Internet of Things intrusion detection method, device and equipment based on RFE-HO and medium

Abstract

The invention relates to an internet of things intrusion detection method, device and equipment based on RFE-HO, and a medium, and belongs to the field of internet of things intrusion detection, and the method comprises the steps: carrying out the data preprocessing of an internet of things data set; feature selection is carried out on the data set after data preprocessing, a new feature selection algorithm is formed after feature recursion elimination RFE and a HO algorithm are combined, and an optimal feature subset is screened out through feature selection; sending the screened optimal feature subset into a spatiotemporal feature extraction model to extract time and space features respectively, adding a residual structure in the spatiotemporal feature extraction model in order to prevent the model from overfitting, adding an attention mechanism to enhance the importance of the spatiotemporal features of the feature subset, and performing weighted fusion on the spatiotemporal features to obtain a spatiotemporal feature fusion model; and then carrying out classification testing. Compared with an existing intrusion detection method, the method has the advantages that the feature dimension is greatly reduced, the subsequent model efficiency is improved, and the detection rate of network attacks of the Internet of Things is improved.

Description

Technical Field

[0001] This invention belongs to the field of Internet of Things (IoT) network intrusion detection technology, specifically relating to an IoT intrusion detection method, device, equipment, and medium based on RFE-HO. Background Technology

[0002] In recent years, the internet and digital industries have developed rapidly, and the network has become an indispensable part of people's lives. The Internet of Things (IoT) has brought network applications to their fullest potential. The IoT connects various devices through the internet, enabling intelligent identification, location, tracking, monitoring, and management of networks. While the open and shared nature of the internet brings convenience, it also makes it vulnerable to numerous cyberattacks, making network security a serious challenge to internet development. Traditional intrusion detection technologies (such as traffic encryption and user access control) and products (such as firewalls and antivirus software) are mostly based on passive defense strategies, heavily reliant on historical traffic databases, and lack proactive countermeasures against massive, complex, and ever-changing network traffic. Therefore, researching network security technologies adapted to network development is of great significance. Based on detection technology, intrusion detection systems can be divided into feature-based intrusion detection systems and anomaly-based intrusion detection systems. Feature-based intrusion detection systems rely on known attack characteristics and patterns to detect intrusion behavior. Their advantage is high accuracy in detecting known attacks, but their ability to detect unknown attacks is weak, and they are prone to false negatives. Anomaly-based intrusion detection systems detect anomalous attacks by establishing a model of the system's "normal" behavior and comparing the actual attacks with this model. This method has high adaptability, but the false alarm rate is relatively high because normal behavior can be misjudged as attack behavior.

[0003] Machine learning models have achieved certain results in the field of intrusion detection, including linear regression, K-nearest neighbor algorithm, linear discriminant analysis algorithm, Naive Bayes, and support vector machine (SVM). Algorithms are commonly used. Current research shows that while traditional machine learning methods for intrusion detection perform well in terms of accuracy, they suffer from the following problems: they require manual feature engineering of the dataset, demanding certain knowledge from researchers; traditional machine learning is suitable for low-dimensional or limited data, and its feature extraction efficiency is low when dealing with high-dimensional data; it is a shallow learning model, insufficient for data mining, and difficult to parallelize. Based on these limitations, it is necessary to consider researching other efficient and advanced methods for intrusion detection.

[0004] Because IoT traffic data exhibits spatiotemporal characteristics and contains a large number of irrelevant and redundant features, it poses challenges to model classification and increases classification time. Previous research has largely relied on single deep learning methods to extract temporal or spatial features, failing to fully extract the characteristics of IoT data. Therefore, it is necessary to develop an IoT intrusion detection method that incorporates feature selection and spatiotemporal feature extraction. Summary of the Invention

[0005] To overcome the problems existing in the prior art, the present invention provides an IoT intrusion detection method, device, equipment and medium based on RFE-HO, which is used to overcome the current defects.

[0006] An IoT intrusion detection method based on RFE-HO, the method comprising the following steps: S1. After preprocessing the benchmark dataset, it is divided into a training set and a test set; S2. The training set is subjected to Recursive Feature Elimination (RFE) and Hippo HO optimization to select the optimal feature subset. S3. Perform spatiotemporal feature extraction on the optimal feature subset to obtain a successfully trained model; S4. Use the model to classify and detect the test set to obtain normal or aggressive detection results.

[0007] In addition to the aspects and any possible implementations described above, an implementation is further provided, wherein S1 specifically includes: S11. Clean the benchmark dataset to obtain the cleaned dataset; S12. Label Encoding: Label the non-numeric features in the cleaned dataset and convert them into numerical features to obtain the encoded dataset; S13. Perform uniform scaling and normalization on all features in the encoded dataset to eliminate differences in units and obtain a normalized dataset. S14. Divide the normalized dataset to obtain the training set and the test set.

[0008] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein the recursive feature elimination (RFE) and hippopotamus HO optimization process in S2 specifically includes: S21. Using recursive feature elimination (RFE) to establish a fitness function on the training set; S22. Using the training set as the hippo population, initialize the population size, maximum number of iterations, and upper and lower bounds for the search. S23. The fitness calculated using the fitness function is used to perform binary position encoding on each individual in the initialized hippopotamus population; S24. The fitness values ​​of the encoded hippopotamus population are calculated using RFE and fitness functions to obtain the initial best individuals and their corresponding fitness values; S25. Search and update the hippopotamus population based on the initial best individuals and their corresponding fitness values; S26. Repeat steps S23-S25 until the maximum number of iterations is reached to select the optimal feature subset.

[0009] In addition to the aspects described above and any possible implementations, a further implementation is provided, wherein the fitness function is:

[0010] Here, Accuracy represents accuracy and Fitness represents fitness.

[0011] As described above, and in accordance with any possible implementation, an implementation is further provided, wherein S25 includes: S251. Perform a global search to update the location of hippos in rivers or ponds; S252. Defend: The hippo defends itself against predators to avoid getting trapped in a local optimum. S253. Localized development allows hippos to escape predators.

[0012] In addition to the aspects and any possible implementations described above, a further implementation is provided, wherein spatiotemporal feature extraction includes spatial feature extraction and temporal feature extraction, wherein spatial feature extraction employs a module consisting of a convolutional layer Conv + batch normalization BN + ReLU activation + max pooling MaxPool and a residual bypass; and temporal feature extraction employs a BiLSTM network.

[0013] In addition to the aspects described above and any possible implementations, an implementation is further provided in which the BiLSTM network includes a forward LSTM network and a reverse LSTM network connected in parallel.

[0014] The present invention also provides an IoT intrusion detection device based on RFE-HO, the device being used to implement the method, comprising the following modules: The preprocessing module is used to preprocess the benchmark dataset and divide it into training and test sets; The RFE-HO module is used to perform feature selection on the training set using recursive feature elimination (RFE) and hippopotamus HO optimization to obtain the optimal feature subset. The model building module is used to extract spatiotemporal features from the optimal feature subset to obtain a successfully trained model. The classification and detection module is used to classify and detect the test set using the model to obtain normal or aggressive detection results.

[0015] The present invention also provides an electronic device, the electronic device comprising: a memory storing executable instructions; and a processor executing the executable instructions in the memory to implement the method.

[0016] The present invention also provides a computer storage medium storing a computer program, the computer program being executed by a processor to implement the method described.

[0017] Beneficial effects of the present invention This invention discloses an IoT intrusion detection method based on RFE-HO, comprising: preprocessing a benchmark dataset and dividing it into a training set and a test set; performing feature selection on the training set using recursive feature elimination (RFE) and HippoHo optimization to obtain an optimal feature subset; extracting spatiotemporal features from the optimal feature subset to obtain a successfully trained model; and using the model to classify and detect the test set to obtain normal or attack detection results. This invention uses the RFE-HO feature selection algorithm to remove irrelevant and redundant features from the original dataset, obtaining an optimal feature subset for computation, thus enhancing the classification performance of the subsequent model. Then, spatiotemporal features are extracted again from the features for learning, fully extracting IoT traffic data features, ultimately improving the overall classification performance of the intrusion detection model. Attached Figure Description

[0018] Figure 1 is a flowchart of the method of the present invention; Figure 2 This is a flowchart of the feature selection process based on RFE-HO of the present invention; Figure 3 A diagram showing the performance comparison before and after feature selection for the TON_IoT dataset. Detailed Implementation

[0019] To better understand the technical solution of this invention, the content of this invention includes, but is not limited to, the specific embodiments described below. Similar technologies and methods should be considered within the scope of protection of this invention. To make the technical problems to be solved, the technical solutions, and advantages of this invention clearer, a detailed description will be provided below in conjunction with the accompanying drawings and specific embodiments.

[0020] It should be understood that the embodiments described in this invention are merely some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0021] This invention provides an IoT intrusion detection method based on RFE-HO, the method comprising the following steps: S1. After preprocessing the benchmark dataset, it is divided into a training set and a test set; S2. Feature selection is performed on the training set using Recursive Feature Emission (RFE) and Hippo HO optimization to obtain the optimal feature subset; S3. The spatiotemporal feature extraction model is trained using the optimal feature subset to obtain the trained model; S4. Use the trained model to classify and detect the test set to obtain normal or aggressive detection results.

[0022] Furthermore, S1 specifically includes: S11. Clean the benchmark dataset to obtain the cleaned dataset; S12. Label Encoding: Label the non-numeric features in the cleaned dataset and convert them into numerical features to obtain the encoded dataset; S13. Perform uniform scaling and normalization on all features in the encoded dataset to eliminate differences in units and obtain a normalized dataset. S14. Divide the normalized dataset to obtain the training set and the test set.

[0023] Furthermore, the recursive feature elimination (RFE) and hippopotamus HO optimization process in S2 specifically includes: S21. Using recursive feature elimination (RFE) to establish a fitness function on the training set; S22. Using the training set as the hippo population, initialize the population size, maximum number of iterations, and upper and lower bounds for the search. S23. The fitness calculated using the fitness function is used to perform binary position encoding on each individual in the initialized hippopotamus population; S24. The fitness values ​​of the encoded hippopotamus population are calculated using RFE and fitness functions to obtain the initial best individuals and their corresponding fitness values; S25. Search and update the hippopotamus population based on the initial best individuals and their corresponding fitness values; S26. Repeat steps S23-S25 until the maximum number of iterations is reached to select the optimal feature subset.

[0024] Furthermore, the fitness function is:

[0025] Here, Accuracy represents the average overall accuracy of the model on the training set using five-fold cross-validation. The fitness function takes the negative of accuracy because HO is a minimization problem, and the minimum fitness indicates higher accuracy.

[0026] Furthermore, S25 includes: S251. Perform a global search to update the location of hippos in rivers or ponds; S252. Defend: The hippo defends itself against predators to avoid getting trapped in a local optimum. S253. Localized development allows hippos to escape predators.

[0027] Furthermore, the spatiotemporal feature extraction includes spatial feature extraction and temporal feature extraction. The spatial feature extraction uses a module consisting of a convolutional layer (Conv), batch normalization (BN), ReLU activation, max pooling (MaxPool), and a residual bypass. The temporal feature extraction uses a BiLSTM network.

[0028] Furthermore, the BiLSTM network includes a forward LSTM network and a reverse LSTM network connected in parallel.

[0029] Specifically, the process of this invention is as follows: like Figure 1 As shown, the present invention proposes an IoT intrusion detection method based on RFE-HO feature selection and spatiotemporal feature extraction, the method comprising the following steps: Step 1. Input the benchmark dataset for detecting anomalous behavior in the Internet of Things (IoT). The benchmark dataset comes from the TON_IoT (Telecommunication / Operating system / Network IoT) dataset, a comprehensive intrusion detection dataset for IoT environments released by the cybersecurity research team at the University of New South Wales (UNSW), Australia. This dataset was collected by deploying multiple devices in a real IoT environment and capturing logs and traffic, representing semi-real-time data collection in a real-world scenario. This invention uses the IoT traffic dataset (TON_IoT_Train_Test_Network) as the benchmark dataset. The IoT traffic dataset includes normal communication traffic and nine types of traffic data exhibiting attack behavior: Scanning, Password, DoS, XSS, Backdoor, Injection, Ransomware, DDoS, and Mitm. The feature representing the time dimension in this dataset is the field ts, which records the arrival order of packets / streams and can be used for sliding window or time series modeling; the features representing the spatial dimension are src_ip, dst_ip, src_port, dst_port, proto, service, bytes, packets, and duration. The first six features describe the flow direction, port, and protocol topology, while the last three features, bytes, packets, and duration, reflect the communication intensity. The Normal class covers the following IoT protocols and / or services: (1) MQTT publish-subscribe messaging, CoAP / HTTP / HTTPS device management; (2) Modbus / TCP industrial read / write; (3) Basic network services such as DNS, NTP, and ARP; (4) Remote maintenance of SSH, FTP, and SMB hosts; (5) Cloud API calls and camera RTSP / RTMP streams.

[0030] Step 2. Data Preprocessing. Data preprocessing involves a series of cleaning, transformation, and filtering operations performed on the raw data before it is fed into the model for processing. These operations aim to improve data quality and feature usability, resulting in a more stable and accurate model. This invention employs three sub-steps for data preprocessing: data cleaning, label encoding, and data normalization. Data cleaning includes handling missing values, outliers, and duplicate values. Label encoding maps categories to integer labels, facilitating subsequent model learning. Data normalization involves scaling or transforming the raw data according to a certain ratio, making the numerical ranges of different features closer or exhibiting the same statistical distribution. Specifically, it includes the following three sub-steps: (1) Data cleaning: missing values ​​are filled with the mean and / or median, outliers are truncated, and duplicate samples are removed. To prevent model overfitting and direct learning of spatiotemporal features while ignoring implicit spatiotemporal information, this invention removes timestamps, source and destination IPs, and source and destination port attributes from the benchmark dataset, and uses the remaining features for training and testing. For the handling of numerical missing values, this invention selects the median to fill in the missing values. After the above steps, the cleaned dataset is obtained. (2) Label Encoding: Convert non-numerical features in the cleaned dataset into numerical features. The feature names to be encoded in the cleaned dataset are: proto, service, conn_state, dns_query, dns_AA, dns_RD, dns_RA, dns_rejected, ssl_version, ssl_cipher, ssl_resumed, ssl_established, ssl_subject, ssl_issuer, http_trans_depth, http_method, http_uri, http_version, http_user_agent, http_orig_mime_types, http_resp_mime_types, weird_name, weird_addl, and weird_notice. Map each value to an integer from 0 to n_classes-1. For example, if there are three non-numeric labels in the proto column: tcp, udp, and icmp, then n_classes is three. These three non-numeric labels are mapped to 0, 1, and 2 using label encoding. The remaining non-numeric labels are mapped in the same way.

[0031] The label column is mapped to integer labels. This invention adopts a binary classification mapping method: Normal is mapped to 0, and the other nine attack categories Scanning, Password, Dos, Xss, Backdoor, Injection, Ransomware, Ddos and Mitm are all mapped to 1, which facilitates subsequent learning and obtains the encoded dataset. (3) Normalization: To eliminate differences in the dimensions of different continuous features and accelerate model convergence, this invention normalizes all feature columns in the labeled dataset, linearly mapping them to the interval [0, 1]. The normalization specifically uses a minimum-maximum function, with the following formula: (1) in, These are the normalized eigenvalues. It is the first one that was not normalized after tag encoding. The first feature in the labeled encoded dataset The value of the row. and They are the first The minimum and maximum values ​​among all features in the column containing each feature. and Take a positive integer.

[0032] (4) Data set partitioning: After the above data cleaning, label encoding and data normalization are completed, the dataset is partitioned in an 8:2 ratio to obtain a training set and a test set. The training set is used for the following data processing and model building; the test set is used for classification and detection using the established model.

[0033] Step 3. RFE-HO Feature Selection: (e.g., ...) Figure 2 As shown, Recursive Feature Emission (RFE) is embedded into the Hippo Optimization Algorithm (HO) to search the training set for the optimal feature subset, reducing computational cost and subsequent model complexity. The specific process is as follows: First, a random forest is used as the base learner to perform RFE on the training set. In each round, features with the least contribution are removed based on their importance until a preset number of features are reached after feature elimination, eliminating significantly redundant features and reducing the search space. Then, the Hippo Optimization Algorithm (HO) is introduced into the RFE to accelerate the RFE process. Finally, the HO algorithm generates a feature subset to accelerate the iteration of RFE, enabling more efficient reduction of redundant features in each feature selection process and rapid convergence to the optimal feature set. The specific process includes the following steps: (1) Set the original feature as Let X represent the original features in the training set, R represent the set of real numbers (i.e., all feature values ​​are real numbers), C represent the number of samples, and D represent the number of features (both C and D are natural numbers). In a random forest, the decision tree needs to split nodes during training, based on the importance of candidate features at that node. Specifically, when a node is selected, a feature is randomly selected from the available feature set for that node. The features are selected as candidate features, and the optimal splitting feature is chosen using the Gini exponential gain as the splitting criterion, thus completing the node partitioning. This process ensures the rationality of feature importance calculation and provides a basis for subsequently combining the Hippo Optimization (HO) algorithm to accelerate feature recursive elimination. Original samples are obtained from the training set, i.e., feature columns are extracted from the training set and randomly selected... From a sample, a training subset is obtained. When building a decision tree on this subset, whenever a node needs to split, it is selected from the currently available nodes. Randomly selected from the features For each candidate feature, calculate the Gini exponential gain used as the basis for partitioning: (2) in, This represents the set of node samples currently being used to calculate the Gini index. This indicates that the node sample belongs to the feature The sample proportion is determined, and the feature that maximizes the reduction of the Gini index and the splitting threshold are selected for node splitting. By repeatedly applying this strategy to all nodes, the importance of features can be measured simultaneously, and the tree can be generated.

[0034] The change in the Gini index before and after the node splits is expressed as: (3) in, The number of samples in the current node. , The number of samples for the left and right child nodes generated after the split for the current node. This represents the Gini index of the left node after a node split. Let Gini index represent the value of a particular feature in the right node after a node splits. for: (4) in, Indicates the relationship between the current node and the first node. The number of samples related to each category.

[0035] The importance of a feature on the m-th decision tree is equal to its importance on all nodes, expressed as: (5) in, This formula is an extension of formula (4). This represents the summation of the importance of the feature at each node for all nodes related to the m-th decision tree, yielding the overall importance of the feature across the entire decision tree. This is achieved by... The summation is performed across all nodes in the entire tree to comprehensively reflect the contribution of this feature to tree splitting decisions.

[0036] The final output of this step is the importance score matrix (or vector) of all features on the decision tree, which serves as the input data for the subsequent combination of the recursive feature elimination (RFE) and the hippo optimization (HO) algorithm. This score matrix is ​​used to calculate the fitness function.

[0037] Parameter settings: The hippo population size is set to 40, the maximum number of iterations is 100, the lower bound of the search is 0, and the upper bound is 1. The upper and lower bounds [0, 1] are coordinate system normalization settings at the algorithm level. The hippo population size is chosen to be 40 because the present invention has shown through multiple experiments that when the population size is less than 30, it is prone to premature convergence and convergence to a local optimum; when it exceeds 50, the accuracy improvement is not significant, but the computation time and environmental pressure increase sharply. Therefore, the present invention prefers a hippo population size of 40, but other values ​​are also possible and are not limited in the present invention. (2) Position encoding: the training set X represents the original features in the training set. This training set is used as the hippopotamus population. The fitness obtained by recursively eliminating RFE (Recursive Feature Exclusion) is combined with the hippopotamus optimization algorithm (HO) to achieve positional encoding. In the first stage, the hippopotamus optimization algorithm (HO) utilizes continuous coordinates... (As defined in formula (7) below) Dynamically generate feature subsets (when When the value is greater than 0.5, the j-th dimension feature is selected. Adult male hippos, juvenile hippos, and adult female hippos are responsible for global exploration, local development, and diversity maintenance, respectively. In the second stage, local RFE is independently performed on each feature subset to calculate the fitness value obtained from the feature random forest. This value is calculated using the formula... (6) The calculation shows that Accuracy represents the accuracy rate. The score matrix obtained in step (1) is used for calculation. In this mechanism, As an exploration tool for HO, it enables rapid dimensionality reduction, and As an evaluation criterion for RFE, it ensures the reliability of the selection. The two have a clear division of labor and work together to balance computational efficiency and feature selection accuracy.

[0038] (3) Initializing the hippopotamus population: Under the HO algorithm framework, hippos are considered as candidate solutions to the optimization problem, meaning that updating the decision variable values ​​corresponds to adjusting the position of each hippopotamus in the search space. Therefore, each hippopotamus is represented by a vector, while the entire hippopotamus population is represented by a matrix. To describe it.

[0039] (7) in, , , Indicates the number of hippos in the population. This indicates the number of decision variables in the problem. Indicates the first The individual in the first Position in 3D space The update formula is as follows: (8) and Represent matrices respectively The Upper and lower bounds of 3D space, This represents the number of hippos in the population, which is a hyperparameter given during the algorithm initialization phase. It is a random number in the range [0,1].

[0040] (4) Population search (development stage): According to the population update formula, the positions of adult male hippos and juvenile or adult female hippos are updated respectively. The position update formula is as follows: (9) (10) (11) (12) (13) In most cases, juvenile hippos will stay close to their mothers. However, due to their curious nature, occasionally juvenile hippos will separate from the hippopotamus population or stray from female hippos, which means that the juvenile hippo has kept a certain distance from its mother. It is the current iteration number. It is the maximum number of iterations, and the relationship between the two is expressed by formula (10). Furthermore, if A value between 0 and 1 and greater than 0.5 indicates that the juvenile hippo, while maintaining a certain distance from its mother, is still within or near the hippo herd; conversely, a value less than or equal to 0.5 means it has left the herd. The following two formulas represent the position updates of adult male hippos and juvenile or adult female hippos: (14) (15) in, The objective function value, i.e., the one mentioned earlier. Abbreviation. Representing the updated number The location of an adult male hippopotamus. Representing the updated number The location of a juvenile or female hippopotamus. Representing the The individual in the first Position in each dimension and They represent the first Upper and lower limits in 3D space, Indicates the location of the male hippopotamus. This indicates the location of juvenile or female hippos. This represents the hippopotamus with the best cost among the current choices, that is, the male hippopotamus that performs best in the current iteration. It refers to a randomly selected group of hippos. The algorithm consists of multiple hippos, selected randomly. Although there are multiple hippos, the algorithm selects a specific subset based on the objective function value (the inverse of accuracy). By selecting this subset, the algorithm can better explore the solution space, adjust its search direction, and thus accelerate the discovery of the global optimum. In short, It is a group of individual hippos that make choices at different stages of the optimization process according to certain criteria, and these are known variables. and It must be an integer between 1 and 2, meaning it can only be 1 or 2. arrive These are random vectors between 0 and 1, with values ​​ranging from 0 to 1. These random numbers are used to calculate the location information of new solutions, allowing the algorithm to perform efficient exploration in the solution space. These random values ​​increase the diversity of the search, making the optimization process less likely to get trapped in local optima. , , , It is a random number between 0 and 1. and It is 0 or 1. and from The solution can be obtained from any one of the five expressions in the equation. Specifically... The formula includes five different selection options, each corresponding to a different optimization strategy. The choice is determined randomly based on the current situation and is used to help adjust the current optimization direction.

[0041] (5) Hippos Defending Against Predators (Exploration Phase): A core element of hippos' choice of a gregarious lifestyle is the pursuit of safety and protection. However, due to the mischievous nature of juvenile hippos, they often stray from the group, becoming prey for other animals. The hippo's primary defense mechanism involves quickly turning towards the threat and emitting a deafening roar as a warning to prevent the predator from approaching further. During this process, hippos may also employ a strategy of approaching the predator to confuse it and cause it to retreat, thus effectively dealing with potential danger. The following formula illustrates the process of hippos defending against predators: (16) (17) (18) (19) (20) in, , Indicates predator, Indicates the predator's updated location. This indicates the distance between the predator and the hippopotamus. During this time, the hippopotamus uses defensive behaviors to protect itself from the predator. If , This represents the predator's current objective function value relative to the hippopotamus. This is a fitness value, indicating that the predator and hippopotamus are very close. In this situation, the hippopotamus turns towards the predator and moves in its direction to make the predator retreat. If Larger, such as greater than or equal to This indicates that the predator is relatively far from the hippopotamus population. In this case, the hippos turn towards the predator, but their movement is more limited. The purpose of this is to make the predator aware that it has entered the hippopotamus population's territory. This is used to measure the relative position and danger between the predator and the hippopotamus. During the optimization process, The smaller the size, the closer the predator is to the hippo, which will then take more aggressive defensive actions.

[0042] This is the posture of a hippopotamus when facing a predator. It is a random variable with a Levy distribution, used for the random positional changes of the predator, and is calculated by formula (19). and It is a random number between [0, 1]. =1.5, It is an abbreviation for the Gamma function. It is obtained through formula (20). It is a uniformly random number between 2 and 4. It is a uniformly random number between 1 and 1.5. It is a uniformly random number between 2 and 3. It represents a uniformly random number between -1 and 1. It is a dimension of random vectors, This represents vector addition. Represents a random vector ranging from 0 to 1.

[0043] (twenty one) According to the above formula, if If the signal is positive, it means the hippo has been preyed upon, and another hippo in the group will take its place. Conversely, if the predator flees, the hippo returns to the group. This is the updated individual position in formula (14). This step significantly enhances the search process. This step complements the stage in step (4) and effectively reduces the risk of getting trapped in local minima.

[0044] (6) Hippos escaping predators (development stage) When faced with a strong and irresistible predator, a hippopotamus attempts to escape to the nearest lake or pond, where the predator is unlikely to enter. To simulate this behavior, a random location is generated near the hippopotamus's current position, and the process is represented by the following equation: (twenty two) (twenty three) (twenty four) in, , It's a new location that the hippopotamus found to avoid predators. It is based on a vector or number randomly selected from the expression in formula (24). It is a random vector in [0, 1]. and It is a random number in [0, 1]. It is a normally distributed random number.

[0045] (25) in, It is the objective function value calculated at a certain moment during the optimization algorithm, which relates to predator behavior and hippopotamus defense strategies. This refers to the fitness value or fitness score. This step yields the preliminary optimal feature subset obtained from one iteration.

[0046] (7) Repeat (4)-(6) until the maximum number of iterations is reached. In this step, the preliminary optimal feature subset obtained in each iteration is further processed, and the preliminary optimal feature subset is re-evaluated and optimized again. After optimization, a preliminary optimal feature subset is obtained. The preliminary optimal feature subset obtained after each optimization is compared with the preliminary optimal feature subset obtained after the previous optimization. Based on the difference between the optimization result of each time and the previous optimization result, the current optimal feature subset is updated to ensure that an optimal feature subset is obtained. There are two ways to express the optimal feature subset. One is to directly output the index of the selected optimal feature subset; the other is to use binary code to represent the index of the selected optimal feature subset, where 1 represents selecting the index and 0 represents not selecting. The index of the optimal feature subset is output in the form of 0 and 1. For example, 0111000101 selects the feature column in the optimal feature subset with indexes of 2, 3, 4, 8, 10. The 1 and 0 are determined by the feature mask in the optimal feature subset. and The threshold is used for comparison and judgment. If it is greater than or equal to 0.5, the feature mask is represented by 1; otherwise, it is represented by 0. The formula is as follows: (26), of which These are the row number and column number, respectively, and their values ​​are positive integers.

[0047] Step 4. Spatiotemporal feature extraction: The optimal feature subset is fed into the spatiotemporal feature extraction module that integrates residual structure and attention mechanism. This module uses convolutional neural network (CNN) and bidirectional long short-term memory network (BiLSTM) to extract spatial and temporal features respectively, adds attention mechanism to enhance feature importance and weightedly fuses spatial and temporal features. The spatiotemporal feature extraction model CNN-BiLSTM can capture these change patterns by analyzing the spatiotemporal features of the optimal feature subset, thereby improving detection accuracy.

[0048] The spatiotemporal feature extraction module includes: a spatial feature extraction submodule, a temporal feature extraction submodule, and an attention weighting and feature fusion submodule. The temporal and spatial extraction modules have added a parallel connection mechanism with an attention mechanism.

[0049] (1) Spatial feature extraction submodule The spatial feature extraction submodule employs a Convolutional Neural Network (CNN), comprising three sequentially cascaded layers: Convolutional Layer (Conv), Batch Normalization (BN), ReLU activation, and Max Pooling (MaxPool), along with a residual module bypass. The Convolutional Layer (Conv), Batch Normalization (BN), ReLU activation, and Max Pooling (MaxPool) layers are connected sequentially to form a single module. The convolutional layers extract spatial features by capturing spatial structural information in the input, such as edges, textures, and shapes, through local receptivity. Max pooling compresses spatial dimensions while preserving key spatial features, further enhancing the spatial abstraction capability of the features. The residual module skips between the input and the outputs of the convolutional, batch normalization, ReLU activation, and max pooling layers, enabling the network to learn deeper features and improve performance.

[0050] Let the input be It is the optimal feature subset, obtained after several convolution transformations of the main branch of the convolution. , represents the output features after processing through several layers in a neural network; the bypass path is processed by 1×1 convolution pairs After aligning the dimensions, add the result to the main branch to obtain the output. , is input The transformation result Y obtained after a series of network layers is a dataset with spatial features obtained by the spatial feature extraction submodule, which is the result obtained through the residual structure.

[0051] The submodule's role is to extract locally relevant features while reducing the number of parameters. Convolutional layers (Conv), batch normalization (BN), and ReLU activation layers are the main operations. Through these operations, the network can effectively extract features while controlling the number of parameters. Convolutional layers effectively extract features, while batch normalization and ReLU activation functions help accelerate training and enhance the network's expressive power. Batch normalization allows the network to standardize at each layer, reducing the risk of overfitting, thus helping to reduce the number of parameters without affecting feature extraction performance. Residual mapping alleviates gradient vanishing and reduces overfitting. Gradients exist in the optimal feature subset, and residual mapping helps improve the feature extraction process. Because residual connections prevent the input signal from undergoing a complete nonlinear transformation, the model can extract spatial features more efficiently, avoiding unnecessary transformations.

[0052] (2) Time feature extraction submodule: extract time features from the optimal feature subset in order to better capture the temporal dynamic features of the data.

[0053] The temporal feature extraction module uses a bidirectional long short-term memory network (BiLSTM), which consists of a forward LSTM and a backward LSTM connected in parallel. It can simultaneously model the dependencies before and after the current time step, thereby improving the temporal modeling capability of features.

[0054] Specifically, let the input be... That is, the optimal feature subset, which is split into sequences according to the time dimension. The data are then fed into the forward and reverse LSTM networks for processing, respectively. The formulas are as follows: Forward LSTM outputs hidden states in ascending order: (27) Reverse LSTM outputs hidden states in reverse order: (28) At each time step The result obtained by piecing together: (29) in, Indicates the current time Input information, and They represent the previous moment respectively. and the current moment Hidden states in sequential LSTM and They represent the current time. And the hidden state in the reverse LSTM at the next time step, Indicates the current time The output obtained from BiLSTM is a dataset with temporal characteristics.

[0055] Forward and backward LSTM networks can simultaneously capture the three segments of contextual information—past, present, and future—from the optimal feature subset, thus preserving more complete clues about the attack evolution compared to unidirectional LSTM.

[0056] (3) Attention-weighted and temporal feature fusion submodule. This submodule processes data containing spatial features extracted by the spatial feature extraction submodule and temporal features extracted by the temporal feature extraction submodule. These temporal and spatial features form a dataset. After passing through the attention mechanism, this submodule automatically focuses on the key temporal features in the data, thereby optimizing the learning process. This submodule is located in the back-end layer of the spatiotemporal extraction network. The output of BiLSTM is fed into an attention mechanism module. The attention mechanism module assigns different weights to each feature based on their relevance. Then, the attention-fed features are combined as the final input and passed to the next layer of the submodule. The BiLSTM module and the attention mechanism module work together to improve the model's focus on key features and overall performance.

[0057] The attention mechanism consists of the following three parts: 1) Calculate the attention score: Combine the output of the BiLSTM with the context state of the current time step. The input is fed into an attention network to calculate the attention score. This score indicates the hidden state. The degree of impact on the current output. The calculation formula is as follows: (30) 2) Calculate attention weights: After obtaining the attention score in the previous step, normalize it to obtain the attention weights. The input is converted to a value between 0 and 1, and the sum is 1. This method assigns a weight to each input, with larger weights representing a greater contribution to the current output, and smaller weights representing a smaller contribution.

[0058] Attention weight The calculation formula is: (31) Where M is the number of time steps. For the first Attention score at each time step.

[0059] 3) Weighted Summation: After obtaining attention weights by weighted summation of attention scores, the input is then weighted and summed using these attention weights to obtain a context vector, which serves as the basis for output generation while weakening unimportant information. The calculation formula is as follows: (32) in, This is a context vector, representing the overall attention the model's current output pays to the entire input sequence.

[0060] The attention mechanism assigns weights to sequences at different positions in the input sequence by calculating attention scores, thereby better focusing on relevant feature information. The more important the feature at a position, the greater the attention weight that position will receive, and the influence of the sequence at that position on the classification result will be more considered. The application of the attention mechanism makes more attention paid to the influence of important features, improving classification accuracy. The resulting spatiotemporal feature extraction model is shown in Table 1. The hyperparameters of the CNN part include: number of convolutional kernels, kernel size, stride, pooling layer size and stride, and activation function; the hyperparameters of the BiLSTM part include: number of LSTM units, time step, and number of LSTM layers; the hyperparameters of the attention mechanism part include: attention weights and number of attention layers; the hyperparameters of the optimizer include: learning rate, batch size, and optimization algorithm; regularization includes: Dropout rate, L2 regularization, and number of batch normalization layers.

[0061] Step 5. Classification and Detection: The spatiotemporal feature extraction model built in Step 4 is used for training, and the trained model is tested using a test set. During the training phase, the model automatically learns feature representations from the data, and these features are encoded into network weights and stored. When the test set is input, the model directly calls the learned features to calculate predictions. The model performs classification tests on a subset of features and outputs detection results for normal and aggressive types.

[0062] Step 6. Use the tested spatiotemporal feature extraction model to analyze the real-time acquired IoT network data. The data is analyzed to distinguish between normal and malicious data, detect abnormal attacks, and perform intrusion detection.

[0063] This invention utilizes the RFE-HO algorithm to eliminate irrelevant and redundant features, selects the optimal feature subset, and then feeds the optimal feature subset into a spatiotemporal feature extraction model, ultimately effectively improving the classification performance of the intrusion detection system. The parameter settings of the spatiotemporal feature extraction model are shown in Table 1.

[0064] Table 1. Parameter settings for the spatiotemporal feature extraction model

[0065] This invention uses the dataset TON_IoT, which contains a total of 449,972 samples. Data preprocessing is performed on the dataset, removing timestamps, source and destination IPs, and source and destination port attributes. The features proto, service, weirdname, weird addl, and weird notice are labeled and encoded. These features are non-numerical and are converted to numerical values ​​for subsequent model learning. Non-character features are mapped to integer labels; for example, ICMP is mapped to 0, TCP to 1, UDP to 2, and so on. The encoded dataset contains a total of 38 features. After data cleaning and label encoding, the feature dataset is normalized using minimum-maximum normalization to scale the data to the [0,1] interval. Following a hierarchical approach, the normalized dataset is divided into an 8:2 ratio, with 80% of the samples used as the training set and the remaining 20% ​​as the test set. The training set contains 359,978 training samples, and the test set contains 89,994 test samples, ensuring an unbalanced ratio between the training and test sets.

[0066] The pseudocode for RFE-HO feature selection used in step 3 is shown in Table 2: Table 2. RFE-HO Feature Selection Pseudocode

[0067] Input: Training set; Output: Optimal feature subset ; Initialize population location (Formula (7)), population size Population dimension Number of iterations ; The population is binary encoded according to the equation (Formula (6)), which is only used to calculate the fitness function and does not change the position of the population; Importance is calculated using RFE to find the initial fitness. for ; Phase 1: Updating the location of hippos in rivers or ponds (Exploration Phase: Global Search) for do; Calculate the position update formula for the hippo using formula (formula (9), formula (11)). The hippopotamus's new location end for Phase 2: Hippos Defend Against Predators (Exploration Phase: Avoiding Local Optimum) for do Use the predator position update formula (formula (16)) to generate a random predator position; The distance between the predator and the hippopotamus is calculated using the distance formula (Formula (17)); Calculate the first position using the hippopotamus position update formula (Formula (18)). The hippopotamus's new location; end for Phase 3: Hippos Escape Predators (Development Phase: Partial Development) The new boundary for variable decision is calculated using the boundary calculation formula (Formula (22)). for do Calculate the position update formula for hippopotamus using formula (23) . The hippopotamus's new location; end for (8) Use RFE to reassess the fitness of all individuals. Update the current global optimal solution and fitness; (9)

[0068]

[0069] Then, steps 4 and 5 are used for calculation to finally complete this method.

[0070] After feature extraction using the model proposed in this invention, the model classification performance before and after feature selection was compared, and its efficiency was evaluated using five evaluation metrics: accuracy, precision, recall, F1 score, and false positive rate. See the detailed results below. Figure 3 Feature selection significantly improves model performance, particularly in accuracy, recall, and F1 score. By removing redundant features and noise, feature selection enhances the model's generalization ability and precision. The model after feature selection shows improvements in recognition ability, precision, and recall, ultimately resulting in a significant overall performance improvement.

[0071] To verify the feature selection method proposed in this invention, it was compared with classic metaheuristic feature selection algorithms, namely the Slap Swarm Algorithm (SSA), the Particle Swarm Optimization Algorithm (PSO), and the Genetic Algorithm (GA). The feature subsets selected by these three algorithms and the algorithm of this invention were fed into the spatiotemporal feature extraction model proposed in this invention for comparison. Accuracy, Precision, Recall, F1-score, FPR, and the number of selected features were used to evaluate the efficiency of the feature selection methods. The results are shown in Table 3. Table 3 shows the comparison results of the classification performance of different feature selection algorithms on the TON_IoT dataset. The results show that the RFE-HO algorithm of this invention performs best in several key indicators. Compared with traditional methods such as GA, PSO, and SSA, it achieves better results in accuracy, precision, recall, F1 score, and false positive rate.

[0072] Specifically, RFE-HO achieved an accuracy of 88.94%, a precision of 87.55%, a recall of 88.94%, and an F1 score of 89.34%, significantly outperforming other comparative methods. This demonstrates that RFE-HO effectively improves feature selection efficiency while maintaining model accuracy, and possesses strong potential for practical application.

[0073] Table 3 Performance Comparison of Feature Selection Algorithms for the TON_IoT Dataset

[0074] To objectively evaluate the overall classification performance of the proposed model, its framework was compared with classic classification models. Two classic machine learning models (SVM and K-Nearest Neighbors KNN) and three classic deep learning models (CNN-LSTM, CNN-GRU, and CNN-BiGRU) were selected for binary classification comparison experiments. For each model, the optimal feature subset selected by the feature selection method of this invention was uniformly used for training, and then their various performance metrics were compared. Accuracy, Precision, Recall, F1-score, and FPR were used to evaluate its efficiency. Specific experimental results are shown in Table 4.

[0075] Table 4 Overall Model Performance Comparison for the TON_IoT Dataset

[0076] Table 4 shows that, based on both accuracy and F1 score, deep learning models generally outperform traditional machine learning models. This is because deep networks have a stronger ability to extract features from high-dimensional data. The overall framework model of this invention performs exceptionally well in both accuracy and F1 score, indicating that it has a higher overall discriminative ability in distinguishing normal and attack samples and balancing precision and recall. Precision and recall show that most deep learning models can achieve good performance, but maintaining a balance is not easy. This invention maintains a high recall while also considering precision, meaning it can detect more attack samples while reducing the misclassification of normal samples. The false positive rate shows that the FPR of this invention is relatively low on the TON_IoT dataset, indicating that it has a more stable false positive rate on this dataset. In summary, on the TON_IoT dataset, the proposed model achieves a binary classification accuracy of 88.94%, which is superior to the compared machine learning and deep learning models, demonstrating the superiority of this invention's model.

[0077] As an embodiment of the present invention, the present invention also provides an IoT intrusion detection device based on RFE-HO, the device being used to implement the method, comprising the following modules: The preprocessing module is used to preprocess the benchmark dataset and divide it into training and test sets; The RFE-HO module is used to perform feature selection on the training set using recursive feature elimination (RFE) and hippopotamus HO optimization to obtain the optimal feature subset. The model building module is used to extract spatiotemporal features from the optimal feature subset to obtain a successfully trained model. The classification and detection module is used to classify and detect the test set using the model to obtain normal or aggressive detection results.

[0078] As an embodiment of the present invention, the present invention also provides an electronic device, the electronic device comprising: Memory, which stores executable instructions; A processor that executes the executable instructions in the memory to implement the method.

[0079] As an embodiment of the present invention, the present invention also provides a computer storage medium storing a computer program, the computer program being executed by a processor to implement the method described herein.

[0080] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0081] The foregoing description illustrates and describes several preferred embodiments of the present invention. However, as previously stated, it should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the inventive concept described herein through the foregoing teachings or techniques or knowledge in related fields. Any modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. An IoT intrusion detection method based on RFE-HO, characterized in that, The method includes the following steps: S1. After preprocessing the benchmark dataset, it is divided into a training set and a test set; S2. The training set is subjected to Recursive Feature Elimination (RFE) and Hippo HO optimization to select the optimal feature subset. S3. The spatiotemporal feature extraction model is trained using the optimal feature subset to obtain the trained model; S4. Use the trained model to classify and detect the test set to obtain normal or aggressive detection results.

2. The detection method according to claim 1, characterized in that, S1 specifically includes: S11. Clean the benchmark dataset to obtain the cleaned dataset; S12. Label Encoding: Label the non-numeric features in the cleaned dataset and convert them into numerical features to obtain the encoded dataset; S13. Perform uniform scaling and normalization on all features in the encoded dataset to eliminate differences in units and obtain a normalized dataset. S14. Divide the normalized dataset to obtain the training set and the test set.

3. The detection method according to claim 1, characterized in that, The recursive feature elimination (RFE) and hippopotamus HO optimization processes in S2 specifically include: S21. Use recursive feature elimination (RFE) to establish a fitness function on the training set; S22. Using the training set as the hippo population, initialize and set the population size, maximum number of iterations, and upper and lower bounds for the search; S23. The fitness calculated using the fitness function is used to perform binary position encoding on each individual in the initialized hippopotamus population; S24. The fitness values ​​of the encoded hippopotamus population are calculated using RFE and fitness functions to obtain the initial best individuals and their corresponding fitness values; S25. Search and update the hippopotamus population based on the initial best individuals and their corresponding fitness values; S26. Repeat steps S23-S25 until the maximum number of iterations is reached to select the optimal feature subset.

4. The detection method according to claim 3, characterized in that, The fitness function is: ， Here, Accuracy represents the accuracy rate. Indicates fitness.

5. The detection method according to claim 3, characterized in that, S25 includes: S251. Perform a global search to update the location of hippos in rivers or ponds; S252. Defend: The hippo defends itself against predators to avoid getting trapped in a local optimum. S253. Localized development allows hippos to escape predators.

6. The detection method according to claim 1, characterized in that, Spatiotemporal feature extraction includes spatial feature extraction and temporal feature extraction. Spatial feature extraction uses a module consisting of a convolutional layer (Conv), batch normalization (BN), ReLU activation, max pooling (MaxPool), and a residual bypass. Temporal feature extraction uses a BiLSTM network.

7. The detection method according to claim 6, characterized in that, The BiLSTM network includes a forward LSTM network and a reverse LSTM network connected in parallel.

8. An IoT intrusion detection device based on RFE-HO, characterized in that, The apparatus is used to implement the method according to any one of claims 1-7, and includes the following modules: The preprocessing module is used to preprocess the benchmark dataset and divide it into training and test sets; The RFE-HO module is used to perform feature selection on the training set by recursive feature elimination (RFE) and hippopotamus HO optimization to obtain the optimal feature subset. The model building module is used to train the spatiotemporal feature extraction model using the optimal feature subset to obtain the trained model; The classification and detection module is used to classify and detect the test set using the trained model to obtain normal or aggressive detection results.

9. An electronic device, characterized in that, The electronic device includes: Memory, which stores executable instructions; A processor that executes the executable instructions in the memory to implement the method of any one of claims 1-7.

10. A computer storage medium, characterized in that, The medium stores a computer program, which is executed by a processor to implement the method described in any one of claims 1-7.

Images