Federal learning anti-poisoning attack method for Internet of Things

Abstract

The invention discloses an internet of things-oriented federated learning anti-poisoning attack method. The method comprises the following steps of S1, initializing an internet of things federated learning system; s2, performing mask processing on the privacy data of the Internet of Things participants; s3, the cluster server collects mask data provided by all the Internet of Things participants and aggregates the mask data; and S4, identifying malicious poisoning participants of the Internet of Things through robust clustering. According to the method, an advanced machine learning algorithm and a privacy protection technology are introduced, a more effective anti-poisoning protection measure is provided for the Internet of Things system, the security and robustness of the Internet of Things system are remarkably improved through successful application of the method, and an important guarantee is provided for coping with potential hostile attacks and data tampering.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things data anti-poisoning attack, and more specifically, to a federated learning anti-poisoning attack method for the Internet of Things. Background Art

[0002] As an emerging and highly anticipated distributed machine learning framework, federated learning has shown broad application prospects in the IoT environment. Its core advantage is that each IoT device uses a local data set for independent training, avoiding the privacy risk of traditional centralized models that need to transmit data to a central server; this distributed training method not only reduces the possibility of data leakage, but also greatly improves the protection of user privacy. In particular, in areas with high requirements for privacy and data security, such as smart healthcare, autonomous driving, and smart cities, federated learning has shown strong practicality. However, despite its excellent performance in data privacy protection, federated learning still faces many challenges in practical applications, especially in defending against poisoning attacks. Since IoT devices usually transmit encrypted or masked gradients, this privacy protection measure effectively protects data, but also provides an attack path for malicious attackers, which may cause the model performance to degrade or the training process to fail to proceed normally, threatening the stability of the entire IoT system.

[0003] Existing defense strategies mainly rely on calculating the similarity between gradients, such as Euclidean distance or cosine similarity, to distinguish between benign and malicious actors. However, these methods are not only computationally expensive when processing encrypted or masked gradients, but also inefficient, especially on resource-limited IoT devices, and difficult to meet real-time requirements; in addition, the existence of encrypted gradients makes it difficult to accurately capture the differences between true gradients, resulting in decreased detection accuracy and increased false positives. Although differential privacy technology protects data privacy by introducing noise, the presence of noise also reduces the accuracy and reliability of the model, especially when dealing with sensitive tasks. The impact of noise is particularly significant. Therefore, how to effectively protect data privacy while enhancing the system's defense capabilities against poisoning attacks has become a key technical problem that needs to be urgently solved in the current field of federated learning and IoT security. Summary of the invention

[0004] In view of the shortcomings of the existing technology, the present invention proposes a federated learning anti-poisoning attack method for the Internet of Things, which solves the problems of how to effectively apply dimensionality reduction and clustering techniques in ciphertext in the existing technology, and the difficulty in extracting valuable information when processing masked gradients, which affects the identification of poisoned data.

[0005] In order to solve the above technical problems, the present invention is implemented in the following ways:

[0006] A method for anti-poisoning attack of federated learning for the Internet of Things includes the following steps:

[0007] S1. Initialize the IoT federated learning system;

[0008] S2. Mask the privacy data of IoT participants;

[0009] S3, the cluster server collects and aggregates the mask data provided by all IoT participants;

[0010] S4. Identify malicious IoT participants through Robin clustering.

[0011] Furthermore, the step S1 includes the following sub-steps:

[0012] S11. The IoT federated learning system consists of three parts: a trust agency, a cluster server, and IoT participants. In the initialization phase, the trust agency generates two integer random seeds, denoted as r p and r q , the trust institution sends the random seed r p Send to the cluster server and send the random seed r q Send to IoT participants;

[0013] S12, the cluster server receives the random seed r p Then, use it to generate the corresponding matrix IoT participants receive a random seed r q Afterwards, based on r q Generate mask matrix

[0014] S13, the cluster server divides the matrix P into [P1,…P i ,…P k ]k parts, and each sub-matrix Send to the corresponding IoT participants;

[0015] S14, each IoT participant will receive the sub-matrix P i Based on r q The generated mask matrix Q is combined for local training.

