A method, storage medium, and electronic device for defending Internet of Vehicles federated learning against Byzantine attacks

Abstract

The present invention discloses a method for defending the Internet of Vehicles (IoV) against Byzantine attacks through federated learning. The method comprises the following steps: randomly selecting K clients from M clients, and issuing an initial global model to the selected K clients on the server side; the selected K clients locally training the initial global model and uploading the updated model parameters after training to the server side; the server side obtaining the Gini gain of each client's local model relative to the global model; detecting the number and number of malicious clients based on the Gini gain; after obtaining the number and number of malicious clients, the server side screens out all malicious clients and aggregates the local models of the remaining good clients to obtain a global model; after removing the malicious clients, randomly selecting K clients and repeating the above steps until all malicious clients are screened out. The present invention can detect all malicious clients without knowing the number of malicious clients, thereby improving the accuracy and convergence of the global autonomous driving model.

Description

Technical Field

[0001] The present invention belongs to the field of privacy and security technology of federated learning, and specifically relates to a method for defending federated learning in the Internet of Vehicles against Byzantine attacks. The method can effectively defend against malicious attacks that may be encountered during the federated learning process in the Internet of Vehicles scenario, thereby improving the model accuracy of the global model and ensuring the driving safety of autonomous vehicles. Background Art

[0002] With the rapid development of autonomous driving technology, federated learning (FL) is increasingly being deployed in connected vehicle (IoV) scenarios due to its distributed and privacy-preserving features. Autonomous vehicles use local data to train server-side models. During local model training, potentially malicious users can exploit Byzantine attacks to maliciously modify local model update parameters. When these compromised local models are uploaded to the server for aggregation, they can severely impact the accuracy and convergence of the global model, posing a significant security risk. Therefore, protecting against Byzantine attacks is crucial for federated learning in IoV scenarios.

[0003] Existing solutions can be divided into defense-based algorithms and detection-based algorithms. The basic idea of ​​defense-based algorithms is that the server side finds the optimal local model among all local models through certain rules and uses this optimal local model as the global model, or finds the optimal aggregation method of all local models through certain rules. Since defense-based algorithms do not distinguish between malicious clients and good clients, it is possible that some malicious clients may still participate in the aggregation of the global model. The basic idea of ​​detection-based algorithms is to distinguish malicious clients from good clients and remove malicious clients during model aggregation, thereby eliminating the serious impact of malicious clients on the global model.

[0004] In the paper "Peva Blanchard, Rachid Guerraoui, and et al. Machine learning with adversaries: Byzantine tolerant gradient descent. InNIPS, pages 119–129, 2017," Peva Blanchard et al. proposed a defense-based algorithm called Krum. The basic idea is to select a model that is similar to all other models from among several local models as the global model. Specifically, the sum of the Euclidean distances between the local model's gradient and the gradients of other client models is used as the score of the gradient. The gradient with the lowest score, that is, the gradient that is similar to most of the gradients, is selected as the aggregate gradient.

[0005] In the paper "Dong Yin, Yudong Chen, and et al. Byzantine-robust distributed learning: Towards optimal statistical rates. arXiv preprint arXiv:1803.01498, 2018," Yin et al. proposed a new defense-based algorithm, TrimmedMean, which aggregates each dimension of local model gradients. For a given dimension, it sorts all gradient values ​​along the same dimension, removes several maximum and minimum values, and calculates the average of the remaining values ​​as the aggregate for that dimension. Because the aggregation process removes some local model parameters of abnormal clients, it reduces the impact of malicious attacks to a certain extent.

[0006] In the paper "Y.Wang, Y.Xia and Y.Zhan,"ELITE:Defending FederatedLearning against Byzantine Attacks based on Information Entropy,"2021ChinaAutomation Congress(CAC),Beijing,China,2021,pp.6049-6054,doi:10.1109 / CAC53003.2021.9727486.", Wang et al. proposed a detection-based algorithm ELITE based on information entropy. The idea is to use information entropy to measure the degree of distraction of the local model on the global model. That is, the greater the information gain of the client, the greater its negative impact on the global model. Based on this, it can be judged that the user is a malicious user.

