Low-power-consumption Internet of Things equipment unsupervised intrusion detection method based on comparative learning

Abstract

The invention relates to a low-power-consumption Internet of Things equipment unsupervised intrusion detection method based on comparative learning, and belongs to the field of network security and Internet of Things intrusion detection. The method comprises two stages: in a comparison pre-training stage, an encoder based on a neural network is trained so as to efficiently extract discriminative features of specific Internet of Things equipment; according to the method, loss comparison is introduced, and specific traffic characteristics of target equipment are extracted by distinguishing the traffic of the target equipment from the traffic of other equipment. In a center vector training phase, the method models normal sample distributions of all devices simultaneously within a single neural network, and consistently fits their features to the distributions to obtain a set of robust representations. After training is completed, each type of equipment generates a'center vector 'which represents the most typical characteristic of the traffic. In detection, if an unknown sample is mapped by the model to an abnormal region away from the center vector, the sample can be regarded as abnormal traffic.

Description

Technical Field

[0001] The present invention belongs to the field of network security and Internet of Things intrusion detection, and particularly relates to an unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning. Background Art

[0002] With the rapid development of the Internet of Things (IoT) technology, more and more commercial IoT products have been widely deployed in various application scenarios, such as home environments, office places, etc. These devices are interconnected through the network, greatly improving the intelligent level of life and work. However, due to the variety of IoT products, different functions, lack of unified security standards and protection mechanisms, and their close integration with human daily activities, these devices have gradually become the focus of attention of network attackers. In recent years, cases of IoT devices being attacked by the network have been common. For example, some home cameras have been maliciously invaded and remotely controlled by hackers due to insufficient security protection measures, resulting in the leakage of users' personal privacy data. In addition, some office devices in enterprise internal networks have also been exploited by attackers due to security vulnerabilities, making them a springboard for attackers to further penetrate the internal network server, thus causing more serious security threats. Such cases highlight the severe challenges faced by current IoT products in terms of security.

[0003] The IoT system has many application scenarios and generally includes three types of entities: IoT devices, IoT gateways, and remote control servers. IoT devices, such as smart bulbs, automatic doors, and temperature and humidity sensors, are used to automatically sense the environment and execute control. The IoT gateway provides a wireless access point to enable IoT devices to connect to the Internet. The IoT device control program runs on the remote control server, which collects the data reported by IoT devices, issues control commands, and provides a management interface for users.

[0004] To protect IoT devices from network attacks, the intrusion prevention system (IPS) function is integrated into some IoT gateways. The core of this function is the IoT Intrusion Detection technology. This technology analyzes data such as network traffic to detect abnormal activities or attack behaviors, thereby identifying potential security threats in the IoT. The intrusion prevention system uses this technology to detect network attack events, and then triggers the firewall blocking mechanism and automatically notifies the security administrator to achieve the protection of the device.

[0005] However, there are some deficiencies in the current intrusion detection methods for Internet of Things (IoT) devices: 1) Many detection methods use supervised learning methods for training, that is, the methods require both attack samples and normal samples to participate in training the model, which leads to the need for sampling attack samples during deployment, increasing the labor cost. 2) Although some detection methods use unsupervised learning techniques for training, that is, the methods only require normal samples to participate in training the model, traditional unsupervised methods often need to train a separate model for each IoT device. Therefore, as the number of devices increases, such methods will consume more running memory and storage space. 3) Since some low-power IoT devices reduce power consumption by long-term dormancy, only a small number of normal communication samples are generated. Traditional unsupervised learning methods often cannot adapt to the characteristics of insufficient samples of such devices, resulting in room for further improvement in their detection performance. Summary of the Invention

[0006] The purpose of the present invention is to address the above problems and provide an unsupervised intrusion detection method for low-power IoT devices based on contrastive learning, which is specifically designed for low-power IoT devices and includes two stages: contrastive pre-training and center vector training. First, in the contrastive pre-training stage, a neural network-based encoder is trained to efficiently extract discriminative features of specific IoT devices. The method introduces a contrastive loss to extract the unique traffic features of the target device by distinguishing the traffic of the target device from that of other devices. This prompts the model to focus on the unique features of IoT device traffic rather than the shared features that all traffic has. Then, in the center vector training stage, the method simultaneously models the normal sample distribution of all devices within a single neural network and consistently fits their features to this distribution to obtain a set of robust representations. After training is completed, each type of device will generate a "center vector" representing the most typical features of its traffic. During detection, if an unknown sample is mapped by the model to an abnormal region far from the "center vector", the sample can be regarded as abnormal traffic.

[0007] To achieve the above purpose, the technical solution of the present invention is: an unsupervised intrusion detection method for low-power IoT devices based on contrastive learning, including:

[0008] In the contrastive pre-training stage, a method for calculating the contrastive loss value is designed to extract the unique traffic features of the target IoT device by distinguishing the traffic of the target IoT device from that of other IoT devices;

[0009] In the center vector training stage, the center vector of each type of IoT device is calculated; then, a loss function is designed to guide the model to reduce the cosine distance between the representation vectors of the same type of IoT devices and their corresponding center vectors, so as to fit the sample distribution of all IoT devices within a single model.

[0010] In the detection stage, if an unknown sample is mapped by the model to an abnormal area far from the center vector, it is considered that the unknown sample may be an abnormal data stream generated by a potential network attack.

[0011] Furthermore, the method includes the following steps:

[0012] Step S1, data sampling: When deploying the Internet of Things environment, run a network sniffer program on the Internet of Things gateway to capture and save communication packets from Internet of Things devices within the user-defined sampling period; then, according to the MAC addresses of the Internet of Things devices, cut and reorganize the captured files by device type;

[0013] Step S2, data preprocessing process: Reorganize the captured communication packets into TCP / UDP data stream samples, and then extract features from each data stream sample to generate corresponding vector samples; perform normalization processing on all processed vector samples and then save them as a data set;

[0014] Step S3, contrast pre-training stage of the model: Design a method for calculating the contrast loss value to extract the unique traffic features of the target Internet of Things device by distinguishing the traffic of the target Internet of Things device from the traffic of other Internet of Things devices; during training, the loss value will guide the model to focus on the unique features of the Internet of Things device traffic rather than the shared features that all traffic has;

[0015] Step S4, center vector training stage of the model: Calculate the center vector for each type of Internet of Things device; then, design a loss function that, during training, guides the model to reduce the cosine distance between the representation vectors of the same type of Internet of Things devices and their corresponding center vectors, thereby fitting the sample distributions of all Internet of Things devices within a single model;

[0016] Step S5, use the trained model for detection: When an unknown sample sent to the target Internet of Things device is obtained, the model will generate a corresponding representation vector and calculate the cosine distance between this representation vector and the center vector of the target Internet of Things device as the anomaly score. If the anomaly score exceeds the user-defined threshold, it is considered that the sample may be an abnormal data stream generated by a potential network attack.

[0017] Furthermore, in step S1, the process of data sampling includes the following steps:

[0018] Step S11, run the network sniffer program Network Sniffer on the Internet of Things gateway to capture IP data packets from Internet of Things devices;

[0019] Step S12: At the end of the sampling period time defined by the user, control the network sniffer program to stop capturing packets and save the captured packets as a packet capture file, Packet Capture File;

[0020] Step S13: According to the MAC address of the IoT device, cut the capture file into separate small capture files according to different device types, so that each type of IoT device in the network has a corresponding packet capture file.

[0021] Further, in Step S2, the process of data preprocessing includes the following steps:

[0022] Step S21: Process the capture files of each type of IoT device one by one. When processing a capture file, traverse each packet in it, generate a five-tuple according to the source IP address, destination IP address, source port number, destination port number, and protocol type in the packet header. This five-tuple is called a flow identifier; then group all the packets according to the flow identifier;

[0023] Step S22: Check the protocol rules for each flow identifier group. For a TCP session, the data flow starts from the SYN packet and ends when a packet including FIN or RST is received; for a UDP session, it starts from the first packet and ends when the custom timeout period arrives; the packets in the flow identifier group that do not conform to the protocol rules will be discarded, and other packets will be grouped according to the flow identifier; the packets with the same flow identifier will be saved into the same newly created packet capture file and named with the flow identifier; a capture file of one flow identifier type, which is called a data flow sample, refers to the sequence of packets generated by the TCP or UDP session between the IoT device and the remote host.

[0024] Step S23: Extract features from each data flow sample. Statistically calculate the numerical features of the data flow through code, including the duration of the data flow, the number of upload and download packets, the number of upload and download bytes, the frequency of packet sending and receiving per second, and the eigenvalue of the throughput; form a vector by arranging these feature values in order as the vector sample of the data flow, and add the device label representing the sample source;

[0025] Step S24: Centralize and normalize all the processed vector samples, and then save them as a data set.

[0026] Further, in Step S3, the process of training the model in the pre-training stage includes the following steps:

[0027] Step S31: Initialize the network: Select a neural network f(·) as the encoder and randomly initialize its learnable parameters;

[0028] Step S32. Initialize the training data: Assume that there are N Internet of Things devices in the Internet of Things environment, and each Internet of Things device has M data stream vector samples that can participate in training. Then the training set contains a total of N * M samples. If the subscript is used to represent the serial number of the k-th sample x k in the training set, then the training set is represented as

[0029] Step S33. In each training cycle epoch, use the mini-batch gradient descent method to train the model, where each mini-batch sample training set is composed of 2N samples randomly selected from the training set, and each Internet of Things device has two samples;

[0030] Step S34. Calculate the representation vectors: Input all the samples x k in the mini-batch sample training set into the neural network f(·) respectively, and calculate the corresponding representation vectors z k . There are a total of 2N elements in the generated set of representation vectors {z};

[0031] Step S35. Calculate the similarity between samples: Calculate the cosine similarity between any two vectors in {z} in a loop. Let i ∈ {1,..., 2N} and j ∈ {1,..., 2N}, then the similarity s i，j between the i-th representation vector and the j-th representation vector is: s i，j = cos(z i , z j ). The set {s} composed of similarities s has a total of 2N * 2N elements;