[0016] Furthermore, the step S2 includes the following sub-steps:

[0017] S21. IoT participants use their submatrix P in the federated learning system i and the local neural network model w i , taking the cross entropy function as the optimization target, the gradient with privacy protection capability is calculated through the back propagation algorithm

[0018] S22. IoT participants extract local neural network model w i The weight vector includes the activation values ​​of the neurons in the output layer and all neurons in the last hidden layer, where represents the weight vector of the jth neuron involved in the IoT participant, where j represents the index of the neuron;

[0019] S23, IoT participants use sub-matrix P i And the mask matrix Q performs mask processing on the extracted weight vector. The specific mask processing expression is as follows:

[0020]

[0021] in, Represents the mask weight vector of the jth neuron after processing;

[0022] S24, IoT participants will mask the weight vector Using Gradients Update and send to cluster servers;

[0023] S25. The cluster server aggregates the masked weight vectors sent by each IoT participant to ensure that the local gradients of the IoT participants are used for further updating of the global model while protecting their privacy.

[0024] Furthermore, the step S3 includes the following sub-steps:

[0025] S31, the cluster server collects the masking data provided by all IoT participants and aggregates them into a matrix Y' j , its specific expression is as follows:

[0026] Y j =[P1,…,P i ,…P k ]Y j Q

[0027] Among them, Y j Represents the raw data of IoT participants;

[0028] S32, in order to reduce the data dimension and extract the matrix Y' j The original weight vector The main feature of the cluster server is to use the singular value decomposition algorithm to convert Y' j Decomposed into three matrices, the expressions are as follows:

[0029]

[0030] Among them, U' j and V' jrepresents the orthogonal matrix obtained by singular value decomposition, W' j represents the diagonal matrix obtained by decomposition, and T represents the transpose of the matrix;

[0031] S33, the matrix P held by the cluster server transforms U' j Restore to U j , which is expressed as follows:

[0032] U j =[P1,…P i ,…P k ] -1 U' j .

[0033] Furthermore, the step S4 includes the following sub-steps:

[0034] S41, cluster server based on the main characteristics of the original data of the Internet of Things participants U j , K-means algorithm is used for clustering, and the number of clustering categories is 2. The category with a larger number after clustering is considered to be benign IoT participants, and the other category is considered to be malicious IoT participants;

[0035] S42, the cluster server introduces the silhouette coefficient as an evaluation metric to determine the credibility of the clustering result;

[0036] S43. If the threshold of the silhouette coefficient exceeds 0.7, the cluster server determines that the clustering result is credible, and detects malicious participants based on the clustering result. At the same time, for the IoT participants detected as malicious, the cluster server immediately removes their gradients to ensure that the data of benign participants is used when the global model is updated;

[0037] S44. The cluster server aggregates the gradients of IoT participants detected as benign and updates the global model accordingly. By eliminating the influence of malicious gradients, the cluster server improves the reliability and accuracy of the model.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] The present invention realizes the organic combination of data privacy protection and precise data processing by designing a removable random masking technology, ensures the accuracy of singular value decomposition and other dimensionality reduction technologies, avoids interference with data processing, and improves the parsing ability of the model under privacy protection; through the innovative mask matrix decomposition technology, it can extract the main information from the encrypted or masked gradient, effectively identify potential poisoned data, improve the system's detection ability for forged or malicious data, and enable the Internet of Things system to maintain efficient and stable operation in the face of complex attack scenarios.

[0040] This invention introduces a robust clustering paradigm, uses the profile coefficient to evaluate the behavioral similarity of participants, accurately distinguishes between benign and malicious participants, and effectively reduces the misjudgment rate through a refined detection mechanism, improves the defense effect against poisoning attacks, and strengthens the overall security and robustness of the Internet of Things system. At the same time, the diversity and scale of Internet of Things devices are taken into consideration, and the scalability and efficiency of the system under large-scale deployment are ensured by optimizing data processing and attack detection processes at all levels, so that it can be promoted and used in a wide range of Internet of Things application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flow chart of the method for resisting poisoning attacks by federated learning for the Internet of Things of the present invention;

[0042] Figure 2 This is a schematic diagram of the structure of the federated learning anti-poisoning attack system for the Internet of Things of the present invention. DETAILED DESCRIPTION

[0043] The specific implementation of the present invention is further described in detail below with reference to the accompanying drawings and specific examples.

