A Clustering and Classification-based Malicious Attack Detection Method for Internet of Things

doi:10.3969/j.issn.1671-1122.2021.08.010

Abstract

Abstract:

The Internet of things (IoT) devices are large in number, widely distributed, weak in protection, and vulnerable to malicious attacks. At the same time, attackers can capture a large number of the IoT terminal devices to launch massive attack traffic. To solve the above problems, this paper proposes a malicious attack detection method for IoT based on clustering and classification. Firstly, the traffic data of the IoT is preprocessed, random forest is used to evaluate the importance of features, and principal component analysis is used to reduce the dimensionality of some features. Then, the improved k-means algorithm is applied to cluster the results of traffic preprocessing. For different attack clusters, attack classification is implemented based on CART decision tree. Based on Bot-IoT and KDD CUP 99, the experimental results show that the proposed method has good attack detection effect, especially can effectively improve the detection accuracy of low-frequency attacks.

Key words: Internet of things, clustering, classification, intrusion detection, Bot-IoT

CLC Number:

TP309

LI Qun, DONG Jiahan, GUAN Zhitao, WANG Chao. A Clustering and Classification-based Malicious Attack Detection Method for Internet of Things[J]. Netinfo Security, 2021, 21(8): 82-90.

Figures/Tables 15

References 13

[1]	JAVED F, AFZAL M K, SHARIF M, et al. Internet of Things(IoT) Operating Systems Support, Networking Technologies, Applications, and Challenges: A Comparative Review[J]. IEEE Communications Surveys & Tutorials, 2018, 20(3):2062-2100.
[2]	CHEN Hongsong, CHEN Jingjiu. Statistical Based Distributed Denial of Service Attack Detection Research in Internet of Things[J]. Journal of Jilin University: Engineering and Technology Edition, 2020, 50(5):1894-1904.
	陈红松, 陈京九. 基于统计的物联网分布式拒绝服务攻击检测[J]. 吉林大学学报(工学版), 2020, 50(5):1894-1904.
[3]	LIU Xiangju, LIU Pengcheng, XU Hui, et al. Distributed Denial of Service Attack Detection Method Based on Software Defined Internet of Things[J]. Journal of Computer Applications, 2020, 40(3):753-759.
	刘向举, 刘鹏程, 徐辉, 等. 基于软件定义物联网的分布式拒绝服务攻击检测方法[J]. 计算机应用, 2020, 40(3):753-759.
[4]	RAY S, JIN Y, RAYCHOWDHURY A. The Changing Computing Paradigm with Internet of Things: A Tutorial Introduction[J]. IEEE Design & Test, 2016, 33(2):76-96.
[5]	BERTINO E, ISLAM N. Botnets and Internet of Things Security[J]. Computer, 2017, 50(2):76-79.
[6]	BEHAL S, KUMAR K. Detection of DDoS Attacks and Flash Events Using Information Theory Metrics—An Empirical Investigation[J]. Computer Communications, 2017(103):18-28.
[7]	ALABA F A, OTHMAN M, HASHEM I A T, et al. Internet of Things Securit: A Survey[J]. Journal of Network and Computer Applications, 2017, 88(6):10-28. doi: 10.1016/j.jnca.2017.04.002 URL
[8]	AL-GARADI M A, MOHAMED A, AL-ALI A, et al. A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security[J]. IEEE Communications Surveys & Tutorials, 2020, 22(3):1646-1685.
[9]	XU Wenya. Research on Network Intrusion Detection Based on Machine Learning[D]. Beijing: Beijing Jiaotong University, 2018.
	徐温雅. 基于机器学习的网络入侵检测研究[D]. 北京:北京交通大学, 2018.
[10]	PAJOUH H H, JAVIDAN R, KHAYAMI R, et al. A Two-layer Dimension Reduction and Two-tier Classification Model for Anomaly-based Intrusion Detection in IoT Backbone Networks[J]. IEEE Transactions on Emerging Topics in Computing, 2019, 7(2):314-323. doi: 10.1109/TETC.6245516 URL
[11]	AL-HAWAWREH M, MOUSTAFA N, SITNIKOVA E. Identification of Malicious Activities in Industrial Internet of Things Based on Deep Learning Models[J]. Information Security Technical Report, 2018, 41(8):1-11.
[12]	MEIDAN Y, BOHADANA M, SHABTAI A, et al. ProfilIoT: A Machine Learning Approach for IoT Device Identification Based on Network Traffic Analysis[C]//ACM. The 32nd ACM Symposium on Applied Computing, April 3-7, 2017, Marrakech, Morocco. New York: ACM, 2017: 506-509.
[13]	AMINANTO M E, KIM K. Improving Detection of Wi-Fi Impersonation by Fully Unsupervised Deep Learning[C]//Springer. 2017 Information Security Applications, August 24-26, 2017, Jeju Island, Korea. Cham: Springer, 2017: 212-223.

