Traffic anomaly detection model training method and device, and electronic device

Abstract

The application discloses a traffic anomaly detection model training method and device, and belongs to the technical field of network communication. The method comprises the following steps: obtaining initial model parameters of current round iteration training and a candidate training node set; initializing a local to-be-trained traffic anomaly detection model based on the initial model parameters; performing local training on the initialized to-be-trained traffic anomaly detection model based on local traffic data, and obtaining updated model parameters; selecting a candidate training node which has not performed global iteration training of the current round according to a gradient distance matrix between training nodes; and sending the updated model parameters to the training node to perform local training based on the updated model parameters. The method shares the updated model parameters among multiple training nodes, performs local training based on local traffic data, iteratively updates the model parameters, trains the traffic anomaly detection model, improves the model training efficiency, and improves the convergence accuracy of the model.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to training methods and apparatus for traffic anomaly detection models, as well as electronic devices and computer-readable storage media. Background Technology

[0002] The internet is an essential component of today's rapidly developing society. Abnormal data such as cyberattacks and virus traffic can significantly degrade the service quality of internet applications. To defend against abnormal network behavior and ensure the quality of internet application services, efficient and reliable traffic anomaly detection has become a key technology in network services.

[0003] Machine learning-based traffic anomaly detection methods analyze the data traffic of massive network terminal devices to establish efficient and reliable traffic anomaly detection models for detecting abnormal traffic. In recent years, with the improvement of data privacy protection laws, traditional machine learning methods that directly collect, store, and analyze end-user traffic data are no longer legally supported. Data bottlenecks have become a major challenge for machine learning-based traffic anomaly detection methods. Federated learning-based traffic anomaly detection methods have emerged to address this issue. Existing technologies have at least the following drawbacks in the training process of federated learning-based traffic anomaly detection models: 1. They rely on a centralized parameter server to aggregate the local models of multiple training nodes, requiring the parameter server to simultaneously receive and send model parameters to and from multiple training nodes, leading to network congestion on the parameter server side and resulting in low training efficiency; 2. The final convergence of federated learning is related to the data distribution among training nodes; the greater the data distribution deviation among training nodes, the worse the convergence performance.

[0004] It is evident that the training methods for existing federated learning-based traffic anomaly detection models still require improvement. Summary of the Invention

[0005] This application provides a training method, apparatus, and electronic device for a traffic anomaly detection model, which can solve the problem of low model training efficiency and improve the convergence accuracy of the model.

[0006] In a first aspect, embodiments of this application disclose a training method for a traffic anomaly detection model, applied to training nodes, the method comprising:

[0007] Obtain the initial model parameters and candidate training node set for the current round of training iteration;

[0008] Based on the initial model parameters, initialize the local traffic anomaly detection model to be trained;

[0009] Based on local traffic data, local training is performed on the initialized traffic anomaly detection model to be trained to obtain the updated model parameters of the traffic anomaly detection model to be trained.

[0010] Remove the currently executing local training node from the candidate training node set to obtain an updated candidate training node set;

[0011] In response to the updated candidate training node set being non-empty, the next first target training node to perform local training is selected from the updated candidate training node set according to the pre-calculated gradient distance matrix;

[0012] The updated model parameters and the updated candidate training node set are sent to the first target training node, triggering the first target training node to perform local training on the traffic anomaly detection model to be trained, using the updated model parameters as the initial model parameters.

[0013] Optionally, after removing the currently performing local training node from the candidate training node set to obtain the updated candidate training node set, the method further includes:

[0014] In response to the updated candidate training node set being empty and the current round of training iteration being a non-terminating round, the candidate training node set is updated to include the training nodes participating in training the traffic anomaly detection model to be trained, thus obtaining the updated candidate training node set.

[0015] One of the training nodes participating in training the traffic anomaly detection model to be trained is identified as the second target training node.

[0016] The updated model parameters and the most recently updated set of candidate training nodes are sent to the second target training node, triggering the second target training node to perform local training on the traffic anomaly detection model to be trained, using the updated model parameters as the initial model parameters.

[0017] Optionally, after removing the currently performing local training node from the candidate training node set to obtain the updated candidate training node set, the method further includes:

[0018] In response to the updated candidate training node set being empty and the current iteration training being the final round, the updated model parameters are used as the model parameters of the traffic anomaly detection model.

[0019] Optionally, selecting the next target training node to perform local training from the updated set of candidate training nodes based on the pre-calculated gradient distance matrix includes:

[0020] Based on the values ​​of the mutual gradient distances in the pre-calculated gradient distance matrix, the probability of each candidate training node in the updated candidate training node set being the next training node to perform local training is calculated.

[0021] Each candidate training node is weighted and sampled according to the probability to select the first target training node.

[0022] Optionally, calculating the probability of each candidate training node in the updated candidate training node set becoming the next training node to perform local training, based on the values ​​of the mutual gradient distances in the pre-calculated gradient distance matrix, includes:

[0023] For each candidate training node in the updated candidate training node set, the maximum mutual gradient distance in the gradient distance matrix is ​​subtracted from the mutual gradient distance between the current training node and the candidate training node to obtain the gradient distance difference value corresponding to each candidate training node.

[0024] The probability of a candidate training node being selected as the next training node to perform local training is obtained by the ratio of the gradient distance difference between the candidate training nodes to the sum of the gradient distance differences between the candidate training nodes.

[0025] Optionally, before obtaining the initial model parameters and candidate training node set for the current round of training iterations, the method further includes:

[0026] Obtain the initial model parameters of the traffic anomaly detection model;

[0027] Based on local traffic data and the initial model parameters, obtain the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node;

[0028] Receive the parameter weight update gradient of the traffic anomaly detection model corresponding to the other training nodes in the traffic anomaly detection system;

[0029] The gradient distance matrix is ​​calculated by updating the 2-norm of the gradient based on the parameter weights corresponding to each training node.

[0030] Optionally, obtaining the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node based on local traffic data and the initial model parameters includes:

[0031] Based on local traffic data and the initial model parameters, the initial parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node is calculated using the backpropagation method, and used as the parameter weight update gradient.

[0032] Secondly, embodiments of this application disclose a training device for a traffic anomaly detection model, applied to training nodes, the device comprising:

[0033] The initial data acquisition module is used to acquire the initial model parameters and candidate training node set for the current round of training iteration;

[0034] The model initialization module is used to initialize the local traffic anomaly detection model to be trained based on the initial model parameters.

[0035] The local training module is used to perform local training on the initialized traffic anomaly detection model based on local traffic data, so as to obtain the updated model parameters of the traffic anomaly detection model.

[0036] The candidate training node set update module is used to delete the local training node currently performing local training from the candidate training node set to obtain an updated candidate training node set.

[0037] The first target training node selection module is used to select the next first target training node to perform local training in the updated candidate training node set in response to the updated candidate training node set being non-empty, based on the pre-calculated gradient distance matrix.

[0038] The model parameter transmission module is used to send the updated model parameters and the updated candidate training node set to the first target training node, triggering the first target training node to perform local training on the traffic anomaly detection model to be trained using the updated model parameters as the initial model parameters.

[0039] Optionally, the device further includes:

[0040] The candidate training node set update module is used to update the candidate training node set to include the training nodes that participated in training the traffic anomaly detection model to be trained, in response to the updated candidate training node set being empty and the current round of training not being a terminating round, thereby obtaining the updated candidate training node set.

[0041] The second target training node determination module is used to determine one of the training nodes participating in training the traffic anomaly detection model to be trained, as the second target training node.

[0042] The model parameter transmission module is further configured to send the updated model parameters and the most recently updated set of candidate training nodes to the second target training node, triggering the second target training node to perform local training on the traffic anomaly detection model to be trained using the updated model parameters as initial model parameters.

[0043] Optionally, the device further includes:

[0044] The model parameter output module is used to respond to the updated candidate training node set being empty and the current round of iteration training being the final round, by using the updated model parameters as the model parameters of the traffic anomaly detection model.

[0045] Optionally, the first target training node selection module is further used for:

[0046] Based on the values ​​of the mutual gradient distances in the pre-calculated gradient distance matrix, the probability of each candidate training node in the updated candidate training node set being the next training node to perform local training is calculated.

[0047] Each candidate training node is weighted and sampled according to the probability to select the first target training node.

[0048] Optionally, calculating the probability of each candidate training node in the updated candidate training node set becoming the next training node to perform local training, based on the values ​​of the mutual gradient distances in the pre-calculated gradient distance matrix, includes:

[0049] For each candidate training node in the updated candidate training node set, the maximum mutual gradient distance in the gradient distance matrix is ​​subtracted from the mutual gradient distance between the current training node and the candidate training node to obtain the gradient distance difference value corresponding to each candidate training node.

[0050] The probability of a candidate training node being selected as the next training node to perform local training is obtained by the ratio of the gradient distance difference between the candidate training nodes to the sum of the gradient distance differences between the candidate training nodes.

[0051] Optionally, the apparatus further includes: a gradient distance matrix acquisition module, used to perform the following steps:

[0052] Obtain the initial model parameters of the traffic anomaly detection model;

[0053] Based on local traffic data and the initial model parameters, obtain the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node;

[0054] Receive the parameter weight update gradient of the traffic anomaly detection model corresponding to the other training nodes in the traffic anomaly detection system;

[0055] The gradient distance matrix is ​​calculated by updating the 2-norm of the gradient based on the parameter weights corresponding to each training node.

[0056] Optionally, obtaining the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node based on local traffic data and the initial model parameters includes:

[0057] Based on local traffic data and the initial model parameters, the initial parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node is calculated using the backpropagation method, and used as the parameter weight update gradient.

[0058] Thirdly, embodiments of this application also disclose an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the training method for the traffic anomaly detection model described in embodiments of this application.

[0059] Fourthly, embodiments of this application disclose a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, represents the steps of the training method for the traffic anomaly detection model disclosed in embodiments of this application.

[0060] The training method for a traffic anomaly detection model disclosed in this application involves: obtaining initial model parameters and a set of candidate training nodes for the current iteration of training; initializing a local traffic anomaly detection model to be trained based on the initial model parameters; performing local training on the initialized traffic anomaly detection model to be trained based on local traffic data to obtain updated model parameters; deleting the currently performing local training node from the set of candidate training nodes to obtain an updated set of candidate training nodes; in response to the updated set of candidate training nodes being non-empty, selecting the next first target training node to perform local training based on a pre-calculated gradient distance matrix; sending the updated model parameters and the updated set of candidate training nodes to the first target training node, triggering the first target training node to perform local training on the traffic anomaly detection model to be trained using the updated model parameters as initial model parameters, and iterating in this way. By having multiple training nodes perform local training based on local traffic data, iteratively updating model parameters, and sharing updated model parameters, the training efficiency and convergence accuracy of the model are improved.

