Lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree

Abstract

The invention discloses a lightweight WSN intrusion detection method based on incremental principal component analysis and a decision tree, and the method comprises the following steps: 1, data preprocessing: carrying out the data cleaning and feature coding of an original CICIDS2017 data set; 2, dividing a CICIDS2017 data set into a training set and a test set according to the proportions of 70% and 30%, and respectively carrying out standardization operation on the training set and the test set; 3, further simplifying a data structure based on standardized operation by adopting a feature extraction technology; 4, after feature extraction and dimension reduction of the data are completed, a decision tree classifier with information gain as a division standard is adopted to classify the network flow data expressed in a low-dimension form, and grid search cross validation is used to optimize hyper-parameters; the security requirement can be effectively met, and meanwhile, the resource limitation of the WSN can be better adapted.

Description

Technical Field

[0001] The invention belongs to the technical field of Internet of Things, and in particular relates to a lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree. Background Art

[0002] Wireless sensor networks (WSNs) are hailed as one of the most critical technologies of the 21st century and have a wide range of applications. However, the inherent characteristics of WSNs make them vulnerable to malicious network behaviors, which can seriously damage data transmission and disrupt network operation. In addition, the computing power and storage capacity limitations of sensor nodes pose a huge challenge to the implementation of effective intrusion detection in WSNs. The popularity and widespread application of the Internet of Things (IoT) have improved people's quality of life and changed all aspects of work. Relevant forecasts show that by 2025, the number of IoT-connected devices will reach 100 billion worldwide. Wireless sensor networks (WSNs) are an important supporting technology for the Internet of Things and have broad application prospects in environmental protection, disaster warning, agricultural production and smart cities. WSNs are composed of multiple (hundreds or even thousands) sensor nodes that can autonomously form a network system. Figure 1The basic architecture of WSN. Each sensor node collects data, including variables such as air quality, soil moisture, water quality, and pressure, and transmits this data through wireless communication channels (wireless sensor networks). The base station is responsible for collecting data from each node, performing appropriate processing, and ultimately transmitting it to the control center (controller) via the Internet, which usually includes a database, a cloud server, and various terminal devices. Sensor nodes are essentially small computers equipped with embedded operating systems (such as TinyOS and Contiki) responsible for sensing, collecting, and transmitting data. These devices are designed for cost-effectiveness and low power consumption, with limited communication bandwidth and computing requirements. In addition, sensor nodes are usually deployed in high-density configurations, requiring compact size and lightweight design. Therefore, memory space and battery capacity are inevitably limited and need to be effectively utilized to ensure the stable operation of WSN. In fact, these limitations are also common in various IoT devices, all of which have limited processing power and energy supply, which is a characteristic of IoT. In addition, nodes are exposed to outdoor environments for a long time and are susceptible to physical damage. Due to the characteristics of wireless communication, problems such as eavesdropping, intentional data tampering, and signal interference often occur in WSNs. When these data involve military operations or the medical field, the consequences can be disastrous. Many scholars regard traditional public key encryption technology and identity authentication as the first line of defense for WSN security. However, these traditional security mechanisms require a lot of computing overhead and resources, which are not practical in environments with limited sensor nodes. After the unremitting efforts of researchers, optimized lightweight encryption schemes have increased the feasibility of their application on low-power devices. It is precisely because of the above reasons that solving security problems within WSNs still faces a series of challenges.

[0003] In order to deal with various types of attacks, the security requirements of WSN generally include data integrity, availability, confidentiality, etc. At present, many relevant literatures have classified malicious attacks against WSN. According to different attack strategies, they can be divided into active attacks and passive attacks. Active attacks refer to attackers directly intervening in the normal communication of nodes, including changing the original form of data or injecting fraudulent data packets in an attempt to cause damage, such as man-in-the-middle attacks and energy exhaustion attacks. Passive attacks refer to attackers using tools such as network sniffers to monitor data transmission between nodes and extract valuable or even sensitive data. Further, according to different positions in the network, attacks are divided into internal attacks and external attacks. Internal attacks are usually more difficult to prevent than external attacks because attackers can impersonate legitimate nodes to carry out malicious activities. Similarly, attacks on each layer of the OSI model have also been classified. Table 1 is a classification of common attacks at each layer in WSN.

[0004] Table 1 Attacks on WSN

[0005]

[0006] Among the various types of attacks launched against WSNs, DoS attacks are the most common and can occur at every layer of the network. This is due to two main characteristics of WSNs: the limited resources of sensor nodes cannot process large-scale data requests; the distributed nature of the network makes it difficult for attackers to track. The main purpose of DoS attacks is to block the communication between sensor nodes, making the network unable to provide normal services, and eventually leading to node paralysis and energy exhaustion. With the evolution of various attack techniques, relying solely on the first line of defense is no longer sufficient to solve the security problems in WSNs. Many researchers have gradually regarded intrusion detection as the second line of defense. In recent years, the continuous advancement of hardware technology and the generation of massive data have supported the rapid development of machine learning (ML) and deep learning (DL), which has accelerated the pace of applying these two technologies to WSN intrusion detection. However, the scarcity of resources such as node storage space, battery life, processing power, and communication bandwidth will still pose certain challenges to the design and implementation of intrusion detection methods. In addition, intrusion detection based on ML and DL needs to rely on traffic data collected from the network. However, this data may not be suitable for direct input into the model due to the presence of unnecessary redundant features, noise, and especially high-dimensional problems, which not only increases storage requirements and computational costs, but also has an adverse impact on model training.

[0007] The application of ML and DL-based intrusion detection in WSN has attracted wide attention and a lot of research. Compared with traditional methods, they show great potential and advantages, opening up new ways to solve the security problems of WSN. Abhale and Manivannan applied several supervised learning algorithms (including DT, RF, SVM, NB, etc.) to intrusion detection in WSN and tested them on NSL-KDD, among which SVM had the highest overall accuracy among several models. Chandre et al. compared the performance of different ML techniques in WSN intrusion detection. The authors used convolutional neural networks as classifiers in this study and tested them on WSN-DS. According to their results, DL showed better detection results than ML. Chaurasiya et al. compared several ML techniques applied in WSN intrusion detection and proposed a DL-based WSN intrusion detection method, namely dense artificial neural network (Deep-ANN), which achieved an accuracy of 96.45% on the NSL-KDD dataset, slightly ahead of DT and SVM. The disadvantage is that the authors did not consider the additional impact of computational cost and model complexity. Although deep learning can provide higher accuracy for intrusion detection in many cases, they usually require considerable computing power, which can be challenging in resource-constrained settings. Wazirali and Ahmad compared the performance of different machine learning algorithms in detecting DoS attacks in WSNs. They partitioned the WSN-DS into various data subsets and worked on these partitions of different sizes. The results showed that statistical and logic-based machine learning models performed best on numerical statistical datasets. In addition, they pointed out that using deep learning algorithms on sensor nodes may be too demanding because deep learning requires a lot of training to achieve high accuracy. Similarly, Ahmad et al. also proposed a DL-based intrusion detection method and conducted a series of comparisons of ML- and DL-based network intrusion detection systems, of which about 80% of the schemes were DL-based. However, they pointed out that the implementation of these schemes is very complex and requires a lot of resource consumption, and these shortcomings must be further addressed. Otoum et al. introduced a DL-based intrusion detection system called RBC-IDS (Restricted Boltzmann Clustering) and compared it with an ML-based adaptive IDS (ASCH-IDS). The authors found that both systems had similar accuracy and detection rates, but the detection time of RBC-IDS was almost twice that of ASCH-IDS, indicating that DL increased the computational burden to some extent.

