An IoT Intrusion Detection Method and Device Based on an Improved GAN Model

Abstract

This application provides an IoT intrusion detection method and apparatus based on an improved GAN model, relating to the field of network security technology. It is implemented in a fog computing environment. The specific implementation scheme is as follows: acquiring network traffic data to be detected from an edge device; using the network traffic data to be detected as input, determining a first anomaly score corresponding to the network traffic data based on a pre-trained intrusion detection model, wherein the intrusion detection model is trained based on an improved GAN model; and determining the network traffic data to be detected as intrusion data in response to the first anomaly score exceeding a preset anomaly score threshold. This application can detect IoT anomalies, thereby improving the security and reliability of IoT application services.

Description

Technical Field

[0001] This application belongs to the field of network security technology, and specifically relates to an IoT intrusion detection method, device, electronic device, computer-readable storage medium, and computer program product based on an improved GAN model. Background Technology

[0002] The rapid development of the Internet of Things (IoT) has facilitated the interconnection of smart sensors and devices. IoT devices can generate and collect vast amounts of data, from which valuable information can be extracted to support intelligent services in IoT applications. In banking, IoT devices are primarily used in security, camera surveillance, temperature control, credit card display, and ATMs. Security in these devices and scenarios is extremely important; any intrusion could have serious consequences.

[0003] Currently, Generative Adversarial Networks (GANs) have efficient feature extraction capabilities. In order to mitigate the risks of IoT networks in banks, it is of great significance to use GANs for IoT intrusion detection. However, current research on IoT intrusion detection based on GANs still has its shortcomings. Summary of the Invention

[0004] To address at least one problem in the existing technology, this application provides an IoT intrusion detection method and apparatus based on an improved GAN model, which can detect IoT anomalies, thereby improving the security and reliability of IoT application services.

[0005] According to the first aspect of this application, an IoT intrusion detection method based on an improved GAN model is provided, executed in a fog computing environment, comprising:

[0006] Acquire network traffic data to be detected from edge devices;

[0007] Using the network traffic data to be detected as input, a first anomaly score corresponding to the network traffic data to be detected is determined based on a pre-trained intrusion detection model, wherein the intrusion detection model is trained based on an improved GAN model;

[0008] In response to the first anomaly score exceeding a preset anomaly score threshold, the network traffic data to be detected is determined to be intrusion data.

[0009] In some optional embodiments of this example, the fog computing environment includes an edge layer, a fog layer, and a cloud layer, wherein:

[0010] The edge layer includes edge nodes and edge devices, used to collect network traffic data and send the network traffic data to the fog layer;

[0011] The fog layer includes multiple fog nodes for calculating, analyzing, and storing the network traffic data. The IoT intrusion detection method based on the improved GAN model is executed at the gateway of the fog nodes, and each fog node is used to detect all attacks from the edge layer.

[0012] The cloud layer includes cloud servers used to store model configuration parameters and training configuration parameters.

[0013] In some alternative embodiments of this example, the improved GAN model includes a generator and a discriminator, wherein:

[0014] The generator comprises two BiLSTM layers with an attention mechanism and a fully connected layer. The BiLSTM layers include a forward LSTM and a backward LSTM. The expression for the hidden state of the BiLSTM layer is as follows:

[0015]

[0016] Wherein, H represents the hidden state of the BiLSTM layer; This represents the hidden state of a forward LSTM. This represents the hidden state of the inverse LSTM.

[0017] In some optional embodiments of this example, the step of training the intrusion detection model includes:

[0018] A network traffic data sample set is obtained from an edge device. The network traffic data sample set is preprocessed and subsequenced to obtain a training sample set subsequence and a test sample set subsequence.

[0019] The improved GAN model is trained using the subsequence of the training sample set as input, and optimized using the subsequence of the test sample set as input, resulting in a trained target intrusion detection model.

[0020] In some optional embodiments of this example, training the improved GAN model using a subset of the training sample set as input includes:

[0021] In one training cycle, the improved GAN model is trained using the following procedure:

[0022] In the fog layer, the training sample set subsequence is input into the generator, training generated data is output, and a first loss function of the generator is determined based on the training sample set subsequence and the training generated data; and the training generated data is sent to the cloud server, wherein the cloud server is used to train the discriminator;

[0023] In the cloud layer, the discriminator is trained using the training sample set subsequence as positive samples and the training generated data as negative samples, and the second loss function of the discriminator is determined, wherein the Wasserstein distance is used instead of JS divergence in the discriminator and the Sigmoid function of the last layer is removed.

[0024] Based on the first loss function and the second loss function, the overall objective function is determined, and the improved GAN model is trained based on the overall objective function;

[0025] Repeat the training process until the maximum training cycle is reached to obtain the initial intrusion detection model.

