面向5G MEC基于行为的用户异常检测方案

doi:10.19678/j.issn.1000-3428.0061778

摘要/Abstract

摘要： 5G边缘计算靠近用户侧提供服务，而边缘侧汇聚着用户的敏感信息，用户非法接入或合法用户自身的恶意行为威胁到整个边缘网络的安全。将机器学习算法应用于边缘计算架构，提出一种基于行为的用户异常检测方案。对用户行为进行建模，采用独热编码和互信息进行数据预处理和特征选择，并利用极限梯度提升算法训练一个多分类器分类识别进入园区的用户，根据识别结果与用户身份是否一致来判定用户是否异常。在此基础上，通过孤立森林算法对授权用户历史行为数据进行模型训练，从而检测可信任用户的行为是否异常，实现对小型固定园区内未授权用户的识别以及对授权用户异常行为的检测。实验结果表明，该方案可满足边缘计算场景的时间复杂度要求，并且能够有效区分不同用户，分类准确率达到0.953，而对异常行为样本的误报率仅为0.01。

关键词: 移动边缘计算, 用户异常检测, 孤立森林算法, 极限梯度提升算法, 内部威胁检测

Abstract: 5G edge computing provides services close to the user side, whereas the edge side gathers sensitive information about the user.The illegal access of users or malicious behavior of legitimate users threatens the security of the entire edge network.By applying a machine learning algorithm to an edge computing architecture, a behavior-based user anomaly detection method is proposed.The user behavior is modeled, One-Hot coding and Mutual Information(MI) are used for data pre-processing and feature selection, and the eXtreme Gradient Boosting(XGBoost) algorithm is used to train a multi-classifier to classify and identify users entering the park.Whether the users are abnormal is determined by consistency with the user's identity.The isolation Forest(iForest) algorithm is used to train the historical behavior data of authorized users, detect whether the behavior of trusted users is abnormal according to the model, identify unauthorized users in small fixed parks, and detect abnormal behavior of authorized users.Experimental results show that this method effectively distinguishes different users on the premise of meeting the time complexity requirements of edge computing scenes, with a classification accuracy of 0.953, while the false positive rate of abnormal behavior samples is 0.01.

Key words: Mobile Edge Computing(MEC), user anomaly detection, isolated Forest(iForest) algorithm, eXtreme Gradient Boosting(XGBoost) algorithm, internal threat detection

中图分类号:

TP18

张伟成, 卫红权, 刘树新, 王庚润. 面向5G MEC基于行为的用户异常检测方案[J]. 计算机工程, 2022, 48(5): 27-34.

ZHANG Weicheng, WEI Hongquan, LIU Shuxin, WANG Gengrun. Behavior-based User Anomaly Detection Scheme for 5G MEC[J]. Computer Engineering, 2022, 48(5): 27-34.

http://www.ecice06.com/CN/Y2022/V48/I5/27

图/表 12

20220723172544

20220723172547

20220723172551

20220723172554

20220723172557

20220723172601

20220723172605

20220723172608

20220723172612

20220723172616

20220723172619

20220723172623

参考文献

[1] ABBAS N, ZHANG Y, TAHERKORDI A, et al.Mobile edge computing:a survey[J].IEEE Internet of Things Journal, 2018, 5(1):450-465.
[2] MUKHERJEE A, DE D, GHOSH S K, et al.Mobile edge computing[M].Berlin, Germany:Springer, 2021.
[3] 陈璐, 汤红波, 游伟, 等.移动边缘计算安全防御研究[J].网络与信息安全学报, 2021, 7(1):130-142. CHEN L, TANG H B, YOU W, et al.Research on security defense of mobile edge computing[J].Chinese Journal of Network and Information Security, 2021, 7(1):130-142.(in Chinese)
[4] 赵星, 彭建华, 陈璐, 等.一种MEC中隐私保护计算卸载方法[J].信息工程大学学报, 2020, 21(6):641-646. ZHAO X, PENG J H, CHEN L, et al.Privacy-preserving computation offloading method of multi-access edge computing[J].Journal of Information Engineering University, 2020, 21(6):641-646.(in Chinese)
[5] 工业互联网产业联盟, 中国移动, 中国信通院.5G边缘计算安全白皮书[EB/OL].(2020-11)[2021-05-06].http://aii-alliance.org/bps/20210202/4552.html. Alliance of Industrial Internet, China Mobile, China Academy of Information and Communications Technology.5G edge computing security white paper[EB/OL].(2020-11)[2021-05-06].http://aii-alliance.org/bps/20210202/4552.html. (in Chinese)
[6] Haystax.Haystax insider threat report 2019[EB/OL].[2021-05-06].https://haystax.com/wp-content/uploads/2019/07/Haystax-Insider-Threat-Report-2019.pdf.
[7] 边缘计算产业联盟, 工业互联网产业联盟.边缘计算安全白皮书[EB/OL].[2021-05-06].http://www.ecconsortium.net/Lists/show/id/374.html. Edge Computing Consortium, Alliance of Industrial Internet.Edge computing security white paper[EB/OL].[2021-05-06].http://www.ecconsortium.net/Lists/show/id/374.html. (in Chinese)
[8] XIN Y, KONG L S, LIU Z, et al.Machine learning and deep learning methods for cybersecurity[J].IEEE Access, 2018, 6:35365-35381.
[9] CHEN J S, RAN X K.Deep learning with edge computing:a review[J].Proceedings of the IEEE, 2019, 107(8):1655-1674.
[10] CHANDOLA V, BANERJEE A, KUMAR V.Anomaly detection[J].ACM Computing Surveys, 2009, 41(3):1-58.
[11] FIORE U, PALMIERI F, CASTIGLIONE A, et al.Network anomaly detection with the restricted Boltzmann machine[J].Neurocomputing, 2013, 122:13-23.
[12] SINGH M, MEHTRE B M, SANGEETHA S.User behavior profiling using ensemble approach for insider threat detection[C]//Proceedings of the 5th International Conference on Identity, Security, and Behavior Analysis.Washington D.C, USA:IEEE Press, 2019:1-8.
[13] LEE S J, YOO P D, ASYHARI A T, et al.IMPACT:impersonation attack detection via edge computing using deep autoencoder and feature abstraction[J].IEEE Access, 2020, 8:65520-65529.
[14] ESKANDARI M, JANJUA Z H, VECCHIO M, et al.Passban IDS:an intelligent anomaly-based intrusion detection system for IoT edge devices[J].IEEE Internet of Things Journal, 2020, 7(8):6882-6897.
[15] FERNÁNDEZ M L, PERALES G L, GARCÍA C F J, et al.A self-adaptive deep learning-based system for anomaly detection in 5G networks[J].IEEE Access, 2018, 6:7700-7712.
[16] AN X S, ZHOU X W, LÜ X, et al.Sample selected extreme learning machine based intrusion detection in fog computing and MEC[J].Wireless Communications and Mobile Computing, 2018, 2018:1-10.
[17] SIDDIQUE K, AKHTAR Z, KHAN F A, et al.KDD Cup 99 data sets:a perspective on the role of data sets in network intrusion detection research[J].Computer, 2019, 52(2):41-51.
[18] HUSSAIN B, DU Q H, ZHANG S H, et al.Mobile edge computing-based data-driven deep learning framework for anomaly detection[J].IEEE Access, 2019, 7:137656-137667.
[19] HUSSAIN B, DU Q H, IMRAN A, et al.Artificial intelligence-powered mobile edge computing-based anomaly detection in cellular networks[J].IEEE Transactions on Industrial Informatics, 2020, 16(8):4986-4996.
[20] 周志华.机器学习[M].北京:清华大学出版社, 2016. ZHOU Z H.Machine learning[M].Beijing:Tsinghua University Press, 2016.(in Chinese)
[21] PERERA P, OZA P, PATEL V M.One-class classification:a survey[EB/OL].(2021-01-08)[2021-05-06].https://arxiv.org/pdf/2101.03064v1.pdf.
[22] LIU F T, TING K M, ZHOU Z H.Isolation-based anomaly detection[J].ACM Transactions on Knowledge Discovery from Data, 2012, 6(1):1-39.
[23] AHARONY N, PAN W, IP C, et al.Social fMRI:investigating and shaping social mechanisms in the real world[J].Pervasive and Mobile Computing, 2011, 7(6):643-659.
[24] GOETZ J N, BRENNING A, PETSCHKO H, et al.Evaluating machine learning and statistical prediction techniques for landslide susceptibility modeling[J].Computers & Geosciences, 2015, 81:1-11.

选择文件类型/文献管理软件名称

选择包含的内容