Internet of Things sensing layer network intrusion detection method and device, and storage medium

Abstract

The invention provides an Internet of Things sensing layer network intrusion detection method and device and a storage medium, belongs to the field of Internet of Things security protection technology and network security technology, and improves the feature acquisition capability of a model for a network intrusion data stream by improving a graph neural network and optimizing an original message transmission structure in a basic graph convolution model. A bidirectional propagation message memory mechanism is adopted, and the generalization ability and robustness of the model to adversarial attacks are further improved through iterative reaggregation of data in nodes of intrusion data streams. By adopting a feature analysis-based minimum spanning tree algorithm, the calculation amount and redundancy of the model are reduced. Through the design fusion method, high prediction accuracy is maintained in various attack environments of the Internet of Things edge device, good generalization ability and practicability are shown, and a more reliable solution is provided for application to actual Internet of Things environment deployment.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security technology, and in particular to an intrusion detection method, device and storage medium for an Internet of Things perception layer device network. Background Art

[0002] Traditional IoT security systems mainly focus on protecting the security of the application layer and the network layer, and largely ignore the protection of the perception layer devices. Due to the particularity of the perception layer devices, they often have small computing and storage capabilities, and directly transplanting the existing security protection technology applicable to the network layer is not effective. Therefore, how to combine the existing mature network security technology with the perception layer devices so that they can play the same protective role is also a future research trend. Since the existing network intrusion detection system is vulnerable to adversarial attacks, this attack modifies the input examples with imperceptible perturbations, resulting in incorrect classification by the model.

[0003] Therefore, designing an accurate, stable and computationally efficient intrusion detection method and device for the IoT perception layer device network is of great significance for preventing remote attacks, ensuring the reliability of the IoT perception layer device system, and promoting the research and development of the IoT network security system.

[0004] The Chinese invention patent with application number CN202410326304.0 proposes an IoT intrusion detection method, system and device, which relates to the field of network security technology. The method includes: obtaining IoT traffic data; screening the IoT traffic data to obtain traffic feature data; transforming the traffic feature data to obtain the traffic feature to be tested; training the IoT intrusion detection model based on the federated distillation learning contribution calculation; the IoT intrusion detection model is obtained by a central server and several clients participating in the training; the central server retains the public data set and the original label; each client retains its own labeled private data set; and using the IoT intrusion detection model to detect and classify the traffic feature to be tested. The present invention can reduce communication overhead and improve detection accuracy and security.

[0005] The Chinese invention patent with application number CN202410188565.0 proposes an IoT intrusion detection method and system based on prototype learning and federated learning, which belongs to the field of intrusion detection. By dividing the local neural network model of each IoT client into an embedding layer and a decision layer, the respective cluster centers of all potential vectors of each attack class on the client are calculated, and the cluster centers are used as the local prototypes of the corresponding attack class on the current client and uploaded to the central server; the global prototype is then generated by the central server and distributed back to the corresponding client; the local neural network model of the client is personalized and trained according to the global prototype so as to detect attacks on the local IoT network. The present invention enhances the intrusion detection capability of each client by aligning the local prototypes of different IoT clients while maintaining a certain degree of personalization of their local models.

[0006] The Chinese invention patent with application number CN202311543543.3 proposes an industrial Internet of Things intrusion detection method based on federated learning and self-attention. It introduces and optimizes the encoder structure of the Transformer network model and embeds convolutional neural networks and gated recurrent units. It uses the attention mechanism to build an intrusion detection model for the industrial Internet of Things; secondly, the detection model is integrated with the federated learning framework to allow multiple industrial Internet of Things to jointly build a comprehensive intrusion detection model. The model was verified on two different data sets. Experiments have shown that under the premise of protecting local data privacy, this model can improve the detection accuracy of industrial Internet of Things network attacks and reduce the false alarm rate. At the same time, the attention mechanism makes the model pay more attention to the correlation of internal data, and achieves the purpose of improving detection accuracy and reducing false alarms under the premise of ensuring the security of multi-party data.

[0007] However, the above existing technical methods still have the following defects in the environment of IoT perception layer device network:

[0008] 1. Mainstream network intrusion detection models focus on large models and highly complex algorithms, which enable them to maintain excellent performance such as high prediction accuracy when deployed and used in computer network environments. However, the high heterogeneity of IoT perception layer devices and the lack of computing and storage resources make the deployment of these models difficult. The weak computing power of IoT devices also makes it impossible for complex models to perform as expected.

