A training method and device of an internet of things intrusion detection model

Abstract

This invention discloses a training method and apparatus for an IoT intrusion detection model. The method includes: acquiring a first training data sequence; obtaining multiple second training data sequences based on the first training data sequence; inputting the first training data sequences into a first encoder to obtain a first reconstruction loss of a first decoder; inputting the multiple second training data sequences into a second encoder to obtain a second reconstruction loss of a second decoder; inputting the attention score corresponding to the first decoder and the first training data sequence into the first encoder; and inputting the multiple second training data sequences into the second encoder to obtain a first adversarial loss and a second adversarial loss of the second decoder. Thus, because the IoT intrusion detection model is trained based on the attention score, the accuracy of the IoT intrusion detection model in detecting IoT intrusions can be improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a training method and apparatus for an Internet of Things (IoT) intrusion detection model. Background Technology

[0002] The Internet of Things (IoT) connects the physical world with the network world, and its rapid development is driven by advancements in sensors, embedded networks, and wireless networks. Currently, IoT devices are widely used in smart homes, smart healthcare, smart transportation, industrial manufacturing, and public utilities.

[0003] With the widespread adoption of the Internet of Things (IoT), security issues have become increasingly prominent, posing a major bottleneck to its development. The IoT is characterized by its complex architecture, large number of devices, and limited computing power. Therefore, identifying security problems early and implementing real-time diagnosis and decision-making has become a challenging issue. Summary of the Invention

[0004] This invention provides a training method and apparatus for an Internet of Things (IoT) intrusion detection model, which is used to train the IoT intrusion detection model based on attention scores, thereby improving the accuracy of the IoT intrusion detection model in detecting IoT intrusions.

[0005] In a first aspect, embodiments of the present invention provide a training method for an Internet of Things (IoT) intrusion detection model. This method can be executed by a training device for the IoT intrusion detection model. The method is applied to a cloud server, on which the IoT intrusion detection model is built. The IoT intrusion detection model includes a first encoder, a first decoder, a second encoder, and a second decoder. Specifically, the method includes: acquiring a first training data sequence generated by an IoT device within a first time period; obtaining a plurality of second training data sequences based on the first training data sequence, wherein the length of each of the plurality of second training data sequences is less than the length of the first training data sequence; inputting the first training data sequence into the first encoder; inputting a first output result of the first encoder into the first decoder to obtain a first output result of the first decoder and a first reconstruction loss; and inputting the plurality of second training data sequences into the second encoder. The training process involves inputting the first output of the second encoder and the first output of the first encoder into the second decoder to obtain a second reconstruction loss; inputting the attention score corresponding to the first output of the first decoder and the first training data sequence into the first encoder, and inputting the second output of the first encoder into the first decoder to obtain a second output of the first decoder; inputting the plurality of second training data sequences into the second encoder, and inputting the second output of the second encoder and the second output of the first encoder into the second decoder to obtain a first adversarial loss and a second adversarial loss; obtaining a first cumulative loss based on the first reconstruction loss and the first adversarial loss, and obtaining a second cumulative loss based on the second reconstruction loss and the second adversarial loss; if the first cumulative loss is less than a first threshold and the second cumulative loss is less than a second threshold, then the training of the IoT intrusion detection model is completed.

[0006] In one possible implementation, the method further includes: if the first cumulative loss is greater than or equal to the first threshold or the second cumulative loss is greater than or equal to the second threshold, then inputting the attention score corresponding to the second output result of the first decoder and the first training data sequence into the first encoder, and inputting the third output result of the first encoder into the first decoder to obtain the third output result of the first decoder; and inputting the plurality of second data sequences into the second encoder, and inputting the third output result of the second encoder and the third output result of the first encoder into the second decoder to obtain a third adversarial loss and a fourth adversarial loss; obtaining a third cumulative loss based on the first reconstruction loss and the third adversarial loss, and obtaining a fourth cumulative loss based on the second reconstruction loss and the fourth adversarial loss; if the third cumulative loss is less than the first threshold and the fourth cumulative loss is less than the second threshold, then the training of the IoT intrusion detection model is completed.

[0007] In one possible implementation, the method further includes: acquiring a first test data sequence; obtaining a plurality of second test data sequences based on the first test data sequence, wherein the length of each of the plurality of second test data sequences is less than the length of the first test data sequence; inputting the first test data sequence and the plurality of second test data sequences into the trained IoT intrusion detection model to obtain anomaly scores corresponding to the plurality of second test data sequences respectively; if the anomaly score corresponding to at least one of the plurality of second test data sequences is greater than or equal to a third threshold, then determining that the IoT device corresponding to the first test data sequence has been intruded upon.

[0008] In one possible implementation, the method further includes: sending the trained IoT intrusion detection model to the fog node so that the fog node performs detection based on the trained IoT intrusion detection model.

[0009] Secondly, embodiments of the present invention provide a training device for an Internet of Things (IoT) intrusion detection model. The device is applied to a cloud server, on which the IoT intrusion detection model is built. The IoT intrusion detection model includes a first encoder, a first decoder, a second encoder, and a second decoder. The device includes: an acquisition module, configured to acquire a first training data sequence generated by an IoT device within a first time period; a processing module, configured to obtain a plurality of second training data sequences based on the first training data sequence, wherein the length of each of the plurality of second training data sequences is less than the length of the first training data sequence; the processing module is further configured to: input the first training data sequence into the first encoder; input the first output result of the first encoder into the first decoder to obtain a first output result of the first decoder and a first reconstruction loss; and input the plurality of second training data sequences into the second encoder, and input the first output result of the second encoder into the second decoder. The processing module is further configured to input the first output result of the first encoder and the first output result of the first encoder into the second decoder to obtain the second reconstruction loss; the processing module is also configured to input the attention score corresponding to the first output result of the first decoder and the first training data sequence into the first encoder, input the second output result of the first encoder into the first decoder to obtain the second output result of the first decoder; and input the plurality of second training data sequences into the second encoder, input the second output result of the second encoder and the second output result of the first encoder into the second decoder to obtain the first adversarial loss and the second adversarial loss; the processing module is also configured to obtain the first cumulative loss based on the first reconstruction loss and the first adversarial loss and obtain the second cumulative loss based on the second reconstruction loss and the second adversarial loss, and if the first cumulative loss is less than the first threshold and the second cumulative loss is less than the second threshold, then the training of the IoT intrusion detection model is completed.

[0010] In one possible implementation, the processing module is further configured to: if the first cumulative loss is greater than or equal to the first threshold or the second cumulative loss is greater than or equal to the second threshold, input the attention score corresponding to the second output result of the first decoder and the first training data sequence into the first encoder, input the third output result of the first encoder into the first decoder, and obtain the third output result of the first decoder; and input the plurality of second data sequences into the second encoder, input the third output result of the second encoder and the third output result of the first encoder into the second decoder, and obtain the third adversarial loss and the fourth adversarial loss; obtain the third cumulative loss based on the first reconstruction loss and the third adversarial loss, and obtain the fourth cumulative loss based on the second reconstruction loss and the fourth adversarial loss; if the third cumulative loss is less than the first threshold and the fourth cumulative loss is less than the second threshold, then complete the training of the IoT intrusion detection model.

[0011] In one possible implementation, the acquisition module is further configured to acquire a first test data sequence; the processing module is further configured to obtain a plurality of second test data sequences based on the first test data sequence, wherein the length of each of the plurality of second test data sequences is less than the length of the first test data sequence; the processing module is further configured to input the first test data sequence and the plurality of second test data sequences into the trained IoT intrusion detection model to obtain anomaly scores corresponding to the plurality of second test data sequences respectively; if the anomaly score corresponding to at least one of the plurality of second test data sequences is greater than or equal to a third threshold, then it is determined that the IoT device corresponding to the first test data sequence has been intruded upon.

[0012] In one possible implementation, the apparatus further includes a sending module for sending the trained IoT intrusion detection model to the fog node, so that the fog node performs detection based on the trained IoT intrusion detection model.

[0013] Thirdly, embodiments of the present invention also provide a training apparatus for an Internet of Things intrusion detection model, comprising: a memory for storing computer programs or instructions; and a processor for calling the computer programs or instructions stored in the memory to execute the method as in any possible design of the first aspect.

[0014] Fourthly, the present invention provides a computer-readable storage medium storing a computer program or instructions that, when read and executed by a computer, cause the computer to perform any of the possible designs in the first aspect described above.

[0015] Fifthly, the present invention provides a computer program product that, when read and executed by a computer, causes the computer to perform any of the possible designs in the first aspect described above. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A schematic diagram of a system architecture provided for an embodiment of the present invention;

[0018] Figure 2 This is a flowchart illustrating the training method for an IoT intrusion detection model provided in an embodiment of the present invention.

[0019] Figure 3 A schematic diagram of an Internet of Things (IoT) intrusion detection model provided in an embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram of a test process for testing a trained model, provided as an embodiment of the present invention.

