Internet of Things equipment network intrusion detection method based on hybrid improved grey wolf algorithm

Abstract

The invention discloses an Internet of Things equipment network intrusion detection method based on a hybrid improved grey wolf algorithm. The method comprises the following steps: acquiring and balancing a historical network traffic data set; preliminarily filtering the features based on information gain and a variance threshold to obtain a candidate feature set; the candidate feature set is used as a search space, a hybrid improved grey wolf optimization algorithm is used for iterative optimization, an optimal general feature subset is output, and the algorithm fuses temperature control of simulated annealing and a variation crossover mechanism of differential evolution; calculating relevance scores of the features and attack types, and screening exclusive feature subsets; training a network intrusion detection model through a multi-target fitness function containing attack type weights and hardware resource adaptation coefficients based on the universal and / or exclusive feature subsets; and detecting the real-time traffic by using the trained model. According to the invention, the detection precision and the system adaptability in the dynamic Internet of Things environment are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of Internet of Things attack detection, and more particularly to an Internet of Things device network intrusion detection method based on a hybrid improved grey wolf algorithm. BACKGROUND

[0002] The large-scale deployment of Internet of Things terminal devices has become a significant feature of the digitalization process. However, due to the limited resources of Internet of Things devices, it is difficult to support complex security mechanisms, and the attacks and threats faced are also increasing. Botnet attacks based on the Internet of Things exhibit automated propagation characteristics, for example, the Mirai variant virus can infect more than 100,000 devices within 24 hours. With the rapid development of information technology, network security threats are becoming increasingly serious, and network attack methods are developing towards enhanced concealment, diversified forms, and complex technology. Deep learning technology has brought new breakthroughs to intrusion detection, and the deep anomaly detection framework has significantly improved over traditional methods. However, these deep models usually require millions of parameters (such as the standard Transformer parameter quantity exceeding 100MB), resulting in inference delays generally exceeding 50ms and memory usage exceeding 2GB, which poses a significant challenge to their deployment in resource-constrained scenarios such as the Internet of Things.

[0003] As an important step in data preprocessing, feature selection technology can significantly improve the operating efficiency and detection accuracy of classification models by optimizing data dimensions and removing irrelevant and redundant features. In order to balance detection accuracy and computational efficiency, researchers have begun to explore natural heuristic optimization algorithms. The Grey Wolf Optimizer (GWO) exhibits excellent global search capability due to its unique mechanism of simulating social hierarchical hunting behavior, and has been applied to feature selection. However, the existing technology, with the publication number CN115296851A, discloses a network intrusion detection method based on mutual information and grey wolf optimization algorithm. This type of algorithm has a clear local optimal problem, and when dealing with non-convex optimization problems, the convergence accuracy is often difficult to guarantee.

[0004] In the real network traffic data of five days of a certain Internet of Things device, about 29 features of the 77 features have information gain values less than 0.05, which are typical noise features. The existing optimization algorithms have obvious defects when processing such data: the population diversity of the standard grey wolf optimizer will decrease by 38% in the later iteration; the convergence success rate of the particle swarm algorithm in high-dimensional space is less than 45%. The current swarm intelligence optimization algorithms generally have limitations such as insufficient convergence accuracy, easy premature convergence, and poor robustness, and the existing intrusion detection methods have obvious deficiencies in dealing with dynamic network environment changes of Internet of Things devices, collaborative detection of multiple types of attacks, and adaptability of the model on different hardware resource devices, which are difficult to meet the high-precision, low-latency, and high-adaptability requirements of intrusion detection in complex Internet of Things scenarios.

[0005] Therefore, how to provide an Internet of Things device network intrusion detection method capable of reducing the amount of calculation and improving the detection efficiency and adaptability is a technical problem that technicians in the field urgently need to solve. SUMMARY

[0006] In view of the above problems, the present application is proposed to provide an Internet of Things device network intrusion detection method based on a hybrid improved grey wolf algorithm to overcome the above problems or at least partially solve the above problems.