[0007] Zheng et al. proposed a detection algorithm based on model watermark in the paper "X.Zheng,Q.Dong and A.Fu,"WMDefense:Using Watermark toDefense Byzantine Attacks in Federated Learning,"IEEE INFOCOM 2022-IEEEConference on Computer Communications Workshops (INFOCOM WKSHPS),New York,NY,USA,2022,pp.1-6,doi:10.1109 / INFOCOMWKSHPS54753.2022.9798217." The core idea is that before the formal global iteration begins, the server sends a small image dataset containing a watermark and a simple model to each client. Each client first trains the simple model with this small dataset and uploads it to the server. The server distinguishes malicious clients from good clients based on the degree of watermark decay.

[0008] Existing algorithms for resisting Byzantine attacks have the following problems: (1) Limited defense capabilities: Although existing algorithms can defend against Byzantine attacks to a certain extent, they are far from meeting the model convergence requirements. In the Internet of Vehicles scenario, if the model does not converge, it will pose a huge safety hazard to passengers and various traffic participants on the road; (2) Limited applicable scenarios: Existing algorithms are only applicable to independent and identically distributed (IID) data, while in the Internet of Vehicles scenario, the local data of each autonomous driving vehicle is mostly non-IID; (3) Existing algorithms must know the number of malicious clients to work properly, but in reality it is impossible to know the number of malicious clients in advance. Summary of the Invention

[0009] To address the above-mentioned problems in the prior art, the present invention provides a method for defending Internet of Vehicles (IoV) federated learning against Byzantine attacks. The technical problem to be solved by the present invention is achieved through the following technical solutions:

[0010] The present invention provides a method for defending Internet of Vehicles (IoV) federated learning against Byzantine attacks, comprising:

[0011] S1: Randomly select K clients from M clients to participate in the global iteration, and the server sends the initial global model to the selected K clients;

[0012] S2: The selected K clients train the initial global model locally and upload the updated model parameters after training to the server;

[0013] S3: The server obtains the Gini gain of the local model of each client among all K clients to the global model;

[0014] S4: Detect the number and serial number of malicious clients based on the Gini gain of each client’s local model to the global model;

[0015] S5: After obtaining the number and serial number of malicious clients, the server filters out all malicious clients and aggregates the local models of the remaining good clients to obtain a global model.

[0016] S6: After removing all malicious clients from the M clients, randomly select K clients again and repeat steps S1 to S5 until all malicious clients are screened out.

[0017] In one embodiment of the present invention, the S3 includes:

[0018] S3.1: Divide the i-th parameter of the last fully connected layer of the K client local models into L equal intervals, and obtain the lengths of the divided intervals;

[0019] S3.2: Obtain the probability that the i-th parameter of the last fully connected layer of the K client local models falls within the j-th equally divided interval;

[0020] S3.3: Obtain the Gini impurity G of the i-th parameter of the last fully connected layer of the K client local models based on the probability i :

[0021]

[0022] Among them, p j represents the probability that the i-th parameter of the last fully connected layer of the K client local models falls within the j-th interval;

[0023] S3.4: Accumulate the Gini impurities of all N parameters of the last fully connected layer of the K client local models to obtain the overall Gini impurity of the global model:

[0024]

[0025] Where G represents the overall Gini impurity of the global model, i≤N;

[0026] S3.5: Obtain the Gini gain of each client to the overall Gini impurity of the global model based on the overall Gini impurity of the global model:

[0027] ΔG k =GG X / k

[0028] Among them, G X / krepresents the overall Gini impurity of the remaining K-1 clients after removing the k-th client, ΔG k represents the Gini gain of the k-th client to the overall Gini impurity of the global model.

[0029] In one embodiment of the present invention, in S3.1, the length d of the equally divided interval is expressed as:

[0030]

[0031] Where Y=[Y1,Y2,...,Y i ,...,Y N ], Y represents the N parameter set of the last fully connected layer of the local model of all K clients, Y i represents the i-th parameter set of the last fully connected layer of the local model of all K clients, Y i =[Y i1 ,Y i2 ,...,Y ik ,...,Y iK ],Y ik represents the i-th parameter of the last fully connected layer of the local model of the k-th client, max(Y i ) represents the parameter set Y i The maximum value, min(Y i ) represents the parameter set Y i The minimum value in .

[0032] In one embodiment of the present invention, the S4 includes:

[0033] S4.1: Set the Gini gain ΔG of all clients k Composition set ΔG=[ΔG1,ΔG2,...,ΔG k ,...,ΔG K ], and sort the Gini gain of each client in the set ΔG from large to small to obtain the set ΔSG;

[0034] S4.2: Difference the Gini gains between two adjacent clients in the set Δ and take the absolute value, and obtain the set of Gini gain differences between adjacent clients ΔS = [ΔS1, ΔS2, ..., ΔS k ,...,ΔS K-1 ],in:

[0035] ΔS k =|ΔSG k+1 -ΔSG k |

[0036] Among them, ΔSG krepresents the kth value in the set ΔSG, ΔSG k+1 represents the k+1th value in the set ΔSG;

[0037] S4.3: Determine whether there is a malicious client among all K clients based on the Gini gain difference set ΔS;

[0038] S4.4: Obtain the number and serial number of malicious clients.

[0039] In one embodiment of the present invention, the S4.3 includes:

[0040] Set the judgment threshold U, when the Gini gain difference peak value max(ΔS k ) is greater than U, it is determined that there is a malicious client among the K clients, and the Gini gain difference ΔS k The difference reaches a peak at the boundary between malicious clients and good clients. The locations before the peak are all malicious clients, and the locations after the peak are all good clients. When the Gini gain difference peak value max (ΔS k ) is less than U, it is determined that there is no malicious client among the K clients.

[0041] In one embodiment of the present invention, the S4.4 includes:

[0042] When the Gini gain difference peak value max(Δ k ) is greater than U and there are malicious clients, the number of detected malicious clients is:

[0043] a=argmax(Δ k )

[0044] Among them, argmax(Δ k ) is the index corresponding to the peak value of the Gini gain difference in the Gini gain difference set ΔS, and a is the number of malicious clients detected.

[0045] Determine the number corresponding to each malicious client.

[0046] Another aspect of the present invention provides a storage medium storing a computer program for executing the steps of the vehicle network federated learning defense method against Byzantine attacks described in the above embodiment.

[0047] Another aspect of the present invention provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, it implements the steps of the vehicle network federated learning defense method against Byzantine attacks described in the above embodiment.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] This paper proposes a FL defense method against Byzantine attacks in connected vehicle scenarios based on Gini impurity, which can efficiently detect all malicious autonomous vehicles. Compared with existing methods, this method is not only applicable to non-IID data but can also detect all malicious clients without knowing the number of malicious clients, thereby significantly improving the accuracy and convergence of the global autonomous driving model.

[0050] 2. The method of the present invention is applicable to non-IID data and has excellent Byzantine attack defense. Existing algorithms are only applicable to independent and identically distributed data. However, in the Internet of Vehicles scenario, the data of each autonomous vehicle is mostly non-IID. Moreover, existing algorithms, especially defense-based algorithms, have very limited improvements in global model accuracy and convergence, and cannot meet the expected requirements. The present invention is not only applicable to non-IID data, but also significantly improves the accuracy and convergence of the global model.

[0051] 3. The method of the present invention can detect malicious clients using both random selection of clients and a random number of malicious clients. Existing algorithms require a fixed number of clients and a known number of malicious clients to function properly. However, in reality, it is impossible to know the number of malicious clients in advance, and clients are randomly selected. This invention effectively solves this problem, significantly improving the accuracy of the global model in connected vehicle scenarios, thereby ensuring the safety of autonomous vehicle passengers and other traffic participants.

[0052] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a typical vehicle networking scenario diagram provided by an embodiment of the present invention;

[0054] Figure 2 This is a flowchart of a method for defending a federated learning system for Internet of Vehicles against Byzantine attacks provided by an embodiment of the present invention;

[0055] Figure 3 This is a detailed flow chart of a method for defending a federated learning system for Internet of Vehicles against Byzantine attacks, provided by an embodiment of the present invention;

[0056] Figure 4 is a structural diagram of a global model provided by an embodiment of the present invention;

[0057] Figure 5 is a schematic structural diagram of another global model provided by an embodiment of the present invention;

[0058] Figure 6 Schematic diagram of the relationship between a Gini gain set Δ and a Gini gain difference set ΔS provided by an embodiment of the present invention;

[0059] Figure 7 is a graph showing the accuracy of a model trained using a non-independent and identically distributed MNIST dataset when defending using the method of an embodiment of the present invention;

[0060] Figure 8 This is a graph showing the accuracy of a model using the independent and identically distributed CIFAR-10 dataset when defending using the method of an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following is a detailed description of a federated learning defense method for Internet of Vehicles against Byzantine attacks proposed by the present invention, combined with the accompanying drawings and specific implementation methods.

