A hybrid intrusion detection system and method suitable for incomplete data of the Internet of Things

Abstract

The present invention discloses a hybrid intrusion detection method suitable for incomplete data of the Internet of Things, comprising the following steps: obtaining an open source data set and preprocessing it; configuring a training environment; constructing and training a multi-classification stage algorithm model, wherein the multi-classification stage algorithm model is weighted aggregation of four integrated learning algorithms, namely, an RF algorithm, a category feature boosting algorithm CatBoost, an XGBoost algorithm, and a lightweight gradient boosting machine algorithm LightGBM; constructing and training a binary classification stage algorithm model, wherein the binary classification stage algorithm model is weighted summation of anomaly scores output by an autoencoder, a single-class support vector machine, and an isolation forest algorithm to obtain an aggregated anomaly score, and the final detection result is obtained by comparing it with a threshold. The method can reduce data imbalance, better adapt to incomplete data sets, thereby providing system adaptability, and can effectively aggregate the training results of multiple algorithms.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and to technologies such as data processing, anomaly detection, and machine learning, and specifically refers to a hybrid intrusion detection system and method suitable for incomplete data of the Internet of Things. Background Art

[0002] The development of IoT technology has changed the way we live, work and manage operations. By 2027, the number of IoT devices worldwide is expected to exceed 29 billion, a significant increase from 16.7 billion in 2023. Specific practical scenarios for IoT include smart transportation, smart security, smart manufacturing, smart agriculture, etc. While IoT brings convenience to people's lives, the risk of threats and intrusions to devices and systems using IoT is also increasing.

[0003] In order to solve these problems, intrusion detection system (IDS) has been widely used as a common method to detect IoT attacks and network threats. In recent years, intrusion detection systems are usually based on artificial intelligence (AI) technology. The system is trained through the network traffic of the device to accurately detect any abnormal behavior that may represent a certain type of attack. However, most existing intrusion detection systems rely on the performance of a certain machine learning algorithm, such as Random Forest (RF), Extreme Gradient Boosting (XGBoost), Convolutional Neural Network (CNN), etc. And it is necessary to train on a class-balanced data set to obtain better experimental results. In practical applications, the data distribution of the terminal often shows obvious imbalance, and there may be incomplete data on some classes. Due to the singleness of its algorithm, the existing intrusion detection system may overfit in the case of unbalanced data, resulting in poor performance of the system model on unknown data and failure to detect unknown attacks. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention proposes a hybrid intrusion detection system and method suitable for incomplete data in the Internet of Things, which can reduce data imbalance, better adapt to incomplete data sets, and thus provide system adaptability, and can effectively aggregate the training results of multiple algorithms.

[0005] In order to solve the above technical problems, the technical solution of the present invention is:

[0006] A hybrid intrusion detection method suitable for incomplete data of the Internet of Things includes the following steps:

[0007] Step 1: Obtain and preprocess open source datasets;

[0008] Step 2: Configuration of training environment;

[0009] Step 3, construct and train a multi-classification stage algorithm model, wherein the multi-classification stage algorithm model is a weighted aggregation of four integrated learning algorithms: RF algorithm, category feature boosting algorithm CatBoost, XGBoost algorithm, and lightweight gradient boosting machine algorithm LightGBM; the preprocessed data is used as input, and the weighted probability is output by the pre-trained multi-classification stage algorithm model, and a threshold is given. When the weighted probability is greater than the given threshold, the result corresponding to the weighted probability is judged as a deterministic final result, and a result set is constructed; otherwise, it is considered that the data cannot be clearly judged at this stage, and is judged as non-deterministic unknown data, and step 4 is entered;

[0010] Step 4: construct and train a binary classification stage algorithm model. The binary classification stage algorithm model is to perform weighted summation of the anomaly scores output by the autoencoder, the single-class support vector machine, and the isolation forest algorithm to obtain an aggregated anomaly score, and compare the aggregated anomaly score with a given threshold. When the aggregated anomaly score is greater than the given threshold, the data corresponding to the aggregated anomaly score is judged as benign data and added to the result set, otherwise it is judged as malignant data to obtain the final detection result.

