A method for establishing an IoT traffic anomaly detection model and detection method

Abstract

This invention relates to a method for establishing and detecting anomaly detection models for Internet of Things (IoT) traffic. The model establishment method includes: a client acquiring traffic data, constructing a local model corresponding to the global model based on initial model parameters sent by the server, wherein the global model and the local model are TCN models; the client training the local model based on the traffic data, obtaining training performance data and transmitting it to the server; the server scoring the training performance data and selecting clients to participate in global model aggregation based on the scoring results; the client using a classifier to filter the traffic data, obtaining sample data, and training the local model based on the sample data, obtaining local model parameters and sending them to the server; the server iteratively updating the global model based on the parameters of each local model until the global model converges, obtaining the anomaly detection model. The beneficial effects of this invention are: increased efficiency and accuracy of IoT traffic anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method for establishing an anomaly detection model for Internet of Things (IoT) traffic and a detection method therefor. Background Technology

[0002] With the increasing number of IoT devices connected to the network, IoT applications are facing serious security risks due to anomalies in IoT clients, necessitating effective processing of IoT data for anomaly detection. Federated learning can effectively protect user privacy and reduce communication overhead and message latency between clients and servers, continuously iterating and updating using data from edge devices. Therefore, existing technologies have introduced federated learning methods into IoT anomaly detection.

[0003] However, due to the independence between IoT devices, the heterogeneity of data, the imbalance of data distribution, and the design requirements for security and privacy, edge devices participating in federated learning may intentionally or unintentionally deviate from the prescribed federated training process, making them more vulnerable to adversarial attacks, such as poisoning or becoming malicious proxies. Since data is collected on edge devices, device fluctuations are possible, and the data collection phase often includes noise. Anomaly detection methods are influenced by training data, thus affecting model parameters. Furthermore, participating parties may deceptively claim information about their training data and model performance, sending fake data to the server to be included in the global model aggregation for profit. In summary, this leads to inaccurate detection results from federated learning-based IoT traffic anomaly detection models. Summary of the Invention

[0004] The problem addressed by this invention is how to achieve efficient and accurate detection of abnormal traffic in the Internet of Things (IoT).

[0005] To address the aforementioned issues, this invention provides a method for establishing an IoT traffic anomaly detection model and a detection method.

[0006] This invention provides a method for establishing an IoT traffic anomaly detection model, comprising the following steps:

[0007] Step S100: The client obtains traffic data sent by the IoT device.

[0008] Step S200: The client constructs a local model corresponding to the global model based on the initial model parameters sent by the server, wherein the global model and the local model are TCN models.

[0009] Step S300: The client trains the local model based on the traffic data to obtain training performance data, and transmits the training performance data to the server.

[0010] Step S400: The server scores the training performance data uploaded by each client and selects the clients to participate in global model aggregation based on the scoring results.

[0011] Step S500: The client participating in the global model aggregation uses a classifier to filter the traffic data to obtain sample data, trains the local model based on the sample data, obtains the local model parameters when the local model converges, and sends the local model parameters to the server.

[0012] Step S600: The server updates the global model according to the parameters of each local model, sends the updated global model parameters to each client, returns to the step of constructing the local model, iteratively updates the global model until the global model converges, and obtains the anomaly detection model.

[0013] Therefore, the client obtains traffic data sent by IoT devices as the dataset for building the IoT anomaly detection model, ensuring the normal operation of the anomaly detection model building process. The client constructs a local model corresponding to the global model based on the initial model parameters sent by the server. Both the global and local models are TCN models. Using a TCN model as the anomaly detection model allows for better control over the memory size of the anomaly detection model and the retention of longer historical information, reducing computational resource consumption and improving the stability of training and prediction. The client trains the local model based on the traffic data, obtaining training performance data, and transmits the training performance data to the server. A hierarchical sample selection mechanism is used, filtering at both the node and data levels. Specifically, the server scores the training performance data uploaded by each client and selects clients to participate in global model aggregation based on the scoring results. This node-level selection, i.e., client-level selection, avoids the influence of malicious clients on the anomaly detection model construction in federated learning, achieving control over the accuracy of the anomaly detection model. Clients participating in global model aggregation use a classifier to filter the traffic data, obtaining sample data, and train local models based on the sample data, obtaining the local model parameters at convergence, and sending the local model parameters to the server. A classifier is used to classify data, avoiding the impact of malicious or fake data on the anomaly detection model construction, thus controlling the quality of the anomaly detection model construction and detection at the data level. A hierarchical sample selection mechanism is adopted to screen client and training data separately, effectively eliminating the impact of abnormal clients on the accuracy of the anomaly detection model in the federated learning environment, reducing the probability of low-quality data participating in the anomaly detection model construction, and controlling the model training at the node and data levels, effectively improving the accuracy of the anomaly detection model. The server updates the global model based on the parameters of each local model and sends the updated global model parameters to each client. It then returns to execute the local model construction steps, iteratively updating the global model until the global model converges, obtaining the anomaly detection model. The global model is updated using the local model parameters obtained by training with high-quality sample data, effectively reducing the number of global model iterations and improving the construction efficiency and accuracy of the IoT traffic anomaly detection model, thus constructing an efficient and accurate IoT traffic anomaly detection model.