[0062] The aforementioned and other technical contents, features, and effects of the present invention are clearly presented in the following detailed description of the specific embodiments in conjunction with the accompanying drawings. Through the description of the specific embodiments, a deeper and more specific understanding of the technical means and effects adopted by the present invention to achieve the intended purpose can be obtained. However, the accompanying drawings are provided for reference and illustration purposes only and are not intended to limit the technical solutions of the present invention.

[0063] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations are intended to cover non-exclusive inclusion, such that an article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the article or device comprising the element.

[0064] The embodiments of this invention primarily defend against Byzantine attacks, which are categorized as data poisoning and model poisoning. Model poisoning attacks are more destructive to models and are less expensive to implement. Model poisoning attacks directly alter model parameters during training, preventing them from outputting correct results.

[0065] There are two typical forms of model poisoning attacks:

[0066] (1) Additive noise attack: A malicious client adds Gaussian noise to the model parameters, thereby affecting the performance of the global model.

[0067] (2) Model parameter sign flip attack: A malicious client can flip the sign of the parameters of the local model, thereby affecting the performance of the global model.

[0068] When a local model (or model) attacked by either of these two attacks is uploaded to the server and aggregated into the global model, it can have a significant negative impact on the global model. The server then distributes this global model to each autonomous vehicle (or client). Using this global model for autonomous driving can endanger the lives and property of passengers and other road users. Therefore, defending against Byzantine attacks is crucial in connected vehicle scenarios.

[0069] See Figure 1 , Figure 1 This is a typical IoV scenario at an intersection. The server randomly selects the nearest autonomous vehicle to participate in the model training process. Assuming there are M clients, including an unknown number of malicious clients subject to Byzantine attacks, K clients are randomly selected from all M clients in each round to participate in the global iteration, simulating a scenario in which IoV clients are randomly selected and have a random number of malicious clients. This embodiment of the present invention is based on the Federated Averaging Algorithm (FedAvg).

[0070] See Figure 2 and Figure 3 The vehicle network federated learning defense method of this embodiment includes:

[0071] S1: Randomly select K clients from M clients to participate in the global iteration, and the server sends the initial global model to the selected K clients;

[0072] The global model is a CNN network model. In this embodiment, two different CNN network models are trained using the MNIST dataset and the CIFAR-10 dataset during the verification process. Figure 4 , Figure 4 This is a structural diagram of a global model provided by an embodiment of the present invention. For the MNIST dataset, the structure of the CNN network model is as follows: the first layer is a convolution layer with 1 channel and 10 convolution kernels, each with a size of 5*5; the second layer is a maximum pooling layer with a size of 2*2; the third layer is a convolution layer with 10 channels and 20 convolution kernels, each with a size of 5*5; the fourth layer is a maximum pooling layer with a size of 2*2; the fifth layer is a dropout layer with a dropout rate of 0.5; the sixth layer is a fully connected layer with a size of 320*50; the seventh layer is a fully connected layer with a size of 50*10; and the activation function uses the ReLu function.

[0073] See Figure 5 , Figure 5 This is a schematic diagram of the structure of another global model provided by an embodiment of the present invention. For the CIFAR-10 dataset, the CNN network model structure is as follows: the first layer is a convolutional layer with 3 channels and 6 convolution kernels, each of which has a size of 5*5; the second layer is a maximum pooling layer with a size of 2*2; the third layer is a convolutional layer with 6 channels and 16 convolution kernels, each of which has a size of 5*5; the fourth layer is a maximum pooling layer with a size of 2*2; the fifth layer is a fully connected layer with a size of 400*120; the sixth layer is a fully connected layer with a size of 120*84; the seventh layer is a fully connected layer with a size of 84*10; and the activation function uses the ReLu function.

[0074] S2: The selected K clients train the initial global model locally and upload the updated model parameters after training to the server;

[0075] In the experimental verification, the MNIST dataset or CIFAR-10 dataset is distributed to all clients. Each client uses the data allocated to it to train the model. There will be a local training round number, such as 10 rounds, which means that the training is completed after each client trains for 10 rounds.

[0076] S3: The server uses the Parzen-Window method to obtain the Gini impurity of the i-th parameter of the last fully connected layer of all K client local models, the overall Gini impurity of the global model, and the Gini gain of each client.

[0077] When calculating the Gini impurity of each local model, because the number of parameters in the CNN network is too large and requires high computer computing power, we choose the parameters of the last fully connected layer of the model to calculate the Gini impurity of each local model and use the Parzen-Window function to obtain the probabilities of all local model parameters.

