通信学报2024,Vol.45Issue(1) :106-118.DOI:10.11959/j.issn.1000-436x.2024020

物联网场景下基于蜜场的分布式网络入侵检测系统研究

Research on distributed network intrusion detection system for IoT based on honeyfarm

吴昊 郝佳佳 卢云龙
通信学报2024,Vol.45Issue(1) :106-118.DOI:10.11959/j.issn.1000-436x.2024020

物联网场景下基于蜜场的分布式网络入侵检测系统研究

Research on distributed network intrusion detection system for IoT based on honeyfarm

吴昊 1郝佳佳 1卢云龙1
扫码查看

作者信息

  • 1. 先进轨道交通自主运行全国重点实验室,北京 100044;北京交通大学电子信息工程学院,北京 100044
  • 折叠

摘要

为了解决物联网网络入侵检测系统无法识别新型攻击、灵活性有限等问题,基于蜜场提出了一种能有效识别异常流量和具备持续学习能力的网络入侵检测系统.首先,结合卷积块注意力模块的特点,构建专注于通道和空间双维度的异常流量检测模型,从而提高模型的识别能力.其次,利用联邦学习下的模型训练方案,提高模型的泛化能力.最后,基于蜜场对边缘节点的异常流量检测模型进行更新迭代,从而提高系统对新型攻击流量的识别准确度.实验结果表明,所提系统不仅能有效检测出网络流量中的异常行为,还可以持续提高对异常流量的检测性能.

Abstract

To solve the problems that the network intrusion detection system in the Internet of things couldn't identify new attacks and has limited flexibility,a network intrusion detection system based on honeyfarm was proposed,which could effectively identify abnormal traffic and have continuous learning ability.Firstly,considering the characteristics of the convolutional block attention module,an abnormal traffic detection model was developed,focusing on both channel and spatial dimensions,to enhance the model's recognition abilities.Secondly,a model training scheme utilizing federat-ed learning was employed to enhance the model's generalization capabilities.Finally,the abnormal traffic detection mod-el at the edge nodes was continuously updated and iterated based on the honeyfarm,so as to improve the system's accu-racy in recognizing new attack traffic.The experimental results demonstrate that the proposed system not only effectively detects abnormal behavior in network traffic,but also continually enhances performance in detecting abnormal traffic.

关键词

网络入侵检测系统/联邦学习/蜜场/卷积块注意力模块/物联网

Key words

NIDS/federated learning/honeyfarm/convolutional block attention module/IoT

引用本文复制引用

基金项目

中央高校基本科研业务费专项资金资助项目(2022JBQY004)

基础科研基金资助项目(JCKY2022XXXX145)

国家自然科学基金资助项目(62221001)

中国国家铁路集团有限公司科技研究开发计划基金资助项目(K2022G018)

北京市自然科学基金资助项目(L211013)

中国博士后科学基金资助项目(2021TQ0028)

出版年

2024
通信学报
中国通信学会

通信学报

CSTPCDCSCD北大核心
影响因子:1.265
ISSN:1000-436X
参考文献量28
段落导航相关论文