摘要
5G边缘计算靠近用户侧提供服务,而边缘侧汇聚着用户的敏感信息,用户非法接入或合法用户自身的恶意行为威胁到整个边缘网络的安全。将机器学习算法应用于边缘计算架构,提出一种基于行为的用户异常检测方案。对用户行为进行建模,采用独热编码和互信息进行数据预处理和特征选择,并利用极限梯度提升算法训练一个多分类器分类识别进入园区的用户,根据识别结果与用户身份是否一致来判定用户是否异常。在此基础上,通过孤立森林算法对授权用户历史行为数据进行模型训练,从而检测可信任用户的行为是否异常,实现对小型固定园区内未授权用户的识别以及对授权用户异常行为的检测。实验结果表明,该方案可满足边缘计算场景的时间复杂度要求,并且能够有效区分不同用户,分类准确率达到0.953,而对异常行为样本的误报率仅为0.01。
5G edge computing provides services close to the user side,whereas the edge side gathers sensitive information about the user.The illegal access of users or malicious behavior of legitimate users threatens the security of the entire edge network.By applying a machine learning algorithm to an edge computing architecture,a behavior-based user anomaly detection method is proposed.The user behavior is modeled,One-Hot coding and Mutual Information(MI)are used for data pre-processing and feature selection,and the eXtreme Gradient Boosting(XGBoost)algorithm is used to train a multi-classifier to classify and identify users entering the park.Whether the users are abnormal is determined by consistency with the user’s identity.The isolation Forest(iForest)algorithm is used to train the historical behavior data of authorized users,detect whether the behavior of trusted users is abnormal according to the model,identify unauthorized users in small fixed parks,and detect abnormal behavior of authorized users.Experimental results show that this method effectively distinguishes different users on the premise of meeting the time complexity requirements of edge computing scenes,with a classification accuracy of 0.953,while the false positive rate of abnormal behavior samples is 0.01.
作者
张伟成
卫红权
刘树新
王庚润
ZHANG Weicheng;WEI Hongquan;LIU Shuxin;WANG Gengrun(National Digital Switching System Engineering&Technological R&D Center,PLA Strategic Support Force Information Engineering University,Zhengzhou 450001,China)
出处
《计算机工程》
CAS
CSCD
北大核心
2022年第5期27-34,共8页
Computer Engineering
基金
国家科技重大专项(2018ZX03002002)。
关键词
移动边缘计算
用户异常检测
孤立森林算法
极限梯度提升算法
内部威胁检测
Mobile Edge Computing(MEC)
user anomaly detection
isolated Forest(iForest)algorithm
eXtreme Gradient Boosting(XGBoost)algorithm
internal threat detection