[0032] Step S36. Calculate the contrast loss between samples: Let l i，j represent the contrast loss between the i-th representation vector and the j-th representation vector. Then the value of l i，j is:

[0033]

[0034] where exp(·) represents the exponential function with the natural logarithm constant e as the base; is an indicator function that takes the value 1 if and only if k ≠ i, and τ represents the temperature parameter;

[0035] Step S37. Calculate the total loss: Let the total loss of this training cycle be whose value is equal to the mean of the contrast losses between samples with adjacent serial numbers. Then the value of is:

[0036]

[0037] The total loss is obtained after calculation

[0038] Step S38, update the learnable parameters: According to the loss value Use the backpropagation algorithm to update the learnable parameters in the neural network f(·);

[0039] Step S39, repeat multiple rounds of training: Repeat steps S33 to S38 multiple times until the number of times reaches the user-defined maximum number of training times and then stop. The learnable parameters in the obtained neural network f(·) are the output of step S3.

[0040] Furthermore, in step S4, the process of training the model in the central vector training stage includes the following steps:

[0041] Step S41, calculate the central vector: For each type of Internet of Things device n, calculate its central vector c n ; Input all the training samples in the target Internet of Things device n into the neural network f(·) output by the contrastive pre-training stage to generate corresponding representation vectors. The set composed of these representation vectors is denoted as {z n}; Then, calculate the mean value of all the representation vectors in {z n}, which is the central vector c n ; Since each type of Internet of Things device will generate a central vector, the set of all generated central vectors is denoted as {c};

[0042] Step S42, initialize the training data: Assume that there are N Internet of Things devices in the Internet of Things environment, and each Internet of Things device has M data stream vector samples that can participate in training. Then the training set contains a total of N * M samples. The m-th training sample from the target Internet of Things device n is denoted as x n，m ;

[0043] Step S43, calculate the cosine distance: Input the sample x n，m into the neural network f(·) to obtain the corresponding representation vector z n,m , and then calculate the cosine distance between the representation vector z n,m and the central vector c n . Its value is where represents the learnable parameters of the neural network;

[0044] Step S44, calculate the total loss: Let the total loss of this round of training cycle be Its value is equal to the sum of the cosine distances between the representation vectors z n,m of all samples and the central vectors c n of their corresponding devices, plus a common regularization term, so as to set the loss function of the training process;

[0045] Step S45, Update learnable parameters: Calculate the loss value according to the loss function Use the backpropagation algorithm to update the learnable parameters in the neural network f(·);

[0046] Step S46, Repeat multiple rounds of training: Repeat steps S43 to S45 multiple times until the number of repetitions reaches the user-defined maximum number of training times and then stop. The learnable parameters in the obtained neural network f(·) and the set of center vectors {c} of each IoT device are the outputs of step S4.

[0047] Further, in step S44, the loss function in the training process is defined as:

[0048]

[0049] where the addend in the first part is used to calculate the mean of the cosine distances between all representation vectors and their respective center vectors, and the addend in the second part is the regularization term This is a common penalty term in the loss function, which is used to reduce the complexity of the model to prevent overfitting.

[0050] Further, in step S5, the process of detecting unknown samples using the trained model includes the following steps:

[0051] Step S51, When an unknown sample sent to the target IoT device n is obtained the model will input it into the neural network f(·) to generate the corresponding representation vector Then calculate the cosine distance between it and the centroid vector c of the IoT device n n and use this cosine distance as the anomaly score;

[0052] Step S52, If the anomaly score does not exceed the user-defined threshold, it is considered that the unknown sample is normal data flow, otherwise it is considered that the unknown sample may be abnormal data flow generated by a potential network attack.

[0053] The present invention also provides an unsupervised intrusion detection system for low-power IoT devices based on contrast learning, including a memory, a processor, and computer program instructions stored on the memory and capable of being run by the processor. When the processor runs the computer program instructions, it can implement the method steps as described in any of the above.

[0054] The present invention also provides a computer-readable storage medium, on which computer program instructions capable of being run by the processor are stored. When the processor runs the computer program instructions, it can implement the method steps as described in any of the above.

[0055] Compared with the prior art, the present invention has the following beneficial effects:

[0056] 1) The method of the present invention belongs to an unsupervised learning method. When training the model, no attack samples are required to participate, avoiding the cost of manual sampling;

[0057] 2) The method of the present invention generates a "central vector" for each type of device, enabling all devices to share a detection model and avoiding the additional overhead caused by training a model for each device in traditional unsupervised methods;

[0058] 3) The method introduces a contrastive learning mechanism, which is more suitable for the characteristics of low-power Internet of Things devices that generate only a small number of communication samples. In the case of only a small number of samples, the performance of intrusion detection is effectively improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 is a flowchart of the implementation of the method of the present invention.

[0060] Figure 2 is a system model diagram of the present invention applied in an Internet of Things scenario.

[0061] Figure 3 is a schematic diagram comparing the training strategies of the present invention with traditional unsupervised Internet of Things intrusion detection methods.

[0062] Figure 4 is a schematic diagram showing the positions of vectors and central vectors on a two-dimensional plane after the model training of the present invention is completed. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0063] The technical solution of the present invention will be specifically described below with reference to the accompanying drawings.

[0064] The present invention provides an unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning, including:

[0065] In the contrastive pre-training stage, a method for calculating the contrastive loss value is designed to extract the unique traffic features of the target Internet of Things device by distinguishing the traffic of the target Internet of Things device from the traffic of other Internet of Things devices;

[0066] In the central vector training stage, the central vector of each type of Internet of Things device is calculated; then, a loss function is designed to guide the model to reduce the cosine distance between the representation vectors of the same type of Internet of Things devices and their corresponding central vectors, thereby fitting the sample distributions of all Internet of Things devices within a single model.

[0067] In the detection stage, if an unknown sample is mapped by the model to an abnormal area far from the central vector, it is considered that the unknown sample may be an abnormal data stream generated by a potential network attack.

[0068] The following is the specific implementation process of the present invention.

[0069] As Figure 1 , 2 shown, an unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning is provided in an embodiment of the present invention, including the following steps:

[0070] Step S1: Data sampling. When deploying the Internet of Things environment, a network sniffing program is run on the Internet of Things gateway, and this program will capture and save communication packets from Internet of Things devices within the user-defined sampling period. Then, according to the MAC address of the device, the captured file is cut and reorganized according to the device type.

[0071] Step S2: Data preprocessing process. This process reorganizes the captured communication packets into "data stream" samples of TCP / UDP. Furthermore, feature extraction is performed on each "data stream" sample to generate corresponding vector samples. All processed vector samples are centralized for normalization processing and then saved as a data set.

[0072] Step S3: Contrastive pre-training process of the model. The method designs a specific method for calculating the contrastive loss value, and extracts the unique traffic characteristics of the target device by distinguishing the traffic of the target device from the traffic of other devices. During training, the loss value will guide the model to focus on the unique characteristics of the Internet of Things device traffic rather than the shared characteristics possessed by all traffic. Thus, the model can more efficiently learn its discriminative features from a small number of communication samples of low-power Internet of Things devices.

[0073] Step S4: Central vector training process of the model. The method calculates its "central vector" for each type of Internet of Things device. Then, the method designs a specific loss function. During training, this function guides the model to reduce the cosine distance between the representation vectors of the same type of device and their corresponding "central vectors", thereby fitting the sample distributions of all devices within a single model.

[0074] Step S5: Detection using the trained model. When an unknown sample sent to the target device is obtained, the model will generate a corresponding representation vector and calculate the cosine distance between this vector and the "central vector" of the target device as the anomaly score. If the anomaly score exceeds the user-defined threshold, it is considered that this sample may be an abnormal data stream generated by a potential network attack.

[0075] Figure 3 is a schematic diagram comparing the training strategies of the present invention and traditional unsupervised Internet of Things intrusion detection methods. Figure 4 is a schematic diagram showing the positions of the representation vectors and the central vectors on a two-dimensional plane after the model training of the present invention is completed.

[0076] Embodiment 1

[0077] The specific steps of step S1 include the following steps:

[0078] Step S11: Adopt the Internet of Things intrusion detection dataset CICIoT2022. This dataset is sourced from an Internet of Things environment physically deployed in a laboratory, which contains the normal traffic of 32 different types of Internet of Things devices and the attack traffic of 5 types.

[0079] Step S12: This dataset contains the normal traffic samples of the Internet of Things devices for 30 days in the active state and the normal traffic samples for 30 days in the idle state, totaling 1440 hours. Merge these traffic samples and save them as a "packet capture file".

[0080] Step S13: According to the MAC addresses of the Internet of Things devices provided by the dataset, cut the capture file into separate small capture files according to different device types. Each type of Internet of Things device in the network has a corresponding packet capture file.

[0081] The specific steps of step S2 include the following steps:

[0082] Step S21: Process the capture files of each type of Internet of Things device one by one. When processing a capture file, traverse each packet in it, generate a five-tuple according to the source IP address, destination IP address, source port number, destination port number, and protocol type in the packet header. This five-tuple is called a "flow identifier"; then group all the packets according to the "flow identifier".

[0083] Step S22: Conduct protocol rule checks on each "flow identifier" group. For a TCP session, the data stream starts from the SYN packet and ends when packets such as FIN and RST are received. For a UDP session, it starts from the first packet and ends when a custom timeout period arrives. Packets in the "flow identifier" group that do not conform to the protocol rules will be discarded, and other packets will be grouped according to the "flow identifier". Packets with the same "flow identifier" will be saved into the same newly created packet capture file and named with the "flow identifier". A capture file of this type is called a "data stream" sample, which refers to the sequence of packets generated by the TCP or UDP session between the Internet of Things device and the remote host.

[0084] Step S23: Extract features from each "data stream" sample. Statistically calculate the numerical features of the data stream through code, including the duration of the "data stream", the number of upload / download packets, the number of upload / download bytes, the packet sending and receiving frequency per second, the throughput, and other characteristic values. The vector composed of these characteristic values in order is used as the vector sample of the "data stream", and the "device" label representing the sample source is added. In this embodiment, there are a total of 76 characteristic values.

