A Hybrid Model-Based IoT Intrusion Detection Method and System

Abstract

The present invention provides an Internet of Things (IoT) intrusion detection method and system based on a hybrid model, belonging to the field of network security technology. The method and system include: preprocessing IoT input data to obtain IoT preprocessed data; using an information gain algorithm and a fast filtering algorithm to perform feature selection on the IoT preprocessed data to obtain target feature data; training and learning the target feature data using a random forest algorithm based on a feature model, and training and learning the target feature data using a convolutional neural network and a long short-term memory network based on an anomaly model, using a preset public data set for training and testing to obtain a hybrid IoT intrusion detection model; inputting the IoT input data to be detected into the hybrid IoT intrusion detection model, and outputting IoT intrusion detection results. By applying a hybrid IoT intrusion detection model, the present invention achieves both high detection efficiency and the ability to detect unknown attacks, compared to a single detection model.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an IoT intrusion detection method and system based on a hybrid model. Background Technology

[0002] The rapid development of the Internet of Things (IoT) has driven the widespread adoption of various smart city applications. Today, connecting IoT devices (such as smart home devices, connected vehicles, and industrial equipment) to the internet is an inevitable trend. However, due to limited hardware resources and a lack of security infrastructure, these devices are vulnerable to cyberattacks. On the one hand, hackers can remotely access and control these IoT devices via the internet. On the other hand, the widespread use of unencrypted communication protocols by many IoT devices provides opportunities for hackers to intercept and tamper with data.

[0003] In the context of IoT security, vulnerabilities in individual devices can easily become the entry point for compromised IoT security. Furthermore, by exploiting these vulnerabilities, hackers can also compromise the software controlling the device, turning it into a botnet, causing data loss, system malfunctions, and even the leakage of critical personal information. Most IoT devices lack security protection, making them vulnerable to attacks from the network layer. Among these network layer attacks, denial-of-service and botnet attacks are particularly dangerous due to their large scale and stealth. Through these attacks, IoT devices may exhibit abnormal behavior after being compromised by hackers. Once hackers gain control, the resulting damage can be catastrophic. To protect the IoT and its devices, one of the more effective measures currently is to establish intrusion detection systems (IDS) on IoT networks. As a relatively well-performing type of IDS, AI-based IDS can effectively detect network traffic and differentiate malicious traffic. Based on their detection methods, IDS are categorized into hybrid, feature-based, and anomaly-based IDS. While feature-based IDS can detect known attacks with high accuracy, they cannot detect unknown or new (zero-day) attacks. Meanwhile, the main drawback of anomaly-based IDS is its high false positive rate.

[0004] In recent years, the rise of machine learning technology has spurred the development of intrusion detection systems. Many intrusion detection systems combine with related machine learning techniques to improve detection efficiency and accuracy. For example, many supervised learning algorithms, such as Support Vector Machines (SVMs), extreme gradient boosting, and gradient boosting decision trees, are applied in these systems. These algorithms are all single-classifier models and each has its own drawbacks. Support Vector Machines are not suitable for large-scale training datasets and struggle with multi-class problems. Extreme gradient boosting is unsuitable for handling ultra-high-dimensional feature data. Gradient boosting decision trees are prone to overfitting and neglect the correlation between elements in the dataset.

[0005] To address the shortcomings of the aforementioned detection methods, it is necessary to propose a comprehensive detection method that combines the advantages of each method in order to cope with the increasingly complex IoT intrusion detection scenarios. Summary of the Invention

[0006] This invention provides an IoT intrusion detection method and system based on a hybrid model, which addresses the shortcomings of existing technologies that apply individual detection methods separately for IoT intrusion detection.

[0007] In a first aspect, the present invention provides an IoT intrusion detection method based on a hybrid model, comprising:

[0008] Acquire IoT input data, preprocess the IoT input data, and obtain IoT preprocessed data;

[0009] The information gain algorithm and the fast filtering algorithm are used to select features from the IoT preprocessed data to obtain target feature data;

[0010] The target feature data is trained and learned using a random forest algorithm based on a feature model, and a convolutional neural network and a long short-term memory network based on anomaly models. The target feature data is trained and learned using a preset public dataset to obtain a hybrid IoT intrusion detection model.

