Iot intrusion detection model training method and device, and personalized detection method

Abstract

The application provides an Internet of Things intrusion detection model training method and device and a personalized detection method. The method comprises the following steps: based on a personalized federated learning algorithm, a local network traffic data is used to train a personalized model of local Internet of Things intrusion detection, and an Internet of Things intrusion detection model is updated based on the personalized model to obtain updated general model parameters; the updated general model parameters are sent to a server in a federated learning system in which the self is located, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model. The application can guarantee privacy security, effectively overcome data heterogeneity, and train an effective and comprehensive intrusion detection model for an Internet of Things device with a small amount of local data.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of Internet of Things, and in particular to an Internet of Things intrusion detection model training method and device and a personalized detection method. BACKGROUND

[0002] Intrusion detection technology is a technology for ensuring network security, which determines whether there is an external attack by analyzing network data packets. Intrusion detection technology based on neural networks has been widely used in traditional Internet, but there are still some key points to consider in the Internet of Things scenario. First, most existing Internet of Things intrusion detection researches use a centralized manner, which collects Internet of Things device data and sends it to a server for centralized training, which is easy to cause privacy leakage. Second, in the Internet of Things network, different Internet of Things devices are in different environments and face different security threats. The heterogeneity and diversity of the Internet of Things network make it impossible for a single intrusion detection model to conduct comprehensive and effective intrusion detection. Finally, some Internet of Things devices may have less local data, which cannot train an effective and comprehensive intrusion detection model. When a new attack occurs, the model cannot detect unknown attacks.

[0003] The prior art considers the privacy and security problem of intrusion detection in the Internet of Things scenario, and combines the intrusion detection model with federated learning. However, it does not consider the data heterogeneity problem of Internet of Things devices, and only uses traditional federated learning algorithm, assuming that the intrusion detection model parameters of each Internet of Things device are consistent, but it is not suitable for the data heterogeneity and diversity of Internet of Things devices in different environments, and therefore cannot overcome the influence of data heterogeneity on the accuracy of Internet of Things intrusion detection. SUMMARY

[0004] In view of this, the embodiments of the present application provide an Internet of Things intrusion detection model training method to eliminate or improve one or more defects in the prior art.

[0005] The first aspect of the present application provides an Internet of Things intrusion detection model training method, comprising:

[0006] Based on the personalized federated learning algorithm, a personalized model of local Internet of Things intrusion detection is trained using local network traffic data, and the Internet of Things intrusion detection model is updated based on the personalized model to obtain updated general model parameters;

[0007] The updated general model parameters are sent to a server in a federated learning system in which the server is located, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model.

[0008] In some embodiments of the present application, before the personalized federated learning algorithm is used to train the personalized model of the local IoT intrusion detection based on the local network traffic data and update the IoT intrusion detection model based on the personalized model to obtain the updated general model parameters, the method further comprises:

[0009] receiving the global general model parameters sent by the server;

[0010] updating the local IoT intrusion detection model according to the global general model parameters, and obtaining current training data in the local network traffic data.

[0011] In some embodiments of the present application, the personalized federated learning algorithm comprises a pFedMe algorithm.

[0012] In some embodiments of the present application, before the personalized federated learning algorithm is used to train the personalized model of the local IoT intrusion detection based on the local network traffic data and update the IoT intrusion detection model based on the personalized model to obtain the updated general model parameters, the method further comprises:

[0013] receiving the number of iterations, the regularization parameter and the learning rate, to train the personalized model of the local IoT intrusion detection based on the number of iterations, the regularization parameter and the learning rate and update the IoT intrusion detection model.

[0014] In some embodiments of the present application, the personalized federated learning algorithm is used to train the personalized model of the local IoT intrusion detection based on the local network traffic data and update the IoT intrusion detection model based on the personalized model to obtain the updated general model parameters, comprising:

[0015] solving the personalized model parameters based on the local network traffic data and the regularization parameter based on the personalized federated learning algorithm, and updating the general model parameters using the personalized model parameters and the learning rate.

