A malicious code model detection method, device and computer readable medium

Abstract

The application discloses a malicious code model detection method and device and a computer readable medium. Local models generated by respective local model training of each edge side device are obtained to obtain a local model set. Similarities between a single local model in the local model set and other local models except the single local model are determined to obtain a similarity set corresponding to each single local model. According to the similarity set corresponding to each single local model, a local model with a similarity satisfying a preset condition is determined from the local model set as a malicious code model. The application solves the risk diffusion problem caused by the malicious code model by calculating the similarities between the local models and detecting the local model with the similarity satisfying the preset condition as the malicious code model.

Description

Technical Field

[0001] This application belongs to the field of Internet security technology, and in particular relates to a method, apparatus and readable medium for detecting malicious code models. Background Technology

[0002] In recent years, privacy breaches have occurred frequently, making effective privacy protection a research hotspot. Federated learning, as a distributed machine learning training framework with privacy-preserving characteristics, can protect the privacy of data shared by participating users by allowing source data to remain locally while only model parameters are interacted. However, the applicant has discovered that malicious code can be embedded in the parameters of federated learning models, potentially leading to the spread of risk through the model data. Summary of the Invention

[0003] In view of this, this application provides a malicious code model detection method, apparatus and computer-readable medium to address the problem that malicious code is embedded in the parameters of federated learning models, thereby causing the spread of risks through the smuggling of malicious code into the model data.

[0004] To address the above problems, this application provides the following solution:

[0005] A malicious code model detection method includes:

[0006] Obtain the local models generated by each edge device through its own local model training to obtain a local model set;

[0007] Determine the similarity between each individual local model in the local model set and each of the other local models besides the individual local model, and obtain the similarity sets corresponding to each individual local model;

[0008] Based on the similarity sets corresponding to the different individual local models, the local models whose similarity satisfies the preset conditions are determined from the local model set and used as malicious code models.

[0009] Optionally, obtaining the local models generated by each edge device through its own local model training to obtain a local model set includes:

[0010] Get the local models generated by each edge device training its corresponding pre-trained model based on its local data, and obtain the local model set;

[0011] The pre-trained model is either the current round global model obtained by the edge device from the central device, or a model built locally by the edge device. The current round global model is either a model obtained by the central device updating the previous round global model based on the latest local model set obtained from each edge device, or a model built based on the latest local model set obtained from each edge device.

[0012] Optionally, determining the similarity between a single local model in the local model set and each of the other local models besides the single local model, to obtain the similarity corresponding to each of the different single local models, includes:

[0013] Determine the model distances between each individual local model in the local model set and all other local models besides the individual local model, thereby obtaining model distance sets corresponding to different individual local models; wherein, model distance characterizes model similarity, and model distance and model similarity are inversely correlated. Optionally, determining the model distances between each individual local model in the local model set and all other local models besides the individual local model includes:

[0014] Obtain the parameter data of the single local model and each other local model at each corresponding position;

[0015] Based on the parameter data of the single local model and each other local model at each corresponding position parameter, determine the parameter distance between the single local model and each other local model at each corresponding position parameter;

[0016] Based on the parameter distances between the single local model and each other local model at their respective corresponding position parameters, the model distances between the single local model and each other local model are determined, thus obtaining the model distances between the single local model and each other local model in the local model set.

[0017] Optionally, determining the model distance between the single local model and each other local model based on the parameter distance between the single local model and each other local model at corresponding position parameters, and obtaining the model distance between the single local model in the local model set and each other local model respectively, includes:

[0018] A preset statistic is determined for the parameter distance between the single local model and each other local model at each corresponding position parameter, and the determined preset statistic is used as the model distance between the single local model and the corresponding other local models.

[0019] Optionally, the step of determining the similarity from the local model based on the similarity corresponding to the different individual local models is...

[0020] The local models that meet the preset similarity criteria are identified from the set of models and used as malicious code models, including:

[0021] Based on the model distance sets corresponding to different individual local models, the local models whose model distances satisfy preset conditions are determined from the local model sets and used as malicious code models.