[0011] Preferably, the preprocessing method is: first, the original data is normalized using Z-score to reduce the adverse effects of data range differences and singular samples on training; then, KPCA is used for feature extraction and dimensionality reduction operations to reduce the processing overhead of subsequent detection algorithms; finally, SMOTE is used to create instances for minority classes to balance the distribution of the data set, reducing the class imbalance of the data.

[0012] Preferably, the training environment is configured as follows: based on python 3.7 and Anaconda, using Scikit-learn, Xgboost, Lightgbm and Catboost libraries.

[0013] Preferably, in step 3 and step 4, the aggregation weight calculation method of weighted aggregation is as follows:

[0014]

[0015] Among them, w ij represents the aggregation weight of algorithm i on data class j, β ij represents the F1-score of algorithm i on data class j, and α represents the power used in aggregation.

[0016] Preferably, the RF algorithm is a variant of the bagging method. RF extracts samples from the original data and trains different decision tree models for combination. During the construction of the decision tree, attributes are randomly selected as the basis for node splitting.

[0017] Preferably, the XGBoost algorithm uses a regularization term and a second-order Taylor approximation to sum the square error to minimize the loss function and reduce overfitting; the lightweight gradient boosting algorithm uses gradient-based side sampling to retain only data samples with large gradients and randomly discard samples with small gradients to accelerate model training and reduce memory consumption; the categorical feature boosting algorithm includes symmetric trees, ordered enhancement, and local feature support, which are respectively used to improve prediction speed, reduce overfitting, and process all types of features.

[0018] Preferably, in step 3, a hybrid weighted aggregation algorithm is used to aggregate the classification probability, and the expression is as follows:

[0019] .

[0020] Preferably, in step 4, the autoencoder includes an encoder and a decoder, and the encoder encodes the high-dimensional input x into a low-dimensional latent variable z, which is expressed as follows:

[0021]

[0022] The decoder is responsible for restoring the hidden variable z to the initial dimension, and the expression is as follows:

[0023]

[0024] Where W and b are the parameters of the autoencoder network; in the judgment stage, when the difference between the output x' and the original data x is greater than a certain threshold, it is judged as abnormal data.

[0025] Preferably, the one-class support vector machine is a variant of the support vector machine, which obtains a spherical boundary around the data in the feature space, and expects to minimize the volume of this hypersphere, thereby minimizing the impact of the abnormal point data. The abnormal score finally output by the one-class support vector machine is the distance from the data point to the spherical boundary. This distance is calculated by the kernel function.

[0026] Preferably, the isolation forest algorithm recursively randomly splits the data set and constructs an isolation tree until all sample points become leaf nodes, that is, isolated; under this random splitting strategy, abnormal points usually have shorter paths because points with lower density can be easily isolated; the final output abnormal score value is:

[0027]

[0028] Among them, E(h(x)) is the average path length of data point x in all trees, n is the sample size of training data, and c(n) is the average path length of the tree, which is used for standardization. It can be seen that the closer the output score is to 1, the more abnormal the data is.

[0029] Preferably, in step 4, the anomaly score outputs of the three algorithms are weighted and summed, and the expression is as follows:

[0030]

[0031] Among them, p i represents the anomaly score output by each algorithm, and w i Multiply them together to get the aggregate anomaly score P binary , compare the anomaly score with a given threshold τ B Compare the results.

[0032] The present invention has the following characteristics and beneficial effects:

[0033] (1) In order to reduce the adverse effects of data range differences and singular samples on training, the present invention uses a variety of data preprocessing techniques to process the raw data. After preprocessing, the raw data can reduce the imbalance and the additional overhead caused by it to the system model, shorten the system running time, and improve the overall detection accuracy.