[0008] More and more researchers are combining feature engineering techniques with ML. One reason is that cyber attack techniques are constantly evolving and a single detection technique is not sufficient for effective defense. Another reason is to reduce the complexity of the model and thus reduce the system load. Khammassi and Krichen

[25]

[0009] A GA-LR wrapper method was introduced to address the challenges of high-dimensional data by identifying the best feature subsets from the UNSW-NB15 and KDD99 datasets. The method first adopted the GA genetic algorithm as the search strategy and then adopted logistic regression to evaluate and select the best subset. Dener et al. first selected features based on correlation using the Pearson coefficient and then combined it with the information gain ratio feature selection method. Finally, the data was input into the LightGBM classifier, which achieved an overall accuracy of 99.95% on the WSN-DS dataset. Meng et al. used the LightGBM model as the base classifier in a WSN-based scenario and applied recursive feature elimination for feature selection. Finally, the modeling time was reduced by 46% when tested on WSN-DS. However, recursive feature elimination is an iterative process, which may add additional overhead. Elsadig developed a lightweight ML method based on decision trees and Gini feature selection methods. The method has been tested on WSN-DS and compared with other traditional ML classifiers, with a processing time of only 0.13 seconds and an accuracy of 99.5%. This study further emphasizes that DL does not constitute the best solution for WSN. From related research, it can be seen that most lightweight intrusion detection solutions are implemented by using various feature selection techniques to select the best data feature subset, while feature extraction has fewer relevant solutions in this regard. Unlike feature selection methods, feature extraction techniques convert raw data into new low-dimensional feature space variables that encapsulate the structure and information inherent in the raw data.

[0010] Therefore, it is necessary to develop a lightweight intrusion detection method to reduce the computational complexity and node storage cost, thereby maintaining a relative balance between security and power consumption. Summary of the invention

[0011] To overcome the above-mentioned deficiencies of the prior art, the object of the present invention is to provide a lightweight WSN intrusion detection method based on incremental principal component analysis and information gain decision tree, which has the characteristics of high detection rate, low false alarm rate and low computational overhead.

[0012] To achieve the above object, the technical solution adopted by the present invention is: a lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree, comprising the following steps:

[0013] Step 1, data preprocessing. In the data preprocessing stage, the original CICIDS2017 dataset is cleaned and feature encoded to improve the data quality and ensure usability;

[0014] Step 2: The CICIDS2017 dataset is divided into a training set and a test set at a ratio of 70% and 30%, and the two sets are respectively subjected to the robust scaler, which is standardized by the median and quartiles of the data.

[0015] Step 3, feature extraction technology is used to further simplify the data structure based on the standardization operation; the specific approach is: perform incremental principal component analysis on the standardized original CICIDS2017 dataset, and extract the principal components through linear transformation; according to the cumulative variance explained ratio, on the premise of retaining more than 80% of the variance of the original CICIDS2017, conduct trial and error experiments to obtain the best combination of different numbers of principal components and batch sizes; through the adjustment and evaluation of different parameters, it is determined that 15 principal components are selected, and the input batch size is set to 10,000 samples, and finally the original CICIDS2017 dataset is effectively converted into a low-dimensional data representation, that is, data dimensionality reduction, while retaining the main information;

[0016] Step 4: After completing the feature extraction and dimensionality reduction of the data, a decision tree classifier based on information gain is used to classify the network traffic data represented in a low-dimensional form, and grid search cross-validation is used to optimize the hyperparameters. The specific approach is: input the intrusion detection data into the decision tree classifier based on information gain to learn the attack classification, and adjust the parameters of the decision tree classifier through the grid search method to further optimize the classification ability of the decision tree classifier. The experimental results show that compared with other classifiers and studies, the accuracy, precision, recall and F1 score of the proposed method are 99.6%, 99.64%, 99.65% and 99.64% respectively, the false alarm rate is 0.25%, and the processing time overhead is extremely small.

[0017] The parameters include the maximum depth of the decision tree classifier, the minimum number of split samples and the minimum number of samples for leaf nodes.

[0018] The data preprocessing described in step 1 includes data cleaning, feature encoding, data standardization and incremental principal component analysis.

[0019] The data cleaning refers to removing 207,117 duplicate samples in the CICIDS2017 dataset and deleting samples with missing values ​​and infinite values ​​in the Flow Bytes / s column, as well as samples with infinite values ​​in the Flow Packets / s column, to ensure the integrity of the data; the feature encoding adopts label encoding, which maps each category to an integer, starting from 0 and increasing by 1.

[0020] The data standardization is performed using the Robust Scaler method, using the median and interquartile range (IQR) for feature scaling. IQR represents the range between the first quartile and the third quartile. Specifically, for each feature, the median and IQR are first calculated, and then the IQR is used to scale the data to a smaller range. The scaled range depends on the distribution of the feature and the specific situation of the data. The following formula is usually used for standardization:

[0021]

[0022] Among them, x scaled is the standardized value of x, i is the raw value of the feature, and median(x) is the median of x.

[0023] The incremental principal component analysis is different from the principal component analysis. It can divide the original CICIDS2017 data set into several batches as input. The batch size is dynamically set according to specific needs, and the calculation is performed step by step according to the amount of data in each batch, and the principal components are continuously updated until the entire data set is processed. The implementation of incremental principal component analysis includes: based on singular value decomposition (SVD) or based on the covariance matrix.

[0024] The singular value decomposition is performed using the following formula:

[0025] X centered =U2V T (2)

[0026] Where, X centered It is the result of centralizing the data matrix X (representing the size of the current data set), which is decomposed into the product of three matrices, where U is the left singular matrix and each column is X centered The left singular vector of Σ is a diagonal matrix with the values ​​on the diagonal being X centered The singular values ​​of V T Yes X centeredThe transpose of the matrix composed of right singular vectors is performed. When each new batch of data blocks arrives, it is merged with the existing data to form a new matrix, and a new singular value decomposition is performed to update the singular values ​​and singular vectors. When all batches are processed, the principal components are selected from the final right singular matrix, and finally the projection transformation from high-dimensional space to low-dimensional space is completed on the original data, completing the feature extraction and data dimensionality reduction.

