Network intrusion cooperative detection method based on federated learning

Abstract

The invention discloses a network intrusion cooperative detection method based on federated learning. The method comprises the steps that an initiator initiates a federal learning request; the coordinator issues parameter information; each participant locally trains a federal intrusion detection convolution model; a local encryption state federal intrusion detection convolution model is obtained and uploaded; obtaining a global federal intrusion detection convolution model and issuing the global federal intrusion detection convolution model; feeding back federal learning conditions and the like. The federal intrusion detection convolution model trained by the method is more suitable for own business requirements. The federal learning task adopts a federal model increment average aggregation function, so that the federal learning efficiency can be improved. The model uploaded by each participant adopts an encrypted state federal intrusion detection convolution model, so that the model inversion attack of the semi-honest participant to other participants can be prevented. And arbitration is carried out by an initiator of federal learning, so that the intrusion detection library is protected from being acquired by a coordinator, the end-to-end security of model parameters can be ensured, and the robustness of the model is enhanced.

Description

technical field [0001] The invention belongs to the technical field of network intrusion detection, in particular to a network intrusion cooperative detection method based on federated learning. Background technique [0002] In recent years, with the popularization of big data applications, the network has become one of the tools that everyone knows and uses. The explosive growth of the number of network users has also brought about an exponential increase in network traffic. With that, the problem of network security has become increasingly serious. Network Intrusion Detection System (IDS for short), as an important part of network security, has always been a research hotspot in the field of network security technology. [0003] The traditional network intrusion detection technology is mainly based on the single-point sample training method, but in the face of today's complex and changeable network environment, the single-point training has the following problems: [0004...

AI Technical Summary

Problems solved by technology

[0004] (1) The number of available samples is limited: For a single organization that collects malicious attack samples, the number of labeled samples that can be marked is limited, which leads to insufficient samples, especially the number of malicious samples, so in practice In the application, the intrusion detection model tends to generate a large number of false alarms, thus submerging the real attack alarms

[0005] (2) The form of malicious samples is changeable: the means and methods of malicious attacks are various, and the malicious samples collected by each institution are also different. The model trained by only one institution has limitations for certain types of malicious attacks and cannot Adapts well to complex real-world environments

[0006] (3) There are isolated data islands between institutions: With the improvement of the network security law, the data of this institution cannot be released from the database at will, and cannot be used in plain text at will, which leads to the formation of isolated data islands among institutions. How to use data without leaking data became a very difficult problem

Images