An industrial Internet of Things intrusion detection method

Abstract

The present invention discloses an industrial Internet of Things intrusion detection method, which includes: S1, data collection and preprocessing, using a training data module to use a proxy program and a flow probe, and commonly used data collection means to capture certain network flow data S2, core intrusion detection, according to the complexity of attacks in the industrial Internet of Things scenario and the sensitivity to calculation; S3, detection result display, the detection result display is divided into two parts, the first part is an instance overview function module, and the second part is an instance detail function module; S4, triggering system alarm, the triggering system is divided into two types of alarms, one is an alarm for quantity, and the other is a threshold alarm. The method realizes an integrated learning model that adopts multiple machine learning algorithms, and introduces a fine-grained weighting mechanism, a sub-classifier expansion mechanism and a dynamic update mechanism on the basis of the integrated learning model, thereby improving the detection accuracy of the model for various threats.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial Internet of Things, and in particular to an industrial Internet of Things intrusion detection method. Background Art

[0002] With the rapid popularization of industrial Internet of Things in recent years, network attacks against this field have also intensified. In order to resist potential network intrusions, a large number of intrusion detection-related studies have emerged in the field of industrial Internet of Things. These intrusion detection systems analyze the traffic of industrial equipment and detect malicious traffic in it, thereby realizing the detection and defense of network attacks.

[0003] However, due to the characteristics of industrial IoT, such as sensitive computing delays, high asset value, and wide potential attack surfaces, rule-based or traditional machine learning intrusion detection systems are difficult to resist complex and changeable network attacks, while deep learning-based intrusion detection will bring too high computing overhead. Therefore, ensemble learning-related technologies can be introduced to solve the shortcomings of existing research.

[0004] Ensemble learning is a widely used method in statistics and machine learning that improves prediction performance by combining multiple learning algorithms. The core idea of ​​this technique is that a single model has limitations in a specific task, but when multiple models are integrated together, they can complement each other's shortcomings and achieve better results than any single model. Ensemble learning is defined as using multiple learning algorithms to obtain better prediction performance than any algorithm alone. These algorithms are the same basic learners and different learners. They work together on different parts of the hypothesis space to form a more powerful comprehensive hypothesis. The advantages of ensemble learning include improving prediction accuracy, enhancing the generalization ability of the model, and reducing the risk of overfitting. It introduces diversity between models, which is achieved by using different subsets of training data or different algorithms. In theory, ensemble learning can represent a wider function space, thereby providing a more flexible model structure. Therefore, this scheme proposes an industrial Internet of Things intrusion detection method. Summary of the invention

[0005] The purpose of the present invention is to solve at least one of the technical problems existing in the prior art and to provide an industrial Internet of Things intrusion detection method. The method implements an integrated learning model that adopts multiple machine learning algorithms, and introduces a fine-grained weighting mechanism, a sub-classifier expansion mechanism and a dynamic update mechanism on the basis of the integrated learning model, thereby improving the model's detection accuracy for various threats.

[0006] The present invention also provides an industrial Internet of Things intrusion detection method as described above, comprising the following steps: S1, data collection and preprocessing, using a training data module to use an agent program and a flow probe, and after certain network flow data is captured by a common data collection method, a data set is formed, and data preprocessing is performed according to rules, which includes encoding non-numerical features, normalizing numerical data, and data set segmentation. The training data module is divided into two functions, data collection and data preprocessing, which realizes the capture of industrial Internet of Things device data and performs parsing preprocessing on the captured data, and pushes the generated csv file to a specified directory;

[0007] S2. Core intrusion detection. According to the complexity of attacks and the sensitivity to computing in the industrial Internet of Things scenario, an improved integrated learning framework is used as the core intrusion detection module. Three improved mechanisms are introduced, namely, fine-grained weighting mechanism, subclassifier expansion mechanism and integrated learning update mechanism. The generated csv file is passed through the core intrusion detection module for intrusion detection.