[0014] Optionally, the server scores the training performance data uploaded by each client and selects the clients to participate in global model aggregation based on the scoring results, including:

[0015] The server receives the training performance data sent by each client, scores the training performance data according to the scoring algorithm, obtains the scoring results, calculates the Manhattan similarity between each client based on the scoring results, clusters the clients using the Mini Batch K-Means algorithm based on the Manhattan similarity between each client, selects the clients to participate in global model aggregation, and returns information to the selected clients.

[0016] Optionally, the clients participating in the global model aggregation use a classifier to filter the traffic data to obtain sample data, including:

[0017] The client participating in the global model aggregation receives the information returned by the server, and classifies the traffic data using a random forest classifier based on the information to obtain the sample data.

[0018] Optionally, the server scores the training performance data uploaded by each client, including:

[0019] The server calculates the score of the training performance data according to a first formula, which is expressed as follows:

[0020]

[0021] in, Let i be the score of the i-th client in the t-th round. Let nn be the model loss during the training of the anomaly detection model in the t-th round of aggregation for the i-th client. i Let N be the amount of training data for the i-th client, N be the total amount of training data for all clients, and K be the classification of the anomaly detection model. The anomaly detection model is a binary classification model, and the value of K is 0 or 1.

[0022] Optionally, the TCN model includes two dilated causal convolutional units and a nonlinear mapping layer. Each dilated causal convolutional unit sequentially includes a one-dimensional dilated causal convolution, a weight normalization layer, a ReLU activation function layer, and a dropout operation layer. The nonlinear mapping layer is used to perform a nonlinear transformation between the output of the dilated causal convolutional unit and the input to obtain the output of the TCN model.

[0023] Optionally, obtaining the traffic data sent by the IoT device includes:

[0024] The traffic data sent by the IoT device is acquired, and the traffic data is preprocessed to obtain preprocessed traffic data, wherein the preprocessing includes data normalization.

[0025] Optionally, before the client constructs a local model corresponding to the global model based on the model parameters sent by the server, the method for establishing the IoT traffic anomaly detection model further includes:

[0026] Construct an autoencoder and train the preset autoencoder based on the traffic data to obtain a stacked sparse autoencoder.

[0027] The preprocessed traffic data is input into the stacked sparse autoencoder for encoding to obtain the encoded traffic data.

[0028] Optionally, the construction of the autoencoder includes:

[0029] The client invokes multiple sparse autoencoders, each comprising an input layer, a hidden layer, and an output layer, and sorts these sparse autoencoders in ascending order of the number of neurons in the hidden layer.

[0030] The input and hidden layers of the first sparse autoencoder, the hidden and output layers of the last sparse autoencoder, and the hidden layers of the remaining sparse autoencoders are retained. Adjacent sparse autoencoders are sequentially connected through the hidden layers to construct the pre-trained stacked sparse autoencoder.

[0031] Optionally, before the client constructs a local model corresponding to the global model based on the initial model parameters sent by the server, the method for establishing the IoT traffic anomaly detection model further includes:

[0032] The server confirms the task and objective of training the anomaly detection model, constructs the global model based on the task and objective, obtains the initial model parameters of the global model, and broadcasts the initial model parameters to the client.

[0033] Another method for detecting abnormal Internet of Things (IoT) traffic according to the present invention includes:

[0034] Use IoT devices to acquire traffic data;

[0035] The traffic data is input into the anomaly detection model established according to the IoT traffic anomaly detection model establishment method described above, and the traffic anomaly detection classification result is obtained.

[0036] Based on the classification results, select abnormal IoT traffic. Attached Figure Description

[0037] Figure 1 This is a flowchart illustrating the method for establishing an IoT traffic anomaly detection model according to an embodiment of the present invention.

[0038] Figure 2This is a schematic diagram of the hierarchical sample selection mechanism in a federated learning environment according to an embodiment of the present invention.

[0039] Figure 3 This is a schematic diagram of the TCN model according to an embodiment of the present invention;

[0040] Figure 4 This is a schematic diagram illustrating the calculation process of one-dimensional dilated causal convolution in the TCN model of this invention.

[0041] Figure 5 This is a schematic diagram of the stacked sparse autoencoder according to an embodiment of the present invention;

[0042] Figure 6 This is a schematic diagram of the experimental results verifying the feasibility of the SSAE-TCN anomaly detection model under federated learning in an embodiment of the present invention;

[0043] Figure 7 This is a schematic diagram illustrating the experimental results of the impact of the anomaly detection client of this invention on the IoT data anomaly detection model in a federated learning environment.

[0044] Figure 8 This is a schematic diagram illustrating the experimental results of the impact of high-quality sample data on the IoT data anomaly detection model in a federated learning environment, according to an embodiment of the present invention. Detailed Implementation

[0045] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0046] This invention provides a method for establishing an IoT traffic anomaly detection model implemented in a federated learning environment. Federated learning is a framework based on distributed machine learning. Its main idea is to enable a large number of edge devices (referred to as clients) capable of storing local data and performing various calculations and applications to collaboratively train a global machine learning model using the data generated on the device itself, without having to share their original data to obtain the training model.

