Contents I. Introduction
With the development of information science and technology, the application of the Internet of Things is becoming more and more widespread, bringing many conveniences to people's lives. IoT technology enables devices and sensors to connect with each other to form an intelligent network, thereby achieving automation, intelligence, and data-driven decision-making. However, as the Internet of Things continues to develop and expand, security issues have also become an increasingly important focus of attention[6]. In the current security issues of the Internet of Things, identifying abnormal behavior in the network has become an urgent problem to be solved. Although common protective measures such as firewall technology and identity authentication mechanisms can meet basic security needs, their defense capabilities are relatively limited. However, once they are subjected to hacker attacks or abnormal activities, such as zero-day vulnerability attacks, these traditional methods often prove to be inadequate[7]. Therefore, we need more innovative and powerful methods to solve this problem. In recent years, scholars at home and abroad have conducted more and more research on flow anomaly detection, and have also achieved good results[8]. Intrusion detection technology is a method of using network data acquisition and analysis to determine the legitimacy or illegal intrusion of network access. Usually, intrusion detection can be divided into two main methods: feature-based intrusion detection and anomaly-based intrusion detection. Feature-based intrusion detection is a detection method based on known attack features[9]. It uses pre-defined attack feature patterns to detect known attacks. Anomaly-based intrusion detection first establishes a model through historical data, and then compares the passed data packets with the threshold set by the established model. Common methods include machine learning and deep learning. Traditional machine learning algorithms include K-nearest neighbor algorithm, Boosting algorithm, support vector machine, K-means clustering algorithm, etc. These algorithms are mainly applied to shallow learning and have limitations for complex classification problems of large-scale high-dimensional data. On the contrary[10], deep learning can meet the predictive needs of high-dimensional learning. Compared with other machine learning methods, deep learning can extract better features from complex data, improving the accuracy of classification. The advantage of deep learning is that it can automatically learn features without manual feature engineering. This means that deep learning models can extract and learn the most discriminative features from raw data[11], thus more intelligently and effectively identifying the abnormal features of intrusion behavior. Deep learning mainly includes recurrent neural networks, deep neural networks, and convolutional neural networks. Convolutional neural networks are widely used due to their significant ability to learn high-dimensional data features.
