Federal undersampling learning method for unbalanced network intrusion detection

Abstract

The invention discloses a federated undersampling learning method for unbalanced network intrusion detection, which comprises a federated learning server and a client, and communication connection is established between the federated learning server and the client; all models for network intrusion detection are configured in the server; the server is used for maintaining a global model and deploying the global model to the client for training and learning, and the client adopts a local data set to train a local model downloaded from the server and uploads the local model after training and learning to the server; the server aggregates the local models uploaded by the client to obtain a global model with updated parameters; and when the client adopts the local data set to train the server, undersampling processing is performed on the local data set to obtain a balanced data set to perform learning training on the client. When federated learning is carried out on an intrusion detection network model, the influence of training data imbalance in a client on the model detection performance is solved through an undersampling method.

Description

Technical Field

[0001] The present invention relates to the fields of machine learning and network security monitoring, and in particular to a federated undersampling learning method for detecting unbalanced networks. Background Art

[0002] In the modern interconnected world, the widespread use of networks and the rapid development of information technology have led to increasing security risks and threats facing network systems. Existing intrusion detection systems are constantly challenged by various malicious intrusion attacks. Machine learning algorithms have been widely used in intrusion detection. However, training these models requires sufficient high-quality samples, especially abnormal traffic data. Due to data security and privacy concerns, organizations are unable to share data with each other.

[0003] Therefore, when training the intrusion detection module in the prior art, a federated learning method is used to train the model, and the intrusion detection pattern aggregated after learning can be used to accurately identify network intrusion detection.

[0004] Various machine learning-based network anomaly detection methods in the existing art learn complex patterns from high-dimensional data through deep learning, making them suitable solutions for detecting network attacks. Using machine learning or deep learning algorithms to build detection models has been widely used in NIDS. Although previous studies have shown that they can achieve significant performance compared to traditional methods, their improved performance often requires a large amount of attack instance data. However, in the real world, due to the limited high-quality network attack traffic data available to a given organization or institution, the vast majority of network traffic datasets suffer from severe class imbalance. Specifically, data belonging to the majority class, normal network traffic, accounts for a large proportion of the dataset samples, while data belonging to the minority class, abnormal network traffic, accounts for a small proportion compared to the majority class normal network traffic data. This class imbalance problem can also reduce the detector's recognition performance for minority class abnormal network traffic data, resulting in a large number of false positives.

[0005] The intrusion detection model built based on unbalanced network intrusion data with limited data volume and deep learning methods has limitations such as insufficient ability to detect network attacks. An effective solution is to collect network traffic data from different organizations into a data center and train a deep learning model based on the data samples in the data center. Each organization contains a certain amount of network traffic data, which exists in the form of isolated islands. But the fact is that network intrusion data is private and confidential, which involves the security of governments, enterprises, research institutes, and even the country. In addition, with the implementation of data protection regulations and privacy policies such as GDPR and CCPA, organizations cannot share network intrusion data at will. Therefore, a federated learning (FL) framework is needed to solve this problem. In the FL framework, not only can the model's demand for the quantity of training data be solved, but the data can also be kept locally on the client. Under the premise of ensuring the privacy and security of user data, a global model shared by multiple parties can be collaboratively trained, such as Figure 1 However, FL is currently mostly used in the field of image data, and few studies have applied it to the tabular data field of network intrusion detection. Another challenge is that the network traffic data held by each organization also suffers from an imbalanced class distribution. This causes the model to learn more from the majority class, that is, normal network traffic data, while neglecting the more important minority class, abnormal network traffic data.

[0006] In federated learning, each client's network traffic dataset typically exhibits a data imbalance. This imbalance is a relative imbalance: the amount of attack network traffic data itself is not absolutely rarity, but rather imbalanced relative to the amount of normal network traffic data. The number of clients participating in federated learning typically ranges from thousands to millions. Due to differences in user habits and devices, datasets between different clients often differ significantly. Specifically, the ratio of normal to attack network traffic data in the local datasets of different clients varies, indicating varying degrees of dataset imbalance. Furthermore, the size of the network traffic datasets held by different clients may vary. Furthermore, due to the differences in client local data distribution, from a global perspective, the data distribution obtained by aggregating all client datasets is often also imbalanced: attack network traffic data is imbalanced relative to normal network traffic data. To distinguish imbalance issues in federated learning, this paper categorizes imbalance issues in federated learning into three categories:

[0007] 1) Local imbalance: the data distribution of each client is imbalanced;

[0008] 2) Global imbalance: From a global perspective, the data from all clients aggregated together is class-imbalanced.

[0009] 3) Size imbalance: The amount of data held by each client is uneven. However, studies have shown that data imbalance across clients can hinder this goal by extending training time and reducing the classification accuracy of minority class anomaly network traffic data.