[0011] The IoT intrusion detection model inputs the IoT data to be detected and outputs the IoT intrusion detection results.

[0012] According to the present invention, an IoT intrusion detection method based on a hybrid model acquires IoT input data, preprocesses the IoT input data to obtain IoT preprocessed data, including:

[0013] The IoT input data is one-hot encoded to obtain one-hot encoded data;

[0014] Oversampled data is obtained from the one-hot encoded data, the neighboring data frames of the one-hot encoded data, and a preset random number;

[0015] The oversampled data is standardized by using the characteristic mean and the characteristic standard deviation to obtain standardized data.

[0016] The standardized data is processed using the K-means clustering algorithm to obtain the IoT preprocessed data.

[0017] According to the present invention, an IoT intrusion detection method based on a hybrid model employs an information gain algorithm and a fast filtering algorithm to select features from the preprocessed IoT data to obtain target feature data, including:

[0018] Determine the target variable information and feature variable information of the IoT preprocessed data;

[0019] The information gain between the target variable information and the feature variable information is obtained by subtracting the posterior uncertainty of the received feature variable information from the uncertainty before sending the target variable information.

[0020] The uncertain correlation between the target variable information and the feature variable information is obtained from the information gain, the uncertainty before sending the target variable information, and the uncertainty before sending the feature variable information;

[0021] A preset feature relevance threshold is determined using a Bayesian optimization-Gaussian process, and feature variable information that is greater than the preset feature relevance threshold is filtered out.

[0022] Arrange the uncertain correlations in descending order from largest to smallest, and calculate the uncertain correlations between each feature variable and all other feature variables with uncertainties smaller than the uncertainty.

[0023] The target feature data is obtained by identifying the feature variable information whose uncertain correlation with all other feature variable information is greater than the uncertain correlation between all other feature variable information and feature variable information.

[0024] According to the present invention, an IoT intrusion detection method based on a hybrid model is provided, wherein a random forest algorithm based on a feature model is used to train and learn the target feature data, including:

[0025] A number of training samples are randomly selected from the target feature data, and a sub-model is trained using the number of training samples.

[0026] The classification result is determined by voting, with the sub-model receiving the most votes being used as the final classification result.

[0027] The classification results are labeled using the random forest algorithm to obtain normal traffic classification results, known malicious traffic classification results, and unknown malicious traffic classification results.

[0028] According to the present invention, an IoT intrusion detection method based on a hybrid model is provided, which trains and learns the target feature data using a convolutional neural network based on an anomaly model and a long short-term memory network, including:

[0029] The unknown malicious traffic classification results are sequentially input into the convolutional kernel and preset activation function of the convolutional neural network for processing to determine which data to retain and which data to discard.

[0030] The temporal information from both the retained and discarded data is input into the fully connected layer of the Long Short-Term Memory network and a preset activation function for processing to obtain the final traffic classification result.

[0031] According to the present invention, an IoT intrusion detection method based on a hybrid model is obtained by training and testing using a pre-set public dataset, comprising:

[0032] Obtain the NSL-KDD dataset, CICIDS2018 dataset, and Bot-IoT dataset;

[0033] The NSL-KDD dataset, the CICIDS2018 dataset, and the Bot-IoT dataset are divided into training set, validation set, and test set according to a preset partitioning ratio.

[0034] The hybrid IoT intrusion detection model is obtained by training and testing using the training set, the validation set, and the test set.

[0035] Secondly, the present invention also provides an IoT intrusion detection system based on a hybrid model, comprising:

[0036] The preprocessing module is used to acquire IoT input data, preprocess the IoT input data, and obtain IoT preprocessed data.

[0037] The selection module is used to perform feature selection on the IoT preprocessed data using information gain algorithm and fast filtering algorithm to obtain target feature data;

[0038] The training module is used to train and learn the target feature data using a random forest algorithm based on a feature model, a convolutional neural network and a long short-term memory network based on an anomaly model, and to train and test the target feature data using a preset public dataset to obtain a hybrid IoT intrusion detection model.