[0078] Step S3 of the embodiment of the present invention specifically includes:

[0079] S3.1: Divide the i-th parameter of the last fully connected layer of the K client local models into multiple intervals and obtain the length of the divided intervals:

[0080]

[0081] Where Y=[Y1,Y2,...,Y i ,...,Y N ], Y represents the N parameter set of the last fully connected layer of the local model of all K clients, Y irepresents the i-th parameter set of the last fully connected layer of the local model of all K clients, Y i =[Y i1 ,Y i2 ,...,Y ik ,...,Y iK ],Y ik represents the i-th parameter of the last fully connected layer of the local model of the k-th client, max(Y i ) represents the parameter set Y i The maximum value, min(Y i ) represents the parameter set Y i L represents dividing the i-th parameter of the last fully connected layer of the K client local models into L intervals, and d represents the length of the divided interval, where i≤N, preferably, L=5.

[0082] S3.2: Obtain the probability that the i-th parameter of the last fully connected layer of the K client local models falls within the j-th interval.

[0083] Specifically, first obtain the number of clients m whose i-th parameter falls within the j-th interval in the last fully connected layer of the K client local models j :

[0084] m j =count(j) (2)

[0085] Where j≤L.

[0086] Next, obtain the probability p that the i-th parameter of the last fully connected layer of the K client local models falls within the j-th interval j :

[0087] p j =m j / K (3)

[0088] S3.3: Obtain the Gini impurity G of the i-th parameter of the last fully connected layer of the K client local models based on the probability i :

[0089]

[0090] Formulas (1) to (4) are the process of calculating the Gini impurity using the Parzen-Window method.

[0091] S3.4: Accumulate the Gini impurities of all N parameters of the last fully connected layer of the K client local models to obtain the overall Gini impurity of the global model:

[0092]

[0093] Here, G represents the overall Gini impurity of the global model.

[0094] S3.5: Obtain the Gini gain of each client to the overall Gini impurity of the global model based on the overall Gini impurity of the global model:

[0095] Δ G k = G - G X / k (6)

[0096] Among them, G X / k represents the overall Gini impurity of the remaining K-1 clients after removing the k-th client, Δ k represents the Gini gain of the k-th client to the overall Gini impurity of the global model.

[0097] S4: Detect malicious clients based on the Gini gain of each client’s local model to the global model.

[0098] The embodiment of the present invention distinguishes malicious clients from good clients by determining the Gini gain of each client's local model to the global model. The Gini gain Δ of the kth client's local model to the global model is k The larger it is, the greater the negative impact it has on the global model, thereby detecting malicious clients.

[0099] Specifically, the Gini gain Δ of each client is calculated using formula (6): k , and get the set Δ=[Δ1,ΔG2,...,ΔG k ,...,ΔG K ], sort the Gini gain of each client in Δ from large to small to obtain the set Δ. The clients at the front of the set Δ are the clients with larger Gini gains, and these clients have a greater negative impact on the global model.

[0100] Since the number of malicious clients is unknown, it is currently impossible to determine which users are malicious clients. Experiments show that the difference in Gini gain between good clients and malicious clients is much greater than the difference in Gini gain between good clients and malicious clients. Differences between the Gini gains of two adjacent clients in the set Δ are taken and their absolute values ​​are taken to obtain the set of Gini gain differences between adjacent clients Δ = [Δ1, ΔS2, ..., ΔS k ,...,ΔS K-1 ],in:

[0101] Δ S k =|Δ SG k+1 -Δ SG k | (7)

[0102] Among them, Δ k represents the kth value in the set Δ, Δ k+1 Represents the k+1th value in the set Δ.

[0103] Since the number of malicious clients is unknown, a judgment threshold U is added. When the peak value (maximum value) of the Gini gain difference is max(Δ k ) is greater than U, it is determined that there is a malicious client among all K clients, and the Gini gain difference Δ k The difference reaches a peak at the boundary between malicious clients and good clients. All the locations before the peak are malicious clients, and all the locations after the peak are good clients. Figure 6 , Figure 6 ΔS is a schematic diagram of the relationship between a Gini gain set Δ and a Gini gain difference set Δ provided by an embodiment of the present invention. k The peak value is reached at position 7. It can be seen that the positions before the peak (numbers 1-7) are all malicious clients, and the positions after the peak (numbers 8-20) are all good clients. k ) is less than U, it is determined that there is no malicious client, and U is usually 1 to 2.

