Internet of Things attack detection method and system based on deep learning

Abstract

The invention belongs to the technical field of network security, and discloses an Internet of Things attack detection method based on deep learning, which eliminates redundant features through feature selection, enhances inter-class difference and intra-class similarity of selected feature subsets, solves the problem of class imbalance in an attack detection data set by utilizing EQLv2, and improves the attack detection efficiency. And meanwhile, constructing a space-time model to extract space-time information of the sample. According to the method, multi-classification performance evaluation is carried out on an Internet of Things attack detection reference data set NSL-KDD and a CIC-IDS-2017, the advantages of the method are verified from five indexes including the accuracy rate, the precision rate, the recall rate, the F1 score and the false alarm rate, and the effectiveness and feasibility of the method are reflected when the method is compared with a plurality of methods.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to an Internet of Things attack detection method and system based on deep learning. Background Art

[0002] With the advancement of 5G mobile communication technology, the Internet of Things (IoT) is accelerating, connecting billions of physical objects, including sensors, smart vehicles, and other items embedded with electronics and software, enabling them to exchange data. The interconnection of these devices enables advanced IoT applications and extends automation to our daily lives. However, the massive amount of devices will generate extremely huge traffic, attracting more and more malicious attackers, resulting in a sharp surge in attacks against IoT devices. A smart home hacker survey showed that in one week, smart home devices such as TVs, thermostats, smart kettles, and security systems were attacked more than 12,000 times by cyber criminals and unknown entities, which puts tremendous pressure on data communication transmission, resource management, QoS, etc., and causes more security issues. In response to malicious attacks, the IoT generally analyzes network data and identifies abnormal traffic through attack detection, thereby intercepting attack traffic, which can significantly reduce the success rate of network attacks.

[0003] In recent years, a large number of methods have been shown to produce good attack detection results in IoT, but identifying abnormal network traffic in this field remains a challenging problem. On the one hand, it is well known that IoT is a large and complex system with heterogeneity, resource constraints, dynamics, and privacy. On the other hand, another significant difficulty is that the probability of such abnormal events occurring in the real world is extremely low, resulting in scarce network traffic, so the network traffic datasets used for model training are basically long-tail datasets. These problems will make it difficult for anomaly detection to achieve excellent performance.

[0004] Therefore, in order to solve the above problems and accurately identify the traffic transmitted to the IoT device, the present invention proposes an IOT network attack detection method based on Genetic Algorithm (GA) and Equalization Loss v2 (EQL v2). First, a set of optimal feature sets is determined by the GA algorithm; secondly, EQL v2 is used to solve the problem of scarce attack traffic samples; finally, the Convolutional Neural Network (CNN) and the Long Short Term Memory Network (LSTM) are combined to extract the spatiotemporal information of network traffic.

[0005] First, the attack detection model applied in IOT is introduced, and then the research methods and latest progress proposed by domestic and foreign scholars in recent years in the field of class imbalance are explained.

[0006] 1.1 Machine Learning Techniques

[0007] Machine learning has always played an important role in IoT attack detection, and various ML methods have emerged. Among them, reference [6] uses an improved support vector machine (SVM) for detection, and uses the binary gray wolf optimization algorithm to select important features to reduce the false alarm rate; reference [7] proposes a distributed integrated IDS based on IoT fog computing, using K nearest neighbor, XGBoost and Gaussian naive Bayes as base classifiers, and finally using random forest for classification; reference [8] integrates machine learning methods such as extra tree and random forest for IoT attack detection, and has achieved good results; reference [9] proposes an attack detection system that combines multiple support vector machines (SVM), each SVM is only responsible for detecting a specific attack type, can accurately detect attacks, and ensure the security of IoT devices. However, with the diversification of attack methods, shallow learning represented by machine learning technology has been unable to meet the needs of network attack detection. Therefore, it is urgent to seek new learning algorithms to break through the limitations of ML methods.

[0008] 1.2 Deep Learning Technology

[0009] Given the great advantages of deep learning in data mining, it has been widely used in the field of attack detection. Reference

[10] designed an IoT attack detection model based on knowledge distillation and deep metric learning. This method not only improves the accuracy of anomaly detection, but also significantly reduces the model size and computational cost. Reference

[11] constructed a multi-frequency DL framework. By utilizing the different frequencies of different types of data, the high-frequency layer and the low-frequency layer jointly built multi-frequency Transformer and multi-frequency LSTM modules to achieve attack detection. Good results were achieved on IoT datasets. Reference

[12] constructed two deep learning models, DNN and CNN, and conducted multiple experiments on feature-selected datasets to find the most suitable model for anomaly detection. The results achieved were quite satisfactory. Reference

[13] proposed an adaptive optimization algorithm based on mutation and perception strategies, and introduced reinforcement learning into the classifier SVM. The detection rates of 99.71% and 99.61% were achieved on the NSL-KDD and CIC-IDS-2017 IoT benchmark datasets, respectively. However, the above method fails to take into account the characteristics of network traffic in the time dimension. Therefore, the present invention constructs an IoT attack detection model based on convolutional neural network and long short-term memory network. CNN is used to extract the spatial information of network traffic in IoT devices, and then LSTM is introduced into the model to extract the time information of traffic. The proposed model can effectively extract the deep features of network traffic and has strong robustness, but it still does not solve the class imbalance problem, so further research is needed on this issue.

[0010] 1.3 Types of Unbalanced Technology

[0011] Class imbalance is a common problem in IDS and has seriously affected system performance. Currently, there are three main methods to solve this problem: data method, integration method, and cost sensitivity method. The data method mainly balances samples by modifying the data set and is also the most widely used method. Reference

[14] applies the undersampling method based on K nearest neighbors to normal samples, which can effectively balance data. However, the data method is susceptible to noise interference and may cause information loss. Reference

[15] proposes to combine the SMOTE technology combined with clustering and the K-Means undersampling technology, which can avoid the excessive cost of SMOTE and eliminate the problem of random undersampling losing important information. The integration method mainly alleviates the class imbalance problem by combining with ensemble learning. Reference

[16] uses bagging and GBDT to propose a dual integration model, which has achieved good results on three public data sets. Reference

[17] improves the anomaly detection performance by integrating DNN, XGB and GBM in parallel, but the computational cost of the integration method is high and time-consuming. The cost sensitivity method mainly reduces the false alarm rate by changing the loss weight. Reference

[18] uses focal loss as the loss function of the model, so that the model focuses on the minority class without being overwhelmed by the majority class, improving the detection performance of multiple data sets. In addition, the cost sensitivity method is simple and efficient and does not change the data set. Therefore, the present invention introduces EQL v2 into the field of attack detection, divides each category into multiple independent tasks, and balances the training process of each task according to the gradient-guided reweighting mechanism. This function can effectively solve the class imbalance problem and has low computational cost.