[0026] In some optional embodiments of this example, the step of using the subsequence of the test sample set as input to optimize the improved GAN model to obtain the trained target intrusion detection model includes:

[0027] Determine the true labels of the subsequences in the test sample set;

[0028] Using the test sample set subsequence as input, and based on the initial intrusion detection model, determine the intrusion detection result corresponding to the test sample set subsequence;

[0029] Based on the intrusion detection results and the real labels, determine the accuracy of the initial intrusion detection model;

[0030] In response to the accuracy being greater than or equal to a preset accuracy threshold, the initial intrusion detection model is used as the target intrusion detection model;

[0031] In response to the accuracy being less than the preset accuracy threshold, the initial intrusion detection model is optimized based on the intrusion detection results and the test sample set subsequence until the accuracy is greater than or equal to the preset accuracy threshold, thereby obtaining a trained target intrusion detection model.

[0032] In some optional embodiments of this example, determining the intrusion detection result corresponding to the subsequence of the test sample set as input, based on the initial intrusion detection model, includes:

[0033] The test sample set subsequence is input into the generator to obtain test generated data, and the reconstruction loss function of the generator and the third loss function of the discriminator are determined based on the test sample set subsequence and the test generated data.

[0034] Based on the reconstruction loss function and the third loss function, the overall loss function is determined, and the overall loss function is normalized to obtain the anomaly scoring function;

[0035] Based on the anomaly scoring function, a second anomaly score is determined for the subsequence of the test sample set, and based on the second anomaly score, the intrusion detection result corresponding to the subsequence of the test sample set is determined.

[0036] According to a second aspect of this application, an IoT intrusion detection device based on an improved GAN model is also provided, which operates in a fog computing environment, including:

[0037] The acquisition module is configured to acquire network traffic data to be detected from edge devices;

[0038] The anomaly score determination module takes the network traffic data to be detected as input and determines the first anomaly score corresponding to the network traffic data to be detected based on a pre-trained intrusion detection model, wherein the intrusion detection model is trained based on an improved GAN model.

[0039] The intrusion data determination module is configured to determine the network traffic data to be detected as intrusion data in response to the first anomaly score exceeding a preset anomaly score threshold.

[0040] According to a third aspect of this application, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the IoT intrusion detection method based on an improved GAN model of the first aspect described above.

[0041] According to a fourth aspect of this application, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the IoT intrusion detection method based on an improved GAN model of the first aspect described above.

[0042] According to a fifth aspect of this application, a computer program product is also provided, which, when executed by a processor, implements the steps of the IoT intrusion detection method based on an improved GAN model of the first aspect described above.

[0043] This application provides an IoT intrusion detection method and apparatus based on an improved GAN model. It uses a BiLSTM with an attention injection mechanism to capture correlations between data and employs Wasserstein distance to capture and learn the distribution of high-dimensional raw data, reducing the false alarm rate. Outliers are detected using reconstruction loss and discriminant loss, and the flexibility of fog computing is leveraged for expansion, contributing to efficient detection. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating the IoT intrusion detection method based on an improved GAN model according to an embodiment of this application.

[0046] Figure 2 This is a flowchart illustrating the training of an intrusion detection model according to an embodiment of this application.

[0047] Figure 3 This is a schematic diagram illustrating the division of a long sequence into subsequences according to an embodiment of this application;

[0048] Figure 4 This is a schematic diagram of the generator structure of the improved GAN model according to an embodiment of this application;

[0049] Figure 5 This is one of the flowcharts illustrating the training of an improved GAN model according to an embodiment of this application;

[0050] Figure 6 This is a second schematic diagram illustrating the process of training and improving a GAN model according to an embodiment of this application.

[0051] Figure 7 This is one of the flowcharts illustrating the optimized and improved GAN model according to an embodiment of this application;

[0052] Figure 8 This is a second flowchart illustrating the optimized and improved GAN model according to an embodiment of this application.

[0053] Figure 9 This is a schematic diagram of the structure of an IoT intrusion detection device based on an improved GAN model according to an embodiment of this application;

[0054] Figure 10 This is a block diagram of an electronic device used to implement the IoT intrusion detection method based on the improved GAN model according to the embodiments of this application. Detailed Implementation

[0055] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] It should be noted that the acquisition, storage, use and processing of data in the technical solution of this application all comply with the relevant provisions of laws and regulations.

[0057] One embodiment of this application provides an IoT intrusion detection method based on an improved GAN model, executed in a fog computing environment, such as... Figure 1 As shown, the method includes:

[0058] Step 10: Obtain network traffic data to be detected from the edge device;

[0059] Step 20: Using the network traffic data to be detected as input, determine the first anomaly score corresponding to the network traffic data to be detected based on the pre-trained intrusion detection model, wherein the intrusion detection model is trained based on the improved GAN model;

[0060] Step 30: In response to the first abnormal score exceeding a preset abnormal score threshold, determine that the network traffic data to be detected is intrusion data.

