A covert communication detection method based on federated learning
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NANJING UNIV OF SCI & TECH
- Filing Date
- 2022-12-12
- Publication Date
- 2026-05-12
AI Technical Summary
Existing methods for detecting covert communication are at risk of data leakage and misuse in highly adversarial environments, and also face the problem of data imbalance. Centralized training modes are difficult to effectively detect covert communication.
A federated learning-based approach is adopted, in which local data training and model updates are performed on the user end, a binary classification FNN neural network is used for covert communication detection, and the central server performs model aggregation and updates, avoiding the transmission of raw data. The Tanh activation function and backpropagation algorithm are used to optimize the model.
It saves communication resources, protects data security, has better adaptability, can detect physical layer covert communication without prior information, and reduces algorithm complexity.
Smart Images
Figure CN115795548B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of wireless communication technology, specifically a covert communication detection method based on federated learning. Background Technology
[0002] Covert communication, also known as low probability of detection (LPD) or low probability of intercept (LPI) communication, is often used in secure communication. In the field of privacy protection, covert communication serves as a means of leaking private or confidential information, making it necessary to detect potential covert communications to protect the information security of individuals and organizations. In the field of military confrontation, covert communication, as a type of secure communication characterized by low detection and low interception, is used to transmit information of significant value. For the adversary, detecting and cracking enemy secure communications is a means of achieving this, possessing significant strategic value.
[0003] Developed specifically to counter detection methods, conventional security detection techniques struggle to effectively detect covert communications. Advances in machine learning have made it possible to detect covert communications using machine learning. Developments in electronic hardware have solved the problem of excessively large datasets that once plagued machine learning. Now, combined with big data, machine learning has become a widely applied discipline, integrating psychology, biology, neurophysiology, mathematics, automation, and computer science. In the field of communications, the time-frequency characteristics of signals, data packets, and feature frame structures provide rich labeling information for machine learning.
[0004] Detection of network-layer covert channels essentially involves pattern matching of the flag bits of anomalous network-layer message segments. The detection approach first performs Singular Value Decomposition (SVD) and Principal Component Analysis (PCA) on the tensed network time covert channel message segment information to achieve dimensionality reduction and reconstruction. Then, supervised learning algorithms such as improved Support Vector Machines (SVM) and K-Nearest Neighbors (KNN) are used for multi-classification, ultimately achieving the detection of suspicious message sequences at the network layer. The paper "Timing Covert Channels Detection Cases via Machine Learning" addresses the dilemma of balancing recall and detection complexity in physical-layer covert channels, proposing a network time covert channel detection method based on random forests. Furthermore, it expands statistical feature indicators, ultimately improving classifier classification performance while reducing the overall algorithm complexity.
[0005] However, existing machine learning detection methods for covert communication all employ a centralized training model, requiring the collection of large amounts of user data before training. This process carries the risk of data leakage and misuse of user data, a drawback that is particularly pronounced in highly adversarial environments. Furthermore, the original datasets for covert communication often suffer from imbalanced data. Summary of the Invention
[0006] To address the aforementioned technical deficiencies in existing technologies, this invention proposes a covert communication detection method based on federated learning.
[0007] The technical solution to achieve the objective of this invention is: a covert communication detection method based on federated learning, comprising the following steps:
[0008] (10) User data processing: Store the physical layer bit stream signal sample data carrying covert information transmitted by several time slot antennas in the form of a matrix;
[0009] (20) Training parameter initialization: Determine the global model and initialize the global model on the central server;
[0010] (30) Initial model distribution: The central server distributes the initialized global model to the users;
[0011] (40) Local Model Training: Participating nodes download the global model from the central server and use the downloaded global model as the local model, using local data to train and update the local model;
[0012] (50) Global model aggregation: Participating nodes upload their local models to the central server. After receiving all the local models, the central server performs model aggregation and updates to form a new global model.
[0013] (60) Global model distribution: The central server distributes the new global model to all training nodes and determines whether the global model training update count has reached the required number. If it has, proceed to step (70); otherwise, return to step (40).
[0014] (70) Covert communication detection: The user uses the final updated global model to detect local data, determine whether the physical layer signal contains covert communication data, and complete the classification and detection task.
