防御洪泛攻击的大模型辅助工业物联网安全路由方法

李杰铃; 肖亮; 王成耀; 方明洋; 陈晨; 雷妍

doi:10.11999/JEIT260400

防御洪泛攻击的大模型辅助工业物联网安全路由方法

doi: 10.11999/JEIT260400 cstr: 32379.14.JEIT260400

李杰铃^{1, 2,},
肖亮^1, ,,
王成耀¹,
方明洋¹,
陈晨¹,
雷妍¹

1.
厦门大学信息学院福建厦门 361105
2.
集美大学计算机工程学院福建厦门 361021

基金项目: 国家自然科学基金(U25A20388)，中央高校基本科研业务费专项资金资助(20720250036)，国家重点研发计划(2023YFB3107603)

详细信息

作者简介:
李杰铃：男，博士，研究方向为无线网络和网络安全，邮箱　lijieling1995@gmail.com

肖亮：女，教授，研究方向为无线通信、网络安全、机器学习和人工智能安全

王成耀：男，硕士生，研究方向为强化学习和网络安全

方明洋：男，硕士生，研究方向为网络安全和无线抗干扰

陈晨：女，硕士生，研究方向为无线网络和协同推断

雷妍：女，博士生，研究方向为无线网络和网络安全

通讯作者:
肖亮　lxiao@xmu.edu.cn

中图分类号: TN915.85
计量
- 文章访问数: 13
- HTML全文浏览量: 1
- PDF下载量: 0
- 被引次数: 0
出版历程
- 修回日期: 2026-08-10
- 录用日期: 2026-08-10
- 网络出版日期: 2026-08-18

LLM-Aided Secure Routing Method in Industrial IoT Against Flooding Attacks

1.
School of Informatics, Xiamen University, Xiamen 361105, China
2.
Computer Engineering College, Jimei University, Xiamen 361021, China

Funds: National Natural Science Foundation of China (U25A20388), Fundamental Research Funds for the Central Universities (20720250036), National Key Research and Development Program of China (2023YFB3107603)

