Network intrusion detection method, system and device for smart home environment and medium

Abstract

The invention belongs to the technical field of network space security, and discloses a network intrusion detection method, system and device for a smart home environment, and a medium, and the method comprises the steps: obtaining the original network flow in the smart home environment; extracting feature samples of different protocol types in the original network traffic; a task set is constructed based on the feature samples and a small sample learning normal form, each to-be-detected task in the task set comprises a support set and a query set, the support set is used for guiding intrusion detection model learning, and the query set comprises a plurality of to-be-classified feature samples; inputting each to-be-detected task into the intrusion detection model for classification prediction to obtain an attack category corresponding to each to-be-classified feature sample; wherein the smart home environment intrusion detection model comprises a space-frequency feature fusion module and a classifier which are connected in sequence. According to the technical scheme of the invention, high classification accuracy and robustness can be realized under the condition of limited resources and limited samples.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and in particular relates to a network intrusion detection method, system, device and medium for a smart home environment. Background Art

[0002] The Internet of Things (IoT) is rapidly becoming a core component of our daily lives and industrial operations. As more and more devices are connected to the network, the amount of data they generate and the scope of their applications are also expanding dramatically. However, this connectivity also brings new security challenges, as the diversity and distributed nature of IoT devices make them new targets for cyber attacks. Internet of Things Intrusion Detection System (IoT IDS) has therefore become a key technology to ensure the security of the IoT. In recent years, a large number of excellent algorithms have emerged in the research of IoT intrusion detection systems, which have very good results in detecting abnormal traffic. These studies have one thing in common, that is, they all train models through huge data sets. At present, due to the diversity of IoT devices and the dynamic nature of the network environment, traditional intrusion detection methods based on a large number of samples face the challenges of data collection and annotation. In this diverse IoT environment, the incoherence of security measures is caused by factors such as device diversity, differences in operating system versions, and inconsistent firmware updates. This fragmentation makes it extremely difficult to maintain a unified security strategy, thus providing attackers with opportunities. In addition, when facing zero-day attacks, researchers usually cannot collect enough samples, so they may not have enough time to build a data set. At this time, the IoT intrusion detection system based on machine learning may fail, causing irreparable damage to industrial production, etc. The smart home environment, which belongs to the category of IoT, also faces the above problems. Once malicious traffic invades the smart home environment, it will cause the entire facility to be paralyzed, which may seriously threaten people's lives. Therefore, it is necessary to detect malicious traffic in time and issue an alarm.

[0003] Faced with the situation of few attack samples such as zero-day attacks, researchers have shifted their attention to small sample learning. As the name suggests, the IoT intrusion detection system based on small sample learning aims to develop efficient and accurate intrusion detection models in the face of sparse and unbalanced data. When faced with many types of smart home devices, the standards and protocols of smart home products may not be unified, and the traffic samples that can be collected are also limited. At this time, there may be insufficient samples to learn, and the use of traditional machine learning-based methods is not enough to cope with this complex environment. At this time, it is necessary to develop a small sample intrusion system that can handle different protocol traffic and detect in real time. Summary of the invention

[0004] The purpose of the present invention is to provide a smart home environment intrusion detection method, system, device and medium to solve the problems existing in the above-mentioned prior art.

[0005] To achieve the above object, the present invention provides a smart home environment intrusion detection method, comprising:

[0006] Get raw network traffic in smart home environments;

[0007] Extracting characteristic samples of different protocol types from the original network traffic;

[0008] Constructing a task set based on the feature samples and the small sample learning paradigm, wherein each task to be tested in the task set includes a support set and a query set, wherein the support set is used to guide the learning of the intrusion detection model, and the query set includes a number of feature samples to be classified;

[0009] Each of the tasks to be tested is input into the intrusion detection model for classification prediction to obtain the attack category corresponding to each of the feature samples to be classified; wherein the intrusion detection model includes a space-frequency feature fusion module and a classifier connected in sequence; the space-frequency fusion module includes a DCT submodule, a feature extraction submodule and a feature fusion module connected in sequence, and the feature extraction module is a four-layer convolutional neural network that introduces the ECA attention mechanism.

[0010] Optionally, obtain the original network traffic in the smart home environment, including:

[0011] Configure NetFlow on the router to collect the original network traffic passing through the router in real time based on the NetFlow method.