[0022] Optionally, the step of determining, based on the model distance sets corresponding to different individual local models, the local models whose model distances satisfy preset conditions from the local model set as malicious code models includes:

[0023] For each individual local model, based on the model distance set corresponding to the individual local model, determine the local models in the local model set whose model distances satisfy the distance condition with the individual local model, and use them as candidate models; the distance condition should at least be used to ensure that the model distance between the determined candidate model and the individual local model is greater than the model distance between the non-candidate models in the model distance set and the individual local model;

[0024] Initiate a voting request for candidate models corresponding to different single local models;

[0025] Obtain the voting results of the candidate models corresponding to different single local models;

[0026] Based on the obtained voting results, the local models that meet the voting conditions among the candidate models corresponding to different single local models are identified as malicious code models.

[0027] The preset conditions include the distance condition and the voting condition.

[0028] Optionally, the number of determined malicious code models is one, and each malicious code model represents an attacker; the method further includes:

[0029] Get the number of attackers configured;

[0030] When the attacker count representation needs to detect multiple attackers, the model distance set corresponding to the malicious code model and the model distance of the malicious code model in the model distance sets corresponding to other single local models are removed from the model distance sets corresponding to different single local models to obtain the updated model distance sets corresponding to the other single local models.

[0031] For each of the other single local models, the updated model distance set is used to trigger the step of determining the local model whose model distance satisfies the preset condition from the local model set based on the model distance set corresponding to each of the different single local models, as a malicious code model, until the configured number of malicious code models are detected.

[0032] A malicious code model detection device, comprising:

[0033] The model acquisition unit is used to acquire the local models generated by each edge device through its own local model training, and obtain a local model set;

[0034] The first determining unit is used to determine the similarity between a single local model in the local model set and each of the other local models besides the single local model, so as to obtain the similarity corresponding to the different single local models respectively;

[0035] The second determining unit is used to determine, based on the similarity corresponding to the different single local models, the local models whose similarity satisfies the preset conditions from the local model set, and use them as malicious code models.

[0036] A computer-readable medium having a computer program stored thereon, which, when executed by a processor, can be used to implement the malicious code model detection method as described in any of the above.

[0037] As can be seen from the above scheme, the malicious code model detection method, apparatus, and computer-readable medium disclosed in this application acquire local models generated by each edge device through its own local model training, obtain a local model set, determine the similarity between each individual local model in the local model set and each other local model outside the individual local model, obtain the similarity set corresponding to each individual local model, and determine the local model whose similarity meets the preset conditions from the local model set based on the similarity sets corresponding to each individual local model, as the malicious code model. This application solves the risk diffusion problem caused by malicious code models by calculating the similarity between each local model and detecting the corresponding local model whose similarity meets the preset conditions as a malicious code model. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0039] Figure 1This is a schematic diagram illustrating the working principle of federal learning provided in this application;

[0040] Figure 2 This is a schematic diagram of the multilayer neural network model provided in this application;

[0041] Figure 3 This is a schematic diagram of the IEEE 754 single-precision floating-point data representation method provided in this application;

[0042] Figure 4 This is a diagram illustrating the propagation of malicious code through a model supply chain;

[0043] Figure 5 This is a schematic diagram illustrating the use of a model for malicious code delivery in federated learning, as provided in this application.

[0044] Figure 6 This is a flowchart illustrating one of the malicious code model detection methods provided in this application;

[0045] Figure 7 This is a distance diagram of model parameters provided in this application, and another flowchart of a malicious code model detection method;

[0046] Figure 8 This is another flowchart illustrating the malicious code model detection method provided in this application;

[0047] Figure 9 This is a structural diagram of the malicious code model detection device provided in this application. Detailed Implementation

[0048] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0049] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0050] It should be noted that the concepts of "first" and "second" mentioned in this application are only used to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0051] It should be noted that the terms "a" and "a plurality of" used in this application are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0052] In recent years, federated learning, as a privacy-preserving distributed machine learning training framework, has become a research hotspot. Federated learning primarily protects the privacy of shared user data by ensuring that source data remains local while only model parameters are exchanged, thus achieving secure data sharing and collaborative analysis. However, due to attacks such as model inversion, member inference, model extraction, and model smuggling, both the global model on the central device and the local model on the edge device still suffer from privacy leaks and malicious model attacks. In particular, attackers can embed malicious code into model parameters, which not only evades security detection but also does not affect the accuracy of the model it belongs to, while simultaneously achieving the goal of malicious code propagation, thus posing a serious threat to the entire federated learning system. Therefore, this application primarily addresses the risk propagation problem caused by attackers using frequently interacting model data during federated learning to embed malicious code.