[0012] With the rapid development of IoT technology, the means of network attacks it faces are also increasing, and the malicious network traffic generated is growing exponentially. In order to identify attack traffic to protect the security of IoT devices, attack detection has received widespread attention from researchers. However, current attack detection methods have difficulty identifying complex and changeable attack methods, and the false alarm rate is high. At the same time, the problem of feature redundancy and class imbalance in IoT traffic data sets also constrains detection performance.

[0013] Through the above analysis, the problems and defects of the prior art are as follows:

[0014] With the rapid development of IoT technology, the means of network attacks it faces are also increasing, and the malicious network traffic generated is growing exponentially, making the current network traffic environment more complex and changeable. Therefore, existing attack detection methods have difficulty identifying new and diverse attack methods, resulting in a high false alarm rate. At the same time, the current IoT traffic data set generally has feature redundancy and class imbalance problems, which to a certain extent also restricts the performance of IoT attack detection. Summary of the invention

[0015] In view of the problems existing in the existing attack detection methods, the present invention provides an Internet of Things attack detection method based on deep learning.

[0016] The present invention is implemented in this way: a method for detecting attacks on the Internet of Things based on deep learning includes:

[0017] Step 1, obtain the IoT traffic data set;

[0018] Step 2, preprocessing the obtained data set;

[0019] Step 3, perform feature selection on the IoT traffic data set through a genetic algorithm to determine a set of representative feature subsets that can effectively approximate the original feature space;

[0020] Step 4: Use the cost-sensitive function to balance the gradients of positive and negative samples, thereby solving the problem of scarce attack traffic in the Internet of Things;

[0021] Step 5: Combine the convolutional neural network and the long short-term memory network to extract the spatiotemporal information of the network and output the final IoT attack detection results.

[0022] Furthermore, the feature selection:

[0023] (1) Randomly initialize the population;

[0024] (2) Determine whether the fitness of individuals in the population meets the optimization criteria. If so, end the search and output the optimal solution; otherwise, continue;

[0025] (3) Individual selection is achieved based on fitness. The higher the individual's fitness, the higher the probability of being selected.

[0026] (4) The selected individual is replaced with the parent's chromosome at the selected position through the crossover operator to produce a new individual;

[0027] (5) Implement mutation operations on newly emerged individuals to increase the richness of individuals;

[0028] (6) Repeat the above steps until the maximum number of iterations is reached.

[0029] Furthermore, the convolutional neural network:

[0030] Convolutional neural networks use convolution kernels to move on the input to mine hidden intrinsic features. The specific structure is shown below;

[0031] In CNN, the formula for extracting input features is as follows:

[0032]

[0033] Wherein, x represents the input and output layers, j represents the current number of convolutional layers, i and l represent the positions, ω represents the weight, b represents the bias, and f() represents the activation function. At the same time, the convolutional layer is generally set to be a pooling layer. The present invention adopts average pooling to achieve dimensionality reduction, and its calculation process is shown in formula (2);

[0034] x i =down(x i-1 ) (2)

[0035] Among them, x i represents the vector before pooling, down() represents the pooling function, x i-1 Represents the pooled vector.

[0036] Furthermore, the long short-term memory network:

[0037] The key to LSTM's ability to provide long-term memory lies in the gate structure and cell state. The specific calculation process is shown in formula (3);

[0038]

[0039] Among them, f t 、i t and t is the output of each gate in the network, x t represents the initial input of the network, h t represents the final output of the network, Indicates the temporary state of the cell, C t represents the state of the cell at time t, W represents the weight matrix, b represents the bias, σ and tanh represent the activation function;

[0040] EQLv2 is used as the loss function; its output z j About Loss The positive and negative gradients are as follows:

[0041]

[0042] in, represents the probability that the i-th instance belongs to category j, y represents the true label, and L is the number of samples; in order to balance the positive and negative gradients, they can be reweighted, and the reweighting coefficient is defined as follows:

[0043]

[0044] in, and are the weighted coefficients of positive and negative gradients, respectively. It represents the ratio of the accumulated positive and negative gradients after t iterations, α is the balance coefficient, t is the number of iterations, and f() is the constructed mapping function, which is expressed as follows:

[0045]

[0046] After obtaining the reweighted coefficients, the positive and negative gradients are updated as follows:

[0047]

[0048] At the same time, the positive and negative gradient ratios for the next t+1 iteration should also be updated:

[0049]

[0050] To detect anomalies in IoT network traffic, the specific steps are as follows:

[0051] Step 1: Perform preprocessing operations such as digitization and normalization on the traffic data set;

[0052] Step 2: Use genetic algorithm to perform feature selection on IoT traffic dataset;

[0053] Step 3: Build a spatiotemporal model combining CNN and LSTM and set parameters;

[0054] Step 4: Use EQLv2 as the loss function to balance positive and negative gradients to solve the class imbalance problem;

[0055] Step 5: Use K-fold cross validation to pre-train the data set until the model converges;

[0056] Step 6: Input the preprocessed test set into the trained model and count the classification results;

[0057] Furthermore, the dataset:

[0058] 1) Dataset Description

[0059] The NSL-KDD dataset solves the problems that have long plagued the KDDCUP99 dataset by removing a large amount of redundant data;

[0060] The CIC-IDS-2017 dataset is created by sniffing real-time network packets. This dataset is one of the largest and most recent attack detection datasets. Due to the diversity of IoT devices, they are vulnerable to various network attacks, including DDoS and SQL injection attacks.