[0039] The processing module is used to input the IoT input data to be detected into the hybrid IoT intrusion detection model and output the IoT intrusion detection result.

[0040] Thirdly, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the IoT intrusion detection method based on the hybrid model as described above.

[0041] Fourthly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the IoT intrusion detection method based on the hybrid model as described above.

[0042] Fifthly, the present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the IoT intrusion detection method based on the hybrid model as described above.

[0043] The IoT intrusion detection method and system based on a hybrid model provided by this invention achieves both high detection efficiency and the ability to detect unknown attacks by applying a hybrid IoT intrusion detection model compared to a single detection model. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0045] Figure 1 This is an application scenario diagram of the IoT intrusion detection system provided by the present invention;

[0046] Figure 2 This is one of the flowcharts of the IoT intrusion detection method based on a hybrid model provided by the present invention;

[0047] Figure 3 This is the second flowchart of the IoT intrusion detection method based on a hybrid model provided by the present invention;

[0048] Figure 4 This is the feature model-based structure diagram provided by the present invention;

[0049] Figure 5 This is the anomaly model-based structure diagram provided by the present invention;

[0050] Figure 6 This is a schematic diagram of the structure of the IoT intrusion detection system based on a hybrid model provided by the present invention;

[0051] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0053] With the popularization of IoT technology, a large number of devices are connected to the network. IoT transmits data through diverse network connections, enabling remote control and maintenance. While IoT brings great convenience, the probability of attacks on IoT devices and themselves is also increasing significantly. IoT devices and networks are vulnerable to denial-of-service attacks and botnet attacks. To defend against these attacks, IoT intrusion detection systems are typically installed at the control center and gateway connection points for the following reasons: 1) Because most hackers use remote attacks (illegal access, impersonation attacks, denial-of-service attacks, etc.) to gain control of IoT devices, special attention should be paid to traffic from external networks. The system needs to be able to detect traffic from external networks. 2) Since hackers can compromise IoT networks by intruding into physical devices (brute force, illegal access, etc.), the system also needs to detect traffic from internal networks. 3) Once the system detects malicious traffic, it needs to issue an alert, requiring control center administrators to promptly detect and handle it, such as... Figure 1 As shown.

[0054] Figure 2 This is one of the flowcharts of the IoT intrusion detection method based on a hybrid model provided in this embodiment of the invention, such as... Figure 2 Shown, including:

[0055] Step 100: Obtain IoT input data, preprocess the IoT input data to obtain IoT preprocessed data;

[0056] Step 200: Use the information gain algorithm and the fast filtering algorithm to select features from the IoT preprocessed data to obtain target feature data;

[0057] Step 300: The target feature data is trained and learned using the random forest algorithm based on the feature model, and the target feature data is trained and learned using the convolutional neural network and long short-term memory network based on the anomaly model. The model is trained and tested using a preset public dataset to obtain a hybrid IoT intrusion detection model.

[0058] Step 400: Input the IoT input data to be detected into the hybrid IoT intrusion detection model and output the IoT intrusion detection result.

[0059] Specifically, such as Figure 3As shown, the first step involves acquiring IoT input data, which undergoes a series of preprocessing steps, including data standardization, oversampling, one-hot encoding, and K-means clustering, to obtain preprocessed IoT data. Then, feature selection is performed using information gain and fast filtering algorithms to obtain target feature data. Further, a feature-model-based random forest algorithm is used to train the target feature data, yielding normal classification results, known attack / malicious classification results, and unknown attack / malicious classification results. The unknown attack / malicious classification results are then input into a convolutional neural network and a long short-term memory network based on anomaly models for further training, resulting in normal or malicious classification results. Finally, the model is trained and tested using a publicly available dataset divided into training, validation, and test sets, resulting in a hybrid IoT intrusion detection model. In practical applications, the IoT input data to be detected is input into the hybrid IoT intrusion detection model to output the IoT intrusion detection results.

[0060] This invention applies a hybrid IoT intrusion detection model. Compared to a single detection model, the hybrid model can achieve both high detection efficiency and the ability to detect unknown attacks.