[0012] Optionally, extracting feature samples of different protocol types from the original network traffic specifically includes:

[0013] Based on the Tshark program and DPKT library, the features of the original network traffic of different protocol types are extracted to obtain feature samples of different protocol types and store them in csv files.

[0014] Optionally, before constructing the task set based on the feature samples and the small sample learning paradigm, it also includes performing data cleaning and normalization on the feature samples to obtain preprocessed feature samples, and constructing the task set based on the preprocessed feature samples in combination with the small sample learning paradigm.

[0015] Optionally, the training process of the intrusion detection model specifically includes:

[0016] Acquire training data, wherein the training data includes training tasks and corresponding attack categories of each feature sample;

[0017] An initial intrusion detection model is constructed, the training data is input into the initial intrusion detection model for classification prediction, and training is performed with the goal of minimizing the loss between the initial training result after classification prediction and the attack category of each feature sample corresponding to the training task to obtain the intrusion detection model.

[0018] Optionally, the processing process of the intrusion detection model specifically includes:

[0019] The spatial domain features corresponding to the feature samples in the support set / the query set are respectively extracted by the feature extraction submodule;

[0020] Performing frequency domain conversion on the feature samples in the support set / the query set by the DCT submodule, and extracting features from the feature samples after the frequency domain conversion by the feature extraction submodule to obtain frequency domain features corresponding to the feature samples in the support set / the query set;

[0021] The spatial domain features and frequency domain features corresponding to the support set / the query set are fused by the feature fusion module to obtain support features corresponding to the support set and query features corresponding to the query set;

[0022] constructing a number of attack category subspaces based on the supporting features;

[0023] The projection distance of the query feature on each of the attack category subspaces is calculated, and the predicted category probability of the query feature is calculated in combination with the Softmax function, and the predicted category corresponding to the highest probability is used as the attack category of the query feature.

[0024] A network intrusion detection system for a smart home environment, comprising:

[0025] A data acquisition module is used to obtain the original network traffic in the smart home environment; extract feature samples of different protocol types in the original network traffic; construct a task set based on the feature samples and a small sample learning paradigm, wherein each task to be tested in the task set includes a support set and a query set, wherein the support set is used to guide the learning of the intrusion detection model, and the query set includes a number of feature samples to be classified;

[0026] An intrusion detection module is used to input each of the tasks to be tested into the intrusion detection model for classification prediction, and obtain the attack category corresponding to each of the feature samples to be classified; wherein the intrusion detection model includes a space-frequency feature fusion module and a classifier connected in sequence; the space-frequency fusion module includes a DCT submodule, a feature extraction submodule and a feature fusion module connected in sequence, and the feature extraction module is a four-layer convolutional neural network that introduces the ECA attention mechanism.

[0027] An electronic device comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute an intrusion detection method for a smart home environment.

[0028] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the intrusion detection method for a smart home environment.

[0029] The technical effects of the present invention are:

[0030] The present invention realizes efficient detection of malicious traffic in smart home environments by using intrusion detection technology based on subspace and ECA mechanism under the condition of small samples (the number of samples available for model training is extremely limited). This method can achieve high classification accuracy and robustness under the conditions of limited resources and samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0032] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0033] Figure 1 is a block diagram of the overall structure of the model in the embodiment of the present invention;

[0034] Figure 2 A schematic diagram of a network structure for feature extraction in an embodiment of the present invention;

[0035] Figure 3 Schematic diagram of an ECA module in an embodiment of the present invention;

[0036] Figure 4 It is a space-frequency feature fusion module in the implementation of the present invention;

[0037] Figure 5 The figure is a flowchart of the intrusion detection implementation in the embodiment of the present invention. DETAILED DESCRIPTION

[0038] Various exemplary embodiments of the present invention will now be described in detail. This detailed description should not be considered as limiting the present invention, but should be understood as a more detailed description of certain aspects, features, and embodiments of the present invention.

[0039] It should be understood that the terms described in the present invention are only for describing special embodiments and are not intended to limit the present invention. In addition, for the numerical range in the present invention, it should be understood that each intermediate value between the upper and lower limits of the scope is also specifically disclosed. Each smaller range between the intermediate value in any stated value or stated range and any other stated value or intermediate value in the described range is also included in the present invention. The upper and lower limits of these smaller ranges can be independently included or excluded in the scope.

[0040] Unless otherwise indicated, all technical and scientific terms used herein have the same meanings as those of ordinary skill in the art generally understood by the present invention. Although the present invention describes only preferred methods, any method similar or equivalent to that described herein may also be used in the implementation or testing of the present invention. All documents mentioned in this specification are incorporated by reference to disclose and describe the methods related to the documents. In the event of a conflict with any incorporated document, the content of this specification shall prevail.

[0041] It will be apparent to those skilled in the art that various modifications and variations may be made to the specific embodiments of the present invention description without departing from the scope or spirit of the present invention. Other embodiments derived from the present invention description will be apparent to those skilled in the art. The present application description and examples are exemplary only.

[0042] The words “include,” “including,” “have,” “contain,” etc. used in this article are open-ended terms, meaning including but not limited to.

[0043] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0044] Embodiment 1

[0045] like Figure 1 - Figure 5As shown, in this embodiment, a method for intrusion detection in a smart home environment is provided, including: obtaining original network traffic in the smart home environment; extracting feature samples of different protocol types in the original network traffic; constructing a task set based on the feature samples and a small sample learning paradigm, wherein each task to be tested in the task set includes a support set and a query set, wherein the support set is used to guide the learning of the intrusion detection model, and the query set includes a number of feature samples to be classified; each of the tasks to be tested is input into the intrusion detection model for classification prediction, and an attack category corresponding to each of the feature samples to be classified is obtained; wherein the intrusion detection model includes a space-frequency feature fusion module and a classifier connected in sequence; the space-frequency fusion module includes a DCT submodule, a feature extraction submodule and a feature fusion module connected in sequence, and the feature extraction module is a four-layer convolutional neural network that introduces an ECA attention mechanism.

[0046] This embodiment realizes efficient detection of malicious traffic in smart home environments by using intrusion detection technology based on subspace and ECA mechanisms under the condition of small samples (the number of samples available for model training is extremely limited). This method can achieve high classification accuracy and robustness under the conditions of limited resources and samples.

[0047] This embodiment is carried out on the original network traffic in the smart home environment, and converts the original network traffic into a type suitable for model input by continuously transforming it. The space-frequency feature fusion module includes a DCT module and a feature extraction network. The DCT module is used to convert the network traffic sample into the frequency domain. The feature extraction network is a one-dimensional convolutional neural network with an ECA (efficient channel attention) mechanism. This embodiment classifies the network traffic based on the classification idea of ​​the subspace classifier, including the following steps:

[0048] 1) Sample data collection: collect original network traffic from IoT devices, such as DDoS-UDP-Flood, DoS-UDP-Flood, Mirai-greeth-flood, DNS-Spoofing, etc., and collect original network traffic through Netflow-based traffic monitoring technology.

[0049] 2) Traffic feature extraction: Use the Tshark program and DPKT library to extract features from raw network traffic of different protocol types and store them in a csv file.

[0050] 3) Construct a data set and sample the samples stored in the csv file. For the training set, 30 samples are extracted for each attack type and 2000 benign samples are extracted. For the test set, 20 samples are extracted for each attack type and 1200 benign samples are extracted.

[0051] 4) Normalization: The extracted sample features have large differences in numerical values. The features are uniformly normalized to between 0 and 1 to facilitate processing by the designed model.

[0052] 5) Constructing tasks. For subspace-based classifiers, it is necessary to construct tasks T for model training. i , each task T i It also includes a support set S i and a query set Q i , and then extract tasks according to the K-way M-shot form, where K represents K categories in each task and M represents M samples in each category.

[0053] 6) Space-frequency feature fusion: use one-dimensional DCT to convert network traffic samples into the frequency domain, and then use a one-dimensional feature extraction network with ECA attention mechanism to extract features from the samples in the space and frequency domains respectively, and finally fuse the features to obtain new features.

[0054] The space-frequency feature fusion module includes a DCT module, a feature extraction module and a feature fusion module; the main function of the DCT module is to transform the space domain traffic samples into the frequency domain, which can clearly distinguish the frequency distribution of network traffic and prepare for subsequent feature extraction and feature fusion.