摘要

摘要: 工业物联网路由转发设备相关的控制指令、状态信息及感知数据，但在洪泛攻击下可引发网络拥塞与通信资源耗尽。现有安全路由方法采用强化学习基于网络拓扑等信息优化下一跳，绕开拥塞节点以缓解洪泛攻击的影响。然而，工业物联网节点在链路带宽和队列容量等方面存在异构性，导致网络负载分布不均，在洪泛攻击下易引发区域拥塞。为此，提出防御洪泛攻击的大模型辅助工业物联网安全路由方法，云服务器部署大模型获取全局负载分布和异常流量分布等全局安全态势，以此优化多路径选择，均衡网络负载，抵御洪泛攻击。基于各感知节点、交换节点和工业网关等节点获取的链路状态信息，采用参数量不小于270亿的大模型推断全局安全态势，反馈至物联网节点以辅助强化学习状态构建和路由风险评估。设计基于洪泛攻击行为特征以及时延和数据包到达率等业务需求的风险评估网络，降低路由中断风险，支撑设备协同控制、系统安全运行和环境监测等业务，提升工业物联网安全。在节点资源异构的工业物联网环境下，恶意设备发起数据包洪泛攻击，结果表明所提方案可提升数据包到达率，降低路由能耗和端到端时延。
- 工业物联网 /
- 路由 /
- 洪泛攻击 /
- 强化学习 /
- 大模型
Abstract: Objective Industrial Internet of Things (IIoT) routing forwards and schedules control commands, equipment status information and sensing data to support critical tasks such as collaborative equipment control, safe system operation and environmental monitoring, but the routing process is prone to congestion and resource exhaustion under flooding attacks. Existing intelligent secure routing methods apply reinforcement learning (RL) to optimize next-hop selection based on network topology, but the heterogeneity in queue capacity and link bandwidth of IIoT terminals is often overlooked, leading to load imbalance and local congestion, and limiting performance under high load or malicious traffic attacks. Therefore, we propose a large language model (LLM)-based global situation-aware assisted secure routing method in IIoT against flooding attacks, which applies RL to optimize multi-path selection and achieve load balancing across the network. Methods Based on global security awareness, queue congestion of neighboring nodes, queue capacity, link bandwidth, and service types, the proposed secure routing method applies RL to optimize multi-path selection against flooding attacks. The cloud–edge large model infers global security situational awareness including global load distribution and anomalous traffic distribution based on network topology, node resource occupancy and link state information, and feeds the inference result back to IIoT terminals to construct RL states and evaluate routing policies risks. In addition, a risk-aware function is formulated to quantify the routing disruption potential by integrating end-to-end latency, packet delivery ratio and node vulnerability to attacks. An experience replay buffer that incorporates both reward and risk is constructed, where both factors are considered during routing parameter updates to guide routing policy selection, thereby balancing safe path exploration and optimization efficiency. Results and Discussions Simulations are conducted using 30 industrial nodes under varying configurations, including bandwidths of 5 MHz, 10 MHz, 20 MHz, and queue capacities ranging from 100 to 500 packets. The global security situational awareness is inferred by the Qwen3.5-27B-AWQ-4bit, which is deployed on a cloud–edge server equipped with dual 24 GB RTX 4090 GPUs. In each time slot, each terminal sends 5 packets of 2 KB each to the industrial gateway. A flooding attacker injects $ y\in \{10,20,30\} $ packets into neighboring queues per time slot to excessively consume network resources. Compared with the baseline method EEMR, the proposed secure routing method improves 39.4% packet delivery ratio, reduces 48.2% end-to-end latency and 41.1% routing energy consumption. Compared with the baseline method RLMR, the proposed secure routing method improves packet delivery ratio by a factor of 1.48, reduces end-to-end latency by 53.8% and routing energy consumption by 54.5%. This is because the proposed method leverages an LLM to infer global security situational awareness, integrating load distribution and anomalous traffic patterns to assist in selecting low-load nodes while avoiding high-load nodes, potential attack nodes, and abnormal or faulty nodes. Conclusions This paper proposes an LLM-based global situation-aware assisted secure routing method for IIoT against flooding attacks, which applies RL to optimize multi-path selection based on global security situational awareness including load distribution and anomalous traffic distribution. A risk assessment network is constructed based on attack behavior characteristics and service requirements to evaluate the risk level of routing performance degradation, thereby enabling risk-aware rerouting. Simulation results show that the proposed method increases the packet delivery ratio by 39.4%, reduces the end-to-end latency by 48.2% and the routing energy consumption by 41.1%.
- Industrial Internet of Things /
- Routing /
- Flooding attacks /
- Reinforcement learning /
- Large language model

