Situation prediction of large-scale Internet of Things network security

Abstract

The Internet of Things (IoT) is a new technology rapidly developed in various fields in recent years. With the continuous application of the IoT technology in production and life, the network security problem of IoT is increasingly prominent. In order to meet the challenges brought by the development of IoT technology, this paper focuses on network security situational awareness. The network security situation awareness is basic of IoT network security. Situation prediction of network security is a kind of time series forecasting problem in essence. So it is necessary to construct a modification function that is suitable for time series data to revise the kernel function of traditional support vector machine (SVM). An improved network security situation awareness model for IoT is proposed in this paper. The sequence kernel support vector machine is obtained and the particle swarm optimization (PSO) method is used to optimize related parameters. It proves that the method is feasible by collecting the boundary data of a university campus IoT network. Finally, a comparison with the PSO-SVM is made to prove the effectiveness of this method in improving the accuracy of network security situation prediction of IoT. The experimental results show that PSO-time series kernel support vector machine is better than the PSO-Gauss kernel support vector machine in network security situation prediction. The application of the Hadoop platform also enhances the efficiency of data processing.

1 Introduction

With the popularity of the Internet of Things and the rapid development of cloud computing, security issues become increasingly prominent. Security vulnerabilities and security incidents are increasing notably. Network security incidents have occurred occasionally such as network worms, hackers dragging databases, 0-day exposure, and privacy data leakage. Network security is becoming the focus of many nations, enterprises, and individuals. China set up the Central Internet Security and Informatization Leading Group in February 2014, which indicated that the government had put network security on the national strategic position [1].

The Internet of Things (IoT) is a new technology rapidly developed in recent years. With the development of communication technology, IoT devices have made good development in smart cities, wireless sensing, cloud computing, and many other fields. However, with the popularity of Internet of Things devices, security and privacy issues have become increasingly prominent [2,3,4,5,6]. Due to increasingly serious problems of IoT network security, network security situation awareness of IoT comes into being and gradually becomes the focus of the network security field. By assessing the operating status of the network in real-time and promptly predicting the problems before the security incidents occur, the network security situation awareness can help the administrators make the right decisions [7].

Utilizing the characteristic of situational factors that are randomness, time-sequence, and complexity, an improved network security situation awareness model for IoT is proposed in this paper. Considering the close relationship between the network security situation and time, we agree that situation prediction of network security is a kind of time series forecasting problem in essence [8]. A modification function is constructed that is suitable for time series data to revise the kernel function of traditional support vector machine. The sequence kernel support vector machine is obtained and the particle swarm optimization method is used to optimize related parameters. It proves that the method is feasible by collecting the boundary data of a university campus network. Finally, a comparison with the PSO-SVM is made to prove the effectiveness of this method in improving the accuracy of network security situation prediction.

The main contributions of our work are listed as follows:

• 1) We propose an improved network security situation awareness model for IoT based on PSO-time series kernel support vector machine.

• 2) We employ a sequence kernel support vector machine and the particle swarm optimization to optimize related parameters, improving the accuracy of network security situation prediction.

• 3) The experimental results show that PSO-time series kernel support vector machine is greatly effective.

1.1 Roadmap

The rest of this paper is organized as follows. First, we survey related work in Section 2. Then, we introduce the design of network security situation prediction of IoT in Section 3. We describe the system implementation and report evaluation results in Section 4. Finally, we conclude our work in Section 5.

2 Related work

The concept of situational awareness originated from the military field which requires an understanding of the strengths and weaknesses of the enemy in order to make the right decisions on the battlefield. In 1988, Endsley [9] gave the definition of situational awareness for the first time, which was the perception of environmental elements with respect to time and/or space, the comprehension of their meaning, and the projection of their status after some variables had changed. In 1999, Bass [10] first proposed the concept of Cyberspace Situation Awareness, which aimed at using the SA for the network management and network security to improve the cognitive ability of administrators to shorten the decision time.

There were many groundbreaking researches in the field of network security situation awareness [11]. After analyzing the concept of network situational awareness, Bass [12] proposed a framework for network security situation based on multi-sensor data fusion technology. By reasoning to identify the intruders’ identity and locate intrusion goals, it was a good way to assess the security status of the network.

A prediction method combined with the quantitative and qualitative of network security situation based on the cloud was proposed by Lei Xuan [13]. The future situation was predicted by combining the current trend with the prediction rules mining from history evolvement data.

After the assessment of current network security situation, You and Ren [14, 15] proposed different prediction models based on a neural network. By using the advantage of a neural network in dealing with nonlinear problems, they implement the accurate forecast of the network security situation.

A complex network-based network security situation prediction mechanism was proposed by Li [16]. Using the model of Markov, we can not only trace the dynamic behavior of the numerical fluctuations in the security situation but also predict security state effectively.

Chen [17] proposed a prediction method of network security situation based on the algorithm of IHS_LSSVR. An improved Harmony Search (IHS) algorithm is used to optimize the parameters of least squares support vector machine and then to forecast the network security status.

The related principles of the proposed method are described below.

3 Network security situation prediction of IoT

3.1 Data analysis initial normalization based on Hadoop

In the Internet of Things, the massive heterogeneous data about security contain various information. In this paper, MapReduce technology is adopted to realize data analysis and fusion processing based on attribute phase heterogeneity. The network data of IoT usually includes logs and traffic. Therefore, in the map phase, the log and the flow file are read and the packets are extracted. Converts the device address, time, and other attributes of the packet to the key-value pair of MapReduce processing for <key,value> format, the process is Map<key1,value1 > →list<key2,value2>. Key1 represents the number of the data line. Value1 represents the content of each row of packets. The packet contains complete data content. Key2 is a collection of important attributes needed. Value2 is the remaining property in the packet. Because both key2 and value2 have multiple attributes. We use # to separate properties when implemented. In case of subsequent data parsing errors, the processed property item becomes like a list<string1,string2 > string. In the Reduce stage, the Hadoop platform was used to pre-process the string, and the record of the upcoming string was merged to realize Reduce<key2,value2 > →list<key3,value3>. Extract all administrative configuration and system run class logs from the log file. The log (the event_type, priority, the user, sourceIP, operation, the time, the result) of the same is aggregated into a log record. At the same time, increase the count origID and attribute, the count records including log which is composed of several raw log, logID origID record raw logs, and semicolons to separate the Map Reduce input and output of the details in Table 1, as shown in Table 2

Table 1 Manages the Map phase input output for the configuration class log

Table 2 Manage the Reduce phase input output for the configuration class log

Firewall logs can reflect network traffic, and the log aggregation of traffic abnormal classes is mainly extracted from the firewall logs and related to connection classes. Similar configuration to polymerization with the management, traffic exception class log aggregation also need to increase the count origID and attribute, the role of the same, and Map Reduce the input and output of the details such as Table 3, shown in Table 4.

Table 3 The MAP phase input and output of the traffic exception class log

Table 4 The Reduce phase input and output of the traffic exception class log

Network attack is usually in a variety of network security equipment in the log traces of attack [18], according to the above design, log aggregation rules and attribute characteristics to aggregation of attack mode, increase the count, origID, and mode three attributes. Graphs of input and output details are shown in Table 5 and 6.

Table 5 The Map phase input and output of the attack class event log

Table 6 The Reduce phase input and output of the attack class event log

Through clustering algorithm, this node initializes the firewall and IDS logs through Hadoop and builds a comprehensive and accurate data source for the subsequent chapters of this article, based on the prediction of log files.

3.2 Situation prediction model based on sequence kernel support vector machine

On the basis of different levels, different information sources, and different needs, this paper proposed a network security situation prediction model based on sequence kernel support vector machine as shown in Fig. 1.

Fig. 1

Network security situation prediction model based on sequence kernel support vector machine

In the model, the whole situation of the network is divided into four first-class indicator situations: threat situation, fragile situation, stable situation and disaster situation [19]. Each first-class indicator situation is described by several secondary indicators. We use the T-S fuzzy neural network (FNN [20]) method, which makes secondary indicators as input and first-class indicator situation as output to get the threat situation, fragile situation, stable situation, and disaster situation, respectively. Finally, the analytic hierarchy process (AHP) is used to decide the relative weight of each first-class indicator situation, thus the whole situation of the network is obtained [21].

Finally, the PSO-sequence kernel support vector machine is used to deal with the value of the whole situation; thus, we get the prediction results of the future state of the network. Situation prediction of network security can help network administrators have a good understanding of network status. For network attacks, administrators can release network security warning timely.

3.3 Support vector machine

Support vector machine (SVM) is a general and effective machine learning method based on statistical learning theory [22]. It has many obvious advantages in the study of complex nonlinear prediction. The regression function of network security situation prediction based on support vector machine is as follows:

Set up network security situational training sample is {x_i, y_i}, i = 1, 2, …n, Where x_i and y_i represent input vectors and output values. n is the training sample number. The prediction idea of SVM is to find a nonlinear mapping from input to output and to map data into high dimensional feature space. In this feature space, the training samples are predicted by prediction equation f(x).

f(x)is defined as follows:

$$ f(x)=w\times \varphi (x)+b,\varphi :{R}^n\to G,w\in G $$

(1)

Where w is the weight vector and b is the bias vector.

