一种基于随机森林算法的MQTT异常流量检测方法

计算机与现代化 ›› 2021, Vol. 0 ›› Issue (01): 61-64.

一种基于随机森林算法的MQTT异常流量检测方法

(华北电力大学控制与计算机工程学院,北京 102206)

出版日期:2021-01-28 发布日期:2021-01-29
作者简介:吴克河(1962—),男,江苏镇江人,教授,博士,研究方向:智能电网软件技术,电力信息安全, E-mail: wkh@ncepu.edu.cn; 张英(1992—),女,安徽安庆人,硕士研究生,研究方向:网络信息安全,E-mail: 1014340780@qq.com; 崔文超(1983—),男,河南南阳人,讲师,博士,研究方向:信息安全,电力信息化,计算机视觉,E-mail: cuzz@ncepu.edu.cn; 程瑞(1989—),男,安徽安庆人,博士,研究方向:电力信息安全, E-mail: ahchengrui@126.com。
基金资助:
国家电网总部科技项目(SGGR0000XTJS1900905)

A MQTT Abnormal Traffic Detection Method Based on Random Forest Algorithm

(School of Control and Computer Engineering, North China Electric Power University, Beijing 102206, China)

Online:2021-01-28 Published:2021-01-29

摘要/Abstract

摘要： 工业物联网系统所面临的网络安全威胁随着物联网技术的广泛应用日益增加，信息安全问题已成为其发展过程中的一大挑战。MQTT（Message Queuing Telemetry Transport）协议是物联网通信的主流协议，基于该协议的物联网通信安全研究是当前研究的热点话题。传统的流量识别技术如深度包检测无法有效地识别符合包格式的异常流量，而基于机器学习理论的异常流量识别技术则表现出很好的效果。对此提出一种基于随机森林算法的MQTT异常流量检测方法，实现整体高于90%的MQTT异常流量识别准确度，与其他常用分类模型相比拥有更好的识别效果。

关键词: 异常流量检测, 随机森林, MQTT, 流量特征

Abstract: With the wide application of Internet of things technology, the industrial Internet of things system suffers from increasing network security threats, and information security becomes a major challenge in its development. The MQTT (Message Queuing Telemetry Transport) protocol is the mainstream protocol for Internet of things communication. The research on communication security of Internet of things based on the protocol is a hot topic at present. In order to ensure the communication security of restricted devices in the Internet of things, this paper focuses on the abnormal detection of MQTT traffic. Traditional traffic identification technology such as deep packet inspection cant effectively identify abnormal traffic conforming to packet format, and abnormal traffic identification technology based on machine learning theory shows very good effect. For this, a MQTT abnormal traffic detection method based on random forest algorithm is proposed, which achieves an overall accuracy of more than 90% and gets better recognition effect than other common classification models.

Key words: abnormal traffic detection, random forests, MQTT, flow features

吴克河, 张英, 崔文超, 程瑞. 一种基于随机森林算法的MQTT异常流量检测方法[J]. 计算机与现代化, 2021, 0(01): 61-64.

WU Ke-he, ZHANG Ying, CUI Wen-chao, CHENG Rui. A MQTT Abnormal Traffic Detection Method Based on Random Forest Algorithm[J]. Computer and Modernization, 2021, 0(01): 61-64.

参考文献

［1］刘克一. 物联网概念的基本定位［J］. 数字技术与应用, 2015(4):221.
［2］毕然,李小刚,姜建. 物联网安全事件案例和问题分析［J］. 电信网技术, 2014(12):10-13.
［3］ TAO L H, LIU G J, LIU W W, et al. Packet signature mining for application identification using an improved Apriori algorithm［C］// Proceedings of the 2015 IEEE International Conference on Progress in Informatics & Computing. 2015:633-637.
［4］周卫国. 工业物联网安全隐患分析与防护策略探究［J］. 电子世界, 2019(21):13-18.

［5］ TANTITHARANUKUL N, OSATHANUNKUL K, HANTRAKUL K, et al. MQTT-topics management system for sharing of open data［C］// Proceedings of the 2017 International Conference on Digital Arts, Media and Technology. 2017:62-65.

