《计算机应用》唯一官方网站 ›› 2022, Vol. 42 ›› Issue (7): 2118-2124.DOI: 10.11772/j.issn.1001-9081.2021040692

• 网络空间安全 • 上一篇    

基于物联网平台的动态权重损失函数入侵检测系统

董宁(), 程晓荣, 张铭泉   

  1. 华北电力大学(保定) 计算机系,河北 保定 071003
  • 收稿日期:2021-04-30 修回日期:2021-08-06 接受日期:2021-08-10 发布日期:2022-07-15 出版日期:2022-07-10
  • 通讯作者: 董宁
  • 作者简介:程晓荣(1963—),女,河北邯郸人,教授,博士,主要研究方向:网络安全、大数据
    张铭泉(1980—),男,山东莘县人,讲师,博士,主要研究方向:计算机系统结构、大数据。
  • 基金资助:
    中央高校基本科研业务费专项(2020MS122)

Intrusion detection system with dynamic weight loss function based on internet of things platform

Ning DONG(), Xiaorong CHENG, Mingquan ZHANG   

  1. Department of Computer,North China Electric Power University,Baoding Hebei 071003,China
  • Received:2021-04-30 Revised:2021-08-06 Accepted:2021-08-10 Online:2022-07-15 Published:2022-07-10
  • Contact: Ning DONG
  • About author:CHENG Xiaorong, born in 1963, Ph. D., professor. Her research interests include network security, big data.
    ZHANG Mingquan, born in 1980, Ph. D., lecturer. His research interests include computer architecture, big data.
  • Supported by:
    Fundamental Research Funds for Central Universities(2020MS122)

摘要:

随着物联网(IoT)接入设备越来越多,以及网络管理维护人员缺乏对IoT设备的安全意识,针对IoT环境和设备的攻击逐渐泛滥。为了加强IoT环境下的网络安全性,利用基于IoT平台制作的入侵检测数据集,采用卷积神经网络(CNN)+长短期记忆(LSTM)网络为模型架构,利用CNN提取数据的空间特征,LSTM提取数据的时序特征,并将交叉熵损失函数改进为动态权重交叉熵损失函数,制作出一个针对IoT环境的入侵检测系统(IDS)。经实验设计分析,并使用准确率、精确率、召回率和F1-measure作为评估参数。实验结果表明在CNN-LSTM网络架构下采用了动态权重损失函数的模型与采用传统的交叉熵损失函数的模型相比,前者比后者在使用数据集的地址解析协议(ARP)类样本中在F1-Measure上提升了47个百分点,前者比后者针对数据集中的其他少数类样本则提升了2个百分点~10个百分点。实验结果表明,动态权重损失函数能够增强模型对少数类样本的判别能力,且该方法可以提升IDS对少数类攻击样本的判断能力。

关键词: 动态权重损失函数, 入侵检测, 深度学习, 卷积神经网络, 长短期记忆, 物联网

Abstract:

With the increasing number of Internet of Things (IoT) access devices, and the lack of awareness of the security of IoT devices of network management and maintenance staffs, attacks in IoT environment and on IoT devices spread gradually. In order to strengthen network security in IoT environment, an intrusion detection dataset based on IoT platform was used, the Convolutional Neural Network (CNN) + Long-Short Term Memory (LSTM) network was adopted as the model architecture, CNN was used to extract data spatial features, and LSTM was used to extract the data temporal features, the cross-entropy loss function was improved to a dynamic weight cross-entropy loss function, and an Intrusion Detection System (IDS) for IoT environment was produced. Experiments were designed and analyzed, and accuracy, precision, recall and F1-Measure were used as evaluation metrics. Experimental results show that compared with the model using traditional cross-entropy loss function, the proposed model using dynamic weight loss function under CNN-LSTM network architecture has an improvement of 47 percentage points in F1-Measure for Address Resolution Protocol (ARP) samples in the dataset, and has an improvement of 2 percentage points to 10 percentage points for other minority class samples in the dataset, which verifies the dynamic weight loss function can enhance the model’s ability to discriminate minority class samples, and this method can improve IDS’s ability to judge minority class attack samples.

Key words: dynamic weight loss function, intrusion detection, deep learning, Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), Internet of Things (IoT)

中图分类号: