Internet of Things gateway enhancement method and system based on traffic monitoring and mimetic feedback

Abstract

The present invention discloses an Internet of Things gateway enhancement method and system based on traffic monitoring and mimetic feedback. The method uses an unsupervised trained autoencoder as a detection unit to determine whether a network traffic sequence is abnormal. The distribution component receives the network traffic sequence determined to be normal from the detection unit, copies it into multiple copies, and then transmits it to multiple heterogeneous executors. The arbitration component collects the execution results returned by each heterogeneous executor, and weights the credibility of the heterogeneous executor based on whether the historical execution results of the heterogeneous executor are correct. The arbitration result is obtained by combining a majority arbitration mechanism based on historical execution results. When the detection unit or the arbitration component captures an abnormal network traffic sequence, the forged data generation component generates forged data traffic as a response and sends it to the attacker. The present invention can enhance the dynamic adaptability of the mimetic defense system and improve its anti-attack capability.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security protection technology, and in particular to an Internet of Things gateway enhancement method and system based on traffic monitoring and mimetic feedback, which is suitable for network security defense in scenarios such as smart homes, industrial automation, and smart transportation. Background Art

[0002] As an emerging technology, the Internet of Things (IoT) is widely used in fields such as smart homes, industrial automation, and intelligent transportation. It collects, processes, and transmits information through sensors, devices, and network connections. Gateways, acting as bridges between IoT devices and cloud platforms or other networks, are crucial in IoT communications.

[0003] As IoT devices proliferate and their application scenarios become more complex, traditional IoT gateways (such as firewalls and intrusion detection systems) are struggling to cope with new cyberattacks. Their limitations are becoming apparent when faced with unknown attacks like advanced persistent threats and zero-day attacks. Attackers can circumvent traditional security mechanisms by spoofing traffic and changing attack patterns, posing serious cybersecurity threats.

[0004] Traffic monitoring is at the core of network security defense. Previous machine learning-based methods have been replaced by deep learning methods due to their limited generalization capabilities. While deep learning-based anomaly detection methods can improve detection accuracy, they rely on large amounts of labeled data for training. Labeled data is expensive to acquire and difficult to obtain in sufficient quantities in practical applications, limiting training effectiveness and detection efficiency.

[0005] Mimicry defense technology dynamically alters system structure, behavior, or state to make it more difficult for attackers to understand. However, existing technologies often rely on static rules, redundant pools, or hardware-level changes to passively detect and defend against attack traffic, lacking a proactive defense feedback process. After repeated attempts, attackers can easily identify system vulnerabilities, bypass static defense mechanisms, obtain sensitive information, or cause service interruptions.

[0006] Patent publication number CN119382980A proposes a mimetic distribution and adjudication method based on deep learning traffic monitoring, comprising data preprocessing, network traffic detection, distribution, adjudication, and execution modules. Its drawbacks are that system training relies on labeled datasets, and the quality and quantity of labeled data affect model training effectiveness. This makes it difficult to meet training requirements in real-world network traffic environments, potentially impacting detection accuracy. Furthermore, the system relies on traditional anomaly detection methods, making it incapable of dynamic, mimetic data perturbations. The method lacks active defense and data mimetic mechanisms, posing security challenges.

[0007] Patent publication number CN113973008A proposes a detection system, method, device, and medium based on mimicry technology and machine learning. It covers modules for data reception and preprocessing, attack detection and classification, data filtering and decision-making, and heterogeneous data execution. The problem is that the detection unit uses traditional machine learning models, which struggle to cope with complex network traffic and lack accuracy and generalization capabilities. Furthermore, it relies on high-quality training data, which is prone to overfitting when the data lacks richness or diversity, making it ineffective in detecting unknown attack types. Summary of the Invention

[0008] The present invention aims to solve the problems existing in the IoT gateway defense mechanism in the prior art, and provide a mimetic defense method and system based on deep learning traffic monitoring and data mimicry, to enhance the dynamic adaptability of the mimetic defense system, reduce the model training cost, and improve the system availability, security and anti-attack capability.

[0009] The present invention is implemented through the following technical solutions: an IoT gateway enhancement method based on traffic monitoring and mimetic feedback, comprising:

[0010] S1: Perform data preprocessing on the network traffic sequence to limit the value of the network traffic sequence to the range of [0,1];

[0011] S2: An unsupervised autoencoder is used as the detection unit. The network traffic sequence after data preprocessing is input into the autoencoder for reconstruction. The reconstruction loss is used as the anomaly score to determine whether the network traffic sequence is abnormal.

[0012] S3: The distribution component receives the normal network traffic sequence from the detection unit, replicates it, and transmits it to multiple heterogeneous execution bodies.

[0013] S4: Multiple heterogeneous executors process the network traffic sequences distributed by the distribution component and send the execution results to the arbitration component;

[0014] S5: The adjudication component collects the execution results returned by each heterogeneous executor, adjusts the trustworthiness of the heterogeneous executor based on the correctness of its historical execution results, and then uses a majority adjudication mechanism based on historical execution results to determine the adjudication result.

[0015] S6: When the detection unit or the adjudication component captures an abnormal network traffic sequence, the forged data generation component is activated; the forged data generation component generates forged data traffic as a response and sends it to the attacker.

[0016] Further preferably, in step S2, an autoencoder based on contrastive learning is used to extract features of the network traffic sequence, and the total loss function is:

[0017] ;

[0018] in, is the total loss of the autoencoder, is the contrast loss, is the positive sample reconstruction loss, is the negative sample reconstruction loss, and α are adjustable hyperparameters.

[0019] Further preferably, the distribution component is built based on the Python language, and the Flask framework is used to establish the service interface. During the distribution process, the RabbitMQ message queue is used for asynchronous distribution, supporting multiple distribution strategies.

[0020] It is further preferred that each heterogeneous executor runs independently, and the total number of heterogeneous executors must be at least three. It receives the network traffic sequence distributed by the distribution component, selects three processing network traffic sequences from the heterogeneous executor pool each time according to the random selection algorithm, and processes them according to its own environment and configuration, and finally returns the processing results to the arbitration component.

[0021] Further preferably, the specific process of the majority decision mechanism based on historical execution results is as follows: n heterogeneous executors constitute a heterogeneous executor set; for any voting cycle, a corresponding historical confidence set is defined; if the i-th heterogeneous executor If the historical execution result of is determined by the majority in this round of voting, its historical confidence is assigned a value of 1, otherwise it is assigned a value of 0;

[0022] In N consecutive voting cycles, the frequency of each heterogeneous executor passing the vote is counted and recorded as the cumulative confidence , which is defined as follows:

[0023] ;

[0024] in, Indicates the i-th heterogeneous executor in the j-th voting cycle The historical confidence value of

[0025] Cumulative confidence Perform normalization to obtain normalized confidence :

[0026] ;

[0027] Where n is the number of heterogeneous executors;

[0028] Multiply the voting result of each heterogeneous executor by the normalized confidence The corrected decision score is then used, and the final decision is output based on the principle of majority decision, that is, the decision with the highest score.

[0029] Further preferably, the forged data generation component is based on a generative adversarial network (GAN) to generate forged data traffic through adversarial training.

[0030] Further preferably, the fake data generation component adopts a conditional generative adversarial network (cGAN) framework, which is collaboratively trained by a generator, a semantic discriminator, and a statistical discriminator.

[0031] The present invention also provides an IoT gateway enhancement system based on traffic monitoring and mimetic feedback, comprising:

[0032] A detection unit is used to input the network traffic sequence after data preprocessing into the autoencoder for reconstruction, and use the reconstruction loss as the anomaly score to determine whether the network traffic sequence is abnormal;

[0033] The distribution component receives the normal network traffic sequence from the detection unit, replicates it into multiple copies, and then transmits it to multiple heterogeneous execution bodies;

[0034] Heterogeneous executors: Multiple heterogeneous executors process the network traffic sequences distributed by the distribution component and send the execution results to the arbitration component;

[0035] The adjudication component collects the execution results returned by each heterogeneous executor, adjusts the credibility of the heterogeneous executor based on whether its historical execution results are correct, and then uses a majority adjudication mechanism based on historical execution results to determine the adjudication result.

[0036] The forged data generation component is activated when the detection unit captures an abnormal network traffic sequence; the forged data generation component generates forged data traffic as a response and sends it to the attacker.

[0037] The beneficial effects of the present invention are mainly reflected in the following two key aspects:

[0038] 1. Implement active defense and improve security performance: This invention innovatively introduces an active defense mechanism based on mimetic defense. By combining mimetic data with a generative adversarial network (GAN), a complete defense chain from "attack detection" to "attack misdirection" is established. Once abnormal traffic is detected, the system not only blocks traffic delivery but also calls a GAN model trained on normal system response data to feed back forged normal response data to the attacker. This makes it difficult for attackers to determine the success of the attack and the true state of the system, effectively increasing the difficulty of the attack and slowing down the attack process. When facing unknown or new attacks, this defense mechanism makes the system more adaptable and proactive, greatly improving the overall security and anti-attack capabilities of the system. Compared with traditional passive defense methods, it provides more comprehensive security protection and significantly improves the defense effectiveness.

[0039] 2. Reduce training costs and enhance generalization capabilities: The present invention uses an unsupervised deep learning model based on an autoencoder to detect traffic anomalies. Unlike traditional supervised learning models that rely on a large amount of labeled data for training, the autoencoder only needs to be trained using normal traffic data. In the field of network security, labeled data is difficult and costly to obtain, and this feature of the autoencoder effectively reduces the dependence on labeled data and significantly reduces training costs. At the same time, the model can learn the characteristic patterns of normal traffic, and the generalization ability is improved, which can more effectively detect unknown abnormal traffic. It is especially suitable for actual application scenarios where labeled data is difficult or costly to obtain. While reducing deployment costs, it can also effectively identify and isolate attack behaviors before they enter the system.

[0040] In summary, the present invention enhances the dynamic adaptability of the mimetic defense system through the collaborative work of the above-mentioned dual mechanisms, enabling it to flexibly respond to complex attacks and network threats. It also reduces the cost of model training, enhances usability, and significantly improves the actual application effect and technological advancement of the mimetic defense system, providing more efficient and accurate protection for the Internet of Things gateway in a complex network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 Flowchart of the present invention. DETAILED DESCRIPTION

[0042] The present invention will be further described in detail below with reference to the accompanying drawings.

[0043] Reference Figure 1 ,The IoT gateway enhancement method based on traffic monitoring and mimetic feedback includes:

[0044] S1: Perform data preprocessing on the network traffic sequence to limit the value of the network traffic sequence to the range of [0,1];

[0045] S2: Use an unsupervised trained autoencoder as the detection unit, input the network traffic sequence after data preprocessing into the autoencoder for reconstruction, and use the reconstruction loss as the anomaly score to determine whether the network traffic sequence is abnormal. The autoencoder includes an encoder and decoder architecture and can be trained in an unsupervised manner using only normal network traffic sequences. This training method allows the model to grasp the pattern characteristics of normal network traffic sequences. Because the autoencoder is only trained on normal network traffic sequences, it can only reconstruct normal network traffic sequences, while abnormal network traffic sequences will have a large reconstruction loss. The present invention uses the reconstruction loss as the judgment criterion and judges network traffic sequences whose reconstruction loss exceeds the threshold as abnormal;

[0046] S3: The distribution component receives the normal network traffic sequence from the detection unit, replicates it, and transmits it to multiple heterogeneous execution bodies.

[0047] S4: Multiple heterogeneous executors process the network traffic sequence distributed by the distribution component respectively, and send the execution results to the arbitration component. The heterogeneous executors based on mimicry defense are composed of different hardware platforms, operating systems or virtualization environments. These heterogeneous executors together form a heterogeneous executor pool. Through the scheduling algorithm, the system can dynamically select and switch the selected heterogeneous executors, so that each time a task is processed, the heterogeneous executor that actually carries the calculation may change. Due to the diversity and switching mechanism of heterogeneous executors, these heterogeneous executors can analyze and process the same network traffic sequence in different ways when receiving it. This dynamic switching execution method makes it more difficult for attackers to bypass security defenses through attack methods targeting a single executor, thereby enhancing the overall security and defense capabilities of the system;

[0048] S5: The arbitration component collects the execution results returned by each heterogeneous executor, and adjusts the weight of the credibility of the heterogeneous executor according to whether the historical execution results of the heterogeneous executor are correct, and obtains the arbitration result by combining the majority arbitration mechanism based on the historical execution results. The judgment results returned by each heterogeneous executor are summarized, and the arbitration component adjusts the credibility of the heterogeneous executor according to whether the historical execution results of the heterogeneous executor are correct, giving higher weights to heterogeneous executors with high credibility. If the majority of heterogeneous executors believe that the network traffic sequence is normal, the arbitration component determines that the network traffic sequence is normal and returns a normal response; if the majority of heterogeneous executors believe that the network traffic sequence is abnormal, it is determined to be an abnormal network traffic sequence. This multiple decision-making mechanism improves the overall accuracy and fault tolerance of the system, reduces the possible misjudgment of a single heterogeneous executor, and assists the system in making more robust decisions;

[0049] S6: When the detection unit or adjudication component detects an abnormal network traffic sequence, the forged data generation component is activated. This component generates forged data traffic as a response and sends it to the attacker. This component uses a GAN model to generate simulated data. The GAN model is trained based on the system's normal response data. When the detection unit or adjudication component detects an abnormal network traffic sequence, the forged data generation component generates forged traffic data to simulate the system's normal response under attack. This prevents the attacker from determining whether their attack intent has been detected and, consequently, from determining the system's true state, increasing the cost and difficulty of the attack.

[0050] The purpose of data preprocessing is to cleanse and standardize network traffic sequences, making subsequent detection and analysis more efficient and accurate. During this stage, network traffic sequence attributes (such as traffic volume, timestamp, source IP address, destination IP address, etc.) are scaled to a certain range (e.g., 0 to 1 or -1 to 1) to eliminate differences in the magnitude of different eigenvalues. Generally, the network traffic sequence is first fitted to determine the maximum and minimum values. These maximum and minimum values ​​are used to normalize the network traffic sequence, limiting its values ​​to the range [0, 1].

[0051] An autoencoder is a model architecture that can be trained on unsupervised normal data for anomaly detection. It consists of two parts: an encoder and a decoder. Represents a normal network traffic sequence, where is the dimension of normal network traffic sequence, is the sample size, is the feature dimension of each sample. In order to effectively capture the characteristics of normal network traffic sequences, an autoencoder based on contrastive learning is used to extract more diverse features of network traffic sequences and effectively model the difference between normal network traffic sequences and abnormal network traffic sequences. Positive samples are constructed by randomly selecting some other normal network traffic sequences. , and construct negative samples with pseudo-anomalies by injecting disturbances, packet loss or protocol misalignment Then, the positive and negative samples are fed into the encoder module composed of stacked Transformer encoders to extract the potential features of the positive samples. and negative sample latent features , to capture key temporal dependencies and semantic features. To further enhance the model's discriminative capabilities, a contrastive learning mechanism is introduced. This contrastive learning loss function narrows the feature distances between positive samples in the latent space and increases the feature distances between them and negative samples, thereby optimizing the structure of the latent feature space. The contrastive learning loss function uses the InfoNCE loss.

[0052] Subsequently, the latent features obtained by the encoder are fed into the decoder built on LSTM for sequence reconstruction. The reconstruction results of positive and negative samples are obtained respectively, and the reconstruction loss is calculated. Obviously, the desired model can better reconstruct positive samples while maintaining a larger reconstruction loss for negative samples. Therefore, the final training objective is a combination of contrast loss and reconstruction loss, and its total loss function is defined as follows:

[0053] ;

[0054] in, is the total loss of the autoencoder, is the contrast loss, is the positive sample reconstruction loss, is the negative sample reconstruction loss, Both α and α are adjustable hyperparameters that balance the weights between the contrast loss and the reconstruction loss between positive and negative samples. During inference, the model identifies anomalies based solely on the reconstruction loss of the input network traffic sequence: if the reconstruction loss of a particular input exceeds a preset threshold, the network traffic sequence is identified as an anomaly.

[0055] The distribution component is built in Python and uses the Flask framework to establish a service interface for receiving and processing network traffic sequences from detection units. The Flask framework is known for its lightweight and flexible nature, making it ideal for rapid development and testing. After receiving the network traffic sequence, the distribution component preprocesses it, including parsing and filtering, to ensure efficient and accurate subsequent processing. The processed network traffic sequence is then distributed to multiple heterogeneous executors to achieve system redundancy and diversified processing.

[0056] During the distribution process, RabbitMQ message queues are used for asynchronous distribution, supporting various distribution strategies such as round-robin, random, and weighted round-robin. RabbitMQ, with its high throughput and reliability, ensures stable traffic distribution even under high loads. By using message queues, the distribution component can effectively manage traffic distribution, ensuring efficient system operation in complex network environments.

[0057] To ensure high system availability and fault tolerance, the distribution component uses Nginx for load balancing. Nginx distributes traffic evenly across multiple distribution component instances, preventing single points of failure and automatically switching to the next instance in the event of a distribution component failure, ensuring system continuity. Furthermore, combined with containerization technology, the distribution component can dynamically scale resources to adapt to varying load demands, further enhancing system flexibility and maintenance efficiency.

[0058] The heterogeneous executor is the core processing unit of the mimicry defense system, responsible for receiving and processing the network traffic sequence distributed by the distribution component. Each heterogeneous executor runs on a different hardware architecture and operating system, ensuring system redundancy and diversity. The following is the specific implementation scheme and workflow of the heterogeneous executor:

[0059] In this solution, heterogeneous executors are based on ARM and x86 hardware architectures, combined with Ubuntu and CentOS operating systems, and managed in a containerized manner using Docker and Kubernetes. Each heterogeneous executor runs independently, and there must be at least three heterogeneous executors in total. Each executor receives network traffic sequences distributed by the distribution component, randomly selects three from the heterogeneous executor pool to process the network traffic sequences, processes them based on their own environment and configuration, and returns the results to the arbitration component.

[0060] As a key component of the mimicry defense system, the arbitration component is responsible for comparing and judging the processing results from multiple heterogeneous executors, ensuring the accuracy and reliability of the system's final decision. The arbitration component uses a majority decision mechanism based on historical execution results, ensuring the system can respond correctly.

[0061] The adjudication component is implemented using the Python Flask framework to build a service interface to receive execution results from heterogeneous executors. After processing a network traffic sequence, each heterogeneous executor sends the execution results to the adjudication component via a predefined communication mechanism. These results include information such as the network traffic sequence classification (normal / abnormal), attack type identification, and risk scoring. The adjudication component aggregates and analyzes these results. To enhance the reliability of the adjudication mechanism, the final decision is determined through a majority decision based on historical execution results.

[0062] The specific process of the majority decision mechanism based on historical execution results is as follows: Assume that the system contains n heterogeneous executors, forming a heterogeneous executor set , represents the i-th heterogeneous executor, and n is the number of heterogeneous executors. For any voting cycle, the corresponding historical confidence set is defined as , is the i-th heterogeneous execution body The historical confidence value of . If the i-th heterogeneous execution body If the execution result of is decided by the majority in this round of voting, its historical confidence is assigned a value of 1, otherwise it is assigned a value of 0.

[0063] In N consecutive voting cycles, the frequency of each heterogeneous executor passing the vote is counted and recorded as the cumulative confidence , which is defined as follows:

[0064] ;

[0065] in, Indicates the i-th heterogeneous executor in the j-th voting cycle The historical confidence value of the execution body is used to reflect the stability and reliability of the execution body in the long term operation.

[0066] To achieve comparability between heterogeneous execution bodies, the cumulative confidence Perform normalization to obtain normalized confidence :

[0067] ;

[0068] Where n is the number of heterogeneous executors; the normalized result can be regarded as the number of heterogeneous executors. The historical reliability measurement value of . This indicator can not only characterize the behavioral stability of heterogeneous executors during system operation, but also serve as a credibility reference factor in subsequent voting and task scheduling, improving the system's response accuracy when facing different attack modes. The voting result of each heterogeneous executor is multiplied by the normalized confidence The corrected decision score is used as the final decision, and the majority decision is made based on the principle of majority decision, that is, the decision with the highest score is output as the final decision.

[0069] By integrating and normalizing historical confidence, the system captures performance differences between executors at different stages, effectively identifying heterogeneous executors with high robustness. This approach also avoids the random biases associated with relying on minority voting results, improving the accuracy and adaptability of the system's overall decision-making mechanism.

[0070] The fake data generation component is based on a generative adversarial network (GAN). Through adversarial training, it generates fake data traffic that is highly similar to real data, confusing attackers and delaying or preventing the attack process. The following is its specific implementation process:

[0071] First, the system collects response data from normal network traffic sequences, including HTTP responses and TCP / IP packets. This data must be representative and diverse to ensure the generated virtual data covers a variety of scenarios. The collected data is cleaned and preprocessed to ensure data quality and consistent formatting.

[0072] The fake data generation component uses the conditional generative adversarial network (cGAN) framework, which is trained collaboratively by the generator G, the semantic discriminator D1, and the statistical discriminator D2. The generator first maps the random noise vector z and the conditional vector c through a fully connected layer and then concatenates them. It then extracts semantic features through multiple layers of residual blocks including conditional batch normalization (CBN) and inputs these semantic features into the LSTM network to generate a temporal hidden state sequence of length T. , t is the time step, T is the total number of time steps. At each time step t, the generator uses the current hidden state The packet interval is predicted separately through three parallel feedforward networks , Packet length TCP flag vector , the prediction process is defined as:

[0073] ;

[0074] in, is the packet interval time, is the packet interval at time step t, is the packet interval parameter matrix, is the packet interval time offset matrix, is the packet length, is the packet length at time step t, is the packet length parameter matrix, is the packet length bias matrix, is the TCP flag bit vector, is the TCP flag bit vector at time step t, is the TCP flag bit vector parameter matrix, is the TCP flag vector bias matrix, ReLU and sigmoid are two activation functions, ReLU and sigmoid are used to regress continuous values ​​and output multi-dimensional probability vectors respectively. The entire packet-level sequence Constitutes a complete package-level behavior trajectory. The hidden state at the end of the sequence It is regarded as an aggregated semantic representation and used to further predict flow-level statistical summary features through a multi-layer perceptron (MLP) :

[0075] ;

[0076] in Represents a nonlinear mapping network used to fit statistical features.

[0077] Semantic Discriminator To generate or real packet sequence With the conditional vector As input, three types of features are first embedded through three parallel sub-networks, then concatenated and sent to a multi-layer unidirectional LSTM network, and the context information is fused using conditional batch normalization (CBN). Finally, the hidden state and the conditional vector are concatenated, and the true or false probability of the semantic layer is output through the sigmoid function.

[0078] The statistical discriminator D2 uses flow-level statistical summaries With the packet-level statistical sequence as input, the low-order statistical features and high-order local patterns are extracted respectively through the dual-branch structure. Input multi-layer perceptron, the other way is After one-dimensional convolution processing, it is finally fused with the conditional vector and input into sigmoid to output the overall authenticity score.

[0079] The loss functions of both discriminators are cross entropy loss functions.

[0080] The optimization goal of the generator G is:

[0081] ;

[0082] in, Express expectations, represents the i-th discriminator, and are the strength coefficients of the two control confusion enhancement terms, z is the random noise vector, and c is the conditional vector.

[0083] After training is completed, when the model detects the attack behavior and receives the context condition c triggered by the intrusion behavior, the model generates a simulation packet-level sequence in real time, inserts a handshake packet or maintains the state machine with the help of the protocol controller, and injects or writes the pcap file through Scapy / libpcap to achieve high-fidelity virtual service simulation, effectively delaying the attacker's identification and decision-making process, and building an active defense system that integrates multiple protocols and multiple scenarios.

[0084] Another embodiment further provides an IoT gateway enhancement system based on traffic monitoring and mimetic feedback, including:

[0085] A detection unit is used to input the network traffic sequence after data preprocessing into the autoencoder for reconstruction, and use the reconstruction loss as the anomaly score to determine whether the network traffic sequence is abnormal;

[0086] The distribution component receives the normal network traffic sequence from the detection unit, replicates it into multiple copies, and then transmits it to multiple heterogeneous execution bodies;

[0087] Heterogeneous executors: Multiple heterogeneous executors process the network traffic sequences distributed by the distribution component and send the execution results to the arbitration component;

[0088] The adjudication component collects the execution results returned by each heterogeneous executor, adjusts the credibility of the heterogeneous executor based on whether its historical execution results are correct, and then uses a majority adjudication mechanism based on historical execution results to determine the adjudication result.

[0089] The forged data generation component is activated when the detection unit captures an abnormal network traffic sequence; the forged data generation component generates forged data traffic as a response and sends it to the attacker.

[0090] The above description merely represents preferred embodiments of the present invention and is not intended to limit the present invention in any other manner. Any person skilled in the art may utilize the above disclosure to modify or modify the present invention into equivalent embodiments. However, any simple modifications, equivalent variations, and modifications to the above embodiments that do not depart from the technical content of the present invention and are based on the technical essence of the present invention remain within the scope of protection of the present invention.

Claims

1. An IoT gateway enhancement method based on traffic monitoring and mimetic feedback is characterized by: include: S1: Perform data preprocessing on the network traffic sequence to limit the value of the network traffic sequence to the range of [0,1]; S2: An unsupervised autoencoder is used as the detection unit. The network traffic sequence after data preprocessing is input into the autoencoder for reconstruction. The reconstruction loss is used as the anomaly score to determine whether the network traffic sequence is abnormal. S3: The distribution component receives the normal network traffic sequence from the detection unit, replicates it, and transmits it to multiple heterogeneous execution bodies. S4: Multiple heterogeneous executors process the network traffic sequences distributed by the distribution component respectively and send the execution results to the arbitration component; S5: The adjudication component collects the execution results returned by each heterogeneous executor, adjusts the trustworthiness of the heterogeneous executor based on the correctness of its historical execution results, and then uses a majority adjudication mechanism based on historical execution results to determine the adjudication result. S6: When the detection unit or adjudication component captures an abnormal network traffic sequence, the forged data generation component is activated. Based on a generative adversarial network, the forged data generation component generates forged data traffic as a response through adversarial training and sends it to the attacker. The forged data generation component adopts a conditional generative adversarial network framework and is trained collaboratively by the generator G, the semantic discriminator D1, and the statistical discriminator D2. The generator first maps the random noise vector z and the conditional vector c through the fully connected layer and then concatenates them. It then extracts semantic features through multiple layers of residual blocks containing conditional batch normalization and inputs the semantic features into the LSTM network to generate a temporal hidden state sequence of length T. , t is the time step, T is the total number of time steps; at each time step t, the generator uses the current hidden state The packet interval is predicted separately through three parallel feedforward networks , Packet length TCP flag vector , the prediction process is defined as: ； in, is the packet interval time, is the packet interval at time step t, is the packet interval parameter matrix, is the packet interval time offset matrix, is the packet length, is the packet length at time step t, is the packet length parameter matrix, is the packet length bias matrix, is the TCP flag bit vector, is the TCP flag bit vector at time step t, is the TCP flag bit vector parameter matrix, is the TCP flag vector bias matrix, ReLU and sigmoid are two activation functions, ReLU and sigmoid are used to regress continuous values ​​and output multidimensional probability vectors respectively; the entire packet-level sequence Constructs a complete package-level behavior trajectory; the hidden state at the end of the sequence It is regarded as an aggregated semantic representation and used to further predict flow-level statistical summary features through a multi-layer perceptron (MLP) : ； in Represents a nonlinear mapping network for fitting statistical features; Semantic Discriminator To generate or real packet sequence With the conditional vector As input, three types of features are first embedded through three parallel sub-networks, and then spliced ​​into a multi-layer unidirectional LSTM network. The context information is fused using conditional batch normalization (CBN). Finally, the hidden state and the conditional vector are spliced ​​together, and the true and false probability of the semantic layer is output through the sigmoid function. The statistical discriminator D2 uses flow-level statistical summaries With the packet-level statistical sequence as input, the low-order statistical features and high-order local patterns are extracted respectively through the dual-branch structure; Input multi-layer perceptron, the other way is After one-dimensional convolution processing, it is finally fused with the conditional vector and input into sigmoid to output the overall authenticity score; The loss functions of both discriminators are cross entropy loss functions; The optimization goal of the generator G is: ； in, Express expectations, represents the i-th discriminator, and are the strength coefficients of the two control confusion enhancement terms, z is the random noise vector, and c is the conditional vector.

2. The method for enhancing the Internet of Things gateway based on traffic monitoring and mimetic feedback according to claim 1 is characterized in that: In step S2, the autoencoder based on contrastive learning is used to extract the features of the network traffic sequence, and a positive sample is constructed by randomly selecting some other normal network traffic sequences. , and construct negative samples with pseudo-anomalies by injecting disturbances, packet loss or protocol misalignment ; The total loss function is: ； in, is the total loss of the autoencoder, is the contrast loss, is the positive sample reconstruction loss, is the negative sample reconstruction loss, and α are adjustable hyperparameters.

3. The method for enhancing the Internet of Things gateway based on traffic monitoring and mimetic feedback according to claim 1 is characterized in that: The distribution component is built based on Python language and uses the Flask framework to establish the service interface. During the distribution process, RabbitMQ message queue is used for asynchronous distribution and supports multiple distribution strategies.

4. The method for enhancing the Internet of Things gateway based on traffic monitoring and mimetic feedback according to claim 1 is characterized in that: Each heterogeneous executor runs independently, and the total number of heterogeneous executors must be at least three. It receives the network traffic sequence distributed by the distribution component, selects three processing network traffic sequences from the heterogeneous executor pool each time according to the random selection algorithm, and processes them according to its own environment and configuration, and finally returns the processing results to the arbitration component.

5. The method for enhancing the Internet of Things gateway based on traffic monitoring and mimetic feedback according to claim 1 is characterized in that: The specific process of the majority decision mechanism based on historical execution results is as follows: n heterogeneous executors constitute a heterogeneous executor set; for any voting cycle, define the corresponding historical confidence set; if the i-th heterogeneous executor If the historical execution result of is determined by the majority in this round of voting, its historical confidence is assigned a value of 1, otherwise it is assigned a value of 0; In N consecutive voting cycles, the frequency of each heterogeneous executor passing the vote is counted and recorded as the cumulative confidence , which is defined as follows: ； in, Indicates the i-th heterogeneous executor in the j-th voting cycle The historical confidence value of Cumulative confidence Perform normalization to obtain normalized confidence : ； Where n is the number of heterogeneous executors; Multiply the voting result of each heterogeneous executor by the normalized confidence The corrected decision score is then used, and the final decision is output based on the principle of majority decision, that is, the decision with the highest score.

6. A system for implementing the method for enhancing an Internet of Things gateway based on traffic monitoring and mimetic feedback according to any one of claims 1 to 5, characterized in that: include: A detection unit is used to input the network traffic sequence after data preprocessing into the autoencoder for reconstruction, and use the reconstruction loss as the anomaly score to determine whether the network traffic sequence is abnormal; The distribution component receives the normal network traffic sequence from the detection unit, replicates it into multiple copies, and then transmits it to multiple heterogeneous execution bodies; Heterogeneous executors: Multiple heterogeneous executors process the network traffic sequences distributed by the distribution component and send the execution results to the arbitration component; The adjudication component collects the execution results returned by each heterogeneous executor, adjusts the credibility of the heterogeneous executor based on whether its historical execution results are correct, and then uses a majority adjudication mechanism based on historical execution results to determine the adjudication result. The forged data generation component is activated when the detection unit captures an abnormal network traffic sequence; the forged data generation component generates forged data traffic as a response and sends it to the attacker.

Images