[0034] (2) In order to reduce the false negatives that occur in the system classification, the present invention uses a hybrid system that first performs multi-classification and then performs binary classification. This type of hierarchical system structure can better adapt to data sets with incomplete classes and a large number of unknown attacks because it can correct the misclassified data within the system.

[0035] (3) In order to adapt the system to different data load environments, the present invention introduces a threshold classification method. By adjusting the threshold, the classification performance and classification speed of the system can be adjusted. This can enhance the flexibility of the system model and enable the system model to balance timeliness and accuracy.

[0036] (4) Considering that different algorithms may perform differently on different data types, in order to improve the accuracy of the algorithm, the present invention proposes a hybrid weighted aggregation algorithm, which can aggregate the training results of multiple algorithms based on the performance of different basic algorithms, using the accuracy of the algorithm on the data class as the weight. Compared with a single algorithm, this aggregation method can adapt to more and more complex data, and ultimately obtain a comprehensive result that is better than a single algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0038] Figure 1 Schematic diagram of the principle of an embodiment of the present invention. DETAILED DESCRIPTION

[0039] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0040] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and the like are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first", "second", and the like may explicitly or implicitly include one or more of the features. In the description of the present invention, unless otherwise specified, "multiple" means two or more.

[0041] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood by specific circumstances.

[0042] Example 1

[0043] The present invention provides a hybrid intrusion detection method suitable for incomplete data of the Internet of Things, such as Figure 1 As shown, the following steps are included:

[0044] Step 1: Obtain and preprocess open source datasets.

[0045] In this embodiment, CICIDS2017 and UNSW-NB15 are used to evaluate the multi-layer hybrid intrusion detection system. The CICIDS2017 dataset is a state-of-the-art general network security dataset, including the latest attack types, namely, denial-of-service attacks (DoS), sniffing, brute force cracking, web attacks, botnets, and infiltration attacks. During the experiment, a balanced preprocessed dataset was used, in which the Heartbleed and Infiltration attack classes were merged into unknown class attacks due to their small number. UNSW-NB15 is a network intrusion dataset. It contains nine different attacks, including DoS, worms, backdoors, and fuse attacks. The dataset used in the experiment sets the Worms with the smallest number as unknown class attacks. In order to facilitate subsequent training, the labelencoder in scikit-learn is used to encode non-numeric labels into numerical labels.

[0046] Furthermore, after acquiring the data, the original data is first preprocessed. Figure 1 As shown in the "Data Preprocessing" module of Figure 1, three technologies are used in the data preprocessing stage: Z-score, KPCA and SMOTE. Since the original data collected from the real network environment may have major defects, it cannot be directly used for model training. Therefore, Z-score is first used to normalize the original data to reduce the adverse effects of data range differences and singular samples on training. Then KPCA technology is used for feature extraction and dimensionality reduction operations, which reduces the processing overhead of subsequent detection algorithms. Finally, SMOTE is used to create instances for minority classes to balance the distribution of data sets and reduce the class imbalance of data. Through the data preprocessing stage, the impact of class imbalance on model performance can be effectively reduced, and the overall detection accuracy can be improved.

[0047] Step 2: Configure the training environment.

[0048] Specifically, in this embodiment, in order to verify the detection results of unknown attacks of the model, the attack class with the smallest number in the data set is set as the unknown class in advance. In order to implement the system proposed by the present invention, Scikit-learn, Xgboost, Lightgbm and Catboost libraries are used for development based on python3.7 and Anaconda.

[0049] Step 3, construct and train a multi-classification stage algorithm model, wherein the multi-classification stage algorithm model is a weighted aggregation of four integrated learning algorithms: RF algorithm, category feature boosting algorithm CatBoost, XGBoost algorithm, and lightweight gradient boosting machine algorithm LightGBM; the preprocessed data is used as input, and the weighted probability is performed through the output of the pre-trained multi-classification stage algorithm model, and a threshold is given. When the weighted probability is greater than the given threshold, the result corresponding to the weighted probability is judged as a deterministic final result, and a result set is constructed; otherwise, it is considered that the data cannot be clearly judged at this stage, and it is judged as non-deterministic unknown data, and proceeds to step 4.