[0027] The covariance matrix is ​​based on the following formula:

[0028]

[0029] In formula (3), the covariance matrix is ​​represented by C, where n represents the number of samples in the current batch, x i represents the i-th sample, μ represents the sample mean vector, and T represents the transpose of the matrix; in the process of processing each batch, the overall mean and covariance matrix are iteratively updated; the eigenvalues ​​and eigenvectors are obtained from the covariance matrix, and then they are sorted in descending order according to the size of the eigenvalues, and the eigenvectors corresponding to the first d largest eigenvalues ​​are selected as principal components, where d is a pre-specified dimension, which is less than the number of features in the original data set; on the other hand, the incremental update feature of incremental principal component analysis (IPCA) allows dynamic processing of newly arrived data; whenever new sample data arrives, incremental principal component analysis does not recalculate the entire data set, but updates the existing model, avoiding redundant calculations, saving additional energy consumption, and improving response speed. This method is very suitable for applications with real-time requirements.

[0030] The decision tree classifier uses the information gain method as the feature selection method:

[0031] Gain(D, A)=H(D)-H(D|A) (4)

[0032] Where Gain(D,A) is the information gain, D is the training data set, and A is the feature. H(D) is the empirical entropy of data set D, and H(D│A) is the conditional entropy of training data set D under the condition of feature A. Entropy is a measure of the uncertainty of a random variable. The larger the entropy value, the greater the uncertainty. For a random variable X, entropy H(X) is defined as:

[0033]

[0034] X is a discrete random variable that can take on a finite number of values, and the probability distribution of X is P(X = x i )=p i , i = 1, 2, ..., n, n is the number of possible values ​​of the random variable X, p i It means that the random variable X takes the value x iThe probability of, ∑ is the cumulative symbol, and the conditional entropy indicates the degree of uncertainty of the random variable under given known conditions:

[0035]

[0036] In the formula, H(Y|X) is the conditional entropy, Y is the random variable, random variable X is the given condition, P(X=x i )=p i , i = 1, 2, ..., n, n is the number of possible values ​​of the random variable X, p i It means that the random variable X takes the value x i The probability of ∑ is the cumulative symbol, H(Y|X=x i ) is the value of X i The conditional entropy of Y at .

[0037] The beneficial effects of the present invention are:

[0038] The present invention adopts data cleaning, which is an important part of data preprocessing. There are usually noise, missing values, duplicate records and other problems in the original data set, which affect the accuracy and reliability of the data. Effective data cleaning helps to discover and solve these problems, thereby improving data quality.

[0039] Since the present invention adopts feature coding, non-numerical features in original data can be converted into numerical features, thereby ensuring the effectiveness of each model in processing numerical features.

[0040] The present invention uses data standardization to help eliminate the scale differences between different features and the influence of dimensional effects. Appropriate standardization of the data before performing the incremental principal component analysis introduced in 3.2.4 can make the contribution of each feature to IPCA more balanced, thereby ensuring that IPCA can accurately capture the main variance structure in the data and treat each feature fairly.

[0041] The present invention adopts incremental principal component analysis (IPCA), which is one of the variants of principal component analysis (PCA). The key idea of ​​incremental principal component analysis is to divide the original data set into multiple batches according to a certain batch size (which can be dynamically set according to the available memory size), and gradually calculate according to the amount of data in each batch, and continuously update the principal components until the entire data set is processed. This is different from the traditional PCA method that requires the entire data set to be loaded into the memory for work. In contrast, IPCA reduces memory resource consumption, especially when processing large-scale data sets, it can process data sets more efficiently and run faster.

[0042] The present invention adopts a decision tree classifier, the algorithm of the decision tree classifier is simple to implement, the model complexity is low, and the relevant application in the Internet of Things environment has high cost-effectiveness. Information gain is a measure of the degree to which a certain feature reduces the information uncertainty of the original data set. Node splitting usually hopes to select a feature with the largest information gain, which means that it also has a greater effect on reducing confusion.

[0043] Implementing intelligent intrusion detection in resource-constrained WSNs involves complex technical issues, and a low-energy detection model that can operate effectively under these constraints is needed to defend against potential attacks. From another perspective, this will also extend the service life of sensor nodes. The present invention balances security and power consumption, using IPCA to convert the original data space into a series of linearly independent vectors. In order to retain the overall data structure as much as possible, the optimal number of principal components and batch size for each execution are determined. The proposed method can achieve advanced performance indicators (such as accuracy, precision, recall, F1 score, and false alarm rate) while significantly reducing computational overhead, thereby improving efficiency and reliability. The method of the present invention is only applicable to one dataset.

[0044] The lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree of the present invention uses RobustScaler to mitigate the impact of outliers, extracts 15 principal components through incremental principal component analysis (IPCA) to map the CICIDS2017 dataset to a low-dimensional feature space, and effectively minimizes the computational requirements. The new compressed representation is further combined with a decision tree based on information gain. Experimental results show that compared with other classifiers and studies, the accuracy, precision, recall and F1 scores of the method of the present invention are 99.6%, 99.64%, 99.65% and 99.64% respectively, the false alarm rate is 0.25%, and the processing time overhead is extremely small. These results highlight the excellent performance of the scheme, indicating that it can effectively meet security requirements while better adapting to the resource constraints of WSNs. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 Schematic diagram of WSN infrastructure.

[0046] Figure 2 Flow chart of the method of the present invention.

[0047] Figure 3 Comparison of the accuracy of PCA under different standardizations.

[0048] Figure 4 The figure is a comparison of the accuracy of IPCA under different standardizations.

[0049] Figure 5 Schematic diagram of the cumulative explained variance ratio.

[0050] Figure 6 The following is a comparison chart of the accuracy of PCA and IPCA based on StandardScaler.

[0051] Figure 7 This is a comparison chart of the performance indicators of the model.

[0052] Figure 8 This is a comparison chart of the processing time of the models.

[0053] Fig. 9 A diagram of the confusion matrix.

[0054] Fig.10 Schematic diagram of ROC curve.

[0055] Fig.11 This is a line chart showing the accuracy comparison.

[0056] Fig.12 This is a line chart showing the accuracy comparison.

[0057] Fig.13 This is a line chart showing the comparison of recall rates.

[0058] Fig.14 It is a line chart comparing F1 scores. DETAILED DESCRIPTION

[0059] The structural principle and working principle of the present invention are further described in detail below in conjunction with the accompanying drawings and embodiments.

[0060] Dataset Introduction

[0061] The dataset used in this paper is CICIDS2017 developed by the Canadian Institute for Cyber ​​Security and the University of New Brunswick. This new public network intrusion detection dataset reflects real-world data. It was created to address the outdated and unreliable nature of many existing intrusion detection datasets. The dataset can be downloaded at https: / / www.unb.ca / cic / datasets / ids-2017.html. The CICIDS2017 dataset is divided into 8 data files, each corresponding to data collected in the morning and afternoon hours of each working day (Monday to Friday). It contains 78 feature columns and 1 label column. The label categories include benign network traffic and 14 types of network attacks: Benign, DoS Hulk, DoS GoldenEye, DoSslowloris, DoS Slowhttptest, DDoS, FTP-Patator, SSH-Patator, PortScan, Bot, Infiltration, Heartbleed, Web Attack–Brute Force, Web Attack–XSS, and Web Attack–SQLInjection. Table 2 shows the data collected on each working day and the corresponding categories.

[0062] Table 2 Data collected on each working day of CICIDS2017 and its labels

[0063]

[0064] The CICIDS2017 dataset contains a total of 2,830,743 data samples, including 2,273,097 benign traffic samples and 557,646 network attack samples. This study selected a subset to conduct related experiments. In addition, several similar attack categories were merged: Web Attack–Brute Force, Web Attack–XSS, and Web Attack–SQLInjection were merged into Web Attack, and DoS GoldenEye, DoS Hulk, DoS Slowhttptest, and DoSslowloris were merged into the DoS category. The updated CICIDS2017 dataset categories and corresponding numbers are shown in Table 3.

[0065] Table 3 Data categories and quantities of CICIDS2017

[0066]

[0067] See also Figure 2 ,The lightweight WSN intrusion detection method based on incremental principal component analysis and ,decision tree includes the following steps:

[0068] Step 1: Data preprocessing. In the data preprocessing stage, necessary data cleaning and feature encoding were performed on the original CICIDS2017 dataset to improve data quality and ensure usability, which is a key step to ensure effective model training.

[0069] Step 2: The CICIDS2017 dataset is divided into a training set and a test set at a ratio of 70% and 30%, respectively. According to the comparison of different ratios, the decision tree classifier can obtain the best performance under this division. Then, the two sets are standardized by the robust scaler, which performs the standardization operation through the median and quartiles.

[0070] Step 3, feature extraction technology is used to further simplify the data structure based on the standardization operation; the specific approach is: perform incremental principal component analysis on the original CICIDS2017 dataset after standardization, and extract the principal components through linear transformation; according to the cumulative variance explained ratio, on the premise of retaining more than 80% of the variance of the original CICIDS2017, conduct trial and error experiments to obtain the best combination of different numbers of principal components and batch sizes; through the adjustment and evaluation of different parameters, it is determined that 15 principal components are selected, and the input batch size is set to 10,000 samples, and finally the original CICIDS2017 dataset is effectively converted into a low-dimensional data representation while retaining the main information;

[0071] Step 4: After completing the feature extraction and dimensionality reduction of the data, a decision tree classifier based on information gain is used to classify the network traffic data represented in a low-dimensional form, and grid search cross-validation is used to optimize the hyperparameters; the specific method is: input the intrusion detection data into the decision tree classifier based on information gain to learn the attack classification, and adjust the parameters of the decision tree classifier (including the maximum depth of the decision tree classifier, the minimum number of split samples and the minimum number of samples of leaf nodes) through the grid search method, aiming to further optimize the classification ability of the decision tree classifier;

[0072] The present invention adopts common indicators of accuracy, precision, recall, F1 score and false alarm rate for verification, and calculates the training and inference time of the proposed method to prove its computational efficiency. The experimental results show that compared with other classifiers and studies, the accuracy, precision, recall and F1 score of the proposed method are 99.6%, 99.64%, 99.65% and 99.64%, respectively, the false alarm rate is 0.25%, and the computational overhead is extremely small.

[0073] The data preprocessing described in step 1 includes data cleaning, feature encoding, data standardization and incremental principal component analysis.

[0074] The data cleaning mentioned above refers to removing 207,117 duplicate samples in the CICIDS2017 dataset and deleting samples with missing values ​​and infinite values ​​in the Flow Bytes / s column, as well as samples with infinite values ​​in the Flow Packets / s column, to ensure the integrity of the data;

[0075] Data cleaning is an important part of data preprocessing. There are usually noise, missing values, duplicate records and other problems in the original data set, which affect the accuracy and reliability of the data. Effective data cleaning helps to discover and solve these problems, thereby improving data quality. Data analysis found that there are 207,117 duplicate samples in the CICIDS2017 data set. These duplicate samples will amplify noise and redundancy and reduce the generalization ability of the model, so it is necessary to remove them. In addition, the "Flow Bytes / s" column in the data set contains missing values ​​and infinite values, and the "Flow Packets / s" column also contains infinite values. Using the same method as duplicate samples, this study deleted samples with missing values ​​and infinite values ​​in the "Flow Bytes / s" column, as well as samples with infinite values ​​in the "Flow Packets / s" column to ensure the integrity of the data. Table 4 shows the distribution of the CICIDS2017 data set after data cleaning.

[0076] Table 4 Distribution of CICIDS2017 dataset

[0077]

[0078] The feature encoding uses label encoding, which maps each category to an integer, starting from 0 and increasing by 1.

[0079] Most machine learning algorithms can only process numerical data, so feature encoding is an essential step in machine learning, a process that converts non-numerical features in the original data into numerical features. When encoding category labels, two common methods are label encoding and one-hot encoding. Label encoding maps each category to an integer, starting from 0 and increasing by 1, and one-hot encoding maps each category to a vector with a length equal to the number of categories, where the position corresponding to the category is 1 and the other positions are 0. Considering the wide range of categories involved in this study and the effectiveness of each model in processing numerical features, the present invention uses label encoding. Table 5 is the result of encoding each category in the data set.

[0080] Table 5 Each category and its corresponding numerical label of CICIDS2017

[0081]

[0082] The data standardization is performed using the Robust Scaler method, and the median and interquartile range (IQR) are used for feature scaling. IQR represents the range between the first quartile and the third quartile. Specifically, for each feature, the median and IQR are first calculated, and then the IQR is used to scale the data to a smaller range. The scaled range depends on the distribution of the specific features and the specific circumstances of the data. The following formula is usually used for standardization:

[0083]

[0084] Among them, x scaled is the standardized value of x, i is the original value of the feature, median(x) is the median of x;

[0085] Data standardization helps eliminate the scale differences between different features and the impact of dimensional effects. Appropriate standardization of the data before performing incremental principal component analysis can make the contribution of each feature to IPCA more balanced, thereby ensuring that IPCA can accurately capture the main variance structure in the data and treat each feature fairly. One of the advantages of RobustScaler is that it can effectively reduce the impact of outliers on the scaling results, and the scaled data is more robust. Robust Scaler uses the median and interquartile range (IQR) for feature scaling. IQR represents the range between the first quartile and the third quartile.