[0010] FL is a distributed machine learning framework that enables training on mobile devices while ensuring data privacy and security. FL eliminates the need for data sharing because it facilitates collaborative learning between devices, where machine learning models are trained on data distributed across multiple servers and devices. In an FL system, the server randomly selects a subset of clients to participate in training during each round of communication and provides them with the current global model. Each client uses its local data to train the downloaded global model, and then these clients upload the updated models to the FL server for aggregation. This process is repeated multiple times, ultimately building a general and robust machine learning model. The FedAvg algorithm is the most fundamental algorithm in federated learning (FL). The server aggregates global model parameters based on the size of the client's local dataset. FedAvg's aggregation strategy aggregates model parameters based on the size of the client's local dataset. This aggregation implicitly implies that models trained on more samples are better than those trained on fewer samples, thereby increasing their contribution to the aggregation process. However, solely basing the focus on data size can be inappropriate. This strategy ignores other important properties of the model and data, and can lead to problems with training convergence. Considering this situation, if a client possesses a large but severely unbalanced dataset, the model parameters trained on this client will significantly deviate from the optimal values. Traditional aggregation strategies based on dataset size will bias the updated global model parameters towards those of the client model, causing global model performance to deviate from the optimal value and even risking global model divergence on unbalanced datasets. Therefore, existing aggregation strategies are flawed in the application of federated learning for unbalanced network intrusions.

[0011] The imbalanced distribution of data in federated learning can lead to poor model performance, making it more difficult for models to predict minority classes. More importantly, learning on datasets with imbalanced data distribution can lead to irreversible degradation, resulting in irreversible consequences. These issues motivate us to design a balanced training dataset method that pre-processes local data while preserving client privacy, while also being more efficient in both communication and computation.

[0012] In summary, the main challenges of FL-based network intrusion detection are the imbalance of local data held by clients and data variability across clients. These issues lead to poor performance of local models trained with FL. Furthermore, when malicious or underperforming local models are aggregated on the server, they can affect the convergence and performance of the global model. This is because when the distribution of client local datasets is unbalanced, the trained local models tend to favor normal network traffic and ignore attack network traffic, resulting in local model parameters deviating from optimal values. During the aggregation phase, these local model parameters uploaded by these clients negatively impact the updated parameters of the global model, ultimately leading to poor global model performance. Summary of the Invention

[0013] The purpose of the present invention is to overcome the shortcomings of the existing technology and provide a federated undersampling learning method for unbalanced network intrusion detection. When the intrusion detection network model is federated learning, the undersampling method is used to solve the impact of imbalanced training data in the client on the model detection performance, while improving the model training efficiency. Furthermore, through the optimized federated learning weighted aggregation strategy, the negative impact of the discrete degree of client data and the difference in information volume on model aggregation is reduced, thereby solving the defects of intrusion detection in the federated learning process.

[0014] To achieve the above objectives, the present invention adopts a technical solution: a federated undersampling learning method for unbalanced network intrusion detection, comprising a federated learning server and a client, wherein a communication connection is established between the federated learning server and the client; the server is configured with all models for network intrusion detection; the server is configured to maintain a global model and deploy the global model to the client for training and learning; the client uses a local dataset to train a local model downloaded from the server and uploads the trained local model to the server; the server aggregates the local models uploaded by the client to obtain a global model with updated parameters;

[0015] When the client uses the local data set to train the server, the local data set is undersampled to obtain a balanced data set for learning and training the client.

[0016] Before federated learning training, a client-side rebalancing strategy is adopted to construct balanced training data blocks by using a hash-based block undersampling method.

[0017] After local training is completed, the client uploads the updated model parameters, and the server performs weighted aggregation on the model parameters uploaded by the client based on the local Gini index.

[0018] After starting the federated learning training task, the server first initializes the global model to start training;

[0019] Subsequently, the FL server starts a new round of communication t and deploys the global model to all clients. Next, the server randomly selects clients to participate in the FL model training task. After completing the local training task, the selected clients upload the updated model parameters.

[0020] Finally, after this round of communication, the FL Server collects the parameters uploaded by the clients participating in the training and performs weighted aggregation on the model parameters uploaded by the clients based on the local Gini index. Then, the server updates the parameters of the global model to W t+1 , end this round of training, when starting the next round of training, the parameters of the starting model of the next round of communication are W t+1 .

[0021] Client rebalancing strategies include:

[0022] Define the number N of databases that the client dataset is divided into d , the number of databases N d The same as the local epoch number, where:

[0023]

[0024] In the formula, N maj 、N min Represents the number of samples of the majority class and the minority class respectively;

[0025] Use iterative quantization to perform binary hash coding on each majority class sample and divide it into hash subspaces according to the coding. Samples with the same hash code will be divided into the same hash subspace.

[0026] Use iterative quantization to process the majority class samples and then construct balanced training data blocks. Each training data block consists of all the samples in the minority class and the same number of samples in the majority class as the minority class samples.

[0027] The majority class samples are divided into various hash subspaces by the assigned hash codes. First, each sample i is weighted to obtain the weight of each sample According to weight distribution Sample N from the majority class min The samples constitute the majority class subset D * , the minority class sample set Dmin and the majority class subset D * Combined to get a balanced dataset D U , a balanced dataset is used to train the client model.

[0028] The weight of sample i The calculation method is:

[0029]

[0030] where n and d i are the number of hash subspaces and the Hamming distance between the hash codes of sample i corresponding to the hash subspace.

[0031] During the initialization phase of the FL model training task, the FL server first waits for clients to join the training. Clients participate in the training by sending the calculated Gini index value to the server. The Gini index is a measure of the probability that a randomly selected sample in a sample set will be misclassified, and is used to measure the degree of disorder in the set.

