Network condition detection method based on flow characteristics of Internet of Things and electronic equipment

Abstract

The invention provides a network condition detection method based on Internet of Things traffic features and electronic equipment, and the method comprises the steps: obtaining a first feature set of a traffic segment, the first feature set comprising a total byte number and a total packet number corresponding to a traffic direction; analyzing the first feature set by using a clustering-based first model to obtain an anomaly detection result, the first model being unsupervised learning, and the anomaly detection result representing whether traffic anomaly occurs; obtaining a second feature set of the traffic fragment, the second feature set comprising traffic statistical information corresponding to a traffic type, the traffic type being related to at least one of a traffic direction, a traffic source, a protocol type and a network identifier; analyzing the second feature set by using a second model based on a decision tree to obtain an attack result; and determining a detection result based on the anomaly detection result and the attack result. Therefore, the effectiveness of low-rate attack detection and the convenience of detection can be improved.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet of Things security technology, and in particular to a network status detection method and electronic device based on Internet of Things traffic characteristics. Background Art

[0002] In the context of smart transportation systems, the application of IoT technology is particularly prominent. By connecting various types of traffic equipment, such as smart traffic lights, on-board sensors, and surveillance cameras, smart transportation systems can monitor and manage traffic flow in real time, optimize road use efficiency, and reduce traffic congestion and accident rates. The traffic data collected by these devices provides valuable information support for traffic management and planning. However, with the widespread deployment of IoT devices, related security challenges have become increasingly prominent. Especially in smart transportation scenarios, most devices operate in unattended environments and are vulnerable to physical intrusions and cyber attacks.

[0003] One of the current mainstream intrusion detection solutions is signature-based intrusion detection, whose basic principle is to detect intrusions by matching signatures of known attack patterns. Another type of intrusion detection is specification-based intrusion detection, whose basic principle is to specify allowed rules for IoT devices, which are best defined by network operators.

[0004] However, when applying signature-based intrusion detection in IoT devices, there is the problem of difficulty in developing signatures at scale. It is always a challenge to set permissible rules for IoT devices when faced with traffic patterns that are highly dependent on applications and user activities, and defining these rules is too burdensome for network operators. Summary of the invention

[0005] The present disclosure is proposed in view of the above situation, and its purpose is to provide a network status detection method and electronic device based on Internet of Things traffic characteristics that can improve the effectiveness of detecting low-rate attacks and improve the convenience of detection.

[0006] To this end, the first aspect of the present disclosure provides a network status detection method based on IoT traffic characteristics, which is applied to an edge node to detect the network status of an IoT device, and the network status detection method includes: obtaining a traffic segment of the IoT device; obtaining a first feature set of the traffic segment, the first feature set including a total number of bytes and a total number of packets corresponding to a traffic direction; analyzing the first feature set using a first clustering-based model to obtain an anomaly detection result, wherein the first model is unsupervised learning, and the anomaly detection result indicates whether a traffic anomaly occurs; obtaining a second feature set of the traffic segment, the second feature set including traffic statistics corresponding to a traffic type, the traffic type being related to at least one of a traffic direction, a traffic source, a protocol type, and a network identifier; analyzing the second feature set using a second decision tree-based model to obtain an attack result, the attack result including an attack type; and determining a detection result based on the anomaly detection result and the attack result.

[0007] In the first aspect of the present disclosure, since the first model can detect abnormal traffic conditions in the Internet of Things environment to a certain extent, but cannot identify attack conditions, and low-rate attacks may also be missed, the second model identifies the attack results based on the traffic statistics corresponding to the traffic type, which facilitates capturing subtle changes in traffic, thereby improving the effectiveness of detecting low-rate attacks, and is more convenient than the solutions mentioned in the background technology. In addition, the first model is unsupervised learning, which can reduce dependence on label information and improve applicability to the Internet of Things environment. In addition, the first model is based on clustering, and the second model is based on decision trees. Based on such a model, the applicability of the detection method at the edge node can be improved. In addition, determining the detection results based on the abnormal detection results and the attack results can improve the reliability of the detection results.

[0008] In addition, in the network status detection method involved in the first aspect of the present disclosure, optionally, a feature item is obtained by combining at least one value of a traffic direction, a traffic source, a protocol type, and a network identifier, and the traffic statistical information is calculated according to the feature item to obtain the second feature set. Thus, a diversified feature set can be generated for traffic types, thereby enriching the dimension of data analysis.

[0009] In addition, in the network status detection method involved in the first aspect of the present disclosure, optionally, the traffic direction includes a receiving direction and a sending direction, the traffic source includes local and Internet, the protocol type includes at least one of ARP, ICMP, TCP and UDP, and the network identifier includes a port and / or IP address.

[0010] In addition, in the network status detection method involved in the first aspect of the present disclosure, optionally, the traffic statistics information includes at least one of the total number of bytes, the total number of packets and the average number of bytes.

[0011] In addition, in the network status detection method involved in the first aspect of the present disclosure, optionally, the training process of the second model includes: obtaining an initial feature set of a training traffic segment; preprocessing the initial feature set to obtain a training feature set, wherein the preprocessing includes at least one of missing value filling, removal of duplicate training samples, normalization, random sampling, replacement sampling, and dimensionality reduction, the second feature set is determined by the training feature set; and the second model is trained based on the training feature set. In this way, the quality of the training samples can be improved.

[0012] In addition, in the network status detection method involved in the first aspect of the present disclosure, optionally, in the dimensionality reduction process, correlation analysis is performed on the initial feature set, and principal component analysis is performed on the initial feature set after the correlation analysis to obtain the training feature set. Thus, through correlation analysis, features with excessive correlation can be preliminarily excluded, and combined with principal component analysis, the number of features can be further reduced while retaining important information.

[0013] In addition, in the network status detection method involved in the first aspect of the present disclosure, optionally, in the principal component analysis, the principal component is selected according to the error rate. In this case, the feature set after dimensionality reduction can still retain most of the information, thereby reducing information loss and improving the performance and generalization ability of the second model.

