| The development of the Internet and the Internet of things(IoT)has brought increasing traffic to cyberspace.While the development of the network is changing daily life,the security problems caused by anomaly behavior are also becoming more and more serious.Many studies are devoted to defending against dangers caused by anomaly behavior,which use machine learning or deep learning methods.Most studies only design for a certain kind of dataset without considering the commonality between different traffic sets,which makes the model work well on one kind of data set,but completely opposite on the others.This leads to their lack of transferability.Meanwhile,the real scene is less labeled,labeled data is often difficult to obtain,most of the data is unlabeled,and these studies rarely meet such need.The storage and computing resources of IoT devices are relatively limited.Conventional detection schemes have high resource requirements and are not lightweight enough to adapt to such scenarios.To solve the above problems,this paper synthetically uses reinforcement learning and machine learning to design detection methods for different scenarios,and integrates them into an anomaly detection system.The specific work is as follows:(1)To solve the shortcomings of existing models in terms of transferability and few labels,reinforcement learning is used to solve the transferability problem by considering the commonality between different datasets.Different functions are designed for labeled and unlabeled data to solve the few label problem.The effectiveness of the proposed scheme is verified on four datasets IDS2017,IDS2018,NSL-KDD,and UNSW-NB15.(2)To solve the deficiency of lightweight of existing detection methods,semantic-level features are designed for traffic,and the packets are merged,then the features are grouped according to the protocol.So it can reduce the data size and the computational complexity.Finally,machine learning algorithms with lower resource requirements are used for anomaly detection,and an efficient lightweight detection scheme is realized.Experiments on the datasets Bot-IoT,MedBIoT and MQTT-IoTIDS2020 verify the effectiveness of the proposed scheme.(3)To solve the deficiencies of the existing detection system in multiscene,the above methods are integrated to design and implement the anomaly detection system.Real-world scenarios are diverse and may have one or more requirements of transferability,few labels,and lightweight.The system which provides friendly interaction modes for users makes comprehensive use of the above-mentioned anomaly detection methods.So it can be adapted to diversified real environments while implementing methods. |
