The invention discloses an
Internet of Things intrusion detection method based on a Transform and GNN
hybrid model, a model, a training method of the model and
electronic equipment, belongs to the technical field of
deep learning, and aims at solving the problem that statistical characteristics,
time sequence characteristics and topological characteristics of traffic are learned at the same time to utilize network space characteristics for
Internet of Things intrusion detection. The method is characterized by comprising the following steps of: carrying out position coding on network flow data in
the Internet of Things, inputting the network flow data into an
encoder of a Transform model, and outputting a first embedding embedding vector; the network flow is converted into a first graph, the host is a node of the first graph, and the network flow is an edge of the first graph; the first graph is converted into a second graph through a Line
Graph model, the network flow is a node of the second graph, and the relation between the host pairs is an edge of the second graph; inputting the second graph into the GNN model, and outputting a second embedding embedding vector; and splicing the first embedding embedding vector and the second embedding embedding vector to obtain a spliced vector, inputting the spliced vector into a classifier, and outputting an
Internet of Things intrusion detection result by the classifier, so that
topological information can be captured, and relevance between different flows can be captured.