Industrial control abnormal traffic detection method based on joint federated learning

Abstract

The present invention discloses an industrial control abnormal traffic detection method based on joint federated learning, comprising: generating a local training data set; a client uses the local data set to train on an initial model to obtain local model parameters, and sends the local model parameters to a server S1 to complete parameter aggregation; S1 distributes global parameters to the client, and the client starts the next round of local training; a global model M1 is obtained; the client sends local abnormal samples to a server S2, which integrates all abnormal samples, performs model training, and obtains a model M2; models M1 and M2 are combined, and industrial control equipment sensor and actuator data are collected, and the data is fed into the combined model to perform real-time anomaly detection. The present invention avoids the problem of overfitting the model to normal samples and low detection accuracy caused by the local client using an unbalanced data set for training in an industrial control environment; and has stronger generalization capabilities.

Description

Technical Field

[0001] The present invention belongs to the field of industrial control detection technology, and in particular relates to an industrial control abnormal traffic detection method based on joint federated learning. Background Art

[0002] Federated learning, an emerging machine learning technology, interconnects multiple clients across different regions and enables distributed machine learning model training by indirectly sharing training data (model weights rather than raw training samples) between clients. This technology leverages the local datasets of each participant while protecting user data privacy. It boasts numerous advantages, including high model training efficiency and robust algorithms, and is widely used in the field of abnormal traffic detection in industrial control systems.

[0003] Abnormal traffic detection technology, a key component of industrial control system security, has attracted considerable research attention in recent years, particularly due to the higher accuracy of machine learning and deep learning compared to traditional detection algorithms. With the development of federated learning, a machine learning technique that perfectly complements the distributed nature of sensors in industrial control systems, it has rapidly become a hot topic in the field of abnormal traffic detection in industrial control systems. However, the majority of traffic in industrial control systems is normal, with abnormal traffic accounting for a very small proportion. Conventional machine learning and federated learning algorithms perform poorly in training models with extremely unbalanced datasets, often resulting in slow model convergence and low test accuracy.

[0004] To improve the performance of trained models, it is important to provide high-quality, balanced datasets for model training. Classic methods for handling imbalanced datasets mainly include dataset resampling, dataset expansion, and algorithm compensation. Resampling methods include oversampling and undersampling methods, dataset expansion methods include attribute value random sampling and the Smote method, and algorithm compensation methods include introducing a cost function to reduce the weight of majority class samples and boosting methods based on ensemble learning. Among classic methods, oversampling methods are prone to cause model overfitting, while undersampling methods cannot fully utilize the dataset. The attribute value random sampling method cannot guarantee that the data attributes after sampling retain the previous linear relationship and may generate data that does not exist in reality. The Smote method is prone to marginalization of the data distribution, blurring the boundaries between positive and negative samples, and the determination of the K value relies on experience.

[0005] To address the issue of dataset imbalance within the federated learning framework, Chinese patent publication number CN112329820A discloses a sampling method and apparatus for unbalanced data within federated learning. The method uses k-means clustering to cluster majority class samples and the Smote method to generate minority class samples. The two sample sets are combined and then the Adaboost method is used to generate a local model. Finally, the model parameters are aggregated through a central server. Chinese patent publication number CN114548419A discloses a method for handling sample imbalance in longitudinal federated learning based on the OT protocol. The OT protocol is used to protect the data privacy of partners and an improved Smote method is used to generate minority class samples. Chinese patent publication number CN114529014A discloses a method for ensemble learning of unbalanced data based on federated learning. The method uses an adaptive boundary Smote algorithm to generate minority samples and uses the Tomeklinks method to eliminate duplicate data generated by the Smote method, ultimately obtaining balanced samples. These three solutions use the improved Smote method as a fundamental approach to addressing unbalanced datasets, but they still suffer from the aforementioned issues. Moreover, federated learning involves multiple clients participating in training, and the data characteristics obtained by each client may be inconsistent, which means that multiple K values ​​must be set manually, which is a cumbersome operation.