[0061] 2) Data preprocessing.

[0062] Further, the data is preprocessed:

[0063] (1) Numericalization: There are some non-numerical features in the above datasets, such as protocol_type, flag, and service in the NSL-KDD dataset. The model cannot learn them, so these feature data need to be converted into numerical features.

[0064] (2) Normalization: The value range of some feature dimensions in the dataset is relatively wide, and their contribution to the learning of the model is not the same. Therefore, in order to reduce the differences between feature dimensions and ensure the accuracy of the detection results.

[0065] Another object of the present invention is to provide an IoT attack detection system based on deep learning, comprising:

[0066] Selection module, used for feature selection through genetic algorithm;

[0067] Adopting a module for adopting cost-sensitive functions to solve the problem of scarce attack traffic in the Internet of Things;

[0068] The combination module is used to combine the convolutional neural network and the long short-term memory network to extract the spatiotemporal information of the network.

[0069] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the deep learning-based Internet of Things attack detection method.

[0070] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the deep learning-based Internet of Things attack detection method.

[0071] Another object of the present invention is to provide an information data processing terminal, which is used to implement the Internet of Things attack detection system based on deep learning.

[0072] In combination with the above technical solutions and the technical problems solved, the advantages and positive effects of the technical solutions to be protected by the present invention are as follows:

[0073] First, in view of the fact that most IoT traffic data sets contain high feature dimensions and feature redundancy, this paper proposes a heuristic search algorithm for feature selection, and uses a genetic algorithm to determine whether the fitness of individuals in the population meets the optimization criteria, thereby determining a set of optimal features. This feature selection method eliminates redundant features and enhances the inter-class differences and intra-class similarities of the selected feature subsets;

[0074] Aiming at the problem of scarce attack traffic in the Internet of Things, the present invention adopts a cost-sensitive function with a gradient-guided reweighting mechanism as a loss function. The function processes each category by dividing multiple independent tasks, thereby weighting the minority class samples and improving the model's detection rate for the class.

[0075] The present invention constructs a spatiotemporal model, which extracts the spatiotemporal information of IoT traffic by combining convolutional neural networks and long short-term memory networks, thereby improving the detection performance of IoT attack traffic.

[0076] The present invention proposes an IoT attack detection method based on deep learning. The method performs multi-classification performance evaluation on the IoT attack detection benchmark datasets NSL-KDD and CIC-IDS-2017, and verifies the advantages of the proposed method from five indicators: accuracy, precision, recall, F1 score and false alarm rate. The effectiveness and feasibility of the proposed method are also reflected when compared with multiple methods.

[0077] Second, the traditional IoT attack detection method directly uses high-dimensional network traffic data for modeling, which has a large number of redundant or irrelevant features, resulting in high computational complexity and low detection accuracy. The present invention selects features through genetic algorithms, optimizes feature subsets, and significantly reduces data dimensions. This process effectively improves the training efficiency of the model, reduces the consumption of computing resources, and ensures that key features are fully utilized, solving the problem of high-dimensional data interfering with model performance.

[0078] In the IoT environment, attack traffic samples are scarce, and the imbalance of positive and negative samples seriously affects the detection performance of traditional models, which easily leads to missed detection of small sample categories (attack traffic). This paper introduces the EQLv2 cost-sensitive function and dynamically adjusts the gradient ratio of positive and negative samples, thereby enhancing the model's learning ability for a small number of attack samples, significantly improving the detection accuracy of small sample categories, and effectively alleviating the problem of category imbalance.

[0079] Traditional detection methods usually ignore the spatiotemporal information in network traffic and rely only on static feature extraction, which is unable to identify complex attack behaviors. This paper combines convolutional neural networks (CNN) and long short-term memory networks (LSTM) to extract local spatial features and time series features of traffic data, respectively, so that the model can accurately capture complex attack patterns. Especially in the changeable and dynamic IoT environment, this method significantly improves the detection effect.

[0080] The traditional method has high false alarm rate and missed alarm rate in dynamic environment, which affects the actual application effect of the system. The present invention significantly improves the accuracy and stability of detection by optimizing feature selection and introducing the loss function of balanced gradient, combined with the comprehensive ability of spatiotemporal model. Experiments show that the false alarm rate and missed alarm rate of the present invention are reduced by 15% and 20% respectively, meeting the demand for high reliability detection in IoT applications.

[0081] The present invention reduces data dimension and computational complexity through feature selection. The detection accuracy of the model of the present invention is improved by more than 10% compared with the traditional method, and the detection time is reduced by 20%. The optimized feature subset enables the model to run efficiently on resource-constrained IoT devices and meet the needs of actual application scenarios.

[0082] With the help of EQLv2 cost-sensitive function, the present invention significantly enhances the model's learning ability for small sample categories such as attack traffic. In the scenario of unbalanced data categories, the F1 value is improved by 15% compared with the traditional method, which effectively solves the problem of underreporting and provides more reliable technical support for IoT security protection.

[0083] The combination of CNN and LSTM enables the model to extract spatial features and capture time series dependencies, which comprehensively improves the adaptability to complex attack patterns. In the detection of multiple types of attacks (such as DDoS and SQL injection), the accuracy of the present invention reaches more than 95%, which is significantly better than the existing methods and demonstrates strong generalization ability.

[0084] The present invention is applicable to attack detection in a variety of IoT scenarios, such as smart homes, industrial Internet, and cloud computing networks. In addition, its feature selection and model design methods are highly versatile and can be extended to other network traffic detection tasks, providing an efficient solution for network security protection in multiple industries. In summary, the present invention shows significant technical advantages and practical value in industrial applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] Figure 1 This is a flow chart of an IoT attack detection method based on deep learning provided by an embodiment of the present invention.

[0086] Figure 2 This is a structural block diagram of an Internet of Things attack detection system based on deep learning provided by an embodiment of the present invention.

[0087] Figure 3 It is a CNN structure diagram provided by an embodiment of the present invention.

[0088] Figure 4 It is a LSTM structure diagram provided by an embodiment of the present invention.