[0008] The fine-grained weighting mechanism first evaluates the performance of each classifier independently on data of multiple categories, and the indicators used include recall rate and precision, which are key indicators for measuring the effectiveness of classifiers. Then, according to the performance indicators of each classifier in different categories, the weight is dynamically calculated, where the weight reflects the performance of the classifier in a specific category, so that the classifier that performs well in a certain category has a greater influence on the decision of this category. Finally, the outputs of different classifiers are integrated according to the calculated weights to form the final prediction result; S3, detection result display, the detection result display is divided into two parts, the first part is the instance overview function module, through which the overall operating status of all devices connected to the current system is visualized, and the second part is the instance details function module, through which different devices are switched to view the specific situation of each device; S4, triggering system alarm, the triggering system is divided into two types of alarms, one is the alarm on quantity, that is, for IoT devices with frequent intrusion behaviors, the number of intrusions in the next time period is compared with the last statistical time when setting, and the number of alarms is increased or decreased, and the other is the threshold alarm, that is, the percentage of increase and decrease in the number of intrusions is set.

[0009] According to an industrial Internet of Things intrusion detection method provided by the present invention, the core detection module performs intrusion behavior detection by using an analysis engine and retrains the model according to the detection situation.

[0010] According to an industrial Internet of Things intrusion detection method provided by the present invention, the encoded non-numerical features exist in a data set through several symbolic attributes, protocol_type, service and flag, which are classification features. In order to enable these features to be effectively processed by the machine learning algorithm, they need to be converted into numerical form, and a label encoding method is adopted. The specific processing idea is as follows: first, each symbolic feature is traversed, and each unique category label is mapped to a unique integer to form a mapping relationship table. For each symbolic feature value in the data set, it is replaced with a corresponding integer according to the mapping relationship table, thereby completing the digital processing. Taking the protocol_type field as an example, there are three labels tcp, udp, and icmp in this feature, and their mapping relationships are tcp -> 0, udp -> 1, and icmp -> 2.

[0011] According to an industrial Internet of Things intrusion detection method provided by the present invention, the numerical features in the normalized numerical data show different scales and ranges in the data set. The values ​​of src_bytes and dst_bytes range from a few bytes to several megabytes. These different feature ranges will have an adverse effect on the algorithm performance. For algorithms that are sensitive to dimension, all numerical features can be made to have the same scale through normalization processing, which helps to accelerate the convergence of the learning algorithm and improve the model performance. The specific processing process of the normalized numerical data is as follows: first, for each numerical feature, the maximum and minimum values ​​in the data set are calculated, and then the normalization formula is applied to map the original value of each feature to a fixed range of [0, 1]. The specific formula is as follows: ;

[0012] in is the original eigenvalue, and are the minimum and maximum values ​​of the feature in all samples, respectively. is the new normalized value.

[0013] According to an industrial Internet of Things intrusion detection method provided by the present invention, the data set segmentation divides the data set into a training set, a validation set and a test set to support the training, tuning and final evaluation of the model. The training set accounts for 70% of the total data and is the data part used to establish and train the machine learning model;

[0014] The validation set accounts for 15% of the total data. Its function is to perform parameter tuning and model selection during the model development process. This part of the data is used to verify the effects of different model configurations and help developers select the best model parameters to optimize model performance. The validation set can effectively avoid overfitting of the model during training and ensure that the model has good generalization ability.

[0015] The test set also accounts for 15% of the total data and is used to evaluate the performance of the model after the model is developed. The test set is the final stage of model evaluation. By testing on this part of independent data, the model's ability to process new data can be evaluated to ensure the model's practicality and reliability. The results of the test set provide a performance preview of the model before actual deployment.

[0016] According to an industrial Internet of Things intrusion detection method provided by the present invention, the recall rate is a classifier In category The number of positive samples correctly identified Divide by the total number of positive samples in this category , ,Accuracy is a classifier In category The number of positive samples correctly identified Divide by the number of samples that the classifier determines to be of this category, that is, the sum of the number of positive samples and the number of negative samples , ;

[0017] The weights are based on the classifier's The weighted average of recall and precision is calculated to ensure that both category coverage and accuracy are taken into account, where It is a tuning parameter used to balance the impact of recall and precision;

[0018] The prediction results are comprehensively output For each category All classifier prediction results The weighted average of is the number of classifiers;

[0019] The final prediction result is a weighted average Highest category .