[0086] The incremental principal component analysis is different from the principal component analysis. It can divide the original CICIDS2017 data set into several batches as input. The size of the batch is dynamically set according to specific needs (such as available memory), and the calculation is performed step by step according to the amount of data in each batch, and the principal components are continuously updated until the entire data set is processed. The implementation of incremental principal component analysis includes: based on singular value decomposition (SVD) or based on the covariance matrix.

[0087] The singular value decomposition is performed using the following formula:

[0088] X centered =U∑V T (2)

[0089] Where, X centered It is the result of centralizing the data matrix X (representing the size of the current data set), which is decomposed into the product of three matrices, where U is the left singular matrix and each column is X centered The left singular vector of Σ is a diagonal matrix with the values ​​on the diagonal being X centered The singular values ​​of VT Yes X centered The transpose of the matrix composed of right singular vectors is performed. When each new batch of data blocks arrives, it is merged with the existing data to form a new matrix, and a new singular value decomposition is performed to update the singular values ​​and singular vectors. When all batches are processed, the principal components are selected from the final right singular matrix, and finally the projection transformation from high-dimensional space to low-dimensional space is completed on the original data, completing the feature extraction and data dimensionality reduction.

[0090] Incremental principal component analysis (IPCA) is a variant of principal component analysis (PCA). The latter is a widely used linear dimensionality reduction technique that can reduce the dimension of data while retaining the original data information as much as possible. It has relevant applications in removing data noise, compressing data to reduce computational complexity, and performing data visualization. PCA converts the original high-dimensional data into a set of low-dimensional linearly independent new variables. These converted new variables are called principal components, and each principal component represents a part of the original data information.

[0091] In wireless sensor networks, sensor nodes have limited computing power, memory size, and energy supply issues, and these limitations have always been important considerations in the research and practical application of WSNs network security solutions. It is necessary to apply appropriate principal component analysis dimensionality reduction technology in WSNs, in order to reduce the computational complexity and energy consumption of related technologies, improve node memory utilization, and better deal with the related difficulties of intrusion detection in wireless sensor networks. The key idea of ​​incremental principal component analysis is to divide the original data set into multiple batches according to a certain batch size (which can be dynamically set according to the available memory size), and gradually calculate according to the amount of data in each batch, and continuously update the principal components until the entire data set is processed. This is different from the traditional PCA method that requires the entire data set to be loaded into memory to work. In contrast, IPCA reduces memory resource consumption, especially when processing large-scale data sets, it can process data sets more efficiently and run faster.

[0092] The covariance matrix is ​​based on the following formula:

[0093]

[0094] In formula (3), the covariance matrix is ​​represented by C, where n represents the number of samples in the current batch, x irepresents the i-th sample, μ represents the sample mean vector, and T represents the transpose of the matrix; in the process of processing each batch, the overall mean and covariance matrix are iteratively updated; the eigenvalues ​​and eigenvectors are obtained from the covariance matrix, and then they are sorted in descending order according to the size of the eigenvalues, and the eigenvectors corresponding to the first d largest eigenvalues ​​are selected as principal components, where d is a pre-specified dimension, which is less than the number of features in the original data set; on the other hand, the incremental update feature of incremental principal component analysis (IPCA) allows dynamic processing of newly arrived data; whenever new sample data arrives, incremental principal component analysis does not recalculate the entire data set, but updates the existing model, avoiding redundant calculations, saving additional energy consumption, and improving response speed. This method is very suitable for applications with real-time requirements.

[0095] The decision tree classifier uses the information gain method as the feature selection method:

[0096] Gain(D, A)=H(D)-H(D|A) (4)

[0097] Where Gain(D,A) is the information gain, D is the training data set, A is the feature, H(D) is the empirical entropy of data set D, and H(D│A) is the conditional entropy of training data set D under the condition of feature A. Entropy is a measure of the uncertainty of a random variable. The larger the entropy value, the greater the uncertainty. For a random variable X, entropy H(X) is defined as:

[0098]

[0099] X is a discrete random variable that can take on a finite number of values, and the probability distribution of X is P(X = x i )=p i , i = 1, 2, ..., n, n is the number of possible values ​​of the random variable X, p i It means that the random variable X takes the value x i The probability of, ∑ is the cumulative symbol, and the conditional entropy indicates the degree of uncertainty of the random variable under given known conditions:

[0100]

[0101] In the formula, H(Y|X) is the conditional entropy, Y is the random variable, random variable X is the given condition, P(X=x i )=p i , i = 1, 2, ..., n, n is the number of possible values ​​of the random variable X, p i It means that the random variable X takes the value x i The probability of ∑ is the cumulative symbol, H(Y|X=x i ) is the value of X i The conditional entropy of Y at .

[0102] Decision tree is a tree-structured machine learning algorithm based on supervised learning, which can be applied to classification and regression problems. The decision tree algorithm is simple to implement, with low model complexity, and has high cost-effectiveness in related applications in the Internet of Things environment. The decision tree is composed of multiple nodes and multiple directed edges, where the nodes can be further divided into internal nodes and leaf nodes. The internal nodes represent a feature, which is the condition for judgment. The leaf nodes represent a category result or regression value that is divided. The construction of the decision tree classifier is a recursive process. Starting from the root node, the root node represents the entire data set. The node is split by selecting the optimal feature, and the original data is divided into different branches. The data on each branch is a non-intersecting subset of the original data. Subsequently, the above process is continued for each node on the new branch. In each node, the optimal feature is continuously selected and the node is split until the stopping condition is met. The stopping condition usually includes the decision tree depth reaching the preset threshold, the sample purity in the node reaching a certain level, etc., and finally a complete decision tree structure is constructed.

[0103] Decision tree classifiers can use a variety of methods to evaluate the importance of features and the effect after splitting, including information gain, information gain ratio, Gini coefficient, etc. This study uses the cross-validation method to select the most suitable feature selection strategy for the experiment, and finally determines to use the information gain method as the feature selection method. Information gain is a measure of the degree to which a feature reduces the information uncertainty of the original data set. Node splitting usually hopes to select a feature with the largest information gain, which means that it also has a greater effect on reducing confusion.

[0104] Example

[0105] The experimental platform of this embodiment is Windows 11 operating system, equipped with 13th generation Intel Core i5-13500H processor, 2.60GHz, and main memory of 32.0GB. Model construction is carried out under the Scikit-learn library of Python 3.8 using PyCharm tool. Scikit-learn is a popular Python machine learning library that provides a wide range of machine learning algorithms and provides users with a simple and efficient toolset.