[0021] Figure 5 A schematic diagram of an internal module of a training device for an Internet of Things intrusion detection model provided in an embodiment of the present invention;

[0022] Figure 6 This is a schematic diagram of a training device for an Internet of Things (IoT) intrusion detection model provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0024] Figure 1 This is a schematic diagram of a system architecture provided for an embodiment of the present invention. Figure 1 As shown, the system architecture can include an edge layer, a fog layer, and a cloud layer. Figure 1 The system includes multiple IoT devices, a fog server, and a cloud server. However, in this embodiment of the invention, the number of cloud servers, fog servers, and IoT devices is not limited.

[0025] The edge layer consists of many edge nodes, including many IoT devices. IoT devices refer to various physical devices that are connected to the Internet through network connectivity and communication technologies, such as smart cameras, smart door locks, smart light bulbs, and smartwatches in smart homes; smart streetlights and smart parking systems in smart cities; and robots and sensors in industrial IoT devices.

[0026] Fog layers consist of fog nodes, which can provide computing, networking, and storage devices in the system architecture, such as smart gateways, routers, switches, and specific fog servers.

[0027] The cloud layer includes large cloud servers and well-configured data centers, possessing powerful computing resources that can easily aggregate, train, and store big data.

[0028] The combination of edge layer, fog layer and cloud layer forms a new computing method - fog computing. Fog computing can provide computing and storage services between terminal devices and cloud services to make up for the shortcomings of cloud computing. It can solve problems such as difficulty in rapid response and poor device flexibility in cloud computing.

[0029] Therefore, embodiments of the present invention provide a training method for an Internet of Things (IoT) intrusion detection model. Figure 2 This is a flowchart illustrating a training method for an IoT intrusion detection model provided in an embodiment of the present invention. This process can be executed by a training device for the IoT intrusion detection model. Figure 2 As shown, the process includes the following steps:

[0030] Step 201: The cloud server obtains the first training data sequence generated by the IoT device within the first time period.

[0031] Specifically, the cloud server acquires traffic data from IoT devices communicating with the fog nodes, and performs preprocessing on the acquired traffic data, such as redundancy and deduplication, to remove duplicate data and data invalid for traffic analysis. For example, the traffic data can be obtained from the IoT devices themselves or from the logs of the fog nodes connected to the IoT devices.

[0032] Since traffic data has a time attribute, the preprocessed data is used as a dataset. One-hot encoding is performed on the non-numerical features in the dataset to obtain time-series data T = {x1, x2, ... x} with timestamps. T}, where non-numerical features can be features such as present, absent, yes, no, etc.

[0033] The encoded data is then normalized to generate the first data sequence t = {x1, x2, ..., x...}.t The formula for normalization is:

[0034]

[0035] Here, min(T) and max(T) are the minimum and maximum vectors in the time series T, and ε′ is a very small constant vector to prevent division by zero.

[0036] Step 202: Obtain multiple second training data sequences based on the first training data sequence, wherein the length of each training data sequence is less than the length of the first training data sequence.

[0037] Specifically, for the first training data sequence t = {x1, x2, ... x...} t x in} t Perform correlation modeling, and for each x t Construct a local context window of length K, W t ={x t-K+1 , ...x t If t is greater than or equal to K, then x t and x t The previous K-1 data points are converted into a sliding window W. t If t is less than K, then a constant vector {x} of length Kt will be used. t , ...x t} Attach to window W t To maintain a window length of K for each timestamp t, t second training data sequences W1, W2, ..., W can be obtained from the first training data sequence. t The length of each second training data sequence is less than the length of the first data sequence.

[0038] For example, if the first data sequence t generated after normalization is {x1, x2, ..., x5}, and if each x... t Construct a local context window of length 3. For data with t greater than or equal to 3, such as x3, it can be constructed as W3 = {x1, x2, x3}; x5 can be constructed as W5 = {x3, x4, x5}. For data with t less than 3, such as x2, it can be constructed as the window sequence W2 = {x2, x1, x2}; x1 can be constructed as W1 = {x1, x1, x1}.

[0039] Step 203: The cloud server inputs the first training data sequence into the first encoder, inputs the first output result of the first encoder into the first decoder, and obtains the first output result of the first decoder and the first reconstruction loss; and inputs multiple second training data sequences into the second encoder, inputs the first output result of the second encoder and the first output result of the first encoder into the second decoder, and obtains the second reconstruction loss.

[0040] Specifically, an IoT intrusion detection model is built on a cloud server. A schematic diagram of the IoT intrusion detection model is shown below. Figure 3 ,from Figure 3 As can be seen, the IoT intrusion detection model shown includes a first encoder, a first decoder, a second encoder, and a second decoder.

[0041] The first encoder is Encoder_1, which includes multi-head attention, residual connections and layer normalization (Add & Norm), and a feedforward neural network; the first decoder is Decoder_1, which includes a feedforward neural network and residual connections and layer normalization (Add & Norm); the second encoder is Encoder_2, which includes multi-head attention and residual connections and layer normalization (Add & Norm); the second decoder is Decoder_2, which includes multi-head attention and residual connections and layer normalization (Add & Norm).

[0042] In the first phase, the first training data sequence t = {x1, x2, ..., x...} t The first encoder is input, and the first training data sequence is... Figure 3 The complete sequence in the sequence is obtained and its position is encoded to obtain the input matrix I1 of the first encoder. Then, the first encoder generates attention weights, and the formula for the operation is as follows:

[0043]

[0044]

[0045] In this context, MultiHeadAtt(I1,I1,I1) represents the multi-head self-attention operation on the input matrix I1, and "+" represents matrix addition.

[0046] Multi-head self-attention includes multiple dot-product attention. Multi-head self-attention and dot-product attention are used to extract feature information from different representation subspaces. Dot-product attention computes three inputs (Query, Key, and Value) to obtain an attention-enabled output vector, which is then transformed into a scaled input for dot-product attention through linear operations. The scaled dot-product attention then integrates the outputs of multiple heads using a concat operation. Finally, a linear layer completes the output, resulting in an attention-enabled output. The formulas for calculating multi-head self-attention and dot-product attention are as follows:

[0047] MultiHeadAtt(Q,K,V)=Θ(h1,h2,...h i W 0

[0048]

[0049] Where Q, K, and V represent the matrix Query, Key, and Value, respectively. k h represents the dimension of the key. i This represents the output of the i-th head, Θ represents the concat operation, and W... 0 This represents the weight matrix.

[0050] The first output of the first encoder is input into the first decoder to obtain the first output of the first decoder. The formula for the operation is as follows:

[0051]

[0052] Multiple second training data sequences are input into the second encoder. The second training data sequences are... Figure 3 The window sequence in the code is used to obtain the input matrix I2 of the second encoder by position encoding. The formula for the operation performed by the second encoder is as follows:

[0053]

[0054]

[0055]

[0056] The first output of the first encoder and the first output of the second encoder are input into the second decoder. The formula for the operation performed by the second decoder is as follows:

[0057]

[0058] For the two outputs O1 and O2 generated by the first and second decoders, the reconstruction loss function of each decoder is defined using the L2 paradigm, as follows:

[0059] L1 = ||O1-W||2

[0060] L2=||O2-W||2

[0061] L1 is the first reconstruction loss, and L2 is the second reconstruction loss.

[0062] Step 204: Input the attention score corresponding to the first output result of the first decoder and the first training data sequence into the first encoder, input the second output result of the first encoder into the first decoder, and obtain the second output result of the first decoder; and input multiple second training data sequences into the second encoder, input the second output result of the second encoder and the second output result of the first encoder into the second decoder, and obtain the first adversarial loss and the second adversarial loss.

[0063] Specifically, in the second stage, a focus score F is defined using the first reconstruction loss as prior knowledge for modifying the attention weights. Higher neural network activation is applied to specific input subsequences to extract short-term time trends. The focus score F and the first training data sequence are input into the first encoder to obtain its second output. This second output is then input into the first decoder to obtain its second output. The second output can redefine the attention score F. After multiple training sessions, the attention score becomes increasingly accurate.

[0064] Multiple second training data sequences are input into the second encoder. The second output of the second encoder and the second output of the first encoder are input into the second decoder to obtain the first adversarial loss and the second adversarial loss. The formula for the first adversarial loss function is as follows: The formulas for the second adversarial loss function are as follows:

[0065] Step 205: Obtain the first cumulative loss based on the first reconstruction loss and the first adversarial loss, and obtain the second cumulative loss based on the second reconstruction loss and the second adversarial loss. If the first cumulative loss is less than the first threshold and the second cumulative loss is less than the second threshold, then the training of the IoT intrusion detection model is completed.

[0066] Specifically, the cumulative loss of the second decoder is determined using an evolutionary loss function that combines the reconstruction loss function and the adversarial loss function of the two stages to obtain the first and second cumulative losses:

[0067] The first cumulative loss is:

[0068] The second cumulative loss is:

[0069] Where n is the number of training iterations, and ε is a training parameter whose value tends to 1.

[0070] If the first cumulative loss function is less than the first threshold and the second cumulative loss function is less than the second threshold, then the training of the IoT intrusion detection model is complete.

[0071] If the first cumulative loss is greater than the first threshold or the second cumulative loss is greater than the second threshold, then the attention score corresponding to the second output result of the first decoder and the first training data sequence are input into the first encoder, and the third output result of the first encoder is input into the first decoder to obtain the third output result of the first decoder; and multiple second data sequences are input into the second encoder, and the third output result of the second encoder and the third output result of the first encoder are input into the second decoder to obtain the third adversarial loss and the fourth adversarial loss.

[0072] The third cumulative loss is obtained based on the first reconstruction loss and the third adversarial loss, and the fourth cumulative loss is obtained based on the second reconstruction loss and the fourth adversarial loss. If the third cumulative loss is less than the first threshold and the fourth cumulative loss is less than the second threshold, then the training of the IoT intrusion detection model is completed.

[0073] The calculation formula for the third cumulative loss is the same as that for the first cumulative loss, and the calculation formula for the fourth cumulative loss is the same as that for the second cumulative loss, except that 'n' differs in the coefficients of reconstruction loss and adversarial loss. Since the second stage can be repeated multiple times, in the initial stage of the training process, i.e., when the decoder output is a weak reconstruction of the input sequence, a higher weight is assigned to the reconstruction loss to ensure stable training. Because the reconstruction result is poor, the attention score used in the second stage has low reliability and cannot be used as a priori to indicate reconstructions deviating from the input sequence. Therefore, the adversarial loss is assigned a lower weight in the initial stage of the training process to avoid compromising the stability of model training. As the reconstruction becomes closer to the input sequence and the attention score becomes more accurate, the weight of the adversarial loss gradually increases. Since the loss curve in the neural network training process typically follows an exponential function, this invention uses ε. -n Weight of form.

[0074] Once the IoT intrusion detection model is trained, it is tested using a test set, and the results are recorded. A diagram illustrating the corresponding testing process is shown below. Figure 4 As shown.

[0075] Step 401: Obtain the first test data sequence.

[0076] Step 402: Obtain multiple second test data sequences based on the first test data sequence, wherein the length of each test data sequence is less than the length of the first test data sequence.

[0077] The method for obtaining multiple second test data sequences based on the first test data sequence is the same as the method for obtaining multiple second training data sequences based on the first training data sequence in step 202, and will not be described in detail here.

[0078] Step 403: Input the first test data sequence and multiple second test data sequences into the trained IoT intrusion detection model to obtain the anomaly scores corresponding to the multiple second test data sequences respectively.

[0079] Specifically, the first test data sequence is denoted as Multiple second test data sequences are denoted as Inputting the first and second test data sequences into the trained IoT intrusion detection model, the first stage yields the O1 output of the first decoder, and the second stage yields the O1 output of the second decoder. According to O1 and Anomaly scores S corresponding to multiple test data sequences can be obtained. i Abnormal score S i The calculation formula is:

[0080]

[0081] Step 404: If the anomaly score of at least one of the multiple second test data sequences is greater than or equal to the third threshold, then it is determined that the IoT device corresponding to the first test data sequence has been intruded upon.

[0082] To ensure fair comparison, a threshold is automatically and dynamically selected using the peak over-threshold method, denoted as the third threshold. For multiple second test data sequences, their anomaly scores are calculated, resulting in an anomaly score for each test data sequence. The anomaly score for each second test data sequence is compared with the third threshold. If the anomaly score is greater than the third threshold, the second test data sequence is determined to be in an abnormal state, denoted as y. i =1. If any one of the multiple second test data sequences is abnormal, then the first test data sequence is determined to be abnormal. If the first test data sequence is abnormal, then the IoT device corresponding to the first test data sequence is determined to be intruded.

[0083] Based on the predicted intrusion scenarios and actual intrusion scenarios from the first test data sequence in the test set, the performance metrics of the IoT intrusion detection model are calculated, including accuracy, precision, recall, and F1 score, as follows:

[0084] Accuracy=(TP+TN) / (TP+FP+TN+FN)

[0085] Precision = TP / (TP + FP)

[0086] Recall = TP / (TP + FN)

[0087] F1-score=2*(Precision*Recall) / (Precision+Recall)

[0088] Wherein, TP represents the number of times a predicted intrusion actually occurred, FP represents the number of times a predicted intrusion actually occurred, TN represents the number of times a predicted normal occurrence actually occurred, and FN represents the number of times a predicted normal occurrence actually occurred.

[0089] After training the IoT intrusion detection model on the cloud server, the IoT intrusion detection model is sent to the fog nodes, enabling the fog nodes to deploy the IoT intrusion detection model. Then, the fog nodes detect traffic data. Once the traffic data is identified as abnormal, the abnormal information is forwarded to the cloud server for archiving and handed over to staff to determine whether an intrusion has occurred.

[0090] This invention provides a training method for an IoT intrusion detection model. This method amplifies the deviation between anomalous and normal data because the reconstruction error is activated as the attention part of the first encoder to generate anomaly scores, simplifying the anomaly labeling task. Secondly, it prevents false alarms by capturing short-term time trends in the second encoder. Furthermore, adversarial training improves scalability and makes the model robust to different input sequences. By amplifying the reconstruction error through adversarial training, even anomalous data with small deviations from normal data can be detected by the IoT intrusion detection model, thus improving detection accuracy.

[0091] Furthermore, an IoT intrusion detection model was trained on a cloud server and deployed on fog nodes, designing a scalable intrusion detection framework for the IoT environment. When data is transmitted to the fog node, it performs traffic data preprocessing operations and calls the trained detection model to classify the data without communicating with the cloud backend. Once the traffic data is identified as an attack, the relevant information is forwarded to the cloud for decision-making and archiving, which helps to reduce system response time and communication overhead.

[0092] Figure 5 This is a schematic diagram of an internal module of a training device 5000 for an IoT intrusion detection model provided in an embodiment of the present invention. Figure 5 As shown, the device may include: an acquisition module 501, a processing module 502, and a sending module 503. Optionally, it may also include a storage module for storing computer instructions or programs. The processing module 502 may call the computer instructions or programs stored in the storage module.

[0093] The acquisition module 501 is used to acquire a first training data sequence generated by an IoT device within a first time period; the processing module 502 is used to obtain a plurality of second training data sequences based on the first training data sequence, wherein the length of each of the plurality of second training data sequences is less than the length of the first training data sequence; the processing module 502 is further used to input the first training data sequence into the first encoder, input the first output result of the first encoder into the first decoder, and obtain the first output result of the first decoder and a first reconstruction loss; and to input the plurality of second training data sequences into the second encoder, input the first output result of the second encoder and the first output result of the first encoder into the second decoder, and obtain a second reconstruction loss; the processing module 502 is further used to The processing module 502 is further configured to: input the attention score corresponding to the first output result of the first decoder and the first training data sequence into the first encoder; input the second output result of the first encoder into the first decoder to obtain the second output result of the first decoder; and input the plurality of second training data sequences into the second encoder; input the second output result of the second encoder and the second output result of the first encoder into the second decoder to obtain the first adversarial loss and the second adversarial loss; the processing module 502 is further configured to: obtain a first cumulative loss based on the first reconstruction loss and the first adversarial loss; and obtain a second cumulative loss based on the second reconstruction loss and the second adversarial loss; if the first cumulative loss is less than a first threshold and the second cumulative loss is less than a second threshold, then the training of the IoT intrusion detection model is completed.

[0094] In one possible implementation, the processing module 502 is further configured to: if the first cumulative loss is greater than or equal to the first threshold or the second cumulative loss is greater than or equal to the second threshold, input the attention score corresponding to the second output result of the first decoder and the first training data sequence into the first encoder, input the third output result of the first encoder into the first decoder, and obtain the third output result of the first decoder; and input the plurality of second data sequences into the second encoder, input the third output result of the second encoder and the third output result of the first encoder into the second decoder, and obtain the third adversarial loss and the fourth adversarial loss; obtain the third cumulative loss based on the first reconstruction loss and the third adversarial loss, and obtain the fourth cumulative loss based on the second reconstruction loss and the fourth adversarial loss; if the third cumulative loss is less than the first threshold and the fourth cumulative loss is less than the second threshold, then complete the training of the IoT intrusion detection model.

[0095] In one possible implementation, the acquisition module 501 is further configured to acquire a first test data sequence; the processing module 502 is further configured to obtain a plurality of second test data sequences based on the first test data sequence, wherein the length of each of the plurality of second test data sequences is less than the length of the first test data sequence; the processing module 502 is further configured to input the first test data sequence and the plurality of second test data sequences into the trained IoT intrusion detection model to obtain anomaly scores corresponding to the plurality of second test data sequences respectively; if the anomaly score corresponding to at least one of the plurality of second test data sequences is greater than or equal to a third threshold, then it is determined that the IoT device corresponding to the first test data sequence has been intruded upon.

