An internet of things intrusion detection system and method based on multi-dimensional features

Abstract

The application provides a multi-dimensional feature-based Internet of Things intrusion detection system and method, relates to the technical field of network intrusion detection, and performs optimization screening, feature reconstruction and compression on network traffic features and physical state features based on a pre-optimized artificial rabbit optimization algorithm to obtain low-dimensional feature representation; a conditional generative adversarial network is constructed, the conditional generative adversarial network is adversarially trained based on the low-dimensional feature representation and attack category identification, and a synthetic attack sample is generated; a balanced training set is constructed according to the synthetic attack sample, the network traffic features and the physical state features, and a space-time fusion detection model is constructed; the space-time fusion detection model is optimized and trained using the balanced training set to obtain an optimized intrusion detection model, and then an intrusion judgment result is generated based on the optimized intrusion detection model; and the application can realize the generation of adversarial samples and the joint discrimination of space-time deep features to improve the detection accuracy of small sample Internet of Things intrusion attacks.

Description

Technical Field

[0001] This application relates to the field of network intrusion detection technology, and more specifically, to an Internet of Things (IoT) intrusion detection system and method based on multi-dimensional features. Background Technology

[0002] With the explosive growth and widespread application of IoT devices, their open and heterogeneous network environment makes them a prime target for cyberattacks. Network intrusion detection, as a core technology for protecting network infrastructure security, aims to identify abnormal behavior and potential attacks by analyzing network traffic or system logs. Traditional intrusion detection methods often rely on manually defined rules or single-dimensional network traffic statistics, which are insufficient to cope with the increasingly complex and varied attack patterns in IoT scenarios.

[0003] In recent years, IoT intrusion detection methods based on multi-dimensional features have gradually become a research hotspot. By analyzing network layer traffic data and fusing device physical layer state information, the ability to identify complex threats such as disguised attacks and low-rate attacks can be improved. However, existing multi-dimensional feature intrusion detection schemes still face the following key technical bottlenecks: First, IoT multi-dimensional features typically constitute a high-dimensional, heterogeneous data space with a large number of irrelevant features. When dealing with nonlinear and highly coupled IoT features, it is difficult to stably select the most discriminative feature subset, affecting the training efficiency and detection accuracy of subsequent models. Second, in real-world IoT environments, normal traffic data accounts for the vast majority, while the frequency of various attack events is extremely low, resulting in severe class imbalance in the training data. Furthermore, most methods use a single convolutional neural network to extract spatial features, failing to effectively achieve deep fusion and joint discrimination of spatiotemporal features, leading to limited detection capabilities against attacks with complex spatiotemporal patterns. Therefore, how to achieve the generation of adversarial examples and joint discrimination of spatiotemporal deep features to improve the detection accuracy of small-sample IoT intrusion attacks is a challenge facing the industry. Summary of the Invention

[0004] This application provides an IoT intrusion detection system and method based on multi-dimensional features, which can realize the generation of adversarial examples and the joint discrimination of spatiotemporal depth features to improve the detection accuracy of small-sample IoT intrusion attacks.

[0005] In a first aspect, this application provides an IoT intrusion detection method based on multi-dimensional features, the intrusion detection method comprising the following steps:

[0006] Collect network traffic characteristics and physical status characteristics;

[0007] The network traffic features and physical state features are optimized and filtered based on the pre-optimized artificial rabbit optimization algorithm to obtain an enhanced feature subset. The enhanced feature subset is then reconstructed and compressed using a denoising autoencoder to obtain a low-dimensional feature representation.

[0008] The network structure of the denoising autoencoder is used as a discriminator to construct a conditional generative adversarial network. The conditional generative adversarial network is then adversarially trained based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples.

[0009] A balanced training set is constructed based on the synthetic attack samples, the network traffic features, and the physical state features. A spatiotemporal fusion detection model is then built using a convolutional neural network and a bidirectional gated recurrent unit.

[0010] The spatiotemporal fusion detection model is optimized and trained using the balanced training set to obtain an optimized intrusion detection model. The optimized intrusion detection model extracts spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain an intrusion determination result.

[0011] In this embodiment, network traffic characteristics and physical status characteristics are collected through IoT devices.

[0012] In this embodiment, the pre-optimized artificial rabbit optimization algorithm refers to the artificial rabbit optimization algorithm based on an adaptive energy contraction strategy and a mirror reflection learning mechanism. The adaptive energy contraction strategy achieves a smooth transition from global feature optimization to local refinement through an adaptive decreasing energy factor constructed based on a logistic function. The mirror reflection learning mechanism avoids the feature selection process from getting stuck in local optima due to the complexity and variability of attack modes by calculating the mirror solution of the current candidate feature subset in the solution space.

[0013] In this embodiment, the enhanced feature subset obtained by optimizing and filtering the network traffic features and the physical state features based on the pre-optimized artificial rabbit optimization algorithm specifically includes:

[0014] Based on the pre-optimized artificial rabbit optimization algorithm, candidate feature subsets are divided according to the network traffic features and the physical state features;

[0015] The fitness is determined based on the classification performance and the number of features of the candidate feature subset;

[0016] The candidate feature subset is iteratively filtered based on an adaptive energy contraction strategy and a specular reflection learning mechanism, and an enhanced feature subset is obtained through the fitness filtering.

[0017] In this embodiment, the use of a denoising autoencoder to reconstruct and compress the enhanced feature subset to obtain a low-dimensional feature representation specifically includes:

[0018] Random noise is added to the enhanced feature subset to obtain a noisy feature set;

[0019] The noisy feature set is input into a noise reduction autoencoder, which converts the noisy feature set into a clean feature set through multiple nonlinear mappings.

[0020] The network parameters of the noise reduction autoencoder are optimized based on the reconstruction error of the purified feature set to obtain the optimized noise reduction autoencoder.

[0021] The enhanced feature subset is input into the optimized denoising autoencoder, which then outputs a low-dimensional feature representation.

[0022] In this embodiment, using the network structure of the noise-reducing autoencoder as a conditional generative adversarial network for discriminator construction specifically includes:

[0023] A discriminator for a conditional generative adversarial network is created based on the network structure of the aforementioned noise reduction autoencoder.

[0024] Construct a generator for the conditional generative adversarial network, wherein the generator generates fake samples by taking random noise and attack category identifier as conditional inputs;

[0025] Adversarial training is performed using the forged samples, and a conditional generative adversarial network is constructed based on the discriminator.

[0026] In this embodiment, the conditional generative adversarial network is trained adversarially based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples, specifically including:

[0027] The low-dimensional feature representation and the attack category identifier are concatenated to obtain the conditional input vector;

[0028] The conditional input vector is input into the discriminator and generator of the conditional generative adversarial network, respectively. Adversarial training is performed by fixing the parameters of the discriminator and optimizing the parameters of the generator, and then the generator generates synthetic attack samples.

[0029] In this embodiment, the spatiotemporal fusion detection model constructed using a convolutional neural network and a bidirectional gated recurrent unit specifically includes:

[0030] Construct a one-dimensional convolutional neural network, which is used to extract local spatial pattern features from the low-dimensional feature representation;

[0031] A bidirectional gated recurrent unit is constructed, which is used to extract temporal dependent features from the low-dimensional feature representation;

[0032] The one-dimensional convolutional neural network and the bidirectional gated recurrent unit are connected in parallel to construct a spatiotemporal fusion detection model.

[0033] In this embodiment, the spatiotemporal fusion detection model is optimized and trained using the balanced training set to obtain the optimized intrusion detection model, specifically including:

[0034] The balanced training set is divided into a training subset and a validation subset;

[0035] The training subset is input into the spatiotemporal fusion detection model to perform forward propagation calculations, and the model prediction results are obtained.

[0036] The cross-entropy loss function value is determined based on the model prediction results;

[0037] The network weight parameters of the spatiotemporal fusion detection model are updated based on the cross-entropy loss function value, and the performance index of the spatiotemporal fusion detection model is evaluated on the validation subset. When the performance index reaches the preset condition, the optimized intrusion detection model is obtained.

[0038] Secondly, this application provides an IoT intrusion detection system based on multi-dimensional features, used to execute an IoT intrusion detection method based on multi-dimensional features, the intrusion detection system comprising:

[0039] The data acquisition module is used to collect network traffic characteristics and physical status characteristics;

[0040] The optimization and dimensionality reduction module is used to optimize and filter the network traffic features and the physical state features based on the pre-optimized artificial rabbit optimization algorithm to obtain an enhanced feature subset. The enhanced feature subset is then reconstructed and compressed using a noise reduction autoencoder to obtain a low-dimensional feature representation.

[0041] The adversarial sample generation module is used to construct a conditional generative adversarial network by using the network structure of the denoising autoencoder as a discriminator, and to perform adversarial training on the conditional generative adversarial network based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples.

[0042] The training set and model building module is used to build a balanced training set based on the synthetic attack sample, the network traffic features and the physical state features, and to build a spatiotemporal fusion detection model through a convolutional neural network and a bidirectional gated recurrent unit.

[0043] The optimization detection module is used to optimize and train the spatiotemporal fusion detection model using the balanced training set to obtain an optimized intrusion detection model. The optimized intrusion detection model extracts spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain an intrusion determination result.

[0044] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects:

[0045] Network traffic features and physical state features are collected. Based on a pre-optimized artificial rabbit optimization algorithm, the network traffic features and physical state features are optimized and filtered to obtain an enhanced feature subset. A denoising autoencoder is used to reconstruct and compress the enhanced feature subset to obtain a low-dimensional feature representation. The network structure of the denoising autoencoder is used as a discriminator to construct a conditional generative adversarial network (GAN). The GAN is trained adversarially based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples. A balanced training set is constructed based on the synthetic attack samples, the network traffic features, and the physical state features. A spatiotemporal fusion detection model is constructed using a convolutional neural network and a bidirectional gated recurrent unit. The spatiotemporal fusion detection model is optimized using the balanced training set to obtain an optimized intrusion detection model. The optimized intrusion detection model extracts spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain the intrusion determination result.

[0046] Therefore, this application can achieve the joint discrimination of adversarial sample generation and spatiotemporal depth features. First, by simultaneously collecting network traffic features and physical state features, a complete information foundation is provided for capturing complex and covert attack patterns. Then, an artificial rabbit optimization algorithm based on adaptive energy contraction and specular reflection learning mechanism is used to intelligently optimize and filter the multidimensional features to obtain an enhanced feature subset, effectively eliminating redundancy and noise, mitigating the negative impact of the curse of dimensionality on model performance, and obtaining a feature representation with strong representational ability through feature reconstruction and compression, laying a solid feature foundation for high-quality sample generation and accurate detection. Second, the network structure of the trained denoising autoencoder is reused as the discriminator of the conditional generative adversarial network, based on... Adversarial training using the low-dimensional feature representations and attack category identifiers ensures alignment between the generation process and the learned robust feature space. Then, a balanced training set is constructed based on the synthetic attack samples and the original features. A spatiotemporal fusion detection model, consisting of a parallel one-dimensional convolutional neural network and bidirectional gated recurrent units, is then built. This model can extract, in parallel and fully, the local spatial anomaly patterns and long-term forward and backward temporal dependencies implicit in the input low-dimensional feature representations, facilitating deep fusion and joint discrimination of the spatiotemporal characteristics of attack behavior. Finally, the spatiotemporal fusion detection model is fully optimized and trained using the balanced training set. The resulting model can comprehensively utilize high-quality enhanced features and balanced data, enabling accurate online analysis of complex IoT traffic.

