An Internet of Things network intrusion detection method and device and a storage medium

Abstract

The present application relates to the technical field of detection, in particular to a kind of internet of things network intrusion detection method, system and storage medium, the local client of the present application obtains the data collected by internet of things equipment group, and based on these data, update global neural network model issued by central processor, to generate local neural network model, and the model parameter of local neural network model is sent to central processor, central processor integrates the model parameter from multiple local clients to update global neural network model, and the updated global neural network is issued to local client again, to generate new local neural network model again based on this, and the model parameter of new local neural network model is sent to central server, so as to continuously and repeatedly update global neural network model and generate new local neural network model, not only help to detect various modes of external attack, but also help to prevent external attack from changing model parameter.

Description

Technical Field

[0001] This invention relates to the field of detection technology, and in particular to a method, system and storage medium for detecting Internet of Things (IoT) network intrusion. Background Technology

[0002] The concept of the Internet of Things (IoT) aims to provide a variety of smart network applications and devices to improve people's lives. In recent years, the development of the IoT has increased our awareness of its complexity by encompassing computers, devices, businesses, and vehicles. Furthermore, the IoT is a network system built on recognized information exchange standards.

[0003] Data collected from end devices enables the establishment of intelligent decision-making mechanisms and effective management of IoT settings. However, connecting numerous real-world devices to the internet can raise concerns about cybersecurity risks. Therefore, security is a paramount requirement for these real-time systems due to the potential for unwanted intrusions, critical attacks, or errors. Summary of the Invention

[0004] To address the technical problems existing in the background art, the present invention provides an Internet of Things (IoT) network intrusion detection method, system, and storage medium, which helps to detect various modes of external attacks and prevent external attacks from changing model parameters.

[0005] To achieve the above technical solution, in a first aspect, the present invention provides an Internet of Things (IoT) network intrusion detection method, comprising the following steps:

[0006] Step 1: Generate a global neural network model and send the generated global neural network model to each local client;

[0007] Step 2: Each local client obtains data from the group of IoT devices connected to it;

[0008] Step 3: Each local client trains the received global neural network model locally based on the acquired data to generate a local neural network model;

[0009] Step 4: Each local client uploads the model parameters of its local neural network model to the central server;

[0010] Step 5: The central server aggregates all received local parameters to update the global neural network model;

[0011] Step 6: The central server will then distribute the updated global neural network model to each local client, and then execute Step 2.

[0012] Furthermore, step two also includes: each local client generating simulated data using a generative adversarial network.

[0013] Furthermore, the local training of the received global neural network model in step three includes using the Q-study reinforcement learning algorithm to perform local training on the received initialized global neural network model.

[0014] Furthermore, between step three and step four, the method further includes: using a function to map the model parameters of the generated local neural network model to privacy-preserving model parameters.

[0015] On the other hand, the present invention provides an Internet of Things (IoT) network intrusion detection system, comprising: multiple local clients, multiple IoT device groups, and a central server operating in real time on a blockchain network;

[0016] Multiple IoT device groups are configured to collect data;

[0017] The central server is configured to generate and update the global neural network and send the global neural network to multiple local clients;

[0018] Multiple local clients are configured to interconnect with multiple IoT device groups to establish a single IoT network. They acquire data from the IoT device groups through the established single Internet network and update the global neural network model issued by the central server based on the acquired data to generate a local neural network model.

[0019] Furthermore, the local client includes: a data acquisition module, an intrusion detection module, a control module, a communication module, and a storage module;

[0020] The data acquisition module is used to acquire data;

[0021] The intrusion detection module is used to update the global neural network model and generate a local neural network model;

[0022] The communication module is used to communicate with the central server and the group of IoT devices;

[0023] The storage module is used to store data.

[0024] On the other hand, the present invention also provides a computer-readable storage medium including a stored program, wherein, when the program is running, it controls the device where the computer-readable storage medium is located to execute the above-described Internet of Things network intrusion detection method.

[0025] The beneficial effects of this invention are as follows:

[0026] This invention involves a local client acquiring data collected by a group of IoT devices and updating the global neural network model issued by the central processing unit (CPU) based on this data to generate a local neural network model. The model parameters of the local neural network model are then sent to the CPU. The CPU integrates the model parameters from multiple local clients to update the global neural network model and then sends the updated global neural network model back to the local clients to generate a new local neural network model. The model parameters of the new local neural network model are then sent to the central server. This continuous and iterative process of updating the global neural network model and generating new local neural network models not only helps detect various types of external attacks but also helps prevent external attacks from altering the model parameters. Attached Figure Description

[0027] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0028] Figure 1 This is a flowchart of an Internet of Things (IoT) network intrusion detection method according to the present invention. Detailed Implementation

[0029] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0030] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, each technical and scientific term used in these embodiments has the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0031] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0032] In this invention, terms such as "upper," "lower," "left," "right," "front," "back," "vertical," "horizontal," "side," and "bottom" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used only to facilitate the description of the structural relationships of the various components or elements of this invention and do not specifically refer to any component or element in this invention. They should not be construed as limiting the invention.

[0033] In this invention, terms such as "fixed connection," "connected," and "linked" should be interpreted broadly, indicating a fixed connection, an integral connection, or a detachable connection; a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can determine the specific meaning of these terms in this invention based on the specific circumstances, and they should not be construed as limitations on the invention.

[0034] It should be noted that the expert model of this invention is obtained by training and fine-tuning an LLM model.

[0035] Example 1:

[0036] like Figure 1 As shown, this embodiment provides an IoT network intrusion detection method, including the following steps:

[0037] S1: Generate a global neural network model and send the generated global neural network model to each local client.

[0038] Specifically, the central server generates an initial global neural network model based on the data it holds, and transmits the generated initial global neural network model to each of the multiple local clients; wherein, the central server may include multiple nodes implemented on the blockchain network.

[0039] For ease of understanding and explanation, multiple local clients can be represented as local client 1, local client 2, ..., local client i, where i is an integer greater than or equal to 2.

[0040] S2: Each local client obtains data from the group of IoT devices connected to it.

[0041] It should be noted that the number of Internet of Things (IoT) device groups is no less than two. For ease of explanation and understanding, multiple IoT device groups can be represented as IoT device group 1, IoT device group 2, ..., IoT device group n, where n is an integer greater than or equal to 2.

[0042] Each local client Q can connect to at least one group of IoT devices.

[0043] For ease of understanding and explanation, the data obtained by local client 1 from the IoT device group connected to it is denoted as data 1, the data obtained by local client 2 from the IoT device group connected to it is denoted as data 2, and so on, the data obtained by local client i from the IoT device group connected to it is denoted as data i.

[0044] Specifically, the steps also include: each local client generating simulated data using generative adversarial networks (GANs).

[0045] S3: Each local client trains the received initial global neural network model locally based on the acquired data to generate a local neural network model.

[0046] It should be noted that, for ease of understanding and explanation, the generated local neural network model is denoted as local neural network model i, where the value of i is the same as the value representing the local client n.

[0047] Specifically, the local client i trains the received initial global neural network model locally based on the data i obtained from the IoT device group connected to it, and obtains the local neural network model i. The data i includes actual data obtained from the IoT device group and simulated data generated using generative adversarial networks.

[0048] For example, local client 5 uses data 5 obtained from the IoT device group connected to it to train the received initial global neural network model locally, and obtains local neural network model 5.

[0049] The local training of the received initial global neural network model includes: using the Q-study reinforcement learning algorithm to train the received initial global neural network model locally. Specifically, it evaluates the quality Q(A, a) of taking action a in a given state A. Specifically, it represents the update of Q after taking action a in state A, as shown in the following formula:

[0050] Where α is the learning rate; 𝑟 is the immediate reward; 𝛾 is the discount factor; 𝑠′ is the new state after performing action a; in intrusion detection, state 𝑠 can represent the current state of the network, action a represents different detection strategies, and reward 𝑟 is the feedback of the detection result; β is the weight of the adversarial example, 𝜆 is the weight of the adversarial loss, 𝜖 is a small positive number to prevent the probability from being zero; δi: the temporal difference error (TD error) of the i-th experience sample, which represents the importance of the experience sample. The larger the error, the greater the contribution of the experience to the training. It is the sum of all empirical sample errors and their smoothing factors, used to normalize the probability distribution.

[0051] S4: Each local client uploads the model parameters of its local neural network model to the central server.

[0052] Specifically, the model parameters of local neural module model i are denoted as model parameter i. For example, the model parameters of local neural network model 5 are model parameter 5.

[0053] Before uploading the model parameters of the local neural network model to the central server, the model parameters of the local neural network model are mapped to privacy-preserving model parameters. The specific formula is as follows:

[0054] Suppose we have a local neural network model parameter vector x, we can add Laplacian noise to the parameter vector x:

[0055]

[0056] in:

[0057] Δf is the sensitivity of the function f(x), that is, the change in output caused by changes in input data; ϵ is the privacy budget, which controls the degree of privacy protection.

[0058] S5: The central server aggregates all received local parameters to generate a new global neural network model.

[0059] The central server aggregates all received local parameters and updates the model parameters of the initial global neural network model based on the aggregated local parameters to generate a new global neural network model, which helps to prevent external attacks.

[0060] In addition, it should be noted that the central server can also use the model data generated by GANs to update the model parameters of the initialized global neural network model through simulated data and aggregated local parameters.

[0061] The specific formula for updating the initialized global neural network model is shown below:

[0062]

[0063] Where t is the training round, These are the model parameters of the updated global neural network model; It is the model parameter received from the i-th local client. It is the weight of the i-th local client, which is dynamically adjusted based on the amount of data or the quality of the model.

[0064] S6: The central server will distribute the newly generated global neural network model to each local client, enabling the local client to perform the next round of local training.

[0065] Specifically, the central server distributes the newly generated global neural network model to each local client, updates the initialized global neural network model, and enables the local client to perform the next round of local training, that is, return to step S2, and so on, to perform dynamic updates in real time.

[0066] It should be noted that steps S2 to S6 constitute a real-time dynamic loop process. In this embodiment, the initial global neural network model is trained locally in step 3. During the loop, the global neural network model generated in the previous round is actually updated. This embodiment is merely exemplary.

[0067] For the above embodiments, assuming a smart home system including multiple sensors (such as temperature sensors, smoke sensors, etc.), the intrusion detection system of the present invention is used for network security monitoring.

[0068] Initialization phase: The central server generates an initial global neural network model and distributes it to the local clients of each smart home device.

[0069] Local training phase: Each smart home device collects sensor data, applies the Q-study algorithm for local model training, and adds differential privacy noise to protect data privacy.

[0070] Model upload phase: Each smart home device uploads the updated model parameters to the central server via the blockchain network.

[0071] Global update phase: The central server combines the model parameters of each smart home device with the data generated by GANs to update the global neural network model and prevent external attacks.

[0072] Personalized distribution phase: The central server distributes the updated global model parameters to each smart home device for personalized adjustments to improve detection accuracy.

[0073] Therefore, this method can improve the accuracy and robustness of intrusion detection while ensuring data privacy.

[0074] In this embodiment, the local client obtains data collected by the IoT device group and updates the global neural network model issued by the central processing unit (CPU) with this data to generate a local neural network model. The model parameters of the local neural network model are then sent to the CPU. The CPU integrates the model parameters from multiple local clients to update the global neural network model and then sends the updated global neural network model back to the local clients to generate a new local neural network model. The model parameters of the new local neural network model are then sent to the central server. This process of continuously updating the global neural network model and generating new local neural network models not only helps detect various types of external attacks but also helps prevent external attacks from changing the model parameters.

[0075] Example 2:

[0076] This embodiment provides an Internet of Things (IoT) network intrusion detection system, including:

[0077] Multiple IoT device groups are used for data collection.

[0078] The central server is configured to generate and update the global neural network and send the global neural network to multiple local clients, wherein the central server is configured to interconnect with the multiple local clients and implement this on the blockchain network.

[0079] Multiple local clients are configured to interconnect with multiple IoT device groups to establish a single IoT network. They acquire data from the IoT device groups through the established single Internet network and update the global neural network model issued by the central server based on the acquired data to generate a local neural network model for real-time data intrusion detection.

[0080] Specifically, the local client includes a data acquisition module, an intrusion detection module, a control module, a communication module, and a storage module.

[0081] The data acquisition module acquires data collected by a group of IoT devices connected to the local client via a single Internet network.

[0082] The intrusion detection module includes an update generation unit and a generative adversarial network unit. The update unit is used to update the received global neural network model based on the data acquired by the data acquisition module and the simulated data generated by the generative adversarial network unit, so as to generate a local neural network model for real-time intrusion detection.

[0083] The data storage module is used to store the data acquired by the data acquisition module and the simulation data generated by the adversarial network unit.

[0084] The communication module is used to communicate with the central processing unit and multiple IoT device groups for data transmission.

[0085] Example 3:

[0086] This embodiment provides a computer-readable storage medium, which includes a stored program, wherein the program, when running, controls the device where the computer-readable storage medium is located to execute the IoT network intrusion detection method described in Embodiment 1.

[0087] The same or similar parts between the various embodiments in this specification can be referred to mutually. In particular, the terminal embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the description in the method embodiments.

[0088] In the embodiments provided by this invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or units may be electrical, mechanical, or other forms.

[0089] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0090] Additionally, it should be noted that the flowcharts in the accompanying drawings illustrate methods according to embodiments of this disclosure. In the descriptions corresponding to the flowcharts or block diagrams in the drawings, the operations or steps corresponding to different blocks may occur in a different order than disclosed in the description; sometimes, there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the function involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or can be implemented using a combination of dedicated hardware and computer instructions.

[0091] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting intrusion into an Internet of Things (IoT) network, characterized in that, Includes the following steps: Step 1: Generate a global neural network model and send the generated global neural network model to each local client; Step 2: Each local client obtains data from the group of IoT devices connected to it; Step 3: Each local client trains the received global neural network model locally based on the acquired data to generate a local neural network model; Step 4: Each local client uploads the model parameters of its local neural network model to the central server; Step 5: The central server aggregates all received local parameters to update the global neural network model; Step Six: The central server then distributes the updated global neural network model to each local client, and then executes Step Two, iterating in this way; Step four includes: before uploading the model parameters of the local neural network model to the central server, mapping the model parameters of the local neural network model to privacy-preserving model parameters, as shown in the following formula: Suppose we have a local neural network model parameter vector This can be achieved by modifying the parameter vector. Add Laplace noise: in: It is a function The sensitivity of the output is the change in output caused by changes in the input data. It's a privacy budget, controlling the level of privacy protection; Step five includes: the central server aggregates all received local parameters, and updates the model parameters of the initialized global neural network model based on the aggregated local parameters; The specific formula for updating the model parameters of the initialized global neural network model is as follows: ； in, It refers to training rounds. These are the model parameters of the updated global neural network model; Is the first received Model parameters for a local client; It is the first The weight of each local client is dynamically adjusted based on the amount of data or the quality of the model.

2. The IoT network intrusion detection method according to claim 1, characterized in that, Step two also includes: each local client generating simulated data using a generative adversarial network.

3. The IoT network intrusion detection method according to claim 1, characterized in that, The local training of the received global neural network model in step three includes using the Q-study reinforcement learning algorithm to train the received initial global neural network model locally.

4. The IoT network intrusion detection method according to claim 1, characterized in that, Between step three and step four, the method further includes: using a function to map the model parameters of the generated local neural network model to privacy-preserving model parameters.

5. An Internet of Things (IoT) network intrusion detection system, characterized in that, include: Multiple local clients, multiple IoT device groups, and a central server; Multiple IoT device groups are configured to collect data; The central server is configured to generate and update the global neural network and send the global neural network to multiple local clients; Multiple local clients are configured to interconnect with multiple IoT device groups to establish a single IoT network. They acquire data from the IoT device groups through the established single Internet network and update the global neural network model issued by the central server based on the acquired data to generate a local neural network model. The local clients include: a data acquisition module, an intrusion detection module, a control module, a communication module, and a storage module. The data acquisition module is used to acquire data; The intrusion detection module is used to update the global neural network model and generate a local neural network model; The communication module is used to communicate with the central server and the group of IoT devices; The storage module is used to store data; The communication module is used to communicate with the central server and the IoT device group, including: Each local client uploads the model parameters of its local neural network model to the central server. Before uploading the model parameters, the local neural network model's model parameters are mapped to privacy-preserving model parameters, using the following formula: Suppose we have a local neural network model parameter vector x, which can be obtained by modifying the parameter vector... Add Laplace noise: in: It is a function The sensitivity of the output is the change in output caused by changes in the input data. It's a privacy budget, controlling the level of privacy protection; The central server is configured to generate and update the global neural network, including: The central server aggregates all received local parameters and updates the model parameters for initializing the global neural network model based on the aggregated local parameters. The specific formula for updating the model parameters of the initialized global neural network model is as follows: ； in, It refers to training rounds. These are the model parameters of the updated global neural network model; Is the first received Model parameters for a local client; It is the first The weight of each local client is dynamically adjusted based on the amount of data or the quality of the model.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium resides to perform the Internet of Things network intrusion detection method as described in any one of claims 1 to 4.

Images