[0009] 2. Traditional intrusion detection methods are susceptible to high false alarm rates caused by problems such as data imbalance and inaccurate feature extraction during the processing of raw data sets. As the number of features increases, the cost of feature extraction also increases significantly.

[0010] 3. Existing network intrusion detection systems are vulnerable to adversarial attacks, which modify input examples with imperceptible perturbations, resulting in incorrect classifications by the model. Using adversarial techniques to attack network intrusion detection systems proves that some existing network intrusion detection systems are extremely vulnerable to adversarial samples, causing the model accuracy, detection rate, and false positive rate to drop significantly. Summary of the invention

[0011] In view of the above problems, the first aspect of the present invention proposes a method for building a vehicle network intrusion detection model for new energy vehicles. The overall process is as follows: Figure 1 As shown, the following process is included:

[0012] Step 1:

[0013] (1a) Data collection phase: Collect device network message data for a certain period of time on the corresponding device, including source and end IP addresses, message segment length, and the protocol used to transmit the message, etc. as feature data for the input model;

[0014] (1b) Data preprocessing: First, non-numeric data are converted into numeric data, and invalid data and null values ​​Nan and Infinity in the data set are removed. The remaining data are standardized and the processed data are converted into graphical data that meets the model input requirements.

[0015] Step 2:

[0016] (2a) Generate adversarial data. First, classify the data. The original dataset D includes benign D G and malicious D b We first need to extract samples of a certain attack type that needs to be tampered with, and we need to keep the data relationship between the extracted messages and the adjacent messages;

[0017] (2b) Feature tampering: The malicious data D obtained from the above screening b Based on the adversarial data generation rules, α% of the data is tampered, and the remaining 1-α% of the data is not modified, and the tampered malicious data set D is obtained. b1 ,The rest is the malicious data set D b2 , then D b1 Randomly insert D b2 middle;

[0018] (2c) After the above steps are completed, the tampered malicious data set D b1 Insert the unmodified malicious dataset D b2 In the example above, we obtain a new malicious sample dataset D' bFinally, with the contextual connection, we compare the benign dataset D G Combine and obtain a new data set D';

[0019] Step 3: Based on the designed training strategy, the training data set preprocessed in steps 1 and 2 is used to train the network intrusion detection model of the IoT perception layer, including the use of the improved model iteration strategy and the optimization method based on the memory mechanism, and finally the network intrusion detection model of the IoT perception layer is obtained. The final model determines whether the device is subject to network intrusion based on the network data of the monitoring and analysis device in a certain period of time.

[0020] The present invention provides a data processing method, which converts the preprocessed training data set into a graph-like format data stream that meets the requirements of model training in the data preprocessing stage, including using a minimum spanning tree algorithm based on feature analysis to extract features from the preprocessed data set, and obtain the most valuable features from a large number of network data stream features. The algorithm flow is as follows Figure 2 shown.

[0021] The algorithm is based on the information gain theory. First, the original graph G = (V, E) contains all the nodes in the original data set. The algorithm first calculates the information gain of the features contained in each node, including information entropy, joint entropy, and conditional entropy. Finally, according to the relevance of the features, it determines whether the minimum spanning tree algorithm needs to be used to optimize the current node. When the information entropy IG exceeds the threshold ε, it means that the feature needs to be retained.

[0022] Given a sample set X = {x1, x2, ..., x m} is the sample u i The information entropy H(X) of sample X can be described as formula (1). The value of H(X) and its information carrying amount and sample set X = {x1, x2, …, x m} is directly proportional to the uncertainty.

[0023]

[0024] The joint entropy represents the m} and Y={y1,y2,…,y n}, the information contained in the above two sets is satisfied at the same time. Joint entropy is generally used to measure the uncertainty between two sample sets, and its definition is shown in formula (2):

[0025]

[0026] Conditional entropy H(Y|X) represents the uncertainty of sample set Y given the occurrence of sample X. It is defined as the mathematical expectation of the conditional probability distribution of set Y to X under the assumption that sample set X exists, as defined in formula (3):

[0027]

[0028] Based on the above definition, information gain can be expressed as formula (4):

[0029] IG(X,Y)=H(X)-H(X|Y) (4)

[0030] The present invention provides an optimization design of a graph convolutional network, performs optimization design of a model network, and a method for building a network intrusion detection model of the perception layer of the Internet of Things, characterized by: an iterative strategy in the model training process; constructing an improved graph neural network structure, the input of the network is a directed or undirected graph G = (V, E). The graph includes a set of nodes and some edges connecting them, and each node n∈N has an association vector representing its initial state This vector is related to its state X n During the MSMP-GCN network execution phase, these hidden state vectors are initialized using some node-related features in the input graph. At the same time, an iteration number t is set in the MSMP-GCN network. Each message transmission iteration t mainly includes three stages: message generation; message aggregation; message update. The specific process is as follows Figure 3 shown.