[0055] The feature extraction module is a four-layer convolutional neural network with an ECA attention mechanism. Each convolution block includes a convolution layer, a BatchNorm layer, a ReLu activation layer, and a MaxPool layer. In order to avoid overfitting, a Dropout layer is added after the last convolution block. The feature fusion module fuses the spatial domain image information and the frequency domain image information respectively through the features extracted by the feature extraction module. A new fusion feature is obtained, and then a subspace is constructed for each category based on the fusion feature, and classification is performed based on this.

[0056] 7) Classification, calculate the subspace of each category, and calculate the distance between the sample to be tested and each subspace through the measurement module.

[0057] 8) Model training, set the training rounds to 200, the learning rate to 0.002 and reduce it by half every 50 rounds when M is greater than 1, and reduce it by half every 100 rounds when M is 1, and save the optimal model.

[0058] The method proposed in this embodiment applies the subspace classifier idea and embeds ECA (efficient channel attention) in the designed network. Specific algorithm examples include:

[0059] Step 1: Collect network traffic. This embodiment targets the smart home network environment. First, malicious traffic in the smart home network is collected as the research object, such as 33 types of attacks such as DDoS-UDP-Flood, DoS-UDP-Flood, Mirai-Greeth-Flood, and DNS-Spoofing. The original network traffic is collected through Netflow-based traffic monitoring technology.

[0060] Step 2: Feature extraction of traffic. Use the Tshark program and DPKT library to extract features of raw network traffic of different protocol types. 46 features such as Flow-duration, Header_Length, and Protocol Type are extracted and stored in a csv file, where one row represents one sample and one column represents one feature.

[0061] Step 3: Build a data set and sample the samples stored in the csv file in step 2. For the training set, 30 samples are extracted for each attack type and 2000 benign samples are extracted. For the test set, 20 samples are extracted for each attack type and 1200 benign samples are extracted.

[0062] Step 4: Normalization: The eigenvalues ​​of the samples vary in size and the gap is large. In this embodiment, the eigenvalues ​​need to be normalized to a uniform range. The normalization formula is shown in Formula 1.

[0063]

[0064] Step 5: Task construction. Before task construction, some professional terms in the field of small samples need to be defined. Currently, most small sample learning uses the episode learning paradigm to train the model. i It consists of two sets, namely the support set and the query set mentioned above. This learning paradigm describes how the model improves its capabilities given fragmented data in each iteration. Specifically, deep embedding is learned with limited labels and data. This learning paradigm is called K-way M-shot classification, which means that there are only K learnable categories in each task and M samples in each category. This example introduces the notation of (K-way M-shot) small sample learning. Each episode or task T i From the support set S = {(x 1,1 ,c 1,1 ),(x 1,2 ,c 1,2 ),…,(x K,M ,c K,M )} and query set Q = {q1,q2,…,q K×M}, where x i,jrepresents the jth sample of the ith category, c i,j ∈{1,…,K}. After the task construction is completed, each task includes a support set and a query set. The samples in the support set follow the K-wayM-shot learning paradigm, which is represented by a total of K categories and M samples in each category.

[0065] Step 6: Space-frequency feature fusion, such as Figure 4 As shown in the present embodiment, a spatial feature and frequency domain feature fusion module is designed. The spatial feature is realized through DCT transformation and feature extraction. The network traffic is converted to the frequency domain through one-dimensional DCT transformation. The feature extraction is a four-layer one-dimensional convolutional neural network. After each convolution block, this embodiment adds an ECA attention module to ensure that each calculation can focus on unique features. Each block includes a one-dimensional convolution layer with a kernel size of 3, a batch normalization layer, a Relu layer, and a MaxPool layer. The designs of the first three blocks are the same. In the last block, this embodiment adds a Dropout layer to reduce the risk of overfitting. The ECA attention module is shown in Figure 3 As shown in Figure 2, the efficient channel attention mechanism (Efficient Channel Attention) is a local cross-channel interaction strategy without dimensionality reduction. This strategy can reduce the complexity of the model while maintaining the performance of the model. This strategy can adaptively select the size of the one-dimensional convolution kernel to ensure the coverage of local cross-channel interactions. C, H, and W represent the number of channels, height, and width, respectively. GAP represents global average pooling, and σ represents the Sigmoid activation function. First, the aggregated features are obtained through global average pooling, and then cross-channel interactions are achieved through one-dimensional convolution. The weight distribution of channel features is then achieved through the Sigmoid function. The adaptive kernel size of the one-dimensional convolution is shown in Formula 2.