HTML全文

图 1 防御洪泛攻击的大模型辅助工业物联网路由

下载: 全尺寸图片幻灯片

图 2 系统部署方案及大模型推断示意图

下载: 全尺寸图片幻灯片

图 3 大模型辅助的抗洪泛攻击路由消融分析

下载: 全尺寸图片幻灯片

图 4 抗洪泛攻击路由性能

下载: 全尺寸图片幻灯片

1 基于强化学习的大模型全局态势辅助抗洪泛攻击路由

1: 初始化 M, N, J , $ \rho $ , $ \tau $, $ \varpi $, $ \theta^{\mathrm{Q}} $, $ \theta^{\mathrm{R}} $, $ \gamma $和$ \mathcal{D}\mathbf{=}\varnothing $
2: For k = 1, 2, ··· do
3: 　计算当前相邻现场节点数量n
4: 　获取邻居节点当前队列长度q^(k)、队列容量c^(k)和链路带宽b^(k)
5: 　接收云侧大模型推断的全局安全态势H^(k)
6: 　根据式(1)构建s^(k)
7: 　输入s^(k)至$ \mathcal{Q} $和$ \mathcal{R} $获取$ \boldsymbol{Q} $和$ \boldsymbol{R} $
8: 　根据式(2)选择路由策略$ a^{(k)} $
9: 　向下一跳$ a^{(k)} $发送数据包
10: 接收工业网关反馈的消息$ {\mathcal{A}}^{(k)} $，提取端到端时延$ {\tau }^{(k)} $和数　　　据包到达率$ {\rho }^{(k)} $
11: 根据式(3)和(4)计算$ u^{(k)} $和$ {r}^{\left(k\right)} $
12: $ \mathcal{D}\leftarrow \mathcal{D}\cup \left\{{\boldsymbol{s}}^{(k)},{\boldsymbol{a}}^{(k)},{u}^{(k)},{r}^{(k)},{\boldsymbol{s}}^{(k+1)},{\boldsymbol{H}}^{(k+1)}\right\} $
13: IF $ \left\| \mathcal{D}\right\| \geq J $ do
14: 　从$ \mathcal{D} $中均匀随机抽取J条经验
15: 　根据式(5)和(6)更新$ \theta^{\mathrm{Q}} $和$ \theta^{\mathrm{R}} $
16: 　End IF
17: End for

下载: 导出CSV

参考文献(27)