[0050] Specifically, after completing the data preprocessing and parameter configuration of the aggregation weights, the system begins to formally build the algorithm part. First, build the multi-classification detection stage, as shown in the attached Figure 1 This stage uses a multi-classification algorithm to try to classify the samples in the data set into known attack categories and benign data. The ensemble learning algorithm is very suitable for this task, and its classification performance is superior to other classification algorithms. The current ensemble learning methods can be roughly divided into two categories, namely the serial individual learner boosting method (Boosting) and the parallel bagging method (Bagging). Among them, the output of the bagging method is to average the output of each base learner, expressed as

[0051]

[0052] The Boosting method continuously minimizes the loss function through step-by-step iteration, that is,

[0053]

[0054] In terms of specific algorithm selection, the multi-classification detection part uses four integrated learning algorithms: RF, CatBoost, XGBoost, and LightGBM. These are the four most advanced integrated learning algorithms with good classification performance, and have achieved great success in various data analysis applications. At the same time, the computational complexity of these algorithms is relatively low, which can speed up the response speed of the model. In addition, they all support parallelization and graphics processing unit (GPU) execution, which can further improve the learning speed of the model. RF is a variant of the bagging method. It completes the task of classification or regression by constructing multiple decision trees. For each node of the base decision tree, RF first randomly selects k attributes from the attribute set of the node (assuming there are d attributes), and then selects an optimal attribute from the k attributes for partitioning. The k here controls the degree of randomness introduced. In general, . Gradient Boosting Decision Tree (GBDT) is an algorithm model based on the boosting method. XGBoost, LightGBM and CatBoost are three more advanced variants of GBDT. XGBoost uses regularization terms and second-order Taylor approximation to sum square errors to minimize the loss function and reduce overfitting. LightGBM uses gradient-based one-side sampling (GOSS), which only retains data samples with large gradients and randomly discards samples with small gradients to speed up model training and reduce memory consumption. CatBoost includes three important model enhancement components: symmetric trees, ordered enhancements, and local feature support, which are used to improve prediction speed, reduce overfitting, and process all types of features, respectively.

[0055] In the multi-classification stage, the outputs of the four algorithms include not only the classification labels but also the probabilities corresponding to each classification result.

[0056] Considering the different application scenarios of the hybrid weighted aggregation algorithm in the multi-classification stage and the binary classification stage, the actual algorithm process of obtaining the final result from the weighted result is also different. In the aggregation process of the multi-classification stage, the hybrid weighted aggregation algorithm mainly aggregates the classification probability. When the judgment results of multiple algorithms are different, the one with the higher weighted result is used as the final result, that is,

[0057]

[0058] When calculating multiple classifications, first calculate the weighted classification probabilities corresponding to the classification results of different algorithms, and select the classification with the largest value as the final result.

[0059]

[0060] First, use the probability output from the multi-classification stage to multiply the probability of each baseline algorithm in each category by the corresponding aggregation weight value to obtain the weighted probability. Finally, compare the weighted probabilities of each data item under different baseline algorithms and select the highest weighted probability. If this value is greater than a given threshold τ M , then the result corresponding to the probability is determined as a deterministic final result. Otherwise, it is considered that the data cannot be clearly determined at this stage and is determined as non-deterministic unknown data.

[0061] After the result aggregation and comprehensive judgment are completed, the final result includes unknown data that cannot be classified in addition to clearly classified benign data and known attacks. The unknown data will enter the binary classification stage for further classification. In real applications, this can reduce the classification errors that may exist in multiple classifiers due to overfitting.