[0016] A second aspect of the present application provides an IoT intrusion detection model training device, comprising:

[0017] a personalized federated training module configured to train a personalized model of a local IoT intrusion detection based on a personalized federated learning algorithm using local network traffic data, and update an IoT intrusion detection model based on the personalized model to obtain updated general model parameters;

[0018] The data sending module is configured to send the updated general model parameter to a server in a federated learning system in which the client device is located, so that the server aggregates the general model parameter and respective general model parameters received from other client devices to update global general model parameters of the IoT intrusion detection model.

[0019] The third aspect of the present application provides an IoT intrusion individualized detection method, comprising:

[0020] receiving network traffic data to be detected;

[0021] inputting the network traffic data into a local individualized model, so that the individualized model outputs corresponding IoT intrusion detection results, wherein the individualized model is trained in advance based on the IoT intrusion detection model training method.

[0022] The fourth aspect of the present application provides a federated learning system for IoT intrusion detection, comprising a server and a plurality of client devices in communication connection with the server.

[0023] Each of the client devices is configured to implement the IoT intrusion detection model training method mentioned in the foregoing embodiments.

[0024] The server is configured to receive general model parameters of a current training round trained by each of the client devices locally, aggregate each of the general model parameters to obtain global general model parameters of the IoT intrusion detection model of the current training round, and send the global general model parameters to each of the client devices in a next training round.

[0025] The fifth aspect of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the IoT intrusion detection model training method mentioned in the foregoing embodiments when executing the computer program, or implements the IoT intrusion individualized detection method mentioned in the foregoing embodiments.

[0026] The sixth aspect of the present application provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the IoT intrusion detection model training method mentioned in the foregoing embodiments, or implement the IoT intrusion individualized detection method mentioned in the foregoing embodiments.

[0027] The Internet of Things intrusion detection model training method provided in the application is executed by a client device and includes: training a local Internet of Things intrusion detection personalized model using local network traffic data based on a personalized federated learning algorithm, and updating an Internet of Things intrusion detection model based on the personalized model to obtain updated general model parameters; and sending the updated general model parameters to a server in a federated learning system to which the client device belongs, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model. The application can guarantee privacy security, effectively overcome data heterogeneity, and train an effective and comprehensive intrusion detection model for an Internet of Things device with a small amount of local data.

[0028] Additional advantages, objects, and features of the application will be set forth in part in the description which follows, and will in part be apparent to those of ordinary skill in the art upon examination of the following or can be learned from a practice of the application. The advantages and objects of the application can be realized and obtained by means of the structures particularly pointed out in the description and appended claims.

[0029] It will be appreciated by persons of ordinary skill in the art that the objects and advantages of the application can not be limited to the above specifically described, and the above and other objects of the application can be more clearly understood from the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0030] The drawings illustrated herein are for the purpose of providing a further understanding of the application and are incorporated in and constitute a part of this specification, illustrate embodiments of the application and are not intended to limit the application, the components in the drawings are not drawn in scale, but are merely intended to show the principles of the application. In order to facilitate the illustration and description of some parts of the application, the corresponding parts in the drawings can be enlarged, that is, they can become larger than other components in the exemplary device actually manufactured according to the application. In the drawings:

[0031] Figure 1 A flowchart of an Internet of Things intrusion detection model training method in an embodiment of the application.

[0032] Figure 2 A structure diagram of an Internet of Things intrusion detection model training device in another embodiment of the application.

[0033] Figure 3 A flowchart of an Internet of Things intrusion detection method in another embodiment of the application. DETAILED DESCRIPTION

[0034] For the purpose of making the object, technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the embodiments and drawings. Herein, the illustrative embodiments of the present application and the description thereof are used to explain the present application, but not as a limitation of the present application.

[0035] It should be further noted that, in order not to obscure the present application due to unnecessary details, only the structures and / or processing steps closely related to the solutions according to the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0036] It should be emphasized that the term "comprises / comprising" as used herein is used to indicate the presence of a feature, element, step or component, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0037] It should be further noted that, if not specifically stated, the term "connected" as used herein can not only mean direct connection, but also indirect connection with an intermediate.