[0061] Current research on GAN-based IoT intrusion detection still has its shortcomings. Existing techniques propose using BiLSTM as the generator and discriminator of the GAN, and injecting an attention mechanism to better represent the feature relevance of IoT data. When learning to capture the distribution of high-dimensional IoT data, the model gradient may vanish, leading to low detection performance. To address this issue, Wasserstein distance is introduced into the adversarial loss to train the GAN model, which helps stabilize and accelerate model training. An anomaly function is defined using a combination of reconstruction loss and discriminative loss to identify anomalies, improving the accuracy of intrusion detection. This IoT intrusion detection method is written in Python, leveraging the advantages of fog nodes and cloud servers to design a scalable framework that helps support efficient detection.

[0062] Therefore, this application provides an IoT intrusion detection method based on an improved GAN model. It uses a BiLSTM with an attention injection mechanism to capture correlations between data, and employs Wasserstein distance to capture and learn the distribution of high-dimensional original data, reducing the false alarm rate. Outliers are detected using reconstruction loss and discriminative loss, and the method is extended with the flexibility of fog computing, contributing to efficient detection.

[0063] The following is about Figure 1 Each step will be explained in detail:

[0064] Step 10: Obtain the network traffic data to be detected from the edge device.

[0065] Here, the fog computing environment of this application is described: the fog computing environment includes an edge layer, a fog layer, and a cloud layer, wherein:

[0066] The edge layer includes edge nodes and edge devices, used to collect network traffic data and send the network traffic data to the fog layer;

[0067] The fog layer includes multiple fog nodes for calculating, analyzing, and storing the network traffic data. The IoT intrusion detection method based on the improved GAN model is executed at the gateway of the fog nodes, and each fog node is used to detect all attacks from the edge layer.

[0068] The cloud layer includes cloud servers used to store model configuration parameters and training configuration parameters.

[0069] In a specific example, based on an improved GAN-based IoT intrusion detection method, this invention proposes an IDS (Intrusion Detection System) aiming to simultaneously achieve high efficiency and low performance in IoT network anomaly detection. Therefore, it attempts to leverage the advantages of fog nodes and cloud servers to train the intrusion detection model. The fog computing environment consists of three components: an edge layer, a fog layer, and a cloud layer. The main functions of these layers are:

[0070] Edge layer: The edge layer includes edge nodes and edge devices that communicate through IoT networks via various network devices (such as wireless access points, routers, switches, and base stations) while also connecting to specific fog nodes that act as cloud functions.

[0071] Fog Layer: The fog layer consists of a large number of fog nodes, used to group computing resources near the network edge. As a core part of the IoT network, fog computing acts as an intermediary between the edge and the cloud, managing IoT traffic within its coverage area. Therefore, fog essentially possesses the available processing power, storage, and network resources to meet various network services.

[0072] Cloud layer: The cloud (i.e., cloud servers) possesses high-performance, powerful computing resources, enabling easy aggregation and storage of large amounts of data in data centers. Furthermore, cloud servers also store model configurations and other training settings.

[0073] Edge nodes / devices collect and analyze IoT traffic information from their base stations, such as network traffic data to be detected, and then send it to the fog layer for computation, analysis, and storage. Network gateways can be installed as software or devices to connect edge nodes, the cloud, and smart devices. The proposed IDS (Intrusion Detection System) will be deployed at the gateway of the fog nodes. The fog layer supports attack detection, and each fog node is responsible for detecting all attacks originating from the edge layer.

[0074] Step 20: Using the network traffic data to be detected as input, determine the first anomaly score corresponding to the network traffic data to be detected based on the pre-trained intrusion detection model, wherein the intrusion detection model is trained based on the improved GAN model.

[0075] In some optional embodiments of this example, such as Figure 2 As shown, step 20 further includes:

[0076] Step 201: Obtain a network traffic data sample set from the edge device, perform data preprocessing and subsequence partitioning on the network traffic data sample set to obtain training sample set subsequences and test sample set subsequences.

[0077] In this embodiment, data is collected from edge devices as training and testing datasets, then processed and normalized to [0,1] to accelerate model convergence. The data preprocessing includes: removing redundant features and illegal traffic records (i.e., null and missing values), converting symbolic features to numerical features using one-hot encoding, and finally normalizing to the range [0,1].

[0078] Furthermore, the applicant found that the preprocessed data sequence was still quite long, and directly inputting it into the model would lead to problems such as increased training time, slow parameter updates, and excessive computational overhead. Therefore, it was necessary to divide the long sequence into subsequences. Specifically, the subsequence division process is as follows: Figure 3 As shown, where:

[0079] The input is a data set of length l, and its expression is as follows:

[0080] S = {s1, s2, ..., s} n-1 ,s n},s i ∈R M×1 (i∈n)

[0081] s i This represents a single value collected at time step i. For simplicity, we will use M=1, s in the following discussion. i It is a scalar. When M>1, S is a multidimensional sequence.

