基于异常行为的海洋气象传感网的入侵检测方法研究

doi:10.11959/j.issn.1000-436x.2023132

Abstract

Abstract:

To deal with the abnormal data flow attacks faced by the marine meteorological sensor network (MMSN), analyze the security mechanism, and aim at the complex and huge network structure and the extremely imbalanced data flow in the nodes, the intrusion detection method of marine meteorological sensor network based on anomalous behaviors was studied, and intrusion detection system (IDS) was built.The imbalance of dataset was considered emphatically, and the effective data generation was realized by using depth generation network CVAE-GAN to learn the distribution of minority classes in the dataset.OPTICS-based denoising algorithm was used to remove the noise points in majority classes and clarify the category boundaries.From the data perspective, the imbalance rate of dataset was reduced, the influence of imbalanced dataset on IDS was reduced, and the ability of classifier to identify minority classes of abnormal traffic was improved.The simulation results show that the proposed system can effectively identify all kinds of abnormal traffic, especially minority classes of them, and the imbalanced dataset processing method can significantly improve the detection ability of the classifier.

Key words: MMSN, IDS, dataset balancing, CVAE-GAN, OPTICS

CLC Number:

TN929.52

Xin SU, Tian TIAN, Gong Ziyang, Yiqing ZHOU. Research on intrusion detection method of marine meteorological sensor network based on anomalous behaviors[J]. Journal on Communications, 2023, 44(7): 86-99.

Figures/Tables 12

分类器	平衡化前				平衡化后
分类器	精确率	召回率	F1-score	准确率	精确率	召回率	F1-score	准确率
DT	0.714 4	0.951 7	0.814 2	0.812 9	0.733 5	$0 . 9664$	0.834 0	0.834 3
RF	0.642 0	0.958 4	0.768 9	0.751 8	0.776 1	0.919 0	0.841 5	0.850 9
SVM	0.642 8	0.918 4	0.756 3	0.745 0	0.654 3	0.919 1	0.764 4	0.756 0
NB	0.576 3	0.998 6	0.730 4	0.683 0	0.733 2	0.876 3	0.798 4	0.809 4
KNN	0.663 1	0.959 6	0.784 3	0.772 6	0.767 0	0.951 0	0.849 1	0.854 4
MLP	0.694 3	0.918 4	0.790 8	0.790 7	$0 . 8009$	0.907 5	$0 . 5809$	$0 . 9630$
CNN	0.710 5	0.923 1	0.802 9	0.804 8	0.792 6	0.904 1	0.844 7	0.856 8

References 28

[1]	LIU J , GAO Y , HU F . A fast network intrusion detection system using adaptive synthetic oversampling and LightGBM[J]. Computers ＆ Security, 2021,106:102289.
[2]	KUMAR A , ABHISHEK K , GHALIB M R ,et al. Intrusion detection and prevention system for an IoT environment[J]. Digital Communications and Networks, 2022,8(4): 540-551.
[3]	SHA K , YANG T A , WEI W ,et al. A survey of edge computing-based designs for IoT security[J]. Digital Communications and Networks, 2020,6(2): 195-202.
[4]	赖英旭, 刘增辉, 蔡晓田 ,等. 工业控制系统入侵检测研究综述[J]. 通信学报, 2017,38(2): 143-156.
	LAI Y X , LIU Z H , CAI X T ,et al. Research on intrusion detection of industrial control system[J]. Journal on Communications, 2017,38(2): 143-156.
[5]	WANG W P , WANG Z R , ZHOU Z F ,et al. Anomaly detection of industrial control systems based on transfer learning[J]. Tsinghua Science and Technology, 2021,26(6): 821-832.
[6]	SHU J G , ZHOU L , ZHANG W Z ,et al. Collaborative intrusion detection for VANETs:a deep learning-based distributed SDN approach[J]. IEEE Transactions on Intelligent Transportation Systems, 2021,22(7): 4519-4530.
[7]	LI W , WANG Y , JIN Z ,et al. Challenge-based collaborative intrusion detection in software-defined networking:an evaluation[J]. Digital Communications and Networks, 2021,7(2): 257-263.
[8]	SHONE N , NGOC T N , PHAI V D ,et al. A deep learning approach to network intrusion detection[J]. IEEE Transactions on Emerging Topics in Computational Intelligence, 2018,2(1): 41-50.
[9]	DING H , CHEN L , DONG L ,et al. Imbalanced data classification:a KNN and generative adversarial networks-based hybrid approach for intrusion detection[J]. Future Generation Computer Systems, 2022,131: 240-254.
[10]	段雪源, 付钰, 王坤 . 基于 VAE-WGAN 的多维时间序列异常检测方法[J]. 通信学报, 2022,43(3): 1-13.
	DUAN X Y , FU Y , WANG K . Multi-dimensional time series anomaly detection method based on VAE-WGAN[J]. Journal on Communications, 2022,43(3): 1-13.
[11]	HAMID M H A , YUSOFF M , MOHAMED A . Survey on highly imbalanced multi-class data[J]. International Journal of Advanced Computer Science and Applications, 2022,13(6): 211-229.
[12]	BITTON R , SHABTAI A . A machine learning-based intrusion detection system for securing remote desktop connections to electronic flight bag servers[J]. IEEE Transactions on Dependable and Secure Computing, 2021,18(3): 1164-1181.
[13]	GUPTA N , JINDAL V , BEDI P . CSE-IDS:using cost-sensitive deep learning and ensemble algorithms to handle class imbalance in network-based intrusion detection systems[J]. Computers ＆ Security, 2022,112:102499.
[14]	TENG S H , WU N Q , ZHU H B ,et al. SVM-DT-based adaptive and collaborative intrusion detection[J]. IEEE/CAA Journal of Automatica Sinica, 2017,5(1): 108-118.
[15]	AL S , DENER M . STL-HDL:a new hybrid network intrusion detection system for imbalanced dataset on big data environment[J]. Computers ＆ Security, 2021,110:102435.
[16]	HARUSH S , MEIDAN Y , SHABTAI A . DeepStream:autoencoder-based stream temporal clustering and anomaly detection[J]. Computers ＆ Security, 2021,106:102276.
[17]	YANG Z , LIU X , LI T ,et al. A systematic literature review of methods and datasets for anomaly-based network intrusion detection[J]. Computers ＆ Security, 2022,116: 1-5.
[18]	张志飞, 刘峰, 葛祎阳 ,等. 一种基于深度可分离卷积和注意力机制的入侵检测方法[J]. 物联网学报, 2023(1): 49-59.
	ZHANG Z F , LIU F , GE Y Y ,et al. An intrusion detection method based on depthwise separable convolution and attention mechanism[J]. Chinese Journal on Internet of Things, 2023(1): 49-59.
[19]	PAJOUH H H , JAVIDAN R , KHAYAMI R ,et al. A two-layer dimension reduction and two-tier classification model for anomaly-based intrusion detection in IoT backbone networks[J]. IEEE Transactions on Emerging Topics in Computing, 2019,7(2): 314-323.
[20]	ZHANG Y , LIU Q . On IoT intrusion detection based on data augmentation for enhancing learning on unbalanced samples[J]. Future Generation Computer Systems, 2022,133: 213-227.
[21]	ULLAH I , QIAN S , DENG Z ,et al. Extended Kalman filter-based localization algorithm by edge computing in wireless sensor networks[J]. Digital Communications and Networks, 2021,7(2): 187-195.
[22]	SWAIN R R , KHILAR P M , DASH T . Multifault diagnosis in WSN using a hybrid metaheuristic trained neural network[J]. Digital Communications and Networks, 2020,6(1): 86-100.
[23]	HOUGHTON I A , SMIT P B , CLARK D ,et al. Performance statistics of a real-time Pacific Ocean weather sensor network[J]. Journal of Atmospheric and Oceanic Technology, 2021,38(5): 1047-1058.
[24]	WANG K , WANG M Y , ZHAO Y F . Carrier design and motion control of marine underwater robot[J]. Journal of Coastal Research, 2020,107(1): 181-184.
[25]	MOMBER A W , WILMS M , BRUN D . The use of meteorological and oceanographic sensor data in the German offshore territory for the corrosion monitoring of marine structures[J]. Ocean Engineering, 2022,257:110994.
[26]	MOLTMANN T , TURTON J , ZHANG H M ,et al. A global ocean observing system (GOOS),delivered through enhanced collaboration across regions,communities,and new technologies[J]. Frontiers in Marine Science, 2019,6:291.
[27]	BAEK S , KWON D , SUH S C ,et al. Clustering-based label estimation for network anomaly detection[J]. Digital Communications and Networks, 2021,7(1): 37-44.
[28]	张兴兰, 尹晟霖 . 可变融合的随机注意力胶囊网络入侵检测模型[J]. 通信学报, 2020,41(11): 160-168.
	ZHANG X L , YIN S L . Intrusion detection model of random attention capsule network based on variable fusion[J]. Journal on Communications, 2020,41(11): 160-168.

Metrics

Recommended 0

No Suggested Reading articles found!

数据集	Normal	Probe	DoS	U2R	R2L
训练集	67 343	11 656	45 927	52	995
测试集	9 711	2 421	7 458	200	2 754

实际	预测
实际	攻击数据	正常数据
攻击数据	TP	FN
正常数据	FP	TN

类别	平衡前	平衡前比例	平衡后	平衡后比例
Normal	67 343	53.46%	64 077	43.83%
Probe	11 656	9.25%	11 656	7.97%
DoS	45 927	36.46%	43 614	29.83%
U2R	52	0.04%	12 113	8.28%
R2L	995	0.79%	14 747	10.09%
总计	125 973	100%	146 207	100%

评估指标			原始数据集					平衡化后
评估指标	Normal	Probe	DoS	U2R	R2L	Normal	Probe	DoS	U2R	R2L
精确率	0.719 4	0.618 2	0.954 7	0.640 0	0.150 0	0.781 6	0.760 1	0.899 0	0.517 2	0.827 1
召回率	0.966 0	0.769 9	0.824 9	0.080 0	0.001 1	0.914 0	0.811 2	0.817 5	0.150 0	0.529 8
F1-score	0.824 7	0.685 8	0.885 1	0.142 2	0.002 2	0.842 6	0.784 8	0.856 3	0.232 6	0.645 9
准确率			0.772 5					0.817 3

Research on intrusion detection method of marine meteorological sensor network based on anomalous behaviors

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 12

References 28

Related Articles 6

Metrics

Recommended 0

[1]	Xiaorong ZHU,Yao SHEN. RPMA low-power wide-area network planning method based on data mining [J]. Journal on Communications, 2019, 40(3): 28-35.
[2]	Pei-xin CHEN,Shu-hui CHEN,Jin-shu SU,Wei ZHANG. Novel software-hardware cooperative approach for decapsulating user data in cdma2000 network [J]. Journal on Communications, 2011, 32(9A): 173-178.
[3]	Jing-fang XU,Guo-hua CUI,Qi CHENG,Bing ZENG. Non-representable multipartite secret sharing matroids [J]. Journal on Communications, 2009, 30(8): 21-26.
[4]	HENYu-long S,UQi-jian X,EIQing-qi P,AJian-feng M. Grid-based routing protocol in wireless sensor networks [J]. Journal on Communications, 2009, 30(11A): 96-100.
[5]	Wang YANG,Jian GONG,Xiong WU. SyncPoint based scoring method in IDS evaluation [J]. Journal on Communications, 2008, 29(9): 1-9.
[6]	Yu YAO,Fu-xiang GAO,Ge YU. IDS evaluation approach based on ROC curves [J]. Journal on Communications, 2005, 26(1A): 113-115.