[0015] Preferably, the global model employs a binary classification FNN neural network.
[0016] Preferably, the activation function of the binary classification FNN neural network is the Tanh activation function:
[0017]
[0018] In the formula, x represents the output of a neuron in the neural network, and y represents the final judgment result.
[0019] Preferably, the global model distributed by the central server is used as the local model, and the specific method for training and updating the local model using local data is as follows:
[0020] (41) Use the data stored in step (10) as the training samples {{x} (1) ,y (1)}…{x (n) ,y (n)}};
[0021] In the formula, x represents the sample data, and y represents the classification label of the corresponding sample data;
[0022] (42) Forward propagation training of network weights:
[0023] z l =w l a l-1 +b l ,a l =σ(z) l )
[0024] In the formula, l and l-1 represent the layer number of the neuron, a represents the input of the neuron connection, w is the weight of the neuron corresponding to the input, z represents the output of the neuron, b is the corresponding bias, σ(z) represents the activation function, and a l This represents the input that neurons in this layer pass to neurons in the next layer.
[0025] (43) Calculate the error of the model output layer:
[0026]
[0027] In the formula, J represents the loss function of the model. Let σ'(z) represent the gradient of the loss function, ⊙ be the Hadamard product of the matrices, and σ'(z) be the gradient of the loss function. L ) represents the matrix formed by the outputs of the activation functions of the neurons in the output layer;
[0028] (44) Calculate the error of each layer of neurons using the backpropagation algorithm:
[0029] δ l =((w l+1 ) T δ l+1 )⊙σ′(z l )
[0030] In the formula, l, l+1 represent the layer number of the neuron, σ′(z l ) is a matrix that arranges the activation function outputs of neurons in this layer, δ l+1 It is the activation value of neurons in layer l+1, (w l+1 ) T It is the transpose of the input weights of neurons in layer l+1, ⊙ is the Hadamard product of the matrices, and δ l It is the final activation value of the neurons in layer l;
[0031] (45) Weight parameters of gradient descent neural network:
[0032]
[0033]
[0034] In the formula, η represents the learning rate, and m is the amount of local user data;
[0035] Determine whether the number of iterations has reached the set total number of iterations E. If it has, proceed to step (50); otherwise, return to step (41).
[0036] Preferably, the specific formula for global model aggregation is as follows:
[0037]
[0038] In the formula, K represents the number of users. Represents the user's local model. This represents the weight of the local dataset of the k-th user relative to the total dataset of all users. This represents the new global model obtained by weighted averaging.
[0039] Compared with the prior art, the significant advantages of this invention are:
[0040] 1. Saves communication resources: Nodes participating in training do not need to transmit a large amount of raw data to the central server, saving a lot of communication transmission resources, which is particularly advantageous in environments with limited communication resources.
[0041] 2. Protect data security: Nodes participating in the training use local data to train models locally, without having to upload their own data to the central node, thus avoiding the risk of data leakage and misuse.
[0042] 3. Better adaptability: The trained model can detect physical layer covert communication without prior information.
[0043] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description
[0044] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Throughout the drawings, the same reference numerals denote the same parts.
[0045] Figure 1 This invention is a system model for covert communication detection based on federated learning.
[0046] Figure 2 This is a flowchart of a covert communication detection method based on federated learning.
[0047] Figure 3 This is a flowchart of the local training method for nodes participating in the training.
[0048] Figure 4 This is a flowchart of the method for updating the global model in federated learning.
[0049] Figure 5 This is a comparison chart showing the detection accuracy of the FNN network structure under the federated learning framework with other network structures. Detailed Implementation
[0050] It is readily understood that, based on the technical solution of this invention, various embodiments of the invention can be conceived by those skilled in the art without altering the essential spirit of the invention. Therefore, the following detailed embodiments and accompanying drawings are merely illustrative examples of the technical solution of this invention and should not be considered as the entirety of the invention or as limitations or restrictions on the technical solution of this invention. Rather, these embodiments are provided to enable those skilled in the art to gain a more thorough understanding of the invention. Preferred embodiments of the invention are described below in conjunction with the accompanying drawings, which form part of this application and, together with the embodiments of the invention, serve to illustrate the innovative concept of the invention.