[0038] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0039] The Internet of Things technology plays an important role in the intelligentization of production and life, therefore, the Internet of Things technology has become one of the new hotspots of current research. However, with the rapid development and application of the Internet of Things technology, various new devices are constantly added, the Internet of Things network is becoming more and more complex, and the security of the network is threatened. The edge devices in the Internet of Things, such as sensors, become new security vulnerabilities of the Internet of Things. On the one hand, most of these devices work in unattended environments, with limited computing and storage capabilities, and only basic functional requirements, lacking additional security measures. On the other hand, the Internet of Things devices directly contact a large amount of private data of users, and only need to attack the Internet of Things devices to obtain the private data of the users. Therefore, the Internet of Things devices are extremely vulnerable to malicious attacks. Once the Internet of Things devices are attacked frequently and fail, serious consequences will be caused. For example, the sensors on the smart home appliances will not be able to provide intelligent services for users if they are attacked maliciously and fail. More importantly, when the devices are attacked, the users will face the risk of privacy leakage. Therefore, security protection technology for the Internet of Things is necessary.

[0040] The intrusion detection technology is a technology for ensuring network security, which analyzes network data packets to determine whether there is an external attack. The intrusion detection technology based on neural networks has been widely applied in traditional Internet, however, there are still some key points to be considered for intrusion detection in the Internet of Things scenario.

[0041] First, privacy security needs to be protected. The high accuracy of neural network models requires a large amount of data to participate in training. Existing Internet of Things intrusion detection research mostly uses a centralized approach, which collects Internet of Things device data and sends it to the server for centralized training. Privacy security is increasingly valued, and collecting user data and uploading it to a remote server for training often poses a threat to user privacy security. To avoid privacy leaks, Internet of Things intrusion detection should avoid direct data sharing.

[0042] Second, personalized intrusion detection needs to be achieved. In the Internet of Things, different Internet of Things devices are in different environments and face different security threats. The heterogeneity and diversity of the Internet of Things make it impossible for a single intrusion detection model to conduct comprehensive and effective intrusion detection. Data heterogeneity refers to the fact that data distributed on different Internet of Things edge devices may be Non-IID, i.e., data are not independent, or data are distributed differently. Data heterogeneity is one of the common heterogeneity problems. The existence of data heterogeneity requires intrusion detection methods to provide personalized intrusion detection for each Internet of Things device.

[0043] Third, some Internet of Things devices may have less local data, making it impossible to train an effective and comprehensive intrusion detection model. When new attacks occur, the model cannot detect unknown attacks, and Internet of Things intrusion detection should be able to provide solutions for such devices while training models for other devices.

[0044] Based on the above analysis, the present application proposes an Internet of Things intrusion detection method based on personalized federated learning. First, the method introduces a federated learning framework, combining the federated learning framework with the Internet of Things intrusion detection model. The devices participating in training only use local data sets for training, without uploading or sharing data, thus achieving privacy protection. Second, the method uses a personalized federated learning algorithm, and each Internet of Things device participating in training has a private personalized model rather than using the same model, thus overcoming data heterogeneity and achieving personalized intrusion detection. In addition, devices with less training data can also obtain comprehensive and effective intrusion detection models by participating in joint training.

[0045] The purpose of the present application is to propose an intrusion detection method based on personalized federated learning. First, the method introduces a federated learning framework, which conducts joint training without the need to share data, thus achieving privacy protection. Second, by using a personalized federated learning algorithm, data heterogeneity is effectively overcome, and personalized intrusion detection is achieved. In addition, the method enables devices with less data to obtain comprehensive and effective intrusion detection models by participating in joint training.

[0046] The specific embodiments are described in detail below.

[0047] The embodiment of the application provides a method for training an Internet of Things intrusion detection model, which can be executed by an Internet of Things intrusion detection model training device, and the method specifically comprises the following contents: Figure 1

[0048] Step 110: Based on the personalized federated learning algorithm, a personalized model for local Internet of Things intrusion detection is trained by using local network traffic data, and the Internet of Things intrusion detection model is updated based on the personalized model to obtain updated general model parameters.

[0049] Specifically, the convolutional neural network model is used as the Internet of Things intrusion detection model, and the general model parameters represent local model parameters obtained by training the convolutional neural network model by using local network traffic data. The complete process is as follows: the client device trains the personalized model for local Internet of Things intrusion detection by using batch size data in the local network traffic data set, updates the convolutional neural network model by using the obtained personalized model parameters, and thus obtains the updated general model parameters.

[0050] Step 120: The updated general model parameters are sent to a server in a federated learning system in which the client device is located, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model.

[0051] Specifically, the client device sends the updated general model parameters to a server in a federated learning system in which the client device is located, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model.

[0052] In an embodiment of the application, the personalized federated learning algorithm comprises a pFedMe algorithm, which is used to improve the convergence speed and reduce the calculation complexity.

[0053] Specifically, the Internet of Things intrusion detection model algorithm adopts the pFedMe algorithm, and the personalized model of the pFedMe algorithm has more advantages than the Per-FedAvg algorithm in terms of convergence speed and calculation complexity.

[0054] In order to further obtain the personalized model parameters and the general model parameters, step 110 can further comprise the following contents before step 110:

[0055] Step 010: Receiving the global general model parameters sent by the server.

[0056] ​Step 020: updating the local IoT intrusion detection model according to the global general model parameters, and obtaining current training data in the local network traffic data.

[0057] Specifically, the client device receives the global general model parameters sent by the server before each round of training, and updates the local IoT intrusion detection model using the global model parameters, while obtaining batch size data in the local network traffic data.

[0058] In order to further improve the effectiveness and reliability of local model training, in the IoT intrusion detection model training method provided in the embodiments of the present application, the step 110 further specifically comprises the following content which can be executed after the step 020:

[0059] Step 030: receiving the number of iterations, the regularization parameter and the learning rate, to train the personalized model of the local IoT intrusion detection based on the number of iterations, the regularization parameter and the learning rate, and update the IoT intrusion detection model.

[0060] Specifically, the client device receives the number of iterations, the regularization parameter and the learning rate before training, to train the personalized model of the local IoT intrusion detection based on the number of iterations, the regularization parameter and the learning rate, and update the IoT intrusion detection model, thereby obtaining the personalized model parameters and the general model parameters.

[0061] In order to further improve the effectiveness and reliability of local model training, in the IoT intrusion detection model training method provided in the embodiments of the present application, the step 110 specifically comprises the following content:

[0062] Step 111: based on the personalized federated learning algorithm, solving the personalized model parameters by applying the local network traffic data and the regularization parameter, and updating the general model parameters using the personalized model parameters and the learning rate.

[0063] Specifically, the formula for solving the personalized model parameters is:

[0064]

[0065] wherein λ represents the regularization parameter, represents the batch size data, θ i represents the personalized model parameters.

[0066] The formula for updating the global model parameters is:

[0067]

[0068] wherein η represents the learning rate, represents the personalized model parameters, represents global model parameters.

[0069] In summary, the method for training an Internet of Things intrusion detection model provided in the present application is based on a personalized federated learning algorithm, uses local network traffic data to train a personalized model for local Internet of Things intrusion detection, and updates an Internet of Things intrusion detection model based on the personalized model to obtain updated general model parameters; the updated general model parameters are sent to a server in a federated learning system in which the client device is located, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model. The present application can guarantee privacy security and effectively overcome data heterogeneity, and train an effective and comprehensive intrusion detection model for an Internet of Things device with a small amount of local data.

[0070] From the software aspect, the present application further provides an Internet of Things intrusion detection model training device for performing all or part of the method for training an Internet of Things intrusion detection model, as shown in Figure 2 , the Internet of Things intrusion detection model training device specifically includes the following contents:

[0071] The personalized federated training module 10 is configured to use a personalized federated learning algorithm to train a personalized model for local Internet of Things intrusion detection using local network traffic data, and update an Internet of Things intrusion detection model based on the personalized model to obtain updated general model parameters.

[0072] The data sending module 20 is configured to send the updated general model parameters to a server in a federated learning system in which the client device is located, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model.

[0073] The embodiments of the Internet of Things intrusion detection model training device provided in the present application can specifically be used to perform the processing procedures of the embodiments of the method for training an Internet of Things intrusion detection model described above, and the functions thereof will not be repeated here, and the detailed description can be referred to the detailed description of the embodiments of the method for training an Internet of Things intrusion detection model described above.

[0074] The part of the Internet of Things intrusion detection model training device based on personalized federated learning can be completed in a client device. Specifically, the selection can be made according to the processing capability of the client device and the limitation of the user's use scenario, etc. The present application does not make any limitation in this regard. If all operations are completed in the client device, the client device can further include a processor for specific processing of the Internet of Things intrusion detection model training based on personalized federated learning.

[0075] The client device described above can have a communication module (i.e., a communication unit) that can be in communication connection with a remote server to realize data transmission with the server. The server can include a server of a task scheduling center side, and in other implementation scenarios, it can also include a server of an intermediate platform, such as a server of a third-party server platform that is in communication link with the server of the task scheduling center. The server can include a single computer device, or a server cluster composed of multiple servers, or a server structure of a distributed device.

[0076] The server and the client device can use any suitable network protocol to communicate, including a network protocol that has not been developed as of the filing date of the present application. The network protocol can include, for example, a TCP / IP protocol, a UDP / IP protocol, an HTTP protocol, an HTTPS protocol, and the like. Of course, the network protocol can also include, for example, a RPC protocol (Remote Procedure Call Protocol) used on top of the above-mentioned protocols, a REST protocol (Representational State Transfer), and the like.

[0077] In addition, the present application also provides an embodiment of an Internet of Things intrusion individualized detection method, which is described below with reference to Figure 3 The Internet of Things intrusion individualized detection method includes the following content:

[0078] Step 210: receiving network traffic data to be detected.

[0079] Step 220: inputting the network traffic data into a local individualized model to make the individualized model output a corresponding Internet of Things intrusion detection result, wherein the individualized model is obtained by pre-training based on the Internet of Things intrusion detection model training method.

[0080] Specifically, the client receives network traffic data to be detected, inputs the network traffic data into a local individualized model, and makes the individualized model output a corresponding Internet of Things intrusion detection result, wherein the individualized model is obtained by pre-training based on the Internet of Things intrusion detection model training method.

[0081] In addition, the present application also provides an embodiment of a federated learning system for Internet of Things intrusion detection, which specifically includes the following content:

[0082] A server and a plurality of client devices in communication connection with the server; each of the client devices is respectively used to implement the Internet of Things intrusion detection model training method mentioned in the foregoing embodiments;

[0083] The server is configured to receive the general model parameters of the current training round respectively trained by each of the client devices, aggregate each of the general model parameters to obtain global general model parameters of the Internet of Things intrusion detection model of the current training round, and send the global general model parameters to each of the client devices in the next training round.

[0084] Specifically, referring to Table 1, the complete training process of the client and the server is as follows:

[0085] In the present solution, there are N devices (clients) and one federated learning server in the Internet of Things intrusion scenario, each device i has its own private local data set P i , the number of data sets is n i = |P i |. Each device and the server use a convolutional neural network model as the intrusion detection model.

[0086] Federated learning is a distributed machine learning technique. With the help of federated learning, Internet of Things devices can share model parameters or gradients between devices instead of raw data, thus effectively protecting data privacy. Federated learning has the following stages: initialization stage, training optimization stage, and aggregation update stage. In the initialization stage, the model parameters of each client and the server are initialized. The training optimization and aggregation update stages require K rounds of communication. In the training optimization stage, in the kth round of communication, the server randomly selects a subset S t of edge devices to participate in communication, and sends the current model parameters w k to the selected edge devices. These edge devices train and improve w k based on the local data set using the stochastic gradient descent method, that is, η is the learning rate, and the result is uploaded to the server. In the aggregation update stage, the server receives the model parameters uploaded by each client, aggregates them as new model parameters, and generates a new global model for the next iteration. Repeat the process of training optimization and aggregation update until the pre-set training round is reached, and then the federated learning process is completed.

[0087] Traditional federated learning (FedAvg) focuses on learning and aggregating common knowledge of all participating devices to generate a global model. The server performs a weighted average of the model parameters uploaded by each client, and after training, each client obtains the same model parameters. For data-heterogeneous Internet of Things devices, the FedAvg algorithm cannot alleviate the impact of heterogeneity on model performance. All local data sets of clients can be regarded as a global data set, and FedAvg implicitly performs model fitting on this global data set. In Non-IID data, the distribution of each client's local data set is different, and there is a large difference between the distribution of the local data set and the global data set, which will cause the difference between the local optimal solution and the global optimal solution. In the case of using IID data, the global optimal solution is close to the local optimal solution of each client. In the local training stage, each client optimizes the local data set, and the model approaches the local optimal solution. The FedAvg algorithm averages each local model to obtain the global model, and finally obtains the global model close to the global optimal solution. However, in the Non-IID data setting, the global model obtained after averaging deviates from the global optimal solution, and there is a large difference between the local optimal solution model of each client.