[0047] Reference Figure 1 As shown, an embodiment of the present invention provides a method for establishing an IoT traffic anomaly detection model, comprising:

[0048] Step S100: The client obtains traffic data sent by the IoT device.

[0049] Specifically, the client connects to IoT devices (such as surveillance cameras) via methods such as Bluetooth or Wi-Fi, and the client can obtain data transmitted by the IoT devices at any time.

[0050] Step S200: The client constructs a local model corresponding to the global model based on the initial model parameters sent by the server, wherein the global model and the local model are TCN models.

[0051] Specifically, based on federated learning, the server constructs an initial global model, namely the TCN model, and sends the initial model parameters of the initial global model to the client. The client constructs a local model, namely the TCN model, corresponding to the global model based on the initial model parameters sent by the server.

[0052] In the TCN model, causal convolution enables the model to handle causal relationships in time-series data, ensuring unidirectional data transmission. Dilated convolution allows for interval sampling, expanding the receptive field of convolutional computation and preserving more historical information. Residual units overcome network degradation caused by excessive network depth, reduce computational resource consumption, improve training and prediction stability, and make training deep networks easier. Therefore, choosing the TCN model to build an anomaly detection model can excellently accomplish anomaly detection tasks.

[0053] Step S300: The client trains the local model based on the traffic data to obtain training performance data, and transmits the training performance data to the server.

[0054] Specifically, the client trains a local model based on the acquired traffic data, obtaining training performance data. This performance data includes the training loss of the local model and the amount of training data received by the client. The client then sends this training performance data to the server. To define the local model quality evaluation process for each client, an e-dimensional vector w is used to represent the parameters in the federated learning model. In the t-th round, the objective function of the global model is obtained as follows:

[0055]

[0056] Where t represents the t-th round of global model iteration, and i represents the client. The model parameters are obtained by client i based on local data (xi, yi). Let K be the model loss function for client i, and K be the number of clients participating in federated learning. Let represent the total amount of data. As shown in the objective function above, the number of clients and the training loss of the local model play a crucial role in evaluating the local model parameters. For each client's uploaded model parameters, there is a calculable prediction error. This prediction error is highly dependent on the detection accuracy of the local model; for example, a large prediction error means that the selected client's state is likely to deviate from the normal state of other devices. The amount of data from each client represents the amount of data participating in model training. The larger the amount of data, the more effectively the client trains the model, and the lower the probability of skewed distributions and extreme cases. Therefore, the training loss of the local model and the amount of training data from each client are used as training performance data.

[0057] Step S400: The server scores the training performance data uploaded by each client and selects the clients to participate in global model aggregation based on the scoring results.

[0058] Specifically, the server receives training performance data sent by each client, scores the training performance data sent by each client according to a preset scoring mechanism, and uses an aggregation algorithm to filter each client based on the scoring results, selecting clients to participate in global model aggregation, thereby controlling the accuracy of the anomaly detection model at the node level.

[0059] Step S500: The client participating in the global model aggregation uses a classifier to filter the traffic data to obtain sample data, trains the local model based on the sample data, obtains the local model parameters when the local model converges, and sends the local model parameters to the server.

[0060] Specifically, after being selected through a scoring mechanism, the selected clients use a data classifier to filter the traffic data participating in the local model training, obtaining high-quality traffic data as sample data. This data-level filtering of traffic data aims to obtain high-quality model parameters to update the global model. A hierarchical sample selection mechanism is employed to control the accuracy of the anomaly detection model at both the node and data levels, thereby improving model construction and detection efficiency. The local model is trained based on the sample data until it converges, obtaining the local model parameters of the clients participating in the global model aggregation, and then sending these local model parameters to the server.

[0061] Step S600: The server updates the global model according to the parameters of each local model, sends the updated global model parameters to each client, returns to the step of constructing the local model, iteratively updates the global model until the global model converges, and obtains the anomaly detection model.

[0062] Specifically, the server performs calculations on the local model parameters transmitted by each client, such as by calculating the average value, to obtain the optimal model parameters. The global model is then updated based on the optimal model parameters. Steps S200 and S300 are then repeated to iteratively obtain the local model parameters and update the global model until the global model converges, thus obtaining the anomaly detection model.

[0063] Furthermore, such as Figure 2 As shown, the hierarchical sample selection mechanism under federated learning is as follows, where client model 3 is the abnormal client selected through a scoring mechanism. The process is as follows: Step 1: Initialization. The server confirms the task and objective of training the anomaly detection model, initializes the model parameters, and broadcasts them to all participating clients. Step 2: Local model training is performed using the initialized model parameters to obtain training performance data. Step 3: The local model training performance data is transmitted. Step 4: Based on the model performance data of each client, the server calculates the score of each client using the scoring mechanism and selects the client for global model aggregation. Step 5: Information is returned to the selected clients. Step 6: Data classification is performed to obtain sample data, and local model training is performed based on the sample data to obtain model parameters. Step 7: The client transmits the local model parameters. Step 8: The global model parameters are iteratively updated based on the model parameters.