[0062] It should be noted that, in this embodiment, different basic algorithms are mixed and used. When the detection results of different basic algorithms are consistent, the results are directly output. However, due to the differences in the performance of different machine learning algorithms in different types of intrusion detection tasks, different results are obtained for the same type of attack, making it impossible to determine the vulnerability type results. Therefore, the present invention proposes a hybrid weighted aggregation algorithm, which performs hybrid weighted aggregation on the output results of different types of algorithms based on the accuracy of different algorithms in different types, so as to improve the comprehensive performance of intrusion detection. Before aggregation, the aggregation weight is calculated first. In the present invention, the aggregation weight is set as

[0063]

[0064] Among them, w ij represents the aggregation weight of algorithm i on data class j, β ij represents the F1-score of algorithm i on data class j, α represents the power used in aggregation, and in this embodiment, the default value is 1. The larger α is, the greater the weight difference between different algorithms. After completing the preprocessing of the data set, since the F1-score of the basic algorithm needs to be used as an aggregation parameter in the subsequent weighted aggregation method, the basic algorithm needs to be pre-trained before the formal training begins to obtain the F1-score of each basic algorithm on each data class of each data set.

[0065] Step 4: construct and train a binary classification stage algorithm model. The binary classification stage algorithm model is to perform weighted summation of the anomaly scores output by the autoencoder, the single-class support vector machine, and the isolation forest algorithm to obtain an aggregated anomaly score, and compare the aggregated anomaly score with a given threshold. When the aggregated anomaly score is greater than the given threshold, the data corresponding to the aggregated anomaly score is judged as benign data and added to the result set, otherwise it is judged as malignant data to obtain the final detection result.

[0066] Specifically, after completing the construction of the multi-classification stage algorithm, we start to build the binary classification stage algorithm model. The main purpose of this module is to classify the unknown data that cannot be accurately determined in the multi-classification stage, that is, the uncertain result set S2. The classification results are only two categories: benign data and unknown attacks. Unsupervised algorithms are more suitable for this classification task. In training, unsupervised algorithms only need to use benign data for training, and judge whether it is benign data by the offset of the sample. Compared with other types of algorithms, unsupervised algorithms have higher training efficiency.

[0067] In terms of algorithm selection, the binary classification detection part uses three unsupervised algorithms: AutoEncoder (AE), One Class-Support Vector Machine (One Class-Support Vector Machine) and Isolation Forest (iForest) as the basic algorithms.

[0068] 1) AE consists of two parts, encoder and decoder. The encoder encodes the high-dimensional input x into a low-dimensional latent variable z, that is,

[0069]

[0070] The decoder is responsible for restoring the hidden variable z to the initial dimension, that is,

[0071]

[0072] Where W and b are the parameters of the autoencoder network, which are obtained through gradient descent training. Ideally, the decoder output x' can perfectly or approximately restore the original input x. In the judgment stage, when the difference between the output x' and the original data x is greater than a certain threshold, it is judged as abnormal data.

[0073] 2) One-class support vector machine is a variant of support vector machine. The algorithm obtains a spherical boundary around the data in the feature space, hoping to minimize the volume of this hypersphere, thereby minimizing the impact of abnormal point data. The anomaly score finally output by the one-class support vector machine is the distance from the data point to the spherical boundary.

[0074] Among them, the distance from the data point to the spherical boundary is calculated by the kernel function.

[0075] In this embodiment, the kernel function used is a radial basis function, which simply calculates the distance between the input x and the fixed point c, and the expression is as follows:

[0076] ϕ(x)=f(‖x−c‖).

[0077] 3) iForest recursively randomly splits the data set and builds an isolated tree until all sample points become leaf nodes, that is, isolated. Under this random splitting strategy, outliers usually have shorter paths because points with lower density can be easily isolated. The final output anomaly score value is

[0078]

[0079] Among them, E(h(x)) is the average path length of data point x in all trees, n is the sample size of training data, and c(n) is the average path length of the tree, which is used for standardization. It can be seen that the closer the output score is to 1, the more abnormal the data is.