[0044] like Figure 1 As shown, a federated learning anti-poisoning attack method for the Internet of Things includes the following steps:

[0045] S1. Initialize the Internet of Things system, including the following steps:

[0046] S11, such as Figure 2 As shown in the figure, the IoT federated learning system consists of three parts: a trust agency, a cluster server, and k IoT participants. In the initialization phase, the trust agency generates two integer random seeds, denoted as r and p and r q , the trust institution sends the random seed r p Send to the cluster server and send the random seed r q Send to IoT participants;

[0047] S12, the cluster server receives the random seed r p Then, use it to generate the corresponding matrix IoT participants receive a random seed r q Afterwards, based on r q Generate mask matrix

[0048] S13, the cluster server divides the matrix P into [P1,…P i ,…P k ]k parts, and each sub-matrix Send to the corresponding IoT participants;

[0049] S14, each IoT participant will receive the sub-matrix P i Based on r p The generated mask matrix Q is combined for local training.

[0050] The present invention effectively protects the data privacy of IoT participants and prevents the leakage of sensitive information through the randomly generated mask matrix Q; and increases the randomness and complexity of the system by using the matrix P generated by random seeds, thereby improving the defense capability against malicious attacks.

[0051] S2. Masking the privacy data of IoT participants, including the following steps:

[0052] S21. IoT participants use their submatrix P in the federated learning system i and the local neural network model w i , taking the cross entropy function as the optimization target, the gradient with privacy protection capability is calculated through the back propagation algorithm

[0053] S22. IoT participants extract local neural network model w i The weight vector includes the activation values ​​of the neurons in the output layer and all neurons in the last hidden layer, where represents the weight vector of the jth neuron involved in the IoT participant, where j represents the index of the neuron;

[0054] S23, IoT participants use sub-matrix P i And the mask matrix Q performs mask processing on the extracted weight vector. The specific mask processing expression is as follows:

[0055]

[0056] in, Represents the mask weight vector of the jth neuron after processing;

[0057] S24, IoT participants will mask the weight vector Using Gradients Update and send to cluster servers;

[0058] S25. The cluster server aggregates the masked weight vectors sent by each IoT participant to ensure that the local gradients of the IoT participants are used for further updating of the global model while protecting their privacy.

[0059] By masking the neural network weight vectors, the local data privacy of IoT participants is effectively protected during the federated learning process, preventing the leakage of sensitive information during gradient updates. The adopted mask processing method not only protects privacy, but also ensures that the cluster server can maintain efficient and accurate global model updates when aggregating the mask gradients of each participant, thereby improving the overall accuracy and performance of the model.

[0060] S3. The cluster server collects the mask data provided by all IoT participants and aggregates them in the following steps:

[0061] S31, the cluster server collects the masking data provided by all IoT participants and aggregates them into a matrix Y' j , its specific expression is as follows:

[0062] Y′ j =[P1,…,P i ,…P k ]Y j Q

[0063] Among them, Y j Represents the number of raw data of IoT participants;

[0064] S32, in order to reduce the data dimension and extract the matrix Y' j The original weight vector The main feature of the cluster server is to use the singular value decomposition algorithm to convert Y' j Decomposed into three matrices, the expressions are as follows:

[0065]

[0066] Among them, U' j and V' j represents the orthogonal matrix obtained by singular value decomposition, W' j represents the diagonal matrix obtained by decomposition, and T represents the transpose of the matrix;

[0067] S33, the matrix P held by the cluster server transforms U' j Restore to U j , which is expressed as follows:

[0068] U j =[P1,…P i ,…P k ] -1 U' j ;

[0069] U j Corresponding to Y j The orthogonal matrix representing U is calculated through the above steps. jThe main feature is that the amount of data is significantly reduced. The cluster server can calculate the low-dimensional matrix Y' j , where Y' j It contains the main feature information of the original data, ensuring that the cluster server extracts useful features from the masked data under the premise of privacy protection, thereby supporting the update and optimization of the global model.

