基于特征波动的异常流量检测,用于安全的工业物联网
Jie Yin1, Chuntang Zhang2, Wenwei Xie3
1Computer Information and Cyber Security, Jiangsu Police Institute, Nanjing, 210031 China.
概括
本研究引入了一种新的特征波动方法,用于在物联网 (IoT) 中检测异常流量. 这种方法通过克服传统方法的局限性来提高检测准确性和模型概括性.
科学领域:
- 网络安全 网络安全
- 网络流量分析 网络流量分析
- 物联网 (IoT) 安全 安全 物联网
背景情况:
- 目前物联网中的异常流量检测依赖于从数据包和会话数据中有限的特征提取.
- 现有的方法往往会丢失关键信息,从而降低数据集的有效性和稳定性.
- 在不同的场景中收集的数据表现出不同的特征,阻碍了有效的特征提取.
研究的目的:
- 使用物联网流量和会话流量数据开发一个新的异常流量数据集.
- 提出一种基于特征波动的创新特征提取方法.
- 提高物联网环境中的异常流量检测模型的准确性,稳定性和通用性.
主要方法:
- 构建一个新的异常流量数据集,集成来自IoT-23数据集的数据包和会话流量数据.
- 基于特征波动分析的特征提取技术的实施.
- 与传统的异常交通检测模型进行比较评估.
主要成果:
- 与传统方法相比,拟议的特征波动方法显示出更高的稳定性.
- 观察到异常交通检测的准确性有了显著的改善.
- 实现了现有异常检测模型的增强泛化能力.
结论:
- 特性波动方法有效地解决了在各种物联网数据场景中的信息丢失.
- 这种新的方法为物联网异常流量检测提供了更强大,更准确的解决方案.
- 该方法有利于提高物联网安全系统的整体性能和适用性.
相关概念视频
Random Error
934
Random or indeterminate errors originate from various uncontrollable variables, such as variations in environmental conditions, instrument imperfections, or the inherent variability of the phenomena being measured. Usually, these errors cannot be predicted, estimated, or characterized because their direction and magnitude often vary in magnitude and direction even during consecutive measurements. As a result, they are difficult to eliminate. However, the aggregate effect of these errors can be...
934
Rapidly Varying Flow
101
Rapidly varying flow (RVF) in open channels is characterized by abrupt changes in flow depth over a short distance, with the rate of depth change relative to distance often approaching unity. These flows are inherently complex due to their transient and multi-dimensional nature, making exact analysis difficult. However, approximate solutions using simplified models provide valuable insights into their behavior.Key Features of Rapidly Varying FlowRVF is commonly observed in scenarios involving...
101
Distribution Reliability and Automation
134
Distribution reliability in electrical power systems is critical for ensuring an uninterrupted power supply to consumers at minimal cost. According to IEEE Standard Terms, reliability is the probability that a device will function without failure over a specified time period or amount of usage. For electric power distribution, this translates to maintaining continuous power supply and addressing customer concerns over power outages. Several indices, as defined by IEEE Standard 1366-2012, are...
134
Unusual Results
3.2K
Unusual results are those that have a very low chance of occurring. Unusual results can be identified using probabilities and the range rule of thumb. In problems involving probability, unusual results can be observed in 2 instances – an unusually high number of successes or an unusually low number of successes.
According to the range rule of thumb, any value above or below two standard deviations, 2σ from the mean, μ is considered unusual.
Maximum unusual value =...
According to the range rule of thumb, any value above or below two standard deviations, 2σ from the mean, μ is considered unusual.
Maximum unusual value =...
3.2K
Classification of Signals
556
In signal processing, signals are classified based on various characteristics: continuous-time versus discrete-time, periodic versus aperiodic, analog versus digital, and causal versus noncausal. Each category highlights distinct properties crucial for understanding and manipulating signals.
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
556
Aliasing
164
Accurate signal sampling and reconstruction are crucial in various signal-processing applications. A time-domain signal's spectrum can be revealed using its Fourier transform. When this signal is sampled at a specific frequency, it results in multiple scaled replicas of the original spectrum in the frequency domain. The spacing of these replicas is determined by the sampling frequency.
If the sampling frequency is below the Nyquist rate, these replicas overlap, preventing the original...
If the sampling frequency is below the Nyquist rate, these replicas overlap, preventing the original...
164