[0061] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0062] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0063] Figure 1 This is a flowchart of the training method for the traffic anomaly detection model disclosed in the embodiments of this application;

[0064] Figure 2 This is a schematic diagram of the traffic anomaly detection system disclosed in the embodiments of this application;

[0065] Figure 3 This is another flowchart of the training method for the traffic anomaly detection model disclosed in the embodiments of this application;

[0066] Figure 4 This is a schematic diagram illustrating the training method of the traffic anomaly detection model disclosed in the embodiments of this application.

[0067] Figure 5 This is one of the schematic diagrams of the training device structure for the traffic anomaly detection model disclosed in the embodiments of this application;

[0068] Figure 6 This is the second schematic diagram of the training device structure of the traffic anomaly detection model disclosed in the embodiments of this application;

[0069] Figure 7 A block diagram schematically illustrates an electronic device for performing the method according to this application; and

[0070] Figure 8 A storage unit for holding or carrying program code implementing the method according to this application is illustrated schematically. Detailed Implementation

[0071] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0072] This application discloses a training method for a traffic anomaly detection model, which is applied to, for example... Figure 2The traffic anomaly detection system shown includes multiple distributed training nodes 210, which are connected via a network to transmit model data and intermediate data generated by the traffic anomaly detection model during training.

[0073] In some embodiments of this application, the training node 210 can be a service provider's server, a network operator's switch, or other network equipment. Each training node locally stores its collected traffic data for local model training, without needing to upload local traffic data to other nodes. All training nodes collaboratively train a shared global model, namely a traffic anomaly detection model, thereby achieving the goal of protecting user privacy.

[0074] like Figure 1 As shown, the training method of the traffic anomaly detection model includes steps 110 to 160.

[0075] Step 110: Obtain the initial model parameters and candidate training node set for the current round of iteration training.

[0076] In the embodiments of this application, the traffic anomaly detection model requires multiple rounds of training jointly performed by the aforementioned training nodes to obtain the optimal model parameters. For example, the traffic anomaly detection model can only reach convergence after the aforementioned training nodes jointly perform T rounds of training, where T is a positive integer and the value of T is set according to training experience.

[0077] In some embodiments of this application, for each training node participating in model training, the traffic anomaly detection model is trained based on local traffic data, and the optimized model parameters obtained from the training are shared with other training nodes, so that other training nodes can further train the traffic anomaly detection model based on local traffic data based on the training results of the previous training node, thereby achieving rapid convergence of the traffic anomaly detection model.

[0078] In the t-th global iteration (t≤T), all training nodes participating in training the traffic anomaly detection model will perform a local update of the global model (i.e., the traffic anomaly detection model) using their local labeled data. For ease of description, let i be the index of the training node currently performing local training, and j be the index of the previous training node performing local training. That is, the initial model parameters of training node i are passed from training node j after performing local training. Multiple nodes update the global model through model parameter passing and performing local updates.

[0079] In other words, for each training node, there are two ways to obtain the initial model parameters and candidate training node set when performing the current round of training iteration: First, the initial model parameters and candidate training node set sent by the previous training node that performed local training; Second, the initial model parameters and candidate training node set generated by itself according to the training configuration.

[0080] In some embodiments of this application, obtaining the initial model parameters and candidate training node set for the current round of iteration training includes: in response to the current training node being the first training node to perform local training in the first round of iteration training, obtaining specified model parameters as initial model parameters, and initializing the candidate training node set to include training nodes participating in training the traffic anomaly detection model to be trained; in response to the current training node not being the first training node to perform local training in the first round of iteration training, receiving updated model parameters sent by the previous training node performing local training as initial model parameters, and receiving the candidate training node set sent by the previous training node performing local training.

[0081] For example, let t represent the current global iteration training round. If t = 1, initialize i = j = 1, and initialize the model parameters W of the training node with index i = 1. 0,1 That is, the current training node i obtains the specified model parameters as the initial model parameters.

[0082] If t>1, the last training node to execute local training of the global model in the (t-1)th round of global iteration training will be denoted as node j, and its updated model parameters will be denoted as W. t-1,j Meanwhile, training node j will randomly select training node i from the global node range (i.e., the candidate training node set) as the first training node for the next round of global iteration training, and initialize the candidate node set for the t-th global iteration training. Then, the updated model parameters are denoted as W. t-1,j and candidate node set The updated model parameters are sent to training node i, triggering training node i to use the updated model parameters as initial model parameters and enter local iterative training and model parameter transmission. Here, N represents the total number of training nodes participating in training the traffic anomaly detection model to be trained, and N is a natural number greater than 1. This represents the set of candidate training nodes at the start of the t-th iteration of training.

[0083] Step 120: Based on the initial model parameters, initialize the local traffic anomaly detection model to be trained.

[0084] In the embodiments of this application, for ease of distinction, the traffic anomaly detection model during the training process is referred to as the "traffic anomaly detection model to be trained", and the model obtained after performing T rounds of global iterative training on the traffic anomaly detection model to be trained is used as the traffic anomaly detection model for traffic anomaly detection.

[0085] The current training node i is based on the acquired initial model parameters (i.e., W). 0,1 Or W t-1,j Initialize the local traffic anomaly detection model to be trained.

[0086] Step 130: Based on local traffic data, perform local training on the initialized traffic anomaly detection model to be trained, and obtain the updated model parameters of the traffic anomaly detection model to be trained.

[0087] In some embodiments of this application, each training node performs several gradient updates (e.g., 50 times) based on local traffic data. Then, the updated model parameters obtained from the last gradient update are shared with the next training node that performs local training.

[0088] For example, the current training node i receives model parameters W from training node j. t,j The system utilizes locally labeled data to train a traffic anomaly detection model. During the training process of the traffic anomaly detection model, backpropagation based on the labeled data and model parameters is used to obtain the update gradient. Subsequently, the model parameters are further updated based on the update gradient to obtain the updated model parameters.

[0089] Among them, the gradient G is updated. t,i The calculation method can be achieved through formulas. This indicates that the function F(·,·) represents the loss function (such as cross-entropy) used to train the traffic anomaly detection model. This represents the local traffic data of training node i. Further, it can be expressed using formula W. t,i =W t,j -ηG t,i The model parameters are updated to obtain the updated model parameters W after training the traffic anomaly detection model by training node i in the t-th round of global iteration training. t,i , where η represents the gradient factor, the value of which is set empirically.

[0090] In some embodiments of this application, the local traffic data of each training node includes several training samples generated based on network traffic association data (such as traffic logs) collected from local network devices. Each training sample includes: traffic features and traffic status labels. The traffic features include, but are not limited to, the following three dimensions: intrinsic traffic features, content traffic features, and time-based network traffic statistical features; the traffic status labels are used to indicate whether the corresponding traffic features match abnormal or normal traffic.

[0091] The inherent characteristics of the traffic can be obtained directly from the header of the traffic data packet, such as "connection duration", "protocol type", "connection status", "number of bytes of data", etc.

[0092] The content characteristics of the traffic can be obtained by reading the traffic's data payload. Examples include "number of failed login attempts," "whether login was successful," "number of file creation operations," and "number of control commands used."

[0093] The time-based network traffic statistics features can be obtained by comparing the current traffic connection records with connection records from a previous period. Examples include "the number of connections with the same target host as the current connection in the past two seconds" and "the number of times the target host refused service among connections with the same target host as the current connection in the past two seconds".

[0094] For details on how each training node trains the traffic anomaly detection model based on local traffic data, please refer to the prior art; these details will not be repeated in the embodiments of this application.

[0095] Step 140: Remove the currently performing local training node from the candidate training node set to obtain an updated candidate training node set.

[0096] After the current training node performing local training completes the preset number of rounds of local training for the traffic anomaly detection model, it removes its own node index from the candidate training node set, updating the candidate training node set. The updated candidate training node set includes training nodes that have not yet performed the current round of global training. For example, after the current training node i completes local model training, the candidate node set is updated.

[0097] Step 150: In response to the updated candidate training node set being non-empty, select the first target training node to perform local training in the updated candidate training node set according to the pre-calculated gradient distance matrix.

[0098] Furthermore, if the updated set of candidate training nodes is not empty (e.g.) If there are still training nodes that have not yet performed global training in this round, then the current training node i will be added to the candidate node set. Select the first target training node to perform local training.

[0099] Traditional federated learning-based traffic anomaly detection methods suffer from slow convergence efficiency and poor convergence accuracy. This application discloses a decentralized federated learning-based traffic anomaly detection model training method. Decentralized federated learning trains the global model through local updates and model transfer between multiple training nodes, thereby eliminating the dependence on a centralized parameter server inherent in traditional federated learning and reducing system training overhead. For example, in this application embodiment, the overhead of model parameter transfer between training nodes is less than the overhead of transferring model data between training nodes and a central parameter server in traditional training methods.

[0100] Furthermore, to improve the convergence accuracy of decentralized training, in this embodiment, the order of model parameter transfer between training nodes is determined based on the gradient distance between the model parameter weights of different training nodes. The initial gradient distance between different training nodes can characterize the distribution characteristics of local traffic data between training nodes, thereby providing a basis for selecting the transfer training nodes.

[0101] In some embodiments of this application, the step of selecting the next first target training node to perform local training from the updated candidate training node set according to the pre-calculated gradient distance matrix includes: calculating the probability of each candidate training node in the updated candidate training node set being the next training node to perform local training based on the values ​​of the mutual gradient distances in the pre-calculated gradient distance matrix; and performing weighted sampling on each candidate training node according to the probability to select the first target training node.

[0102] Taking a traffic anomaly detection model with N training nodes as an example, the pre-calculated gradient distance matrix D is an N×N symmetric matrix, which can be represented as follows: Where, matrix element d i,j This represents the initial gradient distance between training node i and training node j. In embodiments of this application, the initial gradient distance can represent the similarity of local traffic data between training nodes. For example, if the gradient distance between two training nodes is large, it indicates that their local traffic data differs significantly. In embodiments of this application, training nodes with smaller differences in local traffic data can be preferentially selected for continuous training to improve the convergence speed of the model.

[0103] In some embodiments of this application, the step of calculating the probability of each candidate training node in the updated candidate training node set being the next training node to perform local training based on the values ​​of the mutual gradient distances in the pre-calculated gradient distance matrix includes: for each candidate training node in the updated candidate training node set, subtracting the mutual gradient distance between the current training node and the candidate training node from the maximum mutual gradient distance in the gradient distance matrix to obtain the gradient distance difference corresponding to each candidate training node; and obtaining the probability of the candidate training node being the next training node to perform local training based on the ratio of the gradient distance difference corresponding to the candidate training node to the sum of the gradient distance differences corresponding to the candidate training nodes.

[0104] For example, the probability P of selecting training node k as the next training node to perform local training can be calculated using the following formula. i,k :

[0105] in, d represents the maximum mutual gradient distance in the gradient distance matrix. i,l This represents the gradient distance between training node i and training node l, where training node l is a training node in the candidate training node set.

[0106] The current training node i performs weighted sampling on each candidate training node in the candidate training node set based on the probability that each candidate training node will be the next training node to perform local training, and selects the first target training node. For example, the candidate training node with the highest probability is selected as the first target training node.

[0107] Step 160: Send the updated model parameters and the updated candidate training node set to the first target training node, triggering the first target training node to perform local training on the traffic anomaly detection model to be trained using the updated model parameters as the initial model parameters.

[0108] After selecting the next training node k to perform local training, the current training node i sends the updated model parameters and the updated set of candidate training nodes to training node k. Upon receiving the updated model parameters and the updated set of candidate training nodes from training node i, training node k becomes the current training node, while training node i becomes the previous training node to perform local training, i.e., j = i, i = k. Then, as the current training node i, it performs global iterative training for this round by executing steps 110 to 160.

[0109] In some embodiments of this application, such as Figure 3As shown, after deleting the currently performing local training node from the candidate training node set to obtain the updated candidate training node set, the method further includes steps 170, 180, and 190.

[0110] Step 170: In response to the updated candidate training node set being empty and the current round of iteration training not being a terminating round, the candidate training node set is updated to include training nodes participating in training the traffic anomaly detection model to be trained, thus obtaining the updated candidate training node set.

[0111] If all training nodes involved in model training have completed the current round of global iteration training, but have not yet completed the preset T rounds of global iteration training, then the next round of global iteration training needs to be restarted.

[0112] Step 180: Determine one of the training nodes participating in training the traffic anomaly detection model to be trained as the second target training node.

[0113] In some embodiments of this application, when starting a round of global iterative training, a training node can be randomly selected as the first training node to perform local iterative training in the current round, or a certain training node can be fixedly selected as the first training node to perform local iterative training in the current round, i.e., the second target training node.

[0114] Step 190: Send the updated model parameters and the most recently updated set of candidate training nodes to the second target training node, triggering the second target training node to perform local training on the traffic anomaly detection model to be trained using the updated model parameters as the initial model parameters.

[0115] After determining the first training node to perform local iterative training in the next round, i.e., the second target training node, the current training node sends the updated model parameters and the second updated set of candidate training nodes to the second target training node. Upon receiving the updated model parameters and the second updated set of candidate training nodes, the second target training node initializes its local traffic anomaly detection model based on the updated model parameters. Then, it performs local iterative training on the initialized traffic anomaly detection model based on local traffic data.

[0116] In some embodiments of this application, such as Figure 3 As shown, after deleting the currently performing local training node from the candidate training node set to obtain the updated candidate training node set, the method further includes: step 175.

[0117] Step 175: In response to the updated candidate training node set being empty and the current round of iteration training being the final round, the updated model parameters are used as the model parameters of the traffic anomaly detection model.

[0118] If all training nodes participating in model training have completed this round of global iteration training, and have completed the preset T global iteration training, then the training process of the traffic anomaly detection model can be considered complete, and the updated model parameters can be used as the model parameters of the traffic anomaly detection model.

[0119] The training method for the traffic anomaly detection model disclosed in this application is applicable to traffic anomaly detection scenarios with a total number of training nodes between 3 and 100, wherein the global iteration count T can be set between 50 and 500. The selection of the traffic anomaly detection model includes, but is not limited to, fully connected neural networks (MLP), convolutional neural networks (CNN), and long short-term memory networks (LSTM).

[0120] In some embodiments of this application, such as Figure 3 As shown, before obtaining the initial model parameters and candidate training node set for the current round of iteration training, the method further includes: step 100.

[0121] Step 100: Obtain the gradient distance matrix.

[0122] In some embodiments of this application, obtaining the gradient distance matrix includes: sub-step 1001, sub-step 1002, sub-step 1003 and sub-step 1004.

[0123] Sub-step 1001: Obtain the initial model parameters of the traffic anomaly detection model.

[0124] First, the first training node initializes the model parameters W0 of the traffic anomaly detection model and broadcasts the model parameters W0 to all other training nodes participating in the model training.

[0125] Sub-step 1002: Based on the local traffic data and the initial model parameters, obtain the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node.

[0126] All training nodes participating in model training are pre-updated using their local labeled data. For the i-th training node, it can be updated based on its local labeled data. The model parameters W0 are backpropagated through a neural network to calculate the weight update gradient G of the model parameters. 0,i The calculation formula can be expressed as: In the above formula, the function F(·,·) represents the loss function (such as cross-entropy) used to train the traffic anomaly detection model.

[0127] Sub-step 1003: Receive the parameter weight update gradient of the traffic anomaly detection model corresponding to the other training nodes in the traffic anomaly detection system.

[0128] In some embodiments of this application, obtaining the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node based on local traffic data and the initial model parameters includes: calculating the initial parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node using the backpropagation method based on local traffic data and the initial model parameters, and using it as the parameter weight update gradient.

