior collected from the network information. Where E represents the control value of whether the intrusion behavior characteristics contained in the intrusion behavior collected by network information need to be detected; R_a 16 Indicates the hexadecimal form of the ath intrusion behavior feature data contained in the intrusion behavior collected from network information; r_i 16 represents the hexadecimal form of the i-th intrusion behavior feature data in the intrusion behavior database; len() represents the number of data bits of the hexadecimal number in the brackets; m represents the total number of intrusion behavior feature data contained in the intrusion behavior collected by the network information; n represents the total number of intrusion behavior feature data in the intrusion behavior database; If E=1, it means that the intrusion behavior characteristics contained in the intrusion behavior collected by the network information need to be detected and controlled, and then continue with step A2 and step A3; If E=0, it means that the intrusion behavior features contained in the intrusion behavior collected from the network information do not need to be detected and controlled, so there is no need to perform step A2 and step A3, and the intrusion behavior features contained in the intrusion behavior collected from the network information are directly collected into the intrusion behavior database; Step A2: If detection and control operations are required, the intrusion behavior feature data contained in the intrusion behavior collected from the network information is compared with the intrusion behavior feature data in the database using formula (2) to obtain the discard value of each intrusion behavior feature data collected from the network information. Where M(a) represents the control value corresponding to discarding the ath intrusion behavior feature data contained in the intrusion behavior collected from network information; If M(a)=1, it means that the ath intrusion behavior characteristic data contained in the intrusion behavior collected from the network information is discarded; If M(a)=0, it means that the ath intrusion behavior feature data contained in the intrusion behavior collected from the network information is discarded without control; Step A3: Use formula (3) to determine whether all the intrusion behavior feature data contained in the intrusion behavior collected by the network information have been discarded. If all of them have been discarded, cancel the update of the intrusion behavior database and continue to collect new intrusion behavior through network information. Where Q represents the cancellation control value of the intrusion behavior database for this update; Z[] represents the zero test function. If the value in the brackets is 0, the function value is 1; if the value in the brackets is not 0, the function value is 0; If Q=1, it means canceling the update of the intrusion behavior database and continuing to collect new intrusion behaviors through network information; If Q=0, it means that the intrusion behavior feature data that is not controlled to be discarded is collected into the intrusion behavior database; Utilize the increased intrusion behavior feature data to continuously train and update the offline base learner in real time; The online base learner is trained incrementally twice by iteratively updating the offline base learner in real time to enhance the capability of the online base learner.

2. The method for detecting intrusion into the home Internet of Things according to claim 1, characterized in that: Acquire intrusion behavior feature data from an intrusion behavior database, and use the intrusion behavior feature data to establish an offline base learner, including: Extracting a plurality of behavior feature data from the intrusion behavior database; Using a deep learning model to train the plurality of behavior feature data to obtain trained offline data; An offline base learner is constructed using the trained offline data.

3. The method for detecting intrusion in the home Internet of Things according to claim 1, characterized in that: Real-time detection of intrusion behavior feature data during the operation of the Internet of Things, and use of real-time intrusion behavior feature data to establish an online base learner, including: Before the Internet of Things is put into actual operation, a trial operation monitoring period is set according to the actual scale of the Internet of Things; wherein, during the trial operation monitoring period, logical isolation and physical isolation are set in the trial operation stage of the Internet of Things, so that users in the Internet of Things are allowed to access the external network, but the external network is not allowed to access the internal user network nodes of the Internet of Things; During the trial operation monitoring period, detecting real-time network intrusion behavior for the home Internet of Things; When a network intrusion behavior is detected, real-time intrusion behavior feature data corresponding to the current network intrusion behavior is obtained; Using the real-time intrusion behavior feature data to construct multiple groups of online base learners; After the multiple groups of online base learners are constructed, the Internet of Things is formally operated, and during the formal operation, intrusion behaviors existing in the Internet of Things are monitored in real time, and intrusion behavior feature data corresponding to the intrusion behaviors in the actual operation process are obtained; The multiple groups of online base learners are trained online incrementally using the intrusion behavior feature data in the actual operation process.

4. A home IoT intrusion detection system based on edge-cloud collaboration, characterized in that: The home Internet of Things intrusion detection system comprises: An offline base learner establishment module, used to obtain intrusion behavior feature data from an intrusion behavior database and establish an offline base learner using the intrusion behavior feature data; An online base learner building module is used to detect intrusion behavior feature data in real time during the operation of the Internet of Things, and to build an online base learner using the real-time intrusion behavior feature data; An intrusion detection model building module is used to build an online learning intrusion detection model through an offline base learner and an online base learner; An enhanced training module, used for updating the intrusion behavior database in real time, and performing secondary enhanced training on the online base learner using the intrusion behavior database updated in real time; Wherein, the enhanced training module includes: An updating module, used to update the intrusion behavior database in real time by means of network information collection, so that the intrusion behavior feature data contained in the intrusion behavior database is continuously increased; At the same time, the intrusion behavior characteristic data contained in the intrusion behavior collected from the network information is detected, and the intrusion behavior characteristic data that has been collected into the intrusion behavior database is discarded to prevent the same data from being stored in the database for multiple times and occupying space. The specific steps include: Step A1: Using formula (1), first determine whether detection and control operations are required based on the data length of the intrusion behavior feature data contained in the intrusion behavior collected from the network information. Where E represents the control value of whether the intrusion behavior characteristics contained in the intrusion behavior collected by network information need to be detected; R_a 16 Indicates the hexadecimal form of the ath intrusion behavior feature data contained in the intrusion behavior collected from network information; r_i 16 represents the hexadecimal form of the i-th intrusion behavior feature data in the intrusion behavior database; len() represents the number of data bits of the hexadecimal number in the brackets; m represents the total number of intrusion behavior feature data contained in the intrusion behavior collected by the network information; n represents the total number of intrusion behavior feature data in the intrusion behavior database; If E=1, it means that the intrusion behavior characteristics contained in the intrusion behavior collected by the network information need to be detected and controlled, and then continue with step A2 and step A3; If E=0, it means that the intrusion behavior features contained in the intrusion behavior collected from the network information do not need to be detected and controlled, so there is no need to perform step A2 and step A3, and the intrusion behavior features contained in the intrusion behavior collected from the network information are directly collected into the intrusion behavior database; Step A2: If detection and control operations are required, the intrusion behavior feature data contained in the intrusion behavior collected from the network information is compared with the intrusion behavior feature data in the database using formula (2) to obtain the discard value of each intrusion behavior feature data collected from the network information. Where M(a) represents the control value corresponding to discarding the ath intrusion behavior feature data contained in the intrusion behavior collected from network information; If M(a)=1, it means that the ath intrusion behavior characteristic data contained in the intrusion behavior collected from the network information is discarded; If M(a)=0, it means that the ath intrusion behavior feature data contained in the intrusion behavior collected from the network information is discarded without control; Step A3: Use formula (3) to determine whether all the intrusion behavior feature data contained in the intrusion behavior collected by the network information have been discarded. If all of them have been discarded, cancel the update of the intrusion behavior database and continue to collect new intrusion behavior through network information. Where Q represents the cancellation control value of the intrusion behavior database for this update; Z[] represents the zero test function. If the value in the brackets is 0, the function value is 1; if the value in the brackets is not 0, the function value is 0; If Q=1, it means canceling the update of the intrusion behavior database and continuing to collect new intrusion behaviors through network information; If Q=0, the intrusion behavior feature data that is not controlled to be discarded is collected into the intrusion behavior database; An offline base learner update training module is used to continuously train and update the offline base learner in real time using the increased intrusion behavior feature data; The second online training module is used to perform secondary incremental training on the online base learner by iteratively updating the offline base learner in real time, so as to enhance the capability of the online base learner.

5. The home Internet of Things intrusion detection system according to claim 4 is characterized in that: The offline base learner establishment module includes: A data extraction module, used to extract a plurality of behavior feature data from the intrusion behavior database; A deep learning training module, used to train the plurality of behavior feature data using a deep learning model to obtain trained offline data; The offline base learner construction module is used to construct an offline base learner using the trained offline data.

6. The home Internet of Things intrusion detection system according to claim 4, characterized in that: The online base learner establishment module includes: A trial operation time setting module is used to set a trial operation monitoring time period according to the actual scale of the Internet of Things before the Internet of Things is put into actual operation; wherein, during the trial operation monitoring time period, logical isolation and physical isolation are set in the trial operation stage of the Internet of Things, so that users in the Internet of Things are allowed to access the external network, but the external network is not allowed to access the internal user network nodes of the Internet of Things; A real-time intrusion behavior detection module 1 is used to detect real-time network intrusion behavior for the home Internet of Things during the trial operation monitoring period; An intrusion behavior characteristic data acquisition module is used to acquire real-time intrusion behavior characteristic data corresponding to the current network intrusion behavior when a network intrusion behavior is detected; A plurality of online base learner construction modules are used to construct a plurality of online base learners using the real-time intrusion behavior feature data; A second real-time intrusion behavior detection module is used to implement the formal operation of the Internet of Things after the multiple groups of online base learners are built, and to monitor the intrusion behaviors existing in the Internet of Things in real time during the formal operation, and to obtain the intrusion behavior feature data corresponding to the intrusion behavior in the actual operation process; The online training module 1 is used to perform online incremental training on the multiple groups of online base learners using the intrusion behavior feature data in the actual operation process.

Images