Abstract: Aiming at the multifaceted intrusion threats in the oil and gas production IoT, this paper proposes an intrusion detection system based on edgecloud collaboration. The system is designed to meet the high requirements for realtime performance and accuracy, while overcoming challenges such as limited edge computing resources and data heterogeneity between edge and cloud environments. The system adopts a cloudedge collaborative architecture, with different intrusion detection subsystems deployed at the edgecloud, working in coordination to ensure comprehensive protection. The edge uses a model based on independent classification and joint analysis to accurately detect anomalies in multiple physical data, achieving detection speeds within 100 milliseconds. The cloud uses a model based on feature extraction + XGBoost, and adopts pretraining and finetuning to obtain a detection model with both anomaly traffic detection capability and low false alarm rate. The simulation results show that the system achieves high accuracy and realtime performance, adapts to the differences in available computing resources of the edge and cloud devices, and satisfies the performance requirements of intrusion detection across different levels.

Key words: edgecloud collaboration, oil and gas production IoT, edgeside intrusion detection, cloudside intrusion detection, system simulation

摘要： 针对油气生产物联网面临的多方面入侵威胁，为满足入侵检测对于实时性和精确度的高要求，克服边端计算资源受限、边云数据异构等技术难题，提出一种基于边云协同的油气生产物联网入侵检测系统.采用边云协同的架构模式，边端和云端分别部署不同的入侵检测子系统，二者协同运行，实现全面防护.边端采用基于独立分类+联合分析的模型架构，对多种物理数据进行精准的异常检测，检测速度可达100ms级.云端使用基于特征提取+XGBoost的算法，并采用预训练+微调的方式获得兼具异常流量检测能力与低误报率的模型.仿真结果显示该系统具备较高的准确性和实时性，能够适应边、云设备的可用计算资源差异性，并且满足不同层次的入侵检测性能要求.

关键词: 边云协同, 油气生产物联网, 边端入侵检测, 云端入侵检测, 系统仿真