Research On Incremental Intrusion Detection Technology For Internet Of Things

The demand for informatization reform of modern industry and manufacturing industry and the accelerating arrival of the Internet of Things era make the Internet of Things technology face new technical challenges.Due to the lag of the safety standard of IOT terminal equipment,and the lack of a safety assessment plan in production,there have laid a hidden safety hazard for the Io T.As a new type of network,wireless sensor network(WSN)is widely used.Due to the limitations of sensor nodes in computing,storage and energy,effective defense mechanism and detection system for WSN have been deeply studied.Network-based intrusion detection system can detect the characteristic difference between normal traffic and abnormal traffic in LAN.However,with the massive access of Io T terminal devices,the network environment becomes more complicated,and more high-latitude and Non-linear traffic data increases the difficulty of intrusion detection.Therefore,it is very important to establish an adaptive intrusion detection system based on network traffic.In response to the above problems,this thesis mainly combines the idea of incremental learning into the convolutional neural network to study the key technology of intrusion detection system,and verifies it in WSN and traditional LAN.The main research contents and innovations of this thesis are as follows:(1)Aiming at the data processing problem of massive high-dimensional and nonlinear network traffic generated in the network,each convolutional layer in the network model is used for multi-scale processing to obtain feature information of various scales,and then a fixed-scale fusion feature matrix is obtained through fusion and splicing,focusing on the extraction of global features of network traffic data.(2)Aiming at the adaptive problem of new traffic in the network,an incremental learning algorithm is designed to realize the ability of multi-scale convolution neural network model to learn new samples.By adding a control module in the multi-scale convolution layer of the original model,the original model is updated according to the linear rules of the control module when new data is added,so that the model can learn new knowledge while retaining most of the existing knowledge.(3)Aiming at the problem that the accuracy of intrusion detection model for network traffic classification is low,this paper solves it from two aspects of training data set and loss function.The KDD CUP99,UNSW-NB15 and WSN-DS datasets are used to verify the model.The oversampling algorithm is used to adjust the data distribution of different types of samples in the data set,Generative adversarial network is used to generate attack samples,and the misclassification sensitive loss function is used in the training process of the model to strengthen the learning of a small number of samples and improve the classification accuracy of intrusion detection model.