[0066]

[0067] Wherein, |t| represents the odd number closest to t, γ and b are custom parameters, which are set to 2 and 1 respectively in this embodiment.

[0068] Step 7: Classification. For an intrusion detection system, in layman's terms, it is to design a classifier to classify network traffic to identify malicious traffic and take timely countermeasures. Below, this embodiment describes how to create a subspace and classify based on it. A set of samples encoded by the feature extractor can be represented as X c =[f θ (x c ,1)-μ c ,…,f θ (x c ,K)-μ c]. The classification method of the subspace-based intrusion detection system is to find the distance between the data point and its projection on the subspace. To do this, according to X c Calculate the projection matrix P for a specific class c , during the training process, the query vector q i Projection to P c On, and according to the query vector q i To P c The general subspace classifier of this embodiment is defined as:

[0069] d c (q)=-||(IM c )(f θ (q)-μ c )|| 2 (3)

[0070] in M j Indicated by P c The projection matrix, P c is the matrix B c The truncated matrix of I represents the c The original space matrix, f θ (q) represents the feature vector of the query sample. When predicting the category of the query sample, the distance d between its query vector and each projection subspace is calculated. c (q), and then the Softmax function is used to calculate the probability of the predicted label. The category label corresponding to the highest probability is the category to which the traffic sample predicted by the proposed algorithm belongs. In this embodiment, the probability of assigning the query sample to category c is defined as:

[0071]

[0072] Step 8: Loss function: In order to make the generated subspace more discriminative, that is, the distance between subspaces of different categories is larger, this embodiment uses Grassmann geometry to calculate the distance between subspaces of each category, accurately representing the category differences of different subspaces. Given two subspaces P i and P j , whose distance metric is defined as:

[0073]

[0074] From Formula 5, it can be clearly seen that maximizing the distance between two subspaces is achieved by minimizing Therefore, it is natural to introduce it into the loss function in this embodiment, and this term can be minimized through continuous iteration of the model.

[0075] The first term is the cross entropy classification loss function, the second term is the subspace loss function, and λ is the weight coefficient.

[0076] Step 9: Model training, set the training rounds to 200, the learning rate to 0.002 and reduce it by half every 50 rounds when M is greater than 1, and reduce it by half every 100 rounds when M is 1, and save the optimal model. The model training process is as follows:

[0077] First, the model parameters θ are randomly initialized from the task set T i Extract k tasks for model training and traverse each task T i And find the set X after removing the mean of each sample feature c =[f θ (x c ,1)-μ c ,…,f θ (x c ,K)-μ c ]; for X c Perform SVD singular value decomposition to obtain the left singular matrix U; truncate the matrix U to obtain the subspace; traverse the samples in the query set, and use formula (3) to obtain the projection distance between the query sample and each category subspace. Use formula (4) to obtain the loss and perform back propagation to update the parameter θ; repeat the above steps until the model converges or reaches the predetermined training round, and obtain the optimal model.

[0078] A network intrusion detection system for a smart home environment, comprising:

[0079] A data acquisition module is used to obtain the original network traffic in the smart home environment; extract feature samples of different protocol types in the original network traffic; construct a task set based on the feature samples and a small sample learning paradigm, wherein each task to be tested in the task set includes a support set and a query set, wherein the support set is used to guide the learning of the intrusion detection model, and the query set includes a number of feature samples to be classified;

[0080] An intrusion detection module is used to input each of the tasks to be tested into the intrusion detection model for classification prediction, and obtain the attack category corresponding to each of the feature samples to be classified; wherein the intrusion detection model includes a space-frequency feature fusion module and a classifier connected in sequence; the space-frequency fusion module includes a DCT submodule, a feature extraction submodule and a feature fusion module connected in sequence, and the feature extraction module is a four-layer convolutional neural network that introduces the ECA attention mechanism.

[0081] An electronic device comprises a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute a network intrusion detection method for a smart home environment.

[0082] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the network intrusion detection method for a smart home environment is implemented.

