Method and system for identifying abnormal traffic of Internet of Things based on deep neural network

Abstract

The invention relates to the technical field of Internet of Things anomaly identification, in particular to an Internet of Things anomaly traffic identification method and system based on a deep neural network. The method comprises the following steps: collecting communication data of each piece of IoT equipment in real time from an edge gateway of the Internet of Things; preprocessing the collected communication data, and constructing a multi-dimensional feature vector; based on a convolutional neural network and a bidirectional long-short-term memory network, performing time sequence feature extraction and anomaly discrimination on the multi-dimensional feature vector to output a traffic anomaly probability; and comparing the abnormal probability output by the depth time sequence modeling neural network with a dynamic threshold value, and if the abnormal probability exceeds a preset threshold value, determining that the traffic is abnormal. A gating mechanism is introduced into a bidirectional long-short-term memory layer, a gating coefficient is calculated at a time step level, the influence weight of time step information on final output is dynamically adjusted, feature expression of key time steps is strengthened, noise or irrelevant information is suppressed, and the sensitivity of a model to time sequence data is improved.

Description

Technical Field

[0001] This invention relates to the field of IoT anomaly identification technology, and more specifically, to an IoT anomaly traffic identification method and system based on deep neural networks. Background Technology

[0002] With the large-scale deployment of IoT devices in industrial control, urban management, and home security, devices frequently communicate using lightweight protocols (such as MQTT, CoAP, and ZigBee). However, IoT communication is characterized by its simple structure, high frequency, diverse protocols, and limited resources, making traditional network intrusion detection methods based on signature rules or thresholds difficult to adapt. In particular, these methods exhibit weak identification capabilities, poor real-time performance, and high false alarm rates when facing novel, slow, or protocol-spoofed abnormal traffic.

[0003] Among them, devices frequently initiating fake heartbeat connection requests, repeatedly sending messages with empty topics, and unauthorized devices suddenly accessing core service interfaces may all constitute network threats. However, traditional methods are difficult to identify their subtle but abnormal behavioral characteristics. Therefore, there is an urgent need for an IoT abnormal traffic identification method and system based on deep neural networks. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for identifying abnormal traffic in the Internet of Things (IoT) based on deep neural networks, in order to solve the problem mentioned in the background art that devices frequently initiate fake heartbeat connection requests, repeatedly send messages with empty topics, and unauthorized devices suddenly access core service interfaces, all of which may constitute network threats, but traditional methods are unable to identify their subtle but abnormal behavioral characteristics.

[0005] To achieve the above objectives, the present invention aims to provide a method for identifying abnormal traffic in the Internet of Things (IoT) based on deep neural networks, comprising the following steps:

[0006] S1. Collect communication data from each IoT device in real time from the IoT edge gateway;

[0007] S2. Preprocess the collected communication data to extract protocol semantic features, statistical traffic features, temporal evolution features, and device identity codes, and construct a multi-dimensional feature vector X. t ;

[0008] S3. Based on convolutional neural networks and bidirectional long short-term memory networks, and by introducing an attention mechanism, a deep temporal modeling neural network is constructed to process the multidimensional feature vector X. t Perform time-series feature extraction and anomaly detection to output the probability of traffic anomalies;

[0009] In the deep temporal modeling neural network training process, anomaly label information is used to optimize network parameters, and a focus loss function combined with a time weight mechanism and enhanced sample weights is used to improve the model's ability to identify minority abnormal behaviors.

[0010] S4. Compare the abnormal probability output by the deep temporal modeling neural network with the dynamic threshold. If the abnormal probability exceeds the preset threshold, it is determined to be abnormal traffic.

[0011] As a further improvement to this technical solution, in step S1, the communication data includes quintuple information, protocol payload field, timestamp, connection status, and communication duration.

[0012] As a further improvement to this technical solution, the specific steps involved in constructing the deep temporal modeling neural network in step S3 are as follows:

[0013] The multidimensional feature vector X at consecutive time points t splicing to form a time feature sequence

[0014] A deep temporal modeling neural network is constructed based on convolutional neural networks, bidirectional long short-term memory networks, and attention mechanisms, and then optimized through training.

[0015] The deep temporal modeling neural network includes at least: a local feature extraction layer, a bidirectional long short-term memory layer, an attention mechanism layer, and an output layer;

[0016] Time feature series As input to a deep temporal modeling neural network, the time feature sequence is processed by a local feature extraction layer. Perform one-dimensional convolution operations to extract local mutation patterns and short-term behavioral fragment features, and output the convolutional feature sequence.

[0017] Convolutional features As input to the bidirectional long short-term memory layer, the context representation vector h at each time step is obtained. t ;

[0018] A gating mechanism is introduced into the bidirectional long short-term memory layer, and the gating coefficient g is calculated at the time step level. t ;

[0019] The context representation sequence processed by the gating mechanism is input into the attention mechanism layer, and the time step weights β are calculated. t Then, a weighted fusion is performed to obtain the global temporal feature vector H;

[0020] The global temporal feature vector H is input into the output layer, and the anomaly probability P is calculated using the Sigmoid activation function. abn(t).

[0021] As a further improvement to this technical solution, the gating mechanism is specifically as follows:

[0022] At each time step t in the bidirectional long short-term memory layer, the gating coefficient g is calculated based on the context representation vector at the current time. t ;

[0023] Introduce the hidden state change amplitude statistics using a sliding window and dynamically update the gating threshold τ;

[0024] When the gate coefficient g t When the value is below the gating threshold τ, the hidden state update at that moment is selectively skipped;

[0025] When the gate coefficient g t When the value is greater than or equal to τ, the hidden state is updated normally.