[0032] The network intrusion dataset has two categories, namely normal traffic data and abnormal traffic data. For a given client k, the sample set D k , can be divided into two subsets C0 and C1, and the local Gini index of client k is defined as:

[0033]

[0034] where |D k |、|C i | respectively represent the dataset D of client k k The size of the subset Ci, where i takes values ​​of 0 and 1, representing the majority class and the minority class respectively. After determining the clients participating in the federated training, the FL server initializes the weights and optimizer of the global model and collects the Gini index values ​​LG uploaded by all clients.

[0035] In each round of local training, the client uses the built differently balanced data blocks to train the local model. At the beginning of each round of communication, the server sends the current global model to all clients and randomly selects a fraction C of clients to participate in the federated learning training. The participating clients first download the global model from the server. Each client will perform E rounds of local training during the local training process. In each epoch, the small batch stochastic gradient descent algorithm is used to balance the data blocks. After all participating clients complete local training, they send the model updates to FLServer.

[0036] The server aggregates the updated model parameters after client training. The aggregation operation includes:

[0037] The local parameters collected by the server FL Server are weighted and aggregated through the Gini index uploaded by the client. The weight is proportional to the size of the Gini index, and the definition is based on LGThe federated aggregation vector is:

[0038]

[0039] Finally, the server FL Server aggregates all local parameters and updates the global model as follows:

[0040]

[0041] In the global model parameter update of FL Server, the server calculates the federated aggregation vector based on the Gini index of the participating clients to determine the weight of the local parameter aggregation and then calculates the global parameters to obtain the global model W for the next round of training. t+1 .

[0042] The advantages of this invention are that it leverages the distribution characteristics of the dataset to retain more information about majority class samples. Local models trained on balanced data blocks can better learn the characteristics of minority class samples, preventing the model from ignoring minority class samples and improving the model's classification performance. Furthermore, by considering the need to protect data privacy, this method achieves a balanced training dataset without leaving the client's local location, thus avoiding the risk of data leakage. It can address the impact of training data imbalance on model detection performance while improving model training efficiency. A redesigned client-side weighted aggregation strategy further optimizes the effectiveness of global model aggregation, reducing the negative impact of client-side data dispersion and information differences on model aggregation. Extensive experiments on an intrusion detection dataset demonstrate that compared to existing methods, the Fed-UGI method proposed in this solution achieves superior detection results in terms of F1-score, G-mean, and AUC, while reducing model training time by 51.76% to 92.58%, especially in cases of high class imbalance. This solution also considers the privacy of each organization's data and applies it to learning and detection of unbalanced network traffic data. Its technical contributions include:

[0043] (1) Taking data privacy into consideration, the proposed Fed-UGI is applied to unbalanced network intrusion detection. A large number of experiments are conducted on real datasets. The experimental results show that the proposed Fed-UGI can achieve better performance of network intrusion detection models while reducing model training time by 51.76%-92.58%.

[0044] (2) While ensuring that the data does not leave the local environment, the imbalanced dataset is preprocessed to construct balanced training data blocks so that each epoch model is trained on a different balanced data block. This prevents the classification model from being biased towards the majority class and avoids the situation where the model cannot recognize the minority class in highly imbalanced situations.

[0045] (3) A novel client-side weighted aggregation strategy based on Local Gini impurity (LG) is designed. Taking into account the differences between different client data, it can reduce the impact of poorly performing local models on the global model during training. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The following is a brief description of the contents and symbols in the drawings of the present invention:

[0047] Figure 1 This is a schematic diagram of the principle of existing federated learning technology;

[0048] Figure 2 Schematic diagram of the network architecture of the federated undersampling learning method for unbalanced network intrusion detection according to the present invention;

[0049] Figure 3 Schematic diagram of the workflow of the federated undersampling learning method for unbalanced network intrusion detection according to the present invention.

[0050] Figure 4 Schematic diagram of ROC curve and AUC principle of the present invention;

[0051] Figure 5 Schematic diagram of Nemenyi post hoc test results. DETAILED DESCRIPTION

[0052] The specific implementation of the present invention will be further explained in detail below by describing the best embodiment with reference to the accompanying drawings.

[0053] This embodiment addresses the problems existing in the learning and training of network intrusion models and provides a federated undersampling learning method for unbalanced network intrusion detection, referred to herein as Fed-UGI. The imbalance problem existing in prior art federated learning can lead to poor performance of the trained model, and the model often has more difficulty predicting minority classes. More importantly, learning a model on a dataset with an imbalanced data distribution will lead to irreversible degradation, resulting in irreparable consequences. These problems motivate us to design a method for balancing training datasets. This method can pre-process local data while protecting client privacy, while being more efficient in both communication and computing.

[0054] The main challenges of FL-based network intrusion detection are the imbalance of local data held by clients and data variability across clients. These issues can lead to poor performance of local models trained using FL. Furthermore, when aggregated on the server, malicious or underperforming local models can affect the convergence and performance of the global model. This is because when client local datasets are imbalanced, the trained local models tend to favor normal network traffic and ignore attack traffic, resulting in deviations from the optimal parameters. During the aggregation phase, these local model parameters uploaded by clients negatively impact the updated parameters of the global model, ultimately leading to poor global model performance. However, uploading or sharing user local data and data distribution information is inappropriate, as it risks compromising user data privacy. To address these issues, this paper proposes Fed-UGI and applies it to learning and detection on unbalanced network traffic data. This framework first preprocesses local data on the client to address the impact of imbalanced data on local model training. It then uses a client-side weighted aggregation strategy based on local Gini impurity to improve the effectiveness of global model aggregation, further enhancing the model's classification performance and communication efficiency.

[0055] To address the challenges of FL-based network intrusion detection, this paper proposes Fed-UGI, which rebalances the training dataset for each client while ensuring client privacy. It also optimizes the aggregation process by taking into account data variability between different clients. Fed-UGI mitigates the impact of imbalances on model training and parameter aggregation during federated learning, making it efficient and effective in both communication and computation.

[0056] The overview of the Fed-UGI framework of this solution is as follows Figure 2 As shown in Figure 2. Fed-UGI consists of two components: the federated learning server FL server and clients. In the FL system, the server randomly selects a subset of clients to participate in training in each round of communication. K is the set of all clients. The FL server is responsible for maintaining the global model, deploying it to clients, and aggregating local models uploaded by clients. Clients maintain local models and train them using their local datasets. Clients' local data suffers from class imbalance, which can lead to local imbalance. The amount of data varies between clients, resulting in size imbalance. Furthermore, from a global perspective, the data collected from all clients is imbalanced, with varying degrees of class skew across clients. The classic FedAv framework does not account for the impact of these imbalances. The Fed-UGI framework improves upon typical FL training to address the shortcomings of existing FL methods in handling imbalanced data. First, to address the local imbalance problem among clients, we propose a federated learning undersampling framework to rebalance client training datasets, taking into account privacy protection in federated learning. Second, building on the federated learning undersampling framework, we design a client-side weighted aggregation strategy based on Local Gini Impurity to address data disparity across clients, mitigating the impact of global and size imbalances on global model aggregation. Combining these two approaches, Fed-UGI can obtain a better performing global model with less training time between client and server in a data privacy-preserving and efficient manner.

[0057] During the training process of Fed-UGI, before the federated learning training, a client rebalancing strategy is adopted to construct balanced training data blocks by using the hash-based block undersampling (HBU) method. After starting the federated learning training task, first, the server initializes the global model to start training. Subsequently, the FL Server starts a new round of communication t and deploys the global model to all clients. Next, the server randomly selects clients to participate in the FL model training task. After completing the local training task, the selected clients upload the model update parameters. Finally, after this round of communication, the FL Server collects the parameters uploaded by the clients participating in the training, and performs weighted aggregation on the model parameters uploaded by the clients based on Local Gini impurity (LG for short). Subsequently, the server updates the parameters of the global model to W t+1 , ending this round of training. The parameters of the starting model for the next round of communication are W t+1 .

[0058] The workflow of Fed-UGI includes client rebalancing, initialization, training, and aggregation, such as Figure 5 As shown, the Fed-UGI method specifically includes the following steps:

[0059] 1) Client Rebalancing: Before the FL server is initialized, clients participating in the FL model training task need to rebalance local data with unbalanced class distribution to address local imbalances in client data. Local imbalances in client data can lead to weight divergence and accuracy loss in models trained on this dataset. Since we consider the client local dataset to be relatively unbalanced network traffic data, using undersampling methods on it can, on the one hand, balance its categories, and on the other hand, reduce the size of training data and thus improve training efficiency. Therefore, this article only considers undersampling of unbalanced datasets. In addition, due to the significant differences in data distribution between different clients, the category labels of the minority class in the local data of different clients may be different. That is, category label c is the minority class in client A, but may be the majority class in client B.

[0060] To address the imbalance problem mentioned above, this solution provides an HBU (Hash-based Block Undersampling) algorithm, which uses the hash method to divide the majority class dataset and construct an undersampling method with a number of balanced data blocks that is consistent with the number of local epochs. HBU can make good use of the distribution characteristics of the dataset, retain more information about majority class samples, and the local model trained on the balanced data blocks can better learn the characteristics of minority class samples, preventing the model from ignoring minority class samples and improving the classification performance of the model. At the same time, we also consider the need to protect data privacy, and achieve a balanced training dataset without leaving the client, avoiding the risk of data leakage. The HBU method solves the local imbalance existing in the client and alleviates the global imbalance to a certain extent.

[0061] Due to the mismatch in category distribution between different clients, this algorithm adaptively distinguishes the majority and minority class samples in the dataset by calculating the number of occurrences of samples of each category in the dataset. That is, the algorithm makes judgments based on the number of occurrences of a category. Samples of a category with a large number of occurrences are considered as majority class samples, and C0 can be used to define the category. Similarly, samples of a category with a small number of occurrences are considered as minority class samples, and C1 can be used to define the category. Define the number of data blocks N for dividing the client dataset into d The number of hash bits is the same as the local epoch.

[0062]

[0063] N maj 、N minrepresents the number of samples in the majority class and minority class, respectively. First, the HBU algorithm uses the Iterative Quantization (ITQ) method to perform binary hash coding on each majority class sample and divides it into hash subspaces based on the coding. Samples with the same hash code are divided into the same hash subspace.

[0064] ITQ is an unsupervised hashing method that well preserves the similarity information between samples. The ITQ method processes the majority class samples through principal component analysis (PCA) to find the high variance directions of the samples in the feature space and obtain their representation in a new orthogonal projection space. In this new projection space, a unit hypercube is formed with the origin of the PCA projection space as the center. Each vertex of the hypercube represents a hash code, and each vertex is associated with the sample closest to it, which is assigned a corresponding hash code. Then, a rotation operation is performed to minimize the quantization loss between the hash code and the original feature vector of the sample, expressed as:

[0065] Q(B, R)=||B-VR|| 2 (4)

[0066] B, R, V, and ||·|| represent the hash code, rotation matrix, real-valued data descriptor after PCA projection, and Frobenius norm of the dataset sample, respectively. The hash code and rotation matrix are iteratively updated to minimize quantization loss. Ultimately, the optimal set of hash codes and optimal rotation matrices for the sample are obtained.

[0067] After processing each majority class sample using the HBU algorithm, the next step is to construct a balanced training data block. The number of databases is Nd. Each training data block consists of all samples in the minority class and the same number of samples in the majority class as the minority class samples. The majority class samples are divided into different hash subspaces by the assigned hash codes. First, the weight of each majority class sample i in the client dataset is calculated. The weight of each majority class sample i is calculated using a sampling weight based on the Hamming distance. The weight is defined as:

[0068]

[0069] where n and d i They are respectively expressed as the number of hash subspaces and the Hamming distance of the hash code of sample i to each hash subspace. Then, according to the weight distribution Sample N from the majority class min The samples constitute the majority class subset D* , the minority class sample set D in the data set min and the majority class subset D * Combine to get a balanced training dataset D U , where Dmin refers to the set of all minority class samples; a balanced training data block is obtained by combining D* and minority class Dmin. According to the size of the weight, Nmin samples are selected to form the majority class subset to construct the majority class subset D * , the majority class subset D constructed * The number of epochs should be epochs. The balanced data block is a combination of the majority class subset and the minority class samples. There are as many balanced data blocks as there are epochs. One epoch represents one training session. Each training session needs to construct a majority class subset D* based on the weight size. That is to say, the majority class subset D* of each epoch (training) may not be the same, but the minority class sample set is the same D*. min .

[0070] Finally, the preprocessing of the client local data set is completed, and a new data set D for client model training is constructed. U The HBU method solves the impact of local imbalance in the training dataset and alleviates global imbalance, but it does not completely eliminate global imbalance and size imbalance. This is because constructing data blocks with undersampled majority class samples may lose useful information in the majority class.

[0071] 2) Initialization: During the initialization phase of the federated learning FL model training task, the FL server first waits for the clients participating in the training to join. The clients participate in the training by sending the calculated Local Gini impurity value to the server. Gini impurity is a measure of the probability that a randomly selected sample in the sample set is misclassified. It can measure the degree of disorder of the set. Given a set D Contains M categories, the probability that a sample point belongs to the mth category is p m , then the Gini impurity is defined as:

[0072]

[0073] The larger the Gini impurity value, the higher the degree of disorder of the set, the greater the uncertainty, and the greater the amount of information; on the contrary, the smaller the Gini impurity value, the higher the degree of order of the set, the smaller the uncertainty, and the smaller the amount of information. This paper considers the case where the network intrusion dataset has two categories, namely normal traffic data and abnormal traffic data, represented by C0 and C1 respectively. For a given client k, the sample set D k, can be divided into two subsets C0 and C1, and the local Gini impurity of client k is defined as:

[0074]

[0075] |D k |and|C i | denotes the size of the sample set Dk and the size of each category Ci, respectively. Ci includes two categories, C0 and C1.

[0076] Analyze the client k local data set D k The larger the LG(k) value, the larger the Gini impurity value, indicating that the dataset has greater dispersion, greater randomness, and greater information content. Once the clients participating in federated training are determined, the FL server initializes the weights and optimizer of the global model and collects the LGs uploaded by all clients.

[0077] 3) Training: A novel federated learning undersampling framework is designed based on the HBU method. In other federated learning frameworks, in each client's local training, each local training round (local epoch) trains the model on the same training set. However, the federated learning undersampling framework proposed in this paper proposes to use different data blocks to train the local model in each local epoch, and each training data block is completely balanced, that is, the balanced training data block obtained in step (2) is used to train each local epoch. Since multiple training databases are used, they are all balanced datasets obtained by undersampling the original client imbalanced dataset. Therefore, the parameters obtained after training are more reliable and accurate.

[0078] At the beginning of each communication round, the server sends the current global model to all clients and randomly selects a fraction C of clients to participate in federated learning training. The participating clients first download the global model from the server. Each client performs E rounds of local training during the local training process. In each epoch, the mini-batch stochastic gradient descent (mini-batch SGD) algorithm is used to balance the data blocks. Train the model on:

[0079]

[0080] Among them, w'new model parameters, w model parameters, η learning rate, gradient. Refers to the balanced dataset of the kth client Balanced data blocks extracted from

[0081] Training under this framework can help the model better learn the characteristics and discrimination between different categories and avoid bias towards sample categories. After all participating clients complete local training, they send the model updates to the FLServer.

[0082] 4) Aggregation: Because each client generates data independently, the distribution and probability of samples in each category in the local datasets of different clients can vary significantly. To address this data heterogeneity, we propose a new parameter weighted aggregation strategy. This strategy considers the differences in the degree of dispersion and information content of each client's raw data and measures the contribution of each client's local model parameters to the aggregation process. We perform weighted aggregation on the local parameters collected by the FL server based on the local Gini impurity index uploaded by the client.

[0083] The weight is proportional to the size of the local Gini impurity, and the federated aggregation vector based on LG is defined as:

[0084]

[0085] LG(k) refers to the local Gini impurity of client k. Similarly, LG(j) refers to the local Gini impurity of local client j and the value of j belongs to Represents the subset of clients participating in training.

[0086] Finally, the FL Server aggregates the parameters of all local models and updates the parameters of the global model as follows:

[0087]

[0088] In Formula 10, k represents client k, θ is the federation aggregation vector, and θ(k) represents the federation aggregation vector of client k. Denoted as the model parameters of the k-th client. Represents the subset of clients participating in training.

[0089] The global model parameter update process of the FL Server mainly includes two steps. First, the server calculates the federated aggregation vector vecor based on the Local Gini impurity of the participating clients to determine the weight of local parameter aggregation. Next, the global parameters are calculated according to formula (10) to obtain the global model W for the next round of training.t+1 .

[0090] Through the above scheme, this application realizes the training and learning of the network intrusion identification model under federated learning, and obtains the final trained model parameters and the final model. In this scheme, during the training process, the client obtains a balanced database by undersampling its data set during local training, and then aggregates the local parameters of the client training after uploading. The client weighted aggregation strategy based on Local Gini inpurity improves the effect of global model aggregation, further improves the classification performance and communication efficiency of the model, and improves the accuracy of the model.

[0091] Experimental verification:

[0092] This proposal experimentally evaluates the performance of Fed-UGI. First, we present the detailed experimental setup, including the dataset, state-of-the-art federated learning methods, FL parameter settings, and evaluation criteria. We then compare the performance of the proposed Fed-UGI for network intrusion detection with several state-of-the-art methods. Finally, we design ablation experiments to validate the effectiveness of each component of the proposed Fed-UGI. The symbols used in the experiment are listed in Table 3.

[0093] Table 3

[0094] Test Symbol

[0095] Notation Description R Communication round η Learning rate <![CDATA[B t ]]> Test batch size E Local epochs local training rounds B Local batch size Local batch size N Total number of clients c The fraction of clients participating in each training round <![CDATA[α d ]]> Dirichlet distribution coefficient

[0096] 1) Experimental Data: We conducted experiments on three widely used network intrusion detection datasets: UNSW-NB15, CSE-CIC-IDS2018, and CICIDS'17. For each dataset, our method and other comparison methods employed 10-fold cross-validation. The average of the ten results was used as a comprehensive evaluation of model performance to reduce random errors. Table 4 lists detailed information on the datasets used in this paper, including the number of features, label attributes, number of samples per class, and imbalance ratio.

[0097] Table 4

[0098] Dataset information

[0099]

[0100] 2) Environment setup: In the Fed-UGI method, we use cross entropy as the loss function and set the number of communication rounds R to 250, and set the learning rateη SGD with a loss of 0.1 was used as the optimizer for all optimization processes, and the test batch size was set to 512. For local training, the local epoch and local batch size were set to 5 and 16, respectively. For heterogeneous data distribution among clients, Dirichlet distribution was used to partition the data. In this study, multi-layer perceptrons (MLPs) were used as global and local models. Each model had two fully connected layers, where the connection between the input layer and the hidden layer used the ReLU activation function. The structure of the model was adjusted according to different datasets. The number of hidden layer neurons was set differently for different datasets, but the same structure was maintained between the compared methods. The MLP model and FL framework were implemented using pytorch. The client-related parameters for each dataset and the number of neurons in the hidden layer of the MLP model are shown in Table 5.

[0101] Table 5 Parameter settings on different datasets

[0102]

[0103] 3) Baseline and Comparison Methods: We compare our proposed Fed-UGI with four other baseline methods:

[0104] Ratio Loss: A monitor is deployed on the server or client device to monitor the composition of the training data in each round. When the monitor repeatedly detects similar imbalanced components, the system applies a loss function called Ratio Loss in the FL algorithm to mitigate the impact. However, the global model has already learned the imbalanced data, and the adverse effects on the model are irreversible.

[0105] FedCor: We use Gaussian processes to model the loss correlation between clients, and based on this, we design a strategy to select clients based on the expected significant reduction in global loss per round. In the FL scenario, FedCor uses an efficient GP training method that exploits covariance stationarity to achieve low communication overhead.

[0106] FedNoRo is a two-stage FL framework. In the first stage, noisy clients are identified based on abnormal per-class loss values. In the second stage, a noise-resistant training strategy using knowledge distillation and distance-aware aggregation function is adopted to effectively update the FL model.

[0107] CriticalFL: This approach identifies the critical learning period (CLP) during FL training online by examining changes in the Federated Gradient Norm (FGN) metric, and adaptively determines the number of clients participating in each training round. CriticalFL adaptively selects more clients in the CLP for training and fewer clients elsewhere, improving test accuracy while maintaining comparable or even better communication efficiency.

[0108] 4) Performance evaluation indicators: In imbalanced classification problems, Test accuracy is not a good criterion for evaluating model performance. For example, in a network traffic dataset, the ratio of normal traffic data to abnormal traffic data is 99:1. The model tends to predict that all data is normal, then the classification accuracy of normal traffic will reach 99%; however, the classification accuracy of abnormal traffic will be 0, which is meaningless in practical applications and is likely to cause immeasurable losses due to misidentification of abnormal traffic as normal traffic. Therefore, in order to accurately evaluate the effectiveness of our method, we use the three evaluation indicators F1-score, G-mean and AUC, which refers to the area under the ROC curve, which are commonly used in imbalanced data learning research to measure model performance. In addition, we will compare the training time (training time) of all methods from the start of FL training to the end of the final communication. The results of the three evaluation indicators are calculated using the confusion matrix shown in Table 6:

[0109]

[0110] Figure 4 The shaded area under the ROC curve is the AUC value, and the x- and y-axes represent the false positive rate and true positive rate, respectively. The larger the AUC value, the higher the performance of the model.

[0111] Table 6 Confusion Matrix

[0113]

[0114] 5) Statistical Testing: To further objectively discuss and evaluate the effectiveness of Fed-UGI, we used statistical tests to determine whether there were significant differences in model performance across all methods on different network intrusion datasets. This approach has been used in numerous empirical studies in fields such as machine learning. The statistical testing process consists of three steps. First, all methods are ranked from best to worst based on their test performance on each dataset, assigned ordinal values ​​of 1, 2, …, with the best method receiving an ordinal value of 1. If any methods have identical test performance, the ordinal values ​​are split equally. Next, a Friedman test is used to determine whether the methods all perform identically. If not, the hypothesis that all methods perform identically is rejected, indicating that the methods' performance differs significantly. Post-hoc testing is required to further distinguish between the methods. Finally, a Nemenyi post-hoc test is used to determine whether any two methods differ significantly. The Nemenyi post-hoc test uses a critical threshold to determine the difference between the two methods. If the difference in the mean ordinal values ​​of the two algorithms exceeds the critical threshold, the hypothesis that the two methods perform identically is rejected with the corresponding confidence level, and the test result concludes that the performance of the two methods differs significantly. In this study, the confidence level α = 0.05 was used.

[0115] Experimental results:

[0116] In this section, we conduct experiments on Fed-UGI and four baseline methods on the UNSW-NB15, CICIDS'17, and CSE-CIC-IDS2018 datasets. In addition, we also present the statistical test results of all methods. The details are as follows:

[0117] 1) Performance Comparison: Table 7 shows the results for the three evaluation metrics, F1-score, G-mean, and AUC, as well as the time required for all methods to complete 250 rounds of training. Fed-UGI achieves the best results across all metrics. On the UNSW-NB15 dataset, our method improves upon the best-performing baseline, Ratio Loss, by 1.13%, 1.61%, and 1.27% in F1-score, G-mean, and AUC, respectively. More importantly, training time is reduced by approximately 67.73%. On the CSE-CIC-IDS2018 dataset, our method further improves upon the best-performing Ratio Loss by 3.43%, 7.42%, and 1.8%, respectively. Compared to other baseline methods, training time is reduced by approximately 51.76% to 80.38%. On the CICIDS'17 dataset, all baseline methods performed poorly, demonstrating that in highly imbalanced scenarios, these methods are unable to effectively identify minority anomalous traffic samples in network traffic data, or even completely ignore anomalous traffic samples. The model trained with Fed-UGI achieved the best detection results, achieving optimal values ​​for F1-score, G-mean, and AUC, effectively addressing the adverse effects of highly imbalanced data on model training. Compared to other methods, it reduced training time by 83.02% to 92.86%. Based on this, the experimental results demonstrate that our approach achieves optimal detection results, effectively detecting both normal and anomalous network traffic data in unbalanced environments, particularly in highly imbalanced settings. Training time is also significantly reduced, improving model training efficiency.

[0118] Table 7 Comparison of model performance of each method

[0119]

[0120] 2) Statistical test results: Statistical tests were used to further verify the significance of the difference in detection performance between our method and other state-of-the-art methods. For each evaluation metric, the methods were ranked from best to worst based on their test performance on each dataset. Table 8 shows the ordinal and average ordinal values ​​of the test performance of each method on all datasets. The Friedman test results were calculated for the evaluation metrics F1-score, G-mean, AUC, and Training time. The values ​​are 1.962, 1.865, 3.676, and 9.250 respectively, and the critical value of the F test is 3.326 when the confidence level α is 0.05. The Friedman test results are as follows: They are all smaller than the F-test critical value, so we cannot reject the hypothesis that all algorithms have the same performance in F1-score and G-mean.

[0121] In terms of the indicators AUC and Training time, the Friedman test results TF are both greater than the F-test critical value, thus rejecting the hypothesis that all algorithms have the same performance, indicating that the performance of all methods is significantly different in terms of AUC and Training time. Then, the Nemenyi follow-up test is used to further distinguish the methods in terms of indicators AUC and Training time. The Nemenyi follow-up test calculates the critical value domain CD of the difference in tie sequence values ​​to be 3.353. We mainly analyze the gap between Fed-UCI and other methods, and the test results can be used Figure 5 Intuitive display, the vertical axis shows each method, the horizontal axis is the average sequence value, for each method, a far point is used to show its average sequence value, and the horizontal line centered at the origin represents the size of the critical value range. Figure 5 It can be seen that in terms of the evaluation index AUC, the performance of Fed-GCI is better than other methods and significantly better than the FedCor method; for the indicator of Training time, the performance of Fed-GUI is better than other methods and significantly better than the CriticalFL method.

[0122] In summary, the proposed Fed-GUI can significantly reduce the training time of the FL model while improving the performance of the network intrusion detection model. Furthermore, in statistical tests of the evaluation metric AUC and training time, the proposed Fed-GUI outperforms and significantly outperforms the FedCor method and the CriticalFL method, respectively.

[0123] Table 8 Test performance of each method on each dataset

[0125]

[0126] Obviously, the specific implementation of the present invention is not limited to the above-mentioned methods. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, they are all within the scope of protection of the present invention.

Claims

1. A federated undersampling learning method for unbalanced network intrusion detection, characterized by: It includes a federated learning server and a client, and a communication connection is established between the federated learning server and the client; all models for network intrusion detection are configured in the server; the server is used to maintain the global model and deploy the global model to the client for training and learning, the client uses the local data set to train the local model downloaded from the server and uploads the trained local model to the server, and the server aggregates the local local model uploaded by the client to obtain the global model with updated parameters; When the client uses the local data set to train the server, the local data set is undersampled to obtain a balanced data set for learning and training the client.

2. The method of federated undersampling learning for unbalanced network intrusion detection according to claim 1, characterized in that: Before federated learning training, a client-side rebalancing strategy is adopted to construct balanced training data blocks by using a hash-based block undersampling method.

3. The method of federated undersampling learning for unbalanced network intrusion detection according to claim 1, characterized in that: After local training is completed, the client uploads the model update parameters, and the server performs weighted aggregation on the model parameters uploaded by the client based on the local Gini index.

4. A federated undersampling learning method for unbalanced network intrusion detection as claimed in claim 2 or 3, characterized in that: After starting the federated learning training task, first, the server initializes the global model to start training; Subsequently, the FL Server starts a new round of communication t and deploys the global model to all clients. Next, the Server randomly selects clients to participate in the FL model training task. After completing the local training task, the selected clients upload the model update parameters. Finally, after this round of communication, the FL Server collects the parameters uploaded by the clients participating in the training, and performs weighted aggregation on the model parameters uploaded by the clients based on the local Gini index. Then, the server updates the global model parameters to W t+1 , end this round of training, when starting the next round of training, the parameters of the starting model of the next round of communication are W t+1 .

5. A federated undersampling learning method for unbalanced network intrusion detection as claimed in any one of claims 2 to 4, characterized in that: Client rebalancing strategies include: Define the number of databases N that the client data set is divided into d , the number of databases N d The same as the local epoch, where: In the formula, N maj 、N min Represents the number of samples of majority class and minority class respectively; Use iterative quantization method to perform binary hash coding on each majority class sample and divide it into hash subspaces according to the coding. Samples with the same hash code will be divided into the same hash subspace. Use iterative quantization method to construct balanced training data blocks after processing the majority class samples. Each training data block consists of all samples in the minority class and the same number of samples in the majority class as the minority class samples. The majority class samples are divided into various hash subspaces by the assigned hash codes. First, each sample i is weighted to obtain the weight of each sample According to weight distribution Sample N from the majority class min The samples constitute the majority class subset D * , the minority class sample set Dmin and the majority class subset D * Combined to get a balanced dataset D U , a balanced dataset is used to train the client model.

6. The method of federated undersampling learning for unbalanced network intrusion detection according to claim 5, characterized in that: The weight wi of sample i H The calculation method is: where n and d i are the number of hash subspaces and the Hamming distance between the hash codes of sample i corresponding to the hash subspace.

7. The method of federated undersampling learning for unbalanced network intrusion detection according to claim 5, characterized in that: In the initialization phase of the FL model training task, the FL server first waits for the clients participating in the training to join. The clients participate in the training by sending the calculated Gini index value to the server. The Gini index represents the probability of a randomly selected sample in the sample set being misclassified, which is used to measure the degree of disorder of the set. The network intrusion dataset has two categories, namely normal traffic data and abnormal traffic data. For a given client k, the sample set D k , can be divided into two subsets C0 and C1, and the local Gini index of client k is defined as: Where |D k |、|C i | respectively represent the dataset D of client k k The size of the subset Ci, where i takes values ​​of 0 and 1, representing the majority class and the minority class respectively. After determining the clients participating in the federated training, the FL server initializes the weights and optimizer of the global model and collects the Gini index values ​​LG uploaded by all clients.

8. The method of federated undersampling learning for unbalanced network intrusion detection according to claim 5, characterized in that: The client uses the differently balanced data blocks to train the local model in each round of local training. At the beginning of each round of communication, the server sends the current global model to all clients and randomly selects fraction C clients to participate in the federated learning training. The clients participating in the training first download the global model from the server. Each client will perform E rounds of local training during the local training process. In each epoch, a small batch stochastic gradient descent algorithm is used to balance the data blocks. After all participating clients complete local training, they send model updates to FLServer.

9. A federated undersampling learning method for unbalanced network intrusion detection according to any one of claims 1 to 8, characterized in that: The server aggregates the updated model parameters after client training. The aggregation operation includes: The local parameters collected by the server FL Server are weighted and aggregated through the Gini index uploaded by the client. The weight is proportional to the size of the Gini index, and the definition is based on LG The federated aggregation vector is: Finally, the server FL Server aggregates all local parameters and updates the global model as follows: In the global model parameter update of FL Server, the server calculates the federated aggregation vector according to the Gini index of the participating clients to determine the weight of local parameter aggregation and then calculates the global parameters to obtain the global model W for the next round of training. t+1 .

Images