[0051] like Figure 1 As shown, the covert communication detection method based on federated learning of this invention includes the following steps:
[0052] (10) During user communication, communication parameters are obtained: The nodes participating in the training prepare sample data of physical layer bit stream signals carrying covert information transmitted by several time slot antennas and store them in matrix form.
[0053] (11) Training parameter confirmation: Determine the number of iterations T and the number of samples m sent to the training in each batch during each round of training.
[0054] (20) Training model initialization: The central server sends the initial training model to each participating node.
[0055] (21) Determine the number of neurons i in the input layer of the model, determine the number of hidden layers k, and determine the number of neurons n1, n1, ... n in the hidden layers. k The output layer is a single neuron, and the model is a binary classification FNN neural network.
[0056] (22) The activation function used is the Tanh activation function:
[0057]
[0058] (23) Determine the initial model weight parameters w0, b0;
[0059] (24) Set the global model training cycle T, the local user training and update cycle E, the global user number M, the number of users randomly participating in the aggregation each time N, the number of iterations K, and the learning rate η.
[0060] (30) Initial model distribution: The central server distributes the initial model w0 to all users.
[0061] (40) The selected users i∈N each perform the following training and update process locally:
[0062] (41) Use the data stored in step (10) as the training samples {{x} (1) ,y (1)}…{x (n) ,y (n)}};
[0063] In the formula, x represents the sample data, and y represents the classification label of the corresponding sample data;
[0064] (42) Forward propagation training of network weights:
[0065] z l =w l a l-1 +b l ,a l =σ(z) l )
[0066] In the formula, l and l-1 represent the layer number of the neuron, a represents the input of the neuron connection, w is the weight of the neuron corresponding to the input, z represents the output of the neuron, b is the corresponding bias, σ(z) represents the activation function, and a l This represents the input that neurons in this layer pass to neurons in the next layer.
[0067] (43) Calculate the error of the model output layer:
[0068]
[0069] In the formula, J represents the loss function of the model. Let σ'(z) represent the gradient of the loss function, ⊙ be the Hadamard product of the matrices, and σ'(z) be the gradient of the loss function. L ) represents the matrix formed by the outputs of the activation functions of the neurons in the output layer;
[0070] (44) Calculate the error of each layer of neurons using the backpropagation algorithm:
[0071] δ l =((w l+1 ) T δ l+1 )⊙σ′(z l )
[0072] In the formula, l, l+1 represent the layer number of the neuron, σ′(z l ) is a matrix that arranges the activation function outputs of neurons in this layer, δ l+1 It is the activation value of neurons in layer l+1, (w l+1 ) T It is the transpose of the input weights of neurons in layer l+1, ⊙ is the Hadamard product of the matrices, and δ l It is the final activation value of the neurons in layer l;
[0073] (45) Weight parameters of gradient descent neural network:
[0074]
[0075]
[0076] In the formula, η represents the learning rate, and m is the amount of local user data;
[0077] Determine whether the number of iterations has reached the set total number of iterations E. If it has, proceed to step (50); otherwise, return to step (41).
[0078] (50) Global model aggregation: The nodes participating in training send the updated model parameters to the central server. The central server collects the model parameters and then updates the global model.
[0079]
[0080] (60) Global Model Distribution: The central server will distribute the updated global model w t+1 Distributed to all users.
[0081] Determine whether the number of iterations has reached the set total number of iterations T. If it has, proceed to step (70); otherwise, return to step (40).
[0082] (70) Covert communication detection: The central server distributes the trained model to all nodes. The nodes that participate in the training use the model to classify the local data that needs to be detected, and complete the physical layer covert communication detection task.
[0083] This invention allows users to keep their data locally and conduct joint training to obtain a global model while ensuring that the user data is not disclosed, and to share the training results, thereby effectively solving the problems of data privacy and security protection.
