Lightweight distributed intrusion detection method

Abstract

The invention proposes a lightweight distributed intrusion detection method, and the method comprises the steps of preparing local data for each client, wherein the local data is non-independent identically distributed non-IID flow data and corresponding intrusion detection classification labels; in the training stage, enabling each client to use local data to train a local lightweight gradient boosting machine LGBM, in the prediction stage, inputting test data to each trained LGBM, and obtaining an intrusion detection prediction result output by each LGBM; and after the server collects intrusion detection prediction results output by each LGBM, obtaining a final intrusion detection result aiming at the test data in a voting mode. According to the invention, a lightweight gradient lifting algorithm is introduced on the basis of a traditional decision tree method, and a large number of samples can be effectively processed on non-independent identically-distributed data by combining a decision tree trained by a user. Compared with an existing method based on federated learning, the framework achieves higher accuracy and lower overhead on independent identically distributed data and non-independent identically distributed data.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to distributed intrusion detection technology. [0002] technical background [0003] Such as figure 1 As shown, a typical client-server system is composed of a central server cloud server and n client devices device group 1, device group 2, ..., device group n. In the malicious scenario Abnormal, the controlled host bot master may send malicious commands to the client devicegroup i (i=1, 2, ..., n) through the controller control server, thereby damaging the client or even the cloud server. An intrusion detection system (IDS) is the key to detecting malicious intrusions and protecting systems from malware attacks. The main idea of ​​IDS is to detect malicious traffic (abnormal traffic) through cloud real-time monitoring, so as to activate attack warning and traffic interception. [0004] Deep learning DL has achieved great success in building IDS. However, centralize...

AI Technical Summary

Problems solved by technology

[0008] (2) Accuracy: Compared with traditional centralized learning, in distributed scenarios, the accuracy of the IDS model may drop significantly

A large number of errors will bring a burden to the IDS service provider, and even cause its system to be paralyzed

Images