[1]	JI Luyue, HE Shibo, GU Chaojie, et al. Routing and scheduling for low latency and reliability in time-sensitive software-defined IIoT[J]. IEEE Internet of Things Journal, 2024, 11(7): 12929–12940. doi: 10.1109/JIOT.2023.3337941.
[2]	张明强, 马晓聪, 杨雅娟, 等. 工业物联网智能感知-传输-控制融合: 关键技术与未来展望[J]. 电子与信息学报, 2025, 47(10): 3410–3425. doi: 10.11999/JEIT250305. ZHANG Mingqiang, MA Xiaocong, YANG Yajuan, et al. Integrating intelligent sensing, transmission, and control for industrial IoT networks: Key technologies and future directions[J]. Journal of Electronics & Information Technology, 2025, 47(10): 3410–3425. doi: 10.11999/JEIT250305.
[3]	AGIOLLO A, CONTI M, KALIYAR P, et al. DETONAR: Detection of routing attacks in RPL-based IoT[J]. IEEE Transactions on Network and Service Management, 2021, 18(2): 1178–1190. doi: 10.1109/TNSM.2021.3075496.
[4]	NAEEM F, TARIQ M, and POOR H V. SDN-enabled energy-efficient routing optimization framework for industrial internet of things[J]. IEEE Transactions on Industrial Informatics, 2021, 17(8): 5660–5667. doi: 10.1109/TII.2020.3006885.
[5]	叶苗, 胡洪文, 王勇, 等. MA-CDMR: 多域SDWN中一种基于多智能体深度强化学习的智能跨域组播路由方法[J]. 计算机学报, 2025, 48(6): 1417–1442. doi: 10.11897/SP.J.1016.2025.01417. YE Miao, HU Hongwen, WANG Yong, et al. MA-CDMR: An intelligent cross domain multicast routing method based on multi-agent deep reinforcement learning in SDWN multi controller domain[J]. Chinese Journal of Computers, 2025, 48(6): 1417–1442. doi: 10.11897/SP.J.1016.2025.01417.
[6]	孙鹏浩, 兰巨龙, 申涓, 等. 一种基于深度增强学习的智能路由技术[J]. 电子学报, 2020, 48(11): 2170–2177. doi: 10.3969/j.issn.0372-2112.2020.11.011. SUN Penghao, LAN Julong, SHEN Juan, et al. An intelligent routing technology based on deep reinforcement learning[J]. Acta Electronica Sinica, 2020, 48(11): 2170–2177. doi: 10.3969/j.issn.0372-2112.2020.11.011.
[7]	文鹏, 叶苗, 王勇, 等. SDWN中基于多智能体图强化学习的多对多通信路由方法[J]. 电子学报, 2025, 53(6): 1885–1905. doi: 10.12263/DZXB.20240980. WEN Peng, YE Miao, WANG Yong, et al. A multi-agent graph reinforcement learning method for many-to-many communication routing in SDWN[J]. Acta Electronica Sinica, 2025, 53(6): 1885–1905. doi: 10.12263/DZXB.20240980.
[8]	石怀峰, 周龙, 潘成胜, 等. 基于链路状态感知增强的战术通信网络智能路由算法[J]. 电子与信息学报, 2025, 47(7): 2127–2139. doi: 10.11999/JEIT241132. SHI Huaifeng, ZHOU Long, PAN Chengsheng, et al. Link state awareness enhanced intelligent routing algorithm for tactical communication networks[J]. Journal of Electronics & Information Technology, 2025, 47(7): 2127–2139. doi: 10.11999/JEIT241132.
[9]	叶苗, 李锦强, 何倩, 等. DHRL-ACTF: 一种新的SDWN智能链路故障感知自适应跨域路由算法[J]. 计算机学报, 2025, 48(11): 2666–2694. doi: 10.11897/SP.J.1016.2025.02666. YE Miao, LI Jinqiang, HE Qian, et al. DHRL-ACTF: A new SDWN intelligent link failure-aware adaptive cross-domain routing algorithm[J]. Chinese Journal of Computers, 2025, 48(11): 2666–2694. doi: 10.11897/SP.J.1016.2025.02666.
[10]	李洁, 陈青, 陈侃松. 历史交通数据驱动的VANET智能路由算法[J]. 软件学报, 2025, 36(12): 5780–5800. doi: 10.13328/j.cnki.jos.007431. LI Jie, CHEN Qing, and CHEN Kansong. Intelligent routing algorithm driven by historical traffic data for VANET[J]. Journal of Software, 2025, 36(12): 5780–5800. doi: 10.13328/j.cnki.jos.007431.
[11]	KAUR G and CHANAK P. An intelligent fault tolerant data routing scheme for wireless sensor network-assisted industrial internet of things[J]. IEEE Transactions on Industrial Informatics, 2023, 19(4): 5543–5553. doi: 10.1109/TII.2022.3204560.
[12]	FU Junsong, CUI Baojiang, WANG Na, et al. A distributed position-based routing algorithm in 3-D wireless industrial internet of things[J]. IEEE Transactions on Industrial Informatics, 2019, 15(10): 5664–5673. doi: 10.1109/TII.2019.2908439.
