CN109936568A - A kind of preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network - Google Patents
A kind of preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network Download PDFInfo
- Publication number
- CN109936568A CN109936568A CN201910126604.3A CN201910126604A CN109936568A CN 109936568 A CN109936568 A CN 109936568A CN 201910126604 A CN201910126604 A CN 201910126604A CN 109936568 A CN109936568 A CN 109936568A
- Authority
- CN
- China
- Prior art keywords
- neural network
- recognition
- recurrent neural
- malicious attack
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Landscapes
- Computer And Data Communications (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network that the present invention provides a kind of, firstly, being put forward for the first time the safety for improving data transmission using abnormal data caused by Multi-variate normal distribution real-time detection malicious attack behavior；Secondly, when note abnormalities data when, call Recognition with Recurrent Neural Network design based on programmable gate array to accelerate IP kernel, the quick, intelligent normal value for predicting sensor；Finally, dynamic updates Recognition with Recurrent Neural Network training dataset, Recognition with Recurrent Neural Network is improved to the prediction fitness of new measurement value sensor, to ensure that the reasonability of prediction data, further also improve the reliability of data transmission, and this programme also has the characteristics that computation complexity is lower and fast convergence rate, is widely used in the limited Internet of Things edge device of computing resource.
Description
Technical field
The invention belongs to Internet of Things security fields, in particular to a kind of preventing malicious attack sensing based on Recognition with Recurrent Neural Network
Device collecting method.
Background technique
Sensor belongs to the key data acquisition equipment of Internet of Things front end, and true physical object tight association, after being
Continuous network transmission and cloud processing provide timing or the relevant mass data in position, to realize the collaborative perception to physical object
With the wisdom purpose of real-time monitoring.With the open widespread deployment of wireless access and shared system, sensor node more holds
Easily become the target of cyberspace malicious attack, attacker can distort or forge sensor raw data, so as to cause cloud
The erroneous judgement of end system, failure and the serious consequences such as out of control.Therefore, how to improve sensor data acquisition it is accurate, safety and can
It leans on, is the key technical problem that Internet of Things security fields must solve.
So far, two major classes can be divided by solving the safe and reliable method of sensing data, and one kind is multi-source method, main
It will be by the method for Fusion, the rejecting abnormalities node in fusion, for example, by using seeking multiple sensing datas
Similarity distance, several most like sensing datas are merged, to effectively prevent part malicious attack.It is another kind of
Single source method is based primarily upon traditional shallow-layer machine learning algorithm such as Kalman filtering algorithm or Bayesian Estimation, to sensor number
According to Active Fault Tolerant estimation is carried out, the electromagnetic environment noise in sensing data can be effectively filtered out, to improve the reliable of data
Property.
But for the reasonable of sensing data, safety and reliable new demand in Internet of Things, existing solution exists
Algorithm simply with intelligent lower deficiency, can not adapt to internet of things equipment digitlization, intelligent and networking new trend.Especially
Its above two solution, when the increasingly severe and complicated cyberspace of Initiative Defense threatens, have it is clearly disadvantageous, it is right
In the method for Multiple Source Sensor fusion, the internal association logic of Multiple Source Sensor data is not considered, causes rate of false alarm higher, and it is single
Source method main purpose is to improve the anti-noise ability of data, lacks active countermeasure to simple attack, gathering algorithm is blindly believed
Appoint hardware circuit, so that sensor becomes the new entrance of cyberspace malicious attack.
Summary of the invention
For in the prior art the technical issues of, the present invention provides a kind of preventing malicious attacks based on Recognition with Recurrent Neural Network
Sensor data acquisition method, its object is to which the safety of data, reasonability and reliability can not only be effectively improved, also
Have the characteristics that computation complexity is lower and fast convergence rate, thus is widely used in the limited Internet of Things network edge of computing resource and sets
It is standby.