[0096] In one possible implementation, the apparatus further includes a sending module 503, configured to send the trained IoT intrusion detection model to the fog node, so that the fog node performs detection based on the trained IoT intrusion detection model.

[0097] Figure 6 This is a schematic diagram of a training device 6000 for an IoT intrusion detection model provided in an embodiment of the present invention. Figure 6 As shown, it includes at least one processor 601 and a memory 602 connected to at least one processor 601. In this embodiment, the specific connection medium between the processor 601 and the memory 602 is not limited. Figure 6 Taking the connection between the processor 601 and the memory 602 via a bus as an example, the bus can be divided into address bus, data bus, control bus, etc.

[0098] In this embodiment of the invention, the memory 602 stores instructions that can be executed by at least one processor 601. By executing the instructions stored in the memory 602, the at least one processor 601 can implement the steps of the above-described training method for the Internet of Things intrusion detection model.

[0099] The processor 601 is the control center of the computer device, capable of connecting various parts of the computer device via various interfaces and lines. It performs resource configuration by running or executing instructions stored in the memory 602 and accessing data stored in the memory 602. Optionally, the processor 601 may include one or more processing units. The processor 601 may integrate an application processor and a modem processor. The application processor primarily handles the operating system, user interface, and applications, while the modem processor primarily handles wireless communication. It is understood that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip; in other embodiments, they may be implemented on separate chips.

[0100] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware processor, or executed by a combination of hardware and software modules within the processor.

[0101] Memory 602, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 602 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 602 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 602 may also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0102] Based on the same technical concept, embodiments of this application also provide a computer-readable storage medium storing computer-readable instructions, which, when read and executed by a computer, cause the computer to perform any of the possible design methods of the first aspect described above.

[0103] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0104] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0105] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0106] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0107] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A training method for an Internet of Things (IoT) intrusion detection model, characterized in that, The method is applied to a cloud server, on which the IoT intrusion detection model is built. The IoT intrusion detection model includes a first encoder, a first decoder, a second encoder, and a second decoder. The method includes: Acquire the first training data sequence generated by the IoT device within the first time period; Multiple second training data sequences are obtained based on the first training data sequence, wherein the length of each training data sequence is less than the length of the first training data sequence. The first training data sequence is input into the first encoder, and the first output result of the first encoder is input into the first decoder to obtain the first output result of the first decoder and a first reconstruction loss; and the plurality of second training data sequences are input into the second encoder, and the first output result of the second encoder and the first output result of the first encoder are input into the second decoder to obtain a second reconstruction loss; the first reconstruction loss The second reconstruction loss ; The attention score corresponding to the first output result of the first decoder and the first training data sequence are input into the first encoder, and the second output result of the first encoder is input into the first decoder to obtain the second output result of the first decoder; and the plurality of second training data sequences are input into the second encoder, and the second output result of the second encoder and the second output result of the first encoder are input into the second decoder to obtain the first adversarial loss and the second adversarial loss; the first adversarial loss -W 2, the second type of countermeasure loss -W 2; The first cumulative loss is obtained based on the first reconstruction loss and the first adversarial loss, and the second cumulative loss is obtained based on the second reconstruction loss and the second adversarial loss. If the first cumulative loss is less than the first threshold and the second cumulative loss is less than the second threshold, then the training of the IoT intrusion detection model is completed.

2. The method according to claim 1, characterized in that, The method further includes: If the first cumulative loss is greater than or equal to the first threshold or the second cumulative loss is greater than or equal to the second threshold, then the attention score corresponding to the second output result of the first decoder and the first training data sequence are input into the first encoder, and the third output result of the first encoder is input into the first decoder to obtain the third output result of the first decoder; and the plurality of second data sequences are input into the second encoder, and the third output result of the second encoder and the third output result of the first encoder are input into the second decoder to obtain the third adversarial loss and the fourth adversarial loss; The third cumulative loss is obtained based on the first reconstruction loss and the third adversarial loss, and the fourth cumulative loss is obtained based on the second reconstruction loss and the fourth adversarial loss. If the third cumulative loss is less than the first threshold and the fourth cumulative loss is less than the second threshold, then the training of the IoT intrusion detection model is completed.