[0106] Related performance indicators:

[0107] In machine learning literature, accuracy, precision, recall, and F1 score are usually set as the standards for evaluating the quality of a classification model. Accuracy refers to the ratio of the number of samples correctly classified by the model to the total number of samples, which measures the overall classification accuracy of the model. Precision refers to the proportion of samples that are actually positive among all samples predicted by the model as positive, which measures the accuracy of the model in the samples predicted as positive. Recall considers the proportion of samples that are correctly predicted as positive among all samples that are actually positive, which measures the ability of the classification model to find all positive samples. The F1 score takes into account both precision and recall, and is usually regarded as the harmonic mean of precision and recall. The four commonly used classification model performance indicators are expressed as shown in equations (7), (8), (9), and (10):

[0108]

[0109] In addition, in the field of intrusion detection, the false alarm rate (FAR) is also used as a criterion to measure the quality of the detection model. The false alarm rate usually refers to the proportion of normal traffic data that the detection system mistakenly classifies as an attack; a high false alarm rate will not only cause normal activities in the network to be blocked, but also affect the efficiency of detecting actual attacks. The false alarm rate is defined as:

[0110]

[0111] TN, TP, FN, and FP are four elements in the confusion matrix. The confusion matrix is ​​a tool for evaluating the performance of classification models. It presents the corresponding relationship between the model prediction results and the actual situation in the form of a matrix. TN (True Negative) is the number of samples in the actual negative category that are correctly predicted as negative categories, and TP (True Positive) is the number of samples in the actual positive category that are correctly predicted as positive categories. FN (False Negative) represents the number of samples in the actual positive category that are incorrectly predicted as negative categories, and FP (False Positive) represents the number of samples in the actual negative category that are incorrectly predicted as positive categories.

[0112] analyze

[0113] This example first attempts to illustrate the impact of various standardization methods on feature extraction, as well as the difference between the two feature extraction techniques. To this end, the CICIDS2017 dataset is standardized using StandardScaler and RobustScaler, and then PCA and IPCA are performed on different datasets at the same time to observe the overall accuracy of the information gain-based decision tree (DT) for attack identification in different dimensions. The original dataset contains 78 features. In this experiment, the number of features is gradually reduced from 75 columns to 5 columns with a step size of 5. Figure 3 and Figure 4 The comparison of detection performance after PCA and IPCA based on different normalization methods is shown respectively. Regarding the impact of standardization on the feature extraction process (whether PCA or IPCA), it is also found that when the dataset is compressed into 5 principal components, the accuracy of using StandardScaler is about 10% higher than that of using RobustScaler, reaching 97.4% for PCA and 98.3% for IPCA. However, this level is still far from the goal of maximizing computational efficiency while ensuring high-precision attack detection. As the number of principal components retained increases (more than 10), the advantages of RobustScaler gradually emerge, and the detection accuracy rises rapidly and stabilizes at a high level. In contrast, StandardScaler performs poorly in the same dimension and has poor stability. Specifically, when the dataset processed by RobustScaler is processed by PCA and IPCA, the average detection accuracy is 0.8% and 0.6% higher than that based on StandardScaler, respectively. The observed differences are mainly due to the inherent properties of the data distribution (for example, the presence of outliers) and different processing methods. RobustScaler standardization minimizes the impact of outliers, which may cause some useful classification information to be lost, making the first five principal components less representative of the overall data structure. As more principal components are retained, the data becomes more complex, but this also allows more valuable features to be captured. Outliers and noise in the original data increasingly affect the effectiveness of StandardScaler because it relies on mean and variance, while RobustScaler is less sensitive to these issues, helping DT discover various attacks in different low-dimensional spaces.

[0114] In addition to the effect of normalization, the next aspect to consider is PCA and IPCA. Using both techniques to compress the dimensions into different numbers of principal components under different normalization modes enables DT to perform better in detecting malicious activities. When only 5 components are retained, the accuracy decreases. This decrease may be due to the loss of information during the dimensionality reduction process, which limits the learning and generalization ability of the model, thereby affecting the classification of malicious attacks. Figure 5 As shown, the cumulative explained variance of the first five principal components accounts for less than 60% of the total variance of the original data, indicating that these components are not sufficiently representative of the entire dataset.

[0115] Using IPCA for feature dimensionality reduction improves the effectiveness of threat identification compared to traditional PCA, which is different from the more obvious differences observed using StandardScaler standardization (see Figure 6 ), due to the robustness of RobustScaler, the attack detection accuracy of PCA-based DT is only 0.01% to 0.02% different from that of IPCA-based attack detection accuracy, which is negligible. However, IPCA's batch processing strategy optimizes the time required for dataset dimensionality reduction, and significantly reduces peak memory usage by tracking with tracemalloc. In different principal component calculations, IPCA saves about 35%-62% of the memory consumption required for PCA (batch size is 10,000 samples), and the memory usage depends largely on the amount of data processed in each batch. These findings not only show that the incremental nature of IPCA does not harm the representation of data features, but also provides higher efficiency. Based on the above findings, this study used IPCA to compress the CICIDS2017 dataset into 15 principal components (called PC1-PC15) after a series of iterative experiments.

[0116] To further verify and evaluate the effectiveness and rationality of the proposed model, the proposed method is compared with four traditional ML classifiers: DT, Random Forest (RF), K Nearest Neighbor (KNN) and Logistic Regression (LR), all of which are built and evaluated on the original dataset. Table 6 lists some key parameters of each model.

[0117] Table 6 Key parameters of the model

[0118]

[0119] An important consideration is that, under resource-constrained conditions, processing time is also an important indicator for comprehensively evaluating algorithm performance. Each classifier model was run ten times in the same experimental environment and at the same time, and the average value was calculated. The processing time here refers to the total time for model training and inference. The performance indicators and average processing time of each model are reflected in Figure 7 and Figure 8 Table 7 provides detailed information on the processing time, which provides insight into the computational efficiency of the model.

[0120] Figure 7It is clearly shown that the RF model performs best in all evaluation metrics, reaching 99.80% in all metrics. In addition, it has the lowest FAR of 0.16%, as shown in Table 8. However, it should be pointed out that the average processing time of the RF model reaches 125.39 seconds. Although the RF model achieves the best results, its computational complexity is relatively high because it is an ensemble learning method. This complexity mainly comes from two factors: the number of trees and the depth of each tree. The training process of the RF model requires parallel processing of each DT, which consumes a lot of time and resources. On devices with limited computing resources, this greatly limits the practicality of the RF algorithm. Meanwhile, the accuracy of the KNN model exceeds 99.20%. However, the processing time of the KNN classifier is 100 times that of the proposed model, reaching 485.28 seconds (more than 8 minutes), and its performance indicators are not as good as those of the proposed model. In fact, among all classifier models, KNN has the slowest average processing time. Given that KNN is an instance-based learning method, it identifies the n nearest neighbors of each instance by calculating distances and making decisions based on labels. This means that for each sample, KNN has to traverse the entire dataset, which greatly increases the processing time, especially when dealing with large-scale datasets. In addition, KNN needs to load the entire dataset into memory for subsequent operations, which may be impractical for sensor nodes with limited memory space. Although the processing time of the LR model (about 111.4 seconds) is better than that of RF and KNN, it performs the worst among all classification models. Not only does it exhibit a FAR of 5.15%, but the rest of the indicators are also below 97%. Adjusting the parameters of the LR algorithm (such as the number of iterations) can improve this situation to a certain extent, but this also means an increase in complexity. It can be said that the processing time overhead of the proposed model is negligible compared to the above three classifiers.

[0121] Table 7 Detailed information on processing time

[0122]

[0123] Table 8 False alarm rate of the model

[0124]

[0125] Among the classifiers on the original dataset, DT has the fastest processing time, averaging 24.35 seconds, and the accuracy, precision, recall, and F1 score also reach 99.72%. In contrast, the proposed model reaches 99.65%, 99.64%, 99.65%, and 99.64%, respectively, with a FAR of 0.25% (0.19% for DT on the original dataset). Although these five indicators are lower than the traditional DT model, the decrease is less than 0.1%, which shows that it still maintains sufficient competitiveness. This slight decrease is mainly attributed to the inevitable loss of some original information after performing principal component analysis. It is worth emphasizing that the average training cost of the proposed model is only 4.44 seconds, and the computational overhead is greatly reduced, while ensuring a rapid response to real-time network attacks (the inference time for each sample is 0.109 microseconds). Although a certain degree of detection capability is sacrificed, the loss is still within the allowable range, and this trade-off brings more efficient calculations. In the specific application scenarios of WSN, both computational efficiency and security need to be prioritized, so it is crucial to find a delicate balance between the two

[41] . The method proposed in this study has demonstrated that it achieves high performance while meeting low power requirements. In addition, Fig. 9 The confusion matrix of the model proposed in this study is shown, where the columns represent the predicted results and the rows represent the actual results. Fig.10 The receiver operating characteristic (ROC) curve is shown to further evaluate the discrimination ability of normal traffic and various types of attacks.

[0126] To ensure that the results are more fair and representative, this study also conducted an additional 10 groups of hold-out methods. This not only helps to avoid the randomness of the split of a single dataset, but also enables a more in-depth evaluation of the overall performance of each model. In each group of the hold-out method, the CICIDS2017 dataset was randomly divided into different training and test sets, keeping a split of 70% and 30% respectively. The proposed method also follows the same procedure. Fig.11 , 12 , 13 and 14 show the changes in accuracy, precision, recall and F1 score of the five models in different experiments.

[0127] As can be seen from the various figures, the indicators of each model fluctuate slightly within a certain range in each experiment, but are generally stable. This is a normal phenomenon because the difference in data partitioning will have a certain impact on model learning. In order to further analyze and more clearly understand the performance of each model on the entire data set, Table 9 calculates the average indicator of each model in the hold-out method. It can be seen that except for the large decrease in the indicator of the LR classifier, this may be accidental under a single segmentation. At this time, the sample distribution is more suitable for the LR model to classify and learn the attack, and the multiple hold-out methods offset this difference. The average results calculated by the hold-out method for other classifiers (including the model proposed in this paper) are very close to the results obtained by a single data set segmentation. This shows that the model proposed in this paper shows relatively consistent performance in different data segmentations, has good adaptability to various data distributions, and has high stability and generalization ability.

[0128] Table 11 Average index of the holdout method

[0129]

[0130] Comparative Example

[0131] Comparative analysis of the proposed method and existing network intrusion detection algorithm studies based on the CICIDS2017 dataset, including methods applicable to the field of IoT security. These studies adopted various techniques to simplify the dataset and reduce the amount of computation. Table 10 provides a detailed comparison of the data.

[42] used PCA technique to try to reduce the dimension of data features.

[43] proposed a binary MRF optimization algorithm to select the best feature subset. Both achieved the best performance in intrusion detection using RF algorithm. Although the accuracy of these methods is comparable to that of this study, the accuracy, recall and F1 score all showed different degrees of decline.

[44] adopted DNN and introduced a feature selection scheme that combined the standard deviation with the difference between the mean and the median. Although this method showed near-perfect results in multiple metrics, it came at the cost of huge computational cost.

[45] The proposed hybrid CNN and LSTM model achieved 98.99% accuracy in IoT intrusion detection. However, due to the lack of additional overall metrics, it is difficult to fully understand the performance of the model in different aspects. In addition, hybrid DL may not be suitable for implementation on constrained IoT devices. The reason is that these DL algorithms involve a large number of parameters and complex calculations, which together lead to increased demands on computing resources and storage space. In contrast, DT may be a more practical solution in such environments. Similarly,

[46] did not mention computational efficiency, which is a key factor in WSN applications. They adopted various feature extraction techniques and finally fed the streamlined data set into a feedforward neural network. In terms of processing time, the method in this study has significant advantages, and the indicators are equally impressive. This direct and effective method is more cost-effective when deployed in WSNs.

[0132] Table 12 Comparison with existing technology

[0133]

[0134]

[42] ,

[43] ,

[44] ,

[45] , and

[46] in Table 12 refer to the following contents respectively:

[0135]

[42] R.Abdulhammed,M.Faezipour,H.Musafer,A.Abuzneid,Efficient NetworkIntrusion Detection Using PCA-Based Dimensionality Reduction of Features,in:2019International Symposium on Networks,Computers and Communications(ISNCC),IEEE,Istanbul,Turkey,2019:pp.1–6.https: / / doi.org / 10.1109 / ISNCC.2019.8909140。

[0136]

[43] I.H.Hassan,M.Abdullahi,M.M.Aliyu,S.A.Yusuf,A.Abdulrahim,Animproved binary manta ray foraging optimization algorithm based featureselection and random forest classifier for network intrusion detection,Intelligent Systems with Applications 16(2022)200114.https: / / doi.org / 10.1016 / j.iswa.2022.200114。

[0137]

[44] A.Thakkar,R.Lohiya,Fusion of statistical importance for featureselection in Deep Neural Network-based Intrusion Detection System,InformationFusion 90(2023)353–363.https: / / doi.org / 10.1016 / j.inffus.2022.09.026。

[0138]

[45] M.H.Behiry,M.Aly,Cyberattack detection in wireless sensornetworks using a hybrid feature reduction technique with AI and machinelearning methods,J Big Data 11(2024)16.https: / / doi.org / 10.1186 / s40537-023-00870-w。