［6］ LEE S, KIM H, HONG D K, et al. Correlation analysis of MQTT loss and delay according to QoS level［C］// Proceedings of the 2013 International Conference on Information Networking. 2013:714-717.
［7］ SAHADEVAN A, MATHEW D, MOOKATHANA J, et al. An offline online strategy for IoT using MQTT［C］// Proceedings of the 2017 IEEE 4th International Conference on Cyber Security and Cloud Computing. 2017:369-373.
［8］温彬民. 一种基于自适应心跳机制的MQTT通信协议的研究与应用［D］. 广州:华南理工大学, 2015.
［9］ YOKOTANI T, SASAKI Y. Comparison with HTTP and MQTT on required network resources for IoT［C］// Proceedings of the 2016 International Conference on Control, Electronics, Renewable Energy and Communications. 2016:1-6.
［10］NAIK N. Choice of effective messaging protocols for IoT systems: MQTT, CoAP, AMQP and HTTP［C］// Proceedings of the 2017 IEEE International Systems Engineering Symposium. 2017:12-18.
［11］THOTA P, KIM Y. Implementation and comparison of M2M protocols for internet of things［C］// Proceedings of the 2016 4th Intl Conf on Applied Computing and Information Technology/3rd Intl Conf on Computational Science/Intelligence and Applied Informatics/1st Intl Conf on Big Data, Cloud Computing, Data Science & Engineering. 2016:43-48.
［12］XU Y M, MAHENDRAN V, GUO W, et al. Fairness in fog networks: Achieving fair throughput performance in MQTT-based IoTs［C］// Proceedings of the 2017 14th IEEE Annual Consumer Communications & Networking Conference. 2017:191-196.
［13］HAPP D, KAROWSKI N, MENZEL T, et al. Meeting IoT platform requirements with open pub/sub solutions［J］. Annals of Telecommunications, 2017,72(1-2):41-52.
［14］BAUER J, ASCHENBRUCK N. Measuring and adapting MQTT in cellular networks for collaborative smart farming［C］// Proceedings of the 2017 IEEE 42nd Conference on Local Computer Networks. 2017:294-302.
［15］贾军营,王月鹏,王少华. 基于MQTT协议IM的研究和实现［J］. 计算机系统应用, 2015,24(7):9-14.
［16］顾亚文. 基于MQTT协议的通用智能家居系统设计与实现［D］. 西安:西安电子科技大学, 2014.
［17］任亨. 基于MQTT协议的消息推送集群系统的设计与实现［D］. 沈阳:中国科学院沈阳计算技术研究所, 2014.
［18］KATSIKEAS S, FYSARAKIS K, MIAOUDAKIS A, et al. Lightweight & secure industrial IoT communications via the MQ telemetry transport protocol［C］// Proceedings of the 2017 IEEE Symposium on Computers and Communications. 2017:1193-1200.
［19］王斌. 工业物联网信息安全防护技术研究［D］. 成都:电子科技大学, 2018.
［20］向江南. 基于MQTT的服务质量保障及安全防御策略研究［D］. 成都:电子科技大学, 2019.
［21］周志华. 机器学习［M］. 北京:清华大学出版社, 2016.
［22］BREIMAN L. Random forests［J］. Machine Language, 2001,45(1):5-32.
［23］赵小欢,夏靖波,李明辉. 基于随机森林算法的网络流量分类方法［J］. 中国电子科学研究院学报, 2013,8(2):184-190.

[1]	吕美静1, 年梅1, 张俊1, 2, 付鲁森1. 基于自编码器的网络流量异常检测[J]. 计算机与现代化, 2024, 0(12): 40-44.
[2]	苏凯旋. 基于改进XGBoost模型的网络入侵检测研究[J]. 计算机与现代化, 2024, 0(06): 109-114.
[3]	苏欣. 数据驱动的焊膏印刷工艺参数推荐技术[J]. 计算机与现代化, 2024, 0(01): 99-102.
[4]	刘静乐, 罗翔, 宫成荣, 张国鹏. 基于RF-RFECV和LightGBM算法的糖尿病预测[J]. 计算机与现代化, 2023, 0(11): 36-43.
[5]	杨娟, 滕飞, 郭大林. 多模态融合的特征提取方法在SA检测中的应用[J]. 计算机与现代化, 2022, 0(10): 121-126.
[6]	杨琳, 白钊, 寇勇刚. 基于RFM模型的随机森林算法对民航客户的流失分析[J]. 计算机与现代化, 2021, 0(01): 100-104.
[7]	刘晓康, 万曦, 涂文超, 周清楷, 田正稳. 基于红外可见光图像配准的电力设备分割算法[J]. 计算机与现代化, 2020, 0(08): 26-30.
[8]	孙世凡，叶明，刘凯 . 基于超像素分割和随机森林的橡胶柱塞缺陷检测方法[J]. 计算机与现代化, 2020, 0(02): 99-.
[9]	曹作伟1,2,陈晓1,倪宏1 . 面向网络流量的缓存替换算法比较与分析[J]. 计算机与现代化, 2019, 0(08): 50-.
[10]	沈智勇1,苏翀1,周扬1,沈智威2. 一种面向非均衡分类的随机森林算法[J]. 计算机与现代化, 2018, 0(12): 56-.
[11]	张昊,黄蔚,胡国超. 基于改进随机森林的洗钱交易角色识别应用[J]. 计算机与现代化, 2018, 0(02): 101-.
[12]	雷武1,2，廖闻剑2，彭艳兵2. 基于随机森林与LambdaMART的搜索排序模型[J]. 计算机与现代化, 2017, 0(3): 54-.
[13]	隋建凯1，刘惠义1，严烁2. 一种基于随机森林的特征匹配方法[J]. 计算机与现代化, 2014, 0(4): 81-85.
[14]	张艳，魏雪云. 基于旋转不变深度比较特征的人手关节点识别[J]. 计算机与现代化, 2014, 0(3): 119-122.
[15]	杜霄鹏;郝建平;李星新;杨俊. 基于单一深度图像的人体姿态实时识别技术研究[J]. 计算机与现代化, 2012, 1(200): 192-04.