Please wait a minute...
浙江大学学报(工学版)  2026, Vol. 60 Issue (3): 624-632    DOI: 10.3785/j.issn.1008-973X.2026.03.018
计算机技术、控制工程     
基于关系嵌入的物联网未知攻击检测方法
李智慧1,2(),邓琨1,*(),许聪源1,3
1. 嘉兴大学 信息科学与工程学院,浙江 嘉兴 314001
2. 浙江理工大学 信息科学与工程学院(网络空间安全学院),浙江 杭州 310018
3. 天津大学 电气自动化与信息工程学院,天津 300072
Method for detecting unknown IoT attack based on relational embedding
Zhihui LI1,2(),Kun DENG1,*(),Congyuan XU1,3
1. College of Information and Engineering, Jiaxing University, Jiaxing 314001, China
2. School of Information Science and Engineering (School of Cyber Science and Technology), Zhejiang Sci-Tech University, Hangzhou 310018, China
3. School of Electrical and Information Engineering, Tianjin University, Tianjin 300072, China
 全文: PDF(975 KB)   HTML
摘要:

针对传统深度学习方法难以准确检测出未知类别攻击的问题,提出基于小波变换和关系嵌入的小样本物联网入侵检测方法. 该方法利用小波变换来增强主干网络对全局信息的捕捉能力,使用基于关系嵌入的小样本算法计算样本的关系向量,通过余弦相似度函数进行分类. 在公开数据集CICIOT2023和BotIoT上验证了所提方法对未知类别攻击检测的能力. 在5-way 5-shot设置下的检测准确率分别是93.5%和99.3%,在5-way 10-shot设置下的检测准确率分别是93.12%和99.33%.

关键词: 小样本小波变换关系嵌入入侵检测物联网(IoT)    
Abstract:

A few-shot IoT intrusion detection method combining wavelet transform with relational embedding was proposed in order to address the challenge of accurately detecting unknown attack categories in traditional deep learning approaches. Wavelet transform was utilized to enhance the backbone network’s ability to capture global information. A relational embedding-based few-shot algorithm was employed to calculate sample relation vectors. Classification was performed through cosine similarity functions. Experimental validation was conducted on public dataset CICIOT2023 and BotIoT to demonstrate the capability of method in detecting unknown attack categories. Detection accuracies of 93.5% and 99.3% were achieved under 5-way 5-shot settings, while 93.12% and 99.33% accuracies were obtained in 5-way 10-shot configurations.

Key words: few-shot    wavelet transform    relational embedding    intrusion detection    Internet of Thing (IoT)
收稿日期: 2025-03-14 出版日期: 2026-02-04
:  TP 393  
基金资助: 国家自然科学基金资助项目(62302197);浙江省自然科学基金资助项目(LQ23F020006);嘉兴市科技计划资助项目(2024AY40010);中国博士后科学基金资助项目(2024M752366).
通讯作者: 邓琨     E-mail: lzs1902@163.com;dengkun@hrbeu.edu.cn
作者简介: 李智慧(2002—),男,硕士生,从事小样本物联网入侵检测研究. orcid.org/0009-0007-4494-2111. E-mail:lzs1902@163.com
服务  
把本文推荐给朋友
加入引用管理器
E-mail Alert
作者相关文章  
李智慧
邓琨
许聪源

引用本文:

李智慧,邓琨,许聪源. 基于关系嵌入的物联网未知攻击检测方法[J]. 浙江大学学报(工学版), 2026, 60(3): 624-632.

Zhihui LI,Kun DENG,Congyuan XU. Method for detecting unknown IoT attack based on relational embedding. Journal of ZheJiang University (Engineering Science), 2026, 60(3): 624-632.