[0080] The three algorithms in the binary classification stage do not output explicit classification results, but only output the anomaly score of the data, that is, the offset of the data from the baseline model. In the aggregation process of the binary classification stage, since the binary classification algorithm does not output explicit classification results, the hybrid weighted aggregation algorithm is reduced to the aggregation of anomaly scores. The anomaly score outputs of the three algorithms are weighted and summed, which is

[0081]

[0082] Among them, p i represents the anomaly score output by each algorithm, and w i Multiply them together to get the aggregate anomaly score P binary , compare the anomaly score with a given threshold τ B Compare the results.

[0083]

[0084] First, use the outliers output in the binary classification stage to multiply the outliers of each basic algorithm in each classification by the corresponding aggregation weight value to obtain the comprehensive outlier value. Then, compare the comprehensive outlier value with the given threshold τ B Compare. If the comprehensive outlier value is greater than the given threshold τ B , the result is judged as an unknown attack, otherwise it is benign data. In the process of dividing the high and low thresholds of the abnormal score, in addition to considering the accuracy, it is also necessary to consider the different requirements for security levels in actual intrusion detection and the different sensitivities to false negative and false positive data. Make timely adjustments according to different actual situations.

[0085] In the above technical solution, the CICIDS-2017 and UNSW-NB15 data sets are processed, because the present invention focuses on incomplete data sets of type. Therefore, in the preprocessing of the data set, an unknown attack class is preset. When a certain attack class data is completely missing in the training data, ideally, it should be classified as an unknown attack class in the multi-classification process. In the actual classification and detection process, misjudgments may occur in various situations, and the unknown attack class may be misjudged as other types of attacks or benign traffic. In order to comprehensively evaluate this type of error, multi-classification and binary classification are comprehensively considered in the evaluation stage, that is, the classification of specific categories of data is clarified and the classification that only distinguishes between benign and malignant is distinguished.

[0086] Tables 1 and 2 show the accuracy data of the comprehensive model MLH-IDS and the multi-classification stage. The results show that for the complete CICIDS-2017 dataset, the multi-classification stage algorithm can achieve quite good classification results. Even in the case of incomplete classes, the performance indicators can still be maintained above 98%. This is because the CICIDS-2017 dataset used has been balanced, and the proportion of attack data is relatively low, so the classification performance difference under different data conditions is not large. In contrast, the performance of the model on the UNSW-NB15 dataset is obviously biased. The accuracy is 96% on the complete dataset, and the performance drops significantly on the incomplete dataset. When the Generic class is missing, the accuracy is only 73%. Because Generic accounts for a high proportion in the UNSW-NB15 dataset, and the multi-classification algorithm used is easy to misjudge it.

[0087] Although the error of misclassifying known categories as unknown categories in MLH-IDS will lead to a decrease in accuracy, overall, the comprehensive classification results are improved compared with the results of the multi-classification stage. The performance improvement is more obvious in the class-imbalanced UNSW-NB15, where the accuracy of missing Exploits is increased from 84.8783% to 89.9286%, and the accuracy of missing Generic is increased from 73.6506% to 78.2502%. Regardless of the dataset, the binary classification performance of the model is relatively superior, maintaining an accuracy of more than 98%.

[0088] Comparative Example

[0089] When evaluating the comprehensive performance of MLH-IDS, the model's running results were compared with those of the Xgboost and Random Forest algorithms. In addition to the multi-classification performance of the model, the evaluation indicators also include binary classification performance, that is, the classification of benign traffic and malicious attacks, as shown in Table 1. In the CICIDS-2017 dataset, MLH-IDS maintains a higher accuracy rate than the two existing algorithms. And the performance gap between the models is not large under different class missing states. By comparison, it can be seen that in this data, the difference between the multi-classification accuracy and the binary classification accuracy is not large, which means that the proportion of known attacks misclassified as unknown in the model is low.

[0090] In the UNSW-NB15 dataset, the advantage of MLH-IDS in multi-classification results is relatively weak, and in most cases it is basically the same as the classification results of random forests. Only when the Generic class is missing does it have a more obvious performance improvement, as shown in Table 2. However, in distinguishing between benign traffic and attack traffic, the model has always maintained a high performance. The binary classification performance of MLH-IDS has obvious advantages over existing algorithms, and the accuracy rate exceeds 98%. Comprehensive experiments show that the present invention can achieve better classification results than basic machine learning algorithms, and can maintain excellent classification performance in the case of incomplete classes.

[0091] Table 1 Classification accuracy of multi-classification stage under different missing conditions of CICIDS-2017

[0092]

[0093] Table 2 Classification accuracy of multi-classification stage under different missing conditions of UNSW-NB15

[0094]

[0095] Compared with the common classification algorithms, the present invention can achieve a higher classification accuracy. Especially when there is a class missing in the data set, the overall accuracy of the model is significantly better than that of the conventional algorithm. In most cases, it can still achieve an accuracy of more than 98% in distinguishing between benign traffic and malicious attacks.

[0096] Example 2

[0097] This embodiment provides a hybrid intrusion detection system applicable to incomplete data of the Internet of Things, including:

[0098] one or more processors;

[0099] A storage module is used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement a hybrid intrusion detection method suitable for incomplete data of the Internet of Things as described in Example 1.

[0100] Example 3

[0101] This embodiment also provides a storage medium storing a program. When the program is executed by a processor, a hybrid intrusion detection method for incomplete data in the Internet of Things described in Embodiment 1 is implemented.

[0102] The hybrid weighted aggregation algorithm proposed in the present invention can be extended to other intrusion detection systems or application scenarios that require the use of multiple basic algorithms to enhance performance, and has good scalability.

[0103] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions and variations of these embodiments including components are made without departing from the principles and spirit of the present invention, and still fall within the scope of protection of the present invention.

Claims

1. A hybrid intrusion detection method suitable for incomplete data of the Internet of Things, characterized in that: The steps include: Step 1: Obtain and preprocess open source datasets; Step 2: Configuration of training environment; Step 3, construct and train a multi-classification stage algorithm model, wherein the multi-classification stage algorithm model is a weighted aggregation of four integrated learning algorithms: RF algorithm, category feature boosting algorithm CatBoost, XGBoost algorithm, and lightweight gradient boosting machine algorithm LightGBM; the preprocessed data is used as input, and the weighted probability is output by the pre-trained multi-classification stage algorithm model, and a threshold is given. When the weighted probability is greater than the given threshold, the result corresponding to the weighted probability is judged as a deterministic final result, and a result set is constructed; otherwise, it is considered that the data cannot be clearly judged at this stage, and is judged as non-deterministic unknown data, and step 4 is entered; Step 4: construct and train a binary classification stage algorithm model. The binary classification stage algorithm model is to perform weighted summation of the anomaly scores output by the autoencoder, the single-class support vector machine, and the isolation forest algorithm to obtain an aggregated anomaly score, and compare the aggregated anomaly score with a given threshold. When the aggregated anomaly score is greater than the given threshold, the data corresponding to the aggregated anomaly score is judged as benign data and added to the result set, otherwise it is judged as malignant data to obtain the final detection result.

2. According to claim 1, a hybrid intrusion detection method suitable for incomplete data of the Internet of Things is characterized by: The preprocessing method is as follows: first, the Z-score is used to normalize the original data to reduce the adverse effects of data range differences and singular samples on training; then, KPCA is used to perform feature extraction and dimensionality reduction operations to reduce the processing overhead of subsequent detection algorithms; finally, SMOTE is used to create instances for minority classes to balance the distribution of the data set and reduce the class imbalance of the data.