In order to solve the above technical problems, the present invention is achieved by the following technical programs:
A kind of preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network, comprising the following steps:
Step 1: the data x that acquisition sensor measurement obtainsn+1, malicious attack detection threshold value η is set, training data is constructed
Collect T={ x1,x2,…,xi,…,xn, calculate the average value mu of training dataset TjAnd variance
Wherein, xn+1∈Rm；xi=(xi1,xi2,…xij,…,xim)∈Rm；I=1,2 ..., n；J=1,2 ..., m；
Step 2: the average value mu being calculated according to step 1jAnd varianceCalculate the data x that sensor measurement obtainsn+1
Probability p；
Step 3: the calculated Probability p of step 2 being compared with the attack detecting threshold value η that step 1 is arranged, according to comparing
As a result judge whether that malicious attack occurs；
As p < η, indicates that malicious attack occurs, execute step 4；
Otherwise, it indicates to execute step 5 there is no malicious attack；
Step 4: calling Recognition with Recurrent Neural Network to accelerate IP kernel, the training dataset T that input step 1 constructs is to circulation nerve net
The network model of network is trained and tests；
Step 4.1: the network model formula of training Recognition with Recurrent Neural Network is as follows:
ht=Sigmoid (Uht-1+Wxt+b)
yt=Vht
Wherein t ∈ { 1,2 ..., n }, wherein W is the implicit layer state connection weight matrix of input-, and U is that implicit layer state-is hidden
The matrix of connection weight containing layer state, V are implicit layer state-output connection weight matrix, and b is biasing, htImplicit stratiform is walked for t
State, ht-1Implicit layer state, y are walked for t-1tFor neural network forecast as a result, Sigmoid is nonlinear activation function, it is defined as
Step 4.2: the network model of test loop neural network, the data x that sensor measurement is obtainedn+1It is input to
The successful Recognition with Recurrent Neural Network model of training in step 4.1, obtains neural network forecast result yt, enable xn+1=yt, execute step 5；
Step 5: updating training dataset, T={ x1=x2,x2=x3,…,xi=xi+1,…,xn=xn+1}；
Step 6: Returning sensor measurement data xn+1。
Further, in the step 1,
Further, in the step 2, sensor measurement data x is calculated using Multi-variate normal distributionn+1∈Rm's
Probability p,
Further, in the step 4, the Recognition with Recurrent Neural Network designed based on programmable gate array is called to accelerate IP
Core.
Compared with prior art, the present invention at least has the advantages that firstly, being put forward for the first time using Multivariate Normal point
Abnormal data caused by cloth function real-time detection malicious attack behavior improves the safety of data transmission；Secondly, when discovery
When abnormal data, the Recognition with Recurrent Neural Network designed based on programmable gate array is called to accelerate IP kernel, quick, intelligent prediction passes
The normal value of sensor；Finally, dynamic updates Recognition with Recurrent Neural Network training dataset, Recognition with Recurrent Neural Network is improved to new sensing
The prediction fitness of device measured value further also improves the reliable of data transmission to ensure that the reasonability of prediction data
Property, and this programme also has the characteristics that computation complexity is lower and fast convergence rate, and it is limited to be widely used in computing resource
Internet of Things edge device.
Detailed description of the invention
Fig. 1 is that embedded RNN constructed by the present invention accelerates IP kernel schematic diagram；
Fig. 2 is that the present invention uses automobile tyre pressure check system (Tire Pressure Monitoring System, TMPS)
Temperature sensor data realize, sensor call RNN forecast result of model figure.
Specific embodiment
In order to make the object, technical scheme and advantages of the embodiment of the invention clearer, below to technical solution of the present invention
It is clearly and completely described, it is clear that described embodiments are some of the embodiments of the present invention, rather than whole implementation
Example.Based on the embodiments of the present invention, obtained by those of ordinary skill in the art without making creative efforts
Every other embodiment, shall fall within the protection scope of the present invention.
For the loophole of sensor data acquisition link, hardware design level can by increasing hardware protection rank, if
Meter can resist the physical attacks of external acoustic waves and electromagnetic wave, at the same can by promoting the intelligence degree of gathering algorithm, from
And Internet of Things smart machine is adapted to, such as the safe new demand of the intelligent bodies such as unmanned intelligent vehicle.The present invention is directed to single source sensor
Data acquire safety problem, and the reliability of gathering algorithm is promoted using deep learning, are based on software and hardware Mixed-Programming Technology, solve
Sensor is by the real-time data acquisition problem under malicious attack scene.
Recognition with Recurrent Neural Network (Recurrent Neural Network, RNN), i.e. RNN is that one kind is widely used in video
With the deep learning model in language data process, relative to traditional neural network structure, inside RNN hidden layer include dynamic from
Feedback arrangement, the non-linear extensive signal processing to complicate when can be adaptive, but RNN modeling and training process are complicated, because
This limits practical application of the RNN in internet of things equipment.