SVM solves the optimization problem as follows:

$$ \min J=\frac{1}{2}{\left\Vert w\right\Vert}^2+C\sum \limits_{i=1}^n\left(\xi +{\xi}^{\ast}\right) $$

(2)

Constraint conditions are as follows:

$$ \left\{\begin{array}{c}{y}_i-w\cdotp {x}_i-b\le \varepsilon +{\xi}_i\\ {}\mathrm{w}\cdotp {\mathrm{x}}_{\mathrm{i}}+\mathrm{b}-{y}_i\le \upvarepsilon +{\xi}_i^{\ast}\\ {}{\xi}_i\ge 0,{\xi}_i^{\ast}\ge 0\end{array}\right. $$

(3)

where C is the penalty parameter, ξ_i and ${\xi}_i^{\ast }$ are slack variables, ε is insensitive loss function.

ε is defined as follows:

$$ {L}_{\varepsilon}\left(f{(x)}_i,{y}_i\right)=\left\{\begin{array}{c}\left|f\left({x}_i\right)-{y}_i\right|-\varepsilon, \left|f\left({x}_i\right)-{y}_i\right|>\varepsilon \\ {}\ 0,\kern0.75em \mathrm{otherwise}\end{array}\right. $$

(4)

By introducing Lagrange multipliers, the nonlinear prediction problem is transformed into the optimization problem as follows:

$$ L=\frac{1}{2}{\omega}^T\omega +c\sum \limits_{i=1}^k\left({\upzeta}_i+{\upzeta}_i^{\ast}\right)-\sum \limits_{i=1}^k{a}_i\left({\upzeta}_i+\varepsilon -{y}_i+f\left({x}_i\right)\right)-\sum \limits_{i=1}^k{a}_i\left({\upzeta}_i^{\ast }+\varepsilon -{y}_i+f\left({x}_i\right)\right)-\sum \limits_{i=1}^k\left({\eta}_i{\upzeta}_i+{\eta}_i^{\ast }{\varepsilon}_i^{\ast}\right) $$

(5)

Where a_i and ${\alpha}_i^{\ast }$are Lagrange multipliers.

According to the KKT condition, the support vector machine prediction problem can be solved by solving the dual problem in formula (2), that is

$$ f(x)={\sum}_{i=1}^n\left({\alpha}_i-{\alpha}_i^{\ast}\right)\ k\left(x,{x}_i\right)+b $$

(6)

Constraint conditions are as follows:

$$ \left\{\begin{array}{c}{\partial}_bL=0\Rightarrow {\sum}_{\mathrm{i}=1}^l\left({\alpha}_i-{\alpha}_i^{\ast}\right)=0\\ {}0\le {\alpha}_i,{\alpha}_i^{\ast }<c,\mathrm{i}=1,2,\cdots, l\\ {}{\partial}_{\omega }L=0\Rightarrow \omega ={\sum}_{i=1}^l\left({\alpha}_i-{\alpha}_i^{\ast}\right)\Phi \left({x}_i\right)\end{array}\right. $$

(7)

where k(x, x_i) is the kernel function of the support vector machine, describing the inner product of the high dimensional feature space.

As the Gauss kernel function is better than other kernel functions, this paper uses the Gauss kernel function as the kernel function of support vector machine. Gauss kernel function is defined as follows:

$$ k\left(x,{x}_i\right)=\exp \left(\frac{{\left\Vert x-{x}_i\right\Vert}^2}{\upsigma^2}\right) $$

(8)

Bringing Eq. (8) into Eq. (6), the final expression of the SVM prediction model is as follows:

$$ f(x)={\sum}_{i=1}^n\left({\alpha}_i-{\alpha}_i^{\ast}\right)\exp \left(\frac{{\left\Vert x-{x}_i\right\Vert}^2}{\upsigma^2}\right)+b $$

(9)

where σ is the width of the Gauss kernel function.

3.4 Support vector machine based on time sequence kernel

Network security situation prediction is closely related to time. But the Gauss kernel function cannot reflect the time correlation. By fusing the Gauss kernel function with temporal correlation, we can improve the traditional support vector machine.

In order to fuse the Gauss kernel function with temporal correlation, the definition of the window, modified kernel function, and time sequence kernel function is given.