[0089] Figure 54 is a confusion matrix diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0090] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0091] like Figure 1 As shown, an IoT attack detection method based on deep learning provided by an embodiment of the present invention comprises the following steps:

[0092] S101, performing feature selection on the IoT traffic data set by a genetic algorithm to determine a set of representative feature subsets that can effectively approximate the original feature space;

[0093] S102, uses a cost-sensitive function to balance the gradients of positive and negative samples, thereby solving the problem of scarce attack traffic in the Internet of Things;

[0094] S103, combining the convolutional neural network and the long short-term memory network to extract the network's spatiotemporal information and output the final IoT attack detection result.

[0095] The present invention first performs feature selection on the IoT traffic data set through a genetic algorithm to ensure that the feature subset of the input model can effectively approximate the original feature space. After the genetic algorithm randomly initializes the population, it selects high-quality individuals based on the fitness function and generates a new generation of population using crossover and mutation operations until the maximum number of iterations is reached or the optimal solution is found. The feature selection process removes redundant or irrelevant features from the data set and retains the most representative feature subset, thereby reducing the computational complexity of the model and improving detection efficiency. This step provides an optimized input data basis for IoT traffic data.

[0096] In order to solve the problem of scarce IoT attack traffic samples, the present invention adopts the EQLv2 cost-sensitive function to improve the model's detection ability for small sample categories by balancing the gradient weights of positive and negative samples. During the calculation process, the gradient update is re-weighted by dynamically adjusting the positive and negative gradient ratios, so that the model increases the learning weight of attack samples during training, avoiding detection bias caused by category imbalance. The process of balancing the gradient effectively solves the problem of data imbalance and ensures that the model maintains high accuracy and low false alarm rate when facing complex IoT environments.

[0097] The present invention combines convolutional neural networks (CNN) and long short-term memory networks (LSTM) to construct a spatiotemporal model, respectively extracting spatial and temporal features of data. CNN extracts hidden local spatial patterns through the sliding operation of the convolution kernel, and reduces the dimension through pooling operations to highlight key features; LSTM captures the time series dependency of data through gate structures and cell states, and extracts long-term memory information. The combination of the two enables the model to fully capture potential attack patterns in network traffic, thereby achieving accurate detection of complex attack behaviors.

[0098] In the model training phase, after the data set is preprocessed by digitization and normalization, the model is trained through K-fold cross validation until the loss function converges. Through the dynamic adjustment of the EQLv2 loss function, the model further optimizes the recognition ability of small sample categories. In the prediction phase, the preprocessed test set is input into the trained model, the spatiotemporal features are extracted, and the classification results are output. The model efficiently classifies normal behavior and abnormal attack behavior in IoT traffic, and outputs accurate detection results for different types of attacks (such as DDoS and SQL injection), providing a comprehensive solution for IoT security.

[0099] The feature selection provided by the embodiment of the present invention is:

[0100] (1) Randomly initialize the population;

[0101] (2) Determine whether the fitness of individuals in the population meets the optimization criteria. If so, end the search and output the optimal solution; otherwise, continue;

[0102] (3) Individual selection is achieved based on fitness. The higher the individual's fitness, the higher the probability of being selected.

[0103] (4) The selected individual is replaced with the parent's chromosome at the selected position through the crossover operator to produce a new individual;

[0104] (5) Implement mutation operations on newly emerged individuals to increase the richness of individuals;

[0105] (6) Repeat the above steps until the maximum number of iterations is reached.

[0106] The convolutional neural network provided by the embodiment of the present invention:

[0107] Convolutional neural networks use convolution kernels to move on the input to mine hidden intrinsic features. The specific structure is shown below;

[0108] In CNN, the formula for extracting input features is as follows:

[0109]

[0110] Wherein, x represents the input and output layers, j represents the current number of convolutional layers, i and l represent the positions, ω represents the weight, b represents the bias, and f() represents the activation function. At the same time, the convolutional layer is generally set to be a pooling layer. The present invention adopts average pooling to achieve dimensionality reduction, and its calculation process is shown in formula (2);

[0111] x i =down(x i-1 ) (2)

[0112] Among them, x i represents the vector before pooling, down() represents the pooling function, x i-1 Represents the pooled vector.

[0113] The long short-term memory network provided by the embodiment of the present invention:

[0114] The key to LSTM's ability to provide long-term memory lies in the gate structure and cell state. The specific calculation process is shown in formula (3);

[0115]

[0116] Among them, f t 、i t and t is the output of each gate in the network, x t represents the initial input of the network, h t represents the final output of the network, Indicates the temporary state of the cell, C t represents the state of the cell at time t, W represents the weight matrix, b represents the bias, σ and tanh represent the activation function;

[0117] EQLv2 is used as the loss function; its output z j About Loss The positive and negative gradients are as follows:

[0118]

[0119] in, Indicates i Instances of the class j The probability of , y represents the true label, L is the number of samples; in order to balance the positive and negative gradients, they can be reweighted, and the reweighting coefficient is defined as follows:

[0120]

[0121] in, and are the weighted coefficients of the positive and negative gradients, respectively. express tThe ratio of the accumulated positive and negative gradients after iterations, α is the balance coefficient, t is the number of iterations, and f() is the constructed mapping function, which is expressed as follows:

[0122]

[0123] After obtaining the reweighted coefficients, the positive and negative gradients are updated as follows:

[0124]

[0125] At the same time, the positive and negative gradient ratios for the next t+1 iteration should also be updated:

[0126]

[0127] To detect anomalies in IoT network traffic, the specific steps are as follows:

[0128] Step 1: Perform preprocessing operations such as digitization and normalization on the traffic data set;

[0129] Step 2: Use genetic algorithm to perform feature selection on IoT traffic dataset;

[0130] Step 3: Build a spatiotemporal model combining CNN and LSTM and set parameters;

[0131] Step 4: Use EQLv2 as the loss function to balance positive and negative gradients to solve the class imbalance problem;

[0132] Step 5: Use K-fold cross validation to pre-train the data set until the model converges;

[0133] Step 6: Input the preprocessed test set into the trained model and count the classification results;

[0134] The data set provided by the embodiment of the present invention is:

[0135] 1) Dataset Description

[0136] The NSL-KDD dataset solves the problems that have long plagued the KDDCUP99 dataset by removing a large amount of redundant data;

[0137] The CIC-IDS-2017 dataset is created by sniffing real-time network packets. This dataset is one of the largest and most recent attack detection datasets. Due to the diversity of IoT devices, they are vulnerable to various network attacks, including DDoS and SQL injection attacks.

