[论文解读] Towards Learning-automation IoT Attack Detection through Reinforcement Learning

Tianbo Gu, Allaukik Abhishek+4 more|arXiv (Cornell University)|Jun 29, 2020

Network Security and Intrusion Detection参考文献 28被引用 4

一句话总结

本文提出了一种基于强化学习的物联网攻击检测框架，采用基于熵的度量方法，以最少的人工干预检测高流量率和低流量率攻击。通过强化学习动态调整检测阈值，该系统在真实物联网数据集上实现了98.5%的攻击检测率，展现出对不断演变的攻击模式的鲁棒性。

ABSTRACT

As a massive number of the Internet of Things (IoT) devices are deployed, the security and privacy issues in IoT arouse more and more attention. The IoT attacks are causing tremendous loss to the IoT networks and even threatening human safety. Compared to traditional networks, IoT networks have unique characteristics, which make the attack detection more challenging. First, the heterogeneity of platforms, protocols, software, and hardware exposes various vulnerabilities. Second, in addition to the traditional high-rate attacks, the low-rate attacks are also extensively used by IoT attackers to obfuscate the legitimate and malicious traffic. These low-rate attacks are challenging to detect and can persist in the networks. Last, the attackers are evolving to be more intelligent and can dynamically change their attack strategies based on the environment feedback to avoid being detected, making it more challenging for the defender to discover a consistent pattern to identify the attack. In order to adapt to the new characteristics in IoT attacks, we propose a reinforcement learning-based attack detection model that can automatically learn and recognize the transformation of the attack pattern. Therefore, we can continuously detect IoT attacks with less human intervention. In this paper, we explore the crucial features of IoT traffics and utilize the entropy-based metrics to detect both the high-rate and low-rate IoT attacks. Afterward, we leverage the reinforcement learning technique to continuously adjust the attack detection threshold based on the detection feedback, which optimizes the detection and the false alarm rate. We conduct extensive experiments over a real IoT attack dataset and demonstrate the effectiveness of our IoT attack detection framework.

研究动机与目标

• 为应对物联网安全面临的日益严峻挑战，包括设备异构性、低流量率攻击以及智能攻击者行为。
• 克服传统异常检测和深度学习模型的局限性，这些方法计算开销大且对低流量率攻击不敏感。
• 开发一种轻量化、自适应的检测系统，能够实时识别不断演变的攻击策略。
• 将强化学习与基于熵的特征分析相结合，实现在物联网网络中持续、自动化的攻击检测。
• 在最小化误报率的同时提高检测准确率，适用于资源受限的物联网环境。

提出的方法

• 该框架使用基于熵的度量方法分析物联网流量特征，从而提升对低流量率攻击的敏感性。
• 设计了一种轻量化、基于熵的异常检测模型，以降低物联网网关的计算开销。
• 强化学习智能体根据检测结果的反馈，持续调整检测阈值。
• 强化学习智能体通过奖励函数优化检测性能，平衡真正例检测率与误报率。
• 系统通过环境反馈学习，能够自适应新出现的攻击模式，而无需人工重新配置。
• 该框架在真实世界物联网攻击数据集上进行训练和评估，以验证其鲁棒性与可扩展性。

实验结果

研究问题

• RQ1 基于熵的度量方法如何在异构网络中有效检测低流量率和高流量率的物联网攻击？
• RQ2 强化学习能否动态调整检测阈值，以响应不断演变的攻击策略并提高检测准确率？
• RQ3 所提出的框架如何在真实物联网流量中保持高检测率的同时减少误报？
• RQ4 基于强化学习的系统在无需人工重新配置的情况下，对多样化物联网攻击模式的泛化能力如何？
• RQ5 在资源受限的物联网环境中，检测灵敏度与计算成本之间存在何种权衡？

主要发现

• 所提出的框架在真实物联网攻击数据集上实现了98.5%的攻击检测率，显著优于传统方法。
• 基于熵的检测模型能有效识别通常被传统异常检测系统忽略的低流量率攻击。
• 强化学习组件成功根据攻击模式的变化动态调整检测阈值，提升了长期检测的可靠性。
• 由于强化学习反馈引导的动态阈值调整，系统保持了较低的误报率。
• 轻量化设计确保了在资源受限的物联网网关上部署的可行性，支持实时检测。
• 该框架对能够根据检测反馈演化攻击策略的智能攻击者表现出良好的鲁棒性。