[0014] In addition, in the network status detection method involved in the first aspect of the present disclosure, optionally, the detection result includes an alarm level, and the alarm level includes a first level, a second level, a third level, and a fourth level, and the danger levels of the first level, the second level, the third level, and the fourth level increase in sequence. In response to the abnormal detection result indicating that the traffic is normal and the attack type indicates that there is no attack, the alarm level is the first level; in response to the abnormal detection result indicating that the traffic is normal and the attack type indicates that there is an attack, the alarm level is the second level; in response to the abnormal detection result indicating that the traffic is abnormal and the attack type indicates that there is no attack, the alarm level is the third level; in response to the abnormal detection result indicating that the traffic is abnormal and the attack type indicates that there is an attack, the alarm level is the fourth level. In this case, different levels of alarms can be obtained according to the specific circumstances of abnormal detection and attack type identification, and the danger level of the attack can be intuitively obtained through the alarm level.

[0015] In addition, in the network status detection method involved in the first aspect of the present disclosure, optionally, the first model is based on K-means or DBSCAN, and the second model is based on the C4.5 decision tree algorithm. Thus, the clustering effect can be improved, and the effectiveness of the attack results can be improved, and the robustness to missing values ​​and the interpretability can be improved.

[0016] A second aspect of the present disclosure provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed, the network status detection method involved in the first aspect of the present disclosure is implemented.

[0017] According to the present disclosure, a network status detection method and electronic device based on Internet of Things traffic characteristics are provided, which can improve the effectiveness of detecting low-rate attacks and improve the convenience of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The present disclosure will now be explained in further detail, by way of example only, with reference to the accompanying drawings.

[0019] Figure 1 Schematic diagram showing a detection environment involved in the examples of the present disclosure.

[0020] Figure 2 is an exemplary flow chart showing a detection method involved in the examples of the present disclosure.

[0021] Figure 3A is a traffic Sankey diagram showing the TP-Link smart plug involved in the example of the present disclosure.

[0022] Figure 3B is a comparison chart showing the total number of packets of normal traffic and abnormal traffic of the TP-Link smart plug involved in the example of the present disclosure.

[0023] Figure 3C is a comparison chart showing the average number of bytes of normal traffic and abnormal traffic of the TP-Link smart plug involved in the example of the present disclosure.

[0024] Figure 4 is an exemplary flowchart showing the training of the second model involved in the examples of the present disclosure.

[0025] Figure 5 is an exemplary flow chart showing the determination of an alarm level involved in examples of the present disclosure.

[0026] Figure 6 is an exemplary flowchart showing the acquisition of training samples involved in the examples of the present disclosure. DETAILED DESCRIPTION

[0027] Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present disclosure are described in detail. In the following description, the same symbols are given to the same components, and repeated descriptions are omitted. In addition, the accompanying drawings are only schematic diagrams, and the ratio of the dimensions of the components to each other or the shapes of the components, etc. may be different from the actual ones. It should be noted that the terms "including" and "having" in the present disclosure and any variations thereof, such as a process, method, system, product or device including or having a series of steps or units, are not necessarily limited to those steps or units clearly listed, but may include or have other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] First, relevant terms involved in the present disclosure are introduced.

[0029] "Edge node" can refer to a device or system located at the edge of the network and close to the user or data source in the field of Internet of Things.

[0030] “Network status” can refer to whether the traffic of IoT devices is abnormal and / or whether they are under attack.

[0031] The examples disclosed herein relate to a network status detection method based on IoT traffic characteristics (hereinafter referred to as the detection method), which can improve the effectiveness of detecting low-rate attacks and improve the convenience of detection. In some examples, the detection method involved in the examples disclosed herein can be applicable to the scenario of detecting distributed denial of service (DDoS) attacks. In addition, the detection method involved in the examples disclosed herein can also be referred to as a traffic monitoring method, an attack analysis method, a threat detection method, etc.

[0032] Examples of the present disclosure will be described in detail below with reference to the accompanying drawings. Figure 1 Schematic diagram showing a detection environment involved in the examples of the present disclosure.

[0033] refer to Figure 1 , the detection environment may include a variety of IoT devices, such as cameras, multi-function devices, printers, and data analysis servers. Various IoT devices can be interconnected through network nodes such as wireless access points and routers. Edge nodes such as routers can detect network conditions by executing the detection methods involved in the examples of the present disclosure. In other examples, the detection methods involved in the examples of the present disclosure can also be executed by other devices other than edge nodes, such as cloud servers, local servers, or IoT devices. In some examples, the detection methods involved in the examples of the present disclosure can be executed in real time to detect network conditions in real time.

[0034] The following takes the IoT device as a TP-Link smart plug (TP-LINK SMART PLUG) as an example to describe an example of the present disclosure, which does not limit the present disclosure.

[0035] Figure 2 is an exemplary flow chart showing a detection method involved in the examples of the present disclosure. Figure 3A is a traffic Sankey diagram showing the TP-Link smart plug involved in the example of the present disclosure. Figure 3B is a comparison chart showing the total number of packets of normal traffic and abnormal traffic of the TP-Link smart plug involved in the example of the present disclosure. Figure 3C is a comparison chart showing the average number of bytes of normal traffic and abnormal traffic of the TP-Link smart plug involved in the example of the present disclosure.

[0036] In some examples, reference Figure 2 , the detection method may include obtaining a traffic segment of an IoT device (step S101), obtaining a first feature set related to traffic statistics of the traffic segment (step S102), analyzing the first feature set using a first model based on machine learning to obtain an abnormal detection result (step S103), obtaining a second feature set of the traffic segment, the second feature set including traffic statistics corresponding to the traffic type (step S104), analyzing the second feature set using a second model based on machine learning to obtain an attack result (step S105), and determining the detection result based on the abnormal detection result and the attack result (step S106). In this case, since the first model can detect abnormal traffic conditions in the IoT environment to a certain extent, but cannot identify attack conditions, and low-rate attacks may also be missed, the attack results are identified by the second model based on the traffic statistics corresponding to the traffic type, which facilitates capturing subtle changes in traffic, thereby improving the effectiveness of detecting low-rate attacks, and is more convenient than the solution mentioned in the background technology. In addition, determining the detection result based on the abnormal detection result and the attack result can improve the reliability of the detection result.

