Network intrusion detection system, method and product based on federated learning and P4

Abstract

The invention discloses an intelligent and efficient network intrusion detection system, method and product based on federated learning and P4. The system comprises an abnormal traffic detection module and an abnormal traffic classification module. The abnormal traffic detection module is used for extracting data packet feature information in network traffic, calculating a traffic reconstruction loss value according to preset parameters, and comparing the reconstruction loss value with a benign threshold and an attack threshold to judge whether the traffic is abnormal traffic; if the traffic is normal traffic, forwarding the traffic, and if the traffic is abnormal traffic, submitting the traffic to an abnormal traffic classification module; and the abnormal flow classification module is used for calculating an energy value of each flow and comparing the energy value of each flow with an energy threshold value of a flow category so as to detect a network attack type. According to the method, the comprehensiveness and the accuracy of network attack detection are remarkably improved, and a new solution is provided for constructing an intelligent and efficient network protection system.

Description

Technical Field

[0001] The present invention belongs to the technical field of network information security, and relates to a network intrusion detection system, method and product, in particular to an intelligent and efficient network intrusion detection system, method and product based on federated learning and P4. Background Art

[0002] With the continuous development of the Internet, the security threats of computer networks have increased sharply in the past decade, and the importance of network security has continuously become a major issue. At the same time, in a complex network environment, attack behaviors for obtaining private data for profit emerge in an endless stream and the destructive power is becoming stronger and stronger. Therefore, an Intrusion Detection System (IDS) for various network attacks has emerged as the times require. A Network-Based Intrusion Detection System (NIDS) is an attack detection system that ensures the security of the system by continuously monitoring malicious or suspicious behaviors in network traffic.

[0003] Regarding the research and development of network intrusion detection technology from its proposal to application, many scholars at home and abroad have conducted research. The continuous development and research of intrusion detection technology have also become an important force to promote the development of the new generation of network space security and better maintain the safe operation of the network world. Zhang Xinglan et al. proposed an intrusion detection model of a variable fusion random attention capsule network. Through feature dynamic fusion, the model can better capture data features. However, this method has problems such as data leakage, privacy security, and long training time while achieving a high accuracy rate (Literature 1).

[0004] Federated Learning (FL), as a distributed machine learning framework based on privacy protection, can ensure data security while solving the "data island" problem, and fully explore the potential value of data, making the network intrusion detection model have both high performance and privacy security. At the same time, this distributed intelligent training method can improve the overall performance and robustness of the intrusion detection system, especially when dealing with large-scale network data.

[0005] Popoola et al. proposed FDL, a joint deep learning method that uses a federated learning framework to ensure data privacy security, and at the same time has low communication overhead, network latency and storage space. It achieves similar performance to the centralized method while ensuring data privacy in detecting zero-day botnet attacks. Although this method improves the system performance and ensures data privacy, it cannot detect abnormal traffic in the real network environment in real time (Literature 2).

[0006] De Oliveira et al. proposed F-NIDS, a distributed intrusion detection system that overcomes privacy issues in distributed scenarios by evaluating the robustness of performance and accuracy, precision and recall metrics. The system is based on FL and aims to provide a distributed architecture that does not require the exchange of client data, as it eliminates the transmission of individual client information. Although this approach can effectively solve the data privacy problem and maintain high detection accuracy, the deployment and maintenance costs of this method are relatively high (Reference 3).

[0007] Software Defined Network (SDN), as a new type of network architecture, has improved the deficiencies of traditional networks and is considered a technology that can effectively manage the entire network and transform complex network architectures into simple and easy-to-manage ones. SDN separates the network control plane and the forwarding plane, concentrating network intelligence in the controller, enabling the SDN controller to be responsible for the management of the entire network, while the underlying infrastructure such as switches operates based on the instructions deployed by the SDN controller. Compared with traditional networks, SDN has faster anti-strain capabilities, so deploying NIDS in combination with SDN can quickly formulate emergency measures when the network is under attack.

[0008] Li Chuanhuang et al. proposed a DDoS (Distributed Denial of Service) attack detection method based on a deep learning hybrid model. This method has high precision and can also shorten the processing time of classification detection. Since the detection input features of this method are the flow table features in the SDN switch and self-constructed flow table features, it belongs to a lightweight detection method and can be directly deployed in the SDN controller. However, this method can only be applied to single DDoS attack detection and cannot achieve comprehensive detection of abnormal traffic in the network (Reference 4).

[0009] Zainudin et al. introduced a low-complexity intrusion detection and classification method based on federated learning in the SDN environment. Compared with traditional collaborative learning, traditional collaborative learning may endanger privacy when distributing local training data to the central server, while this method conducts local training in each SDN controller. Using the federated averaging algorithm, the aggregation server can aggregate the training parameters from each SDN controller, thus effectively protecting the privacy of network data. The deep neural network (DNN) model is used for training on each controller for the detection and classification based on abnormal network flows. After multiple trainings, the detection accuracy of this method has been greatly improved. Since the switch needs to continuously transmit a large amount of complete packet information to the controller for model training, this method will increase the communication overhead (Reference 5).

[0010] Liu Yanhua et al. proposed a weighted aggregation algorithm based on federated incremental learning, which combined LSTM (Long Short Term Memory) to achieve real-time defense decision-making against DDoS attacks in the SDN environment. According to the DDoS attack detection results and network entity information, real-time flow rules are issued to effectively block DDoS attack traffic. Although this method solves the problem of data independent and identically distributed caused by data increment well, it does not consider more application scenarios and cannot detect more different types of malicious attacks (Literature 6).

[0011] The network data plane solutions in SDN aim to utilize the hardware speed and the latest flexibility of programmable switches. However, these solutions are designed without considering the limitations of flow table size and memory space, and there are often serious bandwidth and latency bottlenecks in the channels between the data plane and the control plane, thus endangering the normal operation of ordinary SDN networks and affecting the timely response to ongoing network attacks. The recently emerged programmable data plane introduces a technology that provides a promising solution to the above challenges. The programmable data plane allows the customization of the data plane pipeline (called fastpath) using domain-specific languages such as P4. P4 (Programming Protocol-Independent Packet Processors) is a domain-specific language (DSL) for the programmable data layer of network switches, a language for changing the packet forwarding behavior of SDN switches. This language is used to program hardware like Verilog and VHDL languages, but different from Verilog and VHDL, people do not need to understand the details of the underlying hardware. The emergence of the P4 open-source language brings the possibility of programmability to the SDN data plane. Its features can completely free the data plane from the constraints of the fixed functions of traditional forwarding devices, allowing users to fully customize the packet forwarding processing flow and achieve efficient packet processing.

[0012] Doriguzzi-Corin et al. proposed the P4DDLe framework, which is a framework for effective packet-level feature extraction and preprocessing on the P4-based programmable data plane. This solution can meet the requirements of ML (Machine Learning)-based NIDS, ensuring accurate detection of DDoS attacks while reducing the chance of missing malicious flows due to lack of memory space. However, the detection types of network attacks in this method are limited (Reference 7). Xavier et al. proposed the MAP4 framework, which relies on the P4 language to deploy a pre-trained ML model into a programmable switch. The ML model as a classifier can better fit the data by using the programmability of the P4 language. The results show that only a small number of packets are needed to accurately classify the traffic. However, this method can only offload simple machine learning models to the data plane for flow classification, and the detection accuracy is relatively low (Reference 8).

[0013] In summary, there is currently no solution that can be flexibly deployed in a network environment to achieve efficient and intelligent detection of abnormal traffic and network attack types in the network. Existing related solutions have problems such as data leakage, high model training time consumption, high deployment and maintenance costs, single detection type, and low accuracy rate.

[0014] Reference 1: Zhang Xinglan, Yin Shenglin. An Intrusion Detection Model of Random Attention Capsule Network with Variable Fusion [J]. Journal of Communications, 2020, 41(11): 160-168.

[0015] Reference 2: Popoola S I, Ande R, Adebisi B, et al. Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT-Edge Devices [J]. IEEE Internet of Things Journal, 2022, 9(5): 3930-3944.

[0016] Reference 3: De Oliveira J A, Goncalves V P, Meneguette R I, et al. F-NIDS—A Network Intrusion Detection System Based on Federated Learning [J]. Computer Networks, 2023, 236(1): 1-14.

[0017] Reference 4: Li Chuanhuang, Wu Yan, Qian Zhengzhe, et al. DDoS Attack Detection and Defense Based on Deep Learning Hybrid Model under SDN[J]. Journal of Communications, 2018, 39(7): 176-185.

[0018] Reference 5: Zainudin A, Akter R, Kim D S, et al. Federated learning inspired low-complexity intrusion detection and classification technique for sdn-based industrial cps[J]. IEEE Transactions on Network and Service Management, 2023, 20(3): 2442-2459.

[0019] Reference 6: Liu Yanhua, Fang Wenyu, Guo Wenzhong, et al. DDoS Attack Detection Model in SDN Environment Based on Federated Incremental Learning[J]. Chinese Journal of Computers, 2024, 47(12): 2852-2866.

[0020] Reference 7: Doriguzzi-Corin R, Knob L A D, Mendozzi L, et al. Introducing packet-level analysis in programmable data planes to advance network intrusion detection[J]. Computer Networks, 2024, 239(1): 1-14.

[0021] Reference 8: Xavier B M, Guimaraes R S, Comarela G, et al. MAP4: A pragmatic framework for in-network machine learning traffic classification[J]. IEEE Transactions on Network and Service Management, 2022, 19(4): 4176-4188. Summary of the Invention

[0022] To solve the technical problems existing in the prior art, such as data leakage, high time consumption for model training, high deployment and maintenance costs, single type of network attack detection, and low accuracy, the present invention provides an intelligent and efficient network intrusion detection system, method, and product based on federated learning and P4.

[0023] The technical solution adopted by the method of the present invention is: a network intrusion detection system based on federated learning and P4, including an abnormal traffic detection module and an abnormal traffic classification module;

[0024] The abnormal traffic detection module is used to extract the packet feature information in the network traffic, calculate the traffic reconstruction loss value according to the preset parameters, compare the reconstruction loss value with the benign threshold and the attack threshold to determine whether it is abnormal traffic; if it is normal traffic, it is forwarded, and if it is abnormal traffic, it is submitted to the abnormal traffic classification module;

[0025] The abnormal traffic classification module calculates the energy value of each flow and compares the energy value of each flow with the energy threshold of the traffic category to detect the type of network attack.

[0026] Preferably, the abnormal traffic detection module includes a feature extraction sub-module, a counting Bloom filter, a traffic feature processing sub-module, a deep autoencoder, a parameter setting sub-module, and a forwarding decision sub-module;

[0027] The feature extraction sub-module uses a P4 parser to parse the packets; the P4 parser performs Ethernet parsing on all packets, stores the parsed header data and metadata, and transfers the parsing state to Accept according to the type value of the Ethernet header. Finally, all packets will enter the Accept state after the parsing is completed;

[0028] The traffic feature processing sub-module uses a binary EA algorithm to process the traffic features, and generates a new field through fitting and adds it to the original traffic data;

[0029] The deep autoencoder is used to generate parameters and thresholds, including a benign threshold and an attack threshold; the deep autoencoder consists of an encoder layer, a bottleneck layer, and a decoder layer connected in sequence, all of which are neural networks.

[0030] Preferably, the preset parameters, the benign threshold, and the attack threshold are all obtained by training the abnormal traffic detection module;

[0031] The training process includes the following steps:

[0032] (1) Construct a training data set. The training data set is used to extract the characteristic information of data packets in the network traffic through the abnormal traffic detection module. The counting Bloom filter is used to verify whether the number of data packets belonging to the same flow is less than a preset value. If so, the characteristic field information of the data packet is retained.

[0033] (2) The traffic feature processing module uses a binary classification EA algorithm to process traffic features and generates a new field after fitting and adds it to the original traffic data;

[0034] (3) The deep autoencoder calculates the input data x and the output data The reconstruction loss value is used to obtain the threshold, and the benign sample data and the attack sample data are reconstructed to obtain the benign threshold and the attack threshold respectively;

[0035] (4) The parameters and thresholds generated by the deep autoencoder are further trained through a federated learning submodule to obtain optimal parameters and thresholds; the federated learning submodule is used to use the FedAvg aggregation algorithm, use distributed training, and obtain the optimal parameters and thresholds after multiple rounds of training and aggregation.

[0036] Preferably, the calculation flow reconstruction loss value Where N refers to each sample x in the data set i The number of associated flow-based features, x i represents the initial value of each feature, Represents feature x i The value obtained after reconstruction by the autoencoder.

[0037] Preferably, the abnormal traffic classification module comprises a register, a model reasoning submodule and an abnormal traffic classification submodule;

[0038] The model reasoning submodule extracts and processes the input data, calculates its coupling value and local field value, and then obtains its energy value;

[0039] The abnormal traffic classification submodule calculates the energy value of each type of flow according to the model reasoning submodule, finds the minimum energy value in each type of flow and compares it with the trained threshold in the model reasoning submodule. Each attack flow corresponds to a training threshold, and the attack category to which it belongs is determined based on the result of the comparison between the minimum energy value of the category flow and the threshold.

[0040] Preferably, the trained threshold in the model inference submodule takes the Nth percentile energy value of each category of flow as the threshold, where N is a preset value.

[0041] Preferably, the energy value of each flow in, is the set of all possible flows, eij (d ki , d kj ) represents the coupling value, h i (d ki ) represents the local field value, N represents the number of flows, d kN represents the energy value of the Nth flow, d ki and d kj respectively represent the values of feature i and feature j.

[0042] Preferably, the system further includes a real-time display module for abnormal data streams, a display module for the detection effect of abnormal traffic, a display module for the detection effect of network attack types, and a display module for the collection effect of network traffic;

[0043] The real-time display module for abnormal data streams is used to display the specific information of the abnormal data streams detected by the abnormal traffic detection module;

[0044] The display module for the detection effect of abnormal traffic is used to display the detection effect of abnormal traffic in network traffic;

[0045] The display module for the detection effect of network attack types is used to display each attack type and quantity detected by the abnormal traffic classification module;

[0046] The display module for the collection effect of network traffic is used to display the effect of the abnormal traffic detection module in collecting network traffic.

[0047] The technical solution adopted by the method of the present invention is; a network intrusion detection method based on federated learning and P4, including the following steps:

[0048] Step 1: When network traffic arrives at the programmable switch, the abnormal traffic detection module extracts the packet feature information in the network traffic, and verifies the number of packets belonging to the same flow through the counting Bloom filter. If the number is less than the preset value, the feature field information of the packet is retained;

[0049] Step 2: The abnormal traffic detection module calculates the traffic reconstruction loss value according to the preset parameters, compares the reconstruction loss value with the benign threshold and the attack threshold to determine whether it is abnormal traffic; if it is normal traffic, it is forwarded, and if it is abnormal traffic, it is submitted to the abnormal traffic classification module;

[0050] Step 3: The abnormal traffic classification module writes the feature field value of the abnormal traffic through the register, and the abnormal traffic classification sub-module classifies the abnormal traffic to detect the type of network attack;

[0051] Step 4: Display the abnormal data stream information, the abnormal traffic detection effect, the network attack type detection effect, and the network traffic collection effect in a visual form.

[0052] The technical solution adopted by the product of the present invention is as follows: A network intrusion detection product based on federated learning and P4, including computer program instructions, which when running on a computer, cause the computer to execute the network intrusion detection method based on federated learning and P4.

[0053] Compared with the prior art, the present invention has the following beneficial effects: It realizes an intelligent and efficient network intrusion detection solution based on federated learning and P4. By utilizing the programmability of the data plane and combining the filtering mechanism of the counting Bloom filter, it can efficiently collect the traffic in the network. It is implemented through software and directly deployed on programmable switches and servers in various network environments to achieve efficient detection and reduce costs, making the maintenance and upgrade of the system easier. At the same time, by combining the energy flow classifier and the deep autoencoder, and using the federated learning framework to enhance its generalization ability, it reduces the model training time, realizes intelligent model aggregation while protecting data privacy, significantly improves the comprehensiveness and accuracy of network attack detection, and provides a new solution for building an intelligent and efficient network protection system. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The following uses embodiments and specific implementation manners to further illustrate the technical solutions of this article. In addition, some drawings are also used in the process of illustrating the technical solutions. For those skilled in the art, without creative efforts, other drawings and the intent of the present invention can also be obtained based on these drawings.

[0055] Figure 1 It is the system schematic diagram of the embodiment of the present invention;

[0056] Figure 2 It is the system simulation network topology diagram of the embodiment of the present invention;

[0057] Figure 3 It is the processing flow chart of the abnormal traffic detection module in the embodiment of the present invention;

[0058] Figure 4 It is an example diagram of the mapping process of the counting Bloom filter in the embodiment of the present invention;

[0059] Figure 5 It is the processing flow chart of the control plane of the abnormal traffic detection module in the embodiment of the present invention;

[0060] Figure 6 It is the processing flow chart of the traffic feature processing module in the embodiment of the present invention;

[0061] Figure 7 It is an example diagram of the autoencoder in the embodiment of the present invention;

[0062] Figure 8It is the processing flow chart of the abnormal traffic classification module in the embodiment of the present invention;

[0063] Figure 9 It is the model training flow chart of the multi-classifier EFC in the embodiment of the present invention;

[0064] Figure 10 It is the classification flow chart of the multi-classifier EFC in the embodiment of the present invention. Detailed implementation manners

[0065] The following uses embodiments and specific implementation manners to further illustrate the technical solution of the present invention. In addition, some drawings are also used in the process of illustrating the technical solution. For those skilled in the art, without creative efforts, other drawings and the intention of the present invention can also be obtained according to these drawings.

[0066] First, the technical terms adopted in this embodiment are explained and described:

[0067] Data plane: In the SDN architecture based on a programmable switch, a module of packet processing logic and forwarding behavior defined by a programmable language, which supports dynamic protocol parsing and custom behavior, and is usually at the hardware layer of network devices.

[0068] Control plane: A centralized module that manages network resources, issues rules, and dynamically configures data plane logic, and is usually in a centralized controller or server.

[0069] Application plane: As a user interface in a network intrusion detection system, it is responsible for collecting information from the data plane and the control plane, and visually displaying specific information of abnormal traffic, detection effects, traffic trends, etc., to help users monitor and analyze the network security status in real time.

[0070] Abnormal traffic detection module: A module in a network intrusion detection system, which is used to detect abnormal traffic in the network.

[0071] Abnormal traffic classification module: A module in a network intrusion detection system, which is used to classify abnormal traffic in the network to detect the type of network attack.

[0072] P4Runtime API: A standardized control plane interface protocol, which is used to interact with and manage network devices that support the P4 programming language. The control plane interacts with the data plane through remote procedure calls provided by the P4Runtime API.

[0073] Five-tuple: Five key attributes of network traffic, including source IP address, destination IP address, transport layer protocol type, source port, and destination port.

[0074] Counting Bloom Filter: A space-efficient probabilistic data structure that supports queries for set membership and is used to count the number of data packets in network traffic.

[0075] Register: A stateful memory in a programmable switch whose value can be read and written through operations. Registers can be more widely used to store the state of data.

[0076] Inverse Potts Model: A statistical mechanics model used to study the interactions in a multi-spin system. The interaction energy of these spins depends on the angular difference between them. The Inverse Potts Model defines a multi-state system, where each state represents a different category of traffic.

[0077] EFC Multi-Classifier: An energy-based traffic classification algorithm that is based on inverse statistics. For each traffic sample, it calculates its energy value according to the inferred statistical model to achieve effective classification of network traffic.

[0078] Coupling Value: In network flow analysis, a parameter used to describe the interaction or correlation between different flows. In the energy calculation of network flows, the coupling value is usually used to measure the correlation between network flows, which reflects the mutual influence of different flows during the processing.

[0079] Local Field Value: A parameter used to describe the influence of other flows on a single network flow in a network environment. The local field value usually quantifies the local influence of the network state where the node or flow is located in a certain way, similar to the local field in a spin system in physics, which represents the external influence or local environmental changes received at that point.

[0080] Deep Autoencoder: A type in the deep learning system, it is a deep neural network structure with multiple hidden layers. Different from traditional neural networks, the neural network in it contains an Auto-Encoder (AE) that can automatically learn the inherent dependencies in the data in an unsupervised manner and extract feature data. This deep autoencoder has a qualitative improvement in learning ability compared to traditional deep neural networks through layer-by-layer unsupervised pre-training and has achieved satisfactory results in many classification and regression problems (see https: / / github.com / rajarsheem / libsdae-autoencoder-tensorflow).

[0081] Accuracy: Accuracy represents the proportion of the total number of correctly classified normal and abnormal samples. It is an evaluation metric in classification tasks such as traffic anomaly detection, and its definition is as follows:

[0082]

[0083] Among them, the parameters TP, TN, FP, and FN are explained as follows:

[0084] TP (True Positive): The true class of the sample is positive, and the predicted result is positive.

[0085] TN (True Negative): The true class of the sample is negative, and the predicted result is negative.

[0086] FP (False Positive): The true class of the sample is negative, and the predicted result is positive.

[0087] FN (False Negative): The true class of the sample is positive, and the predicted result is negative.

[0088] Precision: Precision is the proportion of actual attack records among all predicted attack records, and it is an evaluation metric in classification tasks such as traffic anomaly detection. Its definition is as follows:

[0089]

[0090] Recall: Recall represents the proportion of correctly classified records among actual attack records. Recall is also known as the true positive rate (TPR) or sensitivity, and it is an evaluation metric in classification tasks such as traffic anomaly detection. Its definition is as follows:

[0091]

[0092] F1 Score: The F1 Score is the result of comprehensively considering recall and accuracy, and it is an evaluation metric in classification tasks such as traffic anomaly detection. Its definition is as follows:

[0093]

[0094] Collected Flows Rate: The Collected Flows Rate measures the ratio of the number of flows stored in the switch memory to the total number of flows injected into the switch within a given time window. Through this metric, we can gain in-depth understanding of the system's ability to capture traffic information in the network.

[0095] Please see Figure 1, a network intrusion detection system based on federated learning and P4 provided in this embodiment is applied to the scenarios of abnormal traffic detection and network attack type detection in a network environment. This scenario includes five entities: a control plane, a data plane, an application plane, an abnormal traffic detection module, and an abnormal traffic classification module. When network traffic arrives at the programmable switch, the abnormal traffic detection module processes the network traffic. The data plane extracts the feature information of the traffic in the network, and only retains the feature information of the data packets required for the training of the control plane model through a counting Bloom filter, sets parameters to efficiently detect the traffic and execute forwarding decisions, and the control plane constructs a model for training and transfers parameters and thresholds to the data plane; the abnormal traffic classification module processes the abnormal traffic, the data plane writes the feature field values of the abnormal traffic through registers, and the control plane classifies and detects the types of network attacks for the abnormal traffic. The control plane and the data plane implement interaction through the P4Runtime API; the application plane displays the abnormal data stream information, the abnormal traffic detection effect, the network attack type detection effect, and the network traffic collection effect.

[0096] In one implementation, the abnormal traffic detection module includes a feature extraction sub-module, a counting Bloom filter, a traffic feature processing sub-module, a deep autoencoder, a parameter setting sub-module, and a forwarding decision sub-module;

[0097] The feature extraction sub-module uses a P4 parser to parse the data packets; the P4 parser performs Ethernet parsing on all data packets, stores the parsed header data and metadata, and transfers the parsing state to Accept according to the type value of the Ethernet header. Eventually, all data packets will enter the Accept state after the parsing is completed;

[0098] The traffic feature processing sub-module uses a binary EA algorithm to process the traffic features, and generates a new field through fitting and adds it to the original traffic data;

[0099] The deep autoencoder is used to generate parameters and thresholds, including a benign threshold and an attack threshold; the deep autoencoder consists of an encoder layer, a bottleneck layer, and a decoder layer connected in sequence, all of which are neural networks.

[0100] In one implementation, the preset parameters, the benign threshold, and the attack threshold are all obtained by training the abnormal traffic detection module;

[0101] The training process includes the following steps:

[0102] (1)Construct a training dataset. The training data extracts the packet feature information in the network traffic through the abnormal traffic detection module, and verifies whether the number of packets belonging to the same flow is less than 3 through the counting Bloom filter. If it is less, the feature field information of the packet (including EtherType, Protocol, IPv4DF, IPv4MF, TcpDstPort, UdpDstPort, PackSize, TcpFIN, TcpSYN, TcpRST, TcpPSH, TcpACK, and TcpURG) and the five-tuple information are retained, and redundant packets are filtered out;

[0103] In one implementation, Mininet is used as the SDN network simulation experiment platform to create a simulation network topology structure as shown in Figure 2 to simulate the enterprise campus network. BMv2 is selected as the programmable switch (S 1 , S 2 , S 3 ), and a server configured with a 36-core Intel(R) Xeon(R) Gold 6240C CPU (2.60 GHz) and 128 GB of RAM is selected as the controller (C 1 , C 2 ); The hosts H 1 , H 2 and the switch S 1 represent the R & D department in the campus network. The hosts H 3 , H 4 and the switch S 2 represent the human resources department in the campus network. The hosts H 4 , H 5 and the switch S 3 represent the administrative department in the campus network. In this implementation, the R & D department is taken as an example; The controllers C 1 and C 2 represent the control plane, and the switches S 1 , S 2 and S 3 represent the data plane. The control plane and data plane functions are executed on the controller and switch respectively; The public dataset CICIDS2017 (see https: / / www.unb.ca / cic / datasets / ids-2017.html) is generated by a collaborative project between the Canadian Institute for Cybersecurity and the Canadian Institute for Cybersecurity. It contains the latest attacks and benign traffic, providing an environment similar to a real network. The dataset is a PCAP file generated on a test platform, divided into two networks (victim and attacker), containing most types of attacks, and using this dataset to simulate malicious traffic attacks suffered by different parts.

[0104] In one implementation, as Figures 3 - 5 shown, this step specifically includes the following sub-steps:

[0105] Step 1.1: The data plane extracts the feature information of the data packets in the network traffic. The parser accepts the incoming data packets and extracts the traffic header fields and metadata for checksum verification;

[0106] In one implementation, host H 1 sends the data packet P in the dataset CICIDS2017 to host H 2 . When P arrives at the switch S 1 , the switch extracts the header fields and metadata of the data packet through the parser in the data plane. If the data packet passes the Checksum verification, the components in the ingress pipeline of the data plane are responsible for storing the traffic characteristics and other metadata in the stateful memory.

[0107] Step 1.2: The data plane calculates the number of data packets belonging to the same traffic collected within a specific time through a counting Bloom filter. After being verified by a probabilistic technique based on a hash algorithm (CRC32 algorithm), the feature information of these data packets will be retained in the memory. The parser obtains the information of the data packet P and extracts the five-tuple: source IP address (IP src ), destination IP address (IP dst ), transport layer protocol type (Protocol), source port (Port src ), destination port (Port dst ), and defines the five-tuple identifier M P = (IP src , IP dst , Protocol, Port src , Port dst ). Calculate the CRC32 value of each identifier, and then the algorithm checks whether the counter value stored in the filter at the calculated position is less than the maximum allowed number of data packets P. If this condition is met, the five-tuple identifier of the data packet and its corresponding feature information will be saved in the memory;

[0108] In one implementation, the parser in the data plane extracts the five-tuple M of the data packet P=(10.0.0.1, 10.0.0.2, TCP, 0, 1), the counting Bloom filter size is 32 bits, the maximum number of data packets P = 3; the five-tuple set M = {x, y, z, w}, where x = (10.0.0.1, 10.0.0.2, 0, 1), y = (0, 1, 10.0.0.1, 10.0.0.2), z = (10.0.0.1, 10.0.0.2, TCP, 0, 1), w = (0, 1, 10.0.0.1, TCP, 10.0.0.2), the counting Bloom filter calculates the CRC32 values of the four elements in the five-tuple set, and the value obtained by taking the modulo of this value by 32 is {10, 14, 23, 18}, and then this element will be mapped to the corresponding position and the counter is incremented by 1. The processing process of the counting Bloom filter is as Figure 4 shown. If the value of the minimum counter is less than 3, the five-tuple identifier of the data packet and its corresponding feature information will be saved in the memory.

[0109] In one implementation, the CICIDS2017 dataset is divided into a training set and a test set, accounting for 80% and 20% respectively. The EA algorithm is used for training on the dataset, and the prediction results (energy values) obtained on the training set and the test set are respectively added to the original training set and the original test set as the values of a new feature field (EA). The training set with the EA field added is further divided into 90% for training and 10% for validation (during the training of the deep autoencoder model), and the test set remains the same size as the original.

[0110] (2) Please see Figure 6 , the traffic feature processing module uses the binary EA algorithm to process the traffic features, and after fitting, a new field is generated and added to the original traffic data;

[0111] (3) The deep autoencoder calculates the reconstruction loss value of the input data x and the output data to obtain a threshold, and respectively reconstructs the benign sample data and the attack sample data to obtain the benign threshold and the attack threshold;

[0112] In one implementation, the control plane uses a deep autoencoder with an unsupervised learning algorithm to build a model. The structure of the autoencoder consists of three layers: an encoder network, a bottleneck part (also called the latent space or compressed representation), and a decoder network. These three layers are all neural networks; the encoder network is responsible for encoding the input data into a low-dimensional representation, and this representation method can capture the main features of the input data; the bottleneck part is the space of this low-dimensional representation, and it is the bridge between the encoder network and the decoder network; the task of the decoder network is to recover the original data from this low-dimensional representation, as Figure 7 shown. The process of training the deep autoencoder aims to minimize the reconstruction loss That is, calculate all the given inputs to the output The minimized distance between them, where N refers to the number of flow-based features associated with each sample x in the dataset; during the training process of the autoencoder, the input data is the training data composed after processing the traffic features based on the EA algorithm; the input data used for calculating the minimum distance during training is the same as the input data here; the mean squared error (MSE) is used as the loss function during the training process where X o，i represents the observed value, and X r，i represents the true value, and n represents the number of observations;

[0113] After training the model constructed by the deep autoencoder, two thresholds will be generated, namely the benign threshold (T B ) and the attack threshold (T A ); then calculate the distances between the reconstruction loss value of the test sample and these two thresholds. If the reconstruction loss is close to the attack threshold, it is identified as an attack sample, otherwise it is a benign sample; the reconstruction loss value considered during the calculation and reasoning process is the mean absolute error (MAE), and its calculation formula is Benign samples B = {x m , Benign}, attack samples A = {x n , Attack}, m represents the number of benign samples, n represents the number of attack samples, and m + n represents the total number of samples in the validation set; these thresholds are obtained by calculating the mean absolute error (MAE) for the validation subset and local inference by the autoencoder, that is

[0114] In one implementation, the parameters of the used deep autoencoder are shown in the following table

[0115]

[0116]

[0117] Given the input sample numbers x = {3.2, 2.8, 4.1, 5.5, 3.9, 6.2, 2.5, 7.1, 4.3, 5.8}, the reconstructed data N = 10, calculate the reconstruction loss value MAE = 0.14.

[0118] (4) The parameters and thresholds generated by the deep autoencoder are further trained through the federated learning sub-module to obtain the optimal parameters and thresholds; the federated learning sub-module is used to obtain the optimal parameters and thresholds through the FedAvg aggregation algorithm, using distributed training and aggregating after multiple rounds of training.

[0119] In one implementation, the control plane proposes the FedAvg aggregation algorithm and conducts distributed model training on four clients. Each client consists of a dataset and a deep autoencoder model architecture. During the initialization process, each client fetches the model architecture from the global server, and this model architecture has random weights. The Federated Averaging (FedAvg) algorithm is used for distributed training on multiple clients and generates a new global model by aggregating the model updates of these clients. The number of clients K is indexed by k, B is the size of the local mini-batch data, and E is the number of local training rounds. Initialize the global parameters w on the server side 0 , for each round of global update t = 1, 2, 3..., calculate the number of clients m = MAX(C·K, 1) that need to participate in each round. Where C is a constant representing the participation rate. Then randomly select m clients from K clients to form a set S t , and for each client k ∈ S in parallel t Call the client update function to obtain the model parameters W of client k after local training k+1 , collect the data volume n of client k k , and finally calculate the global model Where

[0120] In one implementation, distributed training is conducted on four clients. The clients iterate through the local data 10 times, each batch contains 128 samples, and the data volume n of the clients k ={100, 150, 200, 120}, and the model parameters after local training The update parameters w of the global model k+1 = 0.55.

[0121] In one implementation, the abnormal traffic classification module includes a register, a model inference sub-module, and an abnormal traffic classification sub-module;

[0122] The model inference sub-module extracts and processes the features of the input data, calculates its coupling value and local field value respectively, and then obtains its energy value;

[0123] The abnormal traffic classification sub-module: The data plane writes the characteristic field values of abnormal traffic through registers. The control plane constructs a training model based on the inverse Potts model and uses a multi-classifier EFC to classify abnormal traffic and detect the types of network attacks. The abnormal traffic classification sub-module calculates the energy value of each type of flow according to the model inference sub-module, finds the minimum energy value in each type of flow, and compares it with the trained threshold in the model inference sub-module. Each type of attack flow corresponds to a training threshold, and the attack category to which it belongs is judged according to the comparison result of the minimum energy value of this type of flow and the threshold.

[0124] In one implementation, for the trained threshold in the model inference sub-module, the 95th percentile energy value of the energy values of each type of flow is taken as the threshold.

[0125] In one implementation, the energy value of each flow where is the set of all possible traffic, e ij (d ki , d kj ) represents the coupling value, h i (d ki ) represents the local field value, N represents the number of flows, d kN represents the energy value of the Nth flow, d ki and d kj represent the values of feature i and feature j respectively.

[0126] In one implementation, the system further includes an abnormal data stream real-time display module, an abnormal traffic monitoring effect display module, a network attack type detection effect display module, and a network traffic collection effect display module;

[0127] The abnormal data stream real-time display module is used to display the specific information of the abnormal data stream detected by the abnormal traffic detection module;

[0128] The abnormal traffic monitoring effect display module is used to display the detection effect of abnormal traffic in network traffic;

[0129] The network attack type detection effect display module is used to display each attack type and quantity detected by the abnormal traffic classification module;

[0130] The network traffic collection effect display module is used to display the effect of the abnormal traffic detection module in collecting network traffic.

[0131] This embodiment also provides a network intrusion detection method based on federated learning and P4, including the following steps:

[0132] Step 1: When network traffic arrives at the programmable switch, the abnormal traffic detection module extracts the packet feature information in the network traffic. If the number of packets belonging to the same flow verified by the counting Bloom filter is less than the preset value, the feature field information of the packet is retained;

[0133] Step 2: The abnormal traffic detection module calculates the traffic reconstruction loss value according to the preset parameters, and compares the reconstruction loss value with the benign threshold and the attack threshold to determine whether it is abnormal traffic; if it is normal traffic, it is forwarded, and if it is abnormal traffic, it is submitted to the abnormal traffic classification module;

[0134] In one embodiment, the traffic reconstruction loss value where N refers to the number of flow-based features associated with each sample x in the dataset, i x i represents the initial value of each feature, represents the value obtained after the feature x i is reconstructed by the autoencoder.

[0135] In one embodiment, as Figure 3 shown, Step 2 specifically includes the following sub-steps:

[0136] Step 2.1: After extracting the packet features, the data plane calculates the reconstruction loss value according to the parameters provided by the control plane;

[0137] Step 2.2: Compare the reconstruction loss value with the benign threshold and the attack threshold trained by the control plane to determine whether it is abnormal traffic;

[0138] Step 2.3: If it is normal traffic, it is forwarded, and if it is abnormal traffic, it is submitted to the abnormal traffic classification module;

[0139] In one embodiment, the benign threshold T B = 21.35, the attack threshold T A = 30.28, the data plane calculates the reconstruction loss value S of the packet loss = 30.2. Since |S loss - T B | > |S loss - T A |, the packet is detected as an abnormal packet, and its feature information will be stored in the register.

[0140] Step 3: The data plane of the abnormal traffic classification module writes the feature field value of the abnormal traffic through the register; the control plane uses the multi-classifier EFC to classify the abnormal traffic and detect the type of network attack;

[0141] In one embodiment, as Figure 8 shown, Step 3 specifically includes the following sub-steps:

[0142] Step 3.1: The control plane mainly infers an inverse statistical model based on the coupling value and the local field value to classify abnormal traffic and detect the type of network attack. This model uses a graphical data structure based on lattice spins to store the complete feature information of abnormal traffic. The main idea includes extracting a statistical model from benign traffic samples to infer the coupling value and the local field value representing such traffic, mainly borrowing the idea of the Potts model here. Given the N - tuple representation of a feature as (D 1 …D N ), for traffic k, it can be instantiated as (d k1 …d kN ), where d k1 ∈θ 1 ,... d kN ∈θ N . Each feature d ki is encoded with an integer from the set θ = {1, 2,... Q}, that is, all feature alphabets are the same, with size Q. If a certain feature can only take M values and M < Q, then the values from M + 1 to Q are considered possible but not actually observed. For example, assume a certain feature "protocol" can only take values {'TCP', 'UDP'}, and Q = 4, then the mapping is {'TCP': 1, 'UDP': 2, ": 3, ": 4}, where the feature values 3 and 4 do not occur. The formula for the coupling value is shown as follows,

[0143]

[0144] where C ij (d i , d j ) = f ij (d i , d j ) - f i (d i )f j (d j ), f ij (d i , d j ) is the joint empirical frequency of the values d i and d j of features i and j, f i (d i ) is the empirical frequency of the value d i on feature i, f j (d j ) is the empirical frequency of the value d j on feature j, and η is the set of features. The formula for the local field value is shown as follows,

[0145]

[0146] Calculate the frequency and pairwise frequency for each category of flow. The formula for calculating the energy value of each flow based on the coupling value and the local field is is the set of all possible traffic volumes;

[0147] In one implementation, the traffic volume k is instantiated as (d1, d2, d3), the feature set θ = {1, 2, 3}, and the single empirical frequency f 1 (1) = 0.2, f 2 (2) = 0.5, f 3 (3) = 0.3, the total empirical frequency f 1 (Q) = 1, f 2 (Q) = 1, f 3 (Q) = 1, the coupling matrix Calculate the local field value for each feature to obtain h 1 (1) = -0.5, h 2 (2) = -0.3, h 3 (3) = -0.1, calculate the coupling value to obtain e 12 (1, 2) = -0.3, e 13 (1, 3) = -0.1, e 23 (2, 3) = -0.2, finally calculate the energy value E = 0.3 according to the coupling value and the local field value.

[0148] Step 3.2: Use a multi-classifier EFC based on abnormal traffic. The energy of a given traffic volume can be calculated based on its feature values and model parameters. The energy of a traffic volume is the negative of the sum of the coupling value and the local field related to its features; the detection of network attack types is actually a multi-classification of abnormal traffic. In this case, the model will infer multiple distributions, with each traffic volume category corresponding to a distribution. Then calculate the energy of the traffic volume in each distribution, compare the values, and return the classification result. The model training process of the EFC classifier is as Figure 9 shown; in the multi-classification model, it is necessary to perform model inference and threshold calculation for each traffic volume category, that is, calculate the coupling value and the local field value, and design a statistical threshold. Then store the model of each category for use in the classification stage; Figure 10Shows the test process of EFC multi-classification. To classify an instance from the test set, during the training phase, each model is induced to calculate its energy, generating a model vector for each instance; the energy of a flow in a distribution is a measure of how similar that flow is to the set used to infer the distribution. The energy vector of the flow actually contains values inversely proportional to the probabilities of the flows belonging to each class. Therefore, after calculating the energy of the flow, EFC takes the lowest energy value, lowest, and compares it with the threshold, cutoff, of that class. If lowest ≤ cutoff, it is considered that the flows of that class come from the same class, and the corresponding attack label is assigned;

[0149] In one implementation, the dataset CICIDS2017 is used. The attack categories included in this dataset are Bot, Brute Force, DDoS, DoS, Infiltration, Injection. The energy sample sets for each type of attack calculated during the training phase are as follows:

[0150] F 1 = {0.2, 0.3, 0.5, 0.7, 0.8}, F 2 = {0.3, 0.4, 0.6, 0.7, 0.9},

[0151] F 3 = {0.1, 0.2, 0.4, 0.5, 0.6}, F 4 = {0.1, 0.3, 0.4, 0.5, 0.7},

[0152] F 5 = {0.4, 0.5, 0.6, 0.7, 0.5}, F 6 = {0.2, 0.3, 0.4, 0.5, 0.4}.

[0153] Selecting the 95th percentile of the set of selected energy values as the threshold, the threshold set can be obtained as cutoff = {0.8, 0.9, 0.6, 0.7, 0.5, 0.4}. During the test phase, the energy value of the new traffic sample is calculated as 0.65 based on the local field value and the coupling value. Since 0.6 < 0.65 < 0.7, it is determined that the traffic category of this class is DoS attack traffic.

[0154] Step 4: Display the abnormal data stream information, abnormal traffic detection effect, network attack type detection effect, and network traffic collection effect in a visual form.

[0155] The application plane shows the specific information of the detected abnormal data stream, including the five-tuple information of the data stream and the finally identified attack category;

[0156] In one implementation, the specific information of the detected abnormal data stream is shown in the following table:

[0157] Source IP address Destination IP address Source port number Destination port number Protocol type Attack type 172.17.0.1 10.0.0.2 0 1 TCP DDoS

[0158] The application plane shows the detection effect of abnormal traffic in network traffic. The evaluation indicators of the detection effect of abnormal traffic include accuracy, precision, recall rate, and F1 score;

[0159] In one implementation, the detection effect of abnormal traffic is shown in the following table:

[0160] Dataset Accuracy Precision Recall F1 score CICIDS 0.981 0.890 0.921 0.912

[0161] The application plane shows the effect of the abnormal traffic detection module collecting network traffic;

[0162] In one implementation, on switch S 1 replay the CICIDS2017 dataset, and the network flow collection rate of detection is 98.8%.

[0163] The application plane shows each attack type and quantity detected by the abnormal traffic classification module;

[0164] In one implementation, the type of each attack flow detected in the CICIDS2017 dataset and its proportion in all attack flows are shown in the following table:

[0165] Bot Brute Force DDoS DoS Infiltration Injection 25.19％ 13.77％ 30.70％ 13.56％ 10.64％ 8.04％

[0166] This embodiment also provides a network intrusion detection product based on federated learning and P4, including computer program instructions. When the computer program instructions run on a computer, the computer is made to execute the network intrusion detection method based on federated learning and P4.

[0167] The invention realizes a network intrusion detection scheme based on federated learning and P4. On the data plane, a counting Bloom filter is used to efficiently and comprehensively collect network traffic, reducing the memory load of the switch; real-time network traffic data is processed, the reconstruction loss value is calculated and compared with the training threshold transmitted by the control plane to achieve efficient detection of abnormal traffic. On the control plane, an unsupervised learning deep autoencoder and a federated learning training model are used. This distributed intelligent training can improve the overall performance and robustness of the system, effectively protecting network security and privacy. At the same time, on the control plane, an inverse statistical model is constructed based on the inverse Potts method to store complete feature information, and a multi-classifier EFC is used to comprehensively and accurately classify abnormal traffic and detect various types of network attacks.

[0168] It should be understood that the above-described embodiments are some but not all of the embodiments of the present invention. Additionally, the technical features in each embodiment or individual embodiment provided by the present invention can be arbitrarily combined with each other to form a feasible technical solution. Such combination is not restricted by the order of steps and / or the structural composition mode, but must be based on what can be achieved by those of ordinary skill in the art. When the combination of technical solutions results in contradictions or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0169] It should be understood that the above description of the preferred embodiment is relatively detailed, and it should not be considered as a limitation to the protection scope of the present invention patent. Those of ordinary skill in the art, under the inspiration of the present invention and without departing from the scope protected by the claims of the present invention, can still make substitutions or modifications, all of which fall within the protection scope of the present invention. The scope of protection requested by the present invention shall be subject to the appended claims.

Claims

1. A network intrusion detection system based on federated learning and P4, characterized by: It includes an abnormal traffic detection module and an abnormal traffic classification module; The abnormal traffic detection module is used to extract the characteristic information of data packets in the network traffic, calculate the traffic reconstruction loss value according to the preset parameters, and compare the reconstruction loss value with the benign threshold and the attack threshold to determine whether it is abnormal traffic; If it is normal traffic, it is forwarded; if it is abnormal traffic, it is submitted to the abnormal traffic classification module; The abnormal traffic classification module calculates the energy value of each flow, and compares the energy value of each flow with the energy threshold of the traffic category to detect the type of network attack.

2. The network intrusion detection system based on federated learning and P4 according to claim 1, characterized in that: The abnormal traffic detection module includes a feature extraction submodule, a counting Bloom filter, a traffic feature processing submodule, a deep autoencoder, a parameter setting submodule and a forwarding decision submodule; The feature extraction submodule uses a P4 parser to parse the data packets; the P4 parser performs Ethernet parsing on all data packets, stores the parsed header data and metadata, and transfers the parsing state to Accept according to the type value of the Ethernet header. Finally, the data packets will enter the Accept state after parsing is completed; The traffic feature processing submodule uses a binary classification EA algorithm to process traffic features, and generates a new field after fitting and adds it to the original traffic data; The deep autoencoder is used to generate parameters and thresholds, including benign thresholds and attack thresholds; the deep autoencoder is composed of a sequentially connected encoder layer, a bottleneck layer, and a decoder layer, all of which are neural networks.

3. The network intrusion detection system based on federated learning and P4 according to claim 2, characterized in that: The preset parameters, benign thresholds and attack thresholds are all obtained by training the abnormal traffic detection module; The training process includes the following steps: (1) Construct a training data set. The training data set is used to extract the characteristic information of data packets in the network traffic through the abnormal traffic detection module. The counting Bloom filter is used to verify whether the number of data packets belonging to the same flow is less than a preset value. If so, the characteristic field information of the data packet is retained. (2) The traffic feature processing module uses a binary classification EA algorithm to process traffic features and generates a new field after fitting and adds it to the original traffic data; (3) The deep autoencoder calculates the input data x and the output data The reconstruction loss value is used to obtain the threshold, and the benign sample data and the attack sample data are reconstructed to obtain the benign threshold and the attack threshold respectively; (4) The parameters and thresholds generated by the deep autoencoder are further trained through a federated learning submodule to obtain optimal parameters and thresholds; the federated learning submodule is used to use the FedAvg aggregation algorithm, use distributed training, and obtain the optimal parameters and thresholds after multiple rounds of training and aggregation.

4. The network intrusion detection system based on federated learning and P4 according to claim 1, characterized in that: The calculated flow reconstruction loss value Where N refers to each sample x in the data set i The number of associated flow-based features, x i represents the initial value of each feature, Represents feature x i The value obtained after reconstruction by the autoencoder.

5. The network intrusion detection system based on federated learning and P4 according to claim 1, characterized in that: The abnormal traffic classification module includes a register, a model reasoning submodule and an abnormal traffic classification submodule; The model reasoning submodule extracts and processes the features of the input data, calculates its coupling value and local field value respectively, and then obtains its energy value; The abnormal traffic classification submodule calculates the energy value of each type of flow according to the model reasoning submodule, finds the minimum energy value in each type of flow and compares it with the trained threshold in the model reasoning submodule. Each attack flow corresponds to a training threshold, and the attack category to which it belongs is determined based on the result of the comparison between the minimum energy value of the category flow and the threshold.

6. The network intrusion detection system based on federated learning and P4 according to claim 5, characterized in that: The threshold value trained in the model reasoning submodule is the energy value of each category of flow, and the Nth percentile energy value is taken as the threshold value, where N is a preset value.

7. The network intrusion detection system based on federated learning and P4 according to claim 1, characterized in that: The energy value of each flow in, is the set of all possible flows, e ij (d ki , d kj ) represents the coupling value, h i (d ki ) represents the local field value, N represents the number of flows, d kN represents the energy value of the Nth stream, d ki and d kj Represent the values ​​of feature i and feature j respectively.

8. The network intrusion detection system based on federated learning and P4 according to any one of claims 1 to 7, characterized in that: The system also includes an abnormal data flow real-time display module, an abnormal traffic monitoring effect display module, a network attack type detection effect display module and a network traffic collection effect display module; The abnormal data flow real-time display module is used to display specific information of the abnormal data flow detected by the abnormal traffic detection module; The abnormal traffic monitoring effect display module is used to display the abnormal traffic detection effect in the network traffic; The network attack type detection effect display module is used to display each attack type and quantity detected by the abnormal traffic classification module; The network traffic collection effect display module is used to display the effect of the abnormal traffic detection module collecting network traffic.

9. A network intrusion detection method based on federated learning and P4, characterized in that: The following steps are involved: Step 1: When network traffic reaches the programmable switch, the abnormal traffic detection module extracts the packet feature information in the network traffic and verifies the number of packets belonging to the same flow through the counting Bloom filter. If the number is less than the preset value, the feature field information of the packet is retained; Step 2: The abnormal traffic detection module calculates the traffic reconstruction loss value according to the preset parameters, and compares the reconstruction loss value with the benign threshold and the attack threshold to determine whether it is abnormal traffic; If it is normal traffic, it is forwarded; if it is abnormal traffic, it is submitted to the abnormal traffic classification module; Step 3: The abnormal traffic classification module writes the characteristic field value of the abnormal traffic through the register, and the abnormal traffic classification submodule classifies the abnormal traffic and detects the type of network attack; Step 4: Display abnormal data flow information, abnormal traffic detection effect, network attack type detection effect and network traffic collection effect in a visual form.

10. A network intrusion detection product based on federated learning and P4, comprising computer program instructions, characterized in that: When the computer program instructions are executed on a computer, the computer is enabled to execute the network intrusion detection method based on federated learning and P4 as claimed in any one of claims 1 to 7.

Images