[0083] The above is only a preferred specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network intrusion detection method for smart home environment, It is characterized in that include: Get raw network traffic in smart home environments; Extracting characteristic samples of different protocol types from the original network traffic; Constructing a task set based on the feature samples and the small sample learning paradigm, wherein each task to be tested in the task set includes a support set and a query set, wherein the support set is used to guide the learning of the intrusion detection model, and the query set includes a number of feature samples to be classified; Each of the tasks to be tested is input into the intrusion detection model for classification prediction to obtain the attack category corresponding to each of the feature samples to be classified; wherein the intrusion detection model includes a space-frequency feature fusion module and a classifier connected in sequence; the space-frequency fusion module includes a DCT submodule, a feature extraction submodule and a feature fusion module connected in sequence, and the feature extraction module is a four-layer convolutional neural network that introduces the ECA attention mechanism.

2. A network intrusion detection method for a smart home environment according to claim 1, It is characterized in that Obtain raw network traffic in a smart home environment, including: Configure NetFlow on the router to collect the original network traffic passing through the router in real time based on the NetFlow method.

3. A network intrusion detection method for a smart home environment according to claim 1, It is characterized in that Extracting feature samples of different protocol types from the original network traffic, specifically including: Based on the Tshark program and DPKT library, the features of the original network traffic of different protocol types are extracted to obtain feature samples of different protocol types and store them in csv files.

4. A network intrusion detection method for a smart home environment according to claim 1, It is characterized in that Before constructing the task set based on the feature samples and the small sample learning paradigm, it also includes performing data cleaning and normalization processing on the feature samples to obtain preprocessed feature samples, and constructing the task set based on the preprocessed feature samples combined with the small sample learning paradigm.

5. A network intrusion detection method for a smart home environment according to claim 1, It is characterized in that The training process of the intrusion detection model specifically includes: Acquire training data, wherein the training data includes training tasks and corresponding attack categories of each feature sample; An initial intrusion detection model is constructed, the training data is input into the initial intrusion detection model for classification prediction, and training is performed with the goal of minimizing the loss between the initial training result after classification prediction and the attack category of each feature sample corresponding to the training task to obtain the intrusion detection model.

6. A network intrusion detection method for a smart home environment according to claim 1, It is characterized in that The processing process of the intrusion detection model specifically includes: The spatial domain features corresponding to the feature samples in the support set / the query set are respectively extracted by the feature extraction submodule; Performing frequency domain conversion on the feature samples in the support set / the query set by the DCT submodule, and extracting features from the feature samples after the frequency domain conversion by the feature extraction submodule to obtain frequency domain features corresponding to the feature samples in the support set / the query set; The spatial domain features and frequency domain features corresponding to the support set / the query set are fused by the feature fusion module to obtain support features corresponding to the support set and query features corresponding to the query set; constructing a number of attack category subspaces based on the supporting features; The projection distance of the query feature on each of the attack category subspaces is calculated, and the predicted category probability of the query feature is calculated in combination with the Softmax function, and the predicted category corresponding to the highest probability is used as the attack category of the query feature.

7. A network intrusion detection system for smart home environment, It is characterized in that include: A data acquisition module is used to obtain the original network traffic in the smart home environment; extract characteristic samples of different protocol types in the original network traffic; Constructing a task set based on the feature samples and the small sample learning paradigm, wherein each task to be tested in the task set includes a support set and a query set, wherein the support set is used to guide the learning of the intrusion detection model, and the query set includes a number of feature samples to be classified; An intrusion detection module is used to input each of the tasks to be tested into the intrusion detection model for classification prediction, and obtain the attack category corresponding to each of the feature samples to be classified; wherein the intrusion detection model includes a space-frequency feature fusion module and a classifier connected in sequence; the space-frequency fusion module includes a DCT submodule, a feature extraction submodule and a feature fusion module connected in sequence, and the feature extraction module is a four-layer convolutional neural network that introduces the ECA attention mechanism.

8. An electronic device, It is characterized in that It includes a memory and a processor, the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to execute a network intrusion detection method for a smart home environment according to any one of claims 1-6.

9. A computer-readable storage medium, It is characterized in that It stores a computer program, which, when executed by a processor, implements a network intrusion detection method for a smart home environment as described in any one of claims 1 to 6.

Images