[0064] In this embodiment, the client acquires traffic data sent by IoT devices as the dataset for building the IoT anomaly detection model, ensuring the normal operation of the anomaly detection model building process. The client constructs a local model corresponding to the global model based on the initial model parameters sent by the server. Both the global and local models are TCN models. Using a TCN model as the anomaly detection model allows for better control over the memory size of the anomaly detection model and the retention of longer historical information, reducing computational resource consumption and improving the stability of training and prediction. The client trains the local model based on the traffic data, obtaining training performance data, and transmits the training performance data to the server. A hierarchical sample selection mechanism is used, filtering at both the node and data levels. Specifically, the server scores the training performance data uploaded by each client and selects clients to participate in global model aggregation based on the scoring results. This node-level selection, i.e., client-level selection, avoids the influence of malicious clients on the anomaly detection model construction in federated learning, achieving control over the accuracy of the anomaly detection model. Clients participating in global model aggregation use a classifier to filter the traffic data, obtaining sample data, and train local models based on the sample data, obtaining the local model parameters at convergence, and sending the local model parameters to the server. A classifier is used to classify data, avoiding the impact of malicious or fake data on the anomaly detection model construction, thus controlling the quality of the anomaly detection model construction and detection at the data level. A hierarchical sample selection mechanism is adopted to screen client and training data separately, effectively eliminating the impact of abnormal clients on the accuracy of the anomaly detection model in the federated learning environment, reducing the probability of low-quality data participating in the anomaly detection model construction, and controlling the model training at the node and data levels, effectively improving the accuracy of the anomaly detection model. The server updates the global model based on the parameters of each local model and sends the updated global model parameters to each client. It then returns to execute the local model construction steps, iteratively updating the global model until the global model converges, obtaining the anomaly detection model. The global model is updated using the local model parameters obtained by training with high-quality sample data, effectively reducing the number of global model iterations and improving the construction efficiency and accuracy of the IoT traffic anomaly detection model, thus constructing an efficient and accurate IoT traffic anomaly detection model.

[0065] Optionally, the server scores the training performance data uploaded by each client and selects the clients to participate in global model aggregation based on the scoring results, including:

[0066] The server receives the training performance data sent by each client, scores the training performance data according to the scoring algorithm, obtains the scoring results, calculates the Manhattan similarity between each client based on the scoring results, clusters the clients using the Mini Batch K-Means algorithm based on the Manhattan similarity between each client, selects the clients to participate in global model aggregation, and returns information to the selected clients.

[0067] Specifically, after the client performs initial training on a local model based on traffic data, it sends the obtained training performance data (i.e., model loss and training data volume) to the server. The server scores the training performance data sent by each client according to a scoring mechanism. During the process of each client sending training performance data to the server, there is a possibility that malicious clients may transmit fake data for profit. Therefore, Manhattan similarity is calculated based on the scoring results to eliminate the influence of fake data on client selection. The Manhattan similarity calculation process is shown in the formula:

[0068]

[0069] Among them, Similarity man For Manhattan similarity, score i The score for the i client. j The score for client j i -score j Let $n$ be the score difference between client $i$ and client $j$, and $n$ be the amount of training data. The Mini Batch K-Means algorithm is an optimized variant of the K-Means algorithm. It's a clustering model that maintains clustering accuracy while significantly reducing computation time, and it still attempts to optimize the objective function. "Mini Batch" refers to a randomly selected subset of data for each training iteration. Using this randomly selected data greatly reduces computation and convergence time. Considering the potential large number of clients in practical applications, quickly completing the classification task is crucial. Therefore, the Mini Batch K-Means algorithm is chosen to perform the client selection task based on similarity data. Based on the Manhattan similarity between clients, the Mini Batch K-Means clustering algorithm clusters each client, quickly identifying clients participating in the global model aggregation and filtering out abnormal clients to increase the efficiency of the anomaly detection model. After selecting the clients participating in the global model aggregation, the server returns information to the selected clients, prompting them to perform data filtering.

[0070] In this embodiment, the server uses a scoring mechanism to score the training performance data sent by each client. Then, based on the scoring results, it calculates the Manhattan similarity between each client. This Manhattan similarity is used as a condition for client selection, preventing abnormal clients from transmitting fraudulent data that could affect the accuracy of client selection. This further enhances the credibility of the selected client based on the scoring mechanism. Using the Mini Batch K-Means clustering algorithm for the client selection task reduces client clustering time, enabling rapid client selection and thus increasing the efficiency of anomaly detection model establishment.

[0071] Optionally, the clients participating in the global model aggregation use a classifier to filter the traffic data to obtain sample data, including:

[0072] The client participating in the global model aggregation receives the information returned by the server, and classifies the traffic data using a random forest classifier based on the information to obtain the sample data.

[0073] Specifically, the client receives information returned by the server, uses a random forest classifier to classify the traffic data, and obtains sample data. The random forest classifier is a classifier that contains multiple decision trees, integrates all classification voting results, and designates the category with the most votes as the final output, thereby improving the effectiveness of classification. At the same time, the random forest classifier has advantages such as high accuracy, fast processing speed, and the ability to run effectively on large datasets. After the data is classified by the random forest classifier, sample data is obtained. A high-quality local model is trained based on the high-quality sample data. The global model obtained after aggregation on the server has a faster convergence speed and higher accuracy.

[0074] In this embodiment, a random forest classifier is used to classify traffic data, obtaining high-quality sample data with high accuracy for local model training. This significantly increases the accuracy of data classification, thereby improving the accuracy of the anomaly detection model. The random forest classifier has advantages such as fast processing speed and efficient operation on large datasets, effectively improving the efficiency of anomaly detection model construction and its generalization ability.

[0075] Optionally, the server scores the training performance data uploaded by each client, including:

[0076] The server calculates the score of the training performance data according to a first formula, which is expressed as follows:

[0077]

[0078] in, Let i be the score of the i-th client in the t-th round. Let n be the model loss during the training of the anomaly detection model for the i-th client in the t-th round of aggregation. i Let N be the amount of training data for the i-th client, N be the total amount of training data for all clients, and K be the classification of the anomaly detection model. The anomaly detection model is a binary classification model, and the value of K is 0 or 1.

[0079] Specifically, the client receives the initial model parameters sent by the server, updates the local model, and then trains the local model based on traffic data to obtain the output and target values. The model loss function is the negative log-likelihood loss (NLL loss), which is used to calculate the model loss using the model output and target value.

[0080] L=-∑ k target k log pred k ,

[0081] Where L is the loss function, k is the classification factor (since the anomaly detection model is a binary classification model, k can take values ​​of 0 or 1), and target... k The probability of a target value of k for each data point; pred k This represents the probability that the model's predicted output value is k.

[0082] The client transmits the calculated model loss and the amount of data within the client to the server. The server calculates the score of the training performance data according to the first formula, evaluates and selects clients based on the scores, and selects clients with higher security for the data screening step. This controls the quality of model construction by selecting outliers at the node level.

[0083] In this embodiment, the first formula is used to calculate the score of the training performance data of each client, which can effectively improve the calculation accuracy. The client is selected based on the score results, and the quality of the anomaly detection model construction is controlled at the node level, thereby increasing the accuracy of client selection.

[0084] Optionally, the TCN model includes two dilated causal convolutional units and a nonlinear mapping layer. Each dilated causal convolutional unit sequentially includes a one-dimensional dilated causal convolution, a weight normalization layer, a ReLU activation function layer, and a dropout operation layer. The nonlinear mapping layer is used to perform a nonlinear transformation between the output of the dilated causal convolutional unit and the input to obtain the output of the TCN model.

[0085] Specifically, such as Figure 3As shown, the residual unit of the TCN model includes two layers of dilated causal convolutional units. Each layer of dilated causal convolutional units includes a one-dimensional dilated causal convolution, weight normalization, a ReLU (Rectified Linear Units) activation function, and parameter regularization dropout operation. The input x is processed by the two layers of dilated causal convolutional units and then output. The calculation process of the one-dimensional dilated causal convolution is as follows: Figure 4 As shown, for a one-dimensional input sequence, the dilation factor typically increases exponentially by a power of 2. The dilated convolution operation performs the following calculation on the input sequence data:

[0086]

[0087] Where F(s) is the dilated convolution operation performed on the input sequence data s, k is the kernel size, f is the filter function, x is the input sequence, d is the dilation factor, and x s-d*i This is historical data. The output is obtained by performing a nonlinear transformation on the input and the output after residual unit transformation using an activation function. The calculation process can be described by the formula:

[0088] output=Activation(G(x)+x),

[0089] Where output is the TCN model output, G(x) is the residual unit output, and x is the input.

[0090] In this embodiment, the TCN model is adopted. Causal convolution enables the model to process causal relationships in time-series data, ensuring the unidirectional nature of data transmission. Dilated convolution enables interval sampling, expands the receptive field of convolutional computation, retains more historical information, overcomes the network degradation problem caused by excessive network depth, reduces computational resource consumption, improves the stability of training and prediction, and makes training deep networks easier.

[0091] Optionally, obtaining the traffic data sent by the IoT device includes:

[0092] The traffic data sent by the IoT device is acquired, and the traffic data is preprocessed to obtain preprocessed traffic data, wherein the preprocessing includes data normalization.

[0093] Specifically, due to the instability of the operating environment of IoT devices, the values ​​in the data collected by IoT devices may be missing. Such data input into the anomaly detection process may cause deviations or even prevent the anomaly detection process from being performed. After the client receives the initial traffic data transmitted by IoT devices (such as surveillance cameras), it preprocesses the initial traffic data, such as data normalization, processing np.inf data, and deleting rows containing NaN data, which effectively reduces the impact of missing or noisy raw data on the accuracy of the anomaly detection model.

[0094] In this embodiment, the acquired initial traffic data is preprocessed, which effectively reduces the impact of missing or noisy raw data on the construction of the anomaly detection model and increases the accuracy of the anomaly detection model.

[0095] Optionally, before the client constructs a local model corresponding to the global model based on the model parameters sent by the server, the method for establishing the IoT traffic anomaly detection model further includes:

[0096] Construct an autoencoder and train the preset autoencoder based on the traffic data to obtain a stacked sparse autoencoder.

[0097] The preprocessed traffic data is input into the stacked sparse autoencoder for encoding to obtain the encoded traffic data.

