Internet of Things botnet life cycle detection method and system based on anti-detection honeypot

Abstract

The invention discloses an Internet of Things botnet life cycle detection method and system based on an anti-detection honeypot, and relates to the technical field of network security detection and defense. The objective of the invention is to accurately identify the life cycle of the Botnet traffic of the Internet of Things captured by the anti-detection honeypot, avoid the virtual detection technology of an attacker and realize higher fraudulence of the Botnet traffic of the Internet of Things. Firstly, a honeypot with an anti-detection function is designed based on a generative adversarial network, and vivid response data is generated according to different request data after training, so that the cheating ability of the honeypot is improved. The invention relates to an Internet of Things botnet life cycle detection method based on fusion of a long short-term memory network. After the Fusion-LSTM is trained, the life cycle of the Botnet traffic of the Internet of Things captured by the anti-detection honeypot can be accurately identified. According to the method, the virtual detection technology of an attacker can be avoided, higher deception on the flow of the botnet of the Internet of Things can be realized, and meanwhile, the life cycle of the flow can be accurately identified, so that protection response can be made as early as possible.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection and defense, and in particular to a method and system for detecting the life cycle of an Internet of Things botnet based on an anti-detection honeypot. Background Art

[0002] As the Internet of Things (IoT) enters the intelligent stage, some traditional industries such as home furnishing, urban transportation, medical care, manufacturing plants, etc. are increasingly integrated with the IoT, resulting in interdisciplinary integration fields such as smart home, smart transportation, smart medical care, and smart factories, which are driving people's production and life towards convenience and intelligence. As an important part of the IoT, IoT terminal devices can usually sense and analyze physical factors such as temperature and air pressure in the real world, and have the characteristics of interconnection, intelligence, and low power consumption. However, these characteristics have a certain impact on their security. The device cannot use high-intensity security encryption algorithms during information storage and information exchange; due to the interconnection of IoT devices with different security characteristics in the system, there may be a short board effect in system security; infected IoT devices become a springboard for attackers to attack other IoT devices in the system. Due to the vulnerability of IoT devices, many attacks on IoT devices have been launched. Among them, IoT botnets have the greatest impact on the IoT network environment. Research on IoT botnet detection has always been a hot topic, but in reality, the security threat caused by IoT botnets has remained high. The main reasons are: 1. Currently, the detection of IoT botnets is mainly focused on the stage after the device is infected, or lacks detection of the entire IoT life cycle. This is likely to result in insufficient awareness of the threat situation of IoT botnets in the real network environment, leaving opportunities for infection and invasion of IoT botnets; 2. In order to analyze the characteristics of IoT botnets, the current main method is to deploy honeypots to trap them. However, attackers can use virtual environment detection technology to identify and bypass honeypots. This makes it difficult to trap IoT botnet activity data.

[0003] Currently, the Internet of Things has penetrated into every aspect of people's lives and plays an increasingly important role in people's lives. However, due to the limitation of computing resources, some IoT devices cannot adopt security solutions, making these IoT devices extremely vulnerable to attacks. IoT zombie networks represented by Mirai infect, control, and attack IoT devices through the vulnerabilities of IoT devices, posing serious security threats to the IoT and even the Internet.

[0004] Currently, although IoT botnet detection is a hot research topic, the security threat posed by IoT botnets remains high.

[0005] Therefore, it is imperative to conduct a detailed study on the IoT botnet trapping and detection methods, and it is urgent to design and implement methods for lifecycle detection and anti-detection honeypots for IoT botnets.

[0006] The prior art with document number CN110505191A provides a method and device for detecting an IoT botnet node, which includes: obtaining scanning detection information of a detection device recorded by a honeypot device, the detection device sending a signal to the honeypot device, identifying the scanning detection information, obtaining device information of the detection device, and if the device information indicates that the detection device is an IoT device, then determining that the detection device is an IoT botnet node. It uses the characteristic that IoT devices will not actively scan and detect other IoT devices, and accurately detects IoT botnet nodes based on the two points that the detection device has active scanning and detection behavior on other IoT devices and that the detection device is an IoT device. It can detect botnet nodes from IoT devices with known security defects, IoT devices without security defects, and IoT devices with unknown security defects, thereby improving the detection rate of IoT botnet nodes. The prior art with document number CN112788065A proposes a method and device for tracking IoT botnets based on honeypots and sandboxes. The IoT honeypot captures the scanning vulnerability attacks launched by the IoT botnets, and at the same time captures the corresponding malicious samples, and sends the malicious samples to the IoT sandbox; the IoT sandbox receives the malicious samples captured by the IoT honeypot, dynamically runs the malicious samples, monitors their network behaviors, generates malicious traffic data, and uses a pre-built IoT malicious traffic classification model to classify the malicious traffic data generated by the malicious samples; based on the malicious traffic data classification results, the discovered P2P botnets are scanned, and the attribute information and network behavior data of the P2P botnets are monitored and obtained. None of the above prior arts can implement lifecycle detection and anti-detection honeypot methods for IoT botnets. Summary of the invention

[0007] The technical problems to be solved by the present invention are:

[0008] The purpose of the present invention is to provide an IoT botnet lifecycle detection method and system based on an anti-detection honeypot, so as to accurately identify the lifecycle of the IoT botnet traffic captured by the anti-detection honeypot, avoid the attacker's virtual detection technology to achieve higher deception of the IoT botnet traffic, and at the same time accurately identify the lifecycle of the traffic, so as to take protective measures as soon as possible.

[0009] The technical solution adopted by the present invention to solve the above technical problems is: a method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot, the method is based on a GAN anti-detection honeypot to trap an IoT botnet, and based on Fusion-LSTM to detect the life cycle of an IoT botnet to protect IoT devices from botnet infection. The method comprises:

[0010] Data processing: used to process interactive traffic data, extract traffic features, and store traffic data and detection results. Interactive traffic processing converts traffic data into input and output formats suitable for model generation. Traffic data is stored in the form of pcap files for use in the life cycle detection process. The traffic feature extraction process can extract traffic-level features from pcap data for analysis and detection by the life cycle detection module. Data storage is used to maintain interactive traffic data and classification results.

[0011] Anti-detection honeypot: Use the GAN model to generate real response data based on the received request data; the generator and discriminator are trained using the data set; after the request data is input into the generator, the converged generative model will generate false data and generate corresponding response data;

[0012] Lifecycle Detection: Detects traffic corresponding to specific stages of the IoT botnet lifecycle. Detection models for each stage of the benign and botnet lifecycle are trained using the dataset. These trained models are then used to evaluate input traffic features. The predictions from each model are fused to arrive at the final classification for that traffic.

