首页|物联网场景下基于蜜场的分布式网络入侵检测系统研究

物联网场景下基于蜜场的分布式网络入侵检测系统研究

扫码查看
原文链接
  • 万方数据
  • 维普
为了解决物联网网络入侵检测系统无法识别新型攻击、灵活性有限等问题,基于蜜场提出了一种能有效识别异常流量和具备持续学习能力的网络入侵检测系统.首先,结合卷积块注意力模块的特点,构建专注于通道和空间双维度的异常流量检测模型,从而提高模型的识别能力.其次,利用联邦学习下的模型训练方案,提高模型的泛化能力.最后,基于蜜场对边缘节点的异常流量检测模型进行更新迭代,从而提高系统对新型攻击流量的识别准确度.实验结果表明,所提系统不仅能有效检测出网络流量中的异常行为,还可以持续提高对异常流量的检测性能.
Research on distributed network intrusion detection system for IoT based on honeyfarm
To solve the problems that the network intrusion detection system in the Internet of things couldn't identify new attacks and has limited flexibility,a network intrusion detection system based on honeyfarm was proposed,which could effectively identify abnormal traffic and have continuous learning ability.Firstly,considering the characteristics of the convolutional block attention module,an abnormal traffic detection model was developed,focusing on both channel and spatial dimensions,to enhance the model's recognition abilities.Secondly,a model training scheme utilizing federat-ed learning was employed to enhance the model's generalization capabilities.Finally,the abnormal traffic detection mod-el at the edge nodes was continuously updated and iterated based on the honeyfarm,so as to improve the system's accu-racy in recognizing new attack traffic.The experimental results demonstrate that the proposed system not only effectively detects abnormal behavior in network traffic,but also continually enhances performance in detecting abnormal traffic.

NIDSfederated learninghoneyfarmconvolutional block attention moduleIoT

吴昊、郝佳佳、卢云龙

展开 >

先进轨道交通自主运行全国重点实验室,北京 100044

北京交通大学电子信息工程学院,北京 100044

网络入侵检测系统 联邦学习 蜜场 卷积块注意力模块 物联网

中央高校基本科研业务费专项资金资助项目基础科研基金资助项目国家自然科学基金资助项目中国国家铁路集团有限公司科技研究开发计划基金资助项目北京市自然科学基金资助项目中国博士后科学基金资助项目

2022JBQY004JCKY2022XXXX14562221001K2022G018L2110132021TQ0028

2024

10.11959/j.issn.1000-436x.2024020

通信学报
中国通信学会

通信学报

CSTPCD北大核心
影响因子：1.265
ISSN：1000-436X
年,卷(期)：2024.45(1)
  • 28