[0037] In some examples, reference Figure 2 In step S101, the traffic segment may be traffic data of a preset window time. In some examples, traffic data of an IoT device may be obtained, and the traffic data may be divided into a plurality of traffic segments according to the preset window time.

[0038] In some examples, in response to receiving a plurality of traffic data, the plurality of traffic data may be divided according to MAC addresses of IoT devices to obtain traffic data of respective IoT devices.

[0039] In some examples, traffic data may include data packets. As an example of traffic data, Figure 3A The traffic Sankey diagram of the TP-Link smart plug is shown. Figure 3AIt can be seen that the data packets of the TP-Link smart plug can come from local (LOCAL) and the Internet (INTERNET). The data packets from local and Internet involve multiple data sources respectively, and these data sources involve different protocol types (such as UDP, ICMP or TCP).

[0040] In some examples, the time length of the traffic segment can be 1 minute. That is, the preset window time can be 1 minute. This facilitates rapid detection and response to protect IoT devices from attacks. In addition, it is also possible to capture features in a short period of time. In addition, the traffic segment can include data packets.

[0041] In some examples, in the training phase, a model (e.g., a first model and / or a second model) may be trained using multiple training samples. In some examples, the window time of multiple training samples may be the same. In some examples, the window time of multiple training samples may be a preset window time. In addition, the training sample may be a feature set of a traffic segment used for training.

[0042] In some examples, during the training phase, multiple flow data of multiple sample devices may be obtained, the multiple flow data may be divided according to the sample devices to obtain the flow data of the sample devices, the flow data of the same sample device may be divided into multiple training flow segments according to a preset window time to obtain multiple training samples, and the model may be trained using the multiple training samples. In some examples, the multiple flow data may be divided according to the MAC address of the sample device. In addition, the sample device may refer to an IoT device as a sample.

[0043] In addition, in step S102, the traffic statistics information may be statistics information of multiple data packets in the traffic segment. In some examples, the traffic statistics information may include at least one of a total number of bytes, a total number of packets, and an average number of bytes. The total number of bytes may be the sum of the number of bytes of all data packets in the traffic segment. The total number of packets may be the number of data packets in the traffic segment. The average number of bytes may be the average number of bytes per data packet in the traffic segment.

[0044] As an example, Figure 3B It shows the total number of packets in a traffic segment when the time length of the traffic segment is 1 minute, where blue represents normal traffic, red represents abnormal traffic, the horizontal axis is the time window interval of 1 minute, and the vertical axis is the total number of packets flowing through the TP-Link smart plug per minute, for a total of one hour. Figure 3C It shows the average number of bytes of traffic segments when the time length of the traffic segments is 1 minute, where blue represents normal traffic, red represents abnormal traffic, the horizontal axis is the 1-minute time window interval, and the vertical axis is the average number of bytes.

[0045] In some examples, before obtaining traffic statistics information, the timestamp and byte count of the data packets in the traffic segment can be obtained. This facilitates subsequent statistics. In some examples, statistics can be performed based on the timestamp and byte count of the data packets to obtain traffic statistics information (i.e., at least one of the total byte count, total packet count, and average byte count of the traffic segment).

[0046] In some examples, the traffic statistics information may also include IP information entropy. In some examples, the IP addresses of the data packets in the traffic segments may be obtained, and statistics may be performed based on the IP addresses of the data packets to obtain the IP information entropy.

[0047] In some examples, the first feature set may include traffic statistics information. In some examples, the first feature set may include the total number of bytes and the total number of packets of the traffic segments. Since the number of bytes of data packets of different network protocols often differs. In this case, using the total number of bytes and the total number of packets of the traffic segments as features can reduce the impact of differences in network protocols while identifying situations where traffic increases in a short period of time. In addition, when the first model is based on clustering, the first feature set includes the total number of bytes and the total number of packets of the traffic segments, which can be more suitable for the analysis of the first model. In some examples, the first feature set may also include the average number of bytes of the traffic segments.

[0048] In some examples, the first feature set may include traffic statistics corresponding to the traffic direction. Since the inbound and outbound traffic of IoT devices is generally different. In this case, the first feature set distinguishes the traffic direction, which can help the first model to more accurately identify and distinguish normal traffic from abnormal traffic. In some examples, the first feature set may include the total number of bytes and the total number of packets corresponding to the traffic direction. In some examples, when the traffic direction includes a receiving direction and a sending direction, the first feature set may include four features, namely, the total number of bytes and the total number of packets in the receiving direction, and the total number of bytes and the total number of packets in the sending direction.

[0049] In some examples, the first feature set may be a numerical feature. In some examples, the first feature set, which is a numerical feature, may be normalized to obtain a normalized feature. Thus, the influence of the value range of different features can be reduced. Accordingly, the normalized feature may be subsequently analyzed based on the first model to obtain an anomaly detection result.

[0050] In some examples, reference Figure 2 In step S103, the first model may be a traditional machine learning model. Thus, the performance requirements for the device applying the first model can be reduced, and the model is applicable to edge nodes.

[0051] In some examples, the first model may be unsupervised learning. That is, when training the first model, the label information of the training samples may not be involved in optimizing the first model. Because it is often difficult to obtain accurate label information in a network traffic environment. Therefore, the first model based on unsupervised learning can reduce dependence on label information and improve applicability to the Internet of Things environment. In addition, the training samples of the first model may refer to a feature set of the first model used for training (hereinafter referred to as the first training feature set).

[0052] In some examples, the first model of unsupervised learning can be based on clustering. In some examples, the first model can be based on K-means (K-means clustering algorithm) or based on DBSCAN (density clustering).

[0053] In some examples, the distance measurement method of K-means may include at least one of Euclidean distance and Manhattan distance. Thus, the clustering effect can be improved. In some examples, the K value of K-means can be selected according to the clustering effect.

[0054] In some examples, when training the first model, the label information may be a measure for evaluating the classification accuracy of the trained first model. In some examples, the performance of the first model may be evaluated using indicators such as accuracy. In some examples, the label information may include normal traffic and abnormal traffic. As an example of a training sample for the first model, see Table 1, where FromByte and FromPacket represent the total number of bytes and the total number of packets in the receiving direction, respectively, ToByte and ToPacket represent the total number of bytes and the total number of packets in the sending direction, respectively, Label represents the label information, and normal traffic and abnormal traffic are represented by "good" and "bad", respectively.

[0055]

[0056] Table 1 Examples of training samples

[0057] In some examples, a portion of the training samples can be used for training and another portion of the training samples can be used for testing. There are generally two ways, one is percentage training, 66% of the training samples are used for training, and 34% of the training samples are used for testing. The other is cross-validation, taking 10-fold cross-validation as an example, the training samples are divided into 10 parts, 9 parts are used for training and 1 part is used for testing in turn, and then the accuracy is averaged as an estimate of the first model.

[0058] As described above, the first model of unsupervised learning can be based on clustering. In some examples, after clustering multiple samples including the first feature set through the first model, the multiple samples can be divided into different clusters, and the abnormal detection results of the traffic segments are determined according to the density of the clusters. Specifically, normal samples (that is, the feature sets of normal traffic segments) can form relatively dense clusters, while abnormal samples can be divided into relatively sparse clusters or isolated samples. In addition, the multiple samples can be any feature sets of traffic segments that are convenient for identifying the abnormal detection results of the first feature set. For example, the feature sets of traffic segments in the historical traffic data of IoT devices.

[0059] In some examples, the size and shape of each cluster may be analyzed to determine anomaly detection results for a traffic segment. For example, if the number of samples in a cluster is significantly less than that of other clusters, or its density is significantly lower than that of normal clusters, the samples included in the cluster may be abnormal samples.

[0060] In some examples, the distance between the sample and its cluster may be analyzed to determine the anomaly detection result of the traffic segment. For example, if the distance between the sample and its cluster exceeds a distance threshold, the sample may be determined to be an abnormal sample.

[0061] In addition, the anomaly detection result may indicate a situation where the traffic is abnormal. In some examples, the anomaly detection result may indicate whether a traffic anomaly occurs. In some examples, the anomaly detection result may include traffic anomaly and traffic normality.

[0062] In some examples, reference Figure 2 In step S104, the traffic statistics information corresponding to the traffic type may mean that one traffic type may correspond to a set of traffic statistics information. For example, if there are multiple traffic types, there may be multiple sets of traffic statistics information. Thus, the diversity of the second feature set can be improved, and more abundant features can be provided, and it is easy to identify small traffic changes. In addition, a set of traffic statistics information may include one or more features.

[0063] In addition, the traffic type can be used to classify data packets. Thus, statistics based on the classification can obtain traffic statistics information corresponding to each classification. In some examples, the traffic type can be related to the characteristics and behavior of the data packets generated and received by the IoT device. In some examples, the traffic type can be related to at least one of the traffic direction, traffic source, protocol type, and network identification (hereinafter referred to as classification information). Preferably, the traffic type can be related to the traffic direction, traffic source, protocol type, and network identification. In this case, the identification of the attack results not only considers the traffic statistics information, but also hides and analyzes more detailed traffic types. By integrating these multi-dimensional data, the pattern of complex attacks (such as hybrid attacks or attacks on specific services) can be identified and feature backtracking can be performed.

[0064] In addition, the traffic direction may include a receiving direction and a sending direction. For example, "From" may be used to represent the receiving direction, and "To" may be used to represent the sending direction. Traffic sources may include local and Internet. For example, "Local" may be used to represent local, and "Internet" may represent the Internet. Protocol types may include at least one of ARP, ICMP, TCP, and UDP. A network identifier may be used to identify the location of a device (e.g., an IoT device or a device that sends a data packet to an IoT device). In some examples, a network identifier may include a port and / or an IP address. This helps to identify specific targets of communication and infer potential sources and types of attacks. The ports and IP addresses of different IoT devices are significantly different, so the network identifiers of different IoT devices are different. That is, the network identifier may not be fixed.

[0065] In some examples, the classification information may further include at least one of a traffic type and a traffic communication mode. The traffic type may include autonomously generated traffic and interactive traffic. Autonomously generated traffic is usually small and short-lived, and interactive traffic is usually small and short-lived. The traffic communication mode may include unicast, broadcast, and multicast.

[0066] In some examples, the second feature set may be a numerical variable. In some examples, the second feature set may include traffic statistics information. In some examples, the values ​​of the classification information (for example, the value of the traffic direction may be a receiving direction or a sending direction) may be combined to obtain feature items, and the traffic statistics information may be calculated based on the feature items to obtain the second feature set. That is, by grouping according to the different values ​​of these classification information, multiple traffic statistics information for multiple groups may be generated. In other words, the values ​​of the classification information may be combined to form feature items, and the traffic statistics information corresponding to the feature items may be feature values. Thus, a variety of feature sets may be generated for traffic types, thereby enriching the dimensions of data analysis. In addition, the classification information involved in the combination may be adjusted as needed, and the present disclosure does not limit this. For traffic statistics information, please refer to the relevant description of the first feature set.

[0067] In some examples, feature items can also be obtained based on the combination of the value of the classification information and the type of traffic statistics information. This facilitates automatic determination of feature items based on the determined type of traffic statistics information. In addition, the type of traffic statistics information can be used to indicate which type of traffic statistics information (e.g., total number of bytes, total number of packets, or average number of bytes) is calculated. For example, "Packet" can be used to indicate a type of traffic statistics information, which indicates that the total number of packets is calculated, and "Byte" can be used to indicate another type of traffic statistics information, which indicates that the total number of bytes is calculated.

[0068] Taking the case where the information involved in the combination includes the traffic direction, the traffic source and the type of traffic statistical information as an example, the traffic statistical information corresponding to the corresponding traffic direction, the corresponding traffic source and the corresponding type of traffic statistical information can be calculated.

[0069] As an example of the second feature set of the second model, see Table 2. Table 2 is an example of the second feature set of three traffic segments. Only two exemplary features are listed in the example. In fact, the number of features will be larger. In Table 2, FromLocalIcmpPortAllPacket is a feature item, which consists of a traffic direction of receiving direction, a traffic source of local, a protocol type of ICMP, a network identifier of all ports, a type of traffic statistics information of the total number of packets, and a feature value of the total number of packets. ToInternetTcpPort50443Byte is a feature item, which consists of a traffic direction of sending direction, a traffic source of the Internet, a protocol type of Tcp, a network identifier of port 50443, a type of traffic statistics information of the total number of bytes, and a feature value of the total number of bytes.

[0070]

[0071] Table 2 Examples of the second feature set

[0072] In some examples, key information of the data packets in the traffic segment can be obtained, and the second feature set can be obtained based on the key information. Thus, feature extraction of the second feature set can be facilitated. In some examples, the key information may include at least one of a timestamp, a protocol type, a port information, a traffic direction, and a number of bytes (i.e., a data packet size). In some examples, classification information can be obtained based on the key information, and the second feature set can be obtained based on the classification information.

[0073] In addition, the timestamp can be used to distinguish traffic segments to calculate traffic statistics of the traffic segments. In some examples, the timestamp format can be a Unix timestamp format. Thereby, the convenience of feature extraction can be improved. In addition, for the protocol type, different attack types generally use different protocol types, resulting in different performances of different attack types in traffic statistics. In addition, for DDoS attacks, the target of the attack is a service on a machine, so port information is also an important reference. In addition, reflection attacks are a new variant of DDoS attacks. For such attacks, the traffic direction can be used as a further reference. In addition, the number of bytes can be used to calculate the total number of bytes and / or the average number of bytes of the traffic segment.

[0074] In some examples, the key information may also include data packet types. For example, depending on the process and purpose of data transmission, the data packet types may include request packets, response packets, and confirmation packets. For another example, depending on the purpose of the data packet, the data packet types may include control packets, transmission packets, and management packets.

[0075] In some examples, reference Figure 2 In step S105, the attack result may indicate the attack situation. In some examples, the attack result may include the attack type. This facilitates the refinement of the attack situation.

[0076] In some examples, the second model may be a traditional machine learning model, thereby reducing the performance requirements for devices applying the second model and being suitable for edge nodes.

[0077] In some examples, the second model may be supervised. In some examples, the supervised second model may be based on a decision tree. In some examples, the second model may be based on a C4.5 decision tree algorithm. Thus, the effectiveness of the attack results can be improved, the robustness to missing values ​​and the interpretability can be improved. In other examples, random forests, support vector machines (SVMs), k-nearest neighbors (KNNs) or neural networks may also be used. In some examples, the second model may be a model for solving multi-classification problems. Thus, multiple attack types can be identified.

[0078] In some examples, the second model may be trained using the training samples. For training and testing of the second model, refer to the relevant description of the first model.

[0079] In some examples, the training samples of the second model may include normal samples. Thus, the reliability of the trained second model can be improved. In addition, by introducing normal samples for training, the second model can learn the characteristics of normal traffic and compare them with real-time traffic (i.e., the second feature set). In this case, this comparative analysis can more keenly capture abnormal traffic, even if the increase in these abnormal traffic is small.

[0080] In some examples, the number of training samples of the first model and the second model may be the same. In this case, the consistency of the training of the two models can be improved so as to combine the recognition results of the two models to obtain the detection result and facilitate comparison of the performance of the two models.

[0081] In some examples, the data set from which the training samples of the second model are derived may be a public data set. This facilitates obtaining training samples with label information. In some examples, the public data set may be annotated with the start time and end time of the attack, and the label information of the training samples may be determined based on the start time and end time of the attack. In addition, the training samples of the second model may be a feature set of the second model used for training (hereinafter referred to as the second training feature set).

[0082] In some examples, the label information of the training sample of the second model may be the attack type. In some examples, the label information of the training sample of the second model may be the attack type and the attack source. That is, the label information may consist of two parts. Thus, each training sample can be described in more detail.

[0083] In some examples, when training the second model, the attack source can be used as one of the features, so that the second model considers both the attack type and the attack source when performing classification, thereby outputting the attack source. By training the second model, the patterns of identifying different attack sources can be learned.

[0084] In some examples, the attack type may include no attack, ArpSpoof attack, PingOfDeath attack, TcpSyn attack, and Smurf attack. In some examples, the attack type may include TCP_SYN flood (TCP SYN flood attack), UDP flood (UDP flood attack), ICMP flood (ICMP flood attack), and ARP flood (ARP flood attack). In some examples, the attack source may include no source, from the Internet, and from a local area network.

[0085] In some examples, the training samples may come from multiple sample devices. In some examples, each sample device may train the second model using the training samples generated by itself, and use the trained second model to identify the attack results of the real-time traffic fragments generated by itself or the same type of device. Since the network traffic patterns of different IoT devices are different, different IoT devices will produce different features. In this case, the sample devices can be prevented from interfering with each other, and the trained second model can be made to better match the network traffic pattern of each sample device.

[0086] In some examples, for the training samples of the second model, the number of samples and the number of features generated by different IoT devices may be different, thereby enabling the training samples to better fit the network traffic pattern of each IoT device.

[0087] Figure 4 is an exemplary flowchart showing the training of the second model involved in the examples of the present disclosure.

[0088] In some examples, reference Figure 4 , the training process of the second model may include: obtaining an initial feature set of a training traffic segment (step S201), preprocessing the initial feature set to obtain a training feature set (i.e., a second training feature set) (step S202), and training the second model based on the training feature set (step S203). In some examples, the training feature set may be a numerical variable. In addition, the training traffic segment may be a traffic segment used for training.

[0089] In some examples, preprocessing may include at least one of missing value filling, removal of duplicate training samples, normalization, random sampling, replacement sampling, and dimensionality reduction, thereby improving the quality of training samples.

[0090] In addition, repeated training samples can refer to training samples with consistent feature values ​​and label information. For normalization processing, different features may affect the classification results of the second model due to different dimensions. This effect can be reduced through normalization processing. Random sampling and replacement sampling can improve the balance between normal samples and attack samples. Taking the TP-Link smart plug as an example, it generated 70,000 training samples, of which the number of normal samples accounted for more than 90%. It can be seen that normal samples and attack samples are unbalanced.