[0013] Furthermore, the implementation process of interactive traffic processing and traffic feature extraction is as follows:

[0014] Interactive traffic processing: The response payload is encoded in byte format before being converted into an image. The byte format encoding uses a byte data bit-level encoding algorithm. The input of the algorithm is the number of bytes that can be encoded per row of the encoding matrix (r N ) and an array of bytes to be encoded (data); the algorithm maps each bit of each byte to four specified elements in the encoding matrix in a specific order; the algorithm uses bits as the basic unit for filling the matrix; the bit values ​​are amplified by 255 times before being included in the matrix, and each bit filled in the matrix occupies the position of four adjacent elements. The average of these four elements is used to represent the predicted value of the bit during the decoding process;

[0015] The decoding algorithm is the inverse process of the byte data bit-level encoding algorithm, taking the average of four adjacent elements in the encoding matrix and comparing it with a predetermined threshold to determine the predicted bit value;

[0016] Traffic feature extraction

[0017] First, the normalization function used is shown in formula (1):

[0018]

[0019] Among them, x min represents the minimum value of the same feature, x max Represents the maximum value of the same feature. Parameters a and b represent the lower and upper limits of the interval [a, b] to which the original value is scaled. Variable x i represents the i-th value of the same feature, x i ′ Represents the normalized new eigenvalue, satisfying x i ∈[a,b];

[0020] Secondly, the CICFlowMeter tool is used to extract traffic features. CICFlowMeter extracts a large number of features. Fisher Score is used to rank the importance of the 80 features extracted by CICFlowMeter, and the top-ranked features are selected as the input features of the classification model. Fisher Score is used to minimize the feature differences between similar categories and maximize the differences between different categories. Fisher Score scores each feature by calculating the ratio of the inter-class variance and the intra-class variance of the feature. The inter-class variance reflects the differences between different categories, and the intra-class variance reflects the differences within the same category. If a feature has a large inter-class variance and a small intra-class variance, then the Fisher Score of the feature is high (which means it is a good feature). The calculation method of Fisher Score is shown in formula (2):

[0021]

[0022] The above formula calculates the Fisher score of the ith feature; where K represents the number of IoT botnet traffic classifications in this paper; p j Represents the ratio of the total number of data in the jth class to the total number of data in all classes; Represents the numerical average of the i-th feature of the j-th category; Represents the standard deviation of the value of the i-th feature of the j-th category;

[0023] The calculated Fisher fraction F s The larger the value is, the stronger the ability of the i-th feature to distinguish different categories is. After calculating the Fisher scores of benign traffic and various attack traffic respectively, the top 20 features with the highest Fisher scores in each category are selected.

[0024] Furthermore, the anti-detection honeypot design process is as follows:

[0025] The design of the anti-detection honeypot is based on the Generative Adversarial Network (GAN). GAN can generate synthetic network traffic and attack models that are very similar to the behavior of real attackers, which is used to enhance the authenticity of the honeypot. By integrating the simulated attack traffic with the actual attack traffic, the honeypot becomes more attractive to attract more attackers and accumulate a large amount of information.

[0026] The design of the anti-detection honeypot includes a generator and a discriminator that mainly use the structure of a convolutional neural network, which encodes the response payload in byte format and converts it into a coding matrix (image); for ease of processing, the response payload needs to be encoded in byte format before being converted into an image, so a byte data bit-level encoding method is designed based on space utilization and information recovery degree;

[0027] The generator receives a single channel with an input dimension of 64 random noise vectors and generates a fake sample with only one channel: a 32×32 grayscale image; the discriminator receives the actual sample and the sample generated by the generator at the same time, and then outputs a probability value between 0 and 1, indicating the possibility that the input is a real sample; the generator and the discriminator continue to iterate and compete, gradually enhancing their respective capabilities; eventually, the two networks reach a dynamic balance, and the samples generated by the generator appear to the discriminator to be no different from real samples.

[0028] Furthermore, the generator is designed as follows: the generator takes a single-channel 64-dimensional random noise vector as input and generates a pseudo-sampling in the form of a 32×32-dimensional single-channel grayscale image. The generator adopts a seven-layer network structure and is designed as follows:

[0029] Input layer: The initial layer of the fully connected network consists of 64 neurons, accepting random noise with input dimension (64, 1);

[0030] Hidden layer: The second layer of the fully connected network consists of 1024 neurons. The function of the second layer is to perform nonlinear transformation on the input random noise (64, 1) and pass the transformed information to the subsequent output layer;

[0031] Output layer: As the last layer of the fully connected network, this layer consists of 16,384 neurons; it is responsible for generating information obtained by transforming the input random noise in the fully connected layer, and the output dimension is (16384, 1);

[0032] Reshaping layer: The 16384-dimensional vector from the fully connected layer is converted into a feature map with 256 channels and a dimension of (8, 8). After the conversion, the next layer uses the convolution algorithm to extract features;

[0033] First layer of deconvolution: The convolution kernel used in this step has 64 channels and a dimension of 2×2. Its stride in both horizontal and vertical directions is 2; this layer extracts features from the feature map and reduces the number of channels in the output feature map to 64, which increases the size of the feature map to 16×16;

[0034] Second layer of deconvolution: Similar to the first layer, the convolution kernel used in this step has 32 channels, 2×2 dimensions, and a bidirectional stride of 2. After this layer, the output feature map has 32 channels and the dimension increases to 32×32.

[0035] Convolutional layer: The last layer of the generator uses a convolution kernel with only one channel and a size of 1×1; the stride is horizontal and vertical. This layer is used to convert the output of the previous layers into a matrix with the target dimension, thereby converting it into a grayscale image that matches the dimension of the training data.

[0036] Furthermore, the discriminator is designed as follows: The structure of the discriminator is mainly composed of a fully connected network, the input of which is a single-channel grayscale image with a size of 32×32; the output is a value in the range of (0, 1), where 0 indicates that the input image is a fake sample and 1 indicates that the input image is a real sample. The specific structure of the discriminator is as follows:

[0037] Reshape layer: In order to input a grayscale image with only one channel and size of 32×32 into the fully connected network, this layer expands the input grayscale image into a tensor with 1024 channels;

[0038] Input layer: This layer consists of 1024 neurons, takes a tensor of dimension (1024, 1) as input, performs a linear transformation on the input data, and then passes it to the hidden layer;

[0039] Hidden layer: This layer has 512 neurons, which introduces nonlinear transformation and enhances the network's ability to classify complex and nonlinear data;

[0040] Output layer: The connection layer of the output layer consists of 256 neurons. It performs binary classification based on the discriminator, so the output layer produces a single channel. The Sigmoid function maps the output value to the range of (0, 1). The final output of this layer represents the confidence of the discriminator in the authenticity of the input sample.

[0041] Furthermore, the life cycle detection is specifically implemented as follows:

[0042] Lifecycle detection includes a multi-classification detection layer and a fusion layer for merging detection results. The important features extracted from the currently detected traffic data are the input of the multi-classification detection layer; the output value range of each category detection model is [0,1], and the input features of the current traffic determine the confidence of the category; the detection result fusion layer receives the confidence output by each classification model in the multi-classification detection layer; after merging the results of each classifier, the final classification result is determined and output.

[0043] The multi-classification detection layer uses LSTM as the classification model. LSTM is suitable for sequence-based prediction and can discover the potential relationship between adjacent features in the feature sequence. The network structures of classification models 0, 1, 2, and 3 in the life cycle detection module are exactly the same; the network structures all use Figure 4 The structure of the four models is different. The 20 input features of the four models are different. X represents the input feature sequence with feature dimension N, and Y represents the output prediction result, which ranges from [0, 1];

[0044] The classification model consists of two main parts: the first part is the LSTM layer, which treats the input feature vector of dimension N as a sequence of length N and produces an output vector of dimension 10; the second part is the fully connected layer. The input layer receives a vector of dimension 10 from the LSTM layer and outputs a vector of dimension 40 to the subsequent layer; the output layer produces a prediction value of dimension 1, which is scaled to the interval [0, 1] using the sigmoid function;

[0045] The detection result fusion layer uses a fusion device based on a fully connected neural network. Initially, the outputs of all classification models in the multi-classification detection layer are used as the inputs of the fully connected neural network of the fusion device. Subsequently, the output of the fully connected neural network output layer is converted into the final classification result using the argmax function.

[0046] The specific network structure of the fuzzifier based on fully connected neural network includes four fully connected layers, one fully connected layer for the input layer and the output layer, and two fully connected layers for the hidden layer; the input layer receives a feature vector with a dimension of 4, the output layer generates a feature vector with a dimension of 4, and LeakyReLU is used as the activation function between adjacent fully connected layers.

[0047] A life cycle detection system for an Internet of Things botnet based on an anti-detection honeypot, the system having program modules corresponding to the steps of the above technical solution, and executing the steps in the life cycle detection method for an Internet of Things botnet based on an anti-detection honeypot during operation.

[0048] A computer-readable storage medium stores a computer program, wherein the computer program is configured to implement the steps of the method for detecting the life cycle of an Internet of Things botnet based on an anti-detection honeypot when called by a processor.

[0049] The present invention has the following beneficial technical effects:

[0050] The present invention designs a honeypot with anti-detection function based on Generative Adversarial Network (GAN). After training, the honeypot can generate realistic response data according to different request data to enhance its deception ability. The present invention designs an IoT botnet life cycle detection method based on Fusion Long Short-Term Memory (Fusion-LSTM). After training Fusion-LSTM, the life cycle of the IoT botnet traffic captured by the anti-detection honeypot can be accurately identified. The method of the present invention can avoid the attacker's virtual detection technology to achieve higher deception of the IoT botnet traffic, and can accurately identify the life cycle of the traffic, so as to make protective responses as soon as possible.

[0051] In terms of IoT botnet trapping, honeypots are designed using dynamic response and automatic generation to improve their anti-detection capabilities. In terms of IoT botnet detection, in order to fill the gap in research on IoT botnet lifecycle detection, the life cycle of IoT botnet activities is divided, and a method for IoT botnet lifecycle detection is designed to achieve early detection and early protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 The schematic diagram of the principle of the IoT botnet life cycle detection method based on anti-detection honeypot;

[0053] Figure 2 It is a bar chart of important features (Top20) of various types of traffic;

[0054] Figure 3 This is the GAN structure diagram of the anti-detection honeypot;

[0055] Figure 4 It is the network structure diagram of the classification model;

[0056] Figure 5 It is the network structure diagram of the fusion layer;

[0057] Figure 6 To generate a grayscale map of traffic;

[0058] Figure 7 It is the real traffic grayscale image;

[0059] Figure 8 This is a comparison chart of the interaction capabilities of the anti-detection honeypot and other honeypots;

[0060] Fig. 9 It is the attack belief change curve of each honeypot;

[0061] Fig.10 This is a comparison chart of the confusion matrix. DETAILED DESCRIPTION

[0062] The following is combined with Figures 1 to 10 The implementation of the IoT botnet lifecycle detection method based on anti-detection honeypot described in the present invention is described as follows:

[0063] 1Technical concept

[0064] This paper proposes a method for detecting the life cycle of IoT botnets based on anti-detection honeypots. Figure 1 As shown in the figure, the method first designs a honeypot with anti-detection function based on the Generative Adversarial Network (GAN). After training, the honeypot can generate realistic response data according to different request data, thereby improving its deception ability. In addition, the IoT botnet life cycle detection method is designed based on the Fusion Long Short-Term Memory (Fusion-LSTM) network. After training the Fusion-LSTM, the life cycle of the IoT botnet traffic captured by the anti-detection honeypot can be accurately identified. This method can avoid the attacker's virtual detection technology to achieve higher deception of the IoT botnet traffic, and at the same time can accurately identify the life cycle of the traffic, so as to make protective responses as early as possible.

[0065] The general life cycle of an IoT botnet is as follows:

[0066] (1) The malicious program on the infected device discovers other devices by exhaustively enumerating IP addresses, and scans whether the target service port is open by sending detection packets. When the target service is detected, it usually attempts to log in to the target service of the device by enumerating usernames and passwords.

[0067] (2) If the service on the device has been successfully logged in in the first step, the malicious program on the infected device will upload the device information such as the device IP, username and password, and hardware information to the Report server.

[0068] (3) The Report server collects the device information collected by the malicious program on the infected device and distributes it to the Loader.

[0069] (4) Loader logs into the device based on the information provided by the Report server, downloads and executes the malware.

[0070] Usually, the execution of malware will add newly infected devices to the IoT botnet, and the newly infected devices will become nodes of the IoT botnet, gradually expanding the size of the botnet.

[0071] (5) The attacker transmits the attack command to the C&C server and launches a DDos attack on the target device.

[0072] (6) After receiving the attacker’s command, the C&C server further transmits the command to the malicious program on the infected device controlled by the C&C server at the next level.

[0073] (7) The malware on the infected device maintains a connection with the C&C server, decodes the received attack commands, and then launches a DDos attack on the target device.

[0074] From the perspective of IoT devices, the present invention uses the following classification rules: (1) whether the device has been infected; (2) whether the device is launching an attack or being attacked; the IoT botnet life cycle is divided into three stages (scanning stage, communication stage, and attack stage). The scanning stage includes the 1st and 4th processes in Figure 2, and the communication stage refers to the process of maintaining connection with the C&C server and transmitting the infectable device information.

[0075] 2 Technical Solution

[0076] In order to facilitate the description of the problem, this section specifically introduces the IoT botnet lifecycle detection method based on anti-detection honeypot, including the construction of the overall system model and the construction of each module, mainly including: traffic data preprocessing and feature extraction, anti-detection honeypot module design and lifecycle detection module design.

[0077] 2.1 System Model

[0078] System model such as Figure 1 As shown in the figure, we trap IoT botnets by implementing a GAN-based anti-detection honeypot and detect the IoT botnet lifecycle based on Fusion-LSTM, thereby protecting IoT devices from botnet infection. The system is located at the network edge of the IoT environment and consists of three core components: data processing module, anti-detection honeypot module, and lifecycle detection module.

[0079] Data Processing Module: This module is responsible for many key functions, including interactive traffic processing, traffic feature extraction, and data storage. Interactive traffic processing converts traffic data into input and output formats suitable for model generation. Traffic data is stored in the form of pcap files for use in the lifecycle detection process. The traffic feature extraction process extracts flow-level features from pcap data for analysis and detection by the lifecycle detection module. Data storage is used to maintain interactive traffic data and classification results.

[0080] Anti-detection honeypot module: The purpose of this module is to use the GAN model to generate real response data based on the received request data. The generator and discriminator are trained using the dataset. After the request data is input into the generator, the converged generative model generates false data and generates the corresponding response data.

[0081] Lifecycle Detection Module: The function of this module is to detect traffic corresponding to a specific stage of the IoT botnet lifecycle. Detection models for each stage of the benign and botnet lifecycle are trained using the dataset. These trained models are then used to evaluate input traffic features. The predictions of each model are fused to arrive at the final classification for that traffic.

[0082] 2.2 Data Processing Module

[0083] The data processing module has several important functions: processing interactive traffic data for the anti-detection honeypot module, extracting traffic features for the lifecycle detection module, and storing traffic data and detection results. This section will specifically discuss the key technologies for implementing interactive traffic processing and traffic feature extraction.

[0084] 2.2.1 Interactive Traffic Processing

[0085] The GAN used in the anti-detection honeypot mainly adopts a convolutional neural network structure. For ease of processing, the response payload needs to be encoded in byte format before being converted into an image. In order to enable GAN to better learn the data distribution of the same type of request-response payload and take into account the training efficiency of the model, the encoding method designed in this paper will consider the following two aspects. 1) Space utilization: Improving space utilization is conducive to reducing the size of the encoding matrix (image), thereby reducing computing resources such as memory space and improving the training efficiency of the generative adversarial network; 2) The degree of information recovery, restore the data distribution of the encoding elements as much as possible, so that the generator can accurately learn the data distribution on the original data, and minimize the generator bias caused by the decoding data error when decoding the generated samples.

[0086] To this end, a byte data bit-level encoding algorithm is proposed, see Algorithm 1 for details.

[0087]

[0088]

[0089] The input of the algorithm is the number of bytes that can be encoded per row of the encoding matrix (r N ) and an array of bytes to be encoded (data). The core concept of the algorithm is to map each bit of each byte to four specified elements in the encoding matrix in a specific order. The algorithm uses bits as the basic unit to fill the matrix. It scales the bit values ​​by 255 times before incorporating them into the matrix. This scaling enhances the distinction between elements filled with different bit values ​​and allows the generator to learn the data distribution at the bit level more effectively and improves the visibility of the boundaries between sample values. In addition, the biased predictions generated by the neural network tend to be in the neighborhood of the true values. In this neighborhood, only true values ​​exist, which improves the prediction accuracy. Each bit filled into the matrix occupies the positions of four adjacent elements, not just one. During the decoding process, the average of these four elements is used to represent the predicted value of the bit. This can minimize the prediction error caused by the generator bias, thereby improving the accuracy of the prediction.

[0090] The decoding algorithm is the inverse process of Algorithm 1. It works by taking the average of four adjacent elements in the encoding matrix and comparing it with a predetermined threshold to determine the predicted bit value.

[0091] The time complexity of the byte data bit-level encoding algorithm is O(n 2 ), with a space complexity of O(n). This approach has the following advantages. Information richness: Each element in the resulting matrix contains detailed information about the encoded data at the bit level, ensuring high information richness. High information relevance: By presenting information at the bit level, the neural relevance of the encoded elements is better preserved. This enhances the usefulness and interpretability of the encoded data.

[0092] In summary, this approach not only effectively encodes data at a fine-grained level, but also preserves rich information and correlations, and is an important technique that can be used in generative models such as GANs.

[0093] 2.2.2 Traffic feature extraction

[0094] The data processed by the lifecycle detection module operates on the process level. During the data preprocessing of the classification model, normalization and feature extraction play a key role.

[0095] Normalization is the process of rescaling data to the range [0,1] through a linear transformation. This transformation ensures that the newly scaled data maintains the same order as the original data. Normalization is very important because some activation functions, such as Sigmoid and Tanh functions, tend to produce output values ​​close to a constant (0 or 1) when the input values ​​are large. This leads to the vanishing gradient problem. Normalization can effectively alleviate this problem by limiting the input data to the effective gradient range of these activation functions. In addition, normalization can also speed up the convergence of the model during training. The normalization function used in this study is shown in formula (1):

[0096]

[0097] Among them, x min represents the minimum value of the same feature, x max Represents the maximum value of the same feature. Parameters a and b represent the lower and upper limits of the interval [a, b] to which the original value is scaled. Variable x i represents the i-th value of the same feature, x i ′ Represents the normalized new eigenvalue, satisfying x i ∈[a,b].

[0098] In terms of traffic feature extraction, this paper uses the CICFlowMeter tool. CICFlowMeter extracts a large number of features (80). The high dimensionality of these features may lead to overfitting and slow down the model convergence during training. In addition, too many dimensional features will increase the demand for computing resources and prolong the model detection time. In order to optimize the feature set for model detection and alleviate these problems, we use Fisher Score to rank the importance of the 80 features extracted by CICFlowMeter (see 80 features and description table) and select the top-ranked features as the input features of the classification model. Fisher Score is used to minimize the feature differences between similar categories and maximize the differences between different categories. Fisher Score scores each feature by calculating the ratio of the inter-class variance and intra-class variance of the feature. The inter-class variance reflects the differences between different categories, and the intra-class variance reflects the differences within the same category. If a feature has a large inter-class variance and a small intra-class variance, then the Fisher Score of this feature is high, "which means it is a good feature." The calculation method of Fisher Score is shown in formula (2):

[0099]

[0100] The above formula calculates the Fisher score of the i-th feature. Where K represents the number of IoT botnet traffic classifications in this paper. j Represents the ratio of the total number of data in the jth class to the total number of data in all classes. Represents the numerical average of the i-th feature of the j-th category. Represents the standard deviation of the values ​​of the i-th feature of the j-th category.

[0101] The calculated Fisher fraction F s The larger the value, the stronger the ability of the i-th feature to distinguish different categories. After calculating the Fisher scores of benign traffic and various attack traffic, the top 20 features with the highest Fisher scores in each category are selected, such as Figure 2 shown. Figure 2 The corresponding top 20 features of the four categories are given in . The 80 features and description tables are as follows:

[0102] Continued from the table

[0103]

[0104] 2.3 Anti-Detection Honeypot

[0105] The basic design of the anti-detection honeypot is derived from the concept of generative adversarial networks (GANs). GANs are able to generate synthetic network traffic and attack models that are very similar to the behavior of real attackers, thereby enhancing the authenticity of the honeypot. By blending simulated attack traffic with actual attack traffic, the honeypot becomes more attractive, thereby attracting more attackers and accumulating a large amount of information. These synthetic data help security experts gain a deeper understanding of attackers' strategies and techniques, so as to more effectively respond to potential threats.

[0106] like Figure 3 As shown, the generator and discriminator mainly use the structure of convolutional neural network, so it is necessary to encode the response payload in byte format and convert it into a coding matrix (image).

[0107] In this paper, the generator receives an input with a single channel of 64 random noise vectors and generates a fake sample with only one channel - a 32×32 grayscale image. The discriminator receives both the actual sample and the sample generated by the generator, and then outputs a probability value between 0 and 1, indicating the possibility that the input is a real sample. The generator and the discriminator continue to iterate and compete, gradually enhancing their respective capabilities. Eventually, the two networks reach a dynamic balance, and the samples generated by the generator appear to the discriminator to be the same as real samples.

[0108] (1) Generator design: The generator takes a single-channel 64-dimensional random noise vector as input and generates a pseudo-sample in the form of a 32×32-dimensional single-channel grayscale image. The generator adopts a seven-layer network structure and is designed as follows:

[0109] Input layer: The initial layer of the fully connected network consists of 64 neurons and accepts random noise with input dimension (64, 1).

[0110] Hidden layer: The second layer of the fully connected network consists of 1024 neurons. Its function is to perform nonlinear transformation on the input random noise (64, 1) and pass the transformed information to the subsequent output layer.

[0111] Output layer: As the last layer of the fully connected network, this layer consists of 16,384 neurons. It is responsible for generating information obtained by transforming the input random noise within the fully connected layer, and the output dimension is (16384, 1).

[0112] Reshape layer: The 16384-dimensional vector from the fully connected layer is converted into a feature map with 256 channels and dimension (8, 8). After this conversion, the next layer uses the convolution algorithm for feature extraction.

[0113] First deconvolution layer: The convolution kernel used in this step has 64 channels and dimension 2×2. It has a stride of 2 in both horizontal and vertical directions. The role of this layer is to extract features from the feature map while reducing the number of channels in the output feature map to 64. This results in the size of the feature map increasing to 16×16.

[0114] Second layer of deconvolution: Similar to the first layer, the convolution kernel used in this step has 32 channels, 2×2 dimensions, and a bidirectional stride of 2. After this layer, the output feature map has 32 channels and the dimension increases to 32×32.

[0115] Convolutional layer: The last layer of the generator uses a convolution kernel with only one channel and size 1×1. The stride is horizontal and vertical. This layer is designed to convert the output of the previous layers into a matrix with target dimensions, thereby converting it into a grayscale image that matches the dimensions of the training data.

[0116] (2) Discriminator design: The structure of the discriminator is mainly composed of a fully connected network. The input of the network is a single-channel grayscale image of size 32×32. The output is a value in the range of (0, 1), where 0 indicates that the input image is a fake sample and 1 indicates that the input image is a real sample. The specific structure of the discriminator is as follows:

[0117] Reshape layer: In order to input a grayscale image with only one channel and size 32×32 into the fully connected network, this layer expands the input grayscale image into a tensor with 1024 channels.

[0118] Input layer: This layer consists of 1024 neurons and takes a tensor of dimension (1024, 1) as input and performs a linear transformation on the input data before passing it to the hidden layer.

[0119] Hidden layer: This layer has 512 neurons and introduces nonlinear transformation, which enhances the network's ability to classify complex and nonlinear data.

[0120] Output layer: The connected layer of the output layer consists of 256 neurons. Given that the discriminator in this study performs binary classification, the output layer produces a single channel. The Sigmoid function maps the output value to the range of (0, 1). The final output of this layer represents the confidence of the discriminator in the authenticity of the input sample.

[0121] 2.4 Lifecycle Detection Module

[0122] The lifecycle detection module includes a multi-classification detection layer and a fusion layer for merging detection results. The important features extracted from the currently detected traffic data are the input of the multi-classification detection layer. The output value range of each category detection model is [0,1], and the input features of the current traffic determine the confidence of the category. The detection result fusion layer receives the confidence output by each classification model in the multi-classification detection layer. After merging the results of each classifier, the final classification result is determined and output.

[0123] The multi-classification detection layer uses LSTM as the classification model. LSTM is particularly suitable for sequence-based prediction and can discover the potential relationship between adjacent features in the feature sequence. The network structures of classification models 0, 1, 2, and 3 in the life cycle detection module are exactly the same, such as Figure 4 As shown. Figure 4 In it, X represents the input feature sequence with feature dimension N, and Y represents the output prediction result, which ranges from [0, 1].

[0124] The classification model consists of two main parts. The first part is the LSTM layer, which treats the input feature vector of dimension N as a sequence of length N and produces an output vector of dimension 10. The second part is the fully connected layer. The input layer receives a vector of dimension 10 from the LSTM layer and outputs a vector of dimension 40 to the subsequent layers. The output layer produces a prediction value of dimension 1, which is scaled to the interval [0, 1] using the sigmoid function.

[0125] The detection result fusion layer uses a fusion device based on a fully connected neural network. Initially, the output of all classification models in the multi-classification detection layer is used as the input of the fully connected neural network of the fusion device. Subsequently, the output of the fully connected neural network output layer is converted into the final classification result using the argmax function.

[0126] The fusion device based on fully connected neural network does not completely rely on the output of a single classifier, but integrates the output of multiple classifiers. It updates the connection weights of neurons between adjacent layers in the fully connected neural network through multiple iterations to ensure that the weights of the classification results of multiple classifiers have a more reasonable impact on the final result. The specific network structure of the fuzzifier based on fully connected neural network in this paper is as follows: Figure 5 As shown in the figure, it consists of four fully connected layers in total, one fully connected layer in the input layer and one fully connected layer in the output layer, and two fully connected layers in the hidden layer. The input layer receives a feature vector of dimension 4, and the output layer produces a feature vector of dimension 4. LeakyReLU is used as the activation function between adjacent fully connected layers.

[0127] 3. Effects of the Invention

[0128] 3.1 Test experiment parameter selection

[0129] 3.1.1 Dataset

[0130] To train the anti-detection honeypot and lifecycle detection models, we built a training dataset combining the MedBIoT and Aposemat IoT-23 datasets. This new dataset is designed to ensure balanced representation of data from different sources.

[0131] MedBIoT dataset: This dataset contains data from three different botnets and captures network traffic from four different device types. It is a medium-sized dataset.

[0132] Aposemat IoT-23 dataset: The Aposemat IoT-23 dataset contains data from ten botnet types and captures network traffic from four different device types. It is a small dataset.

[0133] By merging these datasets, we aim to create a new, balanced dataset that retains pcap data from ten botnet types and seven different device types. This new dataset is called the “Mini-Dataset” and is shown in Table 1. It is this mini-dataset that is used to train the generative response model and the lifecycle detection model. The process of combining these datasets helps ensure that the resulting training dataset is representative of a wide range of botnet and device characteristics.

[0134] Table 1 Experimental dataset

[0135]

[0136] 3.1.2 Experimental environment setup

[0137] For the selection of specific parameters of the test experiment, please refer to Table 2. Among them, the Windows system is the main experimental environment, and Ubuntu is used to create a virtual environment and test traffic functions. We used the VMWare platform to establish a virtual environment, and three virtual machines (VMs) were connected to each other in the same subnet segment and communicated seamlessly through bridge mode. In this research setting, each virtual machine has a specific purpose:

[0138] Table 2 Experimental environment

[0139]

[0140] VM1 (Simulated IoT Botnet): In VM1, we deployed a simulated IoT botnet. This virtual machine simulates the behaviors associated with an IoT botnet and replicates all stages of the botnet lifecycle, including scanning, propagation, and attack stages;

[0141] VM2 runs a comparison service, possibly encapsulated in a container. The service communicates with other VMs using the host's network mode, using the host's IP address and port. VM2 serves as a reference point for the comparison analysis and is an interactive component of the experiment;

[0142] VM3 (Netty Server): VM is equipped with Netty server running RGPot. Netty server is responsible for exposing the services provided by RGPot through specific ports.

[0143] VM1 simulates the activities of an IoT botnet, VM2 provides a baseline for comparison, and VM3 hosts RGPot in a honeypot system designed to detect various stages of an IoT botnet lifecycle. The coordinated interaction between these virtual machines is critical to evaluating the effectiveness of RGPot in a controlled environment.

[0144] 3.2 Test results and analysis

[0145] Experiment 1: Response test of various IoT communication protocols: We carefully deployed the innovative RGPot and open source IoT botnet in the network environment. This arrangement allows the interaction between the simulated botnet and RGPot. During the experiment, we deliberately simulated the commonly used protocols in IoT communication, including MQTT, CoAP, HTTP, SSH, and Telnet.

[0146] Experiment 1 results: Figure 6 and Figure 7Grayscale images are used to describe the real and generated samples corresponding to each interaction stage. Each image represents a sample at a different stage, including (a) consultation stage, (b) login verification stage, (c) malware loading stage, (d) malware execution stage, (e) heartbeat maintenance stage, and (f) message reporting stage.

[0147] In addition, we also conducted 100 detailed tests on the grayscale image data at each interaction stage. Table 3 shows the training status of the generator at different interaction stages, where the correctness of the generated samples refers to the proportion of the generated response body (byte data) that is consistent with the true response body format after the generated samples (grayscale images) are decoded and converted. The reason why such a high accuracy rate can be achieved is that in these stages, the response corresponding to each type of request is unique.

[0148] Table 3 Accuracy of sample generation

[0149]

[0150] Experiment 1 Analysis: Through experiments, we demonstrated that the anti-detection honeypot consistently maintained an accuracy rate of over 93% when generating response data in response to various IoT communication protocol request data. Such impressive results are due to the use of a generative adversarial network model in the design. The trained generator performs well in generating deceptive responses to different request data, thus achieving the observed high accuracy.

[0151] Experiment 2 Interaction capability test: In order to compare the interaction capability, this experiment uses the number of interactions as an evaluation indicator to test the anti-detection honeypot in this article and multiple open source honeypots Cowrie, Hfish, Honeything and Conpot. In this experiment, Mirai was deployed as an attacker of the botnet, and each honeypot was tested for 100 rounds. The number of interactions between the honeypot and the IoT botnet is used as an evaluation indicator for honeypot simulation. The IoT botnet sends a request (application layer level) and receives a response. If the response conforms to the set format, it is recorded as a successful interaction. If not, the connection is released. The time from the connection request to the IoT botnet releasing the connection is called a round of testing. The number of successful interactions in a round of testing is used to measure the degree of interaction of the honeypot.

[0152] Experiment 2 results: After 100 rounds of interaction tests, the results of the number of interactions between several honeypots are as follows: Figure 8As shown in the figure, it is obvious that RGPot has more interactions than Cowrie, Honeything and Conpot in each stage. According to statistics, RGPot has an average of 16 interactions per round, and a maximum of 42. On the other hand, Hfish's performance is relatively more stable, with an average of 22 interactions, but a maximum of only 24.

[0153] Analysis of Experiment 2: From the comparative experiment between the anti-detection honeypot and the open source honeypots Cowrie, Hfish, Honeything and Conpot, it can be seen that the anti-detection honeypot performs better in terms of interaction ability, surpassing Cowrie, Honeything and Conpot, but is slightly worse than Hfish in terms of stability and average value.

[0154] Experiment 3 Anti-detection capability test: In order to verify the anti-detection capability of the anti-detection honeypot against the attacker (that is, the probability that the attacker believes that the interacting object is a honeypot), this paper introduces the attacker's belief as an evaluation indicator. Focus on the impact of the honeypot's actions on the attacker's beliefs, and the impact of beliefs on whether the attacker continues to attack. In the attacker's decision-making process, the attacker who holds the initial belief P0 first calculates the expected benefits of the three actions Test, Attack, and Exit respectively, and then takes the action with the highest expected benefit. If the expected benefits of "Attack" and "Test" are both less than zero, the attacker will choose "Exit" to exit the game. Define P exit P exit =Max(P), where Under the initial belief p, the attacker's Max(E(Attack),E(Test))≥0, that is, P exit It is the maximum initial belief that makes the attacker's attack benefit or test benefit greater than or equal to 0. This paper adopts the fingerprint-based honeypot detection method to simulate the attacker's identification of the honeypot to affect the calculation of P1.

[0155] Experiment 3 results: The detection results of the anti-detection honeypot and the open source honeypots Cowrie, Hfish, Honeything, and Conpot are shown in Table 4. By identifying the corresponding fingerprint information, multiple open source honeypots are identified as honeypot instances. However, due to its generation model, the anti-detection honeypot is not detected as a honeypot instance in the existing fingerprint recognition method.

[0156] Table 4 Honeypot detection results

[0157]

[0158] After the experimental test, the simulated attacker used the honeypot detection technology based on fingerprint recognition to detect the five honeypots. The changes in their belief values ​​are as follows: Fig. 9 shown.

[0159] Experiment 3 analysis: It can be seen that compared with the other honeypots, the anti-detection honeypot has a more stable expected value. Therefore, it can be considered that it is more deceptive and confusing to attackers, and the anti-detection effect is significantly better.

[0160] Experiment 4: Testing the effectiveness of IoT botnet lifecycle detection: We deployed botnets and benign services using a simulation experiment platform and injected traffic data into a trained classification model. The classification task includes four categories: benign traffic, scanning phase traffic, propagation phase traffic, and attack phase traffic. In order to evaluate the performance of IoT botnet lifecycle protection, we used several key evaluation indicators, including Accuracy, Precision, Recall, and F1-score.

[0161] Experiment 4 results: Fig.10 The confusion matrix effectively illustrates the classification performance of the four classification models on the test set. It is worth noting that our method achieves the highest classification accuracy of over 98% when classifying traffic in the propagation phase. In contrast, the classification accuracy of the other three classification models is about 80%. It can be further understood from the confusion matrix that KNN and LSTM misclassify approximately 15.9% and 17.3% of the propagation phase traffic as benign traffic, respectively. In contrast, SVM misclassifies approximately 12.9% of the propagation phase traffic as attack traffic. In terms of benign traffic classification, our method shows higher accuracy, with only approximately 1.4% of benign traffic being misclassified as malicious traffic. This result is slightly higher than LSTM and SVM, and approximately 5% higher than KNN, which misclassifies more benign traffic (approximately 6.5%) as scanning phase traffic.

[0162] Table 5 clearly compares the classification performance of the four models, highlighting the advantages of our model compared to KNN, SVM, and LSTM. It is worth noting that our model has improved in accuracy and other classification metrics. Compared with KNN, it has a significant improvement of 7% in accuracy. In addition, compared with the LSTM classifier, our model has a substantial improvement of 4.5% in classification performance metrics such as accuracy.

[0163] Table 5 Comparison of classification effects of different classifiers

[0164]

[0165] In terms of classification efficiency, KNN has a test time of 53.24 seconds on the test set, which is significantly better than other classifiers in the table. This efficiency is attributed to the computational intensity of calculating the distance between the input sample and the training set during the classification process. In contrast, the classification efficiency (time consumption) of our model is 66 times that of KNN and about 16 times that of SVM. These efficiency improvements highlight the practical advantages of our model in real-time classification tasks.

[0166] Experiment 4 Analysis: Compared with traditional classification models such as KNN, SVM, and LSTM, our model stands out in multiple aspects. In particular, faster detection speed: Our model performs well in timely detection of threats, significantly outperforming KNN and SVM. Superior accuracy: Our model outperforms KNN, SVM, and LSTM in terms of classification accuracy. Reduced false positive rate: Our false positive rate is significantly reduced, which enhances the model's ability to accurately identify threats while minimizing false positives. These results highlight the effectiveness and efficiency of our model in detecting IoT botnet lifecycles.

Claims

1. A method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot, characterized in that: The method is based on a GAN anti-detection honeypot to trap an IoT botnet, and based on a Fusion-LSTM to detect the IoT botnet life cycle, so as to protect IoT devices from being infected by the botnet. The method includes: Data processing: used to process interactive traffic data, extract traffic features, and store traffic data and detection results. Interactive traffic processing converts traffic data into input and output formats suitable for model generation. Traffic data is stored in the form of pcap files for use in the life cycle detection process. The traffic feature extraction process can extract traffic-level features from pcap data for analysis and detection by the life cycle detection module. Data storage is used to maintain interactive traffic data and classification results. Anti-detection honeypot: Use the GAN model to generate real response data based on the received request data; the generator and discriminator are trained using the data set; after the request data is input into the generator, the converged generative model will generate false data and generate corresponding response data; Lifecycle Detection: Detects traffic corresponding to specific stages of the IoT botnet lifecycle. Detection models for each stage of the benign and botnet lifecycle are trained using the dataset. These trained models are then used to evaluate input traffic features. The predictions from each model are fused to arrive at the final classification for that traffic.

2. A method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 1, characterized in that: The implementation process of interactive traffic processing and traffic feature extraction is as follows: Interactive traffic processing: The response payload is encoded in byte format before being converted into an image. The byte format encoding uses a byte data bit-level encoding algorithm. The input of the algorithm is the number of bytes that can be encoded per row of the encoding matrix (r N ) and an array of bytes to be encoded (data); the algorithm maps each bit of each byte to four specified elements in the encoding matrix in a specific order; the algorithm uses bits as the basic unit for filling the matrix; the bit values ​​are amplified by 255 times before being included in the matrix, and each bit filled in the matrix occupies the position of four adjacent elements. The average of these four elements is used to represent the predicted value of the bit during the decoding process; The decoding algorithm is the inverse process of the byte data bit-level encoding algorithm, taking the average of four adjacent elements in the encoding matrix and comparing it with a predetermined threshold to determine the predicted bit value; Traffic feature extraction First, the normalization function used is shown in formula (1): Among them, x min represents the minimum value of the same feature, x max represents the maximum value of the same feature; parameters a and b represent the lower and upper limits of the interval [a, b] to which the original value is scaled; variable x i represents the i-th value of the same feature, x i ′ Represents the normalized new eigenvalue, satisfying x i ∈[a,b]; Secondly, the CICFlowMeter tool is used to extract traffic features. CICFlowMeter extracts a large number of features. The importance of the 80 features extracted by CICFlowMeter is ranked using Fisher Score, and the top ranked features are selected as the input features of the classification model. Fisher Score is used to minimize the feature differences between similar categories and maximize the differences between different categories. Fisher Score scores each feature by calculating the ratio of the feature's inter-class variance to the intra-class variance. The inter-class variance reflects the differences between different categories, and the intra-class variance reflects the differences within the same category. If a feature has a large inter-class variance and a small intra-class variance, then the Fisher Score of the feature is high (which means it is a good feature). The calculation method of Fisher Score is shown in formula (2): The above formula calculates the Fisher score of the ith feature; where K represents the number of IoT botnet traffic classifications in this paper; p j Represents the ratio of the total number of data in the jth class to the total number of data in all classes; Represents the numerical average of the i-th feature of the j-th category; Represents the standard deviation of the value of the i-th feature of the j-th category; The calculated Fisher fraction F s The larger the value is, the stronger the ability of the i-th feature to distinguish different categories is. After calculating the Fisher scores of benign traffic and various attack traffic respectively, the top 20 features with the highest Fisher scores in each category are selected.

3. A method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 1 or 2, characterized in that: The design process of anti-detection honeypot is as follows: The design of the anti-detection honeypot is based on the Generative Adversarial Network (GAN). GAN can generate synthetic network traffic and attack models that are very similar to the behavior of real attackers, which is used to enhance the authenticity of the honeypot. By blending simulated attack traffic with real attack traffic, the honeypot becomes more attractive to attract more attackers and accumulate a large amount of information; The design of the anti-detection honeypot includes a generator and a discriminator that mainly use the structure of a convolutional neural network, which encodes the response payload in byte format and converts it into a coding matrix (image); for ease of processing, the response payload needs to be encoded in byte format before being converted into an image, so a byte data bit-level encoding method is designed based on space utilization and information recovery degree; The generator receives a single channel of input dimension 64 random noise vector and generates a fake sample with only one channel: a 32×32 grayscale image; the discriminator receives both the real sample and the sample generated by the generator, and then outputs a probability value between 0 and 1, indicating the possibility that the input is a real sample; The generator and discriminator continue to iterate and compete, gradually enhancing their respective capabilities; eventually, the two networks reach a dynamic balance, and the samples generated by the generator appear to the discriminator to be no different from real samples.

4. A method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 3, characterized in that: The generator is designed as follows: the generator takes a single-channel 64-dimensional random noise vector as input and generates a pseudo-sampling in the form of a 32×32-dimensional single-channel grayscale image. The generator adopts a seven-layer network structure and is designed as follows: Input layer: The initial layer of the fully connected network consists of 64 neurons, accepting random noise with input dimension (64, 1); Hidden layer: The second layer of the fully connected network consists of 1024 neurons; the function of the second layer is to perform nonlinear transformation on the input random noise (64, 1) and pass the transformed information to the subsequent output layer; Output layer: As the last layer of the fully connected network, this layer consists of 16,384 neurons; it is responsible for generating information obtained by transforming the input random noise in the fully connected layer, and the output dimension is (16384, 1); Reshape layer: The 16384-dimensional vector from the fully connected layer is converted into a feature map with 256 channels and a dimension of (8, 8). After the conversion, the next layer uses the convolution algorithm to extract features; First layer of deconvolution: The convolution kernel used in this step has 64 channels and a dimension of 2×2; its stride in both horizontal and vertical directions is 2; the role of this layer is to extract features from the feature map and reduce the number of channels in the output feature map to 64, which increases the size of the feature map to 16×16; Second layer of deconvolution: Similar to the first layer, the convolution kernel used in this step has 32 channels, 2×2 dimensions, and a bidirectional stride of 2. After this layer, the output feature map has 32 channels and the dimension increases to 32×32. Convolutional layer: The last layer of the generator uses a convolution kernel with only one channel and a size of 1×1; the stride is horizontal and vertical. This layer is used to convert the output of the previous layers into a matrix with the target dimension, thereby converting it into a grayscale image that matches the dimension of the training data.

5. A method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 4, characterized in that: The discriminator is designed as follows: The structure of the discriminator mainly consists of a fully connected network, the input of which is a single-channel grayscale image of size 32×32; The output is a value in the range of (0, 1), where 0 indicates that the input image is a fake sample and 1 indicates that the input image is a real sample. The specific structure of the discriminator is as follows: Reshape layer: In order to input a grayscale image with only one channel and size of 32×32 into the fully connected network, this layer expands the input grayscale image into a tensor with 1024 channels; Input layer: This layer consists of 1024 neurons, takes a tensor of dimension (1024, 1) as input, performs a linear transformation on the input data, and then passes it to the hidden layer; Hidden layer: This layer has 512 neurons, which introduces nonlinear transformation and enhances the network's ability to classify complex and nonlinear data; Output layer: The connection layer of the output layer consists of 256 neurons. It performs binary classification based on the discriminator, so the output layer produces a single channel. The Sigmoid function maps the output value to the range of (0, 1). The final output of this layer represents the confidence of the discriminator in the authenticity of the input sample.

6. A method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 1 or 5, characterized in that: The specific implementation of life cycle detection is as follows: Lifecycle detection includes a multi-classification detection layer and a fusion layer for merging detection results. The important features extracted from the currently detected traffic data are the input of the multi-classification detection layer. The output value range of each category detection model is [0,1]. The input features of the current traffic determine the confidence of the category. The detection result fusion layer receives the confidence output by each classification model in the multi-classification detection layer. After combining the results of each classifier, the final classification result is determined and output; The multi-classification detection layer uses LSTM as the classification model. LSTM is suitable for sequence-based prediction and can discover the potential relationship between adjacent features in the feature sequence. The network structures of classification models 0, 1, 2, and 3 in the life cycle detection module are exactly the same; The classification model consists of two main parts: the first part is the LSTM layer, which treats the input feature vector of dimension N as a sequence of length N and produces an output vector of dimension 10; the second part is the fully connected layer; the input layer receives a vector of dimension 10 from the LSTM layer and outputs a vector of dimension 40 to the subsequent layer; the output layer produces a prediction value of dimension 1, which is scaled to the interval [0, 1] using the sigmoid function; The detection result fusion layer uses a fusion device based on a fully connected neural network. Initially, the outputs of all classification models in the multi-classification detection layer are used as the inputs of the fully connected neural network of the fusion device. Subsequently, the output of the fully connected neural network output layer is converted into the final classification result using the argmax function. The specific network structure of the fuzzifier based on fully connected neural network includes four fully connected layers, one fully connected layer for the input layer and the output layer, and two fully connected layers for the hidden layer; the input layer receives a feature vector with a dimension of 4, the output layer generates a feature vector with a dimension of 4, and LeakyReLU is used as the activation function between adjacent fully connected layers.

7. An IoT botnet lifecycle detection system based on anti-detection honeypot, characterized by: The system has a program module corresponding to the steps of any one of claims 1 to 6 above, and executes the steps in the IoT botnet lifecycle detection method based on anti-detection honeypot when running.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the IoT botnet lifecycle detection method based on anti-detection honeypot according to any one of claims 1 to 6 when called by a processor.

Images