[0070] By using mask matrices Q and P for data processing during the training process, the cluster server is allowed to effectively extract low-dimensional feature information while ensuring data privacy is not leaked, thereby restoring the main features of the data; while ensuring data privacy, the system's ability to accurately restore the features of the original data is also improved; by utilizing techniques such as singular value decomposition and orthogonal transformation, the present invention can significantly improve the performance of the global model while achieving privacy protection. The cluster server extracts valuable feature information from the masked data uploaded by each participant, which helps to optimize the training process of the model, thereby improving the overall accuracy and robustness of the model.

[0071] S4. Identifying malicious IoT participants through Robin clustering includes the following steps:

[0072] S41, cluster server based on the main characteristics of the original data of the Internet of Things participants U j , K-means algorithm is used for clustering, and the number of clustering categories is 2. The category with a larger number after clustering is considered to be benign IoT participants, and the other category is considered to be malicious IoT participants;

[0073] S42. In order to improve the robustness of clustering results, the cluster server introduces the silhouette coefficient as an evaluation metric. The silhouette coefficient measures the closeness of each IoT participant relative to its cluster and calculates its distance from the cluster centroid. The cluster server sets a threshold for the silhouette coefficient to determine the credibility of the clustering results.

[0074] S43. If the threshold of the silhouette coefficient exceeds 0.7, the cluster server determines that the clustering result is credible, and detects malicious participants based on the clustering result. At the same time, for the IoT participants detected as malicious, the cluster server immediately removes their gradients to ensure that the data of benign participants is used when the global model is updated;

[0075] S44. The cluster server aggregates the gradients of IoT participants detected as benign and updates the global model accordingly. By eliminating the influence of malicious gradients, the cluster server improves the reliability and accuracy of the model.

[0076] The steps of this application are mainly divided into two parts: participants and servers. Steps 1 and 2 are for participants. After the participants update the neural network parameters locally in a masked manner, they are sent to the server to update the parameters of the global model. These parameters may be interfered by poisoning attacks, so step 3 is used to parse the characteristics of the data sent to the server, and step 4 is used to identify which data is useful, so as to update the global model to resist the interference of poisoning attacks.

[0077] A federated learning anti-poisoning attack device for the Internet of Things, the attack device comprising:

[0078] Initialization module, used to initialize the IoT federated learning system;

[0079] A mask processing module, used to perform mask processing on the privacy data of IoT participants;

[0080] Aggregation module, used by the cluster server to collect and aggregate the mask data provided by all IoT participants;

[0081] Identification module, used to identify malicious IoT actors through Robin clustering.

[0082] A computer-readable storage medium contains computer-executable instructions, and the computer-executable instructions are executed by a processor to implement a method for implementing a federated learning anti-poisoning attack method for the Internet of Things.

[0083] A computer device comprising a processor;

[0084] The processor is used to store one or more programs;

[0085] When the one or more programs are executed by the processor, any one of the methods described in a federated learning anti-poisoning attack method for the Internet of Things is implemented.

[0086] The above description is only an implementation mode of the present invention. It is stated again that for ordinary technicians in this technical field, several improvements can be made to the present invention without departing from the principle of the present invention. These improvements are also included in the protection scope of the claims of the present invention.

Claims

1. A federated learning anti-poisoning attack method for the Internet of Things, characterized in that: The following steps are involved: S1. Initialize the IoT federated learning system; S2. Mask the privacy data of IoT participants; S3, the cluster server collects and aggregates the mask data provided by all IoT participants; S4. Identify malicious IoT participants through Robin clustering.

2. The method for resisting poisoning attacks by federated learning for the Internet of Things as claimed in claim 1, characterized in that: The step S1 comprises the following sub-steps: S11. The IoT federated learning system consists of three parts: a trust agency, a cluster server, and IoT participants. In the initialization phase, the trust agency generates two integer random seeds, denoted as r p and r q , the trust institution sends the random seed r q Send to the cluster server and send the random seed r q Send to IoT participants; S12, the cluster server receives the random seed r p Then, use it to generate the corresponding matrix IoT participants receive a random seed r q Afterwards, based on r q Generate mask matrix S13, the cluster server divides the matrix P into [P1,…P i ,…P k ]k parts, and each sub-matrix Send to the corresponding IoT participants; S14, each IoT participant will receive the sub-matrix P i Based on r q The generated mask matrix Q is combined for local training.

3. The method for resisting poisoning attacks by federated learning for the Internet of Things as claimed in claim 1, characterized in that: The step S2 comprises the following sub-steps: S21. IoT participants use their submatrix P in the federated learning system i and the local neural network model w i , taking the cross entropy function as the optimization target, the gradient with privacy protection capability is calculated through the back propagation algorithm S22. IoT participants extract local neural network model w i The weight vector includes the activation values ​​of the neurons in the output layer and all neurons in the last hidden layer, where represents the weight vector of the jth neuron involved in the IoT participant, where j represents the index of the neuron; S23, IoT participants use sub-matrix P i And the mask matrix Q performs mask processing on the extracted weight vector. The specific mask processing expression is as follows: in, Represents the mask weight vector of the jth neuron after processing; S24, IoT participants will mask the weight vector Using Gradients Update and send to cluster servers; S25. The cluster server aggregates the masked weight vectors sent by each IoT participant to ensure that the local gradients of the IoT participants are used for further updating of the global model while protecting their privacy.

4. The method for resisting poisoning attacks by federated learning for the Internet of Things as claimed in claim 1, characterized in that: The step S3 comprises the following sub-steps: S31, the cluster server collects the masking data provided by all IoT participants and aggregates them into a matrix Y' j , its specific expression is as follows: Y′ j =[P1,…,P i ,…P k ]Y j Q Among them, Y j Represents the number of raw data of IoT participants; S32, extract matrix Y' j The original weight vector The main feature of the cluster server is to use the singular value decomposition algorithm to convert Y' j Decomposed into three matrices, the expressions are as follows: Among them, U' j and V' j represents the orthogonal matrix obtained by singular value decomposition, W' j represents the diagonal matrix obtained by decomposition, and T represents the transpose of the matrix; S33, the matrix P held by the cluster server transforms U' j Restored to Uj, its expression is as follows: IN j =[P1,…P i ,…P k ] -1 IN' j 。 5. The method for resisting poisoning attacks by federated learning for the Internet of Things as claimed in claim 1, characterized in that: The step S4 comprises the following sub-steps: S41, cluster server based on the main characteristics of the original data of the Internet of Things participants U j , K-means algorithm is used for clustering, and the number of clustering categories is 2. The category with a larger number after clustering is considered to be benign IoT participants, and the other category is considered to be malicious IoT participants; S42, the cluster server introduces the silhouette coefficient as an evaluation metric to determine the credibility of the clustering result; S43. If the threshold of the silhouette coefficient exceeds 0.7, the cluster server determines that the clustering result is credible, and detects malicious participants based on the clustering result. At the same time, for the IoT participants detected as malicious, the cluster server immediately removes their gradients to ensure that the data of benign participants is used when the global model is updated; S44, the cluster server aggregates the gradients of the IoT participants detected as benign and updates the global model accordingly.

6. A federated learning anti-poisoning attack device for the Internet of Things, characterized by: The attack device comprises: Initialization module, used to initialize the IoT federated learning system; A mask processing module, used to perform mask processing on the privacy data of IoT participants; Aggregation module, used by the cluster server to collect and aggregate the mask data provided by all IoT participants; Identification module, used to identify malicious IoT actors through Robin clustering.

7. A computer-readable storage medium, characterized in that: The storage medium contains computer executable instructions, and the computer executable instructions are executed by a processor to implement the methods of claims 1 to 5.

8. A computer device, characterized in that: including a processor; The processor is used to store one or more programs; When the one or more programs are executed by the processor, the method according to any one of claims 1 to 5 is implemented.

Images