[0053] To address the aforementioned issues, this application discloses a method, apparatus, and computer-readable medium for detecting malicious code models. This method can be applied to central-side devices. By determining the model distance between local models trained locally on each edge-side device associated with the central-side device, and using the model distance to quantify the similarity between models, local models carrying malicious code are detected, thereby solving the risk diffusion problem caused by malicious code models.

[0054] In this context, edge devices can be client devices in a federated learning scenario, primarily used for training local models, which can also be referred to as local models of the client devices. Central devices can be central servers in a federated learning scenario, used to generate a global model by aggregating the local models from various client devices during federated learning. Furthermore, this embodiment of the application adds a malicious code model detection function based on the processing logic of this application.

[0055] Federated learning is a distributed machine learning training framework that primarily consists of clients and a central server. There are typically multiple clients, each participating in the federated learning process. The central server can also be called a parameter aggregator. Under the coordination of the central server, clients collaboratively train the model. Each client uses local data to train a local model, and the central server is responsible for weighted aggregation of these local models to generate a global model. After multiple iterations, federated learning yields a model with accuracy similar to that of centralized training, effectively reducing the data privacy risks associated with centralized training through the aggregation of source data. See also... Figure 1 It provides a schematic diagram of how federated learning works.

[0056] As shown in the figure, assume there are k clients, each with a privacy dataset D. i (i∈k), machine learning training is performed under the coordination of the central server, where the training steps for the r-th round are as follows:

[0057] Step 1) Each client downloads the global model θ obtained from r-1 rounds of training from the center. r Then use dataset D i Training on θ r Continue training to obtain a local model

[0058] Step 2) Then all parties will Upload to the center.

[0059] Step 3) After receiving all local models, the center performs a weighted average to obtain the global model θ. r+1 Repeat the above three steps until the global model converges or the model accuracy reaches the specified threshold, at which point training can stop. During the first round of training, the client can download the pre-trained model θ from the center. 1 Otherwise, each client can directly use local data for training.

[0060] Based on the data characteristics and the distribution of data samples in the client, federated learning can generally be divided into horizontally federated learning (HFL), vertically federated learning (VFL), and federated transfer learning (FTL).

[0061] Federated learning further categorizes HFL (Handed Learning Federation) into enterprise-oriented HFL (H2B) and consumer-oriented HFL (H2C) based on the number of participants, the frequency of their participation in model aggregation, and their technical capabilities. In the H2B model, there are typically only a few participants, each frequently selected for parameter aggregation, and these participants often possess high technical capabilities and computing power. In the H2C model, there may be thousands or even millions of participants. In each round of training, the aggregator usually selects only a subset for parameter aggregation, thus the chance of each participant being frequently selected for parameter aggregation is low, and they typically have limited computing power.

[0062] Currently, attackers employ a variety of attack methods. In advanced malware activities such as botnets, ransomware, and APTs, some attackers attach malicious code to seemingly harmless carriers, such as images, without altering the carrier's structure. Ordinary users typically cannot see this secret information, but this malicious code is easily detected by detection software. An even more covert intrusion method uses steganography to embed malicious code into the carrier; however, typical steganographic carriers are unsuitable for transmitting large malware due to their limited channel capacity. Nowadays, another attack method involves embedding malicious code into machine learning model parameters to evade security detection. This method can carry large malware without affecting the model's accuracy.

[0063] See Figure 2 As shown, Figure 2 This is a schematic diagram of the multilayer neural network model provided in this application.

[0064] In a neural network model, each neuron has several weight parameters and one bias parameter. The output of the first neuron in the hidden layer h1 can be expressed as: o1=f(∑x i ·w 1i +b1).

[0065] Where f represents the activation function, x i w represents the upper-level input. 1i `b` represents the weight value of each input to this neuron, and `b` is the bias value of this neuron. Most machine learning programming frameworks use IEEE 754 single-precision floating-point numbers as the default storage type for neural network parameters. For example... Figure 3 As shown, an IEEE 754 single-precision floating-point number can be represented as S×1.M×2. E The sign bit (S) determines the sign of the floating-point number, the exponent bit (E) is a power of 2, and its function is to weight the floating-point number; the mantissa bit (M) is the binary fraction, representing the significant fraction of the floating-point number.

[0066] The attacker's proposed StegoNet embeds malware into deep neural network models (DNNs) and then propagates it through the DNN model supply chain. Four methods can be used to embed malware: Least Significant Bit (LSB) substitution, resilient training, value mapping, and sign mapping. Borrowing from the LSB algorithm in image steganography, StegoNet embeds malware into DNN models by substituting the least significant bits of the model parameters. For large DNN models, this method can embed large malware without degrading model performance. However, for smaller models, model performance drops sharply as the number of malware bytes increases. In resilient training, the attacker first selects some model parameters for malware embedding, then fixes these parameters and retrains the model to restore its accuracy to the state before malware embedding. Compared to the LSB substitution method, this method can embed larger malware into the model. Value mapping and sign mapping methods map malware bytes to model parameters, but these mapping methods require a permutation mapping table to recover the malware, which limits the size of the embedded malware.

[0067] By analyzing the format of floating-point numbers, it was found that the absolute value of a floating-point number is determined by the exponent. Adjusting the exponent can fix the absolute value within a certain range. For example, setting bits 3-6 of a floating-point number to 1 and the last 24 bits to any value (i.e., 0x3c000000 to 0x3cffffff) results in an absolute value between 0.0078 and 0.0313. Therefore, a method was proposed to fix the first byte of neuron parameters to 0x3c or 0xbc, and then embed malware in the following 3 bytes. This limits parameter variations to a certain range, and retraining ensures model accuracy. The feasibility of this rapid replacement was verified on different models and malware samples, such as embedding 36.9MB of malware into a 178MB AlexNet model, with less than 1% loss in model accuracy.

[0068] Industry researchers have found through experiments that conventional malware detection engines are ineffective at detecting malicious code models. Furthermore, experiments have shown that due to the complexity of DNNs, traditional steganalysis methods are ineffective against StegoNet. In response, researchers have proposed converting neuron parameters from floating-point numbers to hexadecimal representation before comparing them with existing malware feature databases. However, this feature database-based detection method is easily circumvented through encryption. They have also pointed out that proactively eliminating potential malware within the model through model compression, pruning, and tuning while maintaining model accuracy is crucial. However, the applicant's research reveals that in federated learning, the central server simply distributes a weighted aggregation of local models to each client to obtain a global model. Once training begins, the machine learning model structure and hyperparameters are fixed and cannot be modified. Therefore, proactively eliminating potential malware within the model is not applicable to federated learning.

[0069] Therefore, this application primarily provides countermeasures against attackers who launch attacks through the model supply chain. See also Figure 4 This provides a schematic diagram of malicious code propagation through a model supply chain.

[0070] Attackers first train or download a pre-trained model, then embed malware into it. Based on the model's accuracy after embedding the code, they determine whether further fine-tuning is needed to improve performance. The attackers then distribute the maliciously-injected model to the internet, controlling victim hosts to download the model, extract the malware, and execute it.

[0071] To address the aforementioned attack methods, this application further establishes a corresponding threat model. Specifically, the threat model is built within an enterprise-oriented horizontal federated learning scenario, such as... Figure 5 As shown, assuming there are k clients and 1 central server in the federated learning system, the threat model is defined as follows:

[0072] Victim: The victim is the Federated Learning Center. We assume that the center deploys its model aggregation service in a secure environment that uses the detection method proposed in this paper to analyze the received client models. After passing the detection, the client models are also subjected to performance testing. Therefore, if a client model fails the detection or its performance is too low, it will not be sent to the center.

[0073] Attacker: We assume the attacker is one of the clients participating in federated learning training, meaning the attacker's capabilities are limited and they cannot collude to attack by controlling multiple clients. Furthermore, the attacker possesses the data for training the model and will adhere to the federated learning protocol to perform model training normally, only embedding malware into the model after local training is complete.

[0074] Attacker's objective: The attacker's objective is to execute malware on the central server, because the central server tests the performance of client models. Therefore, the attacker needs to ensure that the performance of the model embedding malicious code is not too low, which would cause the model to be rejected.

[0075] Honest Model: An honest model refers to a local model trained by the client following a federated learning protocol and without any embedded data.

[0076] See Figure 6 The flowchart shown illustrates a malicious code model detection method. For the aforementioned threat model, the malicious code model detection method provided in this application includes the following processing flow:

[0077] Step 101: Obtain the local models generated by each edge device through its own local model training to obtain the local model set.

[0078] Specifically, the central device acquires local models generated by each edge device training its corresponding pre-trained model based on its local data, thus obtaining a local model set.

[0079] The pre-trained model can be the current round global model obtained by the edge device from the central device, or a model built locally by the edge device. The current round global model is either a model obtained by the central device by updating the previous round global model based on the latest local model set obtained from each edge device, or a model built based on the latest local model set obtained from each edge device.

[0080] For example, in a federated learning scenario, the local model set can be the local model set for the first round of training, which is composed of the local models obtained by the central server from the client based on the pre-trained model during the first round of training, or it can be the local model set for the current round of training, which is composed of the local models obtained by the central server from the client after several rounds of training.

[0081] Step 102: Determine the similarity between each individual local model in the local model set and each of the other local models besides the individual local model, and obtain the similarity set corresponding to each individual local model.

[0082] Specifically, at the beginning of each training round of federated learning, the central side will use the global model θ obtained from the previous training round. r This is sent to each client participating in the training, because each client is working on model θ. r Based on this, the client continues training using its private data, and all clients share a common goal: to reduce model loss and thus improve model accuracy. Therefore, each client obtains a local model θ. ir Models should be similar to each other. However, if an attacker arbitrarily embeds malicious code in the model parameters (such as the last three bytes of the model parameters), and does not change the parameter size to improve model accuracy like an honest model, the similarity between the malicious code model and the honest model will inevitably decrease. That is, if a local model has low similarity with other local models, deviating from the expected high similarity feature, then the model is very likely to be a model carrying malicious code. Based on the above research, the method for detecting malicious code models based on model similarity proposed in this application utilizes the characteristic that the similarity between honest models is greater than the similarity between honest models and malicious code models to detect malicious code models.

[0083] Accordingly, after obtaining the local models generated by each edge device through its own local model training and obtaining the local model set, the similarity between a single local model in the local model set and each other local model outside the single local model is determined to obtain the similarity set corresponding to different single local models, which is used for the detection of malicious code models.

[0084] This application uses the distance between local models to characterize / measure the similarity between them. The model distance and model similarity are inversely correlated; that is, the larger the model distance, the lower the similarity between the two models, and the smaller the model distance, the higher the similarity between the two models. Therefore, the central device can specifically determine the model distances between each individual local model in the local model set and all other local models, obtaining a set of model distances corresponding to each individual local model. These model distances, used to characterize model similarity, are then used in the detection of malicious code models.

[0085] Optionally, embodiments of this application use the parametric distance between different local models to measure the model distance between different local models.

[0086] See the following formula for reference:

[0087]

[0088] Client model parameters It can be viewed as the global model parameter x r By adding a small perturbation ε (ε∈R), the parameter values ​​of each honest model should, in principle, fluctuate within a very small range. In contrast, the malicious model exhibits greater fluctuation in its model parameters compared to the honest model. An honest model refers to a local model trained by the client following a federated learning protocol without embedding any data; it can also be called a local model.

[0089] Therefore, under normal circumstances, the parameter distance between different models is inversely correlated with model similarity and positively correlated with model distance. That is, the larger the parameter distance between different models, the larger the model distance and the smaller the similarity, and vice versa.

[0090] Furthermore, in conjunction with [see also] Figure 7 An example of the provided model parameter distance. The applicant discovered that there may be cases where the parameter distance between malicious code models and honest models is smaller than the distance between honest models. This is because the data from different clients is different, so the direction and magnitude of the change of some parameters during training will be different. To solve this problem, this application proposes to use the statistical measure of the parameter distance of corresponding parameters between local models, rather than a single parameter distance, to measure the model distance, that is, to measure model similarity. This effectively balances the situation where the parameter distance between honest models is a small number of times greater than the parameter distance between honest models and malicious code models, and eliminates the detection error caused by the deviation of individual parameter distances from the pattern.

[0091] Among them, the parameter distance statistics of each corresponding position parameter can be, but are not limited to, any one of the following: the sum of distances of the corresponding position parameters of the two local models, the weighted sum of distances, the average distance value, or the weighted average distance.