[0104] When the Gini gain difference peak value max(Δ k ) is greater than U and there are malicious clients, the number of malicious clients detected is:

[0105] a=argmax(Δ S k ) (8)

[0106] Among them, argmax(Δ k ) is the index corresponding to the peak value of the Gini gain difference in the Gini gain difference set Δ, and a is the number of malicious clients detected.

[0107] Then determine the number corresponding to each malicious client.

[0108] S5: After the server obtains the number and serial number of malicious clients, it filters out all malicious clients and aggregates the local models of the remaining good clients to obtain the global model.

[0109] S6: After removing the malicious clients from the M clients, randomly select K clients and repeat steps S1 to S5 until all malicious clients are screened out.

[0110] Specifically, users who have been determined to be malicious clients are no longer selected to participate in the iteration process in the future global iteration process, so that all malicious clients can be screened out one by one in the first few rounds of global iteration process. In this embodiment, the number of global iterations is set to 50 rounds.

[0111] The following simulation experiments further illustrate the effectiveness of the vehicle network federated learning defense method against Byzantine attacks in an embodiment of the present invention.

[0112] Specifically, in Figure 1 In the scenario shown, 40 autonomous vehicles (M=40) are set up within the coverage area of ​​three roadside units, numbered 1-40. In each global iteration, the three roadside units randomly select 20 autonomous vehicles close to themselves from all 40 autonomous vehicles to participate in the global iteration. 40% of these 40 vehicles are randomly selected to be subject to Byzantine attack. The malicious autonomous vehicles are numbered 2, 4, 5, 6, 7, 11, 14, 16, 18, 21, 22, 24, 26, 28, 30, and 32. Since the clients are randomly selected, the number of malicious clients in each global iteration is unknown. The experimental results are shown in Figure 2. Figure 7 and Figure 8 As shown, Figure 7 The accuracy of the defense using the method of the embodiment of the present invention when the model trained with the non-independent and identically distributed MNIST dataset is used. Figure 8 It is the accuracy of the defense using the method of the embodiment of the present invention using the model of the independent and identically distributed CIFAR-10 dataset. Figure 7 and Figure 8 In the table, noattack acc represents the global model accuracy of the FedAvg algorithm when not attacked by Byzantine attacks; GINI flip acc represents the global model accuracy of the present invention when attacked by model parameter sign flipping; GINI noise acc represents the global model accuracy of the present invention when attacked by additive noise; nodefense flip acc represents the global model accuracy of the FedAvg algorithm when attacked by model parameter sign flipping; nodefense noise acc represents the global model accuracy of the FedAvg algorithm when attacked by additive noise.

[0113] pass Figure 7 and Figure 8 As can be seen, in the IoV scenario, when clients are attacked by model parameter sign flipping and additive noise, the method of this embodiment of the present invention can filter out all malicious clients without knowing the number of malicious clients, regardless of whether the data is independent and identically distributed (IID) or non-IID data, with an accuracy very close to that of a non-attacked scenario. Therefore, this method of this embodiment of the present invention can be deployed in IoV scenarios where users are randomly selected and the number of malicious users is random.

[0114] The present invention's Internet of Vehicles federated learning defense method against Byzantine attacks is applicable to non-independent and identically distributed data and has a good Byzantine attack defense effect. Existing algorithms are only applicable to independent and identically distributed data. However, in the Internet of Vehicles scenario, the data of each autonomous driving vehicle is non-independent and identically distributed in most cases. Moreover, the existing algorithms, especially defense-based algorithms, have very limited improvements in the accuracy and convergence of the global model and cannot meet the expected requirements. The present invention is not only applicable to non-independent and identically distributed data, but also significantly improves the accuracy and convergence of the global model. The method of the present invention can detect malicious clients when the client is randomly selected and the number of malicious clients is randomly selected. Existing algorithms must work properly under the premise of fixed clients and knowing the number of malicious clients. However, in reality, it is impossible to know the number of malicious clients in advance, and the clients are randomly selected. The present invention solves this problem well, significantly improving the model accuracy of the global model in the Internet of Vehicles scenario, thereby ensuring the safety of passengers and other traffic participants in autonomous vehicles.