3. A hybrid intrusion detection method suitable for incomplete data of the Internet of Things according to claim 2, characterized in that: The training environment is configured as follows: based on python 3.7 and Anaconda, using Scikit-learn, Xgboost, Lightgbm and Catboost libraries.

4. According to claim 1, a hybrid intrusion detection method suitable for incomplete data of the Internet of Things is characterized in that: In step 3 and step 4, the aggregation weight calculation method of weighted aggregation is as follows: ； Among them, w ij represents the aggregation weight of algorithm i on data class j, β ij represents the F1-score of algorithm i on data class j, and α represents the power used in aggregation.

5. According to claim 1, a hybrid intrusion detection method suitable for incomplete data of the Internet of Things is characterized by: The RF algorithm is a variant of the bagging method. RF extracts samples from the original data and trains different decision tree models for combination. During the construction of the decision tree model, attributes are randomly selected as the basis for node splitting.

6. A hybrid intrusion detection method applicable to incomplete data of the Internet of Things according to claim 1, characterized in that: The XGBoost algorithm uses regularization terms and second-order Taylor approximation to sum square errors to minimize the loss function and reduce overfitting; the lightweight gradient boosting machine algorithm uses gradient-based side sampling, retaining only data samples with large gradients and randomly discarding samples with small gradients to accelerate model training and reduce memory consumption; the categorical feature boosting algorithm includes symmetric trees, ordered enhancement, and local feature support, which are respectively used to improve prediction speed, reduce overfitting, and process all types of features.

7. A hybrid intrusion detection method applicable to incomplete data of the Internet of Things according to claim 4, characterized in that: In step 3, a hybrid weighted aggregation algorithm is used to aggregate the classification probability, and the expression is as follows: 。 8. A hybrid intrusion detection method applicable to incomplete data of the Internet of Things according to claim 1, characterized in that: In step 4, the autoencoder includes an encoder and a decoder. The encoder encodes the high-dimensional input x into a low-dimensional latent variable z, which is expressed as follows: ； The decoder is responsible for restoring the hidden variable z to the initial dimension, and the expression is as follows: ； Where W and b are the parameters of the autoencoder network; in the judgment stage, when the difference between the output x' and the original data x is greater than a certain threshold, it is judged as abnormal data.

9. A hybrid intrusion detection method for incomplete data of the Internet of Things according to claim 1, characterized in that: The one-class support vector machine is a variant of the support vector machine. The support vector machine obtains a spherical boundary around the data in the feature space, thereby obtaining a hypersphere. The volume of the hypersphere is minimized, thereby minimizing the impact of the abnormal point data. The abnormal score finally calculated and output by the one-class support vector machine through the kernel function is the distance from the data point to the spherical boundary.

10. A hybrid intrusion detection method applicable to incomplete data of the Internet of Things according to claim 1, characterized in that: The isolation forest algorithm is expressed as follows: ； Among them, E(h(x)) is the average path length of data point x in all trees, n is the sample size of training data, and c(n) is the average path length of the tree, which is used for standardization. It can be seen that the closer the output score is to 1, the more abnormal the data is.

11. A hybrid intrusion detection method applicable to incomplete data of the Internet of Things according to claim 1, characterized in that: In step 4, the anomaly score outputs of the three algorithms are weighted and summed, and the expression is as follows: ； Among them, p i represents the anomaly score output by each algorithm, and w i Multiply them together to get the aggregate anomaly score P binary , compare the anomaly score with a given threshold τ B Compare the results.

12. A hybrid intrusion detection system suitable for incomplete data of the Internet of Things, characterized in that: include: one or more processors; A storage module, used to store one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement a hybrid intrusion detection method suitable for incomplete data of the Internet of Things as described in any one of claims 1 to 11.

13. A storage medium storing a program, characterized in that: When the program is executed by a processor, a hybrid intrusion detection method suitable for incomplete data of the Internet of Things as described in any one of claims 1 to 11 is implemented.

Images