链接本文:

https://www.zjujournals.com/eng/CN/10.3785/j.issn.1008-973X.2026.03.018        https://www.zjujournals.com/eng/CN/Y2026/V60/I3/624

图 1  关系嵌入方法的总体框图
图 2  WTRN 的结构图
图 3  残差块的结构图
图 4  WTConv的结构图
算法1 训练关系嵌入分类器
输入:任务$ T $
1 $ \theta \leftarrow $随机初始化
2 for t in {$ {T}_{1},\cdots ,{T}_{i} $} do
3  计算样本基本表示$ {{\boldsymbol{Z}}}_{{\boldsymbol{s}}} $$ {{\boldsymbol{Z}}}_{{\boldsymbol{q}}} $
4  通过$ \boldsymbol{F}=g\left(\boldsymbol{B}\right)+\boldsymbol{Z} $计算自相关表示$ {{\boldsymbol{F}}}_{{\boldsymbol{s}}} $$ {{\boldsymbol{F}}}_{{\boldsymbol{q}}} $
5  计算互相关张量$ {{\boldsymbol{A}}}_{{\boldsymbol{s}}} $$ {{\boldsymbol{A}}}_{{\boldsymbol{q}}} $
6  通过$ {{\boldsymbol{A}}}_{{\boldsymbol{s}}}、{{\boldsymbol{F}}}_{{\boldsymbol{s}}} $$ {{\boldsymbol{A}}}_{{\boldsymbol{q}}}、{{\boldsymbol{F}}}_{{\boldsymbol{q}}} $计算最终嵌入sq
7  通过L$ ={L}_{\mathrm{a}\mathrm{n}\mathrm{c}\mathrm{h}\mathrm{o}\mathrm{r}}+\lambda {L}_{\mathrm{m}\mathrm{e}\mathrm{t}\mathrm{r}\mathrm{i}\mathrm{c}} $计算损失函数
8  通过$ \nabla L $更新$ \theta $
9 end for
  
图 5  自相关模块和互相关模块的结构图
图 6  在CICIOT2023数据集上对未知攻击的检测结果
图 7  在BotIoT数据集上对未知攻击的检测结果
方法实验设置Ac/%
DNNN/A14.24
CNNN/A15.09
Swin_transformer5-way 5-shot91.13
Swin_transformer5-way 10-shot91.96
原型网络5-way 5-shot92.58
原型网络5-way 10-shot92.52
本文方法5-way 5-shot93.50
本文方法5-way 10-shot93.12
表 1  在CICIOT2023数据集上与深度学习方法对比的结果
数据集方法实验设置Ac /%
CICIOT2023Baseline5-way 5-shot91.82
Baseline5-way 10-shot92.62
+ WTConv5-way 5-shot93.50
+ WTConv5-way 10-shot93.12
BotIoTBaseline5-way 5-shot98.56
Baseline5-way 10-shot98.73
+ WTConv5-way 5-shot99.30
+ WTConv5-way 10-shot99.33
表 2  所提方法的消融实验
方法数据集物联网数据集实验设置Ac/%UTRS
LNN[24]BotIoTYN/A96.150.0003
L2F+MAML[9]CICIDS2017N2-way 10-shot94.6610.00
MAML+CNN[8]FSIDSIOTY5-way 5-shot89.6428.91
MAML+CNN[8]FSIDSIOTY5-way 10-shot92.1918.16
IPN-IDS[23]CICIDS2017N5-way 5-shot84.9425.57
IPN-IDS [23]CICIDS2017N5-way 10-shot86.3515.21
CIDIOT[25]CICIOT2023YN/A77.200.017
本文方法CICIDS2017N5-way 5-shot98.8231.41
本文方法CICIDS2017N5-way 10-shot98.8919.08
本文方法BotIoTY5-way 5-shot99.3034.89
本文方法BotIoTY5-way 10-shot99.3322.49
本文方法CICIOT2023Y5-way 5-shot93.5029.91
本文方法CICIOT2023Y5-way 10-shot93.1218.16
表 3  提出方法和相关研究工作的比较
图 8  样本数对模型检测准确率和UTRS的影响
1 DAI B, WANG Y, YE C, et al A novel method for extracting time series information of deformation area of a single landslide based on improved U-Net neural network[J]. Frontiers in Earth Science, 2021, 9: 785476
doi: 10.3389/feart.2021.785476
2 CHEN D, ZHANG F, ZHANG X Heterogeneous IoT intrusion detection based on fusion word embedding deep transfer learning[J]. IEEE Transactions on Industrial Informatics, 2023, 19 (8): 9183- 9193
doi: 10.1109/TII.2022.3227640
3 HE M S, HUANG Y M, WANG X L, et al A lightweight and efficient IoT intrusion detection method based on feature grouping[J]. IEEE Internet of Things Journal, 2024, 11 (2): 2935- 2949
doi: 10.1109/JIOT.2023.3294259
4 FINN C, ABBEEL P, LEVINE S. Model-agnostic meta-learning for fast adaptation of deep networks [C]//Proceedings of the International Conference on Machine Learning. New York: ACM, 2017: 1126-1135.
5 ZHUANG F, QI Z, DUAN K, et al A comprehensive survey on transfer learning[J]. Proceedings of the IEEE, 2021, 109 (1): 43- 76
doi: 10.1109/JPROC.2020.3004555
6 WANG Y, XU C, LIU C, et al. Instance credibility inference for few-shot learning [C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Seattle: IEEE, 2020: 12833–12842.
7 ZHAO L, LU J, XU Y, et al. Few-shot class-incremental learning via class-aware bilateral distillation [C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Vancouver: IEEE, 2023: 11838–11847.
8 LU C M, WANG X F, YANG A M, et al A few-shot-based model-agnostic meta-learning for intrusion detection in security of Internet of Things[J]. IEEE Internet of Things Journal, 2023, 10 (24): 21309- 21321
doi: 10.1109/JIOT.2023.3283408
9 SHI Z X, XING M Y, ZHANG J, et al. Few-shot network intrusion detection based on model-agnostic meta-learning with L2F method [C]//Proceedings of the IEEE Wireless Communications and Networking Conference. Glasgow: IEEE, 2023: 1–6.
10 YAN Y, YANG Y, GU Y, et al. A few-shot intrusion detection model for the Internet of Things [C]//Proceedings of the 3rd International Conference on Electronic Information Engineering and Computer Science. Changchun: IEEE, 2024: 531–537.
11 DU L, GU Z Q, WANG Y, et al A few-shot class-incremental learning method for network intrusion detection[J]. IEEE Transactions on Network and Service Management, 2024, 21 (2): 2389- 2401
doi: 10.1109/TNSM.2023.3332284
12 DI MONDA D, MONTIERI A, PERSICO V, et al Few-shot class-incremental learning for network intrusion detection systems[J]. IEEE Open Journal of the Communications Society, 2024, 5: 6736- 6757