[0031] First, each node n sends its hidden state to the message m. n,m The form is sent to all adjacent points m∈V n ; Then, each node will use the message function P(·) to process each received message and obtain its neighboring nodes (X n ,X m ) state update more fine-grained representation. Afterwards, each node will apply the aggregation function A(·) to represent the hidden state h connecting them. v Combined with all the information obtained through the message function into one piece of information, this aggregation function is implemented in this model as the weighted W of the element x Multiply; Finally, each node updates its hidden state (h) based on the aggregated information of the neighboring nodes using an update function u(·) similar to that in a neural network v). All message passing processes will go through multiple iterations. Therefore, each node may receive information from any other node in the graph through its adjacent nodes, rather than relying solely on its adjacent nodes. Formally, this message passing algorithm can be described as formulas (5), (6), and (7):

[0032]

[0033] After completing the set t iterations, the GNN network executes the Readout function R(·) to output the model This function converts the final states of all nodes into model labels for output. The output state is as follows:

[0034]

[0035] The present invention provides a model optimization method based on a memory mechanism, characterized in that: Figure 3 The detailed steps are as follows:

[0036] The method of reaggregating the current message of each node and the historical messages of multiple adjacent nodes is to apply the memory mechanism to the message transmission process of the nodes in the model training. The specific process is to update its own state based on the state information of the currently connected node and its memory state at the previous moment. Figure 2 It means that a node aggregates the messages of its n neighboring nodes and updates its own state. The formula corresponding to the GRU unit is shown in formula (9):

[0037]

[0038] In formula (9), σ is the sigmoid activation function; x i is the input information of the GRU network; W r , W z , W h They are reset gate, update gate and corresponding weights in this learning process; b r , b z , b h is the corresponding bias parameter; U r , U z They are the reset gate and the update gate, respectively, for the weights corresponding to the hidden state data transmitted by the previous neuron; U h The output state of this neuron is the hidden state data h in this neuron t The above parameters are constantly updated as the message passing process between nodes progresses.

[0039] The second aspect of the present invention provides an Internet of Things perception layer network intrusion detection method and device, characterized in that: the device includes at least one processor and at least one memory, and the processor and the memory are coupled; the memory stores a computer execution program of an Internet of Things perception layer device intrusion detection model built by the building method described in any one of the first aspects; when the processor executes the computer execution program stored in the memory, the processor executes a method for building a model of an Internet of Things perception layer network intrusion detection method.

[0040] The third aspect of the present invention provides a computer-readable storage medium, characterized in that: the computer-readable storage medium stores a computer execution program of a model of a network intrusion detection method for an Internet of Things perception layer built by the building method as described in any one of claims 1 to 4, and when the computer execution program is executed by a processor, the processor executes a method for building a model of a network intrusion detection method for an Internet of Things perception layer.

[0041] Compared with the prior art, the present invention has the following beneficial effects:

[0042] 1. Aiming at the complex relational flow of data in the field of network intrusion detection, a multi-stage message passing network is designed. Compared with the graph convolutional network as the basic model, it enhances the network's information acquisition ability and better handles complex data;

[0043] 2. A minimum spanning tree optimization algorithm based on feature analysis is proposed to preprocess the data. Feature data with more dimensions is obtained through the principle of feature analysis. It is used to extract features from unbalanced data sets, overcoming the problems of large model calculation and slow convergence.

[0044] 3. A two-way message memory mechanism is introduced, which effectively improves the problem of insufficient generalization ability of the intrusion detection model network for complex multiple data streams by further strengthening the extraction capability of effective feature streams obtained based on the above algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Network intrusion detection flow chart based on improved graph neural network

[0046] Figure 2 Flowchart of minimum spanning tree optimization algorithm based on feature analysis

[0047] Figure 3 Flowchart of the message memory function structure between nodes

[0048] Figure 4 Message passing mechanism structure flow chart DETAILED DESCRIPTION

[0049] The present invention proposes a network intrusion detection method for the perception layer of the Internet of Things based on an improved graph convolutional network. The method is obtained by training the network intrusion detection model of the perception layer of the Internet of Things using a training data set, and then deploying the trained intrusion detection model to the actual Internet of Things device environment to monitor the transmission and processing of CAN data to achieve real-time detection and feedback. The overall process is as follows Figure 1 shown.