流量类别	数量/条
正常	157817
Prob	8273
DoS	621311
U2R	280
R2L	17515
总计	805196

流量类别	数量/条
正常	477
DoS	465955
DDoS	500000
Reconnaissance	82060
Theft	79
总计	1048571

特征	描述	VIM
Flag	流量状态标记	0.16870
Pkts_P_State_P_Protocol_P_DestIP	按目标IP的流状态和协议分组的数据包数	0.144135
Mean	汇总记录的平均持续时间	0.134199
Seq	优先队列数量	0.133772
AR_P_Proto_P_DstIP	每个目标IP中每个协议的平均速率	0.075304
N_IN_Conn_P_DstIP	每个目标IP的入站连接数	0.061119
AR_P_Proto_P_Dport	每个目的端口中每个协议的平均速率	0.050949
Srate	每秒源端口到目的端口的数据包	0.033956
Min	汇总记录的最短持续时间	0.029209
AR_P_Proto_P_SrcIP	每个源端口中每个协议的平均速率	0.027693
TnP_PerProto	每个协议的数据包总数	0.023474
Drate	每秒目的端口到源端口的数据包	0.020176
Pkts_P_State_P_Protocol_P_SrcIP	按源IP的流状态和协议分组的数据包数	0.016172
Stddev	汇总记录的标准差	0.013762
Spkts	源到目的数据包数量	0.012901

[1]	WEN Weiping, HU Yezhou, ZHAO Guoliang, CHEN Xiarun. Design and Implementation of an Abnormal IP Identification System Based on Traffic Feature Classification [J]. Netinfo Security, 2021, 21(8): 1-9.
[2]	REN Tao, JIN Ruochen, LUO Yongmei. Network Intrusion Detection Algorithm Integrating Blockchain and Federated Learning [J]. Netinfo Security, 2021, 21(7): 27-34.
[3]	FANG Minzhi, CHENG Guang, KONG Panyu. Anti-noise Application Layer Binary Protocol Format Reverse Method [J]. Netinfo Security, 2021, 21(7): 72-79.
[4]	LIU Xin, GUO Zhenbin, SONG Yuchen. An Authentication Scheme Based on SGX for Industrial Internet of Things [J]. Netinfo Security, 2021, 21(6): 1-10.
[5]	LI Jiawei, WU Kehe, ZHANG Bo. Research on Anomaly Detection of Power Industrial Control System Based on Gaussian Mixture Clustering [J]. Netinfo Security, 2021, 21(3): 53-63.
[6]	GUO Xuanzhen, PAN Zulie, SHEN Yi, CHEN Yuanchao. DNS Rebinding Detection Technology Based on Passive DNS Data Analysis [J]. Netinfo Security, 2021, 21(3): 87-95.
[7]	DU Ye, WANG Zimeng, LI Meihong. Industrial Control Intrusion Detection Method Based on Optimized Kernel Extreme Learning Machine [J]. Netinfo Security, 2021, 21(2): 1-9.
[8]	WANG Huazhong, CHENG Qi. Research on Intrusion Detection of Industrial Control System Based on Improved Whale Algorithm [J]. Netinfo Security, 2021, 21(2): 53-60.
[9]	SONG Yubo, GENG Yijin, LI Guyue, LI Tao. Identification of LoRa Device Based on Differential Constellation Trace Figure [J]. Netinfo Security, 2021, 21(1): 41-48.
[10]	SHEN Yeming, LI Beibei, LIU Xiaojie, OUYANG Yuankai. Research on Active Learning-based Intrusion Detection Approach for Industrial Internet [J]. Netinfo Security, 2021, 21(1): 80-87.
[11]	LI Qiao, LONG Chun, WEI Jinxia, ZHAO Jing. A Hybrid Model of Intrusion Detection Based on LMDR and CNN [J]. Netinfo Security, 2020, 20(9): 117-121.
[12]	TONG Xin, WANG Luona, WANG Runzheng, WANG Jingya. A Generation Method of Word-level Adversarial Samples for Chinese Text Classification [J]. Netinfo Security, 2020, 20(9): 12-16.
[13]	XU Guotian. Research on K-Nearest Neighbor High Speed Matching Algorithm in Network Intrusion Detection [J]. Netinfo Security, 2020, 20(8): 71-80.
[14]	JIANG Nan, CUI Yaohui, WANG Jian, WU Jinchao. Context-based Attack Scenario Reconstruction Model for IDS Alarms [J]. Netinfo Security, 2020, 20(7): 1-10.
[15]	ZHANG Xiaoyu, WANG Huazhong. Intrusion Detection of ICS Based on Improved Border-SMOTE for Unbalance Data [J]. Netinfo Security, 2020, 20(7): 70-76.