doi: 10.1109/OJCOMS.2024.3481895
13 FINDER S E, AMOYAL R, TREISTER E, et al. Wavelet convolutions for large receptive fields [C]// Proceedings of the European Conference on Computer Vision. Madrid: Springer, 2024: 363–380.
14 KANG D, KWON H, MIN J, et al. Relational embedding for few-shot classification [C]//Proceedings of the IEEE/CVF International Conference on Computer Vision. Montreal: IEEE, 2021: 8802–8813.
15 HE K, ZHANG X, REN S, et al. Deep residual learning for image recognition [C]//Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. Las Vegas: IEEE, 2016: 770–778.
16 XU C, SHEN J, DU X A method of few-shot network intrusion detection based on meta-learning framework[J]. IEEE Transactions on Information Forensics and Security, 2020, 15: 3540- 3552
doi: 10.1109/TIFS.2020.2991876
17 YANG J C, LI H W, SHAO S, et al FS-IDS: a framework for intrusion detection based on few-shot learning[J]. Computers and Security, 2022, 122: 102899
doi: 10.1016/j.cose.2022.102899
18 SNELL J, SWERSKY K, ZEMEL R S. Prototypical networks for few-shot learning [C]//Proceedings of the Neural Information Processing Systems. Long Beach: [s. n. ], 2017: 4080-4090.
19 SIMON C, KONIUSZ P, NOCK R, et al. Adaptive subspaces for few-shot learning [C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. Seattle: IEEE, 2020: 4135–4144.
20 NETO E C P, DADKHAH S, FERREIRA R, et al CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment[J]. Sensors, 2023, 23 (13): 5941
doi: 10.3390/s23135941
21 KORONIOTIS N, MOUSTAFA N, SITNIKOVA E, et al Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: bot-IoT dataset[J]. Future Generation Computer Systems, 2019, 100: 779- 796
doi: 10.1016/j.future.2019.05.041
22 DRAPER-GIL G, LASHKARI A H, MAMUN M S I, et al. Characterization of encrypted and VPN traffic using time-related features [C]//Proceedings of the 2nd International Conference on Information Systems Security and Privacy. Portugal: SciTEPress, 2016: 407-414.
23 WANG Y, ZHANG Z, ZHAO K, et al A few-shot learning based method for industrial Internet intrusion detection[J]. International Journal of Information Security, 2024, 23 (5): 3241- 3252
doi: 10.1007/s10207-024-00889-x
24 ZHAO R J, GUI G, XUE Z, et al A novel intrusion detection method based on lightweight neural network for internet of things[J]. IEEE Internet of Things Journal, 2021, 9 (12): 9960- 9972
[1] 段继忠,李海源. 基于变分模型和Transformer的多尺度并行磁共振成像重建[J]. 浙江大学学报(工学版), 2025, 59(9): 1826-1837.
[2] 侯越,王甜甜,张鑫,尹杰. 多分辨率趋势周期解耦交互的交通流预测[J]. 浙江大学学报(工学版), 2025, 59(7): 1362-1372.
[3] 王立红,刘新倩,李静,冯志全. 基于联邦学习和时空特征融合的网络入侵检测方法[J]. 浙江大学学报(工学版), 2025, 59(6): 1201-1210.
[4] 蒋沁诚,陶建峰,王洋洋,张宇磊,刘成良. 基于EWT-LSTM的工业机器人关节异常检测[J]. 浙江大学学报(工学版), 2025, 59(5): 982-994.
[5] 杨燕,贾存鹏. 代理注意力下域特征交互的高效图像去雾算法[J]. 浙江大学学报(工学版), 2025, 59(12): 2527-2538.
[6] 王艳芳,王伟,董云泉. 面向实时决策的物联网时效与失真性能研究[J]. 浙江大学学报(工学版), 2024, 58(4): 664-673.
[7] 朱炳洋,吴建锋,王柯,王章权,刘半藤. 基于单通道ECG信号与INFO-ABCLogitBoost模型的睡眠分期[J]. 浙江大学学报(工学版), 2024, 58(12): 2547-2555.
[8] 张灵维,周正东,许云飞,王嘉文,吉文韬,宋泽峰. 基于特征融合的语言想象脑电信号分类[J]. 浙江大学学报(工学版), 2023, 57(4): 726-734.
[9] 成宏达,骆海明,夏庆超,杨灿军. 基于改进γ-CLAHE算法的水下机器人图像识别[J]. 浙江大学学报(工学版), 2022, 56(8): 1648-1655.
[10] 温竹鹏,陈捷,刘连华,焦玲玲. 基于小波变换和优化CNN的风电齿轮箱故障诊断[J]. 浙江大学学报(工学版), 2022, 56(6): 1212-1219.
[11] 温佩芝,陈君谋,肖雁南,温雅媛,黄文明. 基于生成式对抗网络和多级小波包卷积网络的水下图像增强算法[J]. 浙江大学学报(工学版), 2022, 56(2): 213-224.
[12] 费云,蒙涛,金仲和. 皮纳卫星姿控系统分层式故障检测[J]. 浙江大学学报(工学版), 2020, 54(4): 824-832.
[13] 张承志, 冯华君, 徐之海, 李奇, 陈跃庭. 图像噪声方差分段估计法[J]. 浙江大学学报(工学版), 2018, 52(9): 1804-1810.
[14] 陈学军, 杨永明. 采用经验小波变换的风力发电机振动信号消噪[J]. 浙江大学学报(工学版), 2018, 52(5): 988-995.
[15] 项贻强, 郏亚坤. 基于小波总能量相对变化的拱桥吊杆损伤识别[J]. 浙江大学学报(工学版), 2017, 51(5): 870-878.