GBDT-IL:渐变增强决策树的增量学习,用于检测物联网中的尸网络
Ruidong Chen1, Tianci Dai1, Yanfeng Zhang2
1Institute for Cyber Security, School of Computer Science and Engineering, University of Electronic Science and Technology of China (UESTC), Chengdu 611731, China.
Sensors (Basel, Switzerland)
|April 13, 2024
概括
本研究介绍了GBDT-IL,这是一种用于检测物联网 (IoT) 尸网络的增量学习方法. 它有效地适应不断变化的威胁,并以更少的功能实现高精度,提高物联网安全性.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 物联网 (IoT) 的物联网 (IoT) 的物联网.
背景情况:
- 物联网 (IoT) 设备的扩散引入了重大安全风险,特别是物联网尸网络.
- 现有的基于人工智能的尸网络检测模型与动态网络数据流和在现实环境中不断发展的尸网络作斗争.
研究的目的:
- 提出一种增量学习方法,即GBDT-IL,用于对物联网尸网络流量进行强大而准确的检测.
- 通过优化特征选择,增强模型适应动态数据的能力,减少资源需求.
主要方法:
- 开发了GBDT-IL,一种使用渐变增强决策树的增量学习框架.
- 集成了一个增强的费舍尔分数特征选择算法来识别最佳特征.
- 评估了BoT-IoT,N-BaIoT,MedBIoT和MQTTSet数据集的性能,与现有方法进行比较.
主要成果:
- 使用仅25个特征实现了99.81%的平均准确性,超过了类似的特征选择算法.
- 在漂移数据上表现出卓越的性能,平均准确率为96.88%,比现有的概念漂移检测算法提高了2.98%.
- 保持了3.02%的低平均虚假阳性率.
结论:
- GBDT-IL提供了一个强大的解决方案,用于在动态环境中检测不断发展的物联网尸网络.
- 该方法有效地平衡了高精度与减少计算资源需求.
- 这种方法显著提升了物联网尸网络检测的最新技术.
相关概念视频
Classification of Systems-I
184
Linearity is a system property characterized by a direct input-output relationship, combining homogeneity and additivity.
Homogeneity dictates that if an input x(t) is multiplied by a constant c, the output y(t) is multiplied by the same constant. Mathematically, this is expressed as:
Homogeneity dictates that if an input x(t) is multiplied by a constant c, the output y(t) is multiplied by the same constant. Mathematically, this is expressed as:
184
Classification of Systems-II
144
Continuous-time systems have continuous input and output signals, with time measured continuously. These systems are generally defined by differential or algebraic equations. For instance, in an RC circuit, the relationship between input and output voltage is expressed through a differential equation derived from Ohm's law and the capacitor relation,
144
Machines: Problem Solving II
308
Machines are complex structures consisting of movable, pin-connected multi-force members that work together to transmit forces. Consider a lifting tong carrying a 100 kg load. It comprises movable sections DAF and CBG linked together with member AB.
308
Survival Tree
84
Survival trees are a non-parametric method used in survival analysis to model the relationship between a set of covariates and the time until an event of interest occurs, often referred to as the "time-to-event" or "survival time." This method is particularly useful when dealing with censored data, where the event has not occurred for some individuals by the end of the study period, or when the exact time of the event is unknown.
Building a Survival Tree
Constructing a...
Building a Survival Tree
Constructing a...
84
Classification of Signals
455
In signal processing, signals are classified based on various characteristics: continuous-time versus discrete-time, periodic versus aperiodic, analog versus digital, and causal versus noncausal. Each category highlights distinct properties crucial for understanding and manipulating signals.
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
A continuous-time signal holds a value at every instant in time, representing information seamlessly. In contrast, a discrete-time signal holds values only at specific moments, often denoted as x(n), where...
455
Aggregates Classification
317
Aggregate classification is generally based on its size, petrographic characteristics, weight, and source. Size classification ranges from coarse to fine aggregates, defined by the size of the particles. Coarse aggregates are particles that do not pass through ASTM sieve No. 4, and aggregates that pass through the sieve are fine aggregates.
Petrographic classification groups aggregates based on common mineralogical characteristics. Some of the common mineral groups found in aggregates are...
Petrographic classification groups aggregates based on common mineralogical characteristics. Some of the common mineral groups found in aggregates are...
317


