Research On Intrusion Detection Methods Of MQTT-based IoT

The Internet of Things(IoT)has been developing for more than ten years from its release.With the rise of 5G in recent years,the development momentum of IoT has been continuously enriched,and the market potential has been generally recognized by the industry.IoT technology and applications get a high-speed innovation.IoT has become an important pillar of information industry and a key infrastructure supporting the digital economy.The MQTT protocol is an IoT communication protocol based on the publish/subscribe model.Due to its advantages of small messages body,low overhead,asynchronous transmission and simple implementation,it has been widely used in the connection of IoT devices.Large number of devices brings an urgent security threat.However,there is no reliable security mechanism in MQTT protocol,which making it difficulty to defend against malicious attacks.Intrusion detection system is an important part of network security protection measures,which has the advantages of active defense,high reliability,and scalability.But most of the intrusion detection systems are commonly designed for the traditional network environment.Considering the problem of heterogeneous equipment,weaker performance,and new types of attacks in IoT,it has brought great obstacles to user those intrusion detection systems.Therefore,it is particularly important to design an appropriate intrusion detection method for IoT that uses the MQTT protocol for communication.Aiming at the above goals,the main work of this thsis are as follows:1.An intrusion detection method based on ensemble learning is proposed,using a gradient boosting decision tree as a traffic data classification model.And the problem of imbalanced data,which put a bad influence on classification,is solved by a synthetic sampling method.The performance of the proposed method is verified and tested by NSL-KDD benchmark dataset and making comparison with other models.2.In order to fully extract the serial feature information from network traffic data,a long short-term memory network is adopted to do the thing and generate new features.The new features will be used as input to the gradient boosting decision tree model for classification.Finally an intrusion detection method combining LSTM and GBDT is proposed to improve the classification performance of the model.3.An IoT simulation environment that uses MQTT protocol is built based on the opensource components.With the generation and collection of MQTT traffic data,a complete dataset for intrusion detection in MQTT-based IoT environment is established to verify the performance of the proposed intrusion detection method.