[0050] Step 1:

[0051] (1a) Data collection phase: Collect device network message data for a certain period of time on the corresponding device, including source and end IP addresses, message segment length, and the protocol used to transmit the message, etc. as feature data for the input model;

[0052] (1b) Data preprocessing: First, non-numeric data are converted into numeric data, and invalid data and null values ​​Nan and Infinity in the data set are removed. The remaining data are standardized and the processed data are converted into graphical data that meets the model input requirements.

[0053] Step 2:

[0054] (2a) Generate adversarial data. First, classify the data. The original dataset D includes benign D G and malicious D b We first need to extract samples of a certain attack type that needs to be tampered with, and we need to keep the data relationship between the extracted messages and the adjacent messages;

[0055] (2b) Feature tampering: The malicious data D obtained from the above screening b Based on the adversarial data generation rules, α% of the data is tampered, and the remaining 1-α% of the data is not modified, and the tampered malicious data set D is obtained. b1 ,The rest is the malicious data set D b2 , then D b1 Randomly insert D b2 middle;

[0056] (2c) After the above steps are completed, the tampered malicious data set D b1 Insert the unmodified malicious dataset D b2 In the example above, we obtain a new malicious sample dataset D' b Finally, with the contextual connection, we compare the benign dataset D G Combine and obtain a new data set D';

[0057] Step 3: Based on the designed training strategy, the training data set preprocessed in steps 1 and 2 is used to train the network intrusion detection model of the IoT perception layer, including the use of the improved model iteration strategy and the optimization method based on the memory mechanism, and finally the network intrusion detection model of the IoT perception layer is obtained. The final model determines whether the device is subject to network intrusion based on the network data of the monitoring and analysis device in a certain period of time.

Claims

1. A method for constructing a network intrusion detection model at the perception layer of the Internet of Things, comprising the following processes: Step 1: (1a) Data collection phase: Collect device network message data for a certain period of time on the corresponding device, including source and end IP addresses, message segment length, and the protocol used to transmit the message, etc. as feature data for the input model; (1b) Data preprocessing: First, non-numeric data are converted into numeric data, and invalid data and null values ​​Nan and Infinity in the data set are removed. The remaining data are standardized and the processed data are converted into graphical data that meets the model input requirements. Step 2: (2a) Generate adversarial data. First, classify the data. The original dataset D includes benign D G and malicious D b We first need to extract samples of a certain attack type that needs to be tampered with, and we need to keep the data relationship between the extracted messages and the adjacent messages; (2b) Feature tampering: The malicious data D obtained from the above screening b Based on the adversarial data generation rules, α% of the data is tampered, and the remaining 1-α% of the data is not modified, and the tampered malicious data set D is obtained. b1 , the rest is the malicious data set D b2 , then D b1 Randomly insert D b2 middle; (2c) After the above steps are completed, the tampered malicious data set D b1 Insert the unmodified malicious dataset D b2 In the above example, we obtain a new malicious sample dataset D′. b Finally, with the contextual connection, we compare the benign dataset D G Combined, we get a new data set D′ ； Step 3: Based on the designed training strategy, the training data set preprocessed in steps 1 and 2 is used to train the network intrusion detection model of the IoT perception layer, including the use of the improved model iteration strategy and the optimization method based on the memory mechanism, and finally the network intrusion detection model of the IoT perception layer is obtained. The final model determines whether the device is subject to network intrusion based on the network data of the monitoring and analysis device in a certain period of time.

2. The method for constructing a network intrusion detection model of the Internet of Things perception layer as claimed in claim 1, characterized in that: The method for converting the training data set into a graph-format data stream that meets the requirements of model training after preprocessing in step 1 includes using a minimum spanning tree algorithm based on feature analysis to extract features from the preprocessed data set and obtain the most valuable features from a large number of network data stream features. The algorithm is based on the information gain theory. First, the original graph G = (V, E) contains all the nodes in the original data set. The algorithm first calculates the information gain of the features contained in each node, including information entropy, joint entropy, and conditional entropy. Finally, according to the relevance of the features, it determines whether the minimum spanning tree algorithm needs to be used to optimize the current node. When the information entropy IG exceeds the threshold ε, it means that the feature needs to be retained. Given a sample set X = {x1, x2, ..., x m } is the sample u i The information entropy H(X) of sample X can be described as formula (1). The value of H(X) and its information carrying amount and sample set X = {x1, x2, ..., x m } is directly proportional to the uncertainty. The joint entropy represents the m } and Y = {y1, y2, ..., y n }, the information contained in the above two sets is satisfied at the same time. Joint entropy is generally used to measure the uncertainty between two sample sets, and its definition is shown in formula (2): Conditional entropy H(Y|X) represents the uncertainty of sample set Y given the occurrence of sample X. It is defined as the mathematical expectation of the conditional probability distribution of set Y to X under the assumption that sample set X exists, as defined in formula (3): Based on the above definition, information gain can be expressed as formula (4): IG(X,Y)=H(X)-H(X|Y) (4).

3. A method for building a network intrusion detection model for the perception layer of the Internet of Things as claimed in claim 1, characterized in that: Iteration strategy during model training; Construct an improved graph neural network structure. The input of the network is a directed or undirected graph G = (V, E). The graph includes a set of nodes and some edges connecting them. Each node n∈N has an associated vector representing its initial state This vector is related to its state X n Encoding operation is performed. In the MSMP-GCN network execution phase, these hidden state vectors are initialized using some node-related features in the input graph. At the same time, an iteration number t is set in the MSMP-GCN network. Each iteration t of message transmission mainly includes three stages: message generation; message aggregation; News update. First, each node n sends its hidden state to the message m. n，m The form is sent to all adjacent points m∈V n ; Then, each node will use the message function P(·) to process each received message and obtain its neighboring nodes (X n , X m ) state update more fine-grained representation. Afterwards, each node will apply the aggregation function A(·) to represent the hidden state h connecting them. n Combined with all the information obtained through the message function into one piece of information, this aggregation function is implemented in this model as the weighted W of the element x Multiply; Finally, each node updates its hidden state (h) based on the aggregated information of its neighbors using an update function u(·) similar to that in a neural network v ). All message passing processes will go through multiple iterations. Therefore, each node may receive information from any other node in the graph through its adjacent nodes, rather than relying solely on its adjacent nodes. Formally, this message passing algorithm can be described as formulas (5), (6), and (7): After completing the set t iterations, the GNN network executes the Readout function R(·) to output the model This function converts the final states of all nodes into model labels for output. The output state is as follows:

4. The method for building a network intrusion detection model for the perception layer of the Internet of Things as claimed in claim 1, characterized in that: The specific process of the optimization method based on the memory mechanism in step 3 is as follows: The method of re-aggregating the current message of each node and the historical messages of its multiple adjacent nodes is used. That is, the memory mechanism is applied to the message transmission process of the nodes in the model training. The specific process is to update its own state based on the state information of the currently connected node and its memory state at the previous moment. Figure 2 shows that after a certain node aggregates the messages of its n adjacent nodes, it updates its own state. The formula corresponding to the GRU unit is shown in formula (9): In formula (9), σ is the sigmoid activation function; x i is the input information of the GRU network; W r , W z , W h They are reset gate, update gate and the corresponding weights in this learning process; b r , b z , b h is the corresponding bias parameter; U r , U z They are the reset gate and the update gate, respectively, for the weights corresponding to the hidden state data transmitted by the previous neuron; U h The output state of this neuron is the hidden state data h in this neuron t The above parameters are constantly updated as the message passing process between nodes progresses.

5. A network intrusion detection method for the perception layer of the Internet of Things, characterized in that: The Internet of Things perception layer network intrusion detection model constructed by the construction method according to any one of claims 1 to 4 is deployed to the actual Internet of Things perception layer device, and includes the following process: S1, obtains the network data of IoT perception layer devices collected in real time; S2, data preprocessing, performs operations such as converting non-numeric data into numeric data, and converting the processed data into graphical data that meets the model input requirements S3, inputs the pre-processed data into the network intrusion detection of the IoT perception layer; the model analyzes the input data to identify whether there are known network attack types or unknown intrusion behavior patterns; S4, if an attack or intrusion is detected, the model will output the corresponding attack category label and confidence score.

6. A method and device for detecting network intrusion at the perception layer of the Internet of Things, characterized in that: The device includes at least one processor and at least one memory, and the processor and the memory are coupled; the memory stores a computer execution program of an Internet of Things perception layer device intrusion detection model built by the construction method as described in any one of claims 1 to 4; when the processor executes the computer execution program stored in the memory, the processor executes a method for building a model of an Internet of Things perception layer network intrusion detection method.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer execution program of a model of a network intrusion detection method for the perception layer of the Internet of Things built by the construction method as described in any one of claims 1 to 4. When the computer execution program is executed by the processor, the processor executes a method for building a model of a network intrusion detection method for the perception layer of the Internet of Things.

Images