[0026] As a further improvement to this technical solution, the training and optimization steps of the deep temporal modeling neural network are as follows:

[0027] An anomaly label set Y is constructed by labeling, and the time feature sequence is also included. Construct the original training sample dataset

[0028] From the original training sample dataset Extract all labels containing anomalies y i Time series segments, forming anomaly subsets

[0029] For the original training sample dataset Exception subsets in Expand to generate an enhanced set of anomaly samples. And enhance the abnormal sample set Merge into the original training sample dataset In the process, the augmented dataset is obtained.

[0030] Using augmented datasets The deep temporal modeling neural network is iteratively trained, and the network weight parameters are updated in each training round using forward propagation and backward propagation until the maximum number of training rounds is reached.

[0031] Save the optimal model weights after training is complete.

[0032] As a further improvement to this technical solution, the abnormal subset is... Expand to generate an enhanced set of anomaly samples. The following methods are involved:

[0033] In the abnormal subset In the timestamp sequence, a disturbance term δ following a uniform distribution is introduced into the timestamp of each moment in the timestamp sequence. j,k Generate K for each original abnormal sample time Each time-perturbation version forms a time-perturbation subset of the enhanced anomalous sample set.

[0034] Simultaneously, time series with lengths similar to the anomalous segments are randomly selected from the normal sample set and spliced ​​with the anomalous sequences at the splicing boundary to construct new label sequences. These new label sequences include both normal and anomalous labels. The set of all spliced ​​sequences and their corresponding label sequences constitutes the enhanced anomalous sample set.

[0035] Two anomalous sequences and their corresponding labels are randomly selected, and the mixture is weighted element-wise along the feature dimension according to the mixing coefficient to generate a mixed sequence and its corresponding soft label sequence. The set of all samples generated through the mixing operation and their soft label sequences constitutes the enhanced anomalous sample set.

[0036] As a further improvement to this technical solution, the training optimization method for the deep temporal modeling neural network further includes:

[0037] Before training begins, the network parameters of the deep temporal modeling neural network are initialized using Xavier;

[0038] During training, the focus loss function is used as the loss function to optimize the deep temporal modeling neural network;

[0039] By introducing a time weight mechanism into the focus loss function and fusing enhanced sample weights, the model's attention to anomalous samples at key time steps is enhanced.

[0040] As a further improvement to this technical solution, the focus loss function introduces a time weighting mechanism and integrates enhanced sample weights. The specific steps involved are as follows:

[0041] The context relevance score of each time step is calculated by using a bidirectional long short-term memory layer combined with an attention mechanism, and then normalized to obtain the time weight coefficient.

[0042] A multi-source anomalous sample enhancement strategy based on temporal perturbation, sequence splicing, and feature mixing is used to label the source type of each sample and assign it a corresponding enhancement sample weight coefficient.

[0043] The time weights are combined with the augmented sample weights to guide the optimization of the focus loss function.

[0044] As a further improvement to this technical solution, the judgment process for identifying abnormal traffic in step S4 includes the following steps:

[0045] Establish a dynamic threshold θ for each monitored object t The dynamic threshold θ t Used to distinguish between normal and abnormal probability distributions, and the dynamic threshold θ t Based on sliding window statistics settings;

[0046] For each sample at each time step, the traffic anomaly probability output by the deep temporal modeling neural network is compared with the corresponding dynamic threshold θ. t Compare;

[0047] If the probability of abnormal traffic flow is greater than the dynamic threshold, then time step t is determined as an abnormal candidate moment; otherwise, it is determined as a normal moment.

[0048] On the other hand, the present invention provides an IoT abnormal traffic identification system based on a deep neural network, used to implement the IoT abnormal traffic identification method based on a deep neural network as described in any one of the above claims, comprising:

[0049] The data acquisition module is used to capture IoT communication data streams from edge network devices in real time, including quintuple information, protocol fields, timestamps, and connection status.

[0050] The feature construction module is used to normalize and slide window segment the communication data, extract protocol semantic features, statistical traffic features, temporal evolution features and device identity embedding, and construct a multi-dimensional behavioral feature vector.

[0051] The neural network recognition module includes a convolutional neural network, a bidirectional long short-term memory network, and an attention mechanism, which is used to perform temporal modeling on the behavioral feature vector and output the confidence probability of abnormal behavior.

[0052] The model training module is used to perform neural network training based on the anomaly labeled dataset. It uses the focus loss function to optimize the recognition ability and combines data augmentation techniques to improve the model's ability to perceive and generalize anomalous traffic.

[0053] The anomaly detection module is used to compare the anomaly probability output by the model with the device's dynamic threshold to identify whether it is an abnormal behavior.

[0054] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0055] 1. The IoT abnormal traffic identification method and system based on deep neural networks is based on convolutional neural networks and bidirectional long short-term memory networks. It introduces an attention mechanism to construct a deep temporal modeling neural network for slow abnormal traffic and protocol spoofing attacks, dynamically allocates network computing resources, enhances the model's sensitivity to low-frequency, scattered and highly spoofed abnormal behaviors, effectively avoids the risk of being ignored due to weak abnormal signals, ensures the real-time detection capability of abnormal traffic in complex attack scenarios, and greatly improves the practicality and security protection reliability of the system.

[0056] Meanwhile, a gating mechanism is introduced into the bidirectional long short-term memory layer, and the gating coefficient is calculated at the time step level to dynamically adjust the influence weight of the information at that time step on the final output, strengthen the feature expression of key time steps, suppress noise or irrelevant information, thereby improving the model's sensitivity and expressive ability to time series data.

[0057] 2. This IoT abnormal traffic identification method and system based on deep neural networks combines diverse data augmentation methods such as time perturbation, behavior splicing, and sequence mixing to expand the quantity and diversity of training abnormal samples, alleviating the training bottleneck caused by insufficient data. By enhancing the diversity of samples, the trained deep model has stronger generalization ability, can effectively identify unseen abnormal mutation patterns and emerging threats, significantly reduce the risk of missed detection, and improve the stability and robustness of the model in a variable network environment. Attached Figure Description

[0058] Figure 1 This is a flowchart of the overall method of the present invention. Detailed Implementation

[0059] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] Example 1: Please refer to Figure 1 As shown, this embodiment provides a method for identifying abnormal traffic in the Internet of Things (IoT) based on deep neural networks, including the following steps:

[0061] S1. Real-time collection of communication data from various IoT devices from the IoT edge gateway (through traffic parsing and field extraction by combining Deep Packet Inspection (DPI) with a protocol decoding engine);

[0062] The communication data includes 5-tuple information (source / destination address, port, protocol), protocol payload fields (such as MQTT message type, CoAP Code value, etc.), timestamp, connection status, and communication duration.

[0063] S2. The collected communication data is preprocessed (cleaning, normalization, and sliding window segmentation are performed sequentially), and protocol semantic features, statistical traffic features, temporal evolution features, and device identity codes are extracted and constructed into a multi-dimensional feature vector X. t =[F proto ‖F stat ‖F time ‖F dev ];

[0064] Specifically, in this embodiment, communication data from each IoT device is collected in real time from the IoT edge gateway, and field extraction and standardized structure construction are completed based on the protocol identification mechanism:

[0065] Based on the port number, payload mode, and message header characteristics, the protocol identification module automatically identifies the type of protocol used in the current communication (such as MQTT / CoAP / ZigBee, etc.).

[0066] For the identified protocol, the corresponding protocol parsing template is called to decode the fields and extract the semantic key fields;

[0067] All protocol fields are mapped to a unified behavior vector template, including connection identifier, message type, payload length, behavior interval, etc., and finally constructed into a structured data format that can be used as input for deep learning models, which is the technical basis for consistent modeling of cross-protocol behavior of heterogeneous devices and subsequent feature construction.

[0068] Preprocess structured data to extract multi-dimensional behavioral features:

[0069] Data cleaning removes message records with missing fields, invalid formats, or failed validation.

[0070] For numerical features (such as average packet length and packet interval), the Z-score standardization algorithm is used to unify the units of measurement;

[0071] Set window length W len and sliding step size S step The continuous communication data sequence is divided into several time slices to form time slice feature samples;

[0072] Among them, multi-dimensional behavioral characteristics include:

[0073] Protocol semantic features F proto Such as message type, field identifiers, and payload structure length;

[0074] Statistical flow characteristics F stat Examples include the number of connections per unit time, average packet length, and average packet interval.

[0075] Temporal evolution characteristics F time : behavioral intervals, periodicity, mutation frequency, etc.;

[0076] Device identification code F dev Such as MAC address, device type, and embedded behavioral history;

[0077] S3. Based on Convolutional Neural Network (CNN) and Bidirectional Long Short-Term Memory (BiLSTM) network, and by introducing an attention mechanism, a deep temporal modeling neural network is constructed to process the multidimensional feature vector X. t Perform time-series feature extraction and anomaly detection to output the probability of traffic anomalies;

[0078] In the deep temporal modeling neural network training process, anomaly label information is used to optimize network parameters, and the focus loss function is combined with time weight mechanism and enhanced sample weight to solve the problem of scarce abnormal category samples, thereby improving the model's ability to identify minority abnormal behaviors.

[0079] In this embodiment, the specific steps involved in constructing a deep temporal modeling neural network are as follows:

[0080] The multidimensional feature vector X at consecutive time points t splicing to form a time feature sequence

[0081] A deep temporal modeling neural network is constructed based on convolutional neural networks, bidirectional long short-term memory networks, and attention mechanisms, and then optimized through training.

[0082] The deep temporal modeling neural network includes at least: a local feature extraction layer (1D-CNN), a bidirectional long short-term memory layer (BiLSTM), an attention mechanism layer (Attention), and an output layer (fully connected + Sigmoid);

[0083] Time feature series As input to a deep temporal modeling neural network, the time feature sequence is processed by a local feature extraction layer. Perform one-dimensional convolution operations to extract local mutation patterns and short-term behavioral fragment features, and output the convolutional feature sequence. in, d inL represents the input feature dimension (composed of features such as protocol semantics / statistical traffic), and L represents the sequence length (number of time steps).

[0084] Convolutional features As input to the bidirectional long short-term memory layer, the context representation vector h at each time step is obtained. t ; Where, d cnn k represents the number of output channels of the convolution; * The kernel size is represented by the convolution kernel; the context represents the vector. 2d lstm Indicates the result of bidirectional splicing (forward + backward), d lstm Indicates the dimension of the hidden layer of a unidirectional LSTM;

[0085] Furthermore, a gating mechanism is introduced in the Bidirectional Long Short-Term Memory (BiLSTM) layer to calculate the gating coefficient g at the time step level. t It is used to selectively skip hidden state updates at low-importance moments, reducing the computational load of non-critical time steps, thereby reducing latency and power consumption;

[0086] The context representation sequence processed by the gating mechanism is input into the attention mechanism layer, and the time step weights β are calculated. t Then, a weighted fusion is performed to obtain the global temporal feature vector H. Global temporal feature vector H and context representation vector h t Same dimension;

[0087] The global temporal feature vector H is input into the output layer, and the anomaly probability P is calculated using the Sigmoid activation function. abn (t).