[0084] The following is a detailed description with reference to the embodiments:
[0085] Example
[0086] First, training samples were prepared for the model input. The training set consisted of 800 frames, each containing 300 packets. The transmitter was equipped with 16 transmitting antennas carrying covert information. The wireless signal underwent independent slow fading channel gain with a complex Gaussian distribution (mean 0, variance 1). The channel matrix remained constant during the transmission of one frame, but changed independently between each frame. The transmitted signal was modulated using Covert QAM. 20% of the time slots carried covert information were modulated, and 25% of the transmitting antennas within those time slots were modulated with constellation offset.
[0087] In the proposed model, the FNN input layer has 16 neurons, and there are 3 hidden layers with 32, 64, and 32 neurons in each hidden layer, respectively. The output layer is a single neuron, and the model is a binary classification FNN neural network.
[0088] The simulation is set to a total number of users M=50. In each round of communication, 30 users will be randomly selected to upload their quantized compressed models to the parameter server for aggregation. The local update frequency is set to 5 times, and the learning rate is 0.01.
[0089] Using the above data settings, the cross-validation set precision, recall, and model precision of the FNN network structure are compared with those of other network structures. Cross-validation set precision reflects the proportion of hidden information detected by the trained classification model out of the total antenna array sample information. Precision, also known as accuracy, is defined in this problem as the percentage of detected antenna array information carrying hidden information. Recall, also known as recall, is defined in this problem as the percentage of hidden information detected by the detection network, and is the key focus of this model. The final experimental results are as follows: Figure 5 As shown.
[0090] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.
[0091] It should be understood that, in order to simplify the present invention and help those skilled in the art understand its various aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes described in a single embodiment or with reference to a single figure. However, the present invention should not be construed as including all features in the exemplary embodiments as essential technical features of the claims of this patent.
[0092] It should be understood that the modules, units, components, etc., included in the device of one embodiment of the present invention can be adaptively changed to be placed in a device different from that embodiment. Different modules, units, or components included in the device of the embodiment can be combined into a single module, unit, or component, or they can be divided into multiple sub-modules, sub-units, or sub-components.
Claims
1. A covert communication detection method based on federated learning, characterized in that, Includes the following steps: (10) User data processing: Store the physical layer bit stream signal sample data carrying covert information transmitted by several time slot antennas in the form of a matrix; (20) Initialization of training parameters: Determine the global model and initialize the global model on the central server; (30) Initial model distribution: The central server distributes the initialized global model to the user; (40) Local Model Training: Participating nodes download the global model from the central server and use the downloaded global model as their local model. They then use local data to train and update the local model. The specific method is as follows: (41) Use the data stored in step (10) as training samples. ; In the formula, x represents the sample data, and y represents the classification label of the corresponding sample data; (42) Forward pass training network weights: In the formula, and This indicates the layer number where the neuron is located, and 'a' represents the input to the neuron's connection. These are the weights of the neurons corresponding to the input. This represents the output of the neuron. It is the corresponding bias. Indicates the activation function; (43) Calculate the error of the model output layer: In the formula, The loss function of the model. The gradient of the loss function is represented. It is the Hadamard product of matrices. This represents the matrix formed by the outputs of the activation functions of the neurons in the output layer. (44) Calculate the error of each layer of neurons using the backpropagation algorithm: In the formula, Indicates the layer number where the neuron is located. It is a matrix formed by arranging the activation function outputs of the neurons in this layer. yes Activation values of layer neurons yes The transpose matrix of the input weights of the layer neurons. It is the Hadamard product of matrices; (45) Weight parameters of gradient descent neural network: In the formula, Indicates the learning rate. It represents the amount of local user data. Determine whether the number of iterations has reached the set total number of iterations E. If it has, proceed to step (50); otherwise, return to step (41). (50) Global model aggregation: Participating nodes upload their local models to the central server. After receiving all the local models, the central server performs model aggregation and updates to form a new global model. (60) Global model distribution: The central server distributes the new global model to all training nodes and determines whether the number of global model training updates has reached the preset total number W. If it has, proceed to step (70); otherwise, return to step (40). (70) Covert communication detection: The user uses the final updated global model to detect local data, determine whether the physical layer signal contains covert communication data, and complete the classification and detection task.
2. The covert communication detection method based on federated learning according to claim 1, characterized in that, The global model employs a binary classification FNN neural network.