The present invention is to realize that one kind takes into account real-time and the safe gathering algorithm of intelligentized sensing data, can using scene
The hardware of programmed logic gate array (Field Programmable Gate Array, FPGA) is configurable, and framework is flexible, unit
Low energy consumption, the compatible advantage of upper layer software (applications), realizes that the RNN based on FPGA accelerates IP kernel, the matrix multiplication fortune in parallelization RNN
It calculates, the design scheme that is mixed using C language with Verilog HDL language software and hardware, very good solution RNN is in embedded device
In application problem.
As shown in Figure 1, embedded RNN constructed by the present invention accelerates IP kernel principle, using opening for ARM mixing fpga chip
It sends out platform to realize, data communication uses AXI4 bus structures, and data transmission realizes that algorithm is realized based on direct memory access module
Language is based on embedded-type ARM C language standard and Verilog HDL language.
Specifically, as a certain preferred embodiment of the invention, a kind of anti-malice based on Recognition with Recurrent Neural Network of the present invention
Attack sensor data acquisition method, comprising the following steps:
Step 1: measured value being recorded in real time to vehicle mounted tyre pressure detection system temperature sensor, and as vector xn+1, from
The temperature sensor of vehicle mounted tyre pressure detection system acquires temperature normal data in one group of automobile tire, constructs RNN training dataset
Initial value charges to T={ x1,x2,…,xi,…,xn, calculate the average value of training dataset TAnd variance
Wherein, xn+1∈Rm；xi=(xi1,xi2,…xij,…,xim)∈Rm；I=1,2 ..., n；J=1,2 ..., m；
Malicious attack detection threshold value η is set, and the present embodiment malicious attack detection threshold reference value is 0.95；
Step 2: the average value mu being calculated according to step 1jAnd varianceTemperature is calculated using Multi-variate normal distribution
Spend sensor real-time measuring data xn+1∈RmProbability p,
Step 3: the calculated Probability p of step 3 being compared with the attack detecting threshold value η that step 1 is arranged, according to comparing
As a result judge whether that malicious attack occurs；
As p < η, indicates that malicious attack occurs, execute step 4；
Otherwise, it indicates to execute step 5 there is no malicious attack；
Step 4: the Recognition with Recurrent Neural Network designed based on programmable gate array being called to accelerate IP kernel, 1 structure of input step
The training dataset T built is based on backpropagation (Back Propagation at any time to the model of Recognition with Recurrent Neural Network
Through Time, BPTT) algorithm iteration training, and input pickup measured value is to obtain model predication value；
Step 4.1: the network model formula of training Recognition with Recurrent Neural Network is as follows:
ht=Sigmoid (Uht-1+Wxt+b)
yt=Vht
Wherein t ∈ { 1,2 ..., n }, wherein W is the implicit layer state connection weight matrix of input-, and U is that implicit layer state-is hidden
The matrix of connection weight containing layer state, V are implicit layer state-output connection weight matrix, and b is biasing, htImplicit stratiform is walked for t
State, ht-1Implicit layer state, y are walked for t-1tFor neural network forecast as a result, Sigmoid is nonlinear activation function, it is defined as
Training algorithm BPTT iteration is related to activation primitive derivation, the derived function of the present embodiment activation primitive are as follows:
Step 4.2: the network model of test loop neural network, by sensor measurement data xn+1It is input in step 4.1
The middle successful Recognition with Recurrent Neural Network model of training obtains neural network forecast result yt, enable xn+1=yt, execute step 5；
Step 5: updating training dataset, charge to T={ x1=x2,x2=x3,…,xi=xi+1,…,xn=xn+1}；
Step 6: returning to temperature sensor measurement data xn+1。
As shown in Fig. 2, the present invention using automobile tyre pressure check system (Tire Pressure Monitoring System,
TMPS temperature sensor data) is realized, when detecting the abnormal data that malicious attack generates, sensor calls RNN mould
Type prediction effect figure, wherein * is the sensing data that do not attack, and ◇ is the abnormality sensor data after attacking, and o is
Using the prediction result of RNN, experimental result picture shows that this programme can accurately detect the abnormality sensor data after attack, together
When, it is smaller for the predicted value of abnormal data and the temperature difference of true value based on Recognition with Recurrent Neural Network, and with the increasing of time
Long, temperature difference is reduced therewith.