[0091] In addition, dimensionality reduction processing can simplify features and reduce feature complexity. In some examples, dimensionality reduction processing can include at least one of correlation analysis and principal component analysis (PCA). In some examples, in dimensionality reduction processing, correlation analysis can be performed on the initial feature set, and principal component analysis can be performed on the initial feature set after correlation analysis to obtain a training feature set. Thus, through correlation analysis, features with excessive correlation can be preliminarily excluded, and combined with principal component analysis, the number of features can be further reduced while retaining important information.

[0092] In some examples, in the correlation analysis, the correlation between the features in the initial feature set can be analyzed using a correlation matrix. In some examples, in response to the absolute value of the correlation coefficient of the correlation analysis of the two features being greater than 0.8, one of the features can be selected. In some examples, in response to the absolute value of the correlation coefficient of the correlation analysis being between 0.5 and 0.8, the two features can be considered for retention. In some examples, in response to the absolute value of the correlation coefficient of the correlation analysis being less than 0.5, the two features can be retained.

[0093] In some examples, in principal component analysis, standardization processing may be included. Specifically, the standardization processing may make the features present a distribution with a mean of 0 and a variance of 1. Different features have different ranges, and features with a large range often account for a large proportion, which may cause deviations in the principal components. Therefore, the deviation of the principal components in principal component analysis can be reduced by standardization processing.

[0094] In some examples, in principal component analysis, the principal component can be selected based on the error rate. That is, the dimension to be reduced can be selected based on the error rate. In this case, the feature set after dimensionality reduction can still retain most of the information, thereby reducing information loss and improving the performance and generalization ability of the second model. In addition, the eigenvectors are sorted according to the size of the eigenvalues, and the eigenvectors corresponding to the first d largest eigenvalues ​​are selected. These eigenvectors constitute a new feature space, namely the principal component. The principal component can be used to project the original data (such as the initial feature set after correlation analysis) onto the principal component. d can be called the dimension to be reduced.

[0095] In some examples, the error rate can be determined based on the vector before projection and the vector after projection (ie, the projection in the principal component space). In some examples, the error rate can satisfy the formula:

[0096]

[0097] Wherein, η represents the error rate, μ1 represents the projection error, and μ2 represents the total variation. In some examples, η≤0.01. That is, the error rate can be less than 0.01. Thus, 99% of the difference can be retained. In some examples, the error rate can be 1%, 5%, or 10%.

[0098] In some examples, the projection error can satisfy the formula:

[0099]

[0100] Among them, μ1 represents the projection error, X represents the vector before projection, and X approx represents the projected vector, and m represents the number of selected vectors.

[0101] In some examples, the total variation can satisfy the formula:

[0102]

[0103] Among them, μ2 represents the total variation, X represents the vector before projection, and m represents the number of selected vectors.

[0104] In some examples, the principal components can be selected using the cumulative variance contribution rate. In some examples, the principal components can be selected by cross-validation, and the dimension with the best performance can be selected by training the model in different dimensions and evaluating its performance. In some examples, the principal components can be selected based on the importance of the features. Specifically, a machine learning model (such as a decision tree) can be used to evaluate the importance of the features, and the principal components can be selected based on the importance.

[0105] In addition, the second feature set may be determined by the feature set that is ultimately used to train the second model. In some examples, the second feature set may be determined by the training feature set. That is, the second feature set is consistent with the feature set by which the second model for detecting traffic segments is trained.

[0106] In some examples, the first model and the second model can be regularly updated and retrained according to new traffic data generated during the operation of the IoT device, thereby improving the accuracy and adaptability of the detection.

[0107] In some examples, the detection method involved in the examples of the present disclosure can be applied to edge nodes to detect the network status of IoT devices. In this case, the edge nodes have advantages over remote servers (such as cloud servers) such as fast response speed, low bandwidth consumption, and low risk of data leakage.

[0108] In some examples, the first model may be based on clustering, and the second model may be based on a decision tree. IoT devices are difficult to support complex security architectures due to their limited computing power and power resources. Therefore, based on such a model, the applicability of the detection method in edge nodes can be improved.

[0109] In some examples, each IoT device can use its own traffic data to train the first model and the second model, thereby establishing a personalized security baseline for each IoT device.

[0110] In some examples, reference Figure 2 In step S106, the detection result can be determined by combining the abnormal detection result and the attack result. In addition, the detection result can indicate a dangerous situation of the IoT device.

[0111] In some examples, the detection result may be determined based on a combination of anomaly detection results and attack results. For example, if the anomaly detection result includes two results and the attack result includes two results, there may be four combinations of the anomaly detection result and the attack result, and the four combinations may correspond to the four results in the detection result, respectively.

[0112] Figure 5 is an exemplary flow chart showing the determination of an alarm level involved in examples of the present disclosure.

[0113] In some examples, the detection result may include an alarm level. The alarm level may be determined by combining the anomaly detection result and the attack result. Thus, different levels of alarms may be obtained according to the specific circumstances of anomaly detection and attack type identification, and the danger level of the attack may be intuitively obtained through the alarm level.

[0114] In some examples, the alarm level may include a first level, a second level, a third level, and a fourth level, and the danger levels of the first level, the second level, the third level, and the fourth level may increase in sequence. That is, a higher level indicates a more serious threat to the Internet of Things.

[0115] In some examples, the first level may represent no attack. In some examples, 0 may represent the first level, 1 may represent the second level, 2 may represent the third level, and 3 may represent the fourth level.

[0116] In some examples, reference Figure 5 , determining the alarm level may include:

[0117] Step S301: In response to the abnormal detection result indicating that the traffic is normal and the attack type indicating that there is no attack, the alarm level is the first level.

[0118] Step S302: In response to the abnormal detection result indicating that the traffic is normal and the attack type indicating that an attack exists, the alarm level is the second level.

[0119] Step S303: In response to the abnormal detection result indicating that the traffic is abnormal and the attack type indicating that there is no attack, the alarm level is the third level.

[0120] Step S304: In response to the abnormal detection result indicating that the traffic is abnormal and the attack type indicating that an attack exists, the alarm level is the fourth level.

[0121] In some examples, in response to the attack type of the attack result indicating the presence of an attack, the detection result may also include attack information. Thus, the alarm level can be supplemented, the detection result can be enriched, and more alarm information is beneficial to the administrator. In some examples, the attack information may include at least one of the attack type, the attack packet rate, and the attack byte rate.

[0122] In some examples, the attack packet rate (packets per second, pps) can satisfy the following formula:

[0123] pps = packets / T,

[0124] Where, pps is the attack packet rate, T is the window time, and packets is the total number of packets counted within the window time. In some examples, the window time can be in minutes.

[0125] In some examples, the attack byte rate (Bytes per second, Bps) may satisfy the following formula:

[0126] Bps = Bytes / T,

[0127] Among them, Bps is the attack byte rate, T is the window time, and Bytes is the total number of bytes counted within the window time.

[0128] In some examples, the detection result may also include attack intensity and attack source. In some examples, the attack intensity may be calculated based on the attack packet rate and the attack byte rate.

[0129] In some examples, when the attack type in response to the attack result is no attack, it indicates that there is no attack, and when the attack type in response to the attack result is a certain attack type (eg, ArpSpoof attack), it indicates that there is an attack.

[0130] In some examples, the detection results can be displayed, thereby facilitating administrators to defend against or respond to network attacks.

[0131] The present disclosure also relates to an electronic device, including a processor and a memory. The memory may store a computer program, and when the computer program is executed, one or more steps in the above detection method are implemented.

[0132] The examples of the present disclosure also relate to a computer-readable storage medium, which can store at least one instruction, and when the at least one instruction is executed by a processor, one or more steps in the above-mentioned detection method are implemented. Wherein, the computer-readable storage medium can include but is not limited to any type of disk, including a floppy disk, an optical disk, a DVD, a CD-ROM, a micro drive and a magneto-optical disk, a ROM, a RAM, an EPROM, an EEPROM, a DRAM, a VRAM, a flash memory device, a magnetic card or an optical card, a nanosystem (including a molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0133] Figure 6 is an exemplary flowchart showing the acquisition of training samples involved in the examples of the present disclosure.

[0134] In addition, in order to verify the effect of the detection method involved in the example of the present disclosure (hereinafter referred to as the present solution), the present disclosure also describes some experimental data, which does not limit the present disclosure. Among them, the first model is based on clustering, the second model is based on decision trees, and the data sets for training the first model and the second model are public data sets.

[0135] refer to Figure 6, the steps to obtain training samples are as follows:

[0136] Step S401: Generate traffic files for IoT devices. Because this solution is to establish a security baseline for each IoT device, it is necessary to filter out devices that are not involved in the modeling, and classify the traffic data according to the device MAC address. Thus, the traffic files of the 9 IoT devices (hereinafter referred to as devices) shown in Table 3 are generated. The traffic of these 9 devices includes normal traffic and attack traffic.

[0137]

[0138]

[0139] Table 3 Device and attack information

[0140] Step S402: extract key information from the traffic file as columns and then export it as a csv file. The key information includes timestamp, packet type, protocol type, port information, traffic direction and packet size as columns.

[0141] Step S403: Obtain training samples of the first model based on key information in the csv file. Taking 1 minute as a unit, calculate the total number of packets, total number of bytes and average number of bytes in each minute interval (ie, traffic segment) based on the csv file to obtain training samples of the first model.

[0142] Step S404: Obtain training samples for the second model based on the key information in the csv file. Taking 1 minute as a unit, based on the csv file and taking the combination of the values ​​of the above classification information and the types of traffic statistics information as feature items, calculate the total number of packets and the total number of bytes under the corresponding feature items in each minute interval to obtain training samples for the second model.

[0143] Step S405: Add label information to the training samples through the attack annotation information of the public data set. For example, the attack annotation information of the Samsung smart camera is "1527838552, 1527839153, Localfeatures|Allfeatures|Arpfeatures, ArpSpoof100L2D", which means that the start time of the attack is 1527838552 and the end time is 1527839153. "Localfeatures|Allfeatures|Arpfeatures" corresponds to the key information through which the attack is initiated, and "ArpSpoof100L2D" indicates that the attack type is an arpspoof attack.

[0144] Through the above steps, training samples with label information of the first model and the second model are obtained. In addition, the number of training samples of the first model and the number of training samples of the second model are the same.

[0145] For the second model, different devices generate different numbers of samples and features. As can be seen from Table 4, the number of samples and features varies greatly for different devices. Although the number of samples for the first four devices is about 70,000, and the number of samples for the last five devices is only about 40,000, they are trained and predicted separately and do not affect each other.

[0146]

[0147] Table 4 Sample size and feature number of different devices

[0148] The experimental results are as follows:

[0149] Taking the traffic data of TP-Link smart plug as an example, when the k value of K-means is 2, some experimental results of the first model (i.e., anomaly detection results) are shown in Tables 5 and 6.

[0150]

[0151] Table 5 Comparison of different metrics and clustering algorithms for TP-Link smart plugs

[0152]

[0153] Table 6 Performance of abnormal traffic detection of each device

[0154] From Table 5, we can see that although the K-means algorithm has the highest accuracy when using Euclidean distance as the metric, the cost is that the true positive rate (detection probability) is extremely low, which is improved after using Manhattan distance. In addition, the DBSCAN algorithm has a higher true positive rate than the K-means algorithm, but the false positive rate is also increased, that is, the detection rate increases and the false alarm rate also increases. In anomaly detection, the detection rate is more important, followed by the false alarm rate. Therefore, for the TP-Link smart plug, using DBSCAN and the Manhattan distance metric can achieve a detection rate of 89.42% and a false alarm rate of 2.18%.

[0155] By averaging the accuracy, true positive rate, and false positive rate of all devices in Table 6, it can be concluded that the overall performance of abnormal traffic detection of this scheme is 77.61% in accuracy, 79.57% in true positive rate, and 24.83% in false positive rate.

[0156] We continue to use the TP-Link smart plug as an example to analyze the experimental results of the second model. In order to balance the number of samples, we adopt replacement sampling, and the total number of samples remains unchanged. Table 7 shows the number statistics of the TP-Link smart plug before and after sample balance.

