Deep Learning For LOT Anomaly Detection

With the development of sensor,automatic identification and tracking,embedded computing and other technologies,the ability to integrate intelligent objects into daily activities through the Internet has been increased.This kind of Internet and intelligent object fusion,and can transfer data to each other is called the Internet of things.This new model is considered to be one of the most important parts of the ICT industry in the next few years.Many applications,such as logistics,industrial engineering,public safety,home automation,environmental monitoring and medical security,will benefit from the Internet of things system.However,the network threat in the real world may attack the Internet of things infrastructure,resulting in network security and property loss.Because of the different standards and communication protocols involved,the computing capacity is limited and the number of interconnection devices is large,so the traditional security countermeasures can not play an effective role in the Internet of things system.Therefore,it is very important to develop specific security solutions for the Internet of things.In order to solve the security problem of Internet of things and meet different application scenarios,this paper designs two different anomaly detection schemes based on the supervised and semi supervised training principles of deep learning algorithm.Through the experimental verification,the two schemes can achieve high detection accuracy in their respective application scenarios,and effectively solve the problem of low accuracy of model training when the abnormal data sets are rare.The details are as follows:(1)To know the security status of the Internet of things,investigate the intrusion detection system proposed for network security problems,analyze the feasibility of deep learning application in anomaly detection,and summarize and compare the characteristics of various anomaly detection algorithms.(2)According to the supervised and semi supervised deep anomaly detection methods,aiming at whether the training set contains abnormal data,the deep anomaly detection schemes based on text convolution network(Textcnn)and fully connected generative countermeasure network(Ganomaly-FC)are proposed respectively.For the anomaly detection scheme based on textcnn,we design to convert network data into text data,and use word embedding technology to save the semantic relationship of each byte and reduce the feature dimension,which has high detection accuracy.In the anomaly detection scheme based on Ganomaly-FC,a neural network algorithm Ganomaly-FC is designed,which can be used for semi supervised detection.By manually extracting data features and establishing behavior features of normal data,the algorithm model is trained to detect anomalies.(3)The abnormal detection scheme and result analysis are realized.In the implementation of textcnn anomaly detection scheme,the data is cut into session form by using file divider splitcap.Through reading data into byte text,input it into the built TextCNN network to complete the training and test of the model.In the implementation of the anomaly detection scheme of Ganomaly-FC,the normal data set features are extracted manually by using network traffic analysis and generator cicflowmeter,which is the behavior feature of network traffic,to train the Ganomaly-FC model to complete the anomaly detection.The results show that the detection rate of anomaly in textcnn is 99.8%and that of Ganomaly-FC is 83.3%.In addition,we compared the detection accuracy of the two schemes in different application scenarios and compared the detection rate of Ganomaly-FC under the condition of dimension reduction algorithm.