[0020] According to an industrial Internet of Things intrusion detection method provided by the present invention, the sub-classifier expansion mechanism introduces the scalability of sub-classifiers based on the complexity and changing threat types in the industrial Internet of Things environment to ensure that the system adapts and expands with the emergence of new threats and the development of technology. First, the initial classifier combination and weights are set, and then the performance of all classifiers is monitored and evaluated regularly. Based on performance data and external threat analysis, new classifiers are introduced or existing classifiers are updated and eliminated, and the weights of all active classifiers are recalculated. Finally, the updated weights and classifiers are used to generate the final detection results.

[0021] According to an industrial Internet of Things intrusion detection method provided by the present invention, the integrated learning update mechanism is updated regularly, and it automatically executes model updates according to preset time intervals. The implementation steps include setting update cycles, data collection, model retraining, and deploying updated models; its conditional update is triggered based on system performance indicators. In the system performance, whether the time consumed by the entire process of collection, preprocessing, and detection meets the real-time requirements, and when it drops to an unacceptable level, the system will automatically start the update process. The implementation steps include setting performance thresholds, performance monitoring, triggering updates, data collection and model updates, and deploying updated models.

[0022] Compared with the prior art, the industrial Internet of Things intrusion detection method of the present invention implements an integrated learning model that adopts multiple machine learning algorithms, and introduces a fine-grained weighting mechanism, a sub-classifier expansion mechanism and a dynamic update mechanism on the basis of the integrated learning model, thereby improving the model's detection accuracy for various threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The present invention is further described below in conjunction with the accompanying drawings and embodiments;

[0024] Figure 1 This is a flow chart of an industrial Internet of Things intrusion detection method of the present invention;

[0025] Figure 2 This is a system architecture diagram of an industrial Internet of Things intrusion detection method of the present invention;

[0026] Figure 3 This is a system flow chart of an industrial Internet of Things intrusion detection method of the present invention. DETAILED DESCRIPTION

[0027] This section will describe in detail the specific embodiments of the present invention. The preferred embodiments of the present invention are shown in the accompanying drawings. The purpose of the accompanying drawings is to supplement the description of the text part of the specification with graphics, so that people can intuitively and vividly understand each technical feature and the overall technical solution of the present invention, but it cannot be understood as a limitation on the scope of protection of the present invention.

[0028] Reference Figure 1-3 , an industrial Internet of Things intrusion detection method according to an embodiment of the present invention comprises: S1, data collection and preprocessing, after certain network traffic data is captured by a training data module using an agent program and a traffic probe, a common data collection method is used to form a data set, and data preprocessing is performed according to rules, which includes encoding non-numerical features, normalizing numerical data and data set segmentation. The training data module is divided into two functions, data collection and data preprocessing, which realizes the capture of industrial Internet of Things device data and performs parsing preprocessing on the captured data, and pushes the generated csv file to a specified directory;

[0029] S2. Core intrusion detection. According to the complexity of attacks and the sensitivity to computing in the industrial Internet of Things scenario, an improved integrated learning framework is used as the core intrusion detection module. Three improved mechanisms are introduced, namely, fine-grained weighting mechanism, subclassifier expansion mechanism and integrated learning update mechanism. The generated csv file is passed through the core intrusion detection module for intrusion detection.

[0030] S3. Display of test results. The display of test results is divided into two parts. The first part is the instance overview function module. Through the instance overview function module, the overall operating status of all devices connected to the current system is visualized. First, the device operating status is counted and the real-time status of the monitored IoT devices is displayed, which is divided into three states: running, stopped, and abnormal. Then, the device details are displayed. The instance status and the last update time of the model are displayed in units of a single instance. At the same time, the overview includes two lists, namely the alarm list and the update list, which display the alarm instances, their alarm reasons, and the instances that need to be updated, so that users can understand the alarm status and the reasons for the alarm. You can pay attention to these two types of important information at the same time. The second part is the instance details function module. You can switch different devices through the instance details function module to view the specific situation of each device. After selecting a device, you should first display the overall situation of the current device intuitively. If the device is attacked by an intrusion, the status of the current device on the page is updated to "abnormal", and the pie chart is used to visualize several common attack behaviors based on the detection results. At the same time, you can also view the attack details within the time range of today, this week, and this month on the page, count the attacks suffered by the devices at different times, and display the risk trend and historical attack trend through a line chart.

[0031] S4. Trigger system alarm. For IoT devices with frequent intrusions, a monitoring item is added to actively monitor their intrusion behaviors. In the system alarm module, select the devices to be monitored, select the attack behaviors to be monitored, and use the algorithm designed above to identify and classify the intrusion behaviors. The trigger system is divided into two types of alarms. One is the alarm on quantity, that is, for IoT devices with frequent intrusion behaviors, the number of intrusions in the next time period will increase or decrease the number of alarms compared with the last statistical time when setting. The other is the threshold alarm, that is, the percentage of increase and decrease in the number of intrusions is set. The default base time of the system is the latest statistical time when setting the rules.

[0032] The core detection module detects intrusion behaviors by using an analysis engine and retrains the model based on the detection results.

[0033] Encoding non-numerical features There are several symbolic attributes in the dataset, protocol_type, service and flag, which are classification features. In order to enable these features to be effectively processed by machine learning algorithms, they need to be converted into numerical form. The label encoding method is used. The specific processing ideas are as follows: First, traverse each symbolic feature and map each unique category label to a unique integer to form a mapping relationship table. For each symbolic feature value in the dataset, replace it with the corresponding integer according to the mapping relationship table to complete the digital processing. Taking the protocol_type field as an example, there are three labels in this feature: tcp, udp, and icmp. Their mapping relationships are tcp -> 0, udp -> 1, and icmp-> 2.

[0034] The numerical features in normalized numerical data show different scales and ranges in the dataset. The duration value can range from a few milliseconds to several hours.

[0035] The values ​​of src_bytes and dst_bytes range from a few bytes to several megabytes. These different feature ranges will have an adverse effect on algorithm performance. For algorithms that are sensitive to dimension, normalization is used to make all numerical features have the same scale, which helps to accelerate the convergence of learning algorithms and improve model performance. The specific processing process of normalized numerical data is as follows: First, for each numerical feature, calculate its maximum and minimum values ​​in the data set, and then apply the normalization formula to map the original value of each feature to a fixed range of [0, 1]. The specific formula is as follows:

[0036] in is the original eigenvalue, and are the minimum and maximum values ​​of the feature in all samples, respectively. is the new normalized value.

[0037] When training and using ensemble learning models, the data set needs to be reasonably segmented to ensure the effectiveness of model training and generalization ability. Data set segmentation divides the data set into training set, validation set and test set to support model training, tuning and final evaluation. The training set accounts for 70% of the total data and is the data part used to establish and train machine learning models. At this stage, the model learns the relationship between the features and outputs in the training data and adjusts internal parameters to achieve the purpose of identifying and predicting unseen data. The adequacy and diversity of the training set are the key to whether the model can accurately learn and make effective predictions.

[0038] The validation set accounts for 15% of the total data. Its function is to perform parameter tuning and model selection during the model development process. This part of the data is used to verify the effects of different model configurations and help developers select the best model parameters to optimize model performance.

[0039] The test set accounts for 15% of the total data and is used to evaluate the performance of the model after its development. The test set is the final stage of model evaluation. The training data module uses multiple machine learning models, including but not limited to decision trees, support vector machines, naive Bayes and kNN algorithms. The data set forms corresponding multiple classifiers for the next step of core intrusion detection.

[0040] In the industrial Internet of Things environment, the types of threats faced are diverse and constantly evolving. Different classifiers perform well on certain types of threats, but perform mediocrely on other types. The fine-grained weighting mechanism allows the maximum use of the expertise of each classifier to improve the detection accuracy and efficiency of the entire system. In addition, this mechanism also helps to reduce the false alarm rate, which is crucial in maintaining stable operation of production lines and reducing unnecessary maintenance interventions. The fine-grained weighting mechanism is first used to independently evaluate the performance of each classifier on data from multiple categories. The indicators used include recall rate and precision, which are key indicators for measuring the effectiveness of classifiers. Recall rate is a classifier In category The number of positive samples correctly identified Divide by the total number of positive samples in this category , ， Accuracy is a classifier In category The number of positive samples correctly identified Divide by the number of samples that the classifier determines to be of this category, that is, the sum of the number of positive samples and the number of negative samples , ;

