一种物联网环境下的分布式异常流量检测方案

doi:10.19678/j.issn.1000-3428.0063284

摘要/Abstract

摘要： 物联网终端设备数量的急剧增加带来了诸多安全隐患，如何高效地进行异常流量检测成为物联网安全研究中的一项重要任务。现有检测方法存在计算开销大的问题，且不能显式地捕捉流量数据中的关系和结构，难以应对新型网络攻击。考虑网络结构和节点设备之间的复杂通信模式，提出一种基于图神经网络的分布式异常流量检测方案。结合物联网环境对卷积神经网络进行改进，识别节点之间的复杂关系，同时在物联网设备、转发器和雾节点上设计并部署分布式检测单元，通过分布式检测架构实现本地化的异常流量检测，从而降低检测延迟和时间开销。在此基础上，引入注意力模块强化对关键特征的提取，增强模型的可解释性，进一步提高检测精度。在公开数据集CTU-13上的实验结果表明，该方案准确率和AUC值达到99.93%和0.99，只需9.26 s即可完成检测，且带宽消耗仅为845 kb/s。

关键词: 物联网, 异常流量检测, 图神经网络, 注意力机制, 多层感知机, 分布式系统

Abstract: The sharp increase in the number of Internet of Things(IoT) terminal devices has introduced many security risks.The effective detection of abnormal traffic has become an important task in the security research of IoT.Existing detection methods have high computational overhead and cannot explicitly capture the relationship or structure in the traffic data;thus, handling new network attacks is difficult.Considering the network structure and complex communication mode between node devices, a distributed abnormal traffic detection scheme based on Graph Neural Network(GNN) is proposed.Combined with an IoT environment, Convolutional Neural Network(CNN) is improved to identify the complex relationships between nodes.Simultaneously, a distributed detection unit is designed and deployed on the IoT devices, transponders, and fog nodes, and the localized abnormal traffic detection is realized through the distributed detection architecture, thereby reducing the detection delay and time overhead.On this basis, an attention module is introduced to strengthen the extraction of key features, enhance the interpretability of the model, and further improve the detection accuracy.Experiments on the CTU-13 public dataset show that the accuracy and AUC value of this scheme achieve 99.93% and 0.99, respectively.Detection can complete in only 9.26 s, and the bandwidth consumption is only 845 kb/s.

Key words: Internet of Things(IoT), abnormal traffic detection, Graph Neural Network(GNN), attention mechanism, Multi-layer Perceptron(MLP), distributed system

中图分类号:

TP309

丁庆丰, 李晋国. 一种物联网环境下的分布式异常流量检测方案[J]. 计算机工程, 2022, 48(8): 152-159.

DING Qingfeng, LI Jinguo. A Distributed Abnormal Traffic Detection Scheme in Internet of Things Environment[J]. Computer Engineering, 2022, 48(8): 152-159.

https://www.ecice06.com/CN/Y2022/V48/I8/152

图/表 13

20220825092016

20220825092019

20220825092023

20220825092026

20220825092031

20220825092034

20220825092038

20220825092043

20220825092047

20220825092051

20220825092055

20220825092059

20220825092103

参考文献

[1] 吴吉义, 李文娟, 曹健, 等.智能物联网AIoT研究综述[J].电信科学, 2021, 37(8):1-17. WU J Y, LI W J, CAO J, et al.AIoT:a taxonomy, review and future directions[J].Telecommunications Science, 2021, 37(8):1-17.(in Chinese)
[2] RAHMAN M A, ASYHARI A T, LEONG L S, et al.Scalable machine learning-based intrusion detection system for IoT-enabled smart cities[J].Sustainable Cities and Society, 2020, 61:1-10.
[3] QIU H, DONG T, ZHANG T W, et al.Adversarial attacks against network intrusion detection in IoT systems[J].IEEE Internet of Things Journal, 2021, 8(13):10327-10335.
[4] FERRAG M A, MAGLARAS L, AHMIM A, et al.RDTIDS:rules and decision tree-based intrusion detection system for Internet-of-Things networks[J].Future Internet, 2020, 12(3):44.
[5] MA Y H, YANG Q, GAO Y J.An Internet of Things intrusion detection method based on CNN-FDC[C]//Proceedings of 2021 International Conference on Intelligent Transportation, Big Data &Smart City.Washington D.C., USA:IEEE Press, 2021:174-177.
[6] KAUSHIK S.Enhanced the intrusion detection accuracy rate and performance using deep CNN-LSTM[D].Dublin, Ireland:National College of Ireland, 2021.
[7] KOZIK R, PAWLICKI M, CHORAŚM.A new method of hybrid time window embedding with transformer-based traffic data classification in IoT-networked environment[J].Pattern Analysis and Applications, 2021, 24(4):1441-1449.
[8] ASIF N A, SARKER Y, CHAKRABORTTY R K, et al.Graph neural network:a comprehensive review on non-euclidean space[J].IEEE Access, 2021, 9:60588-60606.
[9] YAO Y P, SU L Y, ZHANG C, et al.Marrying graph kernel with deep neural network:a case study for network anomaly detection[C]//Proceedings of International Conference on Computational Science.Berlin, Germany:Springer, 2019:102-115.
[10] MAHMUD M R, RAMAMOHANARAO K, BUYYA R.Application management in fog computing environments:a taxonomy, review and future directions[J].ACM Computing Surveys, 2020, 53(4):1-43.
[11] HASSAN N, YAU K L A, WU C.Edge computing in 5G:a review[J].IEEE Access, 2019, 7:127276-127289.
[12] MANSOURI Y, BABAR M A.A review of edge computing:features and resource virtualization[J].Journal of Parallel and Distributed Computing, 2021, 150:155-183.
[13] CHIANG W L, LIU X Q, SI S, et al.Cluster-GCN:an efficient algorithm for training deep and large graph convolutional networks[C]//Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining.New York, USA:ACM Press, 2019:257-266.
[14] ZHANG C, PAN X, LI H P, et al.A hybrid MLP-CNN classifier for very fine resolution remotely sensed image classification[J].ISPRS Journal of Photogrammetry and Remote Sensing, 2018, 140:133-144.
[15] LI G H, MULLER M, THABET A, et al.DeepGCNs:can GCNs go as deep as CNNs?[C]//Proceedings of 2019 IEEE/CVF International Conference on Computer Vision.Washington D.C., USA:IEEE Press, 2019:9267-9276.
[16] KIPF T N, WELLING M.Semi-supervised classification with graph convolutional networks[EB/OL].[2021-10-11].https://arxiv.org/abs/1609.02907.
[17] FUKUI H, HIRAKAWA T, YAMASHITA T, et al.Attention branch network:learning of attention mechanism for visual explanation[C]//Proceedings of 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2019:10705-10714.
[18] GARCÍA S, GRILL M, STIBOREK J, et al.An empirical comparison of botnet detection methods[J].Computers &Security, 2014, 45:100-123.
[19] KOLIAS C, KAMBOURAKIS G, STAVROU A, et al.DDoS in the IoT:Mirai and other botnets[J].Computer, 2017, 50(7):80-84.
[20] PENG K, LEUNG V C M, ZHENG L X, et al.Intrusion detection system based on decision tree over big data in fog environment[J].Wireless Communications and Mobile Computing, 2018, 2018:1-10.
[21] MUGHAL M O, KIM S.Signal classification and jamming detection in wide-band radios using Naïve Bayes classifier[J].IEEE Communications Letters, 2018, 22(7):1398-1401.
[22] REDDY R R, RAMADEVI Y, SUNITHA K V N.Effective discriminant function for intrusion detection using SVM[C]//Proceedings of 2016 International Conference on Advances in Computing, Communications and Informatics.Washington D.C., USA:IEEE Press, 2016:1148-1153.
[23] PARK S H, PARK H J, CHOI Y J.RNN-based prediction for network intrusion detection[C]//Proceedings of 2020 International Conference on Artificial Intelligence in Information and Communication.Washington D.C., USA:IEEE Press, 2020:572-574.
[24] KIM J, KIM J, KIM H, et al.CNN-based network intrusion detection against denial-of-service attacks[J].Electronics, 2020, 9(6):916.
[25] JIANG K Y, WANG W Y, WANG A L, et al.Network intrusion detection combined hybrid sampling with deep hierarchical network[J].IEEE Access, 2020, 8:32464-32476.
[26] WANG Z, MARTIN R.Model-free posterior inference on the area under the receiver operating characteristic curve[J].Journal of Statistical Planning and Inference, 2020, 209:174-186.

选择文件类型/文献管理软件名称

选择包含的内容