[0085] Step S24: Centralize and normalize all processed vector samples, and then save them as a data set.

[0086] The specific steps of step S3 are as follows:

[0087] Step S31: Initialize the network: Select a deep neural network DNN as the encoder f(·). This network has a total of 5 layers, where the dimension of the input layer is equal to the number of characteristic values in the data set, that is, 76; the number of neurons in the three hidden layers is set to 57, 38, and 25 respectively; the dimension of the output layer is 19. Initialize its learnable parameters using the random initialization strategy.

[0088] Step S32: Initialize the training data: In the Internet of Things environment corresponding to the CICIoT2022 data set, there are N = 32 Internet of Things devices using the IP protocol. Among them, there are low-power Internet of Things devices similar to D-Link DCHS-161, and this device generates only 0.6 samples per hour in the current scenario. Set each Internet of Things device to have M = 200 "data stream" vector samples that can participate in training. Then the training set contains a total of 6400 samples. If the subscript represents the serial number of the kth sample x k in the training set, then the training set can be represented as

[0089] Step S33: In each training cycle (epoch), train the model using the mini-batch gradient descent method, where each mini-batch sample training set is composed of 2N samples randomly selected from the training set, and each device has two samples.

[0090] Step S34: Calculate the representation vectors: Input all samples x k in the mini-batch sample training set into the neural network f(·) respectively, and calculate the corresponding representation vectors z k . There are a total of 2N elements in the generated vector set {z}.

[0091] Step S35: Calculate the similarity between samples: Calculate the cosine similarity between any two vectors in {z} in a loop. Let i ∈ {1,..., 2N} and j ∈ {1,..., 2N}, then the similarity s between the ith representation vector and the jth representation vectori，j The value is: s i，j = cos(z i , z j ), and the set {s} composed of the similarity degrees s has a total of 2N * 2N elements.

[0092] Step S36: Calculate the contrastive loss between samples: Let l i，j represent the contrastive loss between the i-th representation vector and the j-th representation vector, then the value of l i，j is:

[0093]

[0094] where exp(·) represents the exponential function with the natural logarithm constant e (approximately equal to 2.71828) as the base; is an indicator function that takes the value 1 if and only if k ≠ i, and τ represents the temperature parameter, which can be set to 0.01.

[0095] Step S37: Calculate the total loss: Let the total loss of this training cycle be whose value is equal to the mean of the contrastive losses between samples with adjacent serial numbers, then the value of is:

[0096]

[0097] After calculation, the total loss

[0098] Step S38: Update the learnable parameters. According to the loss value use the backpropagation algorithm to update the learnable parameters in the neural network f(·). Among them, the learning rate can be set to 0.001.

[0099] Step S39: Repeat multiple rounds of training: Repeat the steps from S33 to S38 multiple times until the number of times reaches the user-defined maximum number of training times (which can be set to 2000 times) and then stop. The learnable parameters in the obtained neural network f(·) are the output of Step S3.

[0100] Step S4 specifically includes the following steps:

[0101] Step S41: Calculate the "central vector": For each type of Internet of Things device n, calculate its central vector c n . Input all the training samples in the target device n into the neural network f(·) output in the contrastive pre-training stage to generate the corresponding representation vectors, and the set composed of these representation vectors is denoted as {z n}. Then, calculate the mean of all the representation vectors in {z n}, and this mean vector is the central vector cn Since each IoT device generates a central vector, the set of all generated central vectors is denoted as {c}.

[0102] Step S42: Initialize the training data: There are N = 32 devices in the current IoT environment, and each IoT device has M = 200 "data stream" vector samples that can participate in training. Then the training set contains a total of N * M = 6400 samples. The m-th training sample from the target device n is denoted as x n，m .

[0103] Step S43: Calculate the cosine distance: Input the sample x n，m into the neural network f(·) to obtain the corresponding representation vector z n,m , and then calculate the cosine distance between the representation vector z n,m and the central vector c n . The value is where, represents the learnable parameters of the neural network.

[0104] Step S44: Calculate the total loss: Let the total loss of this training cycle be Its value is equal to the sum of the cosine distances between all the representation vectors z n,m and the central vectors c of their corresponding devices n , plus a common regularization term. Therefore, the loss function of this training process can be defined as:

[0105]

[0106] where, the first addend is used to calculate the mean of the cosine distances between all the representation vectors and their respective central vectors. The second addend is the regularization term This is a common penalty term in the loss function, which is used to reduce the complexity of the model to prevent overfitting.

[0107] Step S45: Update the learnable parameters. Calculate the loss value according to the loss function Use the backpropagation algorithm to update the learnable parameters in the neural network f(·).

[0108] Step S46: Repeat multiple rounds of training: Repeat the steps from S43 to S45 multiple times until the number of times reaches the user-defined maximum number of training times (which can be set to 1000 times) and then stop. The learnable parameters in the obtained neural network f(·) and the set of central vectors {c} of each device are the outputs of step S4.

[0109] The specific steps of the said step S5 include the following steps:

[0110] Step S51: When an unknown sample destined for target device n is obtained the model will input it into neural network f(·) to generate a corresponding representation vector Then calculate the cosine distance between it and the centroid vector c of device n n and use this distance as the anomaly score.

[0111] For the current dataset, it provides the attack traffic in the current Internet of Things environment at the same time. After preprocessing, attack traffic samples can be generated for evaluation. To evaluate the performance of this method in intrusion detection of low-power Internet of Things devices, in terms of methods, it can be compared horizontally with similar unsupervised learning methods, such as: Autoencoder AE, DSVDD method, K-Nearest Neighbor (KNN), Histogram-based Outlier Score (HBOS), Local Outlier Factor (LOF), Isolation Forest (IForest), Local Density-based Outlier Detection (LODA). In terms of metrics, in order to evaluate the performance of unsupervised detection models, the Area under the Operating Characteristic Curve (AoC) is usually used as the evaluation metric. In terms of test operations, each type of attack traffic can be regarded as an independent anomaly and paired with normal traffic to form a set of test sets. The model is tested separately on each set of test sets, and the AoC is calculated. Finally, the mean value of the AoC of all test sets is used as the final result. In addition, to solve the problem of sample imbalance between normal samples and attack samples, different weights are assigned to the two types of samples so that their impacts are equalized. In addition, each method used in the evaluation can be initialized with different random number seeds and trained 10 times respectively. Each time during training, a specified number of samples are randomly selected from the normal samples to form a training set, and the test set is regenerated. This random number seed is also used to initialize the neural network parameters. Finally, the mean value of the test results after training the model 10 times is used as the final test metric.

[0112] Step S52: If the anomaly score does not exceed the user-defined threshold, it is considered that the unknown sample is normal data flow, otherwise it is considered that the sample may be an abnormal data flow generated by a potential network attack.

[0113] The user can select a suitable threshold for each device according to the characteristics of the traffic samples of the current Internet of Things device itself, or directly use 120% of the maximum anomaly score in the training normal samples as the threshold, or use other mature threshold setting schemes.

[0114] Embodiment 2

[0115] The specific steps of step S1 are as follows:

[0116] Step S11: Adopt the Internet of Things intrusion detection dataset CICIoT2023. This dataset is sourced from an Internet of Things environment physically deployed in a laboratory and is often used as an experimental evaluation benchmark for large-scale attack scenarios in the Internet of Things environment. The environment contains normal traffic of 42 different types of Internet of Things devices and attack traffic of 17 types.

[0117] Step S12: In this dataset, the sampling period of the normal traffic generated by the Internet of Things devices is 28 hours. These traffic samples are merged and saved as a "packet capture file".

[0118] Step S13: The operations in this step are the same as those in Embodiment 1.

[0119] The specific steps and operations included in Step S2 are the same as those in Embodiment 1.

[0120] The specific steps included in Step S3 are as follows:

[0121] Step S31: The operations in this step are the same as those in Embodiment 1.

[0122] Step S32: Initialize the training data: In the Internet of Things environment corresponding to the CICIoT2023 dataset, there are N = 42 Internet of Things devices using the IP protocol. Among them, there are low-power Internet of Things devices similar to Wemo smart plugs, and this device generates only 23 samples per hour in the current scenario. Set that each Internet of Things device has M = 200 "data stream" vector samples that can participate in training. Then the training set contains a total of 8400 samples. If the subscript represents the serial number of the kth sample x k in the training set, then the training set can be expressed as

[0123] The operations from Step S33 to Step S39 are the same as those in Embodiment 1.

[0124] The specific steps included in Step S4 are as follows:

[0125] Step S41: The operations in this step are the same as those in Embodiment 1.

[0126] Step S42: Initialize the training data: There are N = 42 devices in the current Internet of Things environment, and each Internet of Things device has M = 200 "data stream" vector samples that can participate in training. Then the training set contains a total of N * M = 8400 samples. The mth training sample from the target device n is denoted as x n，m .

[0127] The operations from Step S43 to Step S46 are the same as those in Embodiment 1.

[0128] The specific steps and operations included in Step S5 are the same as those in Embodiment 1.

[0129] Example 3

[0130] The specific steps of step S1 are as follows:

[0131] Step S11: Use the IoT intrusion detection dataset IoT-23. This dataset comes from three IoT scenarios and consists of normal traffic generated by running IoT devices. The environment contains normal traffic of 3 different types of IoT devices and attack traffic under 20 different scenarios.

[0132] Step S12: In this dataset, the sampling periods of the normal traffic generated by the three IoT devices are 22 hours, 5 hours, and 121 hours respectively. Merge these traffic samples and save them as a "packet capture file".

[0133] The operation of step S13 is the same as that in Example 1.

[0134] The specific steps and operations included in step S2 are the same as those in Example 1.

[0135] The specific steps of step S3 are as follows:

[0136] Step S31: The operation of this step is the same as that in Example 1.

[0137] Step S32: Initialize the training data: In the IoT environment corresponding to the IoT-23 dataset, there are N = 3 IoT devices using the IP protocol. Among them, there are low-power IoT devices similar to Philips HUE, and this device generates only 14 samples per hour in the current scenario. Set that each IoT device has M = 200 "data stream" vector samples that can participate in training. Then the training set contains a total of 600 samples. If the subscript represents the serial number of the kth sample x k in the training set, then the training set can be expressed as

[0138] The operations of steps S33 to S39 are the same as those in Example 1.

[0139] The specific steps of step S4 are as follows:

[0140] Step S41: The operation of this step is the same as that in Example 1.

[0141] Step S42: Initialize the training data: There are N = 3 devices in the current IoT environment, and each IoT device has M = 200 "data stream" vector samples that can participate in training. Then the training set contains a total of N * M = 600 samples. The mth training sample from the target device n is denoted as x n，m .

[0142] The operations of steps S43 to S46 are the same as those in Embodiment 1.

[0143] The specific steps and operations included in step S5 are the same as those in Embodiment 1.

Claims

1. An unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning, characterized in that, Including: In the contrast pre-training stage, a method for calculating the contrast loss value is designed to extract the unique traffic features of the target Internet of Things (IoT) device by distinguishing the traffic of the target IoT device from that of other IoT devices. In the central vector training stage, the central vector of each type of IoT device is calculated; then, a loss function is designed to guide the model to reduce the cosine distance between the representation vectors of the same type of IoT devices and their corresponding central vectors, so as to fit the sample distributions of all IoT devices within a single model. In the detection stage, if an unknown sample is mapped by the model to an abnormal area far from the central vector, it is considered that the unknown sample may be an abnormal data stream generated by a potential cyber-attack.

2. The unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning according to claim 1, wherein The method includes the following steps: Step S1, data sampling: When deploying the IoT environment, run a network sniffing program on the IoT gateway to capture and save the communication packets from IoT devices within the user-defined sampling period time. After that, according to the MAC addresses of the IoT devices, the captured file is cut and reorganized by device type. Step S2, data preprocessing process: Recombine the captured communication packets into TCP / UDP data stream samples, and then extract features from each data stream sample to generate corresponding vector samples; normalize all processed vector samples together and then save them as a data set. Step S3, contrast pre-training stage of the model: Design a method for calculating the contrast loss value to extract the unique traffic features of the target IoT device by distinguishing the traffic of the target IoT device from that of other IoT devices. During training, the loss value will guide the model to focus on the unique features of the IoT device traffic rather than the shared features of all traffic. Step S4, central vector training stage of the model: Calculate the central vector of each type of IoT device; then, design a loss function. During training, this loss function guides the model to reduce the cosine distance between the representation vectors of the same type of IoT devices and their corresponding central vectors, so as to fit the sample distributions of all IoT devices within a single model. Step S5, use the trained model for detection: When an unknown sample sent to the target IoT device is obtained, the model will generate a corresponding representation vector and calculate the cosine distance between this representation vector and the central vector of the target IoT device as the anomaly score. If the anomaly score exceeds the user-defined threshold, it is considered that the sample may be an abnormal data stream generated by a potential cyber-attack.

3. The unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning according to claim 2, characterized in that, In step S1, the process of data sampling includes the following steps: Step S11, run the network sniffing program Network Sniffer on the IoT gateway to capture the IP data packets from IoT devices. Step S12, at the end of the user-defined sampling period time, control the network sniffing program to stop capturing packets and save the captured packets as a packet capture file Packet Capture File. Step S13: According to the MAC address of the IoT device, cut the capture file into separate small capture files according to different device types, so that each type of IoT device in the network has a corresponding packet capture file.

4. The unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning according to claim 2, wherein In step S2, the data preprocessing process includes the following steps: Step S21: Process the capture files of each type of IoT device one by one. When processing a capture file, traverse each packet in it, generate a five-tuple based on the source IP address, destination IP address, source port number, destination port number, and protocol type in the packet header. This five-tuple is called a flow identifier; then group all packets by the flow identifier. Step S22: Check the protocol rules for each group of flow identifiers. For a TCP session, the data flow starts from the SYN packet and ends when a packet including FIN or RST is received; for a UDP session, it starts from the first packet and ends when a custom timeout period arrives; packets in the flow identifier group that do not conform to the protocol rules will be discarded, and other packets will be grouped according to the flow identifier; packets with the same flow identifier will be saved to the same newly created packet capture file and named with the flow identifier; a capture file of one flow identifier type, which refers to a sequence of packets generated by the TCP or UDP session between the IoT device and the remote host, is called a data flow sample. Step S23: Extract features from each data flow sample. Statistically calculate the numerical features of the data flow through code, including the duration of the data flow, the number of upload and download packets, the number of upload and download bytes, the frequency of packet sending and receiving per second, and the eigenvalue of throughput; form a vector composed of these feature values in order as the vector sample of the data flow, and add the device label representing the sample source. Step S24: Centralize and normalize all processed vector samples, and then save them as a data set.

5. The unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning according to claim 2, wherein In step S3, the process of training the model in the pre-training stage includes the following steps: Step S31: Initialize the network: Select a neural network f(·) as the encoder and randomly initialize its learnable parameters. Step S32. Initialize the training data: Assume that there are N Internet of Things devices in the Internet of Things environment, and each Internet of Things device has M data stream vector samples that can participate in training. Then the training set contains a total of N * M samples. If the subscript is used to represent the sequence number of the k-th sample x k in the training set, then the training set is represented as Step S33: In each training epoch, the model is trained using mini-batch gradient descent, where each mini-batch sample training set consists of 2N samples randomly selected from the training set, with two samples for each IoT device; Step S34, calculate the representation vectors: Input all samples x in the mini-batch sample training set k into the neural network f(·) respectively, and calculate the corresponding representation vectors z k . There are a total of 2N elements in the generated set of representation vectors {z}; Step S35, calculate the similarity between samples: loop to calculate the cosine similarity between any two vectors in {z}. Let i ∈ {1,..., 2N} and j ∈ {1,..., 2N}, then the similarity s i，j between the i-th representation vector and the j-th representation vector is: s i，j = cos(z i , z j ). The set {s} composed of similarities s has a total of 2N * 2N elements; Step S36, calculate the pairwise contrastive loss: Let l i，j represent the contrastive loss between the i-th representation vector and the j-th representation vector, then the value of l i，j is: where exp(·) represents the exponential function with the natural logarithm constant e as the base; is an indicator function that takes the value 1 if and only if k ≠ i, and τ represents the temperature parameter; Step S37, calculate the total loss: Let the total loss of this training cycle be Its value is equal to the mean of the inter-sample contrast losses between all samples with adjacent serial numbers. Then The value of is: The total loss is obtained after calculation Step S38, update the learnable parameters: According to the loss value Use the backpropagation algorithm to update the learnable parameters in the neural network f(·); Step S39: Repeat the training for multiple rounds: Repeat steps S33 to S38 multiple times until the number of repetitions reaches the maximum number of training times defined by the user and then stop. The learnable parameters in the obtained neural network f(·) are the output of step S3.

6. The unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning according to claim 5, wherein In step S4, the process of training the model in the central vector training stage includes the following steps: Step S41, calculate the central vector: For each type of IoT device n, calculate its central vector c n ; Input all the training samples in the target IoT device n into the neural network f(·) output in the contrastive pre-training stage to generate corresponding representation vectors, and the set composed of these representation vectors is denoted as {z n}; Then, calculate the mean value of all the representation vectors in {z n}, that is, the central vector c n ; Since each type of IoT device will generate a central vector, the set of all generated central vectors is denoted as {c}; Step S42: Initialize training data: Assume that there are N Internet of Things devices in the Internet of Things environment, and each Internet of Things device has M data stream vector samples that can participate in training. Then the training set contains a total of N * M samples. The m-th training sample from the target Internet of Things device n is denoted as x n，m ; Step S43, calculate the cosine distance: Input the sample x n，m into the neural network f(·) to obtain the corresponding representation vector z n,m , and then calculate the cosine distance between the representation vector z n,m and the center vector c n , and its value is where represents the learnable parameters of the neural network; Step S44, calculate the total loss: Let the total loss of this training cycle be which is equal to the sum of the cosine distances between the representation vectors z n,m of all samples and the center vectors c n of their corresponding devices, plus a common regularization term, so as to set the loss function of the training process; Step S45, update the learnable parameters: calculate the loss value according to the loss function Use the backpropagation algorithm to update the learnable parameters in the neural network f(·); Step S46: Repeat the training for multiple rounds: Repeat steps S43 to S45 multiple times until the number of repetitions reaches the maximum number of training times defined by the user and then stop. The learnable parameters in the obtained neural network f(·) and the set of central vectors {c} for each IoT device are the output of step S4.

7. The unsupervised intrusion detection method for low-power Internet of Things devices based on contrastive learning according to claim 6, wherein In step S44, the loss function of the training process is defined as: Among them, the addend in the first part is used to calculate the mean value of the cosine distances between all representation vectors and their respective center vectors, and the addend in the second part is a regularization term This is a common penalty term in the loss function, which is used to reduce the complexity of the model to prevent overfitting.

8. The unsupervised intrusion detection method for low-power IoT devices based on contrastive learning according to claim 6, characterized in that In step S5, the process of detecting unknown samples using the trained model includes the following steps: Step S51: When an unknown sample sent to the target IoT device n is obtained The model will input it into the neural network f(·) to generate the corresponding representation vector Then calculate the cosine distance between the representation vector and the centroid vector c n of the IoT device n, and use this cosine distance as the anomaly score; Step S52: If the anomaly score does not exceed the user-defined threshold, the unknown sample is considered to be normal data flow; otherwise, the unknown sample may be abnormal data flow generated by potential network attacks.

9. An unsupervised intrusion detection system for low-power Internet of Things devices based on contrastive learning, characterized in that, It includes a memory, a processor, and computer program instructions stored on the memory and executable by the processor. When the processor runs the computer program instructions, the method steps described in any one of claims 1-8 can be implemented.

10. A computer-readable storage medium, on which computer program instructions executable by a processor are stored. When the processor runs the computer program instructions, the method steps described in any one of claims 1-8 can be implemented.

Images