[0041] Then, according to the performance indicators of each classifier in different categories, the weight is dynamically calculated. Here, the weight is a reflection of the performance of the classifier in a specific category, so that the classifier that performs well in a certain category has a greater influence in the decision of this category. The weight can be calculated based on the performance of the classifier in the category. The weighted average of recall and precision is calculated to ensure that both category coverage and accuracy are taken into account, where It is a tuning parameter used to balance the impact of recall and precision;

[0042] ;

[0043] Finally, the outputs of different classifiers are combined according to the calculated weights to form the final prediction result. For each category All classifier prediction results The weighted average of is the number of classifiers;

[0044] The final prediction result is a weighted average Highest category .

[0045] That middle Represents different classifier numbers, Represents different categories of data. Representatives of categories Use all classifiers The prediction results, The weighted average of Represents different categories of data because multiple classifiers are used to classify the data Perform prediction classification and take the highest value Category As data is classified, the accuracy is improved.

[0046] At the same time, considering the complexity and changing threat types in the industrial Internet of Things environment, the sub-classifier expansion mechanism is introduced to ensure that the system adapts and expands with the emergence of new threats and the development of technology. First, the initial classifier combination and weight are set. After initialization, new classifiers are introduced or the weights of existing classifiers are updated according to the analysis data during operation. The classifier composition and weights of the entire system are dynamically changing. Then, according to the fine-grained empowerment mechanism, the performance of all classifiers is regularly monitored and evaluated, and based on performance data and external threat analysis, the performance data is obtained by regularly monitoring the performance of all classifiers, and the external threat analysis is obtained through data classification results. The classifiers are combined by setting weights, and the data is classified using all classifiers. According to the results obtained by the weights, new classifiers are introduced or the existing classifiers are updated and eliminated after analysis, and the weights of all active classifiers are recalculated. Finally, the updated weights and classifiers are used to generate the final detection results.

[0047] By introducing a scalable mechanism for sub-classifiers, the integrated learning framework can not only adapt to current detection needs, but also flexibly respond to various new threats and technological changes that may arise in the future. This strategy will greatly enhance the durability and effectiveness of the industrial Internet of Things security system, ensuring that the system remains efficient and accurate in the face of an ever-changing industrial environment.

[0048] The integrated learning update mechanism automatically updates the model according to the preset time interval through regular updates. The implementation steps include setting the update cycle, data collection, model retraining, and deploying the updated model. The conditional update is triggered based on the system performance indicators. When the time spent on the entire process of acquisition, preprocessing, and detection in the system performance meets the real-time requirements and drops to an unacceptable level, the system will automatically start the update process. The implementation steps include: setting performance thresholds, performance monitoring, triggering updates, data collection and model updates, and deploying the updated model. The introduction of the model update mechanism, especially the combination of regular updates and conditional updates, is a key strategy to ensure that the industrial Internet of Things security system can continue to effectively respond to new threats. Regardless of the current performance of the model, this approach ensures that the model can be regularly trained with the latest data to adapt to potential environmental changes.

[0049] The embodiments of the present invention are described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Various changes can be made within the knowledge scope of ordinary technicians in the technical field without departing from the purpose of the present invention.