[0157]

[0158] Table 7 Statistics of the number of samples with different label information before and after balancing of TP Link smart plug samples

[0159] In addition, regarding feature selection and dimensionality reduction, it can be seen from Table 4 above that the number of features of the devices is more than 30, and some are higher than 70. Too many features will increase the computational complexity. In the experiment, the correlation coefficient matrix of each training sample is first calculated. Since the feature matrix is ​​too large, for the sake of convenience, the correlation coefficient matrix of the results of the first 6 features of the TP-Link smart plug is listed here:

[0160]

[0161] From the correlation coefficient matrix, we can see that the correlation coefficient between adjacent features is greater than 90%, which is a strong correlation. Therefore, the adjacent features are the total number of bytes and the total number of packets of the same stream. Generally speaking, although the data packets of the same stream will cause the difference in the size of a single data packet due to the different information carried in the data part, the two variables are positively correlated overall. Therefore, only one adjacent feature can be considered to be retained. In this experiment, only the total number of packets is retained, that is, all features are reduced by half.

[0162] At the same time, the inventors also observed that some non-adjacent features also show strong correlation, but cross-correlation is inevitable. Principal component analysis can achieve the purpose of dimensionality reduction from the perspective of the algorithm. In the experiment, a 5% error rate was taken, so that the training samples after dimensionality reduction retained 95% of the information of the original samples.

[0163] The number of features in Table 8 refers to the number after removing half of the features. It can be seen from Table 8 that when the error rate is the same, non-standardization will remove more features, while standardization will retain more features.

[0164]

[0165] Table 8 Statistics of the number of features of each device before and after PCA dimensionality reduction

[0166] In addition, standardization can make each dimension have the same weight, and non-standardization may affect the results. In order to compare the impact of non-standardization and standardization on the classification results, the inventors used a simple KNN algorithm and divided the samples of each device into 66% for training and 34% for prediction. The classification accuracy is shown in Table 9.

[0167]

[0168] Table 9 Comparison of classification accuracy after PCA dimensionality reduction for each device with or without standardization

[0169] As can be seen from Table 9, the standardized PCA has better classification effect than the non-standardized PCA. The reason is that the non-standardized PCA does not balance the weights of each feature and removes too many useful features.

[0170] In addition, as mentioned above, the principal components of PCA are affected by the error rate. As can be seen from Table 10, as the error rate increases, the number of features also increases, and at 99%, it has dropped from 40 to 17. Analyzing the above table, the 95% error rate is indeed a more appropriate choice when the accuracy does not drop much.

[0171]

[0172] Table 10 Comparison of dimensionality reduction results of PCA with different error rates

[0173] Although the present disclosure is specifically described above in conjunction with the accompanying drawings and examples, it is to be understood that the above description does not limit the present disclosure in any form. Those skilled in the art may modify and change the present disclosure as needed without departing from the essential spirit and scope of the present disclosure, and these modifications and changes all fall within the scope of the present disclosure.

Claims

1. A network status detection method based on IoT traffic characteristics, applied to edge nodes to detect the network status of IoT devices, characterized in that: The network status detection method includes: obtaining a traffic segment of the Internet of Things device; obtaining a first feature set of the traffic segment, the first feature set including a total number of bytes and a total number of packets corresponding to a traffic direction; analyzing the first feature set using a first clustering-based model to obtain an anomaly detection result, wherein the first model is unsupervised learning, and the anomaly detection result indicates whether a traffic anomaly occurs; obtaining a second feature set of the traffic segment, the second feature set including traffic statistical information corresponding to a traffic type, the traffic type being related to at least one of a traffic direction, a traffic source, a protocol type, and a network identifier; analyzing the second feature set using a second decision tree-based model to obtain an attack result, the attack result including an attack type; and determining a detection result based on the anomaly detection result and the attack result.

2. The network status detection method according to claim 1, characterized in that: A characteristic item is obtained by combining values ​​of at least one of a traffic direction, a traffic source, a protocol type, and a network identifier, and the traffic statistical information is calculated according to the characteristic item to obtain the second characteristic set.

3. The network status detection method according to claim 2, characterized in that: The traffic direction includes a receiving direction and a sending direction, the traffic source includes a local and the Internet, the protocol type includes at least one of ARP, ICMP, TCP and UDP, and the network identifier includes a port and / or an IP address.

4. The network status detection method according to claim 1, characterized in that: The traffic statistics information includes at least one of a total number of bytes, a total number of packets, and an average number of bytes.

5. The network status detection method according to claim 1, characterized in that: The training process of the second model includes: obtaining an initial feature set of a training traffic segment; preprocessing the initial feature set to obtain a training feature set, wherein the preprocessing includes at least one of filling missing values, removing duplicate training samples, normalization, random sampling, replacement sampling and dimensionality reduction, and the second feature set is determined by the training feature set; and training the second model based on the training feature set.

6. The network status detection method according to claim 5, characterized in that: In the dimensionality reduction process, correlation analysis is performed on the initial feature set, and principal component analysis is performed on the initial feature set after the correlation analysis to obtain the training feature set.

7. The network status detection method according to claim 6, characterized in that: In the principal component analysis, the principal components are selected according to the error rate.

8. The network status detection method according to claim 1, characterized in that: The detection result includes an alarm level, and the alarm level includes a first level, a second level, a third level and a fourth level, and the danger levels of the first level, the second level, the third level and the fourth level increase in sequence. In response to the abnormal detection result indicating that the traffic is normal and the attack type indicates that there is no attack, the alarm level is the first level; in response to the abnormal detection result indicating that the traffic is normal and the attack type indicates that there is an attack, the alarm level is the second level; in response to the abnormal detection result indicating that the traffic is abnormal and the attack type indicates that there is no attack, the alarm level is the third level; in response to the abnormal detection result indicating that the traffic is abnormal and the attack type indicates that there is an attack, the alarm level is the fourth level.

9. The network status detection method according to any one of claims 1 to 8, characterized in that: The first model is based on K-means or DBSCAN, and the second model is based on the C4.5 decision tree algorithm.

10. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed, the network status detection method according to any one of claims 1 to 9 is implemented.

Images