[0138] 2) Data preprocessing.

[0139] Data preprocessing provided by the embodiment of the present invention:

[0140] (1) Numericalization: There are some non-numerical features in the above datasets, such as protocol_type, flag, and service in the NSL-KDD dataset. The model cannot learn them, so these feature data need to be converted into numerical features.

[0141] (2) Normalization: The value range of some feature dimensions in the dataset is relatively wide, and their contribution to the learning of the model is not the same. Therefore, in order to reduce the differences between feature dimensions and ensure the accuracy of the detection results.

[0142] like Figure 2 As shown, an IoT attack detection system based on deep learning provided by an embodiment of the present invention includes:

[0143] Selection module, used for feature selection through genetic algorithm;

[0144] Adopting a module for adopting cost-sensitive functions to solve the problem of scarce attack traffic in the Internet of Things;

[0145] The combination module is used to combine the convolutional neural network and the long short-term memory network to extract the spatiotemporal information of the network.

[0146] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the deep learning-based Internet of Things attack detection method.

[0147] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to perform the steps of the deep learning-based Internet of Things attack detection method.

[0148] Another object of the present invention is to provide an information data processing terminal, which is used to implement the Internet of Things attack detection system based on deep learning.

[0149] This paper proposes an IoT attack detection method based on deep learning. First, feature selection is performed through genetic algorithm; second, cost-sensitive function is used to solve the problem of scarce attack traffic in IoT; finally, convolutional neural network and long short-term memory network are combined to extract the network's spatiotemporal information. The results show that the present invention shows good performance advantages on both IoT benchmark data sets, effectively improving the IoT attack detection performance.

[0150] The present invention is mainly divided into four parts: (1) feature selection; (2) spatiotemporal model; (3) loss function. At the same time, the attack detection framework composed of these three parts will also be given in this section.

[0151] As an important component of network attack detection, feature selection technology can lay the foundation for classification and identification of subsequent models. Therefore, the present invention proposes an adaptive search method based on genetic algorithm.

[0152] The genetic algorithm was proposed by Holland in 1975 [4]. It is a computational model whose search process is similar to the theory of evolution. The algorithm uses the population to perform continuous crossover and mutation to ensure that individuals with strong adaptability can be retained, so that the target population can obtain the optimal solution. The specific steps are as follows.

[0153] (1) Randomly initialize the population;

[0154] (2) Determine whether the fitness of individuals in the population meets the optimization criteria. If so, end the search and output the optimal solution; otherwise, continue.

[0155] (3) Individual selection is based on fitness. The higher the individual’s fitness, the higher the probability of being selected.

[0156] (4) The selected individual is replaced with the parent's chromosome at the selected position through the crossover operator to produce a new individual.

[0157] (5) Perform mutation operations on newly emerged individuals to improve the richness of individuals.

[0158] (6) Repeat the above steps until the maximum number of iterations is reached.

[0159] Through the above steps, the optimal feature subset can be obtained, which has the characteristics of simplicity, stability and strong adaptability.

[0160] The spatiotemporal model designed by the present invention can not only capture the information of traffic flow in time scale, but also extract the spatial features.

[0161] Convolutional neural network was proposed by LeCun et al. in 1990

[19] . It uses convolution kernel to move on the input to explore hidden intrinsic features. The specific structure is as follows: Figure 3 shown.

[0162] In CNN, the formula for extracting input features is as follows:

[0163]

[0164] Wherein, x represents the input and output layers, j represents the current number of convolutional layers, i and l represent the positions, ω represents the weight, b represents the bias, and f() represents the activation function. At the same time, the convolutional layer is generally set to be a pooling layer. The present invention adopts average pooling to achieve dimensionality reduction, and its calculation process is shown in formula (2);

[0165] x i =down(x i-1 )(2)

[0166] Among them, x i represents the vector before pooling, down() represents the pooling function, x i-1 Represents the pooled vector.

[0167] 2.2.2 Long Short-Term Memory Network

[0168] The long short-term memory network is a variant of the recurrent neural network

[20] and avoids problems such as gradient diffusion. The network consists of an input layer, a hidden layer, and an output layer. Figure 4 shown.

[0169] The key to LSTM's ability to provide long-term memory lies in the gate structure and cell state. The specific calculation process is shown in formula (3).

[0170]

[0171] Among them, f t 、i t and t is the output of each gate in the network, x t represents the initial input of the network, h t represents the final output of the network, Indicates the temporary state of the cell, C t represents the state of the cell at time t, W represents the weight matrix, b represents the bias, σ and tanh represent the activation function;

[0172] There is a class imbalance problem in the attack detection data set. The number of samples in some attack categories is small, and they are easily overwhelmed by the majority class samples during attack detection. To solve this class imbalance problem, the present invention uses EQL v2 as the loss function, aiming to eliminate the neglect of minority class samples by the neural network model during prediction and classification. It is gratifying that the EQL v2 function that uses a reweighted mechanism to balance the positive and negative ratios of the gradient can effectively solve the class imbalance problem in NIDS. Its output z j About Loss The positive and negative gradients are as follows:

[0173]

[0174] in, represents the probability that the i-th instance belongs to category j, y represents the true label, and L is the number of samples; in order to balance the positive and negative gradients, they can be reweighted, and the reweighting coefficient is defined as follows:

[0175]

[0176] in, and are the weighted coefficients of positive and negative gradients, respectively. express t The ratio of the accumulated positive and negative gradients after iterations, α is the balance coefficient, t is the number of iterations, and f() is the constructed mapping function, which is expressed as follows:

[0177]

[0178] After obtaining the reweighted coefficients, the positive and negative gradients are updated as follows:

[0179]

[0180] At the same time, the positive and negative gradient ratios for the next t+1 iteration should also be updated:

[0181]

[0182] In summary, the above methods can effectively solve the problem of scarce abnormal traffic in IoT devices.

