自适应类增量学习的物联网入侵检测系统

doi:10.19678/j.issn.1000-3428.0063917

摘要/Abstract

摘要： 传统物联网入侵检测系统难以实时检测新类别攻击，为此，提出一种基于堆叠稀疏自编码器（SSAE）和自组织增量神经网络（SOINN）的物联网入侵检测方法。SSAE对已知类别的攻击样本进行稀疏编码和特征提取，所提取的特征输入SOINN，SOINN形成符合流量特征空间分布的拓扑结构。当出现新类别训练样本的特征时，SOINN自适应地生成新节点以建立新的局部拓扑结构。为了保留SSAE在旧类别样本上的知识，对SOINN已有的拓扑结构施加约束，通过误差反向传递间接约束SSAE权重的变化。针对SOINN在新类别上产生的新局部拓扑结构进行自适应聚合和优化，从而实现新类别样本学习。实验结果表明，该方法能基于新类别数据对模型进行增量训练而无需历史类别数据，在CIC-IDS2017数据集的动态数据流中能有效检测新类别攻击同时缓解旧类别数据中存在的灾难性遗忘问题，在初始已知数据集上的准确率达到98.15%，完成3个阶段的类别增量学习后整体准确率仍能达到57.34%，优于KNN-SVM、mCNN等增量学习方法。

关键词: 入侵检测系统, 堆叠稀疏自编码器, 自组织增量神经网络, 增量学习, 知识保留

Abstract: The conventional intrusion detection system for the Internet of Things(IoT) typically fails to detect new types of attacks in real time.Therefore, a new intrusion detection method for the IoT that is based on Stacked Sparse Autoencoders(SSAE) and Self-Organizing Incremental Neural Networks(SOINN) is proposed in this study.SSAE performs sparse coding and feature extraction on sample attacks of known categories.The extracted features are input to the SOINN, which forms a topological structure that conforms to the spatial distribution of the traffic characteristics.When the features of new class training samples appear, the SOINN adaptively generates new nodes to establish a new local topology.To retain the knowledge of SSAE on the old class samples, constraints are imposed on the existing topology of the SOINN, and the changes to the SSAE weights are indirectly constrained through error reverse transfer.Adaptive aggregation and optimization are performed using the new local topological structure generated by the SOINN for the new class to learn the new class samples.The experimental results indicate that this method can perform incremental training on the model based on new categories of data without requiring historical data.It can effectively detect new types of attacks in the dynamic data flow of the CIC-IDS2017 dataset and alleviate the catastrophic forgetting problem associated with the old category data.The accuracy rate for the initially known dataset is 98.15%, and the overall accuracy rate reaches 57.34% after completing the three stages of category incremental learning, which is better than that of KNN-SVM, mCNN, and other incremental learning methods.

Key words: intrusion detection system, Stacked Sparse Autoencoders(SSAE), Self-Organizing Incremental Neural Networks(SOINN), incremental learning, knowledge retention

中图分类号:

TP393

刘强, 张颖, 周卫祥, 蒋先涛, 周薇娜, 周谋国. 自适应类增量学习的物联网入侵检测系统[J]. 计算机工程, 2023, 49(2): 169-174.

LIU Qiang, ZHANG Ying, ZHOU Weixiang, JIANG Xiantao, ZHOU Weina, ZHOU Mouguo. Adaptive Class Incremental Learning-Based IoT Intrusion Detection System[J]. Computer Engineering, 2023, 49(2): 169-174.

https://www.ecice06.com/CN/Y2023/V49/I2/169

图/表 7

20230216181222

20230216181229

20230216181232

20230216181236

20230216181240

20230216181243

20230216181246

参考文献

[1] KHAN M A, SALAH K.IoT security:review, blockchain solutions, and open challenges[J].Future Generation Computer Systems, 2018, 82:395-411.
[2] MISHRA N, PANDYA S.Internet of Things applications, security challenges, attacks, intrusion detection, and future visions:a systematic review[J].IEEE Access, 2021, 9:59353-59377.
[3] FAROOQ M U, WASEEM M, KHAIRI A, et al.A critical analysis on the security concerns of Internet of Things(IoT)[J].International Journal of Computer Applications, 2015, 111(7):1-6.
[4] BACCARINI L M R, ROCHA E SILVA V V, DE MENEZES B R, et al.SVM practical industrial application for mechanical faults diagnostic[J].Expert Systems with Applications, 2011, 38(6):6980-6984.
[5] ZHANG Y, LI P S, WANG X H.Intrusion detection for IoT based on improved genetic algorithm and deep belief network[J].IEEE Access, 2019, 7:31711-31722.
[6] RAZAVI-FAR R, DAVILU H, PALADE V, et al.Model-based fault detection and isolation of a steam generator using neuro-fuzzy networks[J].Neurocomputing, 2009, 72(13/14/15):2939-2951.
[7] FARID D M, RAHMAN C M.Novel class detection in concept-drifting data stream mining employing decision tree[C]//Proceedings of the 7th International Conference on Electrical and Computer Engineering.Washington D.C., USA:IEEE Press, 2012:630-633.
[8] DING X J, GUO J X, LI D Y, et al.Pricing and budget allocation for IoT blockchain with edge computing[EB/OL].[2022-01-05].https://arxiv.org/pdf/2008.09724v1.pdf.
[9] CONSTANTINIDES C, SHIAELES S, GHITA B, et al.A novel online incremental learning intrusion prevention system[C]//Proceedings of the 10th IFIP International Conference on New Technologies, Mobility and Security.Washington D.C., USA:IEEE Press, 2019:1-6.
[10] SU M Y, YU G J, LIN C Y.A real-time network intrusion detection system for large-scale attacks based on an incremental mining approach[J].Computers & Security, 2009, 28(5):301-309.
[11] CHEN M H, CHANG P C, WU J L.A population-based incremental learning approach with artificial immune system for network intrusion detection[J].Engineering Applications of Artificial Intelligence, 2016, 51:171-181.
[12] TAHERI S, BAGIROV A M, GONDAL I, et al.Cyberattack triage using incremental clustering for intrusion detection systems[J].International Journal of Information Security, 2020, 19(5):597-607.
[13] WANG T T, LÜ Q J, HU B, et al.A few-shot class-incremental learning approach for intrusion detection[C]//Proceedings of International Conference on Computer Communications and Networks.Washington D.C., USA:IEEE Press, 2021:1-8.
[14] CARPENTER G A, GROSSBERG S.The ART of adaptive pattern recognition by a self-organizing neural network[J].Computer, 1988, 21(3):77-88.
[15] WU G L, GONG S G, QUEEN P L.Striking a balance between stability and plasticity for class-incremental learning[C]//Proceedings of IEEE/CVF International Conference on Computer Vision.Washington D.C., USA:IEEE Press, 2021:1104-1113.
[16] MASANA M, LIU X, TWARDOWSKI B, et al.Class-incremental learning:survey and performance evaluation on image classification[EB/OL].[2022-01-05].https://arxiv.org/pdf/2010.15277v2.pdf.
[17] LI Z Z, HOIEM D.Learning without forgetting[J].IEEE Transactions on Pattern Analysis and Machine Intelligence, 2018, 40(12):2935-2947.
[18] KIRKPATRICK J, PASCANU R, RABINOWITZ N, et al.Overcoming catastrophic forgetting in neural networks[J].Proceedings of the National Academy of Sciences of the United States of America, 2017, 114(13):3521-3526.
[19] REBUFFI S A, KOLESNIKOV A, SPERL G, et al.iCaRL:incremental classifier and representation learning[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2017:5533-5542.
[20] TAO X Y, HONG X P, CHANG X Y, et al.Few-shot class-incremental learning[C]//Proceedings of IEEE/CVF Conference on Computer Vision and Pattern Recognition.Washington D.C., USA:IEEE Press, 2020:12180-12189.
[21] TAO X Y, CHANG X Y, HONG X P, et al.Topology-preserving class-incremental learning[EB/OL].[2022-01-05].https://www.ecva.net/papers/eccv_2020/papers_ECCV/papers/123640256.pdf.
[22] SHEN F R, OGURA T, HASEGAWA O.An enhanced self-organizing incremental neural network for online unsupervised learning[J].Neural Networks, 2007, 20(8):893-903.
[23] SHEN F R, HASEGAWA O.An incremental network for on-line unsupervised classification and topology learning[J].Neural Networks, 2006, 19(1):90-106.
[24] ZHU M Y, CHEN Z, CHEN K F, et al.Attention-based federated incremental learning for traffic classification in the Internet of Things[J].Computer Communications, 2022, 185:168-175.
[25] 张帅帅, 黄杰, 祁春阳, 等.基于SOINN的在线物联网设备识别方法[J].东南大学学报(自然科学版), 2021, 51(4):715-723. ZHANG S S, HUANG J, QI C Y, et al.Online IoT device identification method based on SOINN[J].Journal of Southeast University(Natural Science Edition), 2021, 51(4):715-723.(in Chinese)
[26] 张斌, 李立勋, 董书琴.基于改进SOINN算法的恶意软件增量检测方法[J].网络与信息安全学报, 2019, 5(6):21-30. ZHANG B, LI L X, DONG S Q.Malware detection approach based on improved SOINN[J].Chinese Journal of Network and Information Security, 2019, 5(6):21-30.(in Chinese)

选择文件类型/文献管理软件名称

选择包含的内容