[0129] For example, all training nodes update the gradients using the weights of the locally computed model parameters. The gradients are sent to other training nodes. For the i-th training node, it can receive a total of N-1 parameter weight update gradients from other training nodes.

[0130] Sub-step 1004: Update the 2-norm of the gradient according to the parameter weights corresponding to each training node, and calculate the gradient distance matrix.

[0131] Next, all training nodes calculate the distance between their own parameter weight update gradient and the parameter weight update gradients of the other training nodes. In some embodiments of this application, the gradient distance between two training nodes is obtained by calculating the 2-norm between pairwise parameter weight update gradients. For example, for training node i and training node j, the gradient distance between them is calculated using the formula d. i,j =‖G 0,i -G 0,j ‖2, where ‖·‖2 represents the 2-norm operator, G 0,i G represents the gradient of the initial parameters and weights of training node i. 0,j This represents the gradient of the initial parameters, weights, and updates for training node j.

[0132] To facilitate the reader's understanding of the training method for the traffic anomaly detection model disclosed in the embodiments of this application, the following is combined with... Figure 4 The training method for the traffic anomaly detection model is further illustrated with examples.

[0133] Figure 4 This diagram illustrates a decentralized federated learning training process with six training nodes. Each training node in the traffic anomaly detection system first calculates its gradient distance matrix, resulting in a 6×6 symmetric matrix.

[0134] Then, T global iterations of training will be performed to complete the training of the traffic anomaly detection model. Each global iteration requires N local model iterations, meaning that 6 training nodes need to perform local model iterations respectively.

[0135] like Figure 4 As shown, after the model transfer completes the 3rd local iteration of the t-th (1≤t≤T) global iteration training, before entering the 4th local iteration training, the current training node 6 needs to calculate the model transfer probability based on the pairwise gradient distances in the pre-obtained gradient distance matrix. That is, it calculates the probability that candidate training nodes 2, 3, and 5 will be the next training nodes to perform local iteration training. Then, based on the calculated probabilities, random weighted sampling is performed to select one of the candidate training nodes 2, 3, and 5 as the next training node to perform local iteration training for model parameter transfer.

[0136] This application also discloses a training method for a traffic anomaly detection model. This method involves: obtaining initial model parameters and a set of candidate training nodes for the current iteration of training; initializing a local traffic anomaly detection model based on the initial model parameters; performing local training on the initialized traffic anomaly detection model based on local traffic data to obtain updated model parameters; deleting the currently executing local training node from the set of candidate training nodes to obtain an updated set of candidate training nodes; in response to the updated set of candidate training nodes being non-empty, selecting the next target training node to perform local training based on a pre-calculated gradient distance matrix; sending the updated model parameters and the updated set of candidate training nodes to the first target training node, triggering the first target training node to perform local training on the traffic anomaly detection model using the updated model parameters as initial model parameters. This process is iterated, with multiple training nodes performing local training based on local traffic data, iteratively updating model parameters, and sharing the updated model parameters, thereby improving the model's training efficiency and convergence accuracy.

[0137] Specifically, in traditional training schemes, multiple training nodes need to interact with a single parameter server. However, the training method for the traffic anomaly detection model disclosed in this application only requires the transfer of model parameters between training nodes, effectively reducing the throughput of the communication network and lowering system overhead. Furthermore, training nodes can directly exchange parameter information of their local models without the need for coordination from a parameter server, effectively accelerating knowledge fusion within different training nodes.

[0138] Furthermore, when passing model parameters between training nodes, a gradient distance-based method is used. This method arranges the training data used to train the model at the system level, which can effectively improve the final convergence accuracy of the model.

[0139] Accordingly, embodiments of this application also disclose a training device for a traffic anomaly detection model, applied to training nodes, such as... Figure 5 As shown, the device includes:

[0140] The initial data acquisition module 510 is used to acquire the initial model parameters and candidate training node set for the current round of training iteration;

[0141] The model initialization module 520 is used to initialize the local traffic anomaly detection model to be trained based on the initial model parameters.

[0142] The local training module 530 is used to perform local training on the initialized traffic anomaly detection model based on local traffic data, so as to obtain the updated model parameters of the traffic anomaly detection model.

[0143] The candidate training node set update module 540 is used to delete the local training node currently performing local training from the candidate training node set to obtain an updated candidate training node set.

[0144] The first target training node selection module 550 is used to select the next first target training node to perform local training in the updated candidate training node set in response to the updated candidate training node set being non-empty, based on the pre-calculated gradient distance matrix.

[0145] The first model parameter transmission module 560 is used to send the updated model parameters and the updated candidate training node set to the first target training node, triggering the first target training node to perform local training on the traffic anomaly detection model to be trained using the updated model parameters as the initial model parameters.

[0146] Optional, such as Figure 6 As shown, the device further includes:

[0147] The candidate training node set update module 570 is used to update the candidate training node set to include the training nodes that participated in training the traffic anomaly detection model to be trained, in response to the updated candidate training node set being empty and the current round of training not being a terminating round, thereby obtaining the updated candidate training node set.

[0148] The second target training node determination module 580 is used to determine one of the training nodes participating in training the traffic anomaly detection model to be trained, as the second target training node.

[0149] The second model parameter transmission module 590 is used to send the updated model parameters and the most recently updated candidate training node set to the second target training node, triggering the second target training node to perform local training on the traffic anomaly detection model to be trained using the updated model parameters as the initial model parameters.