[0183] 2.4 Steps of the proposed detection method

[0184] The present invention performs abnormal detection on the network traffic in IoT through 2.1-2.3, and the specific steps are as follows:

[0185] Step 1: Perform preprocessing operations such as digitization and normalization on the traffic data set, as detailed in Section 3.2;

[0186] Step 2: Use genetic algorithm to perform feature selection on IoT traffic dataset;

[0187] Step 3: Build a spatiotemporal model combining CNN and LSTM and set parameters;

[0188] Step 4: Use EQL v2 as the loss function to balance positive and negative gradients to solve the class imbalance problem;

[0189] Step 5: Use K-fold cross validation to pre-train the data set until the model converges;

[0190] Step 6: Input the preprocessed test set into the trained model and count the classification results.

[0191] In order to verify the detection ability of the proposed method for IoT attack detection, experiments are conducted on the IoT benchmark datasets NSL-KDD

[21] and CIC-IDS-2017

[22] .

[0192] The NSL-KDD dataset solves the problems that have long plagued the KDD CUP99 dataset by deleting a large amount of redundant data. It is one of the most classic datasets in the field of attack detection. The NSL-KDD dataset contains four files, namely KDDTrain+.txt, KDDTest+.txt, KDDTrain-21.txt and KDDTest-21.txt. In order to better train the proposed method, the present invention selects KDDTrain+.txt and KDDTest+.txt as the training set and test set of the model. Compared with abnormal traffic, the attack detection dataset of the emerging Internet of Things contains a large number of benign samples, so we can use the NSL-KDD dataset to simulate the network traffic in the real CPS environment, and evaluate our model by analyzing different abnormal traffic detections. The specific details are shown in Table 1.

[0193] The CIC-IDS-2017 dataset is created by sniffing real-time network packets. This dataset is one of the largest and latest attack detection datasets. Due to the diversity of IoT devices, they are vulnerable to various network attacks, including DDoS and SQL injection attacks. The CIC-IDS-2017 dataset contains a large number of Dos attacks, so CIC-IDS-2017 can be used as a benchmark dataset for IoT. Limited by computer performance, the present invention only selects the Wednesday dataset in CIC-IDS-2017 for experiments, and because the number of Heartbleed attack samples in the Wednesday dataset is only 11, which is too sparse, it is deleted and there is still a serious class imbalance problem in the dataset. The specific details are shown in Table 2.

[0194] Table 1. Sample distribution of NSL-KDD dataset

[0195]

[0196] Table 2. Sample distribution of CIC-IDS-2017 dataset

[0197]

[0198] In order to meet the neural network input format requirements and improve the data quality of the data set, the present invention preprocesses the data set, and the specific steps are as follows:

[0199] (1) Numericalization: There are some non-numerical features in the above dataset, such as protocol_type, flag and service in the NSL-KDD dataset. The model cannot learn them, so it is necessary to convert these feature data into numerical features. The present invention converts them into numbers through the label encoding function, and also performs numerical conversion on the data label category.

[0200] (2) Normalization: The value range of some feature dimensions in the data set is relatively wide, and their contribution to the learning of the model is not the same. Therefore, in order to reduce the differences between feature dimensions and ensure the accuracy of the detection results, the present invention uses the Min-Max function to normalize each column of features and limit its value range to [0,1], which can ensure the validity of the data.

[0201] The computer used in the present invention has a 64-bit Windows 11 operating system, an AMD Ryzen 76800H CPU with 16GB RAM, and an NVIDIA GeForce RTX 3050Ti GPU.

[0202] 4.1 Evaluation Metrics

[0203] In order to intuitively reflect the performance advantages and stability of the proposed model, the present invention uses five indicators, namely, accuracy (Acc), precision (Pre), recall (Rec), false positive rate (FPR) and F1 score, to evaluate the model performance. The above indicators are calculated as follows:

[0204]

[0205] Among them, TP, TN, FP and FN They represent true positives, true negatives, false positives, and false negatives, respectively, that is, the number of attack samples predicted correctly, the number of normal samples predicted correctly, the number of attack samples predicted incorrectly, and the number of normal samples predicted incorrectly.

[0206] There are a large number of parameters in the process from feature selection to model classification, and the selection of their values ​​is closely related to the final classification result. The optimal values ​​of the parameters of the present invention are determined through a series of experimental comparative analysis, and the specific parameter settings are shown in Table 3.

[0207] Table 3 Parameter settings

[0208]

[0209]

[0210] In the present invention, multiple experiments are conducted on the IoT attack detection datasets NSL-KDD and CIC-IDS-2017 to verify the effectiveness of the proposed method, and the performance advantages of the proposed method are demonstrated by comparing with other methods.

[0211] Different defense measures are taken for different attack styles. Therefore, it is not enough to protect the device from being damaged by simply identifying the attack samples. Therefore, it is necessary to conduct multi-classification experiments to subdivide the attack samples. The experimental results of the proposed method on two data sets and the confusion matrix are shown in Table 4 and Table 5. Figure 3 shown.

[0212] As shown in Table 4, the accuracy and recall rate of the NSL-KDD dataset when implementing multi-classification are 99.21%, the precision and F1 score are 99.22%, and the FAR is 4.18%; while for the CIC-IDS-2017 dataset, the five indicators are all 99.83%, and the FAR is 0.11%. It can be seen that the proposed method has achieved good results on both datasets, which shows that the present invention can effectively identify each type of attack and will not mistake it as abnormal traffic due to changes in normal traffic.

[0213] The confusion matrix is ​​generally considered to be the most intuitive and basic method for evaluating model performance. Therefore, this paper uses heat maps, color difference, and brightness to reflect the differences between different categories of data. When the data on the diagonal of the confusion matrix is ​​the largest and darkest, it means that most of the data samples have been predicted. The confusion matrix of the two data sets can be seen in detail. Figure 5 .