[13]	SANGAIAH A K, ROSTAMI A S, HOSSEINABADI A A R, et al. Energy-aware geographic routing for real-time workforce monitoring in industrial informatics[J]. IEEE Internet of Things Journal, 2021, 8(12): 9753–9762. doi: 10.1109/JIOT.2021.3056419.
[14]	YANG Zhutian, LIU Hanze, LIU Jinlong, et al. SC-RPL: A social cognitive routing for communications in industrial internet of things[J]. IEEE Transactions on Industrial Informatics, 2020, 16(12): 7682–7690. doi: 10.1109/TII.2020.2978925.
[15]	LIU Xin, CAO Qike, JIN Bo, et al. CNCMSA-ERCP: An innovative energy-efficient clustering routing protocol for improving the performance of industrial IoT[J]. IEEE Internet of Things Journal, 2025, 12(9): 11827–11840. doi: 10.1109/JIOT.2024.3516753.
[16]	SHAO Ziling, CHEN Tingzheng, CHENG Guang, et al. AF-FDS: An accurate, fast, and fine-grained detection scheme for DDoS attacks in high-speed networks with asymmetric routing[J]. IEEE Transactions on Network and Service Management, 2023, 20(4): 4964–4981. doi: 10.1109/TNSM.2023.3264278.
[17]	LIU Yucheng, TSANG K F, WU C K, et al. IEEE P2668-compliant multi-layer IoT-DDoS defense system using deep reinforcement learning[J]. IEEE Transactions on Consumer Electronics, 2023, 69(1): 49–64. doi: 10.1109/TCE.2022.3213872.
[18]	HEARTFIELD R, LOUKAS G, BEZEMSKIJ A, et al. Self-configurable cyber-physical intrusion detection for smart homes using reinforcement learning[J]. IEEE Transactions on Information Forensics and Security, 2021, 16: 1720–1735. doi: 10.1109/TIFS.2020.3042049.
[19]	李超豪, 王浩然, 周少鹏, 等. 面向物联网场景的大模型驱动数据合规检测方法[J]. 电子与信息学报, 2026, 48(4): 1480–1494. doi: 10.11999/JEIT250704. LI Chaohao, WANG Haoran, ZHOU Shaopeng, et al. LLM-based data compliance checking for internet of things scenarios[J]. Journal of Electronics & Information Technology, 2026, 48(4): 1480–1494. doi: 10.11999/JEIT250704.
[20]	SAHEED Y K and CHUKWUERE J E. Autonomous LLM agent: A memory-augmented, edge-optimized SHAP explanations with zero-day attack resilience in IoT/industrial IoT networks[J]. IEEE Internet of Things Journal, 2026, 13(7): 14213–14228. doi: 10.1109/JIOT.2025.3648649.
[21]	XIAO Yang, YANG Ying, YU Huihan, et al. Scalable QoS-aware multipath routing in hybrid knowledge-defined networking with multiagent deep reinforcement learning[J]. IEEE Transactions on Mobile Computing, 2024, 23(11): 10628–10646. doi: 10.1109/TMC.2024.3379191.
[22]	CHEN Rongjun, ZHANG Weiting, WANG Hongchao, et al. Enhancing energy efficiency in multipath routing for industrial internet of things[J]. IEEE Internet of Things Journal, 2025, 12(16): 33714–33730. doi: 10.1109/JIOT.2025.3576273.
[23]	LI Jieling, XIAO Liang, WANG Chuxuan, et al. Learning-based energy-efficient anti-jamming FANET routing with QoS guarantee[J]. IEEE Transactions on Communications, 2025, 73(11): 11418–11431. doi: 10.1109/TCOMM.2025.3593615.
[24]	朱晓荣, 贺楚闳. 基于强化学习的大规模多模Mesh网络联合路由选择及资源调度算法[J]. 电子与信息学报, 2024, 46(7): 2773–2782. doi: 10.11999/JEIT231103. ZHU Xiaorong and HE Chuhong. Joint routing and resource scheduling algorithm for large-scale multi-mode mesh networks based on reinforcement learning[J]. Journal of Electronics & Information Technology, 2024, 46(7): 2773–2782. doi: 10.11999/JEIT231103.
[25]	李杰铃, 肖亮, 王鹏程, 等. 大语言模型增强的抗灰洞攻击海域无人机路由算法[J]. 电子学报, 2025, 53(12): 4474–4484. doi: 10.12263/DZXB.20250878. LI Jieling, XIAO Liang, WANG Pengcheng, et al. LLM-enhanced maritime UAV routing algorithm against gray-hole attacks[J]. Acta Electronica Sinica, 2025, 53(12): 4474–4484. doi: 10.12263/DZXB.20250878.
[26]	National Institute of Standards and Technology. Guide for conducting risk assessments[R]. Special Publication 800-30, 2012.
[27]	POOLSAPPASIT N, DEWRI R, and RAY I. Dynamic security risk management using Bayesian attack graphs[J]. IEEE Transactions on Dependable and Secure Computing, 2012, 9(1): 61–74. doi: 10.1109/TDSC.2011.34.