[0088] The present scheme aims to optimize the Internet of Things intrusion detection in the data-heterogeneous scenario. Each device uses a regularization loss function with an L2 norm. Each edge device not only has a global model but also has a private personalized model. The personalized model does not participate in joint training and is obtained by iteratively updating the global model on the local data set. This method can be expressed as a double-layer problem. The outer problem is to solve the global model, and the inner problem is to solve the personalized model for each device. The goal is to minimize the weighted average of the loss function of each device.

[0089] Formula Objective:

[0090]

[0091] where where f i is the local objective function of client i, w represents the parameters of the global model, θ i represents the personalized model of client i, and λ is a regularization parameter used to control the degree of correlation between the personalized model θ i and the global model w. When λ is set to 0, the problem is simplified to only solving the local model; when λ→∞, the problem is converted to only solving the global model, R d Here, w is a tensor (multi-dimensional array), and the elements in it are real numbers.

[0092] The double-layer problem is solved jointly, i.e., the global model w and the personalized model θ iThe steps of the intrusion detection method based on pFedMe are as follows:

[0093] First, the convolutional neural network model is used to realize intrusion detection, and the convolutional neural network model on the client and the server is initialized (line 1). After initialization, K rounds of communication are started to complete the solving process of the global model and the personalized model. In each round of communication, the server first selects a subset S k of the client and sends the current model parameters (line 4). The devices in S k update the global model to the model sent by the server (line 6), and update it using the local data set for τ iterations. In the process of iterative update, a batch size of data is sampled from the data set (line 8), and the optimal personalized model approximation is solved based on the small batch data (lines 9-10), and the global model is updated (line 11).

[0094] Each device obtains after τ local iterations and uploads (line 13). The server aggregates the model parameters uploaded by each client, and thus calculates w (lines 15-16), where β is a hyperparameter used to control the degree of relevance between the global model and the personalized model in the aggregation stage. The value of β is set to 2.

[0095] Table 1

[0096]

[0097] The embodiments of the application also provide an electronic device, for example, a central server, which can include a processor, a memory, a receiver and a transmitter. The processor is used to execute the Internet of Things intrusion detection model training method or the Internet of Things intrusion personalized detection method mentioned in the foregoing embodiments. The processor and the memory can be connected through a bus or other means to be connected through the bus. The receiver can be connected with the processor and the memory through wired or wireless means.

[0098] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, or a combination thereof.

[0099] The memory, as a non-transitory computer readable storage medium, can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the IoT intrusion detection model training method or the IoT intrusion individualized detection method in the embodiments of the present application. The processor executes various functions and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, implements the IoT intrusion detection model training method or the IoT intrusion individualized detection method in the above method embodiments.

[0100] The memory can include a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; and the data storage area can store data created by the processor and the like. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged with respect to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0101] The one or more modules are stored in the memory, and when executed by the processor, implement the IoT intrusion detection model training method and / or the IoT intrusion individualized detection method in the embodiments.

[0102] In some embodiments of the present application, the user equipment can include a processor, a memory and a transceiver unit which can include a receiver and a transmitter, the processor, the memory, the receiver and the transmitter can be connected through a bus system, the memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to transceive signals.

[0103] As an implementation manner, the functions of the receiver and the transmitter in the present application can be implemented by a transceiver circuit or a transceiver dedicated chip, and the processor can be implemented by a dedicated processing chip, a processing circuit or a general-purpose chip.

[0104] As another implementation manner, the server provided by the embodiments of the present application can be implemented by using a general-purpose computer. That is, the program codes for implementing the functions of the processor, the receiver and the transmitter are stored in the memory, and the general-purpose processor implements the functions of the processor, the receiver and the transmitter by executing the codes in the memory.

[0105] The embodiments of the present application further provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps of the Internet of Things intrusion detection model training method or the Internet of Things intrusion individualized detection method mentioned in the foregoing embodiments. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0106] Those of ordinary skill in the art should understand that the example components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether the implementation is in hardware or software depends on the specific application and design constraints imposed on the overall system. Skilled persons can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted through a data signal carried in a carrier wave in a transmission medium or communication link.

[0107] It should be clear that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of well-known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present application are not limited to the specific steps described and shown, and skilled persons can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of the present application.

[0108] In this application, features described and / or illustrated with respect to one implementation can be used in the same manner or in an analogous manner in one or more other implementations, and / or in combination with or in place of features of other implementations.

[0109] The above only is the preferred embodiment of the present application, and is not used to limit the present application, and for the person skilled in the art, the present application can have various changes and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for training an Internet of Things intrusion detection model, characterized in that, The method comprises the following steps: receiving global general model parameters sent by a server; updating a local Internet of Things intrusion detection model according to the global general model parameters, and obtaining current training data in local network traffic data; receiving the number of iterations, the regularization parameter and the learning rate, to train a personalized model of local Internet of Things intrusion detection based on the number of iterations, the regularization parameter and the learning rate, and to update the Internet of Things intrusion detection model; training the personalized model of local Internet of Things intrusion detection based on the local network traffic data based on a personalized federated learning algorithm, and updating the Internet of Things intrusion detection model based on the personalized model to obtain updated general model parameters; the personalized federated learning algorithm comprises a pFedMe algorithm; sending the updated general model parameters to a server in a federated learning system where the client device is located, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model; wherein the personalized federated learning algorithm is used to train the personalized model of local Internet of Things intrusion detection based on the local network traffic data, and to update the Internet of Things intrusion detection model based on the personalized model to obtain updated general model parameters, comprising: solving the personalized model parameters by applying the local network traffic data and the regularization parameter based on the personalized federated learning algorithm, and updating the general model parameters using the personalized model parameters and the learning rate.

2. An Internet of Things intrusion detection model training apparatus, characterized by, The Internet of Things intrusion detection model training device is used to perform the following steps: receiving global general model parameters sent by a server; updating a local Internet of Things intrusion detection model according to the global general model parameters, and obtaining current training data in local network traffic data; receiving the number of iterations, the regularization parameter and the learning rate, to train a personalized model of local Internet of Things intrusion detection based on the number of iterations, the regularization parameter and the learning rate, and to update the Internet of Things intrusion detection model; The Internet of Things intrusion detection model training device further comprises: a personalized federated training module, configured to train a personalized model of local Internet of Things intrusion detection based on the local network traffic data based on a personalized federated learning algorithm, and to update the Internet of Things intrusion detection model based on the personalized model to obtain updated general model parameters; the personalized federated learning algorithm comprises a pFedMe algorithm; a data sending module, configured to send the updated general model parameters to a server in a federated learning system where the client device is located, so that the server aggregates the general model parameters and each general model parameter received from other client devices to update global general model parameters of the Internet of Things intrusion detection model; wherein the personalized federated learning algorithm is used to train the personalized model of local Internet of Things intrusion detection based on the local network traffic data, and to update the Internet of Things intrusion detection model based on the personalized model to obtain updated general model parameters, comprising: solving the personalized model parameters by applying the local network traffic data and the regularization parameter based on the personalized federated learning algorithm, and updating the general model parameters using the personalized model parameters and the learning rate. Based on a personalized federated learning algorithm, the local network traffic data and the regularization parameter are used to solve the personalized model parameters, and the personalized model parameters and a learning rate are used to update the general model parameters.

3. A method for intrusion individualization detection in Internet of Things, characterized in that, The method comprises the following steps: receiving network traffic data to be detected; inputting the network traffic data into a local personalized model to make the personalized model output corresponding Internet of Things intrusion detection results, wherein the personalized model is trained based on the Internet of Things intrusion detection model training method of claim 1.

4. A federated learning system for Internet of Things intrusion detection, characterized in that, The method comprises the following steps: a server and a plurality of client devices in communication connection with the server; each of the client devices is configured to implement the Internet of Things intrusion detection model training method of claim 1; the server is configured to receive general model parameters of a current training round trained by each of the client devices locally, aggregate each of the general model parameters to obtain global general model parameters of the Internet of Things intrusion detection model of the current training round, and send the global general model parameters to each of the client devices in a next training round.

5. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the Internet of Things intrusion detection model training method of claim 1, or implement the Internet of Things intrusion personalized detection method of claim 3.

6. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the Internet of Things intrusion detection model training method of claim 1, or implement the Internet of Things intrusion personalized detection method of claim 3.

Images