| In recent years,the large-scale promotion of IoT devices has brought about frequent attacks against the very devices,indicating that the protection system of IoT is not perfect.To solve this problem,this thesis proposes a IoT intrusion detection method based on improved random forest and deep residual,which can better detect known and unknown attacks and identify threats in the network.As for known attacks,a Resample-RF model is proposed.To begin with,to solve the problem of unbalanced sample,this thesis proposes an improved random forest model,which makes full use of the advantage of high accuracy of ensemble learning.The improved random forest model employs balanced sample selection algorithm and multi-classification greedy transformation algorithm.The former one increases the sample weight for unbalanced categories.The latter one transforms the multi-classification model into a binary model in the process of training,and converts the binary classification into multi-classification in prediction via binary greedy voting algorithm.Then,to settle the problem of low efficiency caused by excessive eigenvalues in random forest,a feature merging method is put forward to accelerate model training and improve its accuracy.As to unknown attacks,a deep residual network based on CVAE is proposed.At first,considering the uncertainty of attack and imbalanced sample problem,this thesis uses CVAE network for sample expansion.Then,based on the expanded sample,unknown attack detection is performed by using ResNet and two-layer LSTM network.The model makes full use of the advantages of CNN in extracting local spatial features and RNN in extracting time series features to accurately extract features and identify abnormal samples.At last,the proposed models are evaluated on multiple datasets.First,Resample-RF model is validated on the IoT-23 and Kaggle datasets.Model accuracy,F1 and Recall reached 0.99 on the IoT-23 dataset.In the Kaggle dataset,the model accuracy,F1 and Recall all reached 1.0.Therefore,the model proposed in this thesis is effective in detecting known attacks and can accurately distinguish different types of attacks.Also,the deep residual network effect based on CVAE was validated on Kaggle and UCI datasets.The model F1 reached 0.90 on the Kaggle dataset and 0.99 on the UCI dataset.The results show that the proposed model is also good at detecting unknown attacks. |