[0082] To obtain training and test samples, a sliding window with a window size of t and a step size of 1 can be used to divide the original data into n subsequences.

[0083] Finally, the data after subsequence partitioning is divided into training sample set subsequences and test sample set subsequences.

[0084] Step 202: Using the training sample set subsequence as input, train the improved GAN model, and using the test sample set subsequence as input, optimize the improved GAN model to obtain the trained target intrusion detection model.

[0085] In this application, the improved GAN model includes a generator and a discriminator, wherein: the generator can continuously optimize its parameters during training, the output of the generator is the input of the discriminator, the generator can obtain a score for each sample input from the discriminator, and adjust the network parameters based on different scores.

[0086] In this application, the real data distribution is learned through adversarial training. A model is jointly designed using fog nodes and a cloud server, with the discriminator residing on the cloud server and the generator on the fog nodes. The model is trained on the cloud server. After a sufficient number of iterations, a generator (G) capable of producing similar (fake) time series and a discriminator (C) capable of distinguishing between fake and real data are trained. G needs to learn how to generate similar (fake) samples to fool C. Then, the generated data and real data are input into C, which needs to distinguish between real and fake samples.

[0087] like Figure 4 As shown, the generator includes two BiLSTM layers with an attention mechanism and a fully connected layer. The BiLSTM layers include a forward LSTM and a backward LSTM. The expression for the hidden state of the BiLSTM layer is:

[0088]

[0089] Wherein, H represents the hidden state of the BiLSTM layer; This represents the hidden state of a forward LSTM. This represents the hidden state of the inverse LSTM.

[0090] To learn the importance of each unit from sequence data, an attention mechanism is incorporated, determining the weight of the current input by calculating its impact on the output. The weight calculation process is as follows:

[0091]

[0092]

[0093] Among them, s i It is the i-th subsequence, w i It represents the weight information of the BiLSTM layer for the i-th subsequence.

[0094] In some optional embodiments of this example, such as Figure 5As shown, training the improved GAN model using a subset of the training sample set as input includes:

[0095] In one training cycle, the improved GAN model is trained using the following procedure:

[0096] Step 2021A: In the fog layer, the training sample set subsequence is input into the generator, training generated data is output, and a first loss function of the generator is determined based on the training sample set subsequence and the training generated data; and the training generated data is sent to the cloud server, wherein the cloud server is used to train the discriminator;

[0097] Step 2022A: In the cloud layer, the discriminator is trained using the training sample set subsequence as positive samples and the training generated data as negative samples, and the second loss function of the discriminator is determined, wherein the Wasserstein distance is used instead of JS divergence in the discriminator and the Sigmoid function of the last layer is removed.

[0098] According to step 2023A, determine the overall objective function based on the first loss function and the second loss function, and train the improved GAN model based on the overall objective function;

[0099] Step 2024A: Repeat the training process until the maximum training period is reached to obtain the initial intrusion detection model.

[0100] In a specific example, steps 2021A to 2024A above will be described in detail:

[0101] The training data is input into the generator, then mapped to the desired data space, and the output is... The generator learning mapping process, sent to the cloud server, is represented as follows:

[0102]

[0103] The generator's loss function, i.e., the first loss function, is defined as:

[0104]

[0105] The discriminator in the cloud server trains the model using received data containing generated data and real data from fog nodes. The original version of GANs is prone to training instability because its generator tends to produce samples that fool the discriminator rather than generating new samples to capture other patterns in the time series data. To overcome this limitation and ensure the stability of the training process, this application uses Wasserstein distance instead of JS divergence.

[0106] Because the Wasserstein distance needs to be fitted, the sigmoid function in the last layer is removed and not used; a fully connected layer is used to output the values ​​of various distributions. The loss function of the discriminator, i.e., the second loss function, is defined as:

[0107]

[0108] Where ||·||2 represents the L2 norm, the result of random interpolation between the generated sample and the real sample: Where δ is a random number between 0 and 1.

[0109] To effectively detect anomalies in the Internet of Things (IoT), the losses of the generator and discriminator are combined to represent the overall objective function, which can be written as:

[0110]

[0111] The training process is repeated until the maximum training cycle is reached, at which point the cloud server copies the discriminator and sends it to the fog nodes. Test data is then input into the trained model, and online anomaly detection is performed by calculating anomaly scores.

