Cost-sensitive traffic feature selection method and system for iot intrusion detection system

Abstract

The application discloses a cost-sensitive traffic feature selection method and system for an IoT intrusion detection system, and belongs to the field of Internet of Things. The application optimizes a feature subset by quantifying the balance between the calculation cost and the recognition effect of features. A calculation cost evaluation model is used to quantify the calculation burden of features, and a particle swarm optimization algorithm and an orthogonal sparse vector initialization strategy are combined to screen an efficient and accurate feature subset from multiple traffic scenes. A multi-dimensional fitness function is used to evaluate the comprehensive effect of calculation loss, recognition ability and feature quantity, so that the feature subset can reduce the calculation cost without sacrificing the detection accuracy. The application effectively improves the efficiency and accuracy of IoT malicious traffic recognition.

Description

Technical Field

[0001] This invention belongs to the field of Internet of Things (IoT), specifically relating to a method and system for selecting cost-sensitive traffic features for IoT intrusion detection systems. Background Technology

[0002] The Internet of Things (IoT) technology has wide applications in urban environments, residential environments, and the automotive industry. The number of IoT devices is projected to exceed 25 billion in the coming years. The plug-and-play nature of IoT devices and their default initial passwords pose significant security risks. Furthermore, the limited computing resources and storage space of IoT devices make defense measures difficult, exacerbating their vulnerability. IoT devices are highly susceptible to attacks from malware such as botnets. Botnets consist of infected nodes that can launch DDoS attacks, spread spam, steal private information, and cause financial losses.

[0003] To enhance the security of IoT devices, Network Intrusion Detection Systems (NIDS) play a crucial role in detecting malware based on network behavior. Machine learning and deep learning-based NIDS have gained significant attention due to their ability to detect unknown malicious traffic with similar behavioral patterns, but they face major challenges in IoT scenarios. IoT devices struggle to perform intensive security tasks due to low power consumption and resource constraints. Therefore, deploying NIDS at the fog layer (network edge) is an effective way to reduce hardware costs. However, NIDS in IoT networks often face high energy efficiency requirements, while traditional ML-based IDS often lack accuracy and are not energy-efficient. The high computational cost of IDS significantly increases the burden on IoT gateways, thereby increasing network congestion.

[0004] Existing research methods focus on reducing redundant features by selecting those that contribute to identification capabilities and eliminating others. However, these methods do not consider the differences in computational cost between different features. Computing a complex feature can take tens or even hundreds of times longer than computing a simple one. Therefore, simply reducing the number of features to lower computational costs is insufficient. To enhance the security of IoT networks, an accurate and efficient method for identifying malicious IoT traffic is needed, capable of identifying infected devices within monitored network segments with low computational cost, high computational efficiency, and high accuracy, even in resource-constrained scenarios such as IoT gateways. Summary of the Invention

[0005] The purpose of this invention is to propose a cost-sensitive traffic feature selection method and system for IoT intrusion detection systems, aiming to solve the problem that existing traffic feature screening technologies cannot effectively balance computational cost and recognition effect, resulting in low recognition efficiency and high computational cost in malicious traffic identification.

[0006] The technical solution adopted by this invention to achieve its objective is as follows:

[0007] A method for selecting cost-sensitive traffic features for IoT intrusion detection systems includes the following steps:

[0008] S1: Obtain the feature construction source code and PCAP files for different scenarios, and extract the flow features for each scenario from them;

[0009] S2: Obtain the feature computation time during stream feature extraction, calculate the scene weight based on the stream transmission frequency of each scene, and use the scene weight to calculate the weighted average of the feature computation time to obtain the feature computation loss;

[0010] S3: Based on the orthogonal sparse vector algorithm, the feature space formed by the extracted flow features is initialized with particles. Each particle represents a feature subset, and the particles are given an initial position and velocity through particle initialization.

[0011] S4: Based on the initial position and velocity of the particles, the particle swarm optimization algorithm is used to randomly update the position and velocity of the particles to generate a temporary feature subset;

[0012] S5: Train and test a temporary subset of features using a random forest classifier, and record the F1 score;

[0013] S6: Calculate the loss based on the features and the F1 score to calculate the overall score of the feature subset;

[0014] S7: If the overall score of the current feature subset exceeds the historical best value, then update the current feature subset to the current global best feature subset.

