Research on intrusion detection model based on synchronization of heterogenous executer

YU Hong; ZHU Zhengbin; WEI Shuai; GUO Wei; LAN Julong

doi:10.11959/j.issn.2096-109x.2025006

您当前的位置：

首页 >

文章列表页 >

Research on intrusion detection model based on synchronization of heterogenous executer

Papers | 更新时间：2025-03-20

- Research on intrusion detection model based on synchronization of heterogenous executer
- Chinese Journal of Network and Information Security Vol. 11, Issue 1, Pages: 54-65(2025)
- 作者机构：
  
  1.信息工程大学，河南郑州 450001
  2.嵩山实验室，河南郑州 450018
- 作者简介：
- 基金信息：
  
  The National Key Research and Development Program(2022YFB4401401)
- DOI：10.11959/j.issn.2096-109x.2025006
  CLC： TP309.1
- Received：10 May 2024，
  
  Revised：2025-01-20，
  
  Published：25 February 2025
- 稿件说明：
移动端阅览
于洪, 朱正彬, 魏帅, 等. 基于异构执行体同步控制的入侵检测模型研究[J]. 网络与信息安全学报, 2025, 11(1): 54-65.

YU H, ZHU Z B, WEI S, et al. Research on intrusion detection model based on synchronization of heterogenous executer[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 54-65.
于洪, 朱正彬, 魏帅, 等. 基于异构执行体同步控制的入侵检测模型研究[J]. 网络与信息安全学报, 2025, 11(1): 54-65. DOI： 10.11959/j.issn.2096-109x.2025006.

YU H, ZHU Z B, WEI S, et al. Research on intrusion detection model based on synchronization of heterogenous executer[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 54-65. DOI： 10.11959/j.issn.2096-109x.2025006.

摘要

基于机器学习和深度学习的入侵检测及网络安全态势感知技术，普遍存在依赖先验知识、需要提前训练的缺点，使其在检测不同类型的攻击时准确率较低或动态适应性差。动态异构冗余（dynamic heterogenous redundancy

DHR）构造技术可以通过判别异构执行体的行为一致性检测攻击。该发现为入侵检测提供了新的思路，基于该思路提出了一种新的入侵检测模型——IDHES（intrusion detection model based on synchronization of heterogenous executer），可在无训练的前提下检测到多种类型的入侵。同时，模型采用内外部事件转换的方式实现异构执行体目标功能同步，降低了因执行体异构性导致的检测假阳率。通过对模型的检测原理及检测准确率进行理论分析，得出IDHES检测准确率仅依赖异构执行体协同攻击成功率和目标功能同步效率这一推论。为验证模型有效性，进一步构建了DHR架构的微控制器原型验证系统，实现了基于内外部事件转换的目标功能同步方法。最后，利用白盒插桩模拟攻击的方式对模型的攻击检测能力进行了测试，测试结果验证了IDHES检测准确率仅依赖异构执行体协同攻击成功率和目标功能同步效率这一推论，也表明IDHES可在不依赖先验知识、不提前训练的情况下，对不同类型的攻击进行实时检测。

Abstract

Intrusion detection and cybersecurity situational awareness technologies based on machine learning and deep learning have generally been limited by their reliance on prior knowledge and pre-training

which restricts their accuracy in detecting various types of attacks. The dynamic heterogeneous redundancy (DHR) construction technique

which detects attacks by evaluating the behavioral consistency of heterogeneous executers

offers a new perspective for intrusion detection. Based on this concept

a novel intrusion detection model called IDHES was proposed. This model was capable of detecting multiple types of intrusions without requiring pre-training. Additionally

synchronization of the target functions of heterogeneous executers was achieved through internal and external event conversions

thereby reducing the false positive rate caused by the heterogeneity of executers. Through theoretical analysis of the model

it was concluded that the detection accuracy of the IDHES model depends solely on the success rate of coordinated attacks by heterogeneous executers and the efficiency of target function synchronization. To verify the effectiveness of the model

a prototype MCU system based on the DHR architecture was constructed

and the target function synchronization method was implemented through internal and external event conversions. Finally

the attack detection capability of the model was tested using white-box instrumentation. The test results confirm the conclusion that the detection accuracy of the IDHES model depends solely on the success rate of coordinated attacks by heterogeneous executers and the efficiency of target function synchronization. Furthermore

the results demonstrate that IDHES can perform real-time detection of various types of attacks without relying on prior knowledge or pre-training.

关键词

Keywords

references

SHARMA S ， KUMAR A ， RATHORE N S , et al . Intrusion detection and prevention systems in industrial IoT network [J ] . Sadhana-Academy Proceedings in Engineering Sciences , 2024 , 49 ( 3 ): 1 - 13 .

龚俭 , 臧小东 , 苏琪 , 等 . 网络安全态势感知综述 [J ] . 软件学报 , 2017 , 28 ( 4 ): 1010 - 1026 .

GONG J , ZANG X D , SU Q , et al . Survey of network security situation awareness [J ] . Journal of Software , 2017 , 28 ( 4 ): 1010 - 1026 .

BRIDGES R A , GLASS-VANDERLAN T R , IANNACONE M D , et al . A survey of intrusion detection systems leveraging host data [J ] . ACM Computing Surveys , 2020 , 52 ( 6 ): 1 - 35 .

HAMED T , DARA R , KREMER S C . Network intrusion detection system based on recursive feature addition and bigram technique [J ] . Computers & Security , 2018 , 73 ( 0 ): 137 - 155 .

AJAYI O , GANGOPADHYAY A , ERBACHER R F , et al . Developing cross-domain host-based intrusion detection [J ] . Electronics , 2022 , 11 ( 21 ): 3631 .

ZHOU W D , LEI S W , XIA C H , et al . LDA-ID: an lda-based framework for real-time network intrusion detection [J ] . China Communications , 2023 , 20 ( 12 ): 166 - 181 .

WU J S , DAI H , KENT K B , et al . Open set dandelion network for iot intrusion detection [J ] . ACM Transactions on Internet Technology , 2024 , 24 ( 1 ): 1 - 26 .

SOKOL P , STAŇA R , GAJDOŠ A , et al . Network security situation awareness forecasting based on statistical approach and neural networks [J ] . Logic Journal of the IGPL , 2023 , 31 ( 2 ).

WANG M L , SONG G X , YU Y , et al . The current research status of ai-based network security situational awareness [J ] . Electronics , 2023 , 12 ( 2309 ): 2309 .

WU L W , YANG C . Research on hierarchical network security situational awareness data fusion method in big data environment [J ] . Applied Mathematics and Nonlinear Sciences , 2024 , 9 ( 1 ).

ZHANG J W , FENG H M , LIU B , et al . Survey of technology in network security situation awareness [J ] . Sensors , 2023 , 23 ( 5 ): 2608 .

罗智勇 , 宋伟伟 , 张文博 , 等 . 基于Markov攻击图和博弈模型的区块链安全态势感知方法 [J ] . 电子与信息学报 , 2023 , 45 ( 4 ): 1374 - 1382 .

LUO Z Y , SONG W W , ZHANG W B , et al . Blockchain security situational awareness method based on Markov attack graph and game model [J ] . Journal of Electronics & Information Technology , 2023 , 45 ( 4 ): 1374 - 1382 .

DATTA N . A hybrid intrusion detection system using k -means clustering and J48 classification [J ] . International Journal of Engineering Research in Computer Science and Engineering , 2018 , 5 ( 4 ).

邬江兴 . 网络空间内生安全发展范式 [J ] . 中国科学: 信息科学 , 2022 , 52 ( 2 ): 189 - 204 .

WU J X . Development paradigms of cyberspace endogenous safety and security [J ] . Sci Sin Inform , 2022 , 52 ( 2 ): 189 - 204 .

邬江兴 , 邹宏 , 薛向阳 , 等 . 内生安全赋能网络弹性的构想、方法与策略 [J ] . 中国工程科学 , 2023 , 25 ( 6 ): 106 - 115 .

WU J X , ZOU H , XUE X Y , et al . Cyber resilience enabled by endogenous security and safety: vision, techniques, and strategies [J ] . Strategic Study of CAE , 2023 , 25 ( 6 ): 106 - 115 .

宋克 , 刘勤让 , 魏帅 , 等 . 基于拟态防御的以太网交换机内生安全体系结构 [J ] . 通信学报 , 2020 , 41 ( 5 ): 18 - 26 .

SONG K , LIU Q R , WEI S , et al . Endogenous security architecture of ethernet switch based on mimic defense [J ] . Journal on Communications , 2020 , 41 ( 5 ): 18 - 26 .

CHEN H S , HAN X T , ZHANG Y Y . Endogenous security formal definition,innovation mechanisms,and experiment research in industrial internet [J ] . Tsinghua Science and Technology , 2024 ,( 2 ): 492 - 505 .

朱维军 , 郭渊博 , 黄伯虎 . 动态异构冗余结构的拟态防御自动机模型 [J ] . 电子学报 , 2019 , 47 ( 10 ): 2025 - 2031 .

ZHU W J , GUO Y B , HUANG B H . A mimic defense automaton model of dynamic heterogeneous redundancy structures [J ] . Acta Electronica Sinica , 2019 , 47 ( 10 ): 2025 - 2031 .

马海龙 , 王亮 , 胡涛 , 等 . 网络空间拟态防御发展综述: 从拟态概念到“拟态+”生态 [J ] . 网络与信息安全学报 , 2022 , 8 ( 2 ): 15 - 38 .

MA H L , WANG L , HU T , et al . Survey on the development of mimic defense in cyberspace: from mimic concept to “mimic+” ecology [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 2 ): 15 - 38 .

王敏 , 付文昊 , 王宝通 , 等 . 基于演化博弈的拟态防御策略优化 [J ] . 计算机应用研究 , 2024 , 41 ( 2 ): 576 - 581 .

WANG M , FU W H , WANG B T , et al . Defense strategy optimization of cyber mimic defense based on evolutionary game theory [J ] . Application Research of Computers , 2024 , 41 ( 2 ): 576 - 581 .

HE J J , YUAN Y L , LIANG S C , et al . A Function-Aware Mimic Defense Theory and Its Practice [J ] . China Communications , 2024 , 21 ( 8 ): 192 - 210 .

朱正彬 , 刘勤让 , 刘冬培 , 等 . 拟态多执行体调度算法研究进展 [J ] . 通信学报 , 2021 , 42 ( 5 ): 179 - 190 .

ZHU Z B , LIU Q R , LIU D P , et al . Research progress of mimic multi-execution scheduling algorithm [J ] . Journal on Communications , 2021 , 42 ( 5 ): 179 - 190 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Application research of sample data generation based on improved Cycle-GAN in intrusion detection

Personalized lightweight distributed network intrusion detection system in fog computing

Method on intrusion detection for industrial internet based on light gradient boosting machine

IoT intrusion detection method for unbalanced samples

Related Author

HUANG Kai

JIANG Libing

JIANG Yuchang

GUO Hangkai

ZENG Qingpeng

Liwen XU

Xuankai ZHANG

Jianhua LI

Related Institution

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Mathematics and Computer Sciences, Nanchang University

College of Modern Posts, Chongqing University of Posts and Telecommunications

College of Automation/ Institute of Industrial Internet, Chongqing University of Posts and Telecommunications

Chang'an Communication Technology Co., Ltd.

⁰