Definition 1

The input space is divided into m sub-windows according to the time points, that is, T = {T_1,T_2,…, T_m − 1,T_m,}. The definition of the window function is as follows:

$$ {\mathrm{g}}_{T_s}(x)=\left\{\begin{array}{c}{\omega}_{is}\kern0.5em ,\kern1em x\in {T}_s\\ {}{\omega}_{is}^{\ast}\kern0.5em ,\kern1em \mathrm{otherwise}\end{array}\right. $$

(10)

where, m is the number of sub-windows, which is related to time characteristics of the learning task. ω_is and ${\omega}_{is}^{\ast }$ are weight parameters, which represent the time correlation between two points to be predicted in the data set. If the two points to be predicted are close to each other in time characteristics (for example less than the threshold θ, they belong to the same sub-window and the kernel function has a larger weight. The values of ω_is and ${\omega}_{is}^{\ast }$ are related to the level of the window and the radius of the window. In general, in the same sub-window, ω_is should be greater than ${\omega}_{is}^{\ast }$.

Definition 2

By modifying Gauss kernel function with a window function, we get the modified kernel function.

$$ {F}_{T_s}(x)=f(x)\ {\mathrm{g}}_{T_s}(x) $$

(11)

where f(x)is the Gauss kernel function.

The modified kernel function judges if the two points to be predicted are in the same window by a window function. Then, we get the modified value and function.

Definition 3

The time sequence kernel function can be defined after the window function and modified kernel function. The time sequence kernel function is as follows:

$$ {F}^T(x)={\sum}_{i=1}^L{F}_{T_s}(x) $$

(12)

where L is the level of the window.

The choice of the number of window layer and the radius of the sub-window should improve the support vector machine prediction ability greatly.

3.5 Parameters optimization of support vector machine

The network security situation prediction model based on SVM is sensitive to the parameters. The accuracy of SVM prediction is determined by the choice of parameters. The parameters affecting the accuracy of SVM prediction include the penalty factor C, the width of the kernel function σ and the insensitive loss function ε. The value of C is too large or too small will produce the phenomenon of over learning or less learning. σ is used to control the complexity of the optimal solution of the nonlinear problem in SVM. The value of σis too large or too small will reduce the generalization ability of SVM. ε is the expectation of error in training. It determines the number of support vectors and the computational complexity of SVM. Therefore, the particle swarm optimization algorithm is used to optimize the three parameters in this paper. Particle swarm optimization algorithm is an optimization algorithm based on swarm intelligence. It uses a particle which has no quality and no volume as an individual and provides simple action rules for each particle. Thus the whole particle swarm exhibits complex characteristics. Finally, the optimal solution is found through the collaboration between individuals. In this paper, the particle swarm optimization algorithm is used to optimize the three parameters of SVM. We construct a three-dimensional solution space. c, σ, and ε are respectively represented as one-dimensional of three-dimensional space. The specific working process of the particle swarm algorithm is as follows. Setting fitness function is F. F is defined as the average error of the forecast data. Randomly construct the initial population which consists of i particles. Give all particles initial position ${W}_i^1$and initial speed ${V}_i^1$. According to the formula (13) and (14), the optimal solution could be found.

$$ {\displaystyle \begin{array}{c}{V}_i^{\left(k+1\right)}={\omega}_i{V}_i^k+{c}_1{\gamma}_1\left({p}_{best}-{W}_i^k\right)\\ {}+{c}_2{\gamma}_2\left({g}_{best}-{W}_i^k\right)\end{array}} $$

(13)

$$ {W}_i^{\left(k+1\right)}={W}_i^k+{V}_i^{\left(k+1\right)} $$

(14)

p_best is the optimal position of the particle, g_best is the optimal position of population, k is iteration, c₁andc₂ are learning factors, ω is inertia weight, γ₁and γ₂ are the random numbers between 0 and 1.

3.6 Network security situation prediction process based on PSO-time sequence kernel function support vector machine

The network security situation prediction process based on PSO-time sequence kernel function support vector machine is shown in Fig. 2.

Fig. 2

The network security situation prediction process based on PSO-time sequence kernel function support vector machine

4 Experiment and analysis

4.1 Experimental data set

In order to verify the reasonability of the method in this paper, the related data of a campus network are collected as the experiment data. The topological structure of the campus IoT network is shown in Fig. 3. Experiment raw data are the attack information by Snort, data flow information by Netflow, vulnerability information by Nessus and asset performance information by Sigar. The rich data source provides a reliable guarantee for the simulation experiment.

Fig. 3

The topological structure of the campus IoT network

In this study, we acquired 360 data from March 1, 2015, to May 31 (90 days and 4 times daily samples) from the university as the training data. According to the steps and algorithms of 3.1, we obtained the value of the whole situation of the network. Then, the model of PSO-sequence kernel support vector machine was trained by the obtained values of the network. The 120 data which was from June 1, 2015, to June 30 (30 days and 4 times daily samples) were acquired as the test data.

4.2 Experiment and analysis of the network security situation prediction

For the prediction model of time series kernel support vector machine, the embedding dimension was set as seven by trial and error. That is using the previous week’s data to predict the network security situation in the coming day. The prediction model is the time sequence kernel support vector machine optimized by the particle swarm. The parameters of the particle swarm are shown in Table 7.

Table 7 The setting table of particle swarm parameters

4.3 The results of network security situation prediction

In order to verify the feasibility and effectiveness of PSO-time series kernel support vector machine, we compared the predictive value of PSO-time series kernel support vector machine with the actual security situation value and the predictive value of PSO-Gaussian kernel support vector machine.

4.3.1 Analysis of experimental results of network security situation prediction in a certain day

The PSO-time series kernel function support vector machine and PSO-Gauss kernel function support vector machine were used to predict the network security situation in a certain day of June. The results were shown in Fig. 4.

Fig. 4

Situation comparison of a certain day in June

The relevant parameters were as follows. c is 100, σ is 15, ε is 0.001, window radius is 30, window weight parameters were ω_1s is 1, ${\omega}_{1s}^{\ast }$ = 0.9.

In order to reflect the prediction results of the two forecasting methods in the same parameter intuitively, the partial relative errors of a certain day in June were shown in Table 8.

Table 8 Partial relative error of a certain day in June

4.3.2 Analysis of experimental results of network security situation prediction in a certain week

The PSO-time series kernel function support vector machine and PSO-Gauss kernel function support vector machine were used to predict the network security situation in a certain week of June. The results were shown in Fig. 5.

Fig. 5

Situation comparison of a certain week in June

The relevant parameters were as follows. C is 500, σ is 50, ε is 0.001, window radius were 1 and 3.

The first layer of the window weight parameters was that ω_1s is 0.6 and ${\omega}_{1s}^{\ast }$ is 0.4.

The second layer window weight parameters were as follows:

ω_2sis 0.4 and ${\omega}_{1s}^{\ast }$is 0.3.

The relative error of a certain week in June between the actual value of the network situation and the predictive value of two kinds of forecasting methods are shown in Table 9.

Table 9 Relative error of a certain week in June

The experimental results show that PSO-time series kernel support vector machine is better than the PSO-Gauss kernel support vector machine in network security situation prediction. And during the week, the network security situation value of weekend was higher than normal, so network administrators should strengthen the network protection in time.

From the above results, it is feasible to predict the network security situation based on the PSO-time series kernel function support vector machine. Compared with the PSO-Gauss kernel support vector machine, the PSO-time series kernel support vector machine has great advantages in network security situation prediction.

4.4 System time performance analysis.

Network security situational awareness system for predicting equipment log of this article is based on the Hadoop big data processing platform, in order to verify the Hadoop platform to handle large amounts of log time performance, in this article, the experiment will be treated as a traditional single log spent time comparing with Hadoop cluster processing time spent, dealt with different levels of the log data; the time it takes is shown in Table 10.

Table 10 Compare the time to log in different modes (unit: millisecond)

Table 10 shows that when the log data level is less than 50,000, the single-machine processing capability is better than the processing power of the Hadoop cluster. But as the growth of the log magnitude cluster around the time grows smaller, the rise in single machine processing time spent is almost in a straight line, and the increase in the number of nodes in the cluster processing efficiency is also higher. The efficient operation makes the log quantity of network security device more and more obvious, and the quiet of the single-machine processing mode is more and more prominent. Therefore, the design of this paper is based on the big data platform to deal with the security log system has strong practical significance.

5 Summarize

There is an in-depth study of the existed network security situation prediction achievement in this paper. For the characteristic of situational factors which are randomness, time-sequence, and complexity, we propose a network security situation prediction method based on PSO-sequence kernel support vector machine. A modification function which is suitable for time series data is constructed to revise the kernel function of traditional support vector machine. Then the sequence kernel support vector machine is obtained and the particle swarm optimization is used to optimize related parameters. By building an experimental environment and using the obtained values of the situation, it is verified that the method in this paper is feasible and effective. Simulation results show that the method in this paper has high accuracy for the prediction of the network security situation, thus it can give network administrators useful help in making timely and effective decisions. In the future development of Internet of Things technology, the network situational awareness prediction method proposed in this paper can be applied to many scenarios, such as the communication field, cloud computing field and smart city construction field. I hope the research results presented in this paper can contribute to the development of Internet of Things network security. In the next step, the focus will be on the situation visualization research of network security.