[0007] In order to achieve the above-mentioned purpose, the present application adopts the following technical solutions: The embodiment of the present application provides an Internet of Things device network intrusion detection method based on a hybrid improved grey wolf algorithm, comprising the following steps: S1: obtaining a historical network traffic data set containing normal traffic and multiple types of attack traffic, performing class imbalance processing to obtain a balanced feature set; S2: performing preliminary filtering on the balanced feature set based on preset information gain and variance thresholds to obtain a candidate feature set; S3: taking the candidate feature set as a search space and applying a hybrid improved grey wolf optimization algorithm for iterative optimization; the hybrid improved grey wolf optimization algorithm combines the temperature control mechanism of the simulated annealing algorithm and the mutation and crossover mechanism of the differential evolution algorithm in the framework of the standard grey wolf optimization algorithm; through algorithm iterative optimization, an optimal universal feature subset is output; S4: calculating the relevance scores of each feature in the optimal universal feature subset and the attack type to screen an exclusive feature subset; S5: calculating the fitness values of each grey wolf individual through a multi-objective fitness function based on the optimal universal feature subset and / or the exclusive feature subset to obtain a final network intrusion detection model; the multi-objective fitness function of the network intrusion detection model includes an attack type weight and a hardware resource adaptation coefficient; S6: Use the final network intrusion detection model to perform intrusion detection on real-time network traffic.

[0008] Preferably, the step of class imbalance processing in step S1 specifically includes: Normal samples are downsampled based on feature importance, and normal samples with feature importance scores higher than a preset threshold are retained; Attack samples are subjected to attack type feature-guided SMOTE oversampling, in which the number of neighboring samples k is dynamically determined for different attack types, and the attribute features of the attack types are fused for directional linear interpolation to generate synthetic samples, until the number of attack samples of each type reaches the set percentage of the normal sample number.

[0009] Preferably, in step S3, the temperature control mechanism that integrates the simulated annealing algorithm includes: Employing an attack type-related temperature decay mechanism, the temperature... With the number of iterations t The percentage of currently detected attack types decreases dynamically, as shown in the formula:

[0010] in, The initial temperature. Based on the basic cooling coefficient, λ This represents the attack type influence coefficient. This represents the proportion of anomalous attack samples in the total samples during the current iteration.

[0011] Preferably, in step S3, the mutation and crossover mechanism of the fusion differential evolution algorithm includes: Assign weights to individual gray wolves participating in the mutation based on the information gain values ​​of their corresponding optimal general feature subsets and / or specific feature subsets. ; Generate mutation vectors using a feature importance-oriented mutation strategy. The formula is:

[0012] in, , , The location vector of a randomly selected gray wolf individual. This is the adaptive scaling factor.

[0013] Preferably, in step S3, the mutation and crossover mechanism of the fusion differential evolution algorithm further includes: When performing differential evolution crossover operations, the hybrid improved gray wolf optimization algorithm sets the crossover probability based on the correlation between the feature dimensions in the optimal general feature subset and / or specific feature subset corresponding to each gray wolf individual and the preset attack type. The crossover probability is positively correlated with the correlation, as shown in the formula:

[0014] in, This represents the cross-probability of the correlation between the feature dimension of an individual gray wolf and the preset attack type, which meets the required standard. This represents the crossover probability when the correlation between the feature dimension of an individual gray wolf and the preset attack type does not meet the requirements. A random number between 0 and 1, representing an individual gray wolf in the experiment. For individual gray wolf indexes, Indexed by feature dimensions.

[0015] Preferably, the method also includes a step of retaining gray wolf individuals that meet the attack type adaptation score requirements through a selection operation, as shown in the formula:

[0016] in, For the fitness function, The attack type matching score is positively correlated with the accuracy of individual gray wolves in detecting the target attack type. This represents the current position vector of the individual gray wolf. This is the position vector of the current gray wolf individual in the next iteration.

[0017] Preferably, in step S4, for different attack types, the correlation scores between each feature in the optimal general feature subset and the attack type are calculated based on mutual information and chi-square test.

