基于异构执行体同步控制的入侵检测模型研究

于洪; 朱正彬; 魏帅; 郭威; 兰巨龙

doi:10.11959/j.issn.2096-109x.2025006

您当前的位置：

首页 >

文章列表页 >

基于异构执行体同步控制的入侵检测模型研究

学术论文 | 更新时间：2025-03-20

- 基于异构执行体同步控制的入侵检测模型研究
- Research on intrusion detection model based on synchronization of heterogenous executer
- 网络与信息安全学报 2025年11卷第1期页码：54-65
- 作者机构：
  
  1.信息工程大学，河南郑州 450001
  2.嵩山实验室，河南郑州 450018
- 作者简介：
  
  [ "于洪（1988），女，四川资阳人，信息工程大学副研究员，主要研究方向为网络空间内生安全、拟态防御。" ]
  [ "朱正彬（1996），男，湖北荆门人，信息工程大学博士生，主要研究方向为软件定义网络、网络安全。" ]
  [ "魏帅（1984），男，河南邓州人，信息工程大学副教授，主要研究方向为软件定义晶上系统、网络空间内生安全。" ]
  [ "郭威（1990），男，北京人，信息工程大学副研究员，主要研究方向为计算机体系结构、人工智能与大数据、内生安全。" ]
  [ "兰巨龙（1962），男，河北张家口人，信息工程大学教授、博士生导师，主要研究方向为信息通信网络、主动防御技术、高效能计算。" ]
- 基金信息：
  
  国家重点研发计划(2022YFB4401401)
- DOI：10.11959/j.issn.2096-109x.2025006
  中图分类号： TP309.1
- 收稿：2024-05-10，
  
  修回：2025-01-20，
  
  纸质出版：2025-02-25
- 稿件说明：
移动端阅览
于洪, 朱正彬, 魏帅, 等. 基于异构执行体同步控制的入侵检测模型研究[J]. 网络与信息安全学报, 2025, 11(1): 54-65.

YU H, ZHU Z B, WEI S, et al. Research on intrusion detection model based on synchronization of heterogenous executer[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 54-65.
于洪, 朱正彬, 魏帅, 等. 基于异构执行体同步控制的入侵检测模型研究[J]. 网络与信息安全学报, 2025, 11(1): 54-65. DOI： 10.11959/j.issn.2096-109x.2025006.

YU H, ZHU Z B, WEI S, et al. Research on intrusion detection model based on synchronization of heterogenous executer[J]. Chinese Journal of Network and Information Security, 2025, 11(1): 54-65. DOI： 10.11959/j.issn.2096-109x.2025006.

摘要

基于机器学习和深度学习的入侵检测及网络安全态势感知技术，普遍存在依赖先验知识、需要提前训练的缺点，使其在检测不同类型的攻击时准确率较低或动态适应性差。动态异构冗余（dynamic heterogenous redundancy

DHR）构造技术可以通过判别异构执行体的行为一致性检测攻击。该发现为入侵检测提供了新的思路，基于该思路提出了一种新的入侵检测模型——IDHES（intrusion detection model based on synchronization of heterogenous executer），可在无训练的前提下检测到多种类型的入侵。同时，模型采用内外部事件转换的方式实现异构执行体目标功能同步，降低了因执行体异构性导致的检测假阳率。通过对模型的检测原理及检测准确率进行理论分析，得出IDHES检测准确率仅依赖异构执行体协同攻击成功率和目标功能同步效率这一推论。为验证模型有效性，进一步构建了DHR架构的微控制器原型验证系统，实现了基于内外部事件转换的目标功能同步方法。最后，利用白盒插桩模拟攻击的方式对模型的攻击检测能力进行了测试，测试结果验证了IDHES检测准确率仅依赖异构执行体协同攻击成功率和目标功能同步效率这一推论，也表明IDHES可在不依赖先验知识、不提前训练的情况下，对不同类型的攻击进行实时检测。

Abstract

Intrusion detection and cybersecurity situational awareness technologies based on machine learning and deep learning have generally been limited by their reliance on prior knowledge and pre-training

which restricts their accuracy in detecting various types of attacks. The dynamic heterogeneous redundancy (DHR) construction technique

which detects attacks by evaluating the behavioral consistency of heterogeneous executers

offers a new perspective for intrusion detection. Based on this concept

a novel intrusion detection model called IDHES was proposed. This model was capable of detecting multiple types of intrusions without requiring pre-training. Additionally

synchronization of the target functions of heterogeneous executers was achieved through internal and external event conversions

thereby reducing the false positive rate caused by the heterogeneity of executers. Through theoretical analysis of the model

it was concluded that the detection accuracy of the IDHES model depends solely on the success rate of coordinated attacks by heterogeneous executers and the efficiency of target function synchronization. To verify the effectiveness of the model

a prototype MCU system based on the DHR architecture was constructed

and the target function synchronization method was implemented through internal and external event conversions. Finally

the attack detection capability of the model was tested using white-box instrumentation. The test results confirm the conclusion that the detection accuracy of the IDHES model depends solely on the success rate of coordinated attacks by heterogeneous executers and the efficiency of target function synchronization. Furthermore

the results demonstrate that IDHES can perform real-time detection of various types of attacks without relying on prior knowledge or pre-training.

关键词

Keywords

references

SHARMA S ， KUMAR A ， RATHORE N S , et al . Intrusion detection and prevention systems in industrial IoT network [J ] . Sadhana-Academy Proceedings in Engineering Sciences , 2024 , 49 ( 3 ): 1 - 13 .

龚俭 , 臧小东 , 苏琪 , 等 . 网络安全态势感知综述 [J ] . 软件学报 , 2017 , 28 ( 4 ): 1010 - 1026 .

GONG J , ZANG X D , SU Q , et al . Survey of network security situation awareness [J ] . Journal of Software , 2017 , 28 ( 4 ): 1010 - 1026 .

BRIDGES R A , GLASS-VANDERLAN T R , IANNACONE M D , et al . A survey of intrusion detection systems leveraging host data [J ] . ACM Computing Surveys , 2020 , 52 ( 6 ): 1 - 35 .

HAMED T , DARA R , KREMER S C . Network intrusion detection system based on recursive feature addition and bigram technique [J ] . Computers & Security , 2018 , 73 ( 0 ): 137 - 155 .

AJAYI O , GANGOPADHYAY A , ERBACHER R F , et al . Developing cross-domain host-based intrusion detection [J ] . Electronics , 2022 , 11 ( 21 ): 3631 .

ZHOU W D , LEI S W , XIA C H , et al . LDA-ID: an lda-based framework for real-time network intrusion detection [J ] . China Communications , 2023 , 20 ( 12 ): 166 - 181 .

WU J S , DAI H , KENT K B , et al . Open set dandelion network for iot intrusion detection [J ] . ACM Transactions on Internet Technology , 2024 , 24 ( 1 ): 1 - 26 .

SOKOL P , STAŇA R , GAJDOŠ A , et al . Network security situation awareness forecasting based on statistical approach and neural networks [J ] . Logic Journal of the IGPL , 2023 , 31 ( 2 ).

WANG M L , SONG G X , YU Y , et al . The current research status of ai-based network security situational awareness [J ] . Electronics , 2023 , 12 ( 2309 ): 2309 .

WU L W , YANG C . Research on hierarchical network security situational awareness data fusion method in big data environment [J ] . Applied Mathematics and Nonlinear Sciences , 2024 , 9 ( 1 ).

ZHANG J W , FENG H M , LIU B , et al . Survey of technology in network security situation awareness [J ] . Sensors , 2023 , 23 ( 5 ): 2608 .

罗智勇 , 宋伟伟 , 张文博 , 等 . 基于Markov攻击图和博弈模型的区块链安全态势感知方法 [J ] . 电子与信息学报 , 2023 , 45 ( 4 ): 1374 - 1382 .

LUO Z Y , SONG W W , ZHANG W B , et al . Blockchain security situational awareness method based on Markov attack graph and game model [J ] . Journal of Electronics & Information Technology , 2023 , 45 ( 4 ): 1374 - 1382 .

DATTA N . A hybrid intrusion detection system using k -means clustering and J48 classification [J ] . International Journal of Engineering Research in Computer Science and Engineering , 2018 , 5 ( 4 ).

邬江兴 . 网络空间内生安全发展范式 [J ] . 中国科学: 信息科学 , 2022 , 52 ( 2 ): 189 - 204 .

WU J X . Development paradigms of cyberspace endogenous safety and security [J ] . Sci Sin Inform , 2022 , 52 ( 2 ): 189 - 204 .

邬江兴 , 邹宏 , 薛向阳 , 等 . 内生安全赋能网络弹性的构想、方法与策略 [J ] . 中国工程科学 , 2023 , 25 ( 6 ): 106 - 115 .

WU J X , ZOU H , XUE X Y , et al . Cyber resilience enabled by endogenous security and safety: vision, techniques, and strategies [J ] . Strategic Study of CAE , 2023 , 25 ( 6 ): 106 - 115 .

宋克 , 刘勤让 , 魏帅 , 等 . 基于拟态防御的以太网交换机内生安全体系结构 [J ] . 通信学报 , 2020 , 41 ( 5 ): 18 - 26 .

SONG K , LIU Q R , WEI S , et al . Endogenous security architecture of ethernet switch based on mimic defense [J ] . Journal on Communications , 2020 , 41 ( 5 ): 18 - 26 .

CHEN H S , HAN X T , ZHANG Y Y . Endogenous security formal definition,innovation mechanisms,and experiment research in industrial internet [J ] . Tsinghua Science and Technology , 2024 ,( 2 ): 492 - 505 .

朱维军 , 郭渊博 , 黄伯虎 . 动态异构冗余结构的拟态防御自动机模型 [J ] . 电子学报 , 2019 , 47 ( 10 ): 2025 - 2031 .

ZHU W J , GUO Y B , HUANG B H . A mimic defense automaton model of dynamic heterogeneous redundancy structures [J ] . Acta Electronica Sinica , 2019 , 47 ( 10 ): 2025 - 2031 .

马海龙 , 王亮 , 胡涛 , 等 . 网络空间拟态防御发展综述: 从拟态概念到“拟态+”生态 [J ] . 网络与信息安全学报 , 2022 , 8 ( 2 ): 15 - 38 .

MA H L , WANG L , HU T , et al . Survey on the development of mimic defense in cyberspace: from mimic concept to “mimic+” ecology [J ] . Chinese Journal of Network and Information Security , 2022 , 8 ( 2 ): 15 - 38 .

王敏 , 付文昊 , 王宝通 , 等 . 基于演化博弈的拟态防御策略优化 [J ] . 计算机应用研究 , 2024 , 41 ( 2 ): 576 - 581 .

WANG M , FU W H , WANG B T , et al . Defense strategy optimization of cyber mimic defense based on evolutionary game theory [J ] . Application Research of Computers , 2024 , 41 ( 2 ): 576 - 581 .

HE J J , YUAN Y L , LIANG S C , et al . A Function-Aware Mimic Defense Theory and Its Practice [J ] . China Communications , 2024 , 21 ( 8 ): 192 - 210 .

朱正彬 , 刘勤让 , 刘冬培 , 等 . 拟态多执行体调度算法研究进展 [J ] . 通信学报 , 2021 , 42 ( 5 ): 179 - 190 .

ZHU Z B , LIU Q R , LIU D P , et al . Research progress of mimic multi-execution scheduling algorithm [J ] . Journal on Communications , 2021 , 42 ( 5 ): 179 - 190 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于改进Cycle-GAN的样本数据生成在入侵检测中的应用研究

面向雾计算的个性化轻量级分布式网络入侵检测系统

基于轻量级梯度提升机优化的工业互联网入侵检测方法

面向不平衡样本的物联网入侵检测方法