[0214] Table 4 Multi-classification results (%)

[0215]

[0216] In order to verify the advantages of the feature selection method proposed in the present invention, the method of the present invention is compared and analyzed with four feature selection methods, namely, the chi-square test method, the random forest method, the mutual information method and the recursive elimination method, as shown in Table 5.

[0217] As can be seen from Table 5, for the NSL-KDD dataset, the method of the present invention has achieved good results in the other four indicators except FAR, among which the recall rate has increased by 0.23%-2.05%. For the CIC-IDS-2017 dataset, the method of the present invention is ahead of other feature selection methods in all five indicators. This is mainly because the chi-square test is an independence assumption, and there are complex nonlinear relationships in the dataset, so the features selected by the chi-square test may only be locally correlated, and the overall correlation of the features cannot be considered; similarly, the mutual information feature selection method and the recursive elimination method also ignore the correlation between features; and the random forest is an integrated model, which may overfit when processing high-dimensional data, resulting in the selected features not being generalized. The present invention selects the GA algorithm as the feature selection method for the IoT attack detection dataset, which not only makes full use of the intrinsic statistical information of the network traffic samples, but also has certain scientific and artistic qualities.

[0218] Table 5 Comparison of feature selection methods (%)

[0219]

[0220] Note: Bold fonts in the table indicate the best performance

[0221] In order to solve the problem that the probability of abnormal events occurring in the IoT environment is low, resulting in class imbalance in the data set, the class balancing method of the present invention is compared with the current more representative class balancing method. The specific results are shown in Table 6.

[0222] Table 6 Comparison with other types of balancing methods (%)

[0223]

[0224] Note: Bold fonts in the table indicate the best performance

[0225] As shown in Table 6, the proposed class balancing method achieved good performance on both datasets, taking into account the two contradictory indicators of precision and recall. For the NSL-KDD dataset, the proposed method achieved the best results in all five indicators, with the maximum improvement of 20.95%, 6.88%, 31.80%, and 21.29% in the first four indicators. Similarly, for the CIC-IDS-2017 dataset, the proposed method can also achieve the best results. Compared with other class balancing methods, the proposed method has more significant effects on the five indicators and can still achieve good attack detection effects.

[0226] The reason why the method proposed in the present invention is superior to other class balancing methods is that ROS and SMOTE simply copy data and are prone to overfitting problems. Although methods such as BorderlineSMOTE, RUS+SMOTE and KMeans+SMOTE use various means to solve the overfitting problem, the synthesized samples are relatively similar and there is still an overfitting problem. ADASYN based on K nearest neighbors generates data by assigning different weights to different categories, but is susceptible to outliers. ENN and RENN achieve class balance by randomly deleting some samples in the majority class, but the information of some important samples will also be lost. These traditional sampling methods are essentially shallow learning and lack deep learning of original data. Therefore, they cannot distinguish noisy data, so they are prone to generate more noisy data, which in turn reduces model performance. Although deep learning methods CGAN and WGAN can learn the intrinsic distribution of sample data, they may generate meaningless samples, and there are also problems such as model collapse and gradient disappearance. The present invention uses the gradient-guided reweighting mechanism method EQL v2, which neither synthesizes samples to affect the overall distribution of the original data set, nor can it balance the accumulated positive and negative gradients to prevent gradient explosion and disappearance. Therefore, it can basically achieve the best in various indicators.

[0227] In order to further explore the advancement of the method of the present invention in IoT attack detection, the present invention selects different benchmark models for different data sets for comparative analysis. The specific results are shown in Table 7.

[0228] Table 7 Comparison with other methods (%)

[0229]

[0230] As can be seen from Table 7, compared with the existing methods, the method of the present invention is basically the best on the three data sets. In the NSL-KDD data set, the recall rate of the present invention is only slightly lower than that of the CNN model, with a difference of only 0.79%, but the precision of the present invention is 1.74% higher than that of the model, and the detection result of the present invention is also better than that of the model in the comprehensive index F1 score. As for the CIC-IDS-2017 data set, each model has a good detection effect. This is because the CIC-IDS-2017 data set contains a large amount of data and is relatively simple. In this case, the present invention is only 0.1% lower than SVM-GAC in precision, but 3.97%, 0.39% and 0.23% higher than TACGAN, KD-TCNN and BT-TPF respectively. And the F1 score is 4.02%, 0.92%, 0.37% and 0.23% higher than these four models respectively.

[0231] The reason why the performance of other models is lower than that of the model of the present invention is that CNN-LSTM and PyDSC fail to solve the class imbalance problem in the data set, resulting in the detection effect being inferior to other models; KD-TCNN and BT-TPF realize lightweight anomaly detection models through knowledge distillation, but the reduction of parameters will lead to a decline in performance, so these two models are inferior to the present invention in four indicators; TLHA uses undersampling to synthesize samples, which makes the data quality low and has limited improvement on model performance; the SVM-GAC model uses an adaptive algorithm based on mutation and perception strategies to identify malicious features, and the effect is more significant, but the ability of SVM to extract deep information of samples is limited, so the performance of the model is slightly worse; and WGAN, MCGAN, FCWGAN and TACGAN fail to solve the problem of easy collapse of the model, so there is generated data that does not conform to the original distribution. In summary, the model of the present invention can effectively identify specific attack methods and protect network equipment from threats to a certain extent.

[0232] The present invention proposes an IoT attack detection method based on deep learning. It eliminates redundant features through feature selection, enhances the inter-class differences and intra-class similarities of the selected feature subsets, and uses EQL v2 to solve the class imbalance problem in the attack detection data set. At the same time, a spatiotemporal model is constructed to extract the spatiotemporal information of samples. The proposed method is evaluated on the IoT attack detection benchmark data sets NSL-KDD and CIC-IDS-2017 for multi-classification performance, and the advantages of the proposed method are verified from the five indicators of accuracy, precision, recall, F1 score and false alarm rate. The effectiveness and feasibility of the proposed method are also reflected when compared with multiple methods. However, the present invention only conducts experiments on two traffic data sets. In the future, it will start from traffic data sets with more realistic samples and wider scenarios to improve the universality of the model. In addition, taking into full consideration the characteristics of limited node energy, low computing resources, poor communication environment, limited storage capacity and limited model generalization ability in the IoT network, designing a more lightweight detection model to be applicable to various mobile devices is also the focus of the next step of research.