[0112] See Figure 6 The IoT intrusion detection method based on the improved GAN model in this application is executed in the fog layer and the cloud layer. In the fog layer, after the training data is preprocessed, similar data (fake data) is obtained by the generator. The fog node sends the real data and the fake data generated by the generator (i.e., a pair of data) to the cloud server in the cloud layer to train and update the model. The cloud server determines the authenticity of the pair of data and updates the parameters of the discriminator. When there is a calculation error, the error term is returned to the fog node to update the generator. Further, it is determined whether the maximum training period T (i.e., whether the Epoch is equal to T) has been reached. If the maximum period has not been reached, the above training process is repeated. When the maximum training period T is reached, the intrusion detection model (i.e., the training model) trained on the fog node is used to detect the anomaly of the test data, thereby obtaining the classification result, i.e., whether it is intrusion data.

[0113] In some optional embodiments of this example, such as Figure 7 As shown, using the subsequence of the test sample set as input, the improved GAN model is optimized to obtain the trained target intrusion detection model, including:

[0114] Step 2021B: Determine the true labels of the subsequences of the test sample set.

[0115] Step 2022B: Using the test sample set subsequence as input, determine the intrusion detection result corresponding to the test sample set subsequence based on the initial intrusion detection model.

[0116] In this embodiment, fog nodes are used for training and detecting IoT data. A trained generator G and discriminator C are used to detect anomalous data in the sequence. An anomalous score is calculated using a weighted average of the reconstruction loss and the discriminant loss, and a local adaptive thresholding method is employed to identify anomalous data.

[0117] In some optional embodiments of this example, such as Figure 8 As shown, the step of using the test sample set subsequence as input and determining the intrusion detection result corresponding to the test sample set subsequence based on the initial intrusion detection model includes:

[0118] Step 2022B1: Input the test sample set subsequence into the generator to obtain test generated data, and determine the reconstruction loss function of the generator and the third loss function of the discriminator based on the test sample set subsequence and the test generated data;

[0119] Step 2022B2: Based on the reconstruction loss function and the third loss function, determine the overall loss function and normalize the overall loss function to obtain the anomaly scoring function;

[0120] Step 2022B3: Determine the second anomaly score corresponding to the test sample set subsequence based on the anomaly scoring function, and determine the intrusion detection result corresponding to the test sample set subsequence based on the second anomaly score.

[0121] In a specific example, the reconstruction loss R is used to measure the difference between the generated points and the original points; that is, the reconstruction loss function is defined as:

[0122] R(sn)=∑|sG BiLSTM (z n )|

[0123] Since this method adopts the idea of ​​WGAN, and the discriminator outputs the Wasserstein distance, the discriminant output is directly used to calculate the discriminant loss. The discriminant loss function, i.e., the third loss function, is defined as follows:

[0124] C(s n )=f(s n )

[0125] The loss function L, i.e., the overall loss function, is defined as the weighted sum of the reconstruction loss function and the third loss function, as shown below:

[0126] L(s n )=(1-α)R(s n )+αC(s n )

[0127] Where α is an adjustable parameter of the final evaluation detection function.

[0128] The anomaly scoring function can be derived from the overall loss function, which is obtained by normalizing the weighted sum of the reconstruction loss function and the third loss function. It is directly defined as:

[0129] Score(s n )=(1-α)R(s n )+αC(s n )

[0130] This method employs an adaptive threshold approach to detect anomalies. After calculating the anomaly score at each time step, it calculates the mean and standard deviation of the anomaly scores over the entire time frame. The threshold is defined as being two standard deviations above the mean. If the anomaly score at a given time step exceeds the threshold, it is detected as an anomaly. After detecting anomalies at all time steps, a continuous anomaly sequence is obtained.

[0131] To reduce false alarms, a correction method was employed. For example, the abnormal sequence is... Calculate the maximum outlier score {m} for these sequences. 1 ,m 2 ,...,m i Then sort them in descending order and calculate the percentage decrease p. i =(m i-1 -m i ) / m i When the first sequence satisfies p i <θ (θ = 0.1), the subsequent sequences are all corrected to normal sequences.

[0132] Step 2023B: Determine the accuracy of the initial intrusion detection model based on the intrusion detection results and the real labels.

[0133] Step 2024B: In response to the accuracy being greater than or equal to a preset accuracy threshold, the initial intrusion detection model is used as the target intrusion detection model.

[0134] Step 2025B: In response to the accuracy being less than the preset accuracy threshold, optimize the initial intrusion detection model based on the intrusion detection results and the test sample set subsequence until the accuracy is greater than or equal to the preset accuracy threshold, thereby obtaining a trained target intrusion detection model.

[0135] Step 30: In response to the first abnormal score exceeding a preset abnormal score threshold, determine that the network traffic data to be detected is intrusion data.

[0136] In this embodiment, when the first abnormal score exceeds a preset abnormal score threshold, the network traffic data to be detected is determined to be intrusion data.