[0061] Based on the above embodiments, IoT input data is acquired, and the IoT input data is preprocessed to obtain IoT preprocessed data, including:

[0062] The IoT input data is one-hot encoded to obtain one-hot encoded data;

[0063] Oversampled data is obtained from the one-hot encoded data, the neighboring data frames of the one-hot encoded data, and a preset random number;

[0064] The oversampled data is standardized by using the characteristic mean and the characteristic standard deviation to obtain standardized data.

[0065] The standardized data is processed using the K-means clustering algorithm to obtain the IoT preprocessed data.

[0066] Specifically, the IoT input data acquired by the system needs to undergo data cleaning first, removing data with missing values. Since some features are in character format and the number of data points in each category of the training data is unbalanced, which is not conducive to subsequent computation and processing, one-hot encoding and oversampling are required for the input data.

[0067] y i =OenHot(x i )

[0068] y new =y i +β×(y0-y i)

[0069] Where OneHot represents one-hot encoding, x i Let y represent the i-th data item. i This represents the data after one-hot encoding, y new This represents the new data obtained after sampling processing; y0 is derived from y i β is randomly selected from the neighboring data frames, where β represents a random number between (0, 1).

[0070] After one-hot encoding, all values ​​become numbers. However, the next problem is that for values ​​with the same feature, their numerical values ​​may not be on the same order of magnitude, and some may even differ significantly. Therefore, to facilitate subsequent calculations, the data needs to be standardized.

[0071]

[0072] Where h is the standardized value, a is the original value, μ represents the mean of the features, and σ is the standard deviation of the features. After standardization, the data range is converted to (-1, 1).

[0073] To improve model training efficiency and reduce training complexity, data sampling is necessary. A K-means clustering sampling algorithm is used to process the dataset and obtain a highly representative subset. The K-means clustering algorithm performs iterative clustering analysis on the data, finding the K optimal centroids and minimizing the sum of squared distances between all data points and their respective centroids.

[0074]

[0075] Among them CL i Let i be the cluster center and B be the cluster data point.

[0076] Based on the above embodiments, the information gain algorithm and fast filtering algorithm are used to select features from the IoT preprocessed data to obtain target feature data, including:

[0077] Determine the target variable information and feature variable information of the IoT preprocessed data;

[0078] The information gain between the target variable information and the feature variable information is obtained by subtracting the posterior uncertainty of the received feature variable information from the uncertainty before sending the target variable information.

[0079] The uncertain correlation between the target variable information and the feature variable information is obtained from the information gain, the uncertainty before sending the target variable information, and the uncertainty before sending the feature variable information;

[0080] A preset feature relevance threshold is determined using a Bayesian optimization-Gaussian process, and feature variable information that is greater than the preset feature relevance threshold is filtered out.

[0081] Arrange the uncertain correlations in descending order from largest to smallest, and calculate the uncertain correlations between each feature variable and all other feature variables with uncertainties smaller than the uncertainty.

[0082] The target feature data is obtained by identifying the feature variable information whose uncertain correlation with all other feature variable information is greater than the uncertain correlation between all other feature variable information and feature variable information.

[0083] Specifically, since the obtained target feature data contains a large number of redundant or useless elements, removing these elements will not result in information loss. Therefore, the feature selection in this embodiment of the invention can select those features that are highly relevant to the result and delete irrelevant or redundant features, which can improve the accuracy of the intrusion detection system and reduce the running time. In addition, selecting relevant features to simplify the model also helps the data generation process in generative adversarial networks. Feature selection is based on information gain and fast filtering algorithms, and the specific calculation steps are as follows:

[0084] Information gain, calculated based on information entropy, represents the degree to which information eliminates uncertainty. Features are selected by ranking information gains. During feature selection, the target variable is used as information U, and the feature variables are used as information V. The order of features is determined by ranking the information gains, thus selecting the features. The information gain between information U and V is expressed as:

[0085] IG[U,V]=Ent[U]-Ent[U|V]

[0086] Where Ent[U] represents the uncertainty before sending information U, and Ent[U|V] represents the average uncertainty of information U that still exists after receiving V, i.e., the posterior uncertainty.

[0087] Furthermore, the fast message filtering algorithm first solves for the uncertainty between the two features based on the information gain mentioned above:

[0088]

[0089] Where Ent[V] represents the uncertainty before sending the target feature V.