3. The method according to claim 1 or 2, characterized in that, The method further includes: Obtain the first test data sequence; Multiple second test data sequences are obtained based on the first test data sequence, wherein the length of each of the multiple second test data sequences is less than the length of the first test data sequence. The first test data sequence and the plurality of second test data sequences are input into the trained IoT intrusion detection model to obtain the anomaly scores corresponding to the plurality of second test data sequences respectively. If the anomaly score of at least one of the plurality of second test data sequences is greater than or equal to the third threshold, then it is determined that the IoT device corresponding to the first test data sequence has been intruded upon.

4. The method according to claim 1 or 2, characterized in that, The method further includes: The trained IoT intrusion detection model is sent to the fog node so that the fog node can perform detection based on the trained IoT intrusion detection model.

5. A training device for an Internet of Things (IoT) intrusion detection model, characterized in that, The device is applied to a cloud server, on which the IoT intrusion detection model is built. The IoT intrusion detection model includes a first encoder, a first decoder, a second encoder, and a second decoder. The device includes: The acquisition module is used to acquire the first training data sequence generated by the IoT device within the first time period. The processing module is configured to obtain a plurality of second training data sequences based on the first training data sequence, wherein the length of each training data sequence in the plurality of second training data sequences is less than the length of the first training data sequence; The processing module is further configured to: input the first training data sequence into the first encoder, input the first output result of the first encoder into the first decoder, and obtain the first output result of the first decoder and a first reconstruction loss; and input the plurality of second training data sequences into the second encoder, input the first output result of the second encoder and the first output result of the first encoder into the second decoder, and obtain a second reconstruction loss; the first reconstruction loss The second reconstruction loss ; The processing module is further configured to: input the attention score corresponding to the first output result of the first decoder and the first training data sequence into the first encoder; input the second output result of the first encoder into the first decoder to obtain the second output result of the first decoder; and input the plurality of second training data sequences into the second encoder; input the second output result of the second encoder and the second output result of the first encoder into the second decoder to obtain the first adversarial loss and the second adversarial loss; the first adversarial loss -W 2, the second type of countermeasure loss -W 2; The processing module is further configured to obtain a first cumulative loss based on the first reconstruction loss and the first adversarial loss, and to obtain a second cumulative loss based on the second reconstruction loss and the second adversarial loss. If the first cumulative loss is less than a first threshold and the second cumulative loss is less than a second threshold, then the training of the IoT intrusion detection model is completed.

6. The apparatus according to claim 5, characterized in that, The processing module is also used for: If the first cumulative loss is greater than or equal to the first threshold or the second cumulative loss is greater than or equal to the second threshold, then the attention score corresponding to the second output result of the first decoder and the first training data sequence are input into the first encoder, and the third output result of the first encoder is input into the first decoder to obtain the third output result of the first decoder. Furthermore, the plurality of second data sequences are input into the second encoder, and the third output result of the second encoder and the third output result of the first encoder are input into the second decoder to obtain the third adversarial loss and the fourth adversarial loss; The third cumulative loss is obtained based on the first reconstruction loss and the third adversarial loss, and the fourth cumulative loss is obtained based on the second reconstruction loss and the fourth adversarial loss. If the third cumulative loss is less than the first threshold and the fourth cumulative loss is less than the second threshold, then the training of the IoT intrusion detection model is completed.

7. The apparatus according to claim 5 or 6, characterized in that, The acquisition module is further configured to acquire a first test data sequence; The processing module is further configured to obtain a plurality of second test data sequences based on the first test data sequence, wherein the length of each test data sequence in the plurality of second test data sequences is less than the length of the first test data sequence. The processing module is further configured to input the first test data sequence and the plurality of second test data sequences into the trained Internet of Things intrusion detection model to obtain the anomaly scores corresponding to the plurality of second test data sequences respectively; If the anomaly score of at least one of the plurality of second test data sequences is greater than or equal to the third threshold, then it is determined that the IoT device corresponding to the first test data sequence has been intruded upon.

8. The apparatus according to claim 5 or 6, characterized in that, The device further includes: The sending module is used to send the trained IoT intrusion detection model to the fog node so that the fog node can perform detection based on the trained IoT intrusion detection model.

9. A training device for an Internet of Things (IoT) intrusion detection model, characterized in that, include: Memory is used to store computer programs or instructions; A processor is configured to invoke a computer program or instructions stored in the memory to execute the method as described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program or instructions, which, when executed by a computer, implement the method as described in any one of claims 1 to 4.

Images