[0139]

[46] A.Nazir,J.He,N.Zhu,S.S.Qureshi,S.U.Qureshi,F.Ullah,A.Wajahat,M.S.Pathan,A deeplearning-based novel hybrid CNN-LSTM architecture forefficient detection of threats in the IoTecosystem,Ain Shams EngineeringJournal 15(2024)102777.https: / / doi.org / 10.1016 / j.asej.2024.102777。

Claims

1. A lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree, characterized in that: The following steps are involved: Step 1, data preprocessing. In the data preprocessing stage, the original CICIDS2017 dataset is cleaned and feature encoded to improve the data quality and ensure usability; Step 2: The CICIDS2017 dataset is divided into a training set and a test set at a ratio of 70% and 30%, and the two sets are respectively subjected to the robust scaler, which is standardized by the median and quartiles of the data. Step 3: Use feature extraction technology to further simplify the data structure based on the standardization operation; the specific approach is: perform incremental principal component analysis on the standardized original CICIDS2017 dataset and extract the principal components through linear transformation; According to the cumulative variance explained ratio, a trial-and-error experiment was conducted to obtain the best combination of different numbers of principal components and batch sizes while retaining more than 80% of the variance of the original CICIDS2017. By adjusting and evaluating different parameters, 15 principal components were selected and the input batch size was set to 10,000 samples. Finally, the original CICIDS2017 dataset was effectively converted into a low-dimensional data representation, i.e., data dimensionality reduction, while retaining the main information. Step 4, after completing the feature extraction and dimensionality reduction of the data, a decision tree classifier based on information gain is used to classify the network traffic data represented in a low-dimensional form, and grid search cross-validation is used to optimize the hyperparameters; the specific approach is: the intrusion detection data is input into the decision tree classifier based on information gain to learn the attack classification, and the parameters of the decision tree classifier are adjusted by the grid search method to further optimize the classification ability of the decision tree classifier; the experimental results show that compared with other classifiers and studies, the accuracy, precision, recall rate and F1 score of the proposed method are 99.6%, 99.64%, 99.65% and 99.64% respectively, the false alarm rate is 0.25%, and the processing time overhead is extremely small.

2. The lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree according to claim 1 is characterized in that: The data preprocessing described in step 1 includes data cleaning, feature encoding, data standardization and incremental principal component analysis.

3. The lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree according to claim 2 is characterized in that: The data cleaning refers to removing 207,117 duplicate samples in the CICIDS2017 dataset and deleting samples with missing values ​​and infinite values ​​in the Flow Bytes / s column, as well as samples with infinite values ​​in the Flow Packets / s column, to ensure the integrity of the data; the feature encoding adopts label encoding, which maps each category to an integer, starting from 0 and increasing by 1.

4. The lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree according to claim 2 is characterized in that: The data standardization is performed using the Robust Scaler method, using the median and interquartile range (IQR) for feature scaling. IQR represents the range between the first quartile and the third quartile. Specifically, for each feature, the median and IQR are first calculated, and then the IQR is used to scale the data to a smaller range. The scaled range depends on the distribution of the feature and the specific situation of the data. The following formula is usually used for standardization: Among them, xscale d is the standardized value of x, i is the raw value of the feature, and median(x) is the median of x.

5. The lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree according to claim 2 is characterized in that: The incremental principal component analysis is different from the principal component analysis. It divides the original CICIDS2017 data set into several batches as input. The batch size is dynamically set according to specific needs, and the calculation is performed step by step according to the amount of data in each batch. The principal components are continuously updated until the entire data set is processed. The implementation of incremental principal component analysis includes: based on singular value decomposition or based on the covariance matrix.

6. The lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree according to claim 5 is characterized in that: The singular value decomposition is performed using the following formula: X centered U∑VT(2) In the formula, Xcentere d It is the result of centering the data matrix X (representing the size of the current data set), which is decomposed into the product of three matrices, where U is the left singular matrix and each column is Xcentere d The left singular vectors of Σ are diagonal matrices, and the values ​​on the diagonal are Xcentere d The singular values ​​of V T Xcenter d The transpose of the matrix composed of right singular vectors is performed. When each new batch of data blocks arrives, it is merged with the existing data to form a new matrix, and a new singular value decomposition is performed to update the singular values ​​and singular vectors. When all batches are processed, the principal components are selected from the final right singular matrix, and finally the projection transformation from high-dimensional space to low-dimensional space is completed on the original data, realizing feature extraction and data dimensionality reduction.

7. The lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree according to claim 5 is characterized in that: The covariance matrix is ​​based on the following formula: In formula (3), the covariance matrix is ​​represented by C, where n represents the number of samples in the current batch, xi represents the i-th sample, μ represents the sample mean vector, and T represents the transpose of the matrix. In the process of processing each batch, the overall mean and covariance matrix are iteratively updated; the eigenvalue The sum of eigenvectors is derived from the covariance matrix, which is then sorted in descending order according to the size of the eigenvalues, and the eigenvectors corresponding to the first d largest eigenvalues ​​are selected as principal components, where d is a pre-specified dimension that is less than the number of features in the original data set; on the other hand, the incremental update feature of incremental principal component analysis (IPCA) allows dynamic processing of newly arrived data; whenever new sample data arrives, incremental principal component analysis does not recalculate the entire data set, but updates the existing model, avoiding redundant calculations, saving additional energy consumption, and improving response speed. This method is very suitable for applications with real-time requirements.

8. The lightweight WSN intrusion detection method based on incremental principal component analysis and decision tree according to claim 1 is characterized in that: The decision tree classifier uses the information gain method as the feature selection method: Gain(D,A)=H(D)-H(D|A)(4) Where Gain(D,A) is the information gain, D is the training data set, and A is the feature. H(D) is the empirical entropy of data set D, and H(D│A) is the conditional entropy of training data set D under the condition of feature A. Entropy is a measure of the uncertainty of a random variable. The larger the entropy value, the greater the uncertainty. For a random variable X, entropy H(X) is defined as: X is a discrete random variable that can take on a finite number of values, and the probability distribution of X is P(X = x i )=p i , i = 1, 2, ..., n, n is the number of possible values ​​of the random variable X, p i It means that the random variable X takes the value x i The probability of, ∑ is the cumulative symbol, and the conditional entropy indicates the degree of uncertainty of the random variable under given known conditions: In the formula, H(Y|X) is the conditional entropy, Y is the random variable, random variable X is the given condition, P(X=x i )=p i , i = 1, 2, ..., n, n is the number of possible values ​​of the random variable X, p i It means that the random variable X takes the value x i The probability of ∑ is the cumulative symbol, H(Y|X=x i ) is the value of X i The conditional entropy of Y at .

Images