[0047] In summary, the technical solution adopted in this application can realize the joint discrimination of adversarial sample generation and spatiotemporal depth features, so as to improve the detection accuracy of small sample IoT intrusion attacks. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart of an IoT intrusion detection method based on multi-dimensional features provided in this application;

[0050] Figure 2 This is an exemplary flowchart for determining a subset of enhanced features according to the present application;

[0051] Figure 3 This is an exemplary flowchart for determining synthetic attack samples provided in this application;

[0052] Figure 4 This is a module structure diagram of an IoT intrusion detection system based on multi-dimensional features, provided in this application. Detailed Implementation

[0053] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0054] This application provides an IoT intrusion detection system and method based on multi-dimensional features. The core of the system is to collect network traffic features and physical state features; optimize and filter the network traffic features and physical state features using a pre-optimized artificial rabbit optimization algorithm to obtain an enhanced feature subset; use a denoising autoencoder to reconstruct and compress the enhanced feature subset to obtain a low-dimensional feature representation; use the network structure of the denoising autoencoder as a discriminator to construct a conditional generative adversarial network (GAN); perform adversarial training on the GAN based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples; construct a balanced training set based on the synthetic attack samples, network traffic features, and physical state features; construct a spatiotemporal fusion detection model using a convolutional neural network and a bidirectional gated recurrent unit; optimize and train the spatiotemporal fusion detection model using the balanced training set to obtain an optimized intrusion detection model; and extract spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain an intrusion determination result.

[0055] Example 1: To better understand the above technical solution, the following will provide a detailed description of the technical solution in conjunction with the accompanying drawings and specific implementation methods. (Refer to...) Figure 1 As shown in the figure, this is a flowchart of an IoT intrusion detection method based on multi-dimensional features according to this embodiment of the present application. The intrusion detection method includes the following steps:

[0056] In step S1, network traffic characteristics and physical state characteristics are collected;

[0057] In this specific implementation, network traffic characteristics and physical state characteristics are collected through an IoT device. The IoT device includes a network communication module and a physical state sensing module. The network communication module consists of a network interface controller and a protocol parsing unit, which is used to capture raw data traffic from the device's network interface and parse it to obtain network traffic characteristics. The network interface controller is responsible for physical layer signal conversion and data packet transmission and reception, and the protocol parsing unit is responsible for decoding data packets and extracting structured information. The physical state sensing module consists of a runtime counter and a temperature sensor, which is used to directly read physical state characteristics from inside the device. The runtime counter is used to accumulate and record the continuous running time of the device after it starts up, and the temperature sensor is used to monitor the temperature of the device's main control chip or key components in real time.

[0058] It should be noted that the network traffic characteristics in this application are indicators describing the communication behavior of the device, including the length of the data packet, the address information for sending and receiving, the time consumed for transmission, the type of communication protocol, etc.; the physical state characteristics are indicators describing the physical operating status of the device, including the continuous operating time of the device and the chip temperature, etc.; among them, the network traffic characteristics are used to represent the device behavior from the network interaction level, and the physical state characteristics are used to represent the device status from the physical operation level.

[0059] In step S2, the network traffic features and physical state features are optimized and filtered based on the pre-optimized artificial rabbit optimization algorithm to obtain an enhanced feature subset. The enhanced feature subset is then reconstructed and compressed using a noise reduction autoencoder to obtain a low-dimensional feature representation.

[0060] It should be noted that, in this embodiment, the pre-optimized artificial rabbit optimization algorithm refers to an artificial rabbit optimization algorithm based on an adaptive energy contraction strategy and a mirror reflection learning mechanism. The adaptive energy contraction strategy achieves a smooth transition from global feature optimization to local refinement through an adaptive decreasing energy factor constructed based on a logistic function. The mirror reflection learning mechanism avoids the feature selection process from falling into local optima due to complex and varied attack patterns by calculating the mirror solution of the current candidate feature subset in the solution space. The adaptive decreasing energy factor is a value that monotonically decreases with the number of iterations of the artificial rabbit optimization algorithm. The mirror solution is a new solution generated at a symmetrical position in the solution space based on the current value of the candidate feature subset through a specific mathematical mapping, used to introduce a new search direction when the algorithm stagnates. Furthermore, using the pre-optimized artificial rabbit optimization algorithm for feature selection can systematically traverse the high-dimensional feature space, avoiding premature convergence to suboptimal feature combinations. The mirror reflection learning mechanism can enhance the artificial rabbit optimization algorithm's ability to cope with multi-peak optimization problems caused by complex attack patterns, increasing the probability of finding the globally optimal feature subset.

[0061] Preferably, in this embodiment, reference Figure 2 As shown, this diagram is an exemplary flowchart for determining an enhanced feature subset according to the present application. In this embodiment, the enhanced feature subset is obtained by optimizing and filtering the network traffic features and the physical state features based on a pre-optimized artificial rabbit optimization algorithm, which can be implemented using the following steps:

[0062] First, in step S21, based on the pre-optimized artificial rabbit optimization algorithm, a subset of candidate features is divided by the network traffic features and the physical state features;

[0063] Then, in step S22, the fitness is determined based on the classification performance and the number of features of the candidate feature subset;

[0064] Finally, in step S23, the candidate feature subset is iteratively filtered based on the adaptive energy contraction strategy and the specular reflection learning mechanism, and the enhanced feature subset is obtained through the fitness filtering.