[0150] Optional, such as Figure 6 As shown, the device further includes:

[0151] The model parameter output module 575 is used to respond to the updated candidate training node set being empty and the current round of iteration training being the final round, by using the updated model parameters as the model parameters of the traffic anomaly detection model.

[0152] Optionally, the first target training node selection module 550 is further configured to:

[0153] Based on the values ​​of the mutual gradient distances in the pre-calculated gradient distance matrix, the probability of each candidate training node in the updated candidate training node set being the next training node to perform local training is calculated.

[0154] Each candidate training node is weighted and sampled according to the probability to select the first target training node.

[0155] Optionally, calculating the probability of each candidate training node in the updated candidate training node set becoming the next training node to perform local training, based on the values ​​of the mutual gradient distances in the pre-calculated gradient distance matrix, includes:

[0156] For each candidate training node in the updated candidate training node set, the maximum mutual gradient distance in the gradient distance matrix is ​​subtracted from the mutual gradient distance between the current training node and the candidate training node to obtain the gradient distance difference value corresponding to each candidate training node.

[0157] The probability of a candidate training node being selected as the next training node to perform local training is obtained by the ratio of the gradient distance difference between the candidate training nodes to the sum of the gradient distance differences between the candidate training nodes.

[0158] Optional, such as Figure 6 As shown, the device further includes a gradient distance matrix acquisition module 500, used to perform the following steps:

[0159] Obtain the initial model parameters of the traffic anomaly detection model;

[0160] Based on local traffic data and the initial model parameters, obtain the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node;

[0161] Receive the parameter weight update gradient of the traffic anomaly detection model corresponding to the other training nodes in the traffic anomaly detection system;

[0162] The gradient distance matrix is ​​calculated by updating the 2-norm of the gradient based on the parameter weights corresponding to each training node.

[0163] Optionally, obtaining the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node based on local traffic data and the initial model parameters includes:

[0164] Based on local traffic data and the initial model parameters, the initial parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node is calculated using the backpropagation method, and used as the parameter weight update gradient.

[0165] The training apparatus for the traffic anomaly detection model disclosed in this application is used to implement the training method for the traffic anomaly detection model described in this application. The specific implementation methods of each module of the apparatus will not be repeated here, but can be found in the specific implementation methods of the corresponding steps in the method embodiments.

[0166] This application discloses a training device for a traffic anomaly detection model. The device acquires initial model parameters and a set of candidate training nodes for the current iteration of training. Based on the initial model parameters, it initializes a local traffic anomaly detection model to be trained. Based on local traffic data, it performs local training on the initialized traffic anomaly detection model to obtain updated model parameters. It removes the currently performing local training node from the set of candidate training nodes, obtaining an updated set of candidate training nodes. In response to the updated set of candidate training nodes being non-empty, it selects the next target training node to perform local training based on a pre-calculated gradient distance matrix. It sends the updated model parameters and the updated set of candidate training nodes to the first target training node, triggering the first target training node to perform local training on the traffic anomaly detection model to be trained using the updated model parameters as initial model parameters. This process is iterated, with multiple training nodes performing local training based on local traffic data, iteratively updating model parameters, and sharing the updated model parameters, thereby improving the model's training efficiency and convergence accuracy.

[0167] Specifically, in traditional training schemes, multiple training nodes need to interact with a single parameter server. However, the training method for the traffic anomaly detection model disclosed in this application only requires the transfer of model parameters between training nodes, effectively reducing the throughput of the communication network and lowering system overhead. Furthermore, training nodes can directly exchange parameter information of their local models without the need for coordination from a parameter server, effectively accelerating knowledge fusion within different training nodes.

[0168] Furthermore, when passing model parameters between training nodes, a gradient distance-based method is used. This method arranges the training data used to train the model at the system level, which can effectively improve the final convergence accuracy of the model.

[0169] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus embodiments, since they are fundamentally similar to the method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0170] The training method and apparatus for a traffic anomaly detection model provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method of this application and its core idea. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the idea of ​​this application. Therefore, the content of this specification should not be construed as a limitation of this application.

[0171] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0172] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some or all of the components in the electronic device according to the embodiments of this application. This application can also be implemented as a device or apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such a program implementing this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0173] For example, Figure 7 An electronic device is shown that can implement the methods according to this application. The electronic device may be a PC, mobile terminal, personal digital assistant, tablet computer, etc. The electronic device conventionally includes a processor 710 and a memory 720, and program code 730 stored in the memory 720 and executable on the processor 710. When the processor 710 executes the program code 730, it implements the methods described in the above embodiments. The memory 720 may be a computer program product or a computer-readable medium. The memory 720 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. The memory 720 has a storage space 7201 for the program code 730 of a computer program for performing any of the method steps described above. For example, the storage space 7201 for the program code 730 may include various computer programs for implementing the various steps in the above methods. The program code 730 is computer-readable code. These computer programs can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, CDs, memory cards, or floppy disks. The computer program includes computer-readable code that, when executed on an electronic device, causes the electronic device to perform the method according to the above embodiments.

[0174] This application also discloses a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the training method for the traffic anomaly detection model as described in this application.

[0175] Such a computer program product can be a computer-readable storage medium, which can have the same characteristics as... Figure 7The memory 720 in the illustrated electronic device is similarly arranged with storage segments, storage spaces, etc. Program code can be stored, for example, in a compressed form on the computer-readable storage medium. The computer-readable storage medium is typically as shown in the reference... Figure 8 The portable or fixed storage unit is described above. Typically, the storage unit includes computer-readable code 730', which is code read by a processor and, when executed by the processor, implements the various steps of the method described above.

[0176] The terms "an embodiment," "embodiment," or "one or more embodiments" as used herein mean that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment of this application. Furthermore, please note that the examples of the phrase "in one embodiment" do not necessarily all refer to the same embodiment.

[0177] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0178] In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0179] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for training a traffic anomaly detection model, the method comprising: The method is applied to a distributed training node, and the method comprises: obtaining initial model parameters of current round iteration training and a candidate training node set; wherein the training node is a network device; initializing a local to-be-trained traffic anomaly detection model based on the initial model parameters; performing local training on the initialized to-be-trained traffic anomaly detection model based on local traffic data to obtain updated model parameters of the to-be-trained traffic anomaly detection model; removing a local training node currently performing local training from the candidate training node set to obtain an updated candidate training node set; in response to the updated candidate training node set being non-empty, selecting a first target training node performing local training next from the updated candidate training node set according to a pre-calculated gradient distance matrix; sending the updated model parameters and the updated candidate training node set to the first target training node to trigger the first target training node to perform local training on the to-be-trained traffic anomaly detection model with the updated model parameters as initial model parameters.

2. The method of claim 1, wherein, After the removing of the local training node currently performing local training from the candidate training node set to obtain the updated candidate training node set, the method further comprises: in response to the updated candidate training node set being empty and the current round iteration training being a non-terminal round, updating the candidate training node set to include training nodes participating in training the to-be-trained traffic anomaly detection model to obtain an updated candidate training node set; determining one of the training nodes participating in training the to-be-trained traffic anomaly detection model as a second target training node; sending the updated model parameters and the most recently updated candidate training node set to the second target training node to trigger the second target training node to perform local training on the to-be-trained traffic anomaly detection model with the updated model parameters as initial model parameters.

3. The method of claim 1, wherein, After the removing of the local training node currently performing local training from the candidate training node set to obtain the updated candidate training node set, the method further comprises: in response to the updated candidate training node set being empty and the current round iteration training being a terminal round, taking the updated model parameters as model parameters of the traffic anomaly detection model.

4. The method according to any one of claims 1 to 3, characterized in that, The selecting of the first target training node performing local training next from the updated candidate training node set according to the pre-calculated gradient distance matrix comprises: calculating a probability of each candidate training node in the updated candidate training node set as a training node performing local training next according to a value of mutual gradient distance in the pre-calculated gradient distance matrix; weighting sampling each candidate training node according to the probability to select the first target training node.

5. The method of claim 4, wherein, The calculating of the probability of each candidate training node in the updated candidate training node set as a training node performing local training next according to the value of mutual gradient distance in the pre-calculated gradient distance matrix comprises: For each candidate training node in the updated candidate training node set, subtract the mutual gradient distance between the current training node and the candidate training node from the largest mutual gradient distance in the gradient distance matrix to obtain a gradient distance difference value corresponding to each candidate training node; According to the ratio of the gradient distance difference value corresponding to the candidate training node to the sum of the gradient distance difference values corresponding to the candidate training nodes, the probability of the candidate training node as the next training node performing local training is obtained.

6. The method of claim 1, wherein, Before obtaining the initial model parameter of the current round of iteration training and the candidate training node set, the method further comprises: Obtaining the initial model parameter of the traffic anomaly detection model; According to the local traffic data and the initial model parameter, obtaining the parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node; Receiving the parameter weight update gradient of the traffic anomaly detection model corresponding to the corresponding training node sent by other training nodes in the traffic anomaly detection system; According to the 2-norm of the parameter weight update gradient corresponding to each training node, a gradient distance matrix is calculated.

7. The method of claim 6, wherein, The method further comprises: Based on the local traffic data and the initial model parameter, the initial parameter weight update gradient of the traffic anomaly detection model corresponding to the current training node is calculated by a back propagation method as the parameter weight update gradient. 8.A device for training a traffic anomaly detection model, comprising: The device is applied to a distributed training node, and the device comprises: An initial data obtaining module is configured to obtain an initial model parameter of a current round of iteration training and a candidate training node set; the training node is a network device; A model initializing module is configured to initialize a local trained traffic anomaly detection model based on the initial model parameter; A local training module is configured to perform local training on the initialized trained traffic anomaly detection model based on local traffic data to obtain an updated model parameter of the trained traffic anomaly detection model; A candidate training node set updating module is configured to delete the local training node currently performing local training from the candidate training node set to obtain an updated candidate training node set; A first target training node selecting module is configured to, in response to the updated candidate training node set being non-empty, select a first target training node performing local training next from the updated candidate training node set based on a pre-calculated gradient distance matrix; A model parameter transferring module is configured to send the updated model parameter and the updated candidate training node set to the first target training node to trigger the first target training node to perform local training on the trained traffic anomaly detection model with the updated model parameter as an initial model parameter.

9. An electronic device comprising a memory, a processor, and program code stored on the memory and executable on the processor, wherein, The processor implements the traffic anomaly detection model training method of any one of claims 1 to 7 when executing the program code.

10. A computer-readable storage medium having stored thereon a program code, characterized in that, The program code realizes the steps of the training method of the flow anomaly detection model of any one of claims 1 to 7 when executed by the processor.

Images