[0006] Chinese patent publication number CN114462509A discloses a distributed IoT device anomaly detection method that uses an improved autoencoder network to extract features from abnormal data in a training set, perform feature correction, and identify abnormal features, obtaining high-quality reconstructed abnormal data. This solution uses an autoencoder to extract sample features to a low-dimensional scale, which inevitably results in the loss of some useful information and poor quality of the reconstructed samples. Summary of the Invention

[0007] In the application of existing federated learning technology in abnormal traffic detection in industrial control systems, the number of abnormal samples and normal samples in the actual traffic is extremely unbalanced, resulting in slow model training convergence and poor performance. Based on the original technology, the present invention introduces a joint model, which can fully and effectively utilize the abnormal samples distributed among various clients and improve the overall detection accuracy of the federated learning model.

[0008] The present invention discloses a method for detecting abnormal industrial control traffic based on joint federated learning, comprising the following steps:

[0009] In the industrial control traffic collection and preprocessing stage, the sensor and actuator data of local industrial control equipment are obtained to generate a local training data set X l ;

[0010] During the model M1 training phase, each client uses the local dataset X l Train the local model parameters w on the initial model l, and sent to the parameter aggregation server S1 to complete parameter aggregation; the parameter aggregation server S1 will be the global parameter w g Distribute to each client, and the client starts the next round of local training; this process repeats until the global model accuracy reaches the requirement or the number of global iterations reaches E times, and the global model M1 is obtained;

[0011] During the model M2 training phase, each client sends local abnormal samples to server S2. Server S2 integrates and shuffles all received abnormal samples, performs model training, and obtains model M2.

[0012] In the model combination and anomaly detection stage, models M1 and M2 are combined, and the sensor and actuator data of industrial control equipment are collected and fed into the combined model for real-time anomaly detection.

[0013] Furthermore, in the industrial control data acquisition and preprocessing stage, each client obtains the sensor and actuator data of the local industrial control equipment once a second through the industrial control protocol, and generates the feature vector x at time t t ∈R n , n is the sum of all sensors and actuators of local industrial control equipment;

[0014] Determine the current feature vector x according to the current operating status of the industrial control system t Label y t If normal, y t =0, otherwise y t =1;

[0015] Continuously collect data until y t = 1 is greater than 50, stop collecting data; and finally form a local training sample.

[0016] Furthermore, during the training phase of model M1, the parameter aggregation server S1 first distributes the basic model w0 to each client;

[0017] Each client receives the parameter w from the parameter aggregation server S1 s , and use local data in w s The local model is iterated based on , until the maximum number of local round iterations E is reached l ; The model parameters w completed by local iteration l The parameters sent to the aggregation server;

[0018] The parameter aggregation server S1 receives the local parameters {w l1 ,w l2 ...w lN}, where N is the total number of clients; use the federated average parameter aggregation algorithm to complete the parameter aggregation of this global iteration, and set the global model parameter w g+1 Distribute to each client;

[0019] Repeat the above steps until the global model accuracy reaches the requirement or the number of global iterations reaches the preset number, and the global aggregation parameter w is obtained. end1 , complete the global model M1 training.

[0020] Furthermore, the specific calculation steps of the federated average parameter aggregation algorithm are as follows:

[0021]

[0022] Among them, w g is the global model parameter retained by the aggregation server at the last moment, η t is the learning rate, and N is the total number of clients participating in this parameter aggregation.

[0023] Furthermore, during the model M2 training phase, each client will use the local training dataset X l All abnormal samples are separated to form an abnormal sample set The abnormal sample refers to the local training data set X l In the data, the sample with data label y=1; each client collects the local abnormal sample Send to server S2;

[0024] Server S2 receives the training sample set from each client and obtains the sample set Then the sample set is shuffled to obtain the training data set X abn ;

[0025] Server S2 uses the training dataset X abn The model M2 is trained locally iteratively until the maximum number of iterations is reached or the required accuracy is achieved, which means that the training of the model M2 is completed.

[0026] Furthermore, in the model combination and anomaly detection phase, models M1 and M2 simultaneously perform industrial control detection. Through the industrial control protocol, they obtain the data of each sensor and actuator of the local industrial control equipment every second to generate the sample x to be detected;

[0027] The samples to be tested are input into the trained models M1 and M2 to obtain the anomaly rates R1 and R2 of the current samples, and the comprehensive anomaly detection score is calculated to determine whether the current industrial control system is normal.

[0028] Furthermore, the comprehensive anomaly detection score R is defined as follows:

[0029]

[0030] Among them, α is the confidence of models M1 and M2. When the anomaly detection score R is greater than the preset threshold, it means that the current industrial control system is abnormal, otherwise it is normal.

[0031] The beneficial effects of the present invention are as follows:

[0032] 1) Taking advantage of the fact that abnormal data contains less private information, we use the abnormal data set X from various clients. abn Training model M2 greatly avoids the problem in industrial control environments where the local client uses an unbalanced data set for training, which causes the model to overfit to normal samples and has low detection accuracy.

[0033] 2) A joint model is used to detect anomalies in industrial control sensor and actuator data. M1 is trained using training datasets from various clients, resulting in stronger generalization capabilities. Finally, by assigning a higher confidence level to model M2, which is more sensitive to anomalies, and combining the two to calculate the comprehensive anomaly detection score R, more accurate anomaly detection results are achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 Flowchart of the abnormal flow detection method of the present invention. DETAILED DESCRIPTION

[0035] The present invention will be further described below with reference to the accompanying drawings, but the present invention is not limited in any way. Any changes or substitutions made based on the teachings of the present invention fall within the scope of protection of the present invention.

[0036] The present invention primarily involves four phases: industrial control data acquisition and preprocessing, model M1 training, model M2 training, model integration, and anomaly detection. Model M1 has strong generalization performance, while model M2 has a good ability to capture abnormal data. The present invention uses a comprehensive score, R, to calculate the final anomaly detection score, resulting in higher anomaly detection accuracy. Figure 1 This is the overall flow chart of the present invention. In the industrial control traffic collection and preprocessing stage, each client obtains the sensor and actuator data of the local industrial control equipment every second through industrial control protocols such as Modbus TCP, S7, and IEC104, and generates a local training data set X. l During the model M1 training phase, each client uses the local dataset X l Train the local model parameters w on the initial model l , and sent to the parameter aggregation server S1 to complete parameter aggregation. S1 will be the global parameter w gThe data is distributed to each client, and the client begins the next round of local training. This process repeats until the global model reaches the required accuracy or the number of global iterations reaches E, resulting in global model M1. During the training phase for model M2, each client sends local anomaly samples to server S2. S2 integrates and shuffles all received anomaly samples for model training, resulting in model M2. During the model combination and anomaly detection phase, models M1 and M2 are first combined, and sensor and actuator data from industrial control equipment is collected. This data is fed into the combined model for real-time anomaly detection.

[0037] Specifically, the steps of each stage are as follows.

[0038] 0001. In the industrial control data acquisition and preprocessing stage, each client obtains the sensor and actuator data of the local industrial control equipment once a second through the industrial control protocol, and generates the feature vector x at time t t ∈R n Specifically, n is the total number of all sensors and actuators in the local industrial control equipment. Industrial control protocols include but are not limited to Modbus TCP, S7, IEC104, and other protocols.

[0039] 0002. Determine the current feature vector x according to the current operating status of the industrial control system t Label y t If normal, y t =0, otherwise y t =1.

[0040] 0003, continuously collect data until y t =1 is greater than a preset value, data collection is stopped, and a local training sample is finally formed. Preferably, the preset value in this embodiment is 50.

[0041] 0004. During the model M1 training phase, the parameter aggregation server S1 first distributes the basic model w0 to each client.

[0042] 0005. Each client receives the parameter w from the parameter aggregation server S1 s , and use local data in w s The local model is iterated based on , until the maximum number of local round iterations E is reached l . The model parameters w completed by local iteration l The parameter aggregation server S1 is the coordinator.

[0043] 0006. The parameter aggregation server receives local parameters from the client {w l1 ,w l2 ...w lN}, where N is the total number of clients. Use the federated average parameter aggregation algorithm to complete the parameter aggregation of this global iteration and set the global model parameter w g+1 Distribute to each client.

[0044] 0007. Specifically, the specific calculation steps of the federated average parameter aggregation algorithm mentioned in step 0006 are as follows:

[0045]

[0046] Among them, w g is the global model parameter retained by the aggregation server at the last moment, η t is the learning rate, and N is the total number of clients participating in this parameter aggregation.

[0047] 0008. Repeat steps 0005 to 0007 until the global model accuracy reaches the requirement or the number of global iterations reaches E times, and obtain the global aggregation parameter w end1 , complete the global model M1 training.

[0048] 0009. During the model M2 training phase, each client sends the local training dataset X l All abnormal samples are separated to form an abnormal sample set Specifically, abnormal samples refer to the local training dataset X l In the data, the sample with data label y=1. Each client collects the local abnormal sample Send to server S2.

[0049] 0010. Server S2 receives the training sample set from each client and obtains the sample set Then the sample set is shuffled to obtain the training data set X abn .

[0050] 0011. Server S2 uses training dataset X abn Perform local iterative training on model M2 until the maximum number of iterations is reached or the required accuracy is achieved. This completes the training of model M2.

[0051] During the model integration and anomaly detection phase, models M1 and M2 simultaneously perform industrial control testing. Using industrial control protocols such as ModbusTCP, S7, and IEC104, they acquire sensor and actuator data from local industrial control devices every second to generate samples x to be tested.

[0052] 0013. Input the sample to be tested into the trained models M1 and M2, obtain the abnormality rates R1 and R2 of the current sample, and determine whether the current industrial control system is normal by calculating the comprehensive abnormality detection score. Specifically, the comprehensive abnormality detection score R is defined as follows:

[0053]

[0054] Wherein, α is the confidence of models M1 and M2. Since model M2 is highly sensitive to abnormal samples, preferably, α<0.5. In this embodiment, α=0.3.

[0055] 0014. When the anomaly detection score R is greater than 0.5, it means that the current industrial control system is abnormal, otherwise it is normal.

[0056] In anomaly detection, when the model's anomaly detection performance is poor due to an imbalanced training dataset, most researchers use Smote or its variants to expand the original dataset to achieve a balanced dataset. The Smote algorithm easily causes data distribution marginalization, blurring the boundaries between positive and negative samples. Importantly, no matter how advanced the data generation algorithm, it is impossible to construct a dataset with the exact same distribution as the real dataset. Moreover, dataset expansion methods rely on the original data. In an independent industrial control environment, sufficient abnormal data samples cannot be provided to represent the distribution of abnormal data, which naturally leads to low quality of the expanded data samples. The present invention avoids the use of constructed datasets and fully utilizes the abnormal data samples distributed across various clients under the federated learning framework, concentrating them on the same server to complete model training. Finally, the model M1 trained under the federated learning framework is combined with the model M2 trained using multi-client abnormal data samples. The former has stronger generalization performance, while the latter has better ability to capture abnormal data. The present invention uses the comprehensive score R to calculate the final anomaly detection score, which improves the model's anomaly detection capability.

[0057] As used herein, the word "preferred" is intended to serve as an example, instance, or illustration. Any aspect or design described herein as "preferred" is not necessarily to be construed as advantageous over other aspects or designs. Rather, the use of the word "preferred" is intended to present concepts in a concrete manner. As used in this application, the term "or" is intended to mean an inclusive "or" rather than an exclusive "or." That is, unless otherwise specified or clear from the context, "X employs A or B" is intended to mean any of the naturally inclusive permutations. That is, if X employs A; X employs B; or X employs both A and B, then "X employs A or B" is satisfied in any of the foregoing examples.

[0058] Moreover, although the present disclosure has been shown and described with respect to one or implementation, those skilled in the art will think of equivalent variations and modifications based on reading and understanding of this specification and the accompanying drawings. The present disclosure includes all such modifications and variations and is limited only by the scope of the appended claims. In particular, with respect to the various functions performed by the above-mentioned components (such as elements, etc.), the terms used to describe such components are intended to correspond to any component (unless otherwise indicated) that performs the specified function of the component (such as it is functionally equivalent), even if structurally different from the disclosed structure that performs the function in the exemplary implementation of the present disclosure shown herein. In addition, although the specific features of the present disclosure have been disclosed with respect to only one of several implementations, such features can be combined with one or other features of other implementations that can be desired and advantageous for a given or specific application. Moreover, insofar as the terms "including", "having", "containing" or their variations are used in specific embodiments or claims, such terms are intended to be included in a manner similar to the term "comprising".

[0059] The functional units in the embodiments of the present invention may be integrated into a single processing module, or each unit may exist physically separately, or multiple or more units may be integrated into a single module. The aforementioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium. The aforementioned storage medium may be a read-only memory, a magnetic disk, or an optical disk, etc. The aforementioned devices or systems may execute the storage method in the corresponding method embodiment.