Claims

1. An industrial Internet of Things intrusion detection method, characterized in that: The following steps are involved: S1. Data collection and preprocessing. After capturing certain network traffic data using the agent program and traffic probe through the training data module, a data set is formed. Data preprocessing is performed according to the rules, which includes encoding non-numerical features, normalizing numerical data, and data set segmentation. The training data module is divided into two functions: data collection and data preprocessing. The generated csv file is pushed to the specified directory. S2. Core intrusion detection. According to the complexity of attacks and the sensitivity to computing in the industrial Internet of Things scenario, an improved integrated learning framework is used as the core intrusion detection module. Three improved mechanisms are introduced, namely, fine-grained weighting mechanism, subclassifier expansion mechanism and integrated learning update mechanism. The generated csv file is passed through the core intrusion detection module for intrusion detection. The fine-grained weighting mechanism first evaluates the performance of each classifier independently on multiple categories of data, using indicators such as recall and precision, and then dynamically calculates weights based on the performance indicators of each classifier on different categories. Finally, the outputs of different classifiers are combined according to the calculated weights to form the final prediction result. The recall rate is a classifier In category The number of positive samples correctly identified Divide by the total number of positive samples in that category , ,Accuracy is a classifier In category The number of positive samples correctly identified Divide by the number of samples that the classifier determines to be of this category, that is, the sum of the number of positive samples and the number of negative samples , ; The weights are based on the classifier's The weighted average of the recall and precision on the dataset is calculated to ensure that both the category coverage and accuracy are taken into account, where a is a tuning parameter used to balance the impact of recall and precision; ； The prediction results are comprehensively output For each category All classifier prediction results The weighted average of , where n is the number of classifiers; ； The final prediction result is a weighted average Highest category ; S3, test result display, the test result display is divided into two parts, the first part is the instance overview function module, through which the overall operation status of all devices connected to the current system is visually displayed, and the second part is the instance details function module, through which different devices are switched to view the specific status of each device; S4. Trigger system alarm. The trigger system is divided into two types of alarms. One is the alarm on quantity, that is, for IoT devices with frequent intrusions, the number of intrusions in the next time period will increase or decrease compared with the last statistical time during the setting. The other is the threshold alarm, that is, the percentage of increase and decrease in the number of intrusions is set.

2. The industrial Internet of Things intrusion detection method according to claim 1, characterized in that: The core detection module performs intrusion behavior detection by using an analysis engine and retrains the model according to the detection situation.

3. The industrial Internet of Things intrusion detection method according to claim 1 is characterized in that: The encoded non-numerical features are encoded by using label encoding method through the presence of several symbol attributes, protocol_type, service and flag in the data set. The specific processing ideas are as follows: first, each symbol feature is traversed, and each unique category label is mapped to a unique integer to form a mapping relationship table. For each symbol feature value in the data set, it is replaced with the corresponding integer according to the mapping relationship table, thereby completing the digital processing.

4. The industrial Internet of Things intrusion detection method according to claim 1, characterized in that: The specific process of normalizing numerical data is as follows: First, for each numerical feature, calculate its maximum and minimum values ​​in the data set, and then apply the normalization formula to map the original value of each feature to a fixed range of [0, 1]. The specific formula is as follows: ; in is the original eigenvalue, and are the minimum and maximum values ​​of the feature in all samples, respectively. is the new normalized value.

5. The industrial Internet of Things intrusion detection method according to claim 1 is characterized in that: The data set segmentation divides the data set into a training set, a validation set, and a test set to support the training, tuning, and final evaluation of the model. The training set accounts for 70% of the total data and is the data portion used to establish and train the machine learning model. The validation set accounts for 15% of the total data. Its function is to perform parameter tuning and model selection during the model development process. This part of the data is used to verify the effects of different model configurations and help developers select the best model parameters to optimize model performance. The test set accounts for 15% of the total data and is used to evaluate the performance of the model after the model is developed. The test set is the final stage of model evaluation.

6. The industrial Internet of Things intrusion detection method according to claim 1, characterized in that: The sub-classifier expansion mechanism introduces the scalability of sub-classifiers based on the complexity and changing threat types in the industrial Internet of Things environment to ensure that the system adapts and expands with the emergence of new threats and the development of technology. First, the initial classifier combination and weights are set, and then the performance of all classifiers is monitored and evaluated regularly. Based on performance data and external threat analysis, new classifiers are introduced or existing classifiers are updated and eliminated, and the weights of all active classifiers are recalculated. Finally, the updated weights and classifiers are used to generate the final detection results.

7. The industrial Internet of Things intrusion detection method according to claim 1 is characterized in that: The integrated learning update mechanism is updated regularly, and it automatically performs model updates according to preset time intervals. The implementation steps include setting update cycles, data collection, model retraining, and deploying updated models. Its conditional updates are triggered based on system performance indicators. The system performance is collected, preprocessed, and the time consumed in the entire process of detection meets the real-time requirements. When it drops to an unacceptable level, the system will automatically start the update process. The implementation steps include setting performance thresholds, performance monitoring, triggering updates, data collection and model updates, and deploying updated models.

Images