[0065] In practice, firstly, the collected network traffic features and physical state features are merged into a feature list. Based on this feature list, each individual in the pre-optimized artificial rabbit optimization algorithm corresponds to a candidate feature subset. The candidate feature subset is encoded as follows: a binary vector with the same length as the feature list is created, where a value of 1 indicates that the corresponding feature is selected, and a value of 0 indicates that the feature is not selected. This completes the partitioning of the candidate feature subset. Then, each candidate feature subset is input into the classifier for training and validation to obtain the classification accuracy under that feature subset. The number of features selected as 1 in the candidate feature subset is obtained. The product of the classification accuracy and the reciprocal of the number of features is then used as the fitness value. A higher fitness value indicates that the feature subset has a stronger classification ability and a more concise feature set. Finally, based on the fitness values ​​obtained from the above steps, the artificial rabbit optimization algorithm is driven to perform iterative screening. In each iteration, the pre-optimized artificial rabbit optimization algorithm, through an adaptive energy contraction strategy, decides whether to conduct global exploration or local development of the candidate feature subset based on the current value of the adaptive decreasing energy factor. During global exploration, the algorithm randomly selects and modifies some bits in the binary vector of the candidate feature subset. During local development, the algorithm refers to the candidate feature subset with the highest current fitness and adjusts its own binary vector. That is, when it is detected that the fitness no longer improves after several consecutive iterations, a mirror reflection learning mechanism is triggered to generate mirror solutions for the current best candidate feature subsets. The mirror solutions are generated by performing a logical "NOT" operation on the binary vector and then performing a logical "OR" operation on the result with a random mask. The feature set selected through repeated iterations of the above process can be used as the enhanced feature subset.

[0066] It should be noted that, in this embodiment, the candidate feature subset is the set to be evaluated; fitness is a quantitative indicator that combines classification performance and feature sparsity, used to guide the algorithm to evolve towards selecting feature combinations that are "accurate in classification and have a small number of features"; global exploration involves a large-scale random search in the solution space to discover potential advantageous regions; local development involves a fine search near the discovered advantageous regions to approximate the optimal solution; mirror solution is a new candidate feature subset created by escaping local optima, and its generation method ensures that the new solution is both different from and related to the parent solution; enhanced feature subset is a feature set that combines high discriminative power and low redundancy. By selecting enhanced feature subset, the subjectivity and inefficiency of manual feature selection can be solved, providing an optimized input data foundation for building a high-performance intrusion detection model.

[0067] In this embodiment, the enhanced feature subset is reconstructed and compressed using a denoising autoencoder to obtain a low-dimensional feature representation. Specifically, this can be achieved in the following manner:

[0068] Random noise is added to the enhanced feature subset to obtain a noisy feature set;

[0069] The noisy feature set is input into a noise reduction autoencoder, which converts the noisy feature set into a clean feature set through multiple nonlinear mappings.

[0070] The network parameters of the noise reduction autoencoder are optimized based on the reconstruction error of the purified feature set to obtain the optimized noise reduction autoencoder.

[0071] The enhanced feature subset is input into the optimized denoising autoencoder, which then outputs a low-dimensional feature representation.

[0072] In specific implementation, firstly, a random number following a normal distribution is generated for each feature dimension. This random number is multiplied by a preset noise intensity coefficient and added to the original feature value to obtain a noisy feature set. Secondly, the denoising autoencoder network consists of an encoder and a decoder connected sequentially. In this embodiment, the noisy feature set first passes through the encoder, which is composed of fully connected layers. Each layer performs a linear transformation on the input data and then passes it through an activation function. After passing through the encoder, the dimension of the data is gradually reduced before being fed into the decoder. The decoder recovers and maps the low-dimensional latent feature vectors back to the original dimension space, thus obtaining the cleaned feature set. Then, the corresponding feature values ​​of corresponding samples are subtracted and the square is taken to obtain the reconstruction error. Then, through the backpropagation algorithm and gradient descent optimizer, all adjustable parameters in the denoising autoencoder network are adjusted to continuously reduce the value of the reconstruction error, resulting in an optimized denoising autoencoder. Finally, the original un-noise-added enhanced feature subset is input into the optimized denoising autoencoder. That is, the data only passes through the encoder part of the denoising autoencoder and does not pass through the decoder part. The vector with compressed dimensions output by the encoder is then used as a low-dimensional feature representation.

[0073] It should be noted that the noisy feature set is artificially constructed noisy data for training the robustness of the denoising autoencoder; the cleaned feature set is the clean data output by the decoder of the denoising autoencoder, which attempts to recover from the noise; the reconstruction error is a key indicator for measuring the reconstruction capability of the denoising autoencoder and is used to guide the optimization direction of the network parameters; the optimized denoising autoencoder refers to a network model whose network parameters have been trained and can effectively extract robust essential features from noisy input and reconstruct clean data; the encoder is the network part of the denoising autoencoder responsible for compressing high-dimensional input into low-dimensional latent representations; the low-dimensional feature representation refers to the features after filtering out random interference and noise in the original data, which can provide a high-confidence feature basis for the classifier.

[0074] In step S3, the network structure of the denoising autoencoder is used as a discriminator to construct a conditional generative adversarial network. The conditional generative adversarial network is then trained adversarially based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples.

[0075] In this embodiment, the network structure of the noise-reducing autoencoder can be used as a condition for constructing a generative adversarial network for the discriminator, specifically in the following manner:

[0076] A discriminator for a conditional generative adversarial network is created based on the network structure of the aforementioned noise reduction autoencoder.