[0137] In summary, this invention provides an IoT intrusion detection method based on an improved GAN, which can achieve real-time detection of IoT attacks. The advantages of the IoT intrusion detection method based on the improved GAN are as follows:

[0138] (1) The method proposed in this invention is an unsupervised intrusion detection method based on an improved GAN, which solves the problem of difficulty in obtaining labeled attacks. It utilizes a BiLSTM with an attention injection mechanism as both a generator and a discriminator to capture the complex time complexity of the data. Furthermore, it uses Wasserstein distance instead of JS distance, which outperforms other deep learning-based intrusion detection methods in terms of time cost and convergence. It produces fewer output errors, maintains computational efficiency, and has better generalization ability.

[0139] (2) This invention is scalable, combining fog nodes and cloud servers, and can be deployed in an IoT network. The invention divides the entire detection mechanism into smaller parts, each dedicated to a specific function, and can be deployed in a production environment for modification and development without affecting the overall system. Therefore, the method proposed in this invention is suitable for complex and large-scale IoT structures.

[0140] Based on the same inventive concept, this application also provides an IoT intrusion detection device based on an improved GAN model, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of the problem solved by this IoT intrusion detection device based on an improved GAN model is similar to that of an IoT intrusion detection method based on an improved GAN model, the implementation of an IoT intrusion detection device based on an improved GAN model can refer to the implementation of an IoT intrusion detection method based on an improved GAN model, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0141] like Figure 9 As shown, this IoT intrusion detection device based on an improved GAN model includes:

[0142] The acquisition module 601 is configured to acquire network traffic data to be detected from the edge device;

[0143] The anomaly score determination module 602 takes the network traffic data to be detected as input and determines the first anomaly score corresponding to the network traffic data to be detected based on a pre-trained intrusion detection model, wherein the intrusion detection model is trained based on an improved GAN model.

[0144] The intrusion data determination module 603 is configured to determine the network traffic data to be detected as intrusion data in response to the first anomaly score exceeding a preset anomaly score threshold.

[0145] In some optional embodiments of this example, the fog computing environment includes an edge layer, a fog layer, and a cloud layer, wherein:

[0146] The edge layer includes edge nodes and edge devices, used to collect network traffic data and send the network traffic data to the fog layer;

[0147] The fog layer includes multiple fog nodes for calculating, analyzing, and storing the network traffic data. The IoT intrusion detection method based on the improved GAN model is executed at the gateway of the fog nodes, and each fog node is used to detect all attacks from the edge layer.

[0148] The cloud layer includes cloud servers used to store model configuration parameters and training configuration parameters.

[0149] In some alternative embodiments of this example, the improved GAN model includes a generator and a discriminator, wherein:

[0150] The generator comprises two BiLSTM layers with an attention mechanism and a fully connected layer. The BiLSTM layers include a forward LSTM and a backward LSTM. The expression for the hidden state of the BiLSTM layer is as follows:

[0151]

[0152] Wherein, H represents the hidden state of the BiLSTM layer; This represents the hidden state of a forward LSTM. This represents the hidden state of the inverse LSTM.

[0153] In some optional embodiments of this example, the step of training the intrusion detection model includes:

[0154] A network traffic data sample set is obtained from an edge device. The network traffic data sample set is preprocessed and subsequenced to obtain a training sample set subsequence and a test sample set subsequence.

[0155] The improved GAN model is trained using the subsequence of the training sample set as input, and optimized using the subsequence of the test sample set as input, resulting in a trained target intrusion detection model.

[0156] In some optional embodiments of this example, training the improved GAN model using a subset of the training sample set as input includes:

[0157] In one training cycle, the improved GAN model is trained using the following procedure:

[0158] In the fog layer, the training sample set subsequence is input into the generator, training generated data is output, and a first loss function of the generator is determined based on the training sample set subsequence and the training generated data; and the training generated data is sent to the cloud server, wherein the cloud server is used to train the discriminator;

[0159] In the cloud layer, the discriminator is trained using the training sample set subsequence as positive samples and the training generated data as negative samples, and the second loss function of the discriminator is determined, wherein the Wasserstein distance is used instead of JS divergence in the discriminator and the Sigmoid function of the last layer is removed.

[0160] Based on the first loss function and the second loss function, the overall objective function is determined, and the improved GAN model is trained based on the overall objective function;

[0161] Repeat the training process until the maximum training cycle is reached to obtain the initial intrusion detection model.

[0162] In some optional embodiments of this example, the step of using the subsequence of the test sample set as input to optimize the improved GAN model to obtain the trained target intrusion detection model includes:

[0163] Determine the true labels of the subsequences in the test sample set;

[0164] Using the test sample set subsequence as input, and based on the initial intrusion detection model, determine the intrusion detection result corresponding to the test sample set subsequence;

[0165] Based on the intrusion detection results and the real labels, determine the accuracy of the initial intrusion detection model;

[0166] In response to the accuracy being greater than or equal to a preset accuracy threshold, the initial intrusion detection model is used as the target intrusion detection model;

[0167] In response to the accuracy being less than the preset accuracy threshold, the initial intrusion detection model is optimized based on the intrusion detection results and the test sample set subsequence until the accuracy is greater than or equal to the preset accuracy threshold, thereby obtaining a trained target intrusion detection model.

[0168] In some optional embodiments of this example, determining the intrusion detection result corresponding to the subsequence of the test sample set as input, based on the initial intrusion detection model, includes:

[0169] The test sample set subsequence is input into the generator to obtain test generated data, and the reconstruction loss function of the generator and the third loss function of the discriminator are determined based on the test sample set subsequence and the test generated data.

[0170] Based on the reconstruction loss function and the third loss function, the overall loss function is determined, and the overall loss function is normalized to obtain the anomaly scoring function;

[0171] Based on the anomaly scoring function, a second anomaly score is determined for the subsequence of the test sample set, and based on the second anomaly score, the intrusion detection result corresponding to the subsequence of the test sample set is determined.

[0172] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0173] An electronic device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps of an IoT intrusion detection method based on an improved GAN model according to the foregoing embodiments.

[0174] A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform steps of an IoT intrusion detection method based on an improved GAN model according to the foregoing embodiments.

[0175] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of an IoT intrusion detection method based on an improved GAN model as described in the foregoing embodiments.

[0176] Figure 10A schematic block diagram of an example electronic device 900 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0177] like Figure 10 As shown, device 900 includes a computing unit 901, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 902 or a computer program loaded from storage unit 908 into random access memory (RAM) 903. RAM 903 may also store various programs and data required for the operation of device 900. The computing unit 901, ROM 902, and RAM 903 are interconnected via bus 904. Input / output (I / O) interface 905 is also connected to bus 904.

[0178] Multiple components in device 900 are connected to I / O interface 905, including: input unit 906, such as keyboard, mouse, etc.; output unit 907, such as various types of monitors, speakers, etc.; storage unit 908, such as disk, optical disk, etc.; and communication unit 909, such as network card, modem, wireless transceiver, etc. Communication unit 909 allows device 900 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0179] The computing unit 901 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 901 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 901 performs the various methods and processes described above, such as an IoT intrusion detection method based on an improved GAN model.

[0180] For example, in some embodiments, an IoT intrusion detection method based on an improved GAN model can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 908. In some embodiments, part or all of the computer program can be loaded and / or installed on device 900 via ROM 902 and / or communication unit 909. When the computer program is loaded into RAM 903 and executed by computing unit 901, one or more steps of the IoT intrusion detection method based on an improved GAN model described above can be performed. Alternatively, in other embodiments, computing unit 901 can be configured to perform an IoT intrusion detection method based on an improved GAN model by any other suitable means (e.g., by means of firmware).

[0181] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0182] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0183] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0184] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0185] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0186] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0187] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0188] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. An IoT intrusion detection method based on an improved GAN model, executed in a fog computing environment, characterized in that, include: Acquire network traffic data to be detected from edge devices; Using the network traffic data to be detected as input, a first anomaly score corresponding to the network traffic data to be detected is determined based on a pre-trained intrusion detection model. The intrusion detection model is trained based on an improved GAN model, which includes a generator and a discriminator. The generator includes two BiLSTM layers with an attention mechanism and a fully connected layer. In response to the first anomaly score exceeding a preset anomaly threshold, the network traffic data to be detected is determined to be intrusion data; The fog computing environment includes an edge layer, a fog layer, and a cloud layer, wherein: The edge layer includes edge nodes and edge devices, used to collect network traffic data and send the network traffic data to the fog layer; The fog layer includes multiple fog nodes for calculating, analyzing, and storing the network traffic data. The IoT intrusion detection method based on the improved GAN model is executed at the gateway of the fog nodes, and each fog node is used to detect all attacks from the edge layer. The cloud layer includes a cloud server for storing model configuration parameters and training configuration parameters; The steps for training the intrusion detection model include: A network traffic data sample set is obtained from an edge device. The network traffic data sample set is preprocessed and subsequenced to obtain a training sample set subsequence and a test sample set subsequence. The improved GAN model is trained using the subsequence of the training sample set as input, and the improved GAN model is optimized using the subsequence of the test sample set as input, to obtain the trained target intrusion detection model. The step of training the improved GAN model using the subsequence of the training sample set as input includes: In one training cycle, the improved GAN model is trained using the following procedure: In the fog layer, the training sample set subsequence is input into the generator, training generated data is output, and a first loss function of the generator is determined based on the training sample set subsequence and the training generated data; and the training generated data is sent to the cloud server, wherein the cloud server is used to train the discriminator; In the cloud layer, the discriminator is trained using the training sample set subsequence as positive samples and the training generated data as negative samples, and the second loss function of the discriminator is determined, wherein the Wasserstein distance is used instead of JS divergence in the discriminator and the Sigmoid function of the last layer is removed. Based on the first loss function and the second loss function, the overall objective function is determined, and the improved GAN model is trained based on the overall objective function; Repeat the training process until the maximum training cycle is reached to obtain the initial intrusion detection model.

