物联网场景下基于蜜场的分布式网络入侵检测系统研究  

Research on distributed network intrusion detection system for IoT based on honeyfarm

作　　者：吴昊 郝佳佳[1,2] 卢云龙 WU Hao;HAO Jiajia;LU Yunlong(State Key Laboratory of Advanced Rail Autonomous Operation,Beijing 100044,China;School of Electronic and Information Engineering,Beijing Jiaotong University,Beijing 100044,China)

机构地区：[1]先进轨道交通自主运行全国重点实验室,北京100044 [2]北京交通大学电子信息工程学院,北京100044

出　　处：《通信学报》2024年第1期106-118,共13页Journal on Communications

基　　金：中央高校基本科研业务费专项资金资助项目(No.2022JBQY004);基础科研基金资助项目(No.JCKY2022XXXX145);国家自然科学基金资助项目(No.62221001);中国国家铁路集团有限公司科技研究开发计划基金资助项目(No.K2022G018);北京市自然科学基金资助项目(No.L211013);中国博士后科学基金资助项目(No.2021TQ0028)。

摘　　要：为了解决物联网网络入侵检测系统无法识别新型攻击、灵活性有限等问题,基于蜜场提出了一种能有效识别异常流量和具备持续学习能力的网络入侵检测系统。首先,结合卷积块注意力模块的特点,构建专注于通道和空间双维度的异常流量检测模型,从而提高模型的识别能力。其次,利用联邦学习下的模型训练方案,提高模型的泛化能力。最后,基于蜜场对边缘节点的异常流量检测模型进行更新迭代,从而提高系统对新型攻击流量的识别准确度。实验结果表明,所提系统不仅能有效检测出网络流量中的异常行为,还可以持续提高对异常流量的检测性能。To solve the problems that the network intrusion detection system in the Internet of things couldn’t identify new attacks and has limited flexibility,a network intrusion detection system based on honeyfarm was proposed,which could effectively identify abnormal traffic and have continuous learning ability.Firstly,considering the characteristics of the convolutional block attention module,an abnormal traffic detection model was developed,focusing on both channel and spatial dimensions,to enhance the model’s recognition abilities.Secondly,a model training scheme utilizing federated learning was employed to enhance the model’s generalization capabilities.Finally,the abnormal traffic detection model at the edge nodes was continuously updated and iterated based on the honeyfarm,so as to improve the system’s accuracy in recognizing new attack traffic.The experimental results demonstrate that the proposed system not only effectively detects abnormal behavior in network traffic,but also continually enhances performance in detecting abnormal traffic.

关 键 词：网络入侵检测系统 联邦学习 蜜场 卷积块注意力模块 物联网 

分 类 号：TN929.5[电子电信—通信与信息系统]