[0115] Another embodiment of the present invention provides a storage medium storing a computer program for executing the steps of the vehicle network federated learning defense method against Byzantine attacks described in the above embodiments. Another aspect of the present invention provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, the steps of the vehicle network federated learning defense method against Byzantine attacks described in the above embodiments are implemented. Specifically, the above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium and includes several instructions for causing an electronic device (which can be a personal computer, server, or network device, etc.) or a processor to execute some of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program code, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0116] The above is a further detailed description of the present invention in conjunction with specific preferred embodiments, and the specific implementation of the present invention should not be considered to be limited to these descriptions. For those skilled in the art of the present invention, without departing from the concept of the present invention, several simple deductions or substitutions can be made, which should be considered to fall within the scope of protection of the present invention.

Claims

1. A method for defending Internet of Vehicles federated learning against Byzantine attacks, characterized in that: include: S1: From M Randomly select from clients K The client participates in the global iteration, and the server is the selected K Each client sends the initial global model; S2: The selected K Each client trains the initial global model locally and uploads the updated model parameters after training to the server; S3: Server-side Get All K The Gini gain of each client's local model to the global model; S4: Detect the number and serial number of malicious clients based on the Gini gain of each client’s local model to the global model; S5: After obtaining the number and serial number of malicious clients, the server filters out all malicious clients and aggregates the local models of the remaining good clients to obtain a global model. S6: From M After removing all malicious clients from the clients, randomly select K Repeat steps S1 to S5 for each client until all malicious clients are filtered out. The S4 includes: S4.1: Gini gain of all clients Composition Collection , and for the set The Gini gain of each client is sorted from large to small to get the set ; S4.2: Yes The difference between the Gini gains of two adjacent clients is calculated and the absolute value is taken to obtain the set of Gini gain differences between adjacent clients. = ,in: in, express Middle k values, express Middle k +1 value; S4.3: Based on the Gini gain difference set Judge all K Whether there are malicious clients among the clients; S4.4: Obtain the number and serial number of malicious clients.

2. The method for defending Internet of Vehicles federated learning against Byzantine attacks according to claim 1, characterized in that: The S3 includes: S3.1: The The last fully connected layer of the client local model Parameters are divided into L intervals and obtain the lengths of the equally divided intervals; S3.2: Obtain the The last fully connected layer of the client local model The parameters fall into The probability of being in an equally divided interval; S3.3: Obtain according to the probability The last fully connected layer of the client local model Gini impurity of parameters : in, express The last fully connected layer of the client local model The parameters fall into The probability within an interval; S3.4: Yes All the last fully connected layers of the client local model The Gini impurity of each parameter is accumulated to obtain the overall Gini impurity of the global model: in, represents the overall Gini impurity of the global model, ≤ ; S3.5: Obtain the overall Gini impurity of each client pair based on the global model Gini gain of overall Gini impurity: in, Indicates removal of Clients remaining The overall Gini impurity of the client, Indicates the Client pairs Gini gain of the overall Gini impurity.

3. The method for defending Internet of Vehicles federated learning against Byzantine attacks according to claim 2, characterized in that: In S3.1, the length of the equally divided interval The expression is: in, , Indicates all The last fully connected layer of the local model of the client A set of parameters, all The last fully connected layer of the local model of the client No. A set of parameters, Indicates the The last fully connected layer of the local model of the client No. parameters, Represents a parameter set Represents a parameter set The minimum value of .

4. The method for defending Internet of Vehicles federated learning against Byzantine attacks according to claim 3, characterized in that: The S4.3 includes: Setting judgment thresholds , when the peak value of the Gini gain difference Greater than When K There are malicious clients among the clients, and the Gini gain difference The difference reaches a peak at the boundary between malicious clients and good clients. The locations before the peak are all malicious clients, and the locations after the peak are all good clients. When the Gini gain difference peak Less than When the K There are no malicious clients among the clients.

5. The method for defending Internet of Vehicles federated learning against Byzantine attacks according to claim 4, characterized in that: The S4.4 includes: When the Gini gain difference peaks Greater than When there are malicious clients, the number of detected malicious clients is: in, is the peak value of the Gini gain difference in the Gini gain difference set ∆ S The corresponding index in is the number of malicious clients detected; Determine the number corresponding to each malicious client.

6. A storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the method for defending the Internet of Vehicles against Byzantine attacks according to any one of claims 1 to 5.

7. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor calls the computer program in the memory, it implements the steps of the vehicle network federated learning defense method against Byzantine attacks as described in any one of claims 1 to 5.

Images