[0090] Based on this, features with relevance greater than a preset threshold δ are selected. To obtain a suitable relevance threshold, a Bayesian optimization-Gaussian process is used to optimize δ. This optimization process uses validation accuracy as the objective function for hyperparameter optimization; SU[U,V] is sorted in descending order of size, and the correlation SU[U,W] between each feature U and all other features W smaller than SU[U,V] is calculated sequentially; features W with SU[U,W] greater than SU[W,V] are deleted, resulting in a feature subset S(s1,s2…s). n ), that is, target feature data.

[0091] Based on the above embodiments, the random forest algorithm based on the feature model is used to train and learn the target feature data, including:

[0092] A number of training samples are randomly selected from the target feature data, and a sub-model is trained using the number of training samples.

[0093] The classification result is determined by voting, with the sub-model receiving the most votes being used as the final classification result.

[0094] The classification results are labeled using the random forest algorithm to obtain normal traffic classification results, known malicious traffic classification results, and unknown malicious traffic classification results.

[0095] Specifically, such as Figure 4 As shown, the intrusion detection system in this embodiment of the invention uses a feature-based model to match and classify existing features, and employs a random forest to distinguish between normal and malicious traffic data in the network. The feature-based model uses a random forest to perform feature matching and classification on the dataset.

[0096] In the Random Forest algorithm, the feature matching and classification steps are as follows: 1) Randomly select x training samples with replacement from the input features, and use these selected samples to form a new training set; 2) Then train a sub-model based on these new training sets; 3) For the IoT malicious traffic classification problem, a voting method is used, and the classification result of the sub-model with the most votes is taken as the final classification result. A tree-based Bayesian optimization algorithm is used to optimize the parameters used in the Random Forest model based on the feature model. After passing through the Random Forest model, the feature-based model will label the traffic prediction results. For known normal traffic and malicious traffic, it will output the corresponding matching results. Unknown malicious traffic will be sent to the anomaly-based model for further detection.

[0097] Based on the above embodiments, the target feature data is trained and learned using a convolutional neural network and a long short-term memory network based on anomaly models, including:

[0098] The unknown malicious traffic classification results are sequentially input into the convolutional kernel and preset activation function of the convolutional neural network for processing to determine which data to retain and which data to discard.

[0099] The temporal information from both the retained and discarded data is input into the fully connected layer of the Long Short-Term Memory network and a preset activation function for processing to obtain the final traffic classification result.

[0100] Specifically, such as Figure 5 As shown, based on the anomaly model, the convolutional kernels in the convolutional neural network are used to extract features of unknown malicious traffic from the sample data, and at the same time obtain the relevant descriptions of these features. Then, these data are sent to the Long Short-Term Memory network.

[0101] After receiving data from the convolutional layer, the data needs to be reshaped to conform to the processing type of the Long Short-Term Memory (LSTM) network. Then, it is fed into the network to: 1) use activation functions to determine which data to retain and which to discard; 2) model the temporal information in the data to obtain the long-term dependencies of the time series in the traffic and learn the temporal patterns of the traffic; and 3) use fully connected layers and activation functions to output the classification results of the traffic.

[0102] Based on the above embodiments, a hybrid IoT intrusion detection model is obtained by training and testing using a pre-set public dataset, including:

[0103] Obtain the NSL-KDD dataset, CICIDS2018 dataset, and Bot-IoT dataset;

[0104] The NSL-KDD dataset, the CICIDS2018 dataset, and the Bot-IoT dataset are divided into training set, validation set, and test set according to a preset partitioning ratio.

[0105] The hybrid IoT intrusion detection model is obtained by training and testing using the training set, the validation set, and the test set.

[0106] Specifically, this embodiment of the invention utilizes three publicly available datasets—NSL-KDD, CICIDS2018, and Bot-IoT—to train and test the intrusion detection system. NSL-KDD and CICIDS2018 primarily serve as data tests for the network layer in the Internet of Things (IoT), while Bot-IoT is an IoT attack dataset, more closely reflecting the system's environment. Each dataset is used for training and testing, with 80% serving as the training set, 10% as the validation set, and the remaining 10% as the test set. The final results show that the feature-based model achieves over 99.9% accuracy and F1 score on all three datasets, while the anomaly-based model achieves over 98.5% accuracy and F1 score.