Claims (4)
1. a kind of preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network, which is characterized in that including following
Step:
Step 1: the data x that acquisition sensor measurement obtainsn+1, malicious attack detection threshold value η is set, training dataset T=is constructed
{x1,x2,…,xi,…,xn, calculate the average value mu of training dataset TjAnd variance
Wherein, xn+1∈Rm；xi=(xi1,xi2,…xij,…,xim)∈Rm；I=1,2 ..., n；J=1,2 ..., m；
Step 2: the average value mu being calculated according to step 1jAnd varianceCalculate the data x that sensor measurement obtainsn+1It is general
Rate p；
Step 3: the calculated Probability p of step 2 being compared with the attack detecting threshold value η that step 1 is arranged, according to comparison result
Judge whether that malicious attack occurs；
As p < η, indicates that malicious attack occurs, execute step 4；
Otherwise, it indicates to execute step 5 there is no malicious attack；
Step 4: calling Recognition with Recurrent Neural Network to accelerate IP kernel, the training dataset T that input step 1 constructs is to Recognition with Recurrent Neural Network
Network model is trained and tests；
Step 4.1: the network model formula of training Recognition with Recurrent Neural Network is as follows:
ht=Sigmoid (Uht-1+Wxt+b)
yt=Vht
Wherein t ∈ { 1,2 ..., n }, wherein W is the implicit layer state connection weight matrix of input-, and U is implicit layer state-hidden layer
State connection weight matrix, V are implicit layer state-output connection weight matrix, and b is biasing, htImplicit layer state is walked for t,
ht-1Implicit layer state, y are walked for t-1tFor neural network forecast as a result, Sigmoid is nonlinear activation function, it is defined as
Step 4.2: the network model of test loop neural network, the data x that sensor measurement is obtainedn+1It is input in step
The successful Recognition with Recurrent Neural Network model of training in 4.1, obtains neural network forecast result yt, enable xn+1=yt, execute step 5；
Step 5: updating training dataset, T={ x1=x2,x2=x3,…,xi=xi+1,…,xn=xn+1}；
Step 6: Returning sensor measurement data xn+1。
2. a kind of preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network according to claim 1,
It is characterized in that, in the step 1,
3. a kind of preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network according to claim 1,
It is characterized in that, calculating sensor measurement data x using Multi-variate normal distribution in the step 2n+1∈RmProbability p,
4. a kind of preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network according to claim 1,
It is characterized in that, calling the Recognition with Recurrent Neural Network designed based on programmable gate array to accelerate IP kernel in the step 4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910126604.3A CN109936568B (en) | 2019-02-20 | 2019-02-20 | Malicious attack prevention sensor data acquisition method based on recurrent neural network |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910126604.3A CN109936568B (en) | 2019-02-20 | 2019-02-20 | Malicious attack prevention sensor data acquisition method based on recurrent neural network |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109936568A true CN109936568A (en) | 2019-06-25 |
| CN109936568B CN109936568B (en) | 2021-08-17 |
Family
ID=66985714
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910126604.3A Active CN109936568B (en) | 2019-02-20 | 2019-02-20 | Malicious attack prevention sensor data acquisition method based on recurrent neural network |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109936568B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110796237A (en) * | 2019-10-28 | 2020-02-14 | 宁夏吉虎科技有限公司 | Method and device for detecting attack resistance of deep neural network |
| CN111400040A (en) * | 2020-03-12 | 2020-07-10 | 重庆大学 | Industrial Internet system based on deep learning and edge calculation and working method |
| CN112822191A (en) * | 2021-01-06 | 2021-05-18 | 大连理工大学 | Method for multi-dimensional data security detection in networked cooperative system |
| CN114884694A (en) * | 2022-04-06 | 2022-08-09 | 北京北卡星科技有限公司 | Industrial control network security risk assessment method based on layered modeling |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107066446A (en) * | 2017-04-13 | 2017-08-18 | 广东工业大学 | A kind of Recognition with Recurrent Neural Network text emotion analysis method of embedded logic rules |
| CN107203701A (en) * | 2017-07-24 | 2017-09-26 | 广东工业大学 | A kind of measuring method of fat thickness, apparatus and system |
| CN107622275A (en) * | 2017-08-21 | 2018-01-23 | 西安电子科技大学 | A kind of Data Fusion Target recognition methods based on combining evidences |
