A method and system for detecting the life cycle of an internet of things botnet based on a reverse detection honeypot

Abstract

The application relates to a method and system for detecting the life cycle of an Internet of Things (IoT) botnet based on a reverse detection honeypot, and belongs to the technical field of network security detection and defense. The application aims to accurately identify the life cycle of IoT botnet traffic captured by a reverse detection honeypot, and to avoid the virtual detection technology of attackers to achieve higher deception of IoT botnet traffic. First, a honeypot with a reverse detection function is designed based on a generative adversarial network, and after training, realistic response data is generated according to different request data, so that the deception ability of the honeypot is improved. An IoT botnet life cycle detection method is designed based on a fusion long short-term memory network. After training of the Fusion-LSTM, the life cycle of IoT botnet traffic captured by the reverse detection honeypot can be accurately identified. The method can avoid the virtual detection technology of attackers to achieve higher deception of IoT botnet traffic, and can accurately identify the life cycle of the traffic, so that protection and response can be made as early as possible.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection and defense, and in particular to a method and system for detecting the life cycle of an Internet of Things botnet based on an anti-detection honeypot. Background Art

[0002] As the Internet of Things (IoT) enters its intelligent phase, traditional industries such as home furnishings, urban transportation, healthcare, and manufacturing are becoming increasingly integrated with the IoT. This has led to the emergence of interdisciplinary fields such as smart homes, smart transportation, smart healthcare, and smart factories, driving people's production and lives towards greater convenience and intelligence. IoT devices, as a crucial component of the IoT, can typically sense and analyze real-world physical factors such as temperature and air pressure. They are interconnected, intelligent, and low-power. However, these characteristics pose certain security risks. Devices cannot utilize high-strength encryption algorithms during information storage and exchange. The interconnection of IoT devices with different security characteristics within a system can lead to system security weaknesses. Compromised IoT devices can serve as springboards for attackers to attack other IoT devices within the system. The vulnerabilities of IoT devices have led to numerous attacks targeting them. Among these, IoT botnets pose the greatest threat to IoT network environments. Research on IoT botnet detection has been a hot topic, yet the security threat posed by IoT botnets remains high in reality. The main reasons are: 1. Current detection of IoT botnets focuses primarily on the post-infection phase of a device, lacking comprehensive coverage of the entire IoT lifecycle. This can lead to insufficient awareness of the threat landscape against IoT botnets in real-world network environments, creating opportunities for infection and intrusion. 2. Currently, honeypots are deployed to analyze the characteristics of IoT botnets. However, attackers can exploit virtual environment detection techniques to identify and bypass honeypots, making it difficult to capture data on IoT botnet activity.

[0003] The Internet of Things (IoT) has permeated every aspect of our lives, playing an increasingly important role. However, due to computing resource constraints, some IoT devices cannot utilize security solutions, making them extremely vulnerable to attacks. IoT botnets, such as Mirai, exploit these vulnerabilities to infect, control, and attack IoT devices, posing a serious security threat to the IoT and even the entire internet.

[0004] Currently, although IoT botnet detection is a hot research topic, the security threat posed by IoT botnets remains high.

[0005] Therefore, it is imperative to conduct detailed research on IoT botnet trapping and detection methods, and it is urgent to design and implement methods for lifecycle detection and anti-detection honeypots for IoT botnets.

[0006] The prior art document CN110505191A provides a method and apparatus for detecting IoT botnet nodes, comprising: obtaining scanning and detection information from a detection device recorded by a honeypot device; the detection device sending a signal to the honeypot device, identifying the scanning and detection information, and obtaining device information of the detection device; and determining that the detection device is an IoT device if the device information indicates that the detection device is an IoT device. This method utilizes the characteristic that IoT devices do not actively scan and detect other IoT devices. Based on the fact that the detection device actively scans and detects other IoT devices and that the detection device is an IoT device, IoT botnet nodes can be accurately detected. This method can detect botnet nodes from IoT devices with known security vulnerabilities, those without security vulnerabilities, and those with unknown security vulnerabilities, thereby improving the detection rate of IoT botnet nodes. The prior art document CN112788065A proposes a honeypot- and sandbox-based method and device for tracking IoT botnets. The IoT honeypot captures vulnerability scanning attacks launched by IoT botnets, simultaneously capturing corresponding malicious samples and sending them to the IoT sandbox. The IoT sandbox receives the malicious samples captured by the IoT honeypot, dynamically runs them, and monitors their network behavior to generate malicious traffic data. The sandbox then uses a pre-built IoT malicious traffic classification model to classify the malicious traffic data generated by the malicious samples. Based on the malicious traffic data classification results, the discovered P2P botnet is scanned to monitor and obtain attribute information and network behavior data of the P2P botnet. None of the aforementioned prior art methods can implement lifecycle detection and honeypot anti-detection methods for IoT botnets. Summary of the Invention

[0007] The technical problems to be solved by the present invention are:

[0008] The purpose of the present invention is to provide an IoT botnet lifecycle detection method and system based on an anti-detection honeypot, so as to accurately identify the lifecycle of IoT botnet traffic captured by the anti-detection honeypot, avoid the attacker's virtual detection technology to achieve higher deception of IoT botnet traffic, and at the same time accurately identify the lifecycle of the traffic, so as to take protective measures as early as possible.

[0009] The present invention solves the above-mentioned technical problems by adopting a technical solution: a method for detecting the lifecycle of an IoT botnet based on an anti-detection honeypot. The method uses a GAN-based anti-detection honeypot to trap IoT botnets and uses Fusion-LSTM to detect the lifecycle of IoT botnets, thereby protecting IoT devices from botnet infection. The method comprises:

[0010] Data processing: used to process interactive traffic data, extract traffic features, and store traffic data and detection results. Interactive traffic processing converts traffic data into input and output formats suitable for model generation. Traffic data is stored in the form of pcap files for use in the lifecycle detection process. The traffic feature extraction process can extract traffic-level features from pcap data for analysis and detection by the lifecycle detection module. Data storage is used to maintain interactive traffic data and classification results.

[0011] Anti-detection honeypot: Uses a GAN model to generate real response data based on received request data; the generator and discriminator are trained using a dataset; after the request data is input into the generator, the converged generative model generates fake data and the corresponding response data;

[0012] Lifecycle Detection: Detects traffic corresponding to specific stages of the IoT botnet lifecycle. Detection models for each stage of the benign and botnet lifecycles are trained using the dataset. These trained models are then used to evaluate input traffic features. The predictions from each model are fused to arrive at a final classification for that traffic.

