基于集成学习的物联网设备异常流量检测算法  

Abnormal traffic detection algorithm for IoT devices based on ensemble learning

作　　者：刘祥军 江凌云[1] Liu Xiangjun;Jiang Lingyun(School of Communication&Information Engineering,Nanjing University of Posts&Telecommunications,Nanjing 210003,China)

机构地区：[1]南京邮电大学通信与信息工程学院,南京210003

出　　处：《计算机应用研究》2022年第6期1785-1789,1804,共6页Application Research of Computers

基　　金：国家自然科学基金资助项目(92067201);江苏省重点研发计划资助项目(BE2020084-4)。

摘　　要：随着物联网设备数量的快速增长,被劫持的物联网设备组成的僵尸网络发起非法攻击的频率大大增加,物联网设备的安全性已经成为一个严峻的问题。为了检测物联网设备发起的异常流量,提出一种集成学习的个体学习器选择算法(individual learner selection algorithm,IISA),IISA是一种基于相关系数度量的选择方法,利用相关系数将相似度差异大的个体学习器集成起来并采用投票的方式进行判决,在减少个体学习器的同时,提高检测的准确度和检测效率。实验结果表明,和八种半监督机器学习检测算法相比,其查全率最大降低9.12%,准确率最大提高4.69%,检测效率最大提高70.72%。With the rapid growth of the number of Internet of Things devices,the frequency of illegal attacks by botnets composed of hijacked IoT devices has increased greatly,and the security of IoT devices has become a serious issue.In order to detect abnormal traffic initiated by IoT devices,this paper proposed an individual learner selection algorithm(IISA)based on ensemble learning.IISA was a selection method based on correlation coefficient measurement.It used correlation coefficient to integrate individual learners with large differences in similarity and made judgements by voting,which could reduce individual learners while improving the accuracy and efficiency of detection.The experimental results show that compared with the eight semi-supervised machine learning detection algorithms,the recall rate can be reduced by 9.12%,the accuracy can be increased by 4.69%,and the detection efficiency can be increased by 70.72%.

关 键 词：僵尸网络 集成学习 相关系数 半监督学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]