-
2019
- 2019-02-20 CN CN201910126604.3A patent/CN109936568B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107066446A (en) * | 2017-04-13 | 2017-08-18 | 广东工业大学 | A kind of Recognition with Recurrent Neural Network text emotion analysis method of embedded logic rules |
| CN107203701A (en) * | 2017-07-24 | 2017-09-26 | 广东工业大学 | A kind of measuring method of fat thickness, apparatus and system |
| CN107622275A (en) * | 2017-08-21 | 2018-01-23 | 西安电子科技大学 | A kind of Data Fusion Target recognition methods based on combining evidences |
Non-Patent Citations (2)
| Title |
|---|
| 方圆等: "基于混合卷积神经网络和循环神经网络的入侵检测模型", 《计算机应用》 * |
| 於帮兵等: "基于长短时记忆网络的工业控制系统入侵检测", 《信息与控制》 * |
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110796237A (en) * | 2019-10-28 | 2020-02-14 | 宁夏吉虎科技有限公司 | Method and device for detecting attack resistance of deep neural network |
| CN110796237B (en) * | 2019-10-28 | 2023-04-07 | 宁夏吉虎科技有限公司 | Method and device for detecting attack resistance of deep neural network |
| CN111400040A (en) * | 2020-03-12 | 2020-07-10 | 重庆大学 | Industrial Internet system based on deep learning and edge calculation and working method |
| CN111400040B (en) * | 2020-03-12 | 2023-06-20 | 重庆大学 | Industrial Internet system based on deep learning and edge calculation and working method |
| CN112822191A (en) * | 2021-01-06 | 2021-05-18 | 大连理工大学 | Method for multi-dimensional data security detection in networked cooperative system |
| CN112822191B (en) * | 2021-01-06 | 2021-11-02 | 大连理工大学 | Method for multi-dimensional data security detection in networked cooperative system |
| CN114884694A (en) * | 2022-04-06 | 2022-08-09 | 北京北卡星科技有限公司 | Industrial control network security risk assessment method based on layered modeling |
| CN114884694B (en) * | 2022-04-06 | 2023-05-30 | 北京北卡星科技有限公司 | Industrial control network security risk assessment method based on hierarchical modeling |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109936568B (en) | 2021-08-17 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109936568A (en) | A kind of preventing malicious attack sensor data acquisition method based on Recognition with Recurrent Neural Network | |
| Selvakumar et al. | Intelligent temporal classification and fuzzy rough set-based feature selection algorithm for intrusion detection system in WSNs | |
| Dong et al. | Network abnormal traffic detection model based on semi-supervised deep reinforcement learning | |
| Abeshu et al. | Deep learning: The frontier for distributed attack detection in fog-to-things computing | |
| Wang et al. | Anomaly detection of industrial control systems based on transfer learning | |
| Kim et al. | Method of intrusion detection using deep neural network | |
| CN113408743B (en) | Method and device for generating federal model, electronic equipment and storage medium | |
| EP2828753B1 (en) | Anomaly detection to identify coordinated group attacks in computer networks | |
| Yu et al. | A high precision intrusion detection system for network security communication based on multi-scale convolutional neural network | |
| Peng et al. | Network intrusion detection based on deep learning | |
| Tian et al. | Adversarial attacks and defense for CNN based power quality recognition in smart grid | |
| CN113765880B (en) | Power system network attack detection method based on space-time correlation | |
| Yazdian-Dehkordi et al. | Penalized Gaussian mixture probability hypothesis density filter for multiple target tracking | |
| Turukmane et al. | M-MultiSVM: An efficient feature selection assisted network intrusion detection system using machine learning | |
| Hu et al. | Model scheduling and sample selection for ensemble adversarial example attacks | |
| Kalaivani et al. | A Hybrid Deep Learning Intrusion Detection Model for Fog Computing Environment. | |
| CN108931700A (en) | A kind of power grid security Warning System based on WSNs | |
| Kumar et al. | Intrusion detection using artificial neural network with reduced input features | |
| Sheng et al. | Network traffic anomaly detection method based on chaotic neural network | |
| CN116737850A (en) | Graph neural network model training method for APT entity relation prediction | |
| Anwer et al. | Intrusion detection using deep learning | |
| Wei et al. | Intrusive detection systems design based on BP neural network | |
| Yu et al. | A parallel game model‐based intrusion response system for cross‐layer security in industrial internet of things | |
| CN115033432A (en) | Time-space network-based false touch point detection and defense method for touch screen | |
| CN116992937A (en) | Neural network model restoration method and related equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |