The invention discloses an
Internet of Things intrusion detection method and
system, and relates to the field of
information security and
Internet of Things. Comprising the steps of performing preprocessing of
feature selection, one-hot coding, normalization, sample balance and data cleaning on
Internet of Things traffic data; training a generative
deep learning model AAE and a generative
deep learning model BiGAN based on the preprocessed IoT-23
data set; after traffic collected in real time is subjected to the same preprocessing, an AAE or BiGAN model is firstly used for distinguishing abnormal and normal traffic, and then a
KNN classifier is used for judging an
attack type; abnormal traffic characteristics are stored in an IoTDB
time sequence database; the method comprises the following steps: regularly calculating TPR, TNR, FPR, FNR and unknown category ratio UNR according to examination results of a
vulnerability library and a
threat intelligence
library, switching between AAE and BiGAN according to the UNR, triggering model retraining according to a TPR-FPR difference value or a TNR-FNR difference value, and dynamically adjusting a sample balance coefficient R at the same time. Through a two-stage detection framework and a dynamic feedback mechanism,
the Internet of Things intrusion detection accuracy is improved, and the deployment cost is reduced.