IoT intrusion detection method for unbalanced samples

ANTONG P; Wen CHEN; Lifa WU

doi:10.11959/j.issn.2096-109x.2023005

您当前的位置：

首页 >

文章列表页 >

IoT intrusion detection method for unbalanced samples

Papers | 更新时间：2024-06-03

- IoT intrusion detection method for unbalanced samples
- Chinese Journal of Network and Information Security Vol. 9, Issue 1, Pages: 130-139(2023)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2023005
  CLC： TP393
- Online First：2023-02，
  
  Published：25 February 2023
- 稿件说明：
移动端阅览
ANTONG P, Wen CHEN, Lifa WU. IoT intrusion detection method for unbalanced samples[J]. Chinese Journal of Network and Information Security, 2023, 9(1): 130-139.
DOI：

ANTONG P, Wen CHEN, Lifa WU. IoT intrusion detection method for unbalanced samples[J]. Chinese Journal of Network and Information Security, 2023, 9(1): 130-139. DOI： 10.11959/j.issn.2096-109x.2023005.

摘要

随着设备的迭代，网络流量呈现指数级别的增长，针对各种应用的攻击行为越来越多，从流量层面识别并对这些攻击流量进行分类具有重要意义。同时，随着物联网设备的激增，针对这些设备的攻击行为也逐渐增多，造成的危害也越来越大。物联网入侵检测方法可以从这些海量的流量中识别出攻击流量，从流量层面保护物联网设备，阻断攻击行为。针对现阶段各类攻击流量检测准确率低以及样本不平衡问题，提出了基于重采样随机森林（RF，random forest）的入侵检测模型——Resample-RF，共包含3种具体算法：最优样本选择算法、基于信息熵的特征归并算法、多分类贪心转化算法。在物联网环境中，针对不平衡样本问题，提出最优样本选择算法，增加小样本所占权重，从而提高模型准确率；针对随机森林特征分裂效率不高的问题，提出基于信息熵的特征归并算法，提高模型运行效率；针对随机森林多分类精度不高的问题，提出多分类贪心转化算法，进一步提高准确率。在两个公开数据集上进行模型的检验，在 IoT-23 数据集上 F1 达到0.99，在Kaggle数据集上F1达到1.0，均具有显著效果。从实验结果中可知，提出的模型具有非常好的效果，能从海量流量中有效识别出攻击流量，较好地防范黑客对应用的攻击，保护物联网设备，从而保护用户。

Abstract

In recent years

network traffic increases exponentially with the iteration of devices

while more and more attacks are launched against various applications.It is significant to identify and classify attacks at the traffic level.At the same time

with the explosion of Internet of Things (IoT) devices in recent years

attacks on IoT devices are also increasing

causing more and more damages.IoT intrusion detection is able to distinguish attack traffic from such a large volume of traffic

secure IoT devices at the traffic level

and stop the attack activity.In view of low detection accuracy of various attacks and sample imbalance at present

a random forest based intrusion detection method (Resample-RF) was proposed

which consisted of three specific methods: optimal sample selection algorithm

feature merging algorithm based on information entropy

and multi-classification greedy transformation algorithm.Aiming at the problem of unbalanced samples in the IoT environment

an optimal sample selection algorithm was proposed to increase the weight of small samples.Aiming at the low efficiency problem of random forest feature splitting

a feature merging method based on information entropy was proposed to improve the running efficiency.Aiming at the low accuracy problem of random forest multi-classification

a multi-classification greedy transformation method was proposed to further improve the accuracy.The method was evaluated on two public datasets.F1 reaches 0.99 on IoT-23 dataset and 1.0 on Kaggle dataset

both of which have good performance.The experimental results show that the proposed model can effectively identify the attack traffic from the massive traffic

better prevent the attack of hackers on the application

protect the IoT devices

and thus protect the related users.

关键词

Keywords

references

BREIMAN L . Random forests [J ] . Machine Learning , 2001 , 45 ( 1 ): 5 - 32 .

ZHANG G P . Neural networks for classification:a survey [J ] . IEEE Transactions on Systems,Man,and Cybernetics,Part C (Applications and Reviews) , 2000 , 30 ( 4 ): 451 - 462 .

朱应武 , 杨家海 , 张金祥 . 基于流量信息结构的异常检测 [J ] . 软件学报 , 2010 , 21 ( 10 ): 2573 - 2583 .

ZHU Y W , YANG J H , ZHANG J X . Anomaly detection based on traffic information structure [J ] . Journal of Software , 2010 , 21 ( 10 ): 2573 - 2583 .

WANG G , HAO J , MA J , et al . A new approach to intrusion detection using artificial neural networks and fuzzy clustering [J ] . Expert Systems with Applications , 2010 , 37 ( 9 ): 6225 - 6232 .

麻文刚 , 张亚东 , 郭进 . 基于LSTM与改进残差网络优化的异常流量检测方法 [J ] . 通信学报 , 2021 , 42 ( 5 ): 23 - 40 .

MA W G , ZHANG Y D , GUO J . Abnormal traffic detection method based on LSTM and improved residual neural network optimization [J ] . Journal on Communications , 2021 , 42 ( 5 ): 23 - 40 .

高妮 , 高岭 , 贺毅岳 , 王海 . 基于自编码网络特征降维的轻量级入侵检测模型 [J ] . 电子学报 , 2017 , 45 ( 3 ): 730 - 739 .

GAO N , GAO L , HE Y Y , WANG H . A lightweight intrusion detection model based on antoencoder network with feature reduction [J ] . Acta Electronica Sinica , 2017 , 45 ( 3 ): 730 - 739 .

TAVALLAEE M , BAGHERI E , LU W , et al . A detailed analysis of the KDD CUP 99 data set [C ] // 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications . 2009 : 1 - 6 .

ZHANG J , LING Y , FU X , et al . Model of the intrusion detection system based on the integration of spatial-temporal features [J ] . Computers ＆ Security , 2020 ,89:101681.

FENG X , SUN R , ZHU X , et al . Snipuzz:black-box fuzzing of IoT firmware via message snippet inference [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2021 : 337 - 350 .

SHEKARI T , IRVENE C , CARDENAS A A , et al . MaMIoT:Manipulation of energy market leveraging high wattage IoT botnets [C ] // Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security . 2021 : 1338 - 1356 .

REZAEI A . Using ensemble learning technique for detecting botnet on IoT [J ] . SN Computer Science , 2021 , 2 ( 3 ): 1 - 14 .

韩春雨 , 张永铮 , 张玉 . Fast-flucos:基于 DNS 流量的 Fast-flux恶意域名检测方法 [J ] . 通信学报 , 2020 , 41 ( 5 ): 37 - 47 .

HAN C Y , ZHANG Y Z , ZHANG Y . Fast-flucos:malicious domain name detection method for fast-flux based on DNS traffic [J ] . Journal on Communications , 2020 , 41 ( 5 ): 37 - 47 .

HAN X , PASQUIER T , BATES A , et al . Unicorn:runtime provenance-based detector for advanced persistent threats [J ] . arXiv preprint arXiv:2001.01525 , 2020 .

ZHANG J , LING Y , FU X , et al . Model of the intrusion detection system based on the integration of spatial-temporal features [J ] . Computers ＆ Security , 2020 ,89:101681.

PAXSON V . Bro:a system for detecting network intruders in real-time [J ] . Computer Networks , 1999 , 31 ( 23-24 ): 2435 - 2463 .

Flowmeter [EB ] .

GOGOI P , BHUYAN M H , BHATTACHARYYA D K , et al . Packet and flow based network intrusion dataset [C ] // International Conference on Contemporary Computing . 2012 : 322 - 334 .

COMBS G . Tshark:Dump and analyze network traffic [J ] . Wireshark , 2012 .

GARCIA S , PARMISANO A , ERQUIAGA M J . IoT-23:a labeled dataset with malicious and benign IoT network traffic [R ] . Stratosphere Lab . 2020 .

VACCARI I , CHIOLA G , AIELLO M , et al . MQTTset,a new dataset for machine learning techniques on MQTT [J ] . Sensors , 2020 , 20 ( 22 ): 6578 .

何红艳 , 黄国言 , 张炳 , 等 . 基于多种特征选择策略的入侵检测模型研究 [J ] . 信息安全研究 , 2021 , 7 ( 3 ): 225 - 232 .

HE H Y , HUANG G Y , ZHANG B , et al . Research on intrusion detection model based on multiple feature selection strategies [J ] . Information Security Research , 2021 , 7 ( 3 ): 225 - 232 .

Views

222

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

LightLSB: a lightweight secure transmission mechanism for large-scale biometric images in computing limited environment

Application research of sample data generation based on improved Cycle-GAN in intrusion detection

Research on intrusion detection model based on synchronization of heterogenous executer

Robust identification method of website fingerprinting against disturbance

Related Author

HUANG Kai

JIANG Libing

JIANG Yuchang

LI Aiping

LI Mohan

YAO Jiefeng

SHEN Shengshang

ZHANG Denghui

Related Institution

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

College of Computer Science and Technology, National University of Defense Technology

Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Qilu University of Technology (Shandong Academy of Sciences)

Cyberspace Institute of Advanced Technology, Guangzhou University

School of Mathematics and Computer Sciences, Nanchang University

⁰