[0060] In summary, the above embodiment is one implementation method of the present invention, but the implementation method of the present invention is not limited to the described embodiment. Any other changes, modifications, substitutions, combinations, and simplifications that deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. The industrial control abnormal traffic detection method based on joint federated learning is characterized by: The following steps are involved: In the industrial control traffic collection and preprocessing stage, the sensor and actuator data of local industrial control equipment are obtained to generate a local training data set X l ; During the model M1 training phase, each client uses the local dataset X l Train the local model parameters w on the initial model l , and sent to the parameter aggregation server S1 to complete parameter aggregation; Parameter aggregation server S1 sends the global parameter w g Distribute to each client, and the client starts the next round of local training; this process repeats until the global model accuracy reaches the requirement or the number of global iterations reaches E times, and the global model M1 is obtained; During the model M2 training phase, each client sends local abnormal samples to server S2. Server S2 integrates and shuffles all received abnormal samples, performs model training, and obtains model M2. In the model combination and anomaly detection stage, models M1 and M2 are combined, and the sensor and actuator data of industrial control equipment are collected and fed into the combined model for real-time anomaly detection.

2. The method for detecting abnormal industrial control traffic based on joint federated learning according to claim 1 is characterized in that: In the industrial control data collection and preprocessing stage, each client obtains the sensor and actuator data of the local industrial control equipment once a second through the industrial control protocol, and generates the feature vector x at time t. t ∈R n , n is the sum of all sensors and actuators of local industrial control equipment; Determine the current feature vector x according to the current operating status of the industrial control system t Label y t If normal, y t =0, otherwise y t =1; Continuously collect data until y t = 1 is greater than 50, stop collecting data; and finally form a local training sample.

3. The method for detecting abnormal industrial control traffic based on joint federated learning according to claim 1 is characterized in that: During the model M1 training phase, the parameter aggregation server S1 distributes the basic model parameters w0 and model M1 to each client; Each client receives the parameter w from the parameter aggregation server S1 s , and use local data in w s The local model is iterated based on , until the maximum number of local round iterations E is reached l ; The model parameters w completed by local iteration l The parameters sent to the aggregation server; The parameter aggregation server S1 receives the local parameters {w l1 ,w l2 ...w lN }, where N is the total number of clients; use the federated average parameter aggregation algorithm to complete the parameter aggregation of this global iteration, and set the global model parameter w g+1 Distribute to each client; Repeat the above steps until the global model accuracy reaches the requirement or the number of global iterations reaches the preset number, and the global aggregation parameter w is obtained. end1 , complete the global model M1 training.

4. The method for detecting abnormal industrial control traffic based on joint federated learning according to claim 3 is characterized in that: The federated average parameter aggregation algorithm is specifically calculated as follows: Among them, w g is the global model parameter retained by the aggregation server at the last moment, η t is the learning rate, and N is the total number of clients participating in this parameter aggregation.

5. The method for detecting abnormal industrial control traffic based on joint federated learning according to claim 3 is characterized in that: During the model M2 training phase, each client will use the local training dataset X l All abnormal samples are separated to form an abnormal sample set The abnormal sample refers to the local training data set X l In the data, the sample with data label y=1; each client collects the local abnormal sample Send to server S2; Server S2 receives the training sample set from each client and obtains the sample set Then the sample set is shuffled to obtain the training data set X abn ; Server S2 uses the training dataset X abn The model M2 is trained locally iteratively until the maximum number of iterations is reached or the required accuracy is achieved, which means that the training of the model M2 is completed.

6. The method for detecting abnormal industrial control traffic based on joint federated learning according to claim 3 is characterized in that: In the model combination and anomaly detection phase, models M1 and M2 simultaneously perform industrial control detection. Through the industrial control protocol, they obtain the sensor and actuator data of local industrial control equipment every second to generate samples x to be tested. The samples to be tested are input into the trained models M1 and M2 to obtain the anomaly rates R1 and R2 of the current samples, and the comprehensive anomaly detection score is calculated to determine whether the current industrial control system is normal.

7. The method for detecting abnormal industrial control traffic based on joint federated learning according to claim 6 is characterized in that: The comprehensive anomaly detection score R is defined as follows: Among them, α is the confidence of models M1 and M2. When the anomaly detection score R is greater than the preset threshold, it means that the current industrial control system is abnormal, otherwise it is normal.

Images