[0077] Construct a generator for the conditional generative adversarial network, wherein the generator generates fake samples by taking random noise and attack category identifier as conditional inputs;

[0078] Adversarial training is performed using the forged samples, and a conditional generative adversarial network is constructed based on the discriminator.

[0079] In practice, firstly, the optimized denoising autoencoder network structure and parameters are copied. The copied network takes the data sample to be judged as input and outputs the result of the sample reconstructed by the encoder-decoder. The copied network is used as the discriminator of the conditional generative adversarial network (GAN), and the authenticity of the sample can be measured by calculating the difference between the input sample and its reconstructed result. Then, the generator of the GAN is constructed. The generator is an independent artificial neural network, usually composed of several fully connected layers. The generator has two input conditions: the first input is a noise vector randomly sampled from a standard normal distribution, and the second input is a numerical code representing a specific attack type, called the attack category label. These two input conditions are concatenated into a long vector, which is then fed into the fully connected layer of the generator and undergoes a nonlinear transformation to obtain a vector with the same dimension as the low-dimensional feature representation. This vector is used as the fake sample. Finally, adversarial training is conducted using fake samples and real samples. In each training round, the low-dimensional feature representation sample and its corresponding attack category identifier are first input into the discriminator. The difference between each real sample and its own reconstruction result is calculated to obtain the reconstruction error of the real sample. At the same time, a random noise vector and a specified attack category identifier are input into the generator to generate fake samples. The fake samples and their attack category identifiers are then input into the same discriminator to calculate the reconstruction error of the fake samples. The parameters of the generator are then fixed, while the parameters of the discriminator are adjusted. The goal is to reduce the reconstruction error of the real samples and increase the reconstruction error of the fake samples. Specifically, fixing the parameters of the discriminator and adjusting the parameters of the generator aims to reduce the reconstruction error generated by the fake samples input into the discriminator. This alternating optimization process is repeated until the network training is stable, resulting in a conditional generative adversarial network.

[0080] It should be noted that the discriminator is built on a denoised autoencoder structure and can evaluate the authenticity of the data by calculating the reconstruction error of the input data. The generator is a neural network used to synthesize fake samples with a distribution similar to real data, conditioned on random noise and category information. The fake samples are data synthesized by the generator based on conditional inputs, designed to mimic the characteristics of real attacks. In addition, the discriminator inherits the robust representation ability of the essential features of normal and attack traffic learned from the data by the denoised autoencoder, which gives the discriminator a strong discriminative foundation in the early stages of adversarial training. It can more stably and accurately guide the generator to learn the distribution of real attack samples in the feature space, which helps to solve the data imbalance problem caused by the scarcity of real attack samples.

[0081] Preferably, in this embodiment, reference Figure 3 As shown, this diagram is an exemplary flowchart for determining synthetic attack samples according to the present application. In this embodiment, the conditional generative adversarial network is adversarially trained based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples, which can be achieved through the following steps:

[0082] First, in step S31, the low-dimensional feature representation and the attack category identifier are concatenated to obtain the conditional input vector;

[0083] Then, in step S32, the conditional input vector is input into the discriminator and generator of the conditional generative adversarial network respectively. Adversarial training is performed by fixing the parameters of the discriminator and optimizing the parameters of the generator, and then the generator generates synthetic attack samples.

[0084] In practice, the numerical code representing the attack type (attack category identifier) ​​is first converted into a fixed-length one-hot encoded vector. This one-hot encoded vector is then used as an additional feature and directly connected to the end of the low-dimensional feature representation vector to form a combined vector that incorporates category information. This combined vector is then used as a conditional input vector. Then, the conditional generative adversarial network (GAN) is trained using conditional input vectors. The training consists of two alternating phases: a discriminator training phase and a generator training phase. In the discriminator training phase, the conditional input vectors corresponding to the real low-dimensional feature representation samples are input into the discriminator, while the generator parameters are kept constant. Only the discriminator parameters are optimized to minimize the reconstruction error generated by real samples in the discriminator. In the generator training phase, the generator generates fake samples based on random noise vectors and specified attack category identifiers. These fake samples are then concatenated with the corresponding attack category identifiers to form the conditional input vector of the fake samples, which is then input into the discriminator. The two training phases are repeated, alternately optimizing the parameters of the discriminator and the generator, until the training process reaches a preset number of rounds or the quality of the generated samples tends to stabilize. After training, the generator outputs synthetic data samples with the same dimension as the low-dimensional feature representation and conforming to the characteristics of the attack type. These synthetic data samples are used as synthetic attack samples.

[0085] It should be noted that the conditional input vector is a representation that integrates data features and class labels, allowing both the discriminator and generator to clearly identify the attack type of the data during processing, thereby achieving conditional sample generation and discrimination. Fixed parameters refer to temporarily not updating the connection weights of that part of the network during training, maintaining its current state. Optimized parameters refer to adjusting the network's connection weights using the backpropagation algorithm based on the calculated error to reduce it. Furthermore, in this application, synthetic attack samples can be mixed with the original data, greatly expanding the number of minority class attack samples, thus constructing a class-balanced training dataset, which helps solve the problems of scarce attack samples and uneven data distribution in real-world IoT environments.

[0086] In step S4, a balanced training set is constructed based on the synthetic attack sample, the network traffic features, and the physical state features, and a spatiotemporal fusion detection model is constructed using a convolutional neural network and a bidirectional gated recurrent unit.

[0087] In specific implementation, the balanced training set is constructed based on the synthetic attack samples, network traffic features, and physical state features using the following method: The synthetic attack samples, network traffic features and physical state features of the normal category extracted from the original data, and network traffic features and physical state features of the real attack category are combined according to a preset ratio through a data merging operation. The preset ratio is set such that the ratio of the total number of normal category samples to the total number of samples of all attack categories (including real attacks and synthetic attacks) is 1:1, and the number of samples for each specific attack subclass (such as DoS, Probe, etc.) is consistent with the total number of samples for that attack category after synthesis. It should be noted that the preset 1:1 ratio forces the model to treat normal traffic and attack traffic patterns equally during training. A balanced training set refers to a dataset where the number of samples in each category (especially the normal category and various attack categories) has been manually adjusted to achieve a relatively balanced state. The balanced training set is used to train a spatiotemporal fusion detection model, which helps to eliminate model training bias caused by the fact that normal samples far outnumber attack samples in the original data.

[0088] In this embodiment, the spatiotemporal fusion detection model constructed using a convolutional neural network and a bidirectional gated recurrent unit can be implemented in the following manner:

[0089] Construct a one-dimensional convolutional neural network, which is used to extract local spatial pattern features from the low-dimensional feature representation;

[0090] A bidirectional gated recurrent unit is constructed, which is used to extract temporal dependent features from the low-dimensional feature representation;

[0091] The one-dimensional convolutional neural network and the bidirectional gated recurrent unit are connected in parallel to construct a spatiotemporal fusion detection model.

[0092] In specific implementation, firstly, a one-dimensional convolutional neural network is constructed. A one-dimensional convolutional layer is created using a deep learning framework. The input dimension of this layer is set to the dimension of the low-dimensional feature representation, and multiple one-dimensional convolutional kernels are set to perform sliding calculations on the input sequence. Each convolutional kernel is responsible for extracting a specific local feature pattern. After the one-dimensional convolutional layer, a one-dimensional pooling layer is added to downsample the features extracted by the convolution, retaining the most significant feature information while reducing the data dimension. The one-dimensional convolutional neural network is constructed by stacking convolutional layers and pooling layers, and its final output is a feature map. Each feature vector in the feature map represents a local spatial pattern feature captured from the original low-dimensional feature representation. Then, a bidirectional gated recurrent unit (GRU) is constructed. A GRU layer is created using a deep learning framework, configured to have bidirectional processing capabilities, and the input dimension of this layer is also set to the dimension of the low-dimensional feature representation. The bidirectional GRU layer consists of two independent GRUs: one processes the input data forward along the time step, and the other processes it backward along the time step. For the input low-dimensional feature representation, the forward GRU is computed from front to back, capturing the temporal dependencies from front to back; the backward GRU is computed from back to front, capturing the temporal dependencies from back to front. The outputs of the forward and backward processing at each time step are concatenated to obtain the final output sequence of the bidirectional GRU. Each vector in this sequence incorporates the past and future contextual information of that time step, representing the temporal dependency features captured from the low-dimensional feature representation. Finally, the constructed one-dimensional convolutional neural network and bidirectional gated recurrent units are connected in parallel to build a spatiotemporal fusion detection model. Specifically, low-dimensional feature representations are simultaneously and in parallel input to both the one-dimensional convolutional neural network and the bidirectional gated recurrent units. The local spatial pattern feature map output by the one-dimensional convolutional neural network is flattened and converted into a one-dimensional feature vector. The temporal dependency feature sequence output by the bidirectional gated recurrent units is typically the output of the last time step, or it is obtained by global average pooling to form another one-dimensional feature vector. These two one-dimensional feature vectors are concatenated to form a joint feature vector that integrates spatial and temporal information. A fully connected layer and an output layer are then connected after this joint feature vector to obtain the spatiotemporal fusion detection model.

[0093] It should be noted that local spatial pattern features refer to the numerical values ​​that can represent the statistical characteristics of a local region, calculated on the continuous feature dimension covered by the sliding one-dimensional convolutional kernel; temporal dependent features refer to the features that reflect the changes in data over time, retained by the gated recurrent unit after selectively memorizing and forgetting information at different time steps in the input sequence through its internal gating mechanism; in addition, the parallel fusion structure in this application enables the model to make full use of the spatial and temporal information contained in the low-dimensional feature representation, thereby more comprehensively and accurately identifying IoT intrusion behaviors with complex patterns that exhibit both spatial feature anomalies and temporal series anomalies.

[0094] In step S5, the spatiotemporal fusion detection model is optimized and trained using the balanced training set to obtain an optimized intrusion detection model. The optimized intrusion detection model extracts spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain an intrusion determination result.

[0095] In this embodiment, the spatiotemporal fusion detection model is optimized and trained using the balanced training set to obtain the optimized intrusion detection model. This can be achieved in the following manner:

[0096] The balanced training set is divided into a training subset and a validation subset;

[0097] The training subset is input into the spatiotemporal fusion detection model to perform forward propagation calculations, and the model prediction results are obtained.

[0098] The cross-entropy loss function value is determined based on the model prediction results;

[0099] The network weight parameters of the spatiotemporal fusion detection model are updated based on the cross-entropy loss function value, and the performance index of the spatiotemporal fusion detection model is evaluated on the validation subset. When the performance index reaches the preset condition, the optimized intrusion detection model is obtained.

[0100] In practice, firstly, the balanced training set is divided into a training subset and a validation subset. A stratified sampling method is used to ensure that the ratio of normal samples to various attack samples in both the training and validation subsets remains consistent with the original balanced training set during the partitioning process. Preferably, the training subset contains 80% of the data in the balanced training set, and the validation subset contains 20% of the data. Secondly, each data sample in the training subset (i.e., the vector resulting from the fusion of network traffic features and physical state features) is fed into the input of the spatiotemporal fusion detection model. The data sequentially passes through a parallel one-dimensional convolutional neural network branch and a bidirectional gated recurrent unit branch in the model. The two branches extract features and fuse them respectively. Finally, after processing by a fully connected layer, a vector containing multiple values ​​is output. This vector serves as the model's prediction result, where each value in the prediction result represents the model's confidence score in determining whether the input sample belongs to a specific category (such as normal or a certain type of attack). Then, the cross-entropy loss function value is determined based on the model prediction results. The cross-entropy loss function formula can be used to calculate the difference between the model's predicted vector and the true label vector. The calculated value is the cross-entropy loss function value for this sample. The average of the cross-entropy loss function values ​​is then taken for the entire training subset to obtain the final cross-entropy loss function value. Finally, based on the calculated cross-entropy loss function value, the network weight parameters of the spatiotemporal fusion detection model are updated. Specifically, the backpropagation algorithm can be used to calculate the gradient of the cross-entropy loss function value with respect to each adjustable weight parameter in the model. A gradient descent optimizer can be used to adjust each weight parameter by a small step size based on the calculated gradient direction, so that the cross-entropy loss function value can be reduced in the next iteration. After each parameter update, the data from the validation subset is input into the spatiotemporal fusion detection model under the current parameter state. The model's performance is evaluated using metrics such as accuracy. When the performance metrics on the validation subset no longer improve within five consecutive preset training epochs, the model is considered to have reached its current optimal state, training is stopped, and the optimized intrusion detection model is obtained.

[0101] It should be noted that the training subset is the data portion specifically used for adjusting the model weight parameters, while the validation subset is the data portion used to independently evaluate the model's generalization ability during training and prevent overlearning of the characteristics of the training subset data; the model prediction result is the model's probability estimate of the input sample belonging to each category; the cross-entropy loss function is a mathematical measure of the difference between the model's predicted probability distribution and the true label distribution; and the network weight parameters are the connection strength between neurons in each layer of the model, and their values ​​determine the specific behavior of the model.

[0102] In specific implementation, the optimized intrusion detection model extracts spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain the intrusion determination result. This can be achieved as follows: First, the low-dimensional feature representation is input into the optimized intrusion detection model. The spatial pattern features are extracted from the low-dimensional feature representation through the one-dimensional convolutional neural network branch of the intrusion detection model, and the bidirectional temporal features are extracted from the low-dimensional feature representation through the bidirectional gated recurrent unit branch of the intrusion detection model. The one-dimensional convolutional neural network branch refers to a neural network composed of multiple one-dimensional convolutional layers and pooling layers, whose function is to capture the correlation patterns between locally adjacent features in the data through sliding calculations of the convolutional kernels. The bidirectional gated recurrent unit branch refers to a neural network composed of two independent forward and backward gated recurrent units, whose function is to perform forward and backward processing on the sequence data through a gating mechanism to capture the temporal or sequential dependencies of the data. Then, the spatial pattern features extracted by the one-dimensional convolutional neural network branch and the bidirectional temporal features extracted by the bidirectional gated recurrent unit branch are concatenated to form a fused joint feature vector. The joint feature vector is then fed into the fully connected layer of the model for nonlinear transformation and information integration. Finally, the classification layer at the end of the model performs probability mapping and logical judgment on the joint feature vector. Based on the learned weights, the classification layer calculates the probability value of the input sample belonging to the "normal" or various "attack" categories. The category with the highest probability value is taken as the final output, and this output category label is the intrusion determination result.

[0103] It should be noted that, in this application, spatial pattern features in low-dimensional feature representation refer to a set of statistically correlated numerical combinations that appear consecutively in the feature dimension, discovered through convolution operations. These reflect anomalies or regularities in a certain local feature segment of the data. Bidirectional temporal features refer to vector representations obtained by processing feature sequences in both forward and reverse directions, reflecting the dynamic relationship between the current feature state and previous historical states. By extracting spatial pattern features and bidirectional temporal features, intrusion judgment results can be obtained through joint analysis and decision-making of spatial pattern features and bidirectional temporal features. This is beneficial for comprehensively utilizing the two key clues of spatial local anomalies and temporal series anomalies that exist simultaneously in IoT traffic data, thereby achieving more accurate and robust identification and judgment of complex, covert, and spatiotemporally characteristic intrusion attacks.

[0104] In summary, the technical solution adopted in this application can realize the joint discrimination of adversarial sample generation and spatiotemporal depth features, so as to improve the detection accuracy of small sample IoT intrusion attacks.

[0105] Example 2: This application provides an IoT intrusion detection system based on multi-dimensional features, referring to... Figure 4As shown, this figure is a module structure diagram of an IoT intrusion detection system based on multi-dimensional features according to this application. The intrusion detection system includes:

[0106] Data acquisition module 100 is used to collect network traffic characteristics and physical status characteristics;

[0107] The optimization and dimensionality reduction module 200 is used to optimize and filter the network traffic features and the physical state features based on the pre-optimized artificial rabbit optimization algorithm to obtain an enhanced feature subset, and to use a noise reduction autoencoder to reconstruct and compress the enhanced feature subset to obtain a low-dimensional feature representation.

[0108] The adversarial sample generation module 300 is used to construct a conditional generative adversarial network by using the network structure of the denoising autoencoder as a discriminator, and to perform adversarial training on the conditional generative adversarial network based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples.

[0109] The training set and model building module 400 is used to build a balanced training set based on the synthetic attack sample, the network traffic features and the physical state features, and to build a spatiotemporal fusion detection model through a convolutional neural network and a bidirectional gated recurrent unit.

[0110] The optimization detection module 500 is used to optimize and train the spatiotemporal fusion detection model using the balanced training set to obtain an optimized intrusion detection model. The optimized intrusion detection model extracts spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain an intrusion determination result.

[0111] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0112] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compactdisc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.

[0113] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

Claims

1. An IoT intrusion detection method based on multi-dimensional features, characterized in that, The intrusion detection method includes the following steps: Collect network traffic characteristics and physical status characteristics; The network traffic features and physical state features are optimized and filtered based on a pre-optimized artificial rabbit optimization algorithm to obtain an enhanced feature subset. Random noise is added to the enhanced feature subset to obtain a noisy feature set. The noisy feature set is input into a denoising autoencoder, which converts the noisy feature set into a cleaned feature set through multi-layer nonlinear mapping. The network parameters of the denoising autoencoder are optimized based on the reconstruction error of the cleaned feature set to obtain an optimized denoising autoencoder. The enhanced feature subset is then input into the optimized denoising autoencoder to output a low-dimensional feature representation. The pre-optimized artificial rabbit optimization algorithm refers to an artificial rabbit optimization algorithm based on an adaptive energy contraction strategy and a mirror reflection learning mechanism. The adaptive energy contraction strategy achieves a smooth transition from global feature optimization to local refinement through an adaptive decreasing energy factor constructed based on a logistic function. The mirror reflection learning mechanism avoids the feature selection process from getting stuck in local optima due to the complexity and variability of attack modes by calculating the mirror solution of the current candidate feature subset in the solution space. The optimized denoising autoencoder network structure and parameters are copied. The input of the copied network is the data sample to be discriminated, and its output is the result of the sample reconstructed by the encoder-decoder. The copied network is used as the discriminator of the conditional generative adversarial network. The discriminator inherits the robust representation ability of the denoising autoencoder on the essential features of normal and attack traffic learned from the data. A generator for the conditional generative adversarial network is constructed, wherein the generator generates fake samples with random noise and attack category identifiers as conditional inputs, performs adversarial training using the fake samples, and constructs the conditional generative adversarial network based on the discriminator; the conditional generative adversarial network is then adversarially trained based on the low-dimensional feature representation and attack category identifiers to generate synthetic attack samples; A balanced training set is constructed based on the synthetic attack samples, the network traffic features, and the physical state features. A spatiotemporal fusion detection model is then built using a convolutional neural network and a bidirectional gated recurrent unit. The spatiotemporal fusion detection model is optimized and trained using the balanced training set to obtain an optimized intrusion detection model. The optimized intrusion detection model extracts spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain an intrusion determination result.

2. The IoT intrusion detection method based on multi-dimensional features as described in claim 1, characterized in that, Network traffic characteristics and physical status characteristics are collected through IoT devices.

3. The IoT intrusion detection method based on multi-dimensional features as described in claim 1, characterized in that, The pre-optimized artificial rabbit optimization algorithm is used to optimize and filter the network traffic features and physical state features to obtain an enhanced feature subset, which specifically includes: Based on the pre-optimized artificial rabbit optimization algorithm, candidate feature subsets are divided according to the network traffic features and the physical state features; The fitness is determined based on the classification performance and the number of features of the candidate feature subset; The candidate feature subset is iteratively filtered based on an adaptive energy contraction strategy and a specular reflection learning mechanism, and an enhanced feature subset is obtained through the fitness filtering.

4. The IoT intrusion detection method based on multi-dimensional features as described in claim 1, characterized in that, The spatiotemporal fusion detection model constructed using convolutional neural networks and bidirectional gated recurrent units specifically includes: Construct a one-dimensional convolutional neural network, which is used to extract local spatial pattern features from the low-dimensional feature representation; A bidirectional gated recurrent unit is constructed, which is used to extract temporal dependent features from the low-dimensional feature representation; The one-dimensional convolutional neural network and the bidirectional gated recurrent unit are connected in parallel to construct a spatiotemporal fusion detection model.

5. The IoT intrusion detection method based on multi-dimensional features as described in claim 1, characterized in that, The spatiotemporal fusion detection model is optimized and trained using the balanced training set to obtain the optimized intrusion detection model, which specifically includes: The balanced training set is divided into a training subset and a validation subset; The training subset is input into the spatiotemporal fusion detection model to perform forward propagation calculations, and the model prediction results are obtained. The cross-entropy loss function value is determined based on the model prediction results; The network weight parameters of the spatiotemporal fusion detection model are updated based on the cross-entropy loss function value, and the performance index of the spatiotemporal fusion detection model is evaluated on the validation subset. When the performance index reaches the preset condition, the optimized intrusion detection model is obtained.

6. An IoT intrusion detection system based on multi-dimensional features, used to execute an IoT intrusion detection method based on multi-dimensional features as described in any one of claims 1 to 5, characterized in that, The intrusion detection system includes: The data acquisition module is used to collect network traffic characteristics and physical status characteristics; The optimization and dimensionality reduction module is used to optimize and filter the network traffic features and the physical state features based on the pre-optimized artificial rabbit optimization algorithm to obtain an enhanced feature subset. The enhanced feature subset is then reconstructed and compressed using a noise reduction autoencoder to obtain a low-dimensional feature representation. The adversarial sample generation module is used to take all the network parameters of the denoising autoencoder as the initial parameters of the discriminator of the conditional generative adversarial network, and to perform adversarial training on the conditional generative adversarial network based on the low-dimensional feature representation and attack category identifier to generate synthetic attack samples. The training set and model building module is used to build a balanced training set based on the synthetic attack sample, the network traffic features and the physical state features, and to build a spatiotemporal fusion detection model through a convolutional neural network and a bidirectional gated recurrent unit. The optimization detection module is used to optimize and train the spatiotemporal fusion detection model using the balanced training set to obtain an optimized intrusion detection model. The optimized intrusion detection model extracts spatial pattern features and bidirectional temporal features from the low-dimensional feature representation to obtain an intrusion determination result.

Images