[0018] Preferably, the multi-objective fitness function F in step S5 is expressed as:

[0019] in, , , , For weight parameters, To improve detection accuracy; Latency For reasoning delay; For attack type detection, an adaptation score is given. This refers to the hardware resource adaptation coefficient.

[0020] Preferably, in step S5, the process of calculating the fitness value of each individual gray wolf also includes a dynamic feedback control mechanism: During iterative training, the detection accuracy of various attacks is monitored. If the detection accuracy of a certain type of attack drops continuously by more than a preset range, the detection weight of that type of attack is automatically increased. And / or, monitor hardware resource utilization; if it exceeds a preset threshold, then prune the optimal general feature subset and / or the specific feature subset.

[0021] Preferably, in step S5, the network intrusion detection model trained is a lightweight classification model that integrates a spatiotemporal attention mechanism; the spatiotemporal attention mechanism includes: a temporal attention branch that captures periodic patterns and burst features of attack characteristics through sliding window attention, and a spatial attention branch that establishes the propagation relationship of attack characteristics between network nodes by utilizing cross-device correlation attention.

[0022] The technical solution provided in this invention addresses the problems of feature space redundancy, excessive computational load, insufficient detection efficiency, and poor adaptability in traditional intrusion detection systems by innovatively integrating simulated annealing and differential evolution algorithms on the basis of the standard gray wolf optimization algorithm, and introducing dynamic attention mechanism, attack type adaptive weight adjustment module, hardware resource awareness adaptation module, and multi-stage feature screening mechanism. The beneficial effects of this invention include at least: 1. Through a multi-stage feature selection mechanism, obvious noisy features are first filtered based on information gain and variance threshold, then the feature subset is optimized by using multi-layer collaborative improvement of the Grey Wolf algorithm, and finally, specific features are selected for attack type, effectively removing redundancy and noise.

[0023] 2. The algorithm combines the temperature dynamic adjustment of the simulated annealing algorithm with the feature-guided mutation of the differential evolution algorithm, along with a diversity maintenance strategy and a dynamic feedback control mechanism, to avoid the algorithm getting trapped in local optima.

[0024] 3. Introducing a hardware resource awareness and adaptation mechanism, the parallelism and feature subsets are dynamically adjusted based on the hardware resources of IoT devices, such as CPU performance and memory. For different types of attacks (large samples such as DDoS, small samples such as Bots), the detection weights and strategies are adaptively adjusted to effectively control the fluctuation range of detection accuracy in dynamic network environments, significantly improving system adaptability. This enables high-precision, low-latency, and highly adaptable network intrusion detection for IoT devices in complex dynamic network environments. It can be widely applied to device security protection in various IoT scenarios such as smart homes, industrial IoT, and intelligent transportation, ensuring the network communication security of IoT devices.

[0025] 4. Attack type feature-guided interpolation is introduced into the SMOTE oversampling algorithm to avoid the generation of invalid samples; the spatiotemporal attention mechanism improves detection accuracy while reducing the number of model parameters, making the model highly available on resource-constrained IoT devices and widely applicable to various IoT scenarios. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0027] Figure 1 This is a flowchart of the IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] This invention discloses a network intrusion detection method for IoT devices based on a hybrid improved Grey Wolf algorithm, taking into account multiple scales from data center to server rack to server. Figure 1 As shown, it includes the following steps: S1: Obtain a historical network traffic dataset containing normal traffic and traffic of various attack types, perform class imbalance processing, and obtain a balanced feature set; S2: Based on preset information gain and variance thresholds, the balanced feature set is initially filtered to obtain a candidate feature set; S3: Using the candidate feature set as the search space, the hybrid improved gray wolf optimization algorithm is applied for iterative optimization. The hybrid improved gray wolf optimization algorithm integrates the temperature control mechanism of the simulated annealing algorithm and the mutation and crossover mechanism of the differential evolution algorithm in the framework of the standard gray wolf optimization algorithm. Through iterative optimization of the algorithm, the optimal general feature subset is output. S4: For different attack types, calculate the correlation score between each feature in the optimal general feature subset and the attack type to select a specific feature subset; S5: Based on the optimal general feature subset and / or specific feature subset, the fitness value of each individual gray wolf is calculated through a multi-objective fitness function to obtain the final network intrusion detection model; the multi-objective fitness function of the network intrusion detection model includes attack type weights and hardware resource adaptation coefficients; S6: Utilize the final network intrusion detection model to perform intrusion detection on real-time network traffic.