[0092] Taking the statistic as the sum of distances between corresponding location parameters of local models as an example, the following provides a method for calculating model distance based on this statistic, where, given two models θ x and θ y The model distance is the sum of the distances of each parameter, as shown in the following formula:

[0093]

[0094] Where x i and y i For model θ x and θ y And the parameter values ​​of neurons at the same location, |x i -y i | represents x i and y i The distance is denoted by n, where n is the total number of parameters to be calculated. Since the model distance is the sum of the parameter distances at corresponding positions between two models, it can effectively balance the situation where the parameter distance between honest models is greater than the parameter distance between honest models and malicious code models.

[0095] In practical applications, the central server can obtain the parameter values ​​of each pair of models at their respective locations in the local model set. Based on the parameter values ​​of each pair of models at their respective locations, the parameter distance between the corresponding parameters can be calculated. Then, statistical measures such as distance sum, weighted distance sum, and average distance can be calculated for the parameter distance between each pair of models, and the calculated statistical measures can be used as the model distance between the two models.

[0096] Step 103: Based on the similarity sets corresponding to the different single local models, determine the local models whose similarity meets the preset conditions from the local model set, and use them as malicious code models.

[0097] It should be noted that the preset conditions include distance conditions and voting conditions. In other words, a local model that satisfies both the distance and voting conditions is a local model that satisfies both the distance and voting conditions. Specifically, in a federated learning scenario, the model distance set of the local models is used to indirectly represent the similarity set.

[0098] The central server, based on the model distance set corresponding to each individual local model, selects local models that meet the distance criteria as candidate local models. The distance criteria ensure that the model distance between a selected candidate model and the individual local model is greater than the model distance between the individual local model and non-candidate models in the model distance set. For example, a local model meeting the distance criteria can be the local model corresponding to the model with the largest model distance in the model distance set corresponding to a given local model, or the local model whose model distance belongs to the top k in a descending distance sequence. This process is repeated for each local model during training, selecting models with large model distances from their respective model distance sets as candidate local model sets.

[0099] Then, the central server initiates voting requests for local models in the candidate local model set corresponding to different local models, and obtains the voting results. This allows it to identify local models that meet the voting criteria as malicious code models from the candidate local model set corresponding to each local model. Local models that meet the voting criteria are those whose vote count in the candidate local model set exceeds a preset threshold.

[0100] Subsequently, the central side obtains the voting results of the candidate models corresponding to different single local models. Based on the obtained voting results, the local models that meet the voting conditions among the candidate models corresponding to different single local models are identified as malicious code models. It should be noted that the distance model that meets the voting conditions can refer to the local model whose votes exceed a preset threshold after voting on the candidate models. Such a distance model is detected as a malicious code model.

[0101] The following example further illustrates the malicious code model detection method used in the federated learning scenario:

[0102] Assuming there are 10 clients, during the r-th round of federated learning training, the central server will receive 10 local models. Type, for Model:

[0103] calculate respectively with Model distance D 1,2 D 1,3 D 1,4 ,...,D 1,10 , such as calculation respectively with Model distance The f() function is the function for calculating the distance in the model above. Assume D... 1，2 D 1,3 D 1,4 D 1,10 The largest value in the middle is D 1,2 This means Model and The model with the lowest similarity is more likely to be a malicious code model, therefore... To conduct a vote.

[0104] For the model Repeat the above steps, such as calculating. respectively with Find the model distance, identify the maximum value, and vote on the model corresponding to it.

[0105] It should be noted that the applicant verified through experiments that the proposed malicious code detection method has good performance indicators. For example, when embedding 0.375MB of malicious code in a 178MB model, the detection method has a true detection rate of 82.9% and a false positive rate of 1.8%. When embedding 0.75MB of malicious code, the true detection rate is 96.6% and the false positive rate is 0.38%.

[0106] In summary, the malicious code detection method disclosed in this application obtains local models generated by each edge device through its own local model training, resulting in a local model set. It then determines the model distances between each individual local model in the local model set and all other local models outside that single local model, obtaining model distance sets corresponding to different individual local models. Based on these model distance sets, it identifies local models whose model distances satisfy preset conditions from the local model set, and uses these models as malicious code models. This application solves the risk propagation problem caused by malicious code models by calculating the model distances between local models and using these model distances to quantify the similarity between models, thereby detecting local models whose similarