基于异常行为的海洋气象传感网的入侵检测方法研究  

Research on intrusion detection method of marine meteorological sensor network based on anomalous behaviors

作　　者：苏新[1] 田天 Ziyang Gong 周一青[3,4] SU Xin;TIAN Tian;Ziyang Gong;ZHOU Yiqing(College of Information Science and Engineering,Hohai University,Changzhou 213022,China;Department of Computer Engineering,Gachon University,Gyeonggi-do 04703,South Korea;Stale Key Lab of Processors,Institute of Computing Technology,Chinese Academy of Sciences,Beijing 100190,China;School of Computer Science and Technology,University of Chinese Academy of Sciences,Beijing 100190,China)

机构地区：[1]河海大学信息科学与工程学院,江苏常州213022 [2]嘉泉大学计算机工程系,韩国京畿道04703 [3]中国科学院计算技术研究所处理器芯片全国重点实验室,北京100190 [4]中国科学院大学计算机科学与技术学院,北京100190

出　　处：《通信学报》2023年第7期86-99,共14页Journal on Communications

基　　金：国家重点研发计划基金资助项目(No.2021YFE0105500);河海大学优秀硕士学位论文培育基金资助项目(No.422003482)。

摘　　要：应对海洋气象传感网面临的异常数据流攻击,分析安全机制,针对其复杂庞大的网络结构和节点内分布极端不平衡的数据流,对基于异常行为的海洋气象传感网入侵检测方法进行研究,并搭建入侵检测系统。重点考虑数据集不平衡问题,使用深度生成网络CVAE-GAN学习数据集中少数类的分布,实现有效的数据生成。使用基于OPTICS的去噪算法清除多数类中噪声点,清晰化类别边界。从数据角度入手,降低数据集不平衡率,减小不平衡数据集对入侵检测系统的影响,提高分类器对少数类异常流量的识别能力。仿真结果表明,所提系统能够有效识别各类异常流量,尤其是少数类异常流量,所采用的不平衡数据集处理方法对分类器的检测能力有显著提高。To deal with the abnormal data flow attacks faced by the marine meteorological sensor network(MMSN),analyze the security mechanism,and aim at the complex and huge network structure and the extremely imbalanced data flow in the nodes,the intrusion detection method of marine meteorological sensor network based on anomalous behaviors was studied,and intrusion detection system(IDS)was built.The imbalance of dataset was considered emphatically,and the effective data generation was realized by using depth generation network CVAE-GAN to learn the distribution of minority classes in the dataset.OPTICS-based denoising algorithm was used to remove the noise points in majority classes and clarify the category boundaries.From the data perspective,the imbalance rate of dataset was reduced,the influence of imbalanced dataset on IDS was reduced,and the ability of classifier to identify minority classes of abnormal traffic was improved.The simulation results show that the proposed system can effectively identify all kinds of abnormal traffic,especially minority classes of them,and the imbalanced dataset processing method can significantly improve the detection ability of the classifier.

关 键 词：海洋气象传感网 入侵检测系统 数据集平衡化 CVAE-GAN OPTICS 

分 类 号：TN929.52[电子电信—通信与信息系统]