[0013] Furthermore, the implementation process of interactive traffic processing and traffic feature extraction is as follows:

[0014] Interactive traffic processing: The response payload is encoded in byte format before being converted into an image. The byte format encoding uses a byte data bit-level encoding algorithm. The input of the algorithm is the number of bytes that can be encoded per row of the encoding matrix (r N ) and an array of bytes to be encoded (data); the algorithm maps each bit of each byte to four specified elements in the encoding matrix in a specific order; the algorithm uses bits as the basic unit of filling the matrix; the bit value is amplified by 255 times before being included in the matrix, and each bit filled in the matrix occupies the position of four adjacent elements. The average of these four elements is used to represent the predicted value of the bit during the decoding process;

[0015] The decoding algorithm is the inverse process of the byte data bit-level encoding algorithm. It takes the average of four adjacent elements in the encoding matrix and compares it with a predetermined threshold to determine the predicted bit value.

[0016] Traffic feature extraction

[0017] First, the normalization function used is shown in formula (1):

[0018]

[0019] Among them, x min Represents the minimum value of the same feature, x max Represents the maximum value of the same feature. Parameters a and b represent the lower and upper limits of the interval [a, b] to which the original value is scaled. Variable x i represents the i-th value of the same feature, x i ′ Represents the new eigenvalue after normalization, satisfying x i ∈[a,b];

[0020] Secondly, the CICFlowMeter tool is used to extract traffic features. CICFlowMeter extracts a large number of features. The importance of the 80 features extracted by CICFlowMeter is ranked using the Fisher Score, and the top-ranked features are selected as the input features of the classification model. The Fisher Score is used to minimize the feature differences between similar categories and maximize the differences between different categories. The Fisher Score scores each feature by calculating the ratio of the inter-class variance to the intra-class variance of the feature. The inter-class variance reflects the differences between different categories, and the intra-class variance reflects the differences within the same category. If a feature has a large inter-class variance and a small intra-class variance, then the Fisher Score of the feature is high (which means it is a good feature). The calculation method of the Fisher Score is shown in formula (2):

[0021]

[0022] The above formula calculates the Fisher score of the i-th feature; where K represents the number of IoT botnet traffic classifications in this paper; p j Represents the ratio of the total number of data in the jth class to the total number of data in all classes; Represents the numerical average of the i-th feature of the j-th category; Represents the standard deviation of the value of the i-th feature of the j-th category;

[0023] Calculated Fisher score F s The larger the value, the stronger the ability of the i-th feature to distinguish different categories. After calculating the Fisher scores of benign traffic and various attack traffic respectively, the top 20 features with the highest Fisher scores in each category are selected.

[0024] Furthermore, the anti-detection honeypot design process is as follows:

[0025] The design of the anti-detection honeypot is based on generative adversarial networks (GANs). GANs can generate synthetic network traffic and attack models that closely resemble the behavior of real attackers, which is used to enhance the authenticity of the honeypot. By integrating simulated attack traffic with real attack traffic, the honeypot becomes more attractive to attract more attackers and accumulate a large amount of information.

[0026] The design of the anti-detection honeypot includes a generator and a discriminator that primarily use a convolutional neural network structure. The response payload is encoded in byte format and converted into a coding matrix (image). To facilitate processing, the response payload needs to be encoded in byte format before being converted into an image. Therefore, a byte data bit-level encoding method is designed based on space utilization and information recovery.

[0027] The generator receives a single channel with an input dimension of 64 random noise vectors and generates a fake sample with only one channel: a 32×32 grayscale image; the discriminator receives the actual sample and the sample generated by the generator at the same time, and then outputs a probability value between 0 and 1, indicating the possibility that the input is a real sample; the generator and discriminator continuously iterate and compete, gradually enhancing their respective capabilities; eventually, the two networks reach a dynamic balance, and the samples generated by the generator appear to the discriminator to be no different from real samples.

[0028] Furthermore, the generator is designed as follows: the generator takes a single-channel 64-dimensional random noise vector as input and generates a pseudo-sample in the form of a 32×32-dimensional single-channel grayscale image. The generator adopts a seven-layer network structure and is designed as follows:

[0029] Input layer: The initial layer of the fully connected network consists of 64 neurons and accepts random noise with input dimension (64, 1);

[0030] Hidden layer: The second layer of the fully connected network consists of 1024 neurons. The function of the second layer is to perform nonlinear transformation on the input random noise (64, 1) and pass the transformed information to the subsequent output layer;

[0031] Output layer: As the last layer of the fully connected network, this layer consists of 16,384 neurons; it is responsible for generating information obtained by transforming the input random noise within the fully connected layer, and the output dimension is (16384, 1);

[0032] Reshape layer: The 16384-dimensional vector from the fully connected layer is converted into a feature map with 256 channels and a dimension of (8, 8). After the conversion, the next layer uses the convolution algorithm for feature extraction;

[0033] First deconvolution layer: The convolution kernel used in this step has 64 channels and a dimension of 2×2. Its stride is 2 in both the horizontal and vertical directions. This layer extracts features from the feature map while reducing the number of channels in the output feature map to 64, which increases the size of the feature map to 16×16.

[0034] Second deconvolution layer: Similar to the first layer, the convolution kernel used in this step has 32 channels, 2×2 dimensions, and a bidirectional stride of 2. After this layer, the output feature map has 32 channels and the dimension increases to 32×32.

[0035] Convolutional layer: The last layer of the generator uses a convolution kernel with only one channel and a size of 1×1; the stride is horizontal and vertical. This layer is used to convert the output of the previous layers into a matrix with target dimensions, thereby converting it into a grayscale image that matches the dimensions of the training data.

[0036] Furthermore, the discriminator is designed as follows: the structure of the discriminator is mainly composed of a fully connected network. The input of the network is a single-channel, 32×32 grayscale image; the output is a value in the range of (0, 1), where 0 indicates that the input image is a fake sample and 1 indicates that the input image is a real sample. The specific structure of the discriminator is as follows:

[0037] Reshape layer: In order to input a grayscale image with only one channel and size of 32×32 into the fully connected network, this layer expands the input grayscale image into a tensor with 1024 channels;

[0038] Input layer: This layer consists of 1024 neurons, takes a tensor of dimension (1024, 1) as input, performs a linear transformation on the input data, and then passes it to the hidden layer;

[0039] Hidden layer: This layer has 512 neurons and introduces nonlinear transformations, which enhances the network's ability to classify complex and nonlinear data.

[0040] Output layer: The connection layer of the output layer consists of 256 neurons. It performs binary classification based on the discriminator, so the output layer produces a single channel. The Sigmoid function maps the output value to the range of (0, 1). The final output of this layer represents the confidence of the discriminator in the authenticity of the input sample.

[0041] Furthermore, the lifecycle detection is specifically implemented as follows:

[0042] Lifecycle detection includes a multi-classification detection layer and a fusion layer for merging detection results. The important features extracted from the currently detected traffic data are the input of the multi-classification detection layer; the output value range of each category detection model is [0,1], and the input features of the current traffic determine the confidence of the category; the detection result fusion layer receives the confidence output by each classification model in the multi-classification detection layer; after merging the results of each classifier, the final classification result is determined and output.

[0043] The multi-classification detection layer uses LSTM as the classification model. LSTM is suitable for sequence-based prediction and can discover the potential relationship between adjacent features in the feature sequence. The network structures of classification models 0, 1, 2, and 3 in the life cycle detection module are exactly the same; the network structures all use Figure 4 The structure of the four models is different. The 20 input features of the four models are different. X represents the input feature sequence with feature dimension N, and Y represents the output prediction result, which ranges from [0, 1].

[0044] The classification model consists of two main parts: the first is the LSTM layer, which treats the input feature vector of dimension N as a sequence of length N and produces an output vector of dimension 10. The second part is the fully connected layer. The input layer receives a vector of dimension 10 from the LSTM layer and outputs a vector of dimension 40 to the subsequent layer. The output layer produces a prediction value of dimension 1, which is scaled to the interval [0, 1] using the sigmoid function.

[0045] The detection result fusion layer uses a fusion unit based on a fully connected neural network. Initially, the outputs of all classification models in the multi-classification detection layer serve as the input of the fusion unit's fully connected neural network. Subsequently, the output of the fully connected neural network output layer is converted into the final classification result using the argmax function.

[0046] The specific network structure of the fuzzifier based on the fully connected neural network includes four fully connected layers, one fully connected layer in the input layer and the output layer, and two fully connected layers in the hidden layer; the input layer receives a feature vector with a dimension of 4, the output layer produces a feature vector with a dimension of 4, and LeakyReLU is used as the activation function between adjacent fully connected layers.

[0047] A system for detecting the lifecycle of an Internet of Things botnet based on an anti-detection honeypot. The system comprises program modules corresponding to the steps of the above technical solution, and executes the steps of the method for detecting the lifecycle of an Internet of Things botnet based on an anti-detection honeypot when running.

[0048] A computer-readable storage medium stores a computer program configured to implement the steps of the method for detecting the lifecycle of an Internet of Things botnet based on an anti-detection honeypot when called by a processor.

[0049] The present invention has the following beneficial technical effects:

[0050] The present invention designs a honeypot with anti-detection function based on the Generative Adversarial Network (GAN). After training, the honeypot can generate realistic response data according to different request data, thereby improving its deception ability. The present invention designs an IoT botnet lifecycle detection method based on the Fusion Long Short-Term Memory (Fusion-LSTM) network. After training the Fusion-LSTM, the lifecycle of the IoT botnet traffic captured by the anti-detection honeypot can be accurately identified. The method of the present invention can avoid the attacker's virtual detection technology to achieve higher deception of the IoT botnet traffic, and at the same time can accurately identify the lifecycle of the traffic, so as to make protective responses as early as possible.

[0051] In terms of IoT botnet trapping, honeypots are designed using dynamic response and automatic generation methods to enhance the anti-detection capabilities of honeypots. In terms of IoT botnet detection, in order to fill the gap in research on IoT botnet lifecycle detection, the lifecycle of IoT botnet activities is divided, and an IoT botnet lifecycle detection method is designed to achieve early detection and early protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a schematic diagram of the principle of the IoT botnet lifecycle detection method based on anti-detection honeypot;

[0053] Figure 2 A histogram of the important features (Top20) of each type of traffic;

[0054] Figure 3 This is the GAN structure diagram of the anti-detection honeypot;

[0055] Figure 4 It is the network structure diagram of the classification model;

[0056] Figure 5 This is the network structure diagram of the fusion layer;

[0057] Figure 6 To generate a traffic grayscale map;

[0058] Figure 7 is the real traffic grayscale image;

[0059] Figure 8 This is a comparison chart of the interaction capabilities of the anti-detection honeypot and other honeypots;

[0060] Figure 9 The attack belief change curve of each honeypot;

[0061] Figure 10 This is a confusion matrix comparison chart. DETAILED DESCRIPTION

[0062] The following is combined with Figures 1 to 10 The implementation of the IoT botnet lifecycle detection method based on anti-detection honeypot described in the present invention is described as follows:

[0063] 1Technical concept

[0064] This paper proposes a method for detecting IoT botnet lifecycle based on anti-detection honeypot. Figure 1 As shown, this method first designs a honeypot with anti-detection capabilities based on a generative adversarial network (GAN). After training, this honeypot can generate realistic response data based on different request data, thereby improving its deception capabilities. Furthermore, a method for detecting the lifecycle of IoT botnets is designed based on a fusion long short-term memory (Fusion-LSTM) network. After training the Fusion-LSTM, the lifecycle of IoT botnet traffic captured by the anti-detection honeypot can be accurately identified. This method can circumvent attackers' virtual detection techniques to achieve higher deceptiveness against IoT botnet traffic, while also accurately identifying the lifecycle of the traffic, allowing for early defensive responses.

[0065] The general life cycle of an IoT botnet is as follows:

[0066] (1) The malicious program on the infected device discovers other devices by exhaustively enumerating IP addresses and scans whether the target service port is open by sending detection packets. If the target service is detected, it usually attempts to log in to the target service by enumerating usernames and passwords.

[0067] (2) If the service on the device has been successfully logged in in the first step, the malicious program on the infected device will upload the device information such as the device's IP, username and password, and hardware information to the Report server.

[0068] (3) The Report server collects the device information collected by the malicious program on the infected device and distributes it to the Loader.

[0069] (4) Loader logs into the device based on the information provided by the Report server, downloads and executes the malware.

[0070] The malware usually executes to add newly infected devices to the IoT botnet, and the newly infected devices will become nodes in the IoT botnet, gradually expanding the size of the botnet.

[0071] (5) The attacker transmits the attack command to the C&C server and launches a DDos attack on the target device.

[0072] (6) After receiving the attacker’s command, the C&C server further transmits the command to the malicious program on the infected device controlled by the C&C server at the next level.

[0073] (7) The malware on the infected device maintains a connection with the C&C server, decodes the received attack commands, and then launches a DDos attack on the target device.

[0074] From the perspective of IoT devices, this paper uses the following classification rules: (1) whether the device has been infected; (2) whether the device is launching an attack or being attacked; and divides the IoT botnet life cycle into three phases (scanning phase, communication phase, and attack phase). The scanning phase includes processes 1 and 4 in Figure 2, and the communication phase refers to the process of maintaining a connection with the C&C server and transmitting information about infected devices.

[0075] 2 Technical Solutions

[0076] To facilitate the description of the problem, this section specifically introduces the IoT botnet lifecycle detection method based on anti-detection honeypots, including the construction of the overall system model and the construction of each module, mainly including: traffic data preprocessing and feature extraction, anti-detection honeypot module design and lifecycle detection module design.

[0077] 2.1 System Model

[0078] System model such as Figure 1 As shown in Figure 2, we implement a GAN-based anti-detection honeypot to trap IoT botnets and use Fusion-LSTM to detect the IoT botnet lifecycle, thereby protecting IoT devices from botnet infection. The system, located at the network edge of the IoT environment, consists of three core components: a data processing module, an anti-detection honeypot module, and a lifecycle detection module.

[0079] Data Processing Module: This module is responsible for several key functions, including interactive traffic processing, traffic feature extraction, and data storage. Interactive traffic processing converts traffic data into input and output formats suitable for model generation. Traffic data is stored as pcap files for use in the lifecycle detection process. Traffic feature extraction extracts flow-level features from pcap data for analysis and detection by the lifecycle detection module. Data storage maintains interactive traffic data and classification results.

[0080] Anti-Detection Honeypot Module: This module uses a GAN model to generate realistic response data based on received request data. The generator and discriminator are trained using the dataset. After the request data is input into the generator, the converged generative model generates fake data and the corresponding response data.

[0081] Lifecycle Detection Module: This module detects traffic corresponding to specific stages of the IoT botnet lifecycle. Detection models for each benign and botnet lifecycle stage are trained using the dataset. These trained models are then used to evaluate input traffic characteristics. The predictions from each model are fused to arrive at a final classification for that traffic.

[0082] 2.2 Data processing module

[0083] The data processing module has several important functions: processing interactive traffic data for the anti-detection honeypot module, extracting traffic features for the lifecycle detection module, and storing traffic data and detection results. This section specifically discusses the key technologies for interactive traffic processing and traffic feature extraction.

[0084] 2.2.1 Interactive Traffic Processing

[0085] The GAN used in the anti-detection honeypot primarily employs a convolutional neural network structure. For ease of processing, the response payload needs to be encoded in byte format before being converted into an image. To enable the GAN to better learn the data distribution of similar request-response payloads while also balancing model training efficiency, the encoding method designed in this paper considers the following two aspects: 1) Space utilization: Improving space utilization helps reduce the size of the encoding matrix (image), thereby reducing computational resources such as memory space and improving the training efficiency of the generative adversarial network; 2) Information recovery: The goal is to restore the data distribution of the encoded elements as much as possible, enabling the generator to accurately learn the data distribution of the original data and minimizing generator bias caused by decoding data errors when decoding generated samples.

[0086] To this end, a bit-level encoding algorithm for byte data is proposed, see Algorithm 1 for details.

[0087]

[0088]

[0089] The input of the algorithm is the number of bytes that can be encoded per row of the encoding matrix (r N ) and an array of bytes to be encoded (data). The core concept of this algorithm is to map each bit of each byte to four designated elements in the encoding matrix in a specific order. The algorithm uses bits as the basic unit for filling the matrix. Before incorporating the bit values ​​into the matrix, it amplifies the bit values ​​by a factor of 255. This scaling enhances the distinction between elements filled with different bit values ​​and allows the generator to more effectively learn the data distribution at the bit level, improving the visibility of the boundaries between sample values. Furthermore, the biased predictions generated by the neural network tend to fall within a range close to the true value. This range only contains true values, which improves prediction accuracy. Each bit filled into the matrix occupies the position of four adjacent elements, rather than just one. During the decoding process, the average of these four elements is used to represent the predicted value of the bit. This minimizes prediction errors caused by the generator's bias, thereby improving prediction accuracy.

[0090] The decoding algorithm is the inverse process of Algorithm 1. It works by taking the average of four adjacent elements in the encoding matrix and comparing it with a predetermined threshold to determine the predicted bit value.

[0091] The time complexity of the byte data bit-level encoding algorithm is O(n 2 ), with a space complexity of O(n). This approach has the following advantages: Information-rich: Each element in the resulting matrix contains detailed information about the bit-level encoded data, ensuring high information richness. High information relevance: By presenting information at the bit level, the neural relevance of the encoded elements is better preserved. This enhances the usefulness and interpretability of the encoded data.

[0092] In summary, this approach not only effectively encodes data at a fine-grained level but also preserves rich information and correlations, making it an important technique that can be used in generative models such as GANs.

[0093] 2.2.2 Traffic feature extraction

[0094] The data processed by the lifecycle detection module operates at the process level. In the data preprocessing process of the classification model, normalization and feature extraction play a key role.

[0095] Normalization is the process of rescaling data to the range [0,1] through a linear transformation. This transformation ensures that the newly scaled data maintains the same order as the original data. Normalization is very important because some activation functions, such as Sigmoid and Tanh functions, tend to produce output values ​​close to a constant (0 or 1) when the input values ​​are large. This leads to the vanishing gradient problem. Normalization can effectively alleviate this problem by limiting the input data to the effective gradient range of these activation functions. In addition, normalization can also speed up the convergence of the model during training. The normalization function used in this study is shown in formula (1):

[0096]

[0097] Among them, x min Represents the minimum value of the same feature, x max Represents the maximum value of the same feature. Parameters a and b represent the lower and upper limits of the interval [a, b] to which the original value is scaled. Variable x i represents the i-th value of the same feature, x i ′ Represents the new eigenvalue after normalization, satisfying x i ∈[a,b].

[0098] In terms of traffic feature extraction, this paper uses the CICFlowMeter tool. CICFlowMeter extracts a large number of features (80). The high dimensionality of these features may lead to overfitting and slow down the model convergence during training. In addition, too many dimensional features will increase the demand for computing resources and prolong the model detection time. In order to optimize the feature set for model detection and alleviate these problems, we use Fisher Score to rank the importance of the 80 features extracted by CICFlowMeter (see 80 features and description table) and select the top-ranked features as the input features of the classification model. Fisher Score is used to minimize the feature differences between similar categories and maximize the differences between different categories. Fisher Score scores each feature by calculating the ratio of the inter-class variance and the intra-class variance of the feature. The inter-class variance reflects the differences between different categories, and the intra-class variance reflects the differences within the same category. If a feature has a large inter-class variance and a small intra-class variance, then the Fisher Score of this feature is high, "which means it is a good feature." The calculation method of Fisher Score is shown in formula (2):

[0099]

[0100] The above formula calculates the Fisher score of the i-th feature. Where K represents the number of IoT botnet traffic classifications in this paper. j Represents the ratio of the total number of data in the jth class to the total number of data in all classes. Represents the numerical average of the i-th feature of the j-th category. Represents the standard deviation of the values ​​of the i-th feature of the j-th category.

[0101] Calculated Fisher score F s The larger the value is, the stronger the ability of the i-th feature to distinguish different categories is. After calculating the Fisher scores of benign traffic and various attack traffic respectively, the top 20 features with the highest Fisher scores in each category are selected, such as Figure 2 shown. Figure 2 The corresponding top 20 features of the four categories are given in . The 80 features and description tables are as follows:

[0102] Continued from the previous table

[0103]

[0104] 2.3 Anti-Detection Honeypot

[0105] The fundamental design of anti-detection honeypots is derived from the concept of generative adversarial networks (GANs). GANs can generate synthetic network traffic and attack models that closely resemble real attacker behavior, thereby enhancing the realism of the honeypot. By blending simulated attack traffic with real-world attack traffic, the honeypot becomes more attractive, attracting more attackers and accumulating a wealth of information. This synthetic data helps security experts gain a deeper understanding of attacker strategies and techniques, enabling them to more effectively address potential threats.

[0106] like Figure 3 As shown, the generator and discriminator mainly use the structure of convolutional neural network, so it is necessary to encode the response payload in byte format and convert it into an encoding matrix (image).

[0107] In this paper, the generator receives a single-channel input of 64 random noise vectors and generates a fake sample with only one channel—a 32×32 grayscale image. The discriminator receives both real samples and samples generated by the generator and outputs a probability value between 0 and 1, indicating the likelihood that the input is a real sample. The generator and discriminator continuously iterate and compete, gradually strengthening their respective capabilities. Eventually, the two networks reach a dynamic equilibrium, and the samples generated by the generator appear indistinguishable from real samples to the discriminator.

[0108] (1) Generator Design: The generator takes a single-channel 64-dimensional random noise vector as input and generates a pseudo-sample in the form of a 32×32-dimensional single-channel grayscale image. The generator adopts a seven-layer network structure and is designed as follows:

[0109] Input layer: The initial layer of the fully connected network consists of 64 neurons and accepts random noise with input dimension (64, 1).

[0110] Hidden layer: The second layer of the fully connected network consists of 1024 neurons. Its function is to perform nonlinear transformation on the input random noise (64, 1) and pass the transformed information to the subsequent output layer.

[0111] Output layer: As the last layer of the fully connected network, this layer consists of 16,384 neurons. It is responsible for generating information obtained by transforming the input random noise within the fully connected layer, and the output dimension is (16384, 1).

[0112] Reshape layer: The 16384-dimensional vector from the fully connected layer is converted into a feature map with 256 channels and a dimension of (8, 8). After this conversion, the next layer uses the convolution algorithm to extract features.

[0113] First deconvolution layer: This layer uses a 64-channel convolution kernel with a 2×2 dimension. Its stride is 2 in both the horizontal and vertical directions. This layer extracts features from the feature map while reducing the number of channels in the output feature map to 64. This results in the feature map size increasing to 16×16.

[0114] Second deconvolution layer: Similar to the first layer, the convolution kernel used in this step has 32 channels, 2×2 dimensions, and a bidirectional stride of 2. After this layer, the output feature map has 32 channels and the dimension increases to 32×32.

[0115] Convolutional layer: The final layer of the generator uses a convolution kernel with a single channel of size 1×1. The stride is horizontal and vertical. This layer is designed to convert the output of the previous layers into a matrix with the target dimension, thereby converting it into a grayscale image that matches the dimensions of the training data.

[0116] (2) Discriminator Design: The discriminator structure mainly consists of a fully connected network. The input of the network is a single-channel, grayscale image of size 32×32. The output is a value in the range of (0, 1), where 0 indicates that the input image is a fake sample and 1 indicates that the input image is a real sample. The specific structure of the discriminator is as follows:

[0117] Reshape layer: In order to input a grayscale image with only one channel and size of 32×32 into the fully connected network, this layer expands the input grayscale image into a tensor with 1024 channels.

[0118] Input layer: This layer consists of 1024 neurons, takes a tensor of dimension (1024, 1) as input, and performs a linear transformation on the input data before passing it to the hidden layer.

[0119] Hidden layer: This layer has 512 neurons, introduces a non-linear transformation, and enhances the network’s ability to classify complex, non-linear data.

[0120] Output layer: The output layer consists of 256 neurons. Since the discriminator in this study performs binary classification, the output layer produces a single channel. The sigmoid function maps the output value to the range of (0, 1). The final output of this layer represents the discriminator’s confidence in the authenticity of the input sample.

[0121] 2.4 Life cycle detection module

[0122] The life cycle detection module includes a multi-classification detection layer and a fusion layer for merging the detection results. The important features extracted from the current detected traffic data are the input of the multi-classification detection layer. The output value of each classification detection model ranges from [0, 1], and the input features of the current traffic determine the confidence of this class. The detection result fusion layer receives the confidence of each classification model output in the multi-classification detection layer. After merging the results of each classifier, the final classification result is determined and output.

[0123] The multi-classification detection layer uses LSTM as the classification model. LSTM is particularly suitable for sequence-based prediction and can discover the potential relationship between adjacent features in a feature sequence. The network structure of classification models 0, 1, 2, and 3 in the life cycle detection module is exactly the same, as shown in Figure 4 In Figure 4 , X represents the input feature sequence with a feature dimension of N, and Y represents the output prediction result, which ranges from [0, 1].

[0124] The classification model consists of two main parts. The first part is the LSTM layer, which takes the input feature vector of dimension N as a sequence of length N and produces an output vector of dimension 10. The second part is the fully connected layer. The input layer receives a vector of dimension 10 from the LSTM layer and outputs a vector of dimension 40 to the subsequent layer. The output layer produces a prediction value of dimension 1, which is scaled to the interval [0, 1] using the sigmoid function.

[0125] The detection result fusion layer uses a fusion based on a fully connected neural network. Initially, the outputs of all classification models in the multi-classification detection layer are used as the input of the fully connected neural network of the fusion. Subsequently, the output of the output layer of the fully connected neural network is converted to the final classification result using the argmax function.

[0126] The fusion device based on fully connected neural network does not rely entirely on the output of a single classifier, but integrates the output of multiple classifiers. It updates the connection weights of neurons between adjacent layers in the fully connected neural network through multiple iterations to ensure that the classification results of multiple classifiers have a more reasonable impact on the final result. The specific network structure of the fuzzifier based on fully connected neural network in this paper is as follows: Figure 5 As shown in Figure 1, it consists of four fully connected layers: one for the input layer, one for the output layer, and two for the hidden layer. The input layer receives a feature vector of dimension 4, and the output layer produces a feature vector of dimension 4. LeakyReLU is used as the activation function between adjacent fully connected layers.

[0127] 3 Effects of the Invention

[0128] 3.1 Test experiment parameter selection

[0129] 3.1.1 Dataset

[0130] To train the anti-detection honeypot and lifecycle detection models, we constructed a training dataset combining the MedBIoT and Aposemat IoT-23 datasets. This new dataset is designed to ensure balanced representation of data from different sources.

[0131] MedBIoT dataset: This dataset contains data from three different botnets and captures network traffic from four different device types. It is a medium-sized dataset.

[0132] Aposemat IoT-23 dataset: The Aposemat IoT-23 dataset contains data from ten botnet types and captures network traffic from four different device types. It is a small dataset.

[0133] By combining these datasets, we aim to create a new, balanced dataset that retains pcap data from ten botnet types and seven different device types. This new dataset, referred to as the "Mini-Dataset," is shown in Table 1. It is this mini-dataset that is used to train the generative response model and the lifecycle detection model. The process of combining these datasets helps ensure that the resulting training dataset is representative of a wide range of botnet and device characteristics.

[0134] Table 1 Experimental dataset

[0135]

[0136] 3.1.2 Experimental environment setup

[0137] For detailed experimental parameters, see Table 2. Windows served as the primary experimental environment, while Ubuntu was used to create a virtual environment and test traffic flow functionality. We established a virtual environment using the VMWare platform, with three virtual machines (VMs) interconnected within the same subnet segment, enabling seamless communication via bridging mode. In this research setup, each VM served a specific purpose:

[0138] Table 2 Experimental environment

[0139]

[0140] VM1 (Simulated IoT Botnet): In VM1, we deployed a simulated IoT botnet. This virtual machine emulated the behaviors associated with an IoT botnet, replicating all stages of the botnet lifecycle, including scanning, propagation, and attack phases.

[0141] VM2 runs a comparison service, possibly encapsulated in a container. This service communicates with the other VMs using the host's network mode, using the host's IP address and port. VM2 serves as a reference point for the comparative analysis and is an interactive component of the experimental process.

[0142] VM3 (Netty Server): VM is equipped with a Netty server running RGPot. The Netty server is responsible for exposing the services provided by RGPot through a specific port.

[0143] VM1 simulates IoT botnet activity, VM2 provides a baseline for comparison, and VM3 hosts RGPot in a honeypot system designed to detect various stages of an IoT botnet's lifecycle. The coordinated interaction between these virtual machines is crucial to evaluating RGPot's effectiveness in a controlled environment.

[0144] 3.2 Test results and analysis

[0145] Experiment 1: Response Testing for Various IoT Communication Protocols: We carefully deployed the innovative RGPot and an open-source IoT botnet in our network environment. This arrangement allowed for simulated interaction between the botnet and RGPot. During the experiment, we intentionally simulated common IoT communication protocols, including MQTT, CoAP, HTTP, SSH, and Telnet.

[0146] Experiment 1 results: Figure 6 and Figure 7Grayscale images are used to depict the real and generated samples corresponding to each interaction stage. Each image represents a sample from a different stage, including (a) consultation stage, (b) login verification stage, (c) malware loading stage, (d) malware execution stage, (e) heartbeat maintenance stage, and (f) message reporting stage.

[0147] We also conducted 100 detailed tests on grayscale image data for each interaction phase. Table 3 shows the training results of the generator at different interaction phases. The correctness of the generated samples refers to the proportion of responses (byte data) that match the format of the actual response body after decoding and conversion of the generated samples (grayscale images). This high accuracy is achieved because the response corresponding to each request type is unique in these phases.

[0148] Table 3 Accuracy of sample generation

[0149]

[0150] Experiment 1 Analysis: Experiments demonstrate that our anti-detection honeypot consistently achieves over 93% accuracy in generating responses to various IoT communication protocol requests. This impressive performance is due to the use of a generative adversarial network model in its design. The well-trained generator excels at generating deceptive responses to diverse request data, resulting in the observed high accuracy.

[0151] Experiment 2: Interaction Capability Test: To compare interaction capabilities, this experiment used the number of interactions as an evaluation metric to test the anti-detection honeypot in this article and several open-source honeypots: Cowrie, Hfish, Honeything, and Conpot. In this experiment, Mirai was deployed as the botnet attacker, and each honeypot underwent 100 rounds of testing. The number of interactions between the honeypot and the IoT botnet was used as an evaluation metric for honeypot simulation. The IoT botnet sends a request (at the application layer level) and receives a response. If the response conforms to the specified format, it is recorded as a successful interaction. If not, the connection is released. The time from the connection request to the IoT botnet releasing the connection is called a test round. The number of successful interactions in a test round is used to measure the honeypot's level of interactivity.

[0152] Experiment 2 results: After 100 rounds of interaction tests, the results of the number of interactions between several honeypots are as follows: Figure 8It can be seen from the figure that RGPot has more interactions at each stage than Cowrie, Honeything and Conpot. On average, RGPot has 16 interactions per round, and a maximum of 42. On the other hand, Hfish performs relatively stably, with an average of 22 interactions, but a maximum of only 24.

[0153] Experiment 2 analysis: From the comparative experiment of the anti-detection honeypot and the open source honeypots Cowrie, Hfish, Honeything and Conpot, it can be seen that the anti-detection honeypot performs better in interaction ability, exceeding Cowrie, Honeything and Conpot, but is slightly worse than Hfish in stability and average value.

[0154] Experiment 3 anti-detection ability test: In order to verify the anti-detection ability of the anti-detection honeypot to the attacker (i.e. the probability that the attacker thinks the interaction object is a honeypot), this paper introduces the attacker's belief as an evaluation index. Focus on the impact of the honeypot's actions on the attacker's belief, and the impact of the belief on whether the attacker continues to attack. In the decision-making process of the attacker, the attacker with initial belief P0 first calculates the expected return of three actions Test, Attack, Exit respectively, and then takes the action with the maximum expected return. If the expected returns of "Attack" and "Test" are both less than zero, the attacker will choose "Exit" to exit the game. Define P exit P exit = Max(P), where Under the initial belief p, the attacker's Max(E(Attack), E(Test)) ≥ 0, i.e. P exit is the maximum initial belief that makes the attacker's attack or test return greater than or equal to 0. This paper uses a fingerprint-based honeypot detection method to simulate the attacker's identification of the honeypot to affect the calculation of P1.

[0155] Experiment 3 results: The detection results of the anti-detection honeypot and the open source honeypots Cowrie, Hfish, Honeything and Conpot are shown in Table 4. Through the identification of the corresponding fingerprint information, multiple open source honeypots are identified as honeypot instances. Due to the generation model of the anti-detection honeypot, it does not show that it is detected as a honeypot instance in the existing fingerprint identification method.

[0156] Table 4 Honeypot detection results

[0157]

[0158] After the experiment, the simulated attacker uses a fingerprint-based honeypot detection technology to detect the five honeypots, and the change of its belief value is as follows Figure 9 As shown.

[0159] Experiment 3 analysis: It can be seen that the anti-detection honeypot has more stable expected value compared with other several honeypots. Therefore, it can be considered that it is more deceptive and confusing to attackers, and the anti-detection effect is obviously better.

[0160] Experiment 4 IoT botnet life cycle detection effect test: We deployed a botnet and benign service using a simulation experiment platform, and injected traffic data into a well-trained classification model. The classification task includes four categories: benign traffic, scanning phase traffic, propagation phase traffic, and attack phase traffic. In order to evaluate the performance of IoT botnet life cycle protection, we use several key evaluation indicators, including Accuracy, Precision, Recall, and F1-score.

[0161] Experiment 4 results: Figure 10 The confusion matrix effectively illustrates the classification performance of the four classification models on the test set. It is worth noting that when classifying the traffic in the propagation phase, our method achieved the highest classification accuracy, exceeding 98%. In contrast, the classification accuracy of the other three classification models is about 80%. From the confusion matrix, it can be further understood that KNN and LSTM misclassify about 15.9% and 17.3% of the propagation phase traffic as benign traffic, respectively. In contrast, SVM misclassifies about 12.9% of the propagation phase traffic as attack traffic. In terms of benign traffic classification, our method shows higher accuracy, with only about 1.4% of benign traffic being misclassified as malicious traffic. This result is slightly higher than LSTM and SVM, and about 5% higher than KNN, which misclassifies more benign traffic (about 6.5%) as scanning phase traffic.

[0162] Table 5 clearly compares the classification performance of the four models, highlighting the advantages of our model compared with KNN, SVM, and LSTM. It is worth noting that our model has improved in both accuracy and other classification indicators. Compared with KNN, its accuracy has increased by 7%. In addition, compared with the LSTM classifier, our model has significantly improved the accuracy and other classification indicators by 4.5%.

[0163] Table 5 Comparison of classification effects of different classifiers

[0164]

[0165] In terms of classification efficiency, KNN achieved a test time of 53.24 seconds on the test set, significantly outperforming the other classifiers in the table. This efficiency is attributed to the computational intensity of calculating the distance between the input sample and the training set during the classification process. In comparison, our model's classification efficiency (time consumption) is 66 times that of KNN and approximately 16 times that of SVM. These efficiency improvements highlight the practical advantages of our model for real-time classification tasks.

[0166] Experiment 4 Analysis: Compared to traditional classification models such as KNN, SVM, and LSTM, our model stands out in several aspects. In particular, it demonstrates faster detection speed: Our model excels in timely threat detection, significantly outperforming KNN and SVM. Superior accuracy: Our model outperforms KNN, SVM, and LSTM in classification accuracy. Reduced false positive rate: Our false positive rate is significantly reduced, enhancing the model's ability to accurately identify threats while minimizing false positives. These results highlight the effectiveness and efficiency of our model for detecting IoT botnet lifecycles.

Claims

1. A method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot, characterized in that: The method is based on a GAN anti-detection honeypot to trap IoT botnets, and based on a Fusion-LSTM to detect the IoT botnet lifecycle, so as to protect IoT devices from botnet infection. The method includes: Data processing: used to process interactive traffic data, extract traffic features, and store traffic data and detection results. Interactive traffic processing converts traffic data into input and output formats suitable for model generation. Traffic data is stored in the form of pcap files for use in the lifecycle detection process. The traffic feature extraction process can extract traffic-level features from pcap data for analysis and detection by the lifecycle detection module. Data storage is used to maintain interactive traffic data and classification results. Anti-detection honeypot: Use the GAN model to generate real response data based on the received request data; the generator and discriminator are trained using the dataset; after the request data is input into the generator, the converged generative model will generate false data and the corresponding response data; the anti-detection honeypot design process is as follows: The anti-detection honeypot is designed using a generative adversarial network (GAN). GAN can generate synthetic network traffic and attack models that closely resemble real attacker behavior, enhancing the authenticity of the honeypot. By fusing simulated attack traffic with actual attack traffic, the honeypot becomes more attractive, attracting more attackers and accumulating a large amount of information. The design of the anti-detection honeypot includes a generator and a discriminator using a convolutional neural network structure to encode the response payload in byte format and convert it into a coding matrix. Before converting the response payload into an image, it is byte-encoded and a bit-level encoding method for byte data is designed based on space utilization and information recovery. Lifecycle detection: Detects traffic corresponding to specific stages of the IoT botnet lifecycle. Detection models for each stage of the benign and botnet lifecycles are trained using the dataset. These trained models are then used to evaluate input traffic features. The predictions from each model are fused to arrive at a final classification for that traffic. Lifecycle detection includes a multi-classification detection layer and a fusion layer for merging detection results. The important features extracted from the currently detected traffic data are the input of the multi-classification detection layer; the output value range of each category detection model is [0,1], and the input features of the current traffic determine the confidence of the category; the detection result fusion layer receives the confidence output by each classification model in the multi-classification detection layer; after merging the results of each classifier, the final classification result is determined and output.

2. The method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 1, characterized in that: The implementation process of interactive traffic processing and traffic feature extraction is as follows: Interactive traffic processing: The response payload is encoded in byte format before being converted into an image. The byte format encoding uses a byte data bit-level encoding algorithm. The input of the algorithm is the number of bytes that can be encoded per row of the encoding matrix r N and the data array of bytes to be encoded; the algorithm maps each bit of each byte to four specified elements in the encoding matrix in a specific order; the algorithm uses bits as the basic unit of filling the matrix; the bit value is amplified by 255 times before being included in the matrix, and each bit filled in the matrix occupies the position of four adjacent elements. The average of these four elements is used to represent the predicted value of the bit during the decoding process; The decoding algorithm is the inverse process of the byte data bit-level encoding algorithm. It takes the average of four adjacent elements in the encoding matrix and compares it with a predetermined threshold to determine the predicted bit value. Traffic feature extraction process: First, the normalization function used is shown in formula (1): Among them, x min Represents the minimum value of the same feature, x max Represents the maximum value of the same feature in terms of value; parameters a and b represent the lower and upper limits of the interval [a, b] to which the original value is scaled; variable x i represents the i-th value of the same feature, x i ′ Represents the new eigenvalue after normalization, satisfying x i ∈[a,b]; Secondly, the CICFlowMeter tool is used to extract traffic features. CICFlowMeter extracts a large number of features. The importance of the 80 features extracted by CICFlowMeter is ranked using Fisher Score, and the top-ranked features are selected as the input features of the classification model. Fisher Score is used to minimize the feature differences between similar categories and maximize the differences between different categories. Fisher Score scores each feature by calculating the ratio of the inter-class variance and the intra-class variance of the feature. The inter-class variance reflects the differences between different categories, and the intra-class variance reflects the differences within the same category. If the inter-class variance of a feature is large and the intra-class variance is small, then the Fisher Score of the feature is high. The calculation method of Fisher Score is shown in formula (2): The above formula calculates the Fisher score of the i-th feature; where K represents the number of IoT botnet traffic classifications in this paper; p j Represents the ratio of the total number of data in the jth class to the total number of data in all classes; Represents the numerical average of the i-th feature of the j-th category; Represents the standard deviation of the value of the i-th feature of the j-th category; Calculated Fisher score F s The larger the value is, the stronger the ability of the i-th feature to distinguish different categories is. After calculating the Fisher scores of benign traffic and various attack traffic respectively, the top 20 features with the highest Fisher scores in each category are selected.

3. The method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 1 or 2, characterized in that: In the anti-detection honeypot design process, the generator receives a single channel with an input dimension of 64 random noise vectors and generates a fake sample with only one channel: a 32×32 grayscale image; the discriminator receives the actual sample and the sample generated by the generator at the same time, and then outputs a probability value between 0 and 1, indicating the possibility that the input is a real sample; the generator and discriminator continuously iterate and compete, gradually enhancing their respective capabilities; eventually, the two networks reach a dynamic balance.

4. The method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 3, characterized in that: The generator is designed as follows: the generator takes a single-channel 64-dimensional random noise vector as input and generates a pseudo-sample in the form of a 32×32-dimensional single-channel grayscale image. The generator adopts a seven-layer network structure and is designed as follows: Input layer: The initial layer of the fully connected network consists of 64 neurons and accepts random noise with input dimension (64, 1); Hidden layer: The second layer of the fully connected network consists of 1024 neurons. The function of the second layer is to perform nonlinear transformation on the input random noise and pass the transformed information to the subsequent output layer. Output layer: As the last layer of the fully connected network, this layer consists of 16,384 neurons; it is responsible for generating information obtained by transforming the input random noise in the fully connected layer, and the output dimension is (16,384, 1); Reshape layer: The 16384-dimensional vector from the fully connected layer is converted into a feature map with 256 channels and a dimension of (8, 8). After the conversion, the next layer uses the convolution algorithm for feature extraction; The first deconvolution layer uses a convolution kernel with 64 channels and a dimension of 2×2. The channels have a stride of 2 in both the horizontal and vertical directions. This layer extracts features from the feature map and reduces the number of channels in the output feature map to 64, increasing the size of the feature map to 16×16. The second deconvolution layer uses a convolution kernel with 32 channels, 2×2 dimensions, and a stride of 2 in both the horizontal and vertical directions. After this layer, the output feature map has 32 channels and the dimension increases to 32×32. Convolutional layer: The last layer of the generator uses a convolution kernel with only one channel and a size of 1×1; the stride is horizontal and vertical. This layer is used to convert the output of the previous layers into a matrix with target dimensions, thereby converting it into a grayscale image that matches the dimensions of the training data.

5. The method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 4, characterized in that: The discriminator is designed as follows: The structure of the discriminator mainly consists of a fully connected network, the input of which is a single-channel grayscale image with a size of 32×32; The output is a value in the range of (0, 1), where 0 indicates that the input image is a fake sample and 1 indicates that the input image is a real sample. The specific structure of the discriminator is as follows: Reshape layer: In order to input a grayscale image with only one channel and size of 32×32 into the fully connected network, this layer expands the input grayscale image into a tensor with 1024 channels; Input layer: This layer consists of 1024 neurons, takes a tensor of dimension (1024, 1) as input, performs a linear transformation on the input data, and then passes it to the hidden layer; Hidden layer: This layer has 512 neurons and introduces nonlinear transformations to enhance the network's ability to classify complex and nonlinear data; Output layer: The connection layer of the output layer consists of 256 neurons. It performs binary classification based on the discriminator, so the output layer produces a single channel. The Sigmoid function maps the output value to the range of (0, 1). The final output of this layer represents the discriminator's confidence in the authenticity of the input sample.

6. The method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to claim 1 or 5, characterized in that: During the life cycle testing process, The multi-classification detection layer uses LSTM as the classification model. LSTM is suitable for sequence-based prediction and discovers the potential relationship between adjacent features in a feature sequence. The network structure of classification models 0, 1, 2, and 3 in the lifecycle detection module is exactly the same. The classification model consists of two main parts: the first part is the LSTM layer, which treats the input feature vector of dimension N as a sequence of length N and produces an output vector of dimension 10; the second part is the fully connected layer; the input layer receives the vector of dimension 10 from the LSTM layer and outputs a vector of dimension 40 to the subsequent layer; the output layer produces a prediction value of dimension 1, which is scaled to the interval [0, 1] using the sigmoid function; The detection result fusion layer uses a fusion unit based on a fully connected neural network. Initially, the outputs of all classification models in the multi-classification detection layer serve as the input of the fusion unit's fully connected neural network. Subsequently, the output of the fully connected neural network output layer is converted into the final classification result using the argmax function. The specific network structure of the fuzzifier based on the fully connected neural network includes four fully connected layers, one fully connected layer in the input layer and the output layer, and two fully connected layers in the hidden layer; the input layer receives a feature vector with a dimension of 4, the output layer produces a feature vector with a dimension of 4, and LeakyReLU is used as the activation function between adjacent fully connected layers.

7. An IoT botnet lifecycle detection system based on anti-detection honeypots, characterized by: The system has a program module corresponding to the steps of any one of claims 1 to 6 above, and when the program module is running, the steps in the IoT botnet lifecycle detection method based on anti-detection honeypot are executed.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the method for detecting the life cycle of an IoT botnet based on an anti-detection honeypot according to any one of claims 1 to 6 when called by a processor.

Images