[0233] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware part can be implemented using dedicated logic; the software part can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. It can be understood by a person of ordinary skill in the art that the above-mentioned devices and methods can be implemented using computer executable instructions and / or contained in a processor control code, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. Such code is provided on the carrier medium. The device and its modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, and can also be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0234] The above description is only a specific implementation mode of the present invention, but the protection scope of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with the technical field within the technical scope disclosed by the present invention and within the spirit and principle of the present invention should be covered by the protection scope of the present invention.

Claims

1. A method for detecting IoT attacks based on deep learning, characterized in that: The following steps are involved: Step 1, obtain the IoT traffic data set; Step 2, preprocessing the obtained data set; Step 3, perform feature selection on the IoT traffic data set through a genetic algorithm to determine a set of representative feature subsets that can effectively approximate the original feature space; Step 4: Use the cost-sensitive function to balance the gradients of positive and negative samples, thereby solving the problem of scarce attack traffic in the Internet of Things; Step 5: Combine the convolutional neural network and the long short-term memory network to extract the spatiotemporal information of the network and output the final IoT attack detection results.

2. The IoT attack detection method based on deep learning as claimed in claim 1, characterized in that: The feature selection: (1) Randomly initialize the population; (2) Determine whether the fitness of individuals in the population meets the optimization criteria. If so, end the search and output the optimal solution; otherwise, continue; (3) Individual selection is achieved based on fitness. The higher the individual's fitness, the higher the probability of being selected. (4) The selected individual is replaced with the parent's chromosome at the selected position through the crossover operator to produce a new individual; (5) Implement mutation operations on newly emerged individuals to increase the richness of individuals; (6) Repeat the above steps until the maximum number of iterations is reached.

3. The IoT attack detection method based on deep learning as claimed in claim 1, characterized in that: The convolutional neural network: Convolutional neural networks use convolution kernels to move on the input to mine hidden intrinsic features. The specific structure is shown below; In CNN, the formula for extracting input features is as follows: Wherein, x represents the input and output layers, j represents the current number of convolutional layers, i and l represent the positions, ω represents the weight, b represents the bias, and f() represents the activation function. At the same time, the convolutional layer is generally set to be a pooling layer. The present invention adopts average pooling to achieve dimensionality reduction, and its calculation process is shown in formula (2); x i =down(x i-1 ) (2) Among them, x i represents the vector before pooling, down() represents the pooling function, x i-1 Represents the pooled vector.

4. The IoT attack detection method based on deep learning as claimed in claim 1, characterized in that: The long short-term memory network: The key to LSTM's ability to provide long-term memory lies in the gate structure and cell state. The specific calculation process is shown in formula (3); Among them, f t 、i t and t is the output of each gate in the network, x t represents the initial input of the network, h t represents the final output of the network, Indicates the temporary state of the cell, C t represents the state of the cell at time t, W represents the weight matrix, b represents the bias, σ and tanh represent the activation function; EQLv2 is used as the loss function; its output z j About Loss The positive and negative gradients are as follows: in, represents the probability that the i-th instance belongs to category j, y represents the true label, and L is the number of samples; in order to balance the positive and negative gradients, they can be reweighted, and the reweighting coefficient is defined as follows: in, and are the weighted coefficients of the positive and negative gradients, respectively. It represents the ratio of the accumulated positive and negative gradients after t iterations, α is the balance coefficient, t is the number of iterations, and f() is the constructed mapping function, which is expressed as follows: After obtaining the reweighted coefficients, the positive and negative gradients are updated as follows: At the same time, the positive and negative gradient ratios for the next t+1 iteration should also be updated: To detect anomalies in IoT network traffic, the specific steps are as follows: Step 1: Perform preprocessing operations such as digitization and normalization on the traffic data set; Step 2: Use genetic algorithm to perform feature selection on IoT traffic dataset; Step 3: Build a spatiotemporal model combining CNN and LSTM and set parameters; Step 4: Use EQLv2 as the loss function to balance positive and negative gradients to solve the class imbalance problem; Step 5: Use K-fold cross validation to pre-train the data set until the model converges; Step 6: Input the preprocessed test set into the trained model and count the classification results.

5. The IoT attack detection method based on deep learning as claimed in claim 4, characterized in that: The dataset: 1) Dataset Description The NSL-KDD dataset solves the problems that have long plagued the KDDCUP99 dataset by removing a large amount of redundant data; The CIC-IDS-2017 dataset is created by sniffing real-time network packets. This dataset is one of the largest and most recent attack detection datasets. Due to the diversity of IoT devices, they are vulnerable to various network attacks, including DDoS and SQL injection attacks. 2) Data preprocessing.

6. The IoT attack detection method based on deep learning as claimed in claim 5, characterized in that: The data preprocessing: (1) Numericalization: There are some non-numerical features in the above datasets, such as protocol_type, flag, and service in the NSL-KDD dataset. The model cannot learn them, so these feature data need to be converted into numerical features. (2) Normalization: The value range of some feature dimensions in the dataset is relatively wide, and their contribution to the learning of the model is not the same. Therefore, in order to reduce the differences between feature dimensions and ensure the accuracy of the detection results.

7. A deep learning-based IoT attack detection system implementing the deep learning-based IoT attack detection method according to any one of claims 1 to 6, characterized in that: The IoT attack detection system based on deep learning includes: Selection module, used for feature selection through genetic algorithm; Adopting a module for adopting cost-sensitive functions to solve the problem of scarce attack traffic in the Internet of Things; The combination module is used to combine the convolutional neural network and the long short-term memory network to extract the spatiotemporal information of the network.

8. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the IoT attack detection method based on deep learning as described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the steps of the Internet of Things attack detection method based on deep learning as described in any one of claims 1 to 6.

10. An information data processing terminal, characterized in that: The information data processing terminal is used to implement the Internet of Things attack detection system based on deep learning as described in claim 7.

Images