[0015] Further, in step S1, PCAP files for six scenarios are obtained, including scan traffic, DoS traffic, C&C traffic, benign IoT traffic, PC traffic, and mobile traffic.

[0016] Furthermore, the formula for calculating the weights based on the streaming frequency of each scenario in step S2 is as follows:

[0017]

[0018] Where, weight i As scene weight, The duration is the total number of streams in scenario PCAP file i. i The total duration of scenario PCAP file i is given by the logarithm base e.

[0019] Furthermore, the formula for calculating the feature loss in step S2 is:

[0020]

[0021] Among them, FCL j The loss is calculated for the features, where normalize is the normalization function, and weight is the weight. i As scene weights, cost j The calculation time is for the features.

[0022] Furthermore, step S3, which involves initializing the feature space formed by the extracted flow features using the orthogonal sparse vector algorithm, includes the following steps:

[0023] Divide all particles into different groups, initialize each group independently, and determine the initial position of each particle.

[0024] In each group, each particle uses a sparse vector orthogonal to the velocities of the other particles as its initial velocity;

[0025] The initial velocity dimension of each particle is determined by controlling the sparsity, and the total number of particles is calculated based on the sparsity.

[0026] Furthermore, in step S4, the formula for randomly updating the particle velocity using the particle swarm optimization algorithm is:

[0027]

[0028]

[0029] Among them, speed p Let p be the velocity of particle p, w be the inertia factor, c1 be the self-awareness learning factor, c2 be the social-awareness learning factor, and vector be... random It is a random vector. These are the best coordinates for the particle so far. The current coordinates of the particle. These are the best global coordinates so far.

[0030] Furthermore, in step S5, the random forest classifier is trained and tested on the MedbIoT, Bot-IoT, CICIoT Dataset2023, and IoT-23 datasets using a temporary subset of features.

[0031] Furthermore, in step S6, a multidimensional fitness function is used to calculate the fitness based on the loss and F1 score of the features, and this fitness is used as the comprehensive score of the feature subset.

[0032] Furthermore, step S6, which involves calculating fitness using a multidimensional fitness function, includes:

[0033] Calculate the recognition score based on the F1 score:

[0034] Sd =Scale(F1,4)

[0035] Calculate the loss score based on the features:

[0036]

[0037] Calculate the loss and feature count score based on the features:

[0038]

[0039] The fitness is obtained by weighted summation of the recognition score, loss score, and feature quantity score.

[0040] RecoFitness = w1·S d +w2·S c +w3·S n

[0041] Where RecoFitness is fitness, S d To identify the score, S c To calculate the loss score, S n The feature count scores are w1, w2, and w3, which are weight coefficients. The free class flow (FCL) is... selected Calculate the loss for the features of the current feature subset, FCL total The loss is calculated for the overall features, and Scale is a scaling function for numerical values.

[0042] A cost-sensitive traffic feature selection system for IoT intrusion detection systems includes:

[0043] The data acquisition module is used to acquire the feature construction source code and PCAP files for different scenarios, and extract the flow features of each scenario from them;

[0044] The feature computation loss evaluator is used to obtain the feature computation time during streaming feature extraction, calculate the scene weight based on the streaming frequency of each scene, and use the scene weight to calculate the feature computation time by weighted average to obtain the feature computation loss.

[0045] The feature selection module initializes the feature space formed by the extracted flow features based on the orthogonal sparse vector algorithm. Each particle represents a feature subset, and initial position and velocity are assigned to the particles through particle initialization. Based on the initial position and velocity of the particles, the position and velocity of the particles are randomly updated using the particle swarm optimization algorithm to generate temporary feature subsets. The temporary feature subsets are trained and tested using a random forest classifier, and the F1 score is recorded. The loss of the features and the F1 score are calculated to obtain the comprehensive score of the feature subsets. If the comprehensive score of the current feature subset exceeds the historical best value, the current feature subset is updated to the current global best feature subset.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] 1. This invention employs a computational cost assessment model to quantify the computational cost of features and analyze the computational burden of various traffic features on the intrusion detection system. By weighted averaging of feature computation time under different traffic scenarios, the computational loss of each feature is accurately evaluated, ensuring a more efficient and scientific feature selection process.