[0107] Understandably, this invention uses random forests to extract traffic features to build a feature library for known IoT attacks, and then compares the features extracted from the test set with this feature library. For the difficulty in detecting IoT attacks such as denial-of-service and botnets, the anomaly-based model uses a combination of convolutional neural networks and long short-term memory networks to improve the system's detection accuracy for denial-of-service and botnet attacks.

[0108] The IoT intrusion detection system based on a hybrid model provided by the present invention will be described below. The IoT intrusion detection system based on a hybrid model described below can be referred to in correspondence with the IoT intrusion detection method based on a hybrid model described above.

[0109] Figure 6 This is a schematic diagram of the structure of the IoT intrusion detection system based on a hybrid model provided in an embodiment of the present invention, as shown below. Figure 6 As shown, it includes: a preprocessing module 61, a selection module 62, a training module 63, and a processing module 64, wherein:

[0110] The preprocessing module 61 is used to acquire IoT input data and preprocess the IoT input data to obtain IoT preprocessed data; the selection module 62 is used to select features from the IoT preprocessed data using an information gain algorithm and a fast filtering algorithm to obtain target feature data; the training module 63 is used to train the target feature data using a random forest algorithm based on a feature model, a convolutional neural network based on an anomaly model, and a long short-term memory network, and to train and test using a preset public dataset to obtain a hybrid IoT intrusion detection model; the processing module 64 is used to input the IoT input data to be detected into the hybrid IoT intrusion detection model and output IoT intrusion detection results.

[0111] Figure 7 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 7 As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730, and a communication bus 740, wherein the processor 710, the communication interface 720, and the memory 730 communicate with each other through the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a hybrid model-based IoT intrusion detection method. This method includes: acquiring IoT input data; preprocessing the IoT input data to obtain IoT preprocessed data; using an information gain algorithm and a fast filtering algorithm to select features from the IoT preprocessed data to obtain target feature data; training the target feature data using a random forest algorithm based on a feature model, and training the target feature data using a convolutional neural network and a long short-term memory network based on an anomaly model; training and testing using a preset public dataset to obtain a hybrid IoT intrusion detection model; inputting the IoT input data to be detected into the hybrid IoT intrusion detection model, and outputting the IoT intrusion detection result.

[0112] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0113] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the IoT intrusion detection method based on a hybrid model provided by the above methods. The method includes: acquiring IoT input data; preprocessing the IoT input data to obtain IoT preprocessed data; using an information gain algorithm and a fast filtering algorithm to select features from the IoT preprocessed data to obtain target feature data; training the target feature data using a random forest algorithm based on a feature model, training the target feature data using a convolutional neural network and a long short-term memory network based on an anomaly model, and training and testing the target feature data using a preset public dataset to obtain a hybrid IoT intrusion detection model; inputting the IoT input data to be detected into the hybrid IoT intrusion detection model, and outputting IoT intrusion detection results.

[0114] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the IoT intrusion detection method based on a hybrid model provided by the above methods. The method includes: acquiring IoT input data; preprocessing the IoT input data to obtain IoT preprocessed data; performing feature selection on the IoT preprocessed data using an information gain algorithm and a fast filtering algorithm to obtain target feature data; training the target feature data using a random forest algorithm based on a feature model, training the target feature data using a convolutional neural network and a long short-term memory network based on an anomaly model, and training and testing the target feature data using a preset public dataset to obtain a hybrid IoT intrusion detection model; inputting the IoT input data to be detected into the hybrid IoT intrusion detection model, and outputting IoT intrusion detection results.

[0115] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0116] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. An IoT intrusion detection method based on a hybrid model, characterized in that, include: Acquire IoT input data, preprocess the IoT input data, and obtain IoT preprocessed data; The information gain algorithm and the fast filtering algorithm are used to select features from the IoT preprocessed data to obtain target feature data; The target feature data is trained and learned using a random forest algorithm based on a feature model, and a convolutional neural network and a long short-term memory network based on anomaly models. The target feature data is trained and learned using a preset public dataset to obtain a hybrid IoT intrusion detection model. The IoT intrusion detection model inputs the IoT data to be detected and outputs the IoT intrusion detection result. The random forest algorithm based on feature models is used to train and learn the target feature data, including: A number of training samples are randomly selected from the target feature data, and a sub-model is trained using the number of training samples. The classification result is determined by voting, with the sub-model receiving the most votes being used as the final classification result. The classification results are labeled using the random forest algorithm to obtain normal traffic classification results, known malicious traffic classification results, and unknown malicious traffic classification results; The target feature data is trained and learned using a convolutional neural network and a long short-term memory network based on anomaly models, including: The unknown malicious traffic classification results are sequentially input into the convolutional kernel and preset activation function of the convolutional neural network for processing to determine which data to retain and which data to discard. The temporal information from both the retained and discarded data is input into the fully connected layer of the Long Short-Term Memory network and a preset activation function for processing to obtain the final traffic classification result. A hybrid IoT intrusion detection model was obtained by training and testing using a pre-defined public dataset, including: Obtain the NSL-KDD dataset, CICIDS2018 dataset, and Bot-IoT dataset; The NSL-KDD dataset, the CICIDS2018 dataset, and the Bot-IoT dataset are divided into training set, validation set, and test set according to a preset partitioning ratio. The hybrid IoT intrusion detection model is obtained by training and testing using the training set, the validation set, and the test set.

2. The IoT intrusion detection method based on a hybrid model according to claim 1, characterized in that, Acquire IoT input data, preprocess the IoT input data to obtain IoT preprocessed data, including: The IoT input data is one-hot encoded to obtain one-hot encoded data; Oversampled data is obtained from the one-hot encoded data, the neighboring data frames of the one-hot encoded data, and a preset random number; The oversampled data is standardized by using the characteristic mean and the characteristic standard deviation to obtain standardized data. The standardized data is processed using the K-means clustering algorithm to obtain the IoT preprocessed data.

3. The IoT intrusion detection method based on a hybrid model according to claim 1, characterized in that, The IoT preprocessed data is used to select features using the information gain algorithm and the fast filtering algorithm to obtain target feature data, including: Determine the target variable information and feature variable information of the IoT preprocessed data; The information gain between the target variable information and the feature variable information is obtained by subtracting the posterior uncertainty of the received feature variable information from the uncertainty before sending the target variable information. The uncertain correlation between the target variable information and the feature variable information is obtained from the information gain, the uncertainty before sending the target variable information, and the uncertainty before sending the feature variable information; A preset feature relevance threshold is determined using a Bayesian optimization-Gaussian process, and feature variable information that is greater than the preset feature relevance threshold is filtered out. Arrange the uncertain correlations in descending order from largest to smallest, and calculate the uncertain correlations between each feature variable and all other feature variables whose uncertain correlations are smaller than the uncertain correlations. The target feature data is obtained by identifying the feature variable information whose uncertain correlation with all other feature variable information is greater than the uncertain correlation between all other feature variable information and feature variable information.

4. An IoT intrusion detection system based on a hybrid model, comprising the IoT intrusion detection method based on a hybrid model as described in any one of claims 1 to 3, characterized in that, include: The preprocessing module is used to acquire IoT input data, preprocess the IoT input data, and obtain IoT preprocessed data. The selection module is used to perform feature selection on the IoT preprocessed data using information gain algorithm and fast filtering algorithm to obtain target feature data; The training module is used to train and learn the target feature data using a random forest algorithm based on a feature model, a convolutional neural network and a long short-term memory network based on an anomaly model, and to train and test the target feature data using a preset public dataset to obtain a hybrid IoT intrusion detection model. The processing module is used to input the IoT input data to be detected into the hybrid IoT intrusion detection model and output the IoT intrusion detection result.

5. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the IoT intrusion detection method based on a hybrid model as described in any one of claims 1 to 3.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the IoT intrusion detection method based on a hybrid model as described in any one of claims 1 to 3.

7. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the IoT intrusion detection method based on a hybrid model as described in any one of claims 1 to 3.

Images