2. The method according to claim 1, characterized in that, The BiLSTM layer includes a forward LSTM and a backward LSTM, wherein the expression for the hidden state of the BiLSTM layer is: in, This refers to the hidden layer state of the BiLSTM layer; This represents the hidden state of a forward LSTM. This represents the hidden state of the inverse LSTM.

3. The method according to claim 1, characterized in that, The step of using the subsequence of the test sample set as input to optimize the improved GAN model to obtain the trained target intrusion detection model includes: Determine the true labels of the subsequences in the test sample set; Using the test sample set subsequence as input, and based on the initial intrusion detection model, determine the intrusion detection result corresponding to the test sample set subsequence; Based on the intrusion detection results and the real labels, determine the accuracy of the initial intrusion detection model; In response to the accuracy being greater than or equal to a preset accuracy threshold, the initial intrusion detection model is used as the target intrusion detection model; In response to the accuracy being less than the preset accuracy threshold, the initial intrusion detection model is optimized based on the intrusion detection results and the test sample set subsequence until the accuracy is greater than or equal to the preset accuracy threshold, thereby obtaining a trained target intrusion detection model.

4. The method according to claim 3, characterized in that, The step of using the test sample set subset sequence as input and determining the intrusion detection result corresponding to the test sample set subset sequence based on the initial intrusion detection model includes: The test sample set subsequence is input into the generator to obtain test generated data, and the reconstruction loss function of the generator and the third loss function of the discriminator are determined based on the test sample set subsequence and the test generated data. Based on the reconstruction loss function and the third loss function, the overall loss function is determined, and the overall loss function is normalized to obtain the anomaly scoring function; Based on the anomaly scoring function, a second anomaly score is determined for the subsequence of the test sample set, and based on the second anomaly score, the intrusion detection result corresponding to the subsequence of the test sample set is determined.

5. An IoT intrusion detection device based on an improved GAN model, executed in a fog computing environment, characterized in that, include: The acquisition module is configured to acquire network traffic data to be detected from edge devices; An anomaly score determination module takes the network traffic data to be detected as input and determines the first anomaly score corresponding to the network traffic data to be detected based on a pre-trained intrusion detection model. The intrusion detection model is trained based on an improved GAN model, which includes a generator and a discriminator. The generator includes two BiLSTM layers with an attention mechanism and a fully connected layer. The intrusion data determination module is configured to determine the network traffic data to be detected as intrusion data in response to the first anomaly score exceeding a preset anomaly threshold. The fog computing environment includes an edge layer, a fog layer, and a cloud layer, wherein: The edge layer includes edge nodes and edge devices, used to collect network traffic data and send the network traffic data to the fog layer; The fog layer includes multiple fog nodes for calculating, analyzing, and storing the network traffic data. The IoT intrusion detection method based on the improved GAN model is executed at the gateway of the fog nodes, and each fog node is used to detect all attacks from the edge layer. The cloud layer includes a cloud server for storing model configuration parameters and training configuration parameters; The steps for training the intrusion detection model include: A network traffic data sample set is obtained from an edge device. The network traffic data sample set is preprocessed and subsequenced to obtain a training sample set subsequence and a test sample set subsequence. The improved GAN model is trained using the subsequence of the training sample set as input, and the improved GAN model is optimized using the subsequence of the test sample set as input, to obtain the trained target intrusion detection model. The step of training the improved GAN model using the subsequence of the training sample set as input includes: In one training cycle, the improved GAN model is trained using the following procedure: In the fog layer, the training sample set subsequence is input into the generator, training generated data is output, and a first loss function of the generator is determined based on the training sample set subsequence and the training generated data; and the training generated data is sent to the cloud server, wherein the cloud server is used to train the discriminator; In the cloud layer, the discriminator is trained using the training sample set subsequence as positive samples and the training generated data as negative samples, and the second loss function of the discriminator is determined, wherein the Wasserstein distance is used instead of JS divergence in the discriminator and the Sigmoid function of the last layer is removed. Based on the first loss function and the second loss function, the overall objective function is determined, and the improved GAN model is trained based on the overall objective function; Repeat the training process until the maximum training cycle is reached to obtain the initial intrusion detection model.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the IoT intrusion detection method based on an improved GAN model as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the IoT intrusion detection method based on an improved GAN model as described in any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the IoT intrusion detection method based on an improved GAN model as described in any one of claims 1 to 4.

Images