【作者】 蒋超；

【导师】 邝坚；

【作者基本信息】 北京邮电大学 ， 软件工程， 2020， 硕士

【摘要】 由于物联网(Internetof Things,IoT)设备的异质性和日益增多的数量,传统的终端与网络安全方案不能完全满足物联网系统安全的需要。在大多数情况下,制造商不能定期提供防火墙更新和安全补丁,且在物联网设备上的有限资源下,开发有效的终端安全解决方案十分困难。与此同时,在家庭物联网环境(以下简称智能家居)下使用传统的云计算服务存在实时性不够、带宽不足,不利于保护数据安全和隐私的局限性。通常攻击者通过网络入侵对目标智能家居设备进行漏洞测试,从而窃取用户隐私数据,扰乱甚至破坏智能家居网络系统的正常运转等。本文分析归纳了家庭物联网安全的研究现状,并对近年来出现的新型物联网安全机制及网络入侵检测算法进行了分析和说明,重点关注了基于机器学习的网络入侵检测方案,选择使用模糊C均值(fuzzy C-mean,FCM)作为入侵检测的聚类模型。在此基础上,本文研究并提出了一种基于统计的增量式网络流量特征抽取策略,并根据此对各个流量特征展开分析研究,进而进行特征裁剪,使特征向量在简洁的前提下尽可能地代表真实网络行为,有效提高了入侵检测的准确率和性能。为进行实际测试,本文实现了一个实时检测网络入侵的边缘网络防护系统。系统使用树莓派作为实验环境,在其上部署边缘智能网关,作为边缘计算节点,运行软件定义网络(Software Defined Network,SDN)控制器和OpenvSwitch(OVS)虚拟交换机,实现对局域网中的流量进行监测,分析和过滤的目的。利用边缘网关上的计算资源,使用轻量级的机器学习聚类模型对物联网设备之间、设备与公共网络之间网络传输进行分类,检测是否存在网络入侵行为。聚类模型分析了局域网中的流量特征,区分其中的异常流量与正常流量。仿真结果表明,该系统对于常见的物联网网络入侵行为具有较高的入侵识别率(≈95.2%),可有效保证家庭物联网设备之间交互的安全性,并且对于网络性能的影响在可接受的范围内,具备一定的实用性。更多还原

【Abstract】 Due to the heterogeneity and increasing number of IoT devices,traditional terminal and network security solutions cannot guarantee system security.In the majority of cases,manufacturers can not provide firewall updates and security patches on a regular basis,and it is very difficult to develop effective terminal security solutions with limited resources on IOT devices.At the same time,traditional cloud computing services in the home Internet of things environment has the limitations of insufficient real-time and bandwidth,which is not conducive to the protection of data security and privacy.Usually,hackers conduct vulnerability tests on target smart home devices through network intrusion,thereby stealing user’s privacy data,or even disrupting the normal operation of smart home network systems.This article summarizes the current research status of home IoT security,analyzes and explains the new IoT security mechanisms and intrusion detection algorithms that have appeared in recent years.It focuses on network intrusion detection schemes based on machine learning,and chooses to use fuzzy C-mean(FCM)as a classification model for intrusion detection.On this basis,this paper proposes an incremental network traffic feature extraction strategy based on the statistics of the number of connections.Further more,each traffic feature is analyzed and researched,and feature clipping is performed to make the feature vector as simple as possible on the premise of simplicity to represent the real network behavior,which effectively improves the accuracy and performance of intrusion detection.For practical testing,this paper implements an edge network protection system that detects network intrusions in real time.The system uses Raspberry Pi as the experimental environment,and an edge intelligent gateway is deployed on it to run the SDN controller and Open vSwitch(OVS)virtual switch to achieve the purpose of monitoring,analyzing and filtering the traffic in the network.Utilize the computing resources on the edge gateway and use lightweight machine learning clustering model to classify the network transmission between IoT devices,devices and public networks,and detect whether there is network intrusion.The clustering model extracts the features of network traffic and distinguishes malignant traffic from benign traffic in the network.Simulation results show that the system has a high intrusion recognition rate(≈95.2%)for common IoT network intrusion behaviors,which can effectively ensure the security of interaction between home IoT devices,and the impact on network performance is acceptable within the range,which means it has practicality.更多还原