[0030] It should be noted that the standard Grey Wolf Optimizer (GWO) algorithm uses... α Individual-level data guides the global search. β , δ Level-based individual collaborative regional exploration. ω The hierarchical collaborative mechanism, where individuals are responsible for local development, exhibits good convergence characteristics in low-dimensional optimization problems. The formula for the behavior of a gray wolf pack surrounding its prey is:

[0031]

[0032] in, Represents the prey's position vector. This represents the current position vector of the gray wolf. For the number of iterations, , For the coefficient vector ( The range of values ​​for changes dynamically with the number of iterations, and is used to control the search direction; (Using a random vector to increase search randomness) This represents the distance vector between the gray wolf and its prey.

[0033] As the complexity of problems increases, GWO reveals significant shortcomings in handling complex issues, exposing three key flaws: Population diversity declines. In the later stages of iteration, ω-level individuals become overly reliant on the leadership, which can easily lead to search stagnation.

[0034] It has poor adaptability in high-dimensional spaces. A fixed hunting radius makes it difficult to balance the exploration and development of non-convex problems.

[0035] Risk of premature convergence. Traditional GWO is highly sensitive to the initial solution and is prone to getting trapped in local optima.

[0036] To address the aforementioned shortcomings of GWO, this invention proposes a multi-layered collaborative improved gray wolf algorithm, which employs a hybrid improved gray wolf optimization algorithm for iterative optimization. This hybrid improved gray wolf optimization algorithm integrates the temperature control mechanism of simulated annealing and the mutation and crossover mechanism of differential evolution within the framework of the standard gray wolf optimization algorithm.

[0037] In one embodiment, the step of class imbalance handling in step S1 specifically includes: Normal samples are downsampled based on feature importance, and normal samples with feature importance scores higher than a preset threshold are retained; Attack samples are subjected to attack type feature-guided SMOTE oversampling, in which the number of neighboring samples k is dynamically determined for different attack types, and the attribute features of the attack types are fused for directional linear interpolation to generate synthetic samples, until the number of attack samples of each type reaches the set percentage of the normal sample number.

[0038] In step S1, five days of real network traffic data from a specific IoT device were selected. Due to the influence of device performance and network environment, the device network data exhibited a significant class imbalance and included multiple attack types, with significant differences in the number of samples for different attack types. A stratified sampling strategy was adopted. For the dominant normal traffic samples, a feature importance weighted downsampling technique is adopted: first, based on a comprehensive evaluation of information gain and mutual information value, the feature importance score of each normal sample is calculated, and the top 60% of the samples with the highest feature importance scores are retained. While ensuring the data distribution characteristics, low-value normal samples are removed, the number of majority class samples is reduced, and computational redundancy is reduced.

[0039] For a small number of attack samples, the existing SMOTE oversampling algorithm is improved by introducing an attack type feature-guided interpolation mechanism. The specific steps are as follows: Step 101: Determine the k nearest neighbors of each minority class sample. Classify by attack type (e.g., Bot, Web / Brute), and count the number of samples for each attack type. For attack types with fewer than 1000 samples (e.g., Bot), set the k value (number of nearest neighbors) to 5; for attack types with 1000-5000 samples (e.g., Web / Brute), set the k value to 8, ensuring that effective synthetic samples can be generated for attack types with different sample sizes.

[0040] Step 102: In the feature space among these samples, typical features of this attack type (such as the periodic connection feature of Bot attacks and the high-frequency request feature of Web / Brute) are fused and directional linear interpolation is performed to intelligently generate synthetic samples with unique features of this attack type, avoiding the generation of meaningless redundant samples.

[0041] Step 103: Repeat the above process until the number of attack samples of each class reaches 80%-90% of the number of samples of the majority class. This will alleviate the class imbalance problem and avoid oversampling, which could lead to model overfitting.

[0042] In one embodiment, step S2 removes features with an information gain value lower than 0.05 and a variance lower than 0.1, thus initially filtering out obvious noise features.

[0043] In one embodiment, step S3 introduces a simulated annealing (SA) algorithm, utilizes its temperature control mechanism to dynamically adjust the search range, and designs an attack type-related temperature decay mechanism to control the temperature. T With the number of iterations t The percentage of currently detected attack types decreases dynamically, as shown in the formula:

[0044] in, This indicates the initial temperature (usually 1000). Based on the coefficient of performance (0 < <1, default value is 0.97). This is the attack type influence coefficient (value ranges from 0.05 to 0.15, dynamically adjusted based on the number of attack types; the more attack types, the greater the influence). The larger ( This represents the proportion of anomalous attack samples in the total samples during the current iteration. This mechanism enables the algorithm to perform a wide-ranging exploration in the initial iteration phase. When the proportion of anomalous attack samples increases, the temperature decay rate is accelerated, quickly focusing on the potential optimal feature region, effectively avoiding premature convergence, and adapting to the feature search needs of different attack types.

[0045] In one embodiment, in step S3, a Differential Evolution (DE) mechanism is introduced at the algorithm's underlying layer, and a feature importance-oriented mutation strategy is designed to generate mutation vectors. When selecting individuals with high feature importance scores for mutation, the formula is as follows:

[0046] in, , , For randomly selected individual position vectors, An adaptive scaling factor (ranging from 0.4 to 0.9, dynamically adjusted with the number of iterations; larger values ​​in the early stages to enhance global search, and smaller values ​​in the later stages to strengthen local exploration). The importance weight of individual features is calculated based on the information gain value of the corresponding feature of the individual. The higher the information gain value, the greater the weight.

[0047] In one embodiment, step S3, the mutation crossover mechanism of the fusion differential evolution algorithm further includes: The hybrid improved gray wolf optimization algorithm sets the crossover probability based on the correlation between the feature dimension in the optimal general feature subset and / or specific feature subset corresponding to each gray wolf individual and the preset attack type when performing differential evolution crossover operations. The crossover probability is positively correlated with the correlation. The crossover operation generates test vectors. At the same time, higher cross-probability is set for feature dimensions with high correlation to attack types, such as traffic rate and connection number characteristics associated with DDoS attacks, while basic cross-probability is set for other dimensions. The formula is:

[0048] in, A higher cross-probability (value 0.7-0.9) is set for feature dimensions with high correlation to attack types. The base crossover probability (value 0.4-0.6) is set for other dimensions. A random number between 0 and 1 For individual indexes, Indexed by feature dimensions.

[0049] In one embodiment, the method further includes a step of retaining gray wolf individuals that meet the attack type adaptation score requirements through a selection operation, specifically: By selecting and retaining superior individuals, and considering the current attack type detection requirements, individuals that improve the accuracy of target attack type detection are given additional scores (e.g., individuals that improve Bot attack detection accuracy receive an additional 0.1 points). The formula is as follows:

[0050] in, For the fitness function, Attack type adaptation score (value 0-0.1, determined based on the individual's improvement in the accuracy of target attack type detection; the greater the improvement, the higher the score). For the test vector, For the current individual vector, This represents the current position vector of the individual gray wolf. This is the position vector of the current gray wolf individual in the next iteration.

[0051] In one embodiment, step S4 calculates the correlation score between each feature in the candidate feature subset and the attack type based on mutual information and chi-square test for different attack types (such as DDoS, Bot, Web / Brute), retains the top 80% of features with the highest correlation scores, and forms the final exclusive feature subset for each attack type to improve the detection accuracy of specific attack types.

[0052] In one embodiment, to optimize the model's real-time performance while ensuring detection accuracy, step S5 adds a multi-objective fitness function to the hybrid improved gray wolf algorithm. Furthermore, it introduces attack type weights and hardware resource adaptation coefficients into the multi-target fitness function. F Represented as:

[0053] in, , , , For weight parameters (satisfying) + + + =1, with default values ​​of 0.4, 0.2, 0.2, and 0.2, which can be adjusted according to the actual scenario. The detection accuracy (value 0-1); Latency Inference delay (unit: ms); The attack type detection adaptation score (values ​​from 0 to 1, calculated based on the average F1 score of the model for detecting various types of attacks; the higher the F1 score, the higher the score). The hardware resource adaptation coefficient (value 0-1, calculated based on the model's memory usage and CPU utilization on the target hardware device; the lower the utilization, the better). (The larger the value). Multi-objective fitness function F It can simultaneously optimize detection accuracy, inference speed, attack type adaptability, and hardware resource adaptability to meet the needs of complex IoT scenarios.

[0054] In one embodiment, step S5, the process of calculating the fitness value of each individual gray wolf, further includes a dynamic feedback control mechanism: During iterative training, the detection accuracy of various attacks is monitored. If the detection accuracy of a certain type of attack drops continuously by more than a preset range, the detection weight of that type of attack is automatically increased. And / or, monitor hardware resource utilization; if it exceeds a preset threshold, then prune the optimal general feature subset and / or the specific feature subset.

[0055] In one embodiment, in step S5, the network intrusion detection model trained is a lightweight classification model that integrates a spatiotemporal attention mechanism. The spatiotemporal attention mechanism includes: a temporal attention branch that captures periodic patterns and burst features of attack characteristics through sliding window attention, and a spatial attention branch that establishes the propagation relationship of attack characteristics between network nodes by utilizing cross-device correlation attention.

[0056] The specific training process of the final network intrusion detection model of this invention is given below: Step 1: In the initialization phase, besides determining the number of individuals the algorithm will search for (default 50-100) and the initial temperature for simulated annealing... (1000) and cooling coefficient In addition to (0.97), initial detection weights need to be set for each type of attack based on the frequency of occurrence of various attacks in historical attack data. The number of CPU cores, memory size, and video memory size of the target device are obtained through the hardware interface, and the parallelism of model computation and memory usage thresholds are set.

[0057] Step 2: Based on the improved multi-objective fitness function The fitness value of each individual is calculated. A hierarchical non-dominated sorting strategy is adopted: the first level sorts by fitness value and selects the top 30% of individuals; the second level sorts the remaining individuals by attack type detection F1 score and selects the top 20% of individuals; the third level sorts the remaining individuals by hardware resource suitability coefficient and selects the top 10% of individuals. Together, these form the initial Pareto optimal solution set, and the current globally optimal individual is marked. .

[0058] Step 3: Update the current temperature based on the temperature decay mechanism associated with the attack type. T(t) When accepting inferior solutions according to the Metropolis criterion, priority is given to solutions that can improve the performance of low-detection-accuracy attack types (such as bots), avoiding the neglect of small-sample attack detection due to excessive pursuit of global optimum; mutation and crossover operations are performed according to feature importance-oriented mutation strategy and adaptive crossover probability, and the better individuals are retained through greedy selection. Simultaneously, population diversity is calculated every 10 iterations (measured by the mean Euclidean distance of individual location vectors). If the diversity falls below 35%, a population restart mechanism is triggered (randomly replacing 20% ​​of individuals with newly generated individuals based on historically optimal feature combinations) to maintain global search capability; the GWO layer integrates SA and DE results for updates. After determining the individual position, the detection accuracy of the new generation population against various attacks is calculated. If the detection accuracy of a certain type of attack decreases by more than 5% for three consecutive iterations, the detection weight of that attack type is automatically increased by 0.05 (maximum not exceeding 0.5). At the same time, the model's attention to the features of that type of attack is adjusted (such as increasing the gradient update amplitude of the features associated with that type of attack), forming a dynamic feedback control mechanism. Every 20 iterations, the memory usage and CPU utilization of the model on the target device are monitored. If the memory usage exceeds the threshold, the feature subset of the model is automatically pruned (removing the 5% of features with the lowest information gain value in the current feature subset). If the CPU utilization is below 30% (parallelism not reaching the maximum), the computational parallelism is increased (maximum not exceeding the number of CPU cores) to improve the iteration speed.

[0059] Step 4: After the data iteration ends, decode the globally optimal individual. The binary encoded strings are concatenated to output the final feature subset. A spatiotemporal attention mechanism significantly reduces the number of model parameters while improving attack detection accuracy. This mechanism employs a dual-branch structure to handle spatiotemporal features separately: in the time dimension, sliding window attention effectively captures the periodic patterns and burst characteristics of DDoS attacks; in the spatial dimension, cross-device correlation attention establishes the abnormal traffic propagation relationship between network nodes, reducing the number of model parameters while improving detection accuracy.

[0060] Step 5: When the maximum number of iterations is reached (default 100-200 times) or the globally optimal individual is achieved for 15 consecutive iterations. The iteration terminates when the fitness value changes by less than 0.001. Decode the globally optimal individual. The binary encoded string (a bit of 1 indicates that the corresponding feature is selected, and a bit of 0 indicates that it is not selected) is combined with the attack-specific feature subsets after multi-stage feature filtering to output the final general feature subset (applicable to all attack type detection) and the specific feature subset (optimized subset for various types of attacks).

[0061] After model training, the network intrusion detection model for IoT devices is saved. To improve model usability, the trained model is divided into four layers: core algorithm layer, feature selection layer, attention mechanism layer, and hardware adaptation layer, and saved separately. The parameter types and loading logic of each layer are as follows: The core algorithm layer primarily stores parameters for the multi-layered collaborative improvement gray wolf algorithm, including the number of individuals, the number of iterations, and the initial temperature. Cooling coefficient Scaling factor F Crossover probability and The algorithm framework is initialized by directly reading the core algorithm layer during model loading.

[0062] The feature filtering layer mainly stores the indexes of general feature subsets and attack-specific feature subsets, as well as the corresponding information gain values ​​and correlation scores. When the model is loaded, the corresponding feature subsets in the feature filtering layer are called according to different detection scenarios, such as general detection or specific attack detection.

[0063] The attention mechanism layer mainly stores the spatiotemporal attention parameters that are adaptive to the attack type, including the time window size and the spatial attention weight matrix. When the model is loaded, the attention weights are dynamically adjusted in combination with the current detected attack type.

[0064] The hardware adaptation layer mainly stores parameters such as the number of CPU cores, memory threshold, and computational parallelism of the device. These parameters are dynamically loaded during model deployment and adjusted according to the different hardware resources of the target device to optimize the model's computation process and parameters.

[0065] Since training a model is time-consuming, transfer learning can be considered. By fine-tuning the model, such as fixing the parameters of the core algorithm layers and only updating the parameters of the feature selection layer and attention mechanism layer, it is possible to identify network intrusion traffic data of other IoT devices. Alternatively, the current network structure can be used, but the currently trained network weights can be discontinued, and the model can be retrained based on the traffic data of new devices to train the model as a network intrusion detection model for a specific type of IoT device.

[0066] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting network intrusion of IoT devices based on a hybrid improved gray wolf algorithm, characterized in that, Includes the following steps: S1: Obtain a historical network traffic dataset containing normal traffic and traffic of various attack types, perform class imbalance processing, and obtain a balanced feature set; S2: Based on preset information gain and variance thresholds, the balanced feature set is initially filtered to obtain a candidate feature set; S3: Using the candidate feature set as the search space, the hybrid improved gray wolf optimization algorithm is applied for iterative optimization; the hybrid improved gray wolf optimization algorithm integrates the temperature control mechanism of simulated annealing algorithm and the mutation and crossover mechanism of differential evolution algorithm in the framework of standard gray wolf optimization algorithm; through algorithm iterative optimization, the optimal general feature subset is output; S4: For different attack types, calculate the correlation score between each feature in the optimal general feature subset and the attack type to select a specific feature subset; S5: Based on the optimal general feature subset and / or the specific feature subset, calculate the fitness value of each individual gray wolf through a multi-objective fitness function to obtain the final network intrusion detection model; the multi-objective fitness function of the network intrusion detection model includes attack type weights and hardware resource adaptation coefficients; S6: Use the final network intrusion detection model to perform intrusion detection on real-time network traffic.

2. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 1, characterized in that, The specific steps for handling class imbalance in step S1 include: Normal samples are downsampled based on feature importance, and normal samples with feature importance scores higher than a preset threshold are retained; Attack samples are subjected to attack type feature-guided SMOTE oversampling, in which the number of neighboring samples k is dynamically determined for different attack types, and the attribute features of the attack types are fused for directional linear interpolation to generate synthetic samples, until the number of attack samples of each type reaches the set percentage of the normal sample number.

3. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 1, characterized in that, In step S3, the temperature control mechanism of the integrated simulated annealing algorithm includes: Employing an attack type-related temperature decay mechanism, the temperature... With the number of iterations t The percentage of currently detected attack types decreases dynamically, as shown in the formula: in, The initial temperature. Based on the basic cooling coefficient, λ This represents the attack type influence coefficient. This represents the proportion of anomalous attack samples in the total samples during the current iteration.

4. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 1, characterized in that, In step S3, the mutation and crossover mechanism of the fusion differential evolution algorithm includes: Assign weights to individual gray wolves participating in the mutation based on the information gain values ​​of their corresponding optimal general feature subsets and / or specific feature subsets. ; Generate mutation vectors using a feature importance-oriented mutation strategy. The formula is: in, , , The location vector of a randomly selected gray wolf individual. This is the adaptive scaling factor.

5. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 4, characterized in that, In step S3, the mutation and crossover mechanism of the fusion differential evolution algorithm also includes: When performing differential evolution crossover operations, the hybrid improved gray wolf optimization algorithm sets the crossover probability based on the correlation between the feature dimensions in the optimal general feature subset and / or specific feature subset corresponding to each gray wolf individual and the preset attack type. The crossover probability is positively correlated with the correlation, as shown in the formula: in, This represents the cross-probability of the correlation between the feature dimension of an individual gray wolf and the preset attack type, which meets the required standard. This represents the crossover probability when the correlation between the feature dimension of an individual gray wolf and the preset attack type does not meet the requirements. A random number between 0 and 1, representing an individual gray wolf in the experiment. For individual gray wolf indexes, Indexed by feature dimensions.

6. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 5, characterized in that, It also includes the step of retaining gray wolf individuals that meet the attack type adaptation score requirements through a selection operation, the formula of which is: in, For the fitness function, The attack type matching score is positively correlated with the accuracy of individual gray wolves in detecting the target attack type. This represents the current position vector of the individual gray wolf. This is the position vector of the current gray wolf individual in the next iteration.

7. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 1, characterized in that, In step S4, for different attack types, the correlation scores between each feature and the attack type in the optimal general feature subset are calculated based on mutual information and chi-square test.

8. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 1, characterized in that, The multi-objective fitness function F in step S5 is expressed as: in, , , , For weight parameters, To improve detection accuracy; Latency For reasoning delay; For attack type detection, an adaptation score is given. This refers to the hardware resource adaptation coefficient.

9. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 1, characterized in that, In step S5, the process of calculating the fitness value of each individual gray wolf also includes a dynamic feedback control mechanism: During iterative training, the detection accuracy of various attacks is monitored. If the detection accuracy of a certain type of attack drops continuously by more than a preset range, the detection weight of that type of attack is automatically increased. And / or, monitor hardware resource utilization; if it exceeds a preset threshold, then prune the optimal general feature subset and / or the specific feature subset.

10. The IoT device network intrusion detection method based on the hybrid improved gray wolf algorithm according to claim 1, characterized in that, In step S5, the trained network intrusion detection model is a lightweight classification model that integrates a spatiotemporal attention mechanism; The spatiotemporal attention mechanism includes: a temporal attention branch that captures periodic patterns and burst features of attack characteristics through sliding window attention, and a spatial attention branch that establishes the propagation relationship of attack characteristics between network nodes by utilizing cross-device correlation attention.

Images