[0048] 2. This invention designs a cost-sensitive traffic feature selection method that comprehensively considers recognition capability and computational cost when optimizing feature selection, exhibiting high adaptability. The system adjusts the selection strategy according to different traffic scenarios (such as scanning traffic, DoS traffic, benign IoT traffic, etc.) to improve the accuracy of malicious traffic identification, making it particularly suitable for resource-constrained IoT devices.

[0049] 3. This invention optimizes both computational cost and recognition performance by selecting an efficient and accurate feature subset, ensuring high accuracy while optimizing computational burden and adapting to the needs of resource-constrained devices.

[0050] 4. This invention significantly improves the efficiency and accuracy of IoT malicious traffic detection. By removing irrelevant or inefficient features, it reduces the computational burden, ensures high accuracy, and is suitable for resource-constrained device environments.

[0051] 5. This invention combines computational cost and recognition effect, quantifies and reduces feature computation cost, optimizes the performance of intrusion detection system without sacrificing accuracy, and is suitable for environments with limited computing resources.

[0052] 6. This invention innovatively combines particle swarm optimization algorithm, orthogonal sparse vector algorithm, and multidimensional fitness function to optimize the feature selection process, improve global search efficiency, and ensure reasonable and comprehensive feature selection.

[0053] 7. This invention employs a particle initialization method based on orthogonal sparse vectors to quickly generate high-quality particles, enhance particle swarm diversity, reduce local optimum traps, and increase the probability of discovering the global optimum. Attached Figure Description

[0054] Figure 1 This is a flowchart illustrating the steps of the cost-sensitive traffic feature selection method for an IoT intrusion detection system in this embodiment.

[0055] Figure 2 This is a diagram showing the module composition of the cost-sensitive traffic feature selection system for the IoT intrusion detection system in this embodiment.

[0056] Figure 3 Scatter plots showing the F1 scores of each method versus the test results of the perceptual loss on different datasets.

[0057] Figure 4 Histograms of F1 scores and perceptual loss for each method on different datasets. Detailed Implementation

[0058] To make the various technical features, advantages, or effects of the present invention more apparent and understandable, detailed descriptions are provided below in conjunction with embodiments and accompanying drawings.

[0059] This embodiment discloses a method for selecting cost-sensitive traffic features for IoT intrusion detection systems, such as... Figure 1 As shown, this invention comprises several parts, including a feature computation cost quantification model, a PSO feature selection framework, a particle initialization method based on orthogonal sparse vectors (PIOSV), and a multidimensional fitness function (RecoFitness). It can quantify and evaluate the computational cost of traffic features, obtain the feature computation loss, and weigh this loss against the feature recognition capability to ultimately obtain a high-quality feature subset that meets the requirements in both computational cost and recognition performance. This invention addresses the feature selection problem in intrusion detection system design, enabling the selection of a feature subset with high recognition capability and low computational cost, thereby constructing a lightweight and efficient intrusion detection system suitable for deployment in resource-constrained devices such as IoT gateways.

[0060] This embodiment also corresponds to a cost-sensitive traffic feature selection system for IoT intrusion detection systems, such as... Figure 2 As shown, it includes:

[0061] The data acquisition module is used to acquire the feature construction source code and PCAP files for different scenarios, and extract the flow features of each scenario from them;

[0062] The feature calculation loss estimator is deployed on resource-constrained devices such as IoT gateways. These devices are characterized by low power consumption and low computing resources, but they have the need for intrusion detection. Therefore, in order to accurately evaluate the computation cost of flow features on these devices, this module needs to quantitatively evaluate the computation cost of each flow feature based on multiple traffic scenarios under resource constraints.

[0063] The PSO-based wrapper feature selection module can be deployed on any high-performance device to select traffic features based on computational cost and recognition performance. This module consists of two sub-modules: a particle initialization algorithm based on orthogonal sparse vectors (PIOSV) to initialize particles in the PSO algorithm, obtain high-quality particle coordinates and velocity vectors, and increase the possibility of it exploring the global optimum; and a multidimensional fitness function to evaluate the overall performance of feature subsets in terms of computational cost and recognition performance.

[0064] The above methods and systems perform the same processing procedure when processing data, specifically including the following steps:

[0065] S1: Data Preparation

[0066] Prepare the feature construction source code and PCAP files for six scenarios. This embodiment refactors the open-source traffic feature extraction tool CICFlowMeter, dividing traffic into several flows using a five-tuple (source IP, source port, protocol, destination IP, destination port), and extracting 69-dimensional flow features from each flow. Simultaneously, prepare PCAP files from six scenarios: scan traffic, DoS traffic, C&C traffic, benign IoT traffic, PC traffic, and mobile traffic. Using the feature construction source code and the PCAP files for each scenario, the feature calculation loss estimator can run and monitor the entire flow feature extraction process to calculate the feature calculation loss.

[0067] S2: Feature-based loss assessment

[0068] S2-1: Feature computation time capture. The computation process of each stream feature is monitored multiple times and the average value is taken to obtain the feature computation time cost. This step will calculate from PCAP files of 6 different scenarios, with each scenario corresponding to a set of feature computation time results.

[0069] S2-2: Scene Weight Calculation. The weight of a scene is determined based on the streaming frequency under different scenes. A higher streaming frequency indicates that this type of stream has a greater impact on the overall performance, therefore, a higher weight is assigned to the feature calculation time results under that scene. For scene PCAP file i, its scene weight is weight. i The calculation method is as follows:

[0070]

[0071] in, with duration i The total number of flows and the total duration of flows in scenario PCAP file i are given. The quotient of these two values ​​represents the flow transmission frequency in this scenario, with the logarithm base e.

[0072] S2-3: Feature computation loss evaluation. For each feature, its computation time is weighted and averaged according to the weights under different scenarios to obtain the final computation loss for each feature. This computational loss is used for subsequent feature subset fitness evaluation. For feature j, its computational loss is FCL. j The calculation method is as follows:

[0073]

[0074] Where normalize is the normalization function, and weight iThe weights for the scenarios mentioned above. j The calculation time is for the average flow characteristics mentioned above.

[0075] S3: Particle initialization is performed using the Orthogonal Sparse Vector Optimization (PIOSV) algorithm (each particle represents a subset of features), resulting in high-quality particle coordinates and velocity vectors. The PIOSV algorithm divides all particles into different groups, with each group undergoing an independent initialization process. Within a group, the initial velocity of each particle is represented by a sparse vector orthogonal to the initial velocities of other particles. This initialization ensures maximum exploration efficiency. The variable density controls the dimension of the initial particle velocity. Let the total dimension be dim, then the dimension c of the initial velocity of each particle... dim It can be calculated as:

[0076] c dim =dim·density

[0077] The total number of particles n particle It can be calculated as:

[0078]

[0079] Here, roundup is a function that rounds up.

[0080] S4: Update particle coordinates

[0081] Based on the initial coordinates and velocity vector of the particles, a temporary feature subset is output using the Particle Swarm Optimization (PSO) algorithm with random updates. This increases the randomness of particle exploration and improves the probability of finding the global optimum. For particle p, its velocity speed... p It can be calculated as follows:

[0082]

[0083] Where w is the inertia factor, c1 is the self-awareness learning factor, c2 is the social-awareness learning factor, and vector random Let be a random vector of dimension dim. These are the best coordinates for particle p so far. The current coordinates of the particle. These are the best global coordinates so far.

[0084] S5: The evaluator assesses the ability to identify temporary feature subsets.

[0085] The evaluator employs a traditional machine learning classifier, Random Forest (RF). The RF setup includes 100 leaf nodes and three tree classifiers. The feature subset is trained and tested on the MedbIoT, Bot-IoT, CIC IoT Dataset2023, and IoT-23 datasets, with the F1 score used as the evaluation result. This F1 score will be one of the key metrics in Stage S6.

[0086] S6: Calculate the multidimensional fitness function

[0087] RecoFitness takes the feature calculation loss, F1 score, and feature count score as inputs and uses them together as evaluation criteria to obtain the fitness score. The feature count score is introduced because some features do not significantly contribute to the F1 score but also do not impose a significant computational burden; the computational loss is insensitive to these features, and they need to be removed by the feature count score. The RecoFitness calculation method is as follows:

[0088] RecoFitness = w1·S d +w2·S c +w3·S n

[0089] Among them, S d S c With S n These are the recognition score, the calculated loss score, and the feature quantity score, respectively, with w1, w2, and w3 being weighting coefficients. The specific calculation methods for the three scores are as follows:

[0090] S d =Scale(F1,4)

[0091]

[0092] Among them, PCL selected Calculate the loss for the features of the current feature subset, FCL total The loss is calculated for the overall features. Fselect = 0 means that the current particle has not selected any features (i.e., the feature subset is empty), and Fselect ≠ 0 means that the current particle has selected at least one feature (i.e., the feature subset is not empty).

[0093] Since the F1 score, calculated loss, and number of features are on different scales, a scale function is used to scale them to avoid overly concentrated or dispersed distributions.

[0094] Scale(x,n) = x n

[0095] S7: Update the global optimal feature list

[0096] RecoFitness represents the overall score of a feature subset. A higher fitness indicates that the subset has advantages in recognition ability, computational loss, and number of features. If the RecoFitness of the current feature subset exceeds the historical best, it is updated to the current global best solution.

[0097] S8: Output the list of globally optimal features, or return to S4 for the next iteration. If the termination condition (such as the iteration round) is not currently met, proceed to the next iteration.

[0098] Experimental test:

[0099] The method of this invention was tested on the MedbIoT, Bot-IoT, CIC IoT Dataset2023, and IoT-23 datasets. Figure 3 and Figure 4 The results show a comparison between the proposed method (RecoSelector) and existing methods (Pearson Corr, Importance, Chi-Square, Greedy, and CHAMELEON). The results demonstrate that the feature subsets selected by the proposed method all offer advantages of high recognition capability and low computational loss. Compared to the average results of existing methods, the proposed method achieves a 2.68% improvement in F1 score while only incurring 12.14% of the computational time cost.

[0100] Meanwhile, the hypervolume (HV) metric was used to evaluate the various methods in this test. Hypervolume is the volume of the region in the target space enclosed by the non-dominated solution set obtained by the algorithm and the reference point. A larger HV value indicates better overall algorithm performance. The HV is calculated as follows:

[0101]

[0102] Where X is the non-dominant solution set given by the algorithm, x is a single solution in the solution set, P is the reference point corresponding to the true Pareto front, and v is the hypervolume of the space formed between the solution x and the reference point P.

[0103] The HV indices for each method are shown in Table 1 below.

[0104] Table 1. HV Index Evaluation Results

[0105]

[0106] As shown in the test results in Table 1, the method of this invention achieved the highest HV score on all datasets. Furthermore, the method of this invention does not experience significant performance degradation due to changes in the dataset, demonstrating an advantage in stability.

[0107] Although the present invention has been disclosed above with reference to embodiments, it is not intended to limit the present invention. Appropriate modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention should be covered within the protection scope of the present invention, which is defined by the claims.

Claims

1. A method for selecting cost-sensitive traffic features for IoT intrusion detection systems, characterized in that, Includes the following steps: S1: Obtain the feature construction source code and PCAP files for different scenarios, and extract the flow features for each scenario from them; S2: Obtain the feature computation time during stream feature extraction, calculate the scene weight based on the stream transmission frequency of each scene, and use the scene weight to calculate the weighted average of the feature computation time to obtain the feature computation loss; S3: Based on the orthogonal sparse vector algorithm, the feature space formed by the extracted flow features is initialized with particles. Each particle represents a feature subset, and the particles are given an initial position and velocity through particle initialization. S4: Based on the initial position and velocity of the particles, the particle swarm optimization algorithm is used to randomly update the position and velocity of the particles to generate a temporary feature subset; S5: Train and test a temporary subset of features using a random forest classifier, and record the F1 score; S6: Employ a multidimensional fitness function to calculate the fitness based on the loss and F1 score, and use this fitness as the comprehensive score for the feature subset; the steps for calculating fitness using the multidimensional fitness function include: Calculate the recognition score based on the F1 score: S d =Scale(F1,4) Calculate the loss score based on the features: Calculate the loss and feature count score based on the features: The fitness is obtained by weighted summation of the recognition score, loss score, and feature quantity score. RecoFitness=w1·S d +w2·S c +w3·S n Where RecoFitness is fitness, S d To identify the score, S c To calculate the loss score, S n The feature count scores are w1, w2, and w3, which are weight coefficients. The free class flow (FCL) is... selected Calculate the loss for the features of the current feature subset, FCL total The loss is calculated for the overall features, where Scale is a scaling function for the numerical values. S7: If the overall score of the current feature subset exceeds the historical best value, then update the current feature subset to the current global best feature subset.

2. The method as described in claim 1, characterized in that, In step S1, obtain the PCAP files for 6 scenarios, including scan traffic, DoS traffic, C&C traffic, IoT benign traffic, PC traffic, and mobile traffic.

3. The method as described in claim 1, characterized in that, The formula for calculating the weights based on the streaming frequency of each scenario in step S2 is: Where, weight i As scene weight, The duration is the total number of streams in scenario PCAP file i. i The total duration of scenario PCAP file i is given by the logarithm base e.

4. The method as described in claim 3, characterized in that, The formula for calculating the feature loss in step S2 is: Among them, FCL j The loss is calculated for the features, normalize is the normalization function, and weight is... i As scene weights, cost j The calculation time is for the features.

5. The method as described in claim 1, characterized in that, Step S3, which involves initializing the feature space formed by the extracted flow features using the orthogonal sparse vector algorithm, includes the following steps: Divide all particles into different groups, initialize each group independently, and determine the initial position of the particles. In each group, each particle uses a sparse vector orthogonal to the velocities of the other particles as its initial velocity; The initial velocity dimension of each particle is determined by controlling the sparsity, and the total number of particles is calculated based on the sparsity.

6. The method as described in claim 1, characterized in that, In step S4, the formula for randomly updating the particle velocity using the particle swarm optimization algorithm is: Among them, speed p Let p be the velocity of particle p, w be the inertia factor, c1 be the self-awareness learning factor, c2 be the social-awareness learning factor, and vector be... random For random vectors, These are the best coordinates for the particle so far. The current coordinates of the particle. These are the best global coordinates so far.

7. The method as described in claim 1, characterized in that, In step S5, the random forest classifier is trained and tested on the MedbIoT, Bot-IoT, CIC IoT Dataset2023, and IoT-23 datasets using a temporary subset of features.

8. A cost-sensitive traffic feature selection system for IoT intrusion detection systems, implementing the method according to any one of claims 1-7, characterized in that, include: The data acquisition module is used to acquire the feature construction source code and PCAP files for different scenarios, and extract the flow features of each scenario from them; The feature computation loss evaluator is used to obtain the feature computation time during streaming feature extraction, calculate the scene weight based on the streaming frequency of each scene, and use the scene weight to calculate the feature computation time by weighted average to obtain the feature computation loss. The feature selection module initializes the feature space formed by the extracted flow features based on the orthogonal sparse vector algorithm. Each particle represents a feature subset, and initial position and velocity are assigned to the particles through particle initialization. Based on the initial position and velocity of the particles, the position and velocity of the particles are randomly updated using the particle swarm optimization algorithm to generate temporary feature subsets. The temporary feature subsets are trained and tested using a random forest classifier, and the F1 score is recorded. The loss of the features and the F1 score are calculated to obtain the comprehensive score of the feature subsets. If the comprehensive score of the current feature subset exceeds the historical best value, the current feature subset is updated to the current global best feature subset.

Images