[0088] Specifically, the gating mechanism is as follows:

[0089] At each time step t in the bidirectional long short-term memory layer, the gating coefficient g is calculated based on the context representation vector at the current time. t =σ(W g h t +b g ), where σ(*) is the Sigmoid function, ensuring that the gating coefficient takes values ​​in the interval (0,1); h t W represents the context vector at time t; g b represents the weight matrix of the gated layer; g W represents the bias of the gating layer. g and b g Through backpropagation and joint training, we can adapt to the data characteristics of different business scenarios.

[0090] Introduce the hidden state change amplitude statistics using a sliding window and dynamically update the gating threshold τ;

[0091] In this embodiment: a sliding window of length w is set, and for the hidden state sequence of the most recent w time steps, its change magnitude index Δh is calculated (based on the average change intensity of the hidden state sequence within the sliding window);

[0092] Adjust the gating threshold τ in real time based on the magnitude of changes in the hidden state:

[0093] τ t =τ base ·exp(-α·Δh)

[0094] In the formula, τ base This represents the preset basic gating threshold; α is an adjustment coefficient, representing the sensitivity of the control threshold to changes in magnitude; exp(*) represents the exponential function; Δh represents the magnitude of the hidden state change (e.g., L1 / L2 norm), which is uniformly normalized (e.g., Z-score) for each dimension of the hidden state vector during the preprocessing stage, where Δh = ||h||h. t -h t-1 ‖2, where h t and h t-1 These represent the hidden state vectors at time steps t and t-1, respectively, with the same shape. ‖*‖2 represents the Euclidean norm (i.e., L2 norm).

[0095] When the gate coefficient g t When the value is below the gating threshold τ, the hidden state update at that moment is selectively skipped;

[0096] When the gate coefficient g t When the value is greater than or equal to τ, the hidden state is updated normally to ensure the complete transmission of information at critical moments.

[0097] Furthermore, abnormal traffic in the Internet of Things (IoT) often manifests as localized and weak abnormal signals. The gating mechanism can precisely identify the key features at abnormal moments, enhance BiLSTM's focus on abnormal patterns, and improve the accuracy and robustness of anomaly detection. The gating mechanism also assigns adjustable weights to each time step, enabling the model to adaptively learn the length range of time-series dependencies, capture complex temporal dynamic changes more flexibly, and adapt to diverse IoT communication behaviors.

[0098] In this embodiment, the training and optimization steps of the deep temporal modeling neural network are as follows:

[0099] Construct an anomaly label set Y = [y] using annotations. t-l ,...,y t ], where y i∈{0,1}, the anomaly label set Y is constructed based on expert annotations or attack logs, and includes time feature sequences. Construct the original training sample dataset

[0100] From the original training sample dataset Extract all labels containing anomalies y i Time series segments with a value of 1 form an anomalous subset. Each of them Y represents a time series segment of length L. (i) This represents the subset of anomaly labels corresponding to the sequence, i = 1, ..., N. anom ; Corresponding tags And there exists j such that

[0101] Among them, the normal sample pool Each A time series segment of length L;

[0102] In the formula, This represents the original training sample dataset, containing time feature sequences and corresponding labels; y i The anomaly label represents a single time step, with values ​​{0, 1}, where 1 indicates an anomaly and 0 indicates normal. This represents an anomalous subset, containing all items with an anomalous label (at least one y). i =1) time series segment; This represents the normal sample pool, which contains all time series segments without outlier labels. Let l represent the time feature sequence of the i-th abnormal segment, with length l; Y represents the multidimensional feature vector of the i-th segment at time t; (i) Let represent the label sequence corresponding to the i-th anomalous segment; j represents the time step index, ranging from the start and end interval of the segment [t-L+1, t]; i represents the anomalous sequence index, whose value range is 1≤i≤N. norm ; N represents the time feature sequence of the j-th normal sample segment, with length L; norm Indicates the total number of normal segments;

[0103] For the original training sample dataset Exception subsets in Expand to generate an enhanced set of anomaly samples. And enhance the abnormal sample set (Validation performed before merging) Merge into the original training sample dataset In the process, the augmented dataset is obtained. Among them, the enhanced abnormal sample set Generated through time perturbation, behavior splicing, and sequence mixing and expansion;

[0104] Among them, the enhanced abnormal sample set

[0105] In the formula, This represents the set after time perturbation, consisting of anomalous subsets. It is obtained by introducing a perturbation term that follows a uniform distribution into the timestamp sequence, and is used to simulate anomalies caused by time misalignment or sampling jitter; This represents the set after behavior concatenation; ∪ represents the set after sequence mixing and expansion; ∪ is the set union operation, which means merging sample sets from different sources into a single set without counting identical samples repeatedly.

[0106] Specifically, for enhancing the abnormal sample set A validation function V(*) → {true, false} is introduced to determine whether the augmented samples are valid; if valid, the augmented abnormal samples are merged into the original training set to obtain the augmented dataset. `true` indicates that the sample has passed the validation (meets requirements for time consistency, protocol validity, device constraints, etc.) and can be added to the augmented dataset; `false` indicates that the sample has failed the validation (has protocol conflicts, abnormal time features, or invalid fields, etc.) and should be discarded or regenerated.

[0107] The validation items of the validation function V(*) include, but are not limited to:

[0108] Time consistency: Packet intervals and minimum / maximum delays are within the limits allowed by the device / protocol;

[0109] Protocol validity: The field sequence conforms to the protocol semantics;

[0110] Resource / equipment constraints: Do not violate minimum timing constraints of the equipment (e.g., heartbeat must not fall below the minimum allowable limit of the equipment);

[0111] Distribution rationality: The distance (e.g., Mahalanobis distance) from the original abnormal / normal clusters is within a reasonable range;

[0112] Random sampling and manual review: A certain proportion of enhanced samples are reviewed by experts;

[0113] Using augmented datasets The deep temporal modeling neural network is trained iteratively. In each training round, the network weight parameters are updated using forward propagation and backpropagation until the preset maximum number of training rounds is reached. During the training process, the performance indicators (including accuracy, recall and F1 score) on the validation set are recorded, and the network weights corresponding to the optimal values ​​of these indicators are saved as the final model weights.

[0114] Save the optimal model weights after training is complete.

[0115] Furthermore, the above applies to anomalous subsets. Expand to generate an enhanced set of anomaly samples. The following methods are involved:

[0116] In the abnormal subset In the timestamp sequence, a disturbance term δ following a uniform distribution is introduced into the timestamp of each moment in the timestamp sequence. j,k ~U(-Δ t ,Δ t For each original abnormal sample, generate K time Each time-perturbation version forms a time-perturbation subset of the enhanced anomalous sample set.

[0117] In this embodiment, the time perturbation operation is specifically as follows:

[0118]

[0119] For each augmented sample From the The timestamp sequence is obtained by perturbing it step by step:

[0120]

[0121] δ j,k ~U(-Δ t ,Δ t )

[0122] In the formula, T j (i) This represents the original timestamp of the j-th moment in the i-th anomaly sequence; -Δ t This represents the lower bound of the time perturbation range, i.e., the maximum negative perturbation amplitude; Δ t This represents the maximum amplitude of the time disturbance (half-interval width), used to determine the range of the timestamp disturbance; δ j,k This represents the perturbation value applied to the j-th timestamp when generating time perturbation version k; δ j,k ~U(-Δ t ,Δ t ) represents the disturbance term δ j,k Follows the interval [-Δ t,Δ t A uniform distribution on [ ] is used to simulate random jitter during time sampling; N anom K represents the total number of sequences in the abnormal subset; time This represents the number of time-perturbed samples generated for each anomalous sequence; k represents the index of the time-perturbed version, ranging from 1 to k to K. time ; This represents the k-th time-perturbation version of the i-th anomalous sequence; This represents the timestamp of the i-th anomalous sequence at time j in time-perturbed version k; where the time-related features of the perturbed sequence are recalculated while maintaining the corresponding label Y. (i) constant.

[0123] Simultaneously, time series with lengths similar to the abnormal segments are randomly selected from the normal sample set and spliced ​​with the abnormal sequences at the splicing boundary (seamless or weighted overlapping splicing) to construct new label sequences. And the new label sequence Including normal and abnormal labels, the set of all concatenated sequences and their corresponding label sequences constitutes the enhanced abnormal sample set.

[0124] In this embodiment, the splicing operation is specifically as follows:

[0125]

[0126] For each From the abnormal sequence With normal sequence The result is obtained by weighted concatenation at the boundary according to the overlap length o:

[0127] The composition of the r-th point in the overlapping region is

[0128] In the formula, k′ represents the number of times the splicing operation is repeated on the same pair of sequences (normal sequence and abnormal sequence); This represents the enhanced anomalous sample time series generated by the k′ concatenation operation based on the i-th anomalous sequence and the j-th normal sequence. Indicates corresponding to A new label sequence containing normal and abnormal labels, reflecting the actual abnormal state at each time point after splicing; X mix [r] represents the feature vector at the r-th time point of the spliced ​​overlapping region, which is the result of weighted fusion of corresponding positions of the abnormal sequence and the normal sequence; ω r This represents the weighting coefficient at the r-th time point in the overlapping region, with a value range of [0,1]. It is used to control the fusion ratio of abnormal and normal sequences at that time point to ensure a seamless or smooth transition. Indicates an abnormal sequence The feature vector at the r-th time point in the overlapping area of ​​the splicing boundary; Indicates normal sequence The feature vector at the r-th time point in the overlapping region of the splicing boundary; o represents the length (time step) of the overlap between the abnormal sequence and the normal sequence at the splicing boundary; K concat The splicing factor represents the number of spliced ​​samples generated for each abnormal-normal sequence pair;

[0129] Wherein, ω can decrease linearly from 1 to 0;

[0130] The overlap length o is measured in time steps or sample points;

[0131] Corresponding label sequence Take 0 in the normal segment and remove 1 in the abnormal segment;

[0132] The overlap area is set to hard label (0 or 1 based on the percentage) or soft label (based on ω). r (Give the probability).

[0133] Two abnormal sequences and their corresponding labels were randomly selected, and the mixture was analyzed according to the mixing coefficient λ. k″ Element-wise weighting along the feature dimension generates a mixed sequence. and the corresponding soft tag sequence All samples generated through the mixing operation and their soft-label sequence sets constitute the enhanced anomaly sample set.

[0134] In this embodiment, the sequence mixing operation specifically involves:

[0135]

[0136] in, This represents the selected set of sequence pairs, containing several sequence index pairs (i′, j′), (which can be anomaly-anomaly or anomaly-normal mixed pairs). For each mixed sample, we have:

[0137]

[0138] λ k″ ~Beta(α,α)

[0139] and corresponding soft tags

[0140] In the formula, k represents the index of the number of times the mixing operation is repeated on the same pair of sequences, K mixThe upper limit of the number of mixing iterations is indicated; i′ represents the i′-th time series index of the mixing pair, and j′ represents the j′-th time series index of the mixing pair, where i′ and j′ represent two sequence indices in the sequence pair, pointing to time series segments in the original training sample dataset respectively; λ represents the augmented sample time series generated by linearly weighting the i′ and j′ sequences in the k″th iteration; k″ Let λ represent the mixing coefficient in the k″-th mixing operation. λ is a random variable following a Beta distribution Beta(α,α), with values ​​ranging from [0,1]. It controls the weighting ratio of the two sequences. α represents the shape parameter of the Beta distribution, which determines the mixing coefficient λ. k″ The distribution pattern is often positive, and α is usually chosen to be 0.2 to 1 to produce a stronger mixing effect; Y represents the i′-th time series segment in the original training sample dataset. (i′ ) indicates correspondence The abnormal label sequence; Y represents the j′-th time series segment in the original training sample dataset. ( j ′ ) indicates correspondence The abnormal label sequence; This represents the soft label sequence corresponding to the enhanced sample generated by the k″-th mixing operation, which is the result of two original label sequences weighted by the same weight λ. k″ and 1-λ k″ obtained by linear weighting;

[0141] The mixing is performed element-wise along the feature dimension. If the sequence lengths are inconsistent, they are first trimmed or padded to a uniform length according to the rules.

[0142] In this embodiment, protocol anomalies and spoofing attacks are simulated by perturbing the semantic layer fields of the protocol:

[0143] In the MQTT protocol, the length of the Topic field can be artificially set to zero or replaced with a random character sequence to simulate an illegal topic subscription;

[0144] Adjust the value of the QoS field to a level that does not conform to the normal behavior of the device (e.g., change it from 0 to 2);

[0145] In the CoAP protocol, randomly replacing the Code field (e.g., changing GET to POST) and adjusting the number of Option fields can create protocol field anomalies.

[0146] After field perturbation, the statistical flow characteristics in the sequence are updated synchronously to ensure the inherent consistency and protocol rationality of the perturbation samples; finally, the field perturbation results are combined into the enhanced anomaly sample set.

[0147] Specifically, the training optimization method for the deep temporal modeling neural network further includes:

[0148] Before training begins, Xavier is used to initialize the network parameters of the deep temporal modeling neural network to improve the network convergence speed and training stability.

[0149] During training, the Focal Loss function is used as the loss function to optimize the deep temporal modeling neural network.

[0150] By introducing a time weight mechanism into the focus loss function and incorporating augmentation sample weights (since augmentation anomalous samples (time perturbation, splicing, and mixing) are used, different loss weights are assigned to different augmentation samples to improve the model's learning effect on augmentation samples and reduce the risk of overfitting to the original samples), the model's attention to anomalous samples at key time steps is enhanced, and different loss weights are assigned to different augmentation samples.

[0151] The focus loss function introduces a time weighting mechanism and incorporates enhanced sample weights. The specific steps involved are as follows:

[0152] The context relevance score of each time step is calculated by using a bidirectional long short-term memory layer combined with an attention mechanism, and then normalized to obtain the time weight coefficient.

[0153] Multi-source anomalous sample augmentation strategy based on time perturbation, sequence concatenation, feature mixing, and protocol field perturbation (multi-source anomalous sample augmentation strategy refers to the augmentation of the original training sample dataset). Exception subsets in (Specific methods for expansion) Label the source type of each sample and assign it a corresponding augmentation sample weight coefficient;

[0154] Combining time weights with enhanced sample weights to guide the optimization of the focus loss function can enhance the model's attention to key time step features and diverse anomaly patterns.

[0155] In this embodiment:

[0156]

[0157] In the formula, This represents the optimized focus loss function; N represents the number of samples in the batch training; T represents the time step for a single sample. This represents the true label of the c-th sample at time step t (1 indicates anomaly, 0 indicates normal). γ represents the anomaly probability of the output of the deep temporal modeling neural network at time step t; γ represents the adjustment factor of the focus loss, which is used to reduce the loss contribution of the majority class samples. The time weight coefficient is obtained by normalizing the BiLSTM and the Attention layer, and reflects the importance of the time step in the sequence. represents the weight coefficient of the enhanced samples, which is assigned different weight values ​​according to the source of the samples (original samples, time perturbation enhancement, sequence splicing enhancement, etc.) to balance the contribution of different types of samples to training; c represents the sample index.

[0158] S4. Compare the anomaly probability output by the deep temporal modeling neural network with the dynamic threshold. If the anomaly probability exceeds the preset threshold, it is determined to be abnormal traffic.

[0159] The process for determining abnormal traffic includes the following steps:

[0160] Establish a dynamic threshold θ for each monitored object t The dynamic threshold θ t The dynamic threshold θ is used to distinguish between normal probability distributions and abnormal probability distributions. t Based on sliding window statistics settings:

[0161] Let W be a sliding window of length W. t Including the anomaly probabilities of the most recent W time points:

[0162] θ t =μ t +k·σ t

[0163] In the formula, μ t σ represents the mean probability of normal flow within the sliding window; t μ represents the standard deviation of the probability of normal flow within the sliding window. t With σ t All values ​​are dimensionless; k represents the adjustable sensitivity coefficient, k∈[2,4]; the preferred sliding window length is W=100;

[0164] For each sample at each time step, the traffic anomaly probability output by the deep temporal modeling neural network is compared with the corresponding dynamic threshold θ. t Compare;

[0165] If the probability of abnormal traffic flow is greater than the dynamic threshold, then time step t is determined as an abnormal candidate moment; otherwise, it is determined as a normal moment.

[0166] Furthermore, to avoid false alarms triggered by noise at a single moment, within the time window W... aggThe system aggregates and determines abnormal candidate moments within a time window. This aggregation and determination includes, but is not limited to, methods such as: aggregate and determine abnormal candidate moments based on the maximum value (essentially, a single point exceeding the threshold within the time window is considered abnormal), the number of times the threshold is exceeded (an alarm is triggered when the number of times the threshold is exceeded within the sliding window reaches a certain proportion or number), or the average magnitude of the exceedance (the average magnitude of the threshold exceeding the threshold within the window), in order to reduce false alarms caused by noise at a single moment.

[0167] When an anomaly is confirmed by aggregation, one or more of the following measures shall be taken:

[0168] Record the anomaly time window, corresponding sample index, time step range, model output probability sequence, and trigger threshold sequence in the anomaly detection log;

[0169] Trigger real-time alerts (e.g., push alerts, notifications to operations and maintenance personnel, or triggering automatic isolation policies);

[0170] Trigger response policies (such as rate limiting, blocking, or redirecting the device's session into deep inspection mode);

[0171] Sequences identified as anomalous are stored in an anomalous verification pool for review by human experts or automated labeling systems before being fed back into the training set for subsequent online model updates or semi-supervised learning.

[0172] To avoid frequent oscillations and alarm storms, an adaptive threshold update and cooling mechanism is introduced:

[0173] When a large number of abnormal triggers are detected in a short period of time and the false alarm rate is high, the threshold is gradually relaxed. When the system is in a low alarm state for a long time, the threshold can be appropriately tightened to improve sensitivity.

[0174] Introduce a minimum interval mechanism: After an alarm is triggered once, the same device is prohibited from being triggered repeatedly within the window or its priority is downgraded to reduce repeated alarms;

[0175] When validation set performance (such as recall / false positive rate) shows a systematic shift, threshold re-evaluation or model retraining is triggered.

[0176] Finally, the judgment and handling results are sent back as feedback information: the false alarms confirmed by humans and the newly labeled real anomaly samples are incorporated into the original training set and the anomaly subset is updated. Based on the newly labeled samples, the augmented dataset can be expanded according to the aforementioned multi-source anomaly sample augmentation strategy and the model can be fine-tuned or retrained.

[0177] Example 2:

[0178] This embodiment provides an IoT abnormal traffic identification system based on deep neural networks, used to implement the IoT abnormal traffic identification method based on deep neural networks described in any one of the above embodiments, including:

[0179] The data acquisition module is used to capture IoT communication data streams from edge network devices in real time, including quintuple information, protocol fields, timestamps, and connection status.

[0180] The feature construction module is used to normalize and slide window segment the communication data, extract protocol semantic features, statistical traffic features, temporal evolution features and device identity embedding, and construct a multi-dimensional behavioral feature vector.

[0181] The neural network recognition module includes a convolutional neural network, a bidirectional long short-term memory network, and an attention mechanism, which is used to perform temporal modeling on the behavioral feature vector and output the confidence probability of abnormal behavior.

[0182] The model training module is used to perform neural network training based on the anomaly labeled dataset. It uses the focus loss function to optimize the recognition ability and combines data augmentation techniques to improve the model's ability to perceive and generalize anomalous traffic.

[0183] The anomaly detection module is used to compare the anomaly probability output by the model with the device's dynamic threshold to identify whether it is an abnormal behavior.

[0184] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for identifying abnormal traffic in the Internet of Things (IoT) based on deep neural networks, characterized in that, Includes the following steps: S1. Collect communication data from each IoT device in real time from the IoT edge gateway; S2. Preprocess the collected communication data to extract protocol semantic features, statistical traffic features, temporal evolution features, and device identity codes, and construct a multi-dimensional feature vector X. t ; S3. Based on convolutional neural networks and bidirectional long short-term memory networks, and by introducing an attention mechanism, a deep temporal modeling neural network is constructed to process the multidimensional feature vector X. t Perform time-series feature extraction and anomaly detection to output the probability of traffic anomalies; In the deep temporal modeling neural network training process, anomaly label information is used to optimize network parameters, and a focus loss function combined with a time weight mechanism and enhanced sample weights is used to improve the model's ability to identify minority abnormal behaviors. S4. Compare the abnormal probability output by the deep temporal modeling neural network with the dynamic threshold. If the abnormal probability exceeds the preset threshold, it is determined to be abnormal traffic.

2. The IoT abnormal traffic identification method based on deep neural networks according to claim 1, characterized in that: In step S1, the communication data includes 5-tuple information, protocol payload field, timestamp, connection status, and communication duration.

3. The IoT abnormal traffic identification method based on deep neural networks according to claim 1, characterized in that: In step S3, the specific steps involved in constructing the deep temporal modeling neural network are as follows: The multidimensional feature vector X at consecutive time points t splicing to form a time feature sequence A deep temporal modeling neural network is constructed based on convolutional neural networks, bidirectional long short-term memory networks, and attention mechanisms, and then optimized through training. The deep temporal modeling neural network includes at least: a local feature extraction layer, a bidirectional long short-term memory layer, an attention mechanism layer, and an output layer; Time feature series As input to a deep temporal modeling neural network, the time feature sequence is processed by a local feature extraction layer. Perform one-dimensional convolution operations to extract local mutation patterns and short-term behavioral fragment features, and output the convolutional feature sequence. Convolutional features As input to the bidirectional long short-term memory layer, the context representation vector h at each time step is obtained. t ; A gating mechanism is introduced into the bidirectional long short-term memory layer, and the gating coefficient g is calculated at the time step level. t ; The context representation sequence processed by the gating mechanism is input into the attention mechanism layer, and the time step weights β are calculated. t Then, a weighted fusion is performed to obtain the global temporal feature vector H; The global temporal feature vector H is input into the output layer, and the anomaly probability P is calculated using the Sigmoid activation function. abn (t).

4. The IoT abnormal traffic identification method based on deep neural networks according to claim 3, characterized in that: The gating mechanism is specifically as follows: At each time step t in the bidirectional long short-term memory layer, the gating coefficient g is calculated based on the context representation vector at the current time. t ; Introduce the hidden state change amplitude statistics using a sliding window and dynamically update the gating threshold τ; When the gate coefficient g t When the value is below the gating threshold τ, the hidden state update at that moment is selectively skipped; When the gate coefficient g t When the value is greater than or equal to τ, the hidden state is updated normally.

5. The IoT abnormal traffic identification method based on deep neural networks according to claim 3, characterized in that: The training and optimization steps of the deep temporal modeling neural network are as follows: An anomaly label set Y is constructed by labeling, and the time feature sequence is also included. Construct the original training sample dataset From the original training sample dataset Extract all labels containing anomalies y i Time series segments, forming anomaly subsets For the original training sample dataset Exception subsets in Expand to generate an enhanced set of anomaly samples. And enhance the abnormal sample set Merge into the original training sample dataset In the process, the augmented dataset is obtained. Using augmented datasets The deep temporal modeling neural network is iteratively trained, and the network weight parameters are updated in each training round using forward propagation and backward propagation until the maximum number of training rounds is reached. Save the optimal model weights after training is complete.

6. The IoT abnormal traffic identification method based on deep neural networks according to claim 5, characterized in that: For abnormal subsets Expand to generate an enhanced set of anomaly samples. The following methods are involved: In the abnormal subset In the timestamp sequence, a disturbance term δ following a uniform distribution is introduced into the timestamp of each moment in the timestamp sequence. j,k Generate K for each original abnormal sample time Each time-perturbation version forms a time-perturbation subset of the enhanced anomalous sample set. Simultaneously, time series with lengths similar to the anomalous segments are randomly selected from the normal sample set and spliced ​​with the anomalous sequences at the splicing boundary to construct new label sequences. These new label sequences include both normal and anomalous labels. The set of all spliced ​​sequences and their corresponding label sequences constitutes the enhanced anomalous sample set. Two anomalous sequences and their corresponding labels are randomly selected, and the mixture is weighted element-wise along the feature dimension according to the mixing coefficient to generate a mixed sequence and its corresponding soft label sequence. The set of all samples generated through the mixing operation and their soft label sequences constitutes the enhanced anomalous sample set.

7. The IoT abnormal traffic identification method based on deep neural networks according to claim 5, characterized in that: The training and optimization method for the deep temporal modeling neural network also includes: Before training begins, the network parameters of the deep temporal modeling neural network are initialized using Xavier; During training, the focus loss function is used as the loss function to optimize the deep temporal modeling neural network; By introducing a time weight mechanism into the focus loss function and fusing enhanced sample weights, the model's attention to anomalous samples at key time steps is enhanced.

8. The IoT abnormal traffic identification method based on deep neural networks according to claim 7, characterized in that: The focus loss function introduces a time weighting mechanism and incorporates enhanced sample weights. The specific steps involved are as follows: The context relevance score of each time step is calculated by using a bidirectional long short-term memory layer combined with an attention mechanism, and then normalized to obtain the time weight coefficient. A multi-source anomalous sample enhancement strategy based on temporal perturbation, sequence splicing, and feature mixing is used to label the source type of each sample and assign it a corresponding enhancement sample weight coefficient. The time weights are combined with the augmented sample weights to guide the optimization of the focus loss function.

9. The IoT abnormal traffic identification method based on deep neural networks according to claim 1, characterized in that: In step S4, the decision process for identifying abnormal traffic includes the following steps: Establish a dynamic threshold θ for each monitored object t The dynamic threshold θ t Used to distinguish between normal probability distributions and abnormal probability distributions, wherein the dynamic threshold θ t Based on sliding window statistics settings; For each sample at each time step, the traffic anomaly probability output by the deep temporal modeling neural network is compared with the corresponding dynamic threshold θ. t Compare; If the probability of abnormal traffic flow is greater than the dynamic threshold, then time step t is determined as an abnormal candidate moment; otherwise, it is determined as a normal moment.

10. An IoT abnormal traffic identification system based on deep neural networks, used to implement the IoT abnormal traffic identification method based on deep neural networks as described in any one of claims 1-9, characterized in that, include: The data acquisition module is used to capture IoT communication data streams from edge network devices in real time, including quintuple information, protocol fields, timestamps, and connection status. The feature construction module is used to normalize and slide window segment the communication data, extract protocol semantic features, statistical traffic features, temporal evolution features and device identity embedding, and construct a multi-dimensional behavioral feature vector. The neural network recognition module includes a convolutional neural network, a bidirectional long short-term memory network, and an attention mechanism, which is used to perform temporal modeling on the behavioral feature vector and output the confidence probability of abnormal behavior. The model training module is used to perform neural network training based on the anomaly labeled dataset. It uses the focus loss function to optimize the recognition ability and combines data augmentation techniques to improve the model's ability to perceive and generalize anomalous traffic. The anomaly detection module is used to compare the anomaly probability output by the model with the device's dynamic threshold to identify whether it is an abnormal behavior.

Images