[0098] Optionally, the construction of the autoencoder includes:

[0099] The client invokes multiple sparse autoencoders, each comprising an input layer, a hidden layer, and an output layer, and sorts these sparse autoencoders in ascending order of the number of neurons in the hidden layer.

[0100] The input and hidden layers of the first sparse autoencoder, the hidden and output layers of the last sparse autoencoder, and the hidden layers of the remaining sparse autoencoders are retained. Adjacent sparse autoencoders are sequentially connected through the hidden layers to construct the pre-trained stacked sparse autoencoder.

[0101] Specifically, considering the contextual features, dimensional features, privacy protection, data storage, and communication overhead of IoT traffic data, a Stacked Autoencoder (SAE) and a Sparse Autoencoder are combined to construct a Stacked Sparse Autoencoder (SSAE). This allows for the retention of more data within limited memory, effectively extracting features layer by layer, better preserving the characteristics of time-series data, and obtaining well-represented low-dimensional data to improve the generalization ability of the autoencoder. Figure 5 As shown, a stacked sparse autoencoder (SAO) combines a stacked autoencoder with a sparse autoencoder, forming a neural network structure composed of multiple single-layer basic sparse autoencoders. Each sparse autoencoder includes an input layer, a hidden layer, and an output layer. Multiple single-layer sparse autoencoders are obtained and sorted in ascending order of the number of neurons in their hidden layers. The first SAO has the fewest hidden layer neurons, and the last SAO has the most. The input and hidden layers of the first SAO are retained, as are the hidden and output layers of the last SAO. The remaining SAOs retain only their hidden layers. These processed SAOs are then sequentially connected through their hidden layers to cascade, forming a stacked sparse autoencoder. When initial traffic data is input, layer-by-layer feature extraction is performed to discover inherent patterns among the data features and preserve low-dimensional data with good representation as much as possible. The pre-constructed autoencoder is then trained based on the pre-processed traffic data to obtain the trained stacked sparse autoencoder. Among them, based on federated learning, the SSAE-TCN model, which combines stacked sparse autoencoders with a global model, serves as the basic model for anomaly detection. This can effectively improve anomaly detection efficiency and reduce the memory requirements, time overhead, and data storage overhead of anomaly detection tasks.

[0102] The raw data acquired by IoT devices is one-dimensional time series data. One-dimensional time series data is usually large in volume and complex in structure. Using raw data to perform anomaly detection usually involves large computational overhead and long delay. Therefore, the preprocessed traffic data is input into a trained stacked sparse autoencoder to encode the traffic data. The encoded traffic data is then used to train the local model, which effectively reduces the dimensionality of the raw data and reduces the computational complexity of the data.

[0103] In this embodiment, a stacked sparse autoencoder is constructed and used to encode traffic data. This can reveal the inherent patterns between data features, reduce the dimensionality of one-dimensional time series data layer by layer, extract features from the data layer by layer, better preserve the features of time series data, obtain low-dimensional data with good representation, reduce the computational complexity of data, and thus increase the computational efficiency of the anomaly detection model.

[0104] Optionally, before the client constructs a local model corresponding to the global model based on the initial model parameters sent by the server, the method for establishing the IoT traffic anomaly detection model further includes:

[0105] The server confirms the task and objective of training the anomaly detection model, constructs the global model based on the task and objective, obtains the initial model parameters of the global model, and broadcasts the initial model parameters to the client.

[0106] Specifically, the server initializes itself, confirms the task and objective of training the anomaly detection model, uses the TCN model to build an initial global model, obtains the corresponding global model parameters, and broadcasts the corresponding initial model parameters to all clients participating in the traffic detection model construction. The clients update their local models, i.e., the TCN models, based on the global model parameters for subsequent model training.

[0107] In this embodiment, the server constructs a global model and obtains the corresponding initial model parameters, then broadcasts the initial model parameters to the client to update the local model, ensuring the normal operation of the anomaly detection model construction. At the same time, by unifying the parameters of the local model and the global model, the accuracy of the anomaly detection model construction is effectively improved.

[0108] Furthermore, to verify that the SSAE-TCN model constructed by combining the stacked sparse autoencoder and the TCN model proposed in this embodiment has good data representation for anomaly detection tasks, a comparative experiment was conducted using data encoded by the stacked sparse autoencoder and the original data. Anomaly detection classification and prediction tasks based on the TCN model were executed respectively, and the performance of the two types of data in anomaly detection tasks was compared. The experimental results are shown in the table below:

[0109]

[0110] The experimental data in the table demonstrates that the anomaly detection accuracy using encoded data is 98.12%, precision is 98.90%, recall is 98.43%, and F1 score is 0.9871. These performance metrics are comparable to those of the model using the original data for classification tasks, indicating that encoding does not significantly reduce data quality for anomaly detection, proving that the data retains good representation after feature extraction. Secondly, the training time for the anomaly detection model is significantly reduced compared to unencoded data, decreasing from 106.66 minutes to 38.56 minutes. This demonstrates that encoded data effectively reduces data dimensionality, thereby lowering the computational and time costs for edge devices. Furthermore, the number of training epochs required for convergence using encoded data is significantly less than that using the original data, without compromising the anomaly detection evaluation metrics. Therefore, stacked sparse autoencoders can be applied to dimensionality reduction for IoT data and improve the overall efficiency of anomaly detection. The experimental data above demonstrates that feature extraction using stacked sparse autoencoders can significantly reduce the feature dimensionality of the training data while preserving good data representation. Reducing the dimensionality of data features can significantly decrease the computation time and memory overhead of anomaly detection tasks, making the prediction and classification model more efficient and lightweight.

[0111] Furthermore, various comparative algorithms were used to verify the effectiveness of the SSAE-TCN model, including variants of recurrent neural network algorithms widely used in time-series data processing: Long Short-Term Memory (LSTM) artificial neural networks, Gated Recurrent Units (GRUs), and the TCN model. The test results for the performance of different models and evaluation metrics are shown in the table below.

[0112]

[0113] The experimental results in the table show that, in a centralized anomaly detection environment, the proposed anomaly detection method achieves an accuracy of 98.62%, precision of 98.90%, recall of 98.43%, and an F1 score of 0.9871. Compared to the comparative method used in the experiment, the proposed SSAE-TCN anomaly detection model demonstrates superior classification performance. Furthermore, the experimental comparison shows that the proposed SSAE-TCN anomaly detection model consumes significantly less memory and has less training time than standard methods based on LSTM, GRU, and TCN models, while exhibiting better classification performance. These experimental data demonstrate that the proposed SSAE-TCN model can efficiently complete IoT data anomaly detection tasks compared to RNN algorithms.

[0114] Furthermore, the detection performance of the model obtained by centralized anomaly detection is the target of the detection performance of the global model obtained by iterative aggregation of local models in a federated learning environment. To verify the feasibility of the proposed SSAE-TCN anomaly detection method under federated learning, experimental verification was conducted. The experiment still used the CIC-IDS-2017 dataset. The experiment for IoT data anomaly detection under federated learning was set with 10 clients. Data from each client was stratified and sampled from the training dataset. The distribution of the client data after partitioning was kept as similar as possible to the original training dataset, and the amount of training data for each client was kept average. Under federated learning, the global model obtained by performing 3 rounds of local updates and 10 rounds of global updates was compared with the performance of centralized anomaly detection after 10 iterations. Figure 6 As shown. From Figure 6 As can be seen, compared to the results of centralized anomaly detection trained on global data, the global model trained on local data and then aggregated globally achieves an accuracy of around 97% after multiple iterations in a federated learning environment. Although this is lower than the over 98% accuracy of centralized anomaly detection after stabilization, it still demonstrates good anomaly detection performance. Furthermore, the federated learning environment requires fewer rounds of global aggregation to converge. Therefore, the anomaly detection performance of the global model trained by federated learning is within an acceptable range.

[0115] Furthermore, to examine the impact of anomalous clients on IoT data anomaly detection in a federated learning environment, experiments were conducted. The training and testing data for each client's anomaly detection were derived from the CIC-IDS-2017 dataset. The training data differed among clients, and the testing data was used to test the performance of the global model generated after global aggregation. The attack dataset was sampled from the CIC-IDS-2017 dataset, mixed with a high proportion of tampered data as the attack client's data sample. The attack client's intention was to cause the model to make incorrect judgments based on the input data features. To simulate the situation where malicious clients tamper with training data and the data samples are poisoned, the experiment assumed that the attack client had a white-box environment. Therefore, anomalous client data could be generated from correct data through label inversion. To simulate a federated learning scenario, the experimental environment included 10 clients. Each client was assigned a separate training dataset. The training data for normal clients were set according to the temporal order of the dataset. To verify the effectiveness of the client selection mechanism, 10 clients were configured to perform local training tasks, with one client using the attack dataset as its local training dataset. The test results of the global model obtained with and without client selection are described as follows: Figure 7As shown. From Figure 7 The results show that without client selection, the participation of local models with outlier data in global aggregation negatively impacts the overall model performance, causing the test accuracy after multiple rounds of global model updates to drop from over 97% to 85%. In contrast, after client selection, only nine clients trained on normal datasets participate in the global model computation. These two scenarios demonstrate the effectiveness of the client selection method based on client performance.

[0116] Furthermore, each client has multiple labeled samples. However, the goal of global model aggregation is to obtain a global model with faster convergence and higher accuracy than existing solutions. Therefore, it is necessary to select high-quality samples for the target task, as high-quality samples have a positive impact on the global model. A random forest classifier will be used to filter the client data, and the training performance of the global model obtained after data filtering will be compared with that of a local model trained on one of the clients without data filtering. The results are as follows. Figure 8 As shown. According to Figure 8 It can be seen that data filtering can better complete the training process of the local model. The global model, after being filtered by various clients, shows better performance, proving the effectiveness of the proposed data filtering method. Experimental results verify that the proposed hierarchical sample selection mechanism achieves accurate and efficient selection of high-quality data samples, thus obtaining a global model with faster convergence speed and higher accuracy than existing solutions.

[0117] This invention also provides a method for detecting abnormal Internet of Things (IoT) traffic, including:

[0118] Use IoT devices to acquire traffic data.

[0119] The traffic data is input into the anomaly detection model established according to the IoT traffic anomaly detection model establishment method described above, and the traffic anomaly detection classification result is obtained.

[0120] Based on the classification results, select abnormal IoT traffic.

[0121] Specifically, raw traffic data is acquired using IoT devices (such as smart cameras), input into the trained IoT traffic anomaly detection model, output classification results, and IoT abnormal traffic is filtered out based on the classification results.

[0122] In this embodiment, raw traffic data obtained by IoT devices (such as smart cameras) is input into the IoT traffic anomaly detection model to obtain accurate IoT traffic detection results. Based on this, abnormal IoT traffic is efficiently and accurately filtered out, enabling normal communication of IoT applications and effectively improving the security of IoT application communication.

[0123] While the disclosure is as stated above, its scope of protection is not limited thereto. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of this disclosure, and all such changes and modifications will fall within the protection scope of this invention.

Claims

1.A method for establishing an Internet of Things traffic anomaly detection model, characterized in that, The method comprises the following steps: A client obtains traffic data sent by an Internet of Things device; The client constructs an autoencoder, trains the preset autoencoder according to the traffic data, and obtains a stacked sparse autoencoder; The client inputs the preprocessed traffic data into the stacked sparse autoencoder for encoding, and obtains encoded traffic data; The construction of the autoencoder comprises the following steps: the client calls a plurality of sparse autoencoders, the sparse autoencoders comprise an input layer, a hidden layer and an output layer, the plurality of sparse autoencoders are sorted in ascending order according to the number of neurons in the hidden layer, the input layer and the hidden layer of the first sparse autoencoder are retained, the hidden layer and the output layer of the last sparse autoencoder are retained, and the hidden layers of the remaining sparse autoencoders are retained, the adjacent sparse autoencoders are sequentially connected through the hidden layers, and a pre-trained stacked sparse autoencoder is constructed; The client constructs a local model corresponding to a global model according to initial model parameters sent by a server, wherein the global model and the local model are TCN models; The client trains the local model according to the traffic data, obtains training performance data, and transmits the training performance data to the server; The server scores the training performance data uploaded by each client, and selects the clients participating in global model aggregation according to the scoring results; The clients participating in global model aggregation use a classifier to filter the traffic data to obtain sample data, train the local model according to the sample data, obtain local model parameters when the local model converges, and send the local model parameters to the server; The server updates the global model according to each local model parameter, sends model parameters of the updated global model to each client, returns to the step of constructing the local model, iteratively updates the global model until the global model converges, and obtains an anomaly detection model. 2.The method of claim 1, wherein, The server receives the training performance data sent by each client, scores the training performance data according to a scoring algorithm, obtains scoring results, calculates Manhattan similarity between each client according to the scoring results, clusters the clients by using a Mini Batch K-Means algorithm according to the Manhattan similarity between each client, selects the clients participating in global model aggregation, and returns information to the selected clients. The clients participating in global model aggregation receive the information returned by the server, classify the traffic data by using a random forest classifier according to the information, and obtain the sample data. 3.The method of claim 2, wherein, The clients participating in global model aggregation receive the information returned by the server, classify the traffic data by using a random forest classifier according to the information, and obtain the sample data. ​ 4.The method of claim 2, wherein, The service end scores the training performance data uploaded by each of the client ends, and the scoring includes: The service end calculates the score of the training performance data according to a first formula, and the first formula is expressed as: = / ， wherein, is the score of the i-th client in the t-th round, is the model loss of the i-th client in the t-th round of the training of the anomaly detection model, is the training data volume of the i-th client, is the total training data volume of each client, K is the classification of the anomaly detection model, the anomaly detection model is a binary classification model, and the value of K is 0 and 1. 5.The method of claim 1, wherein, The TCN model includes two dilated causal convolution units and a nonlinear mapping layer, each dilated causal convolution unit sequentially includes a one-dimensional dilated causal convolution, a weight normalization layer, a ReLU activation function layer and a dropout operation layer, and the nonlinear mapping layer is used to perform nonlinear transformation on the output and input of the dilated causal convolution unit to obtain the output of the TCN model. 6.The method of claim 1, wherein, The traffic data sent by the Internet of Things device includes: Obtaining the traffic data sent by the Internet of Things device, preprocessing the traffic data to obtain preprocessed traffic data, wherein the preprocessing includes data normalization. 7.The method of claim 1, wherein, Before the client constructs a local model corresponding to the global model according to the initial model parameters sent by the service end, the method for establishing the Internet of Things traffic anomaly detection model further includes: The service end confirms the task and target of the anomaly detection model training, constructs the global model according to the task and target of the anomaly detection model training, and obtains the initial model parameters of the global model, and broadcasts the initial model parameters to the client. 8.A method for detecting abnormal traffic of Internet of Things, characterized in that, It includes: Obtaining traffic data by using an Internet of Things device; Inputting the traffic data into the anomaly detection model established by the method for establishing an Internet of Things traffic anomaly detection model according to any one of claims 1 to 7 to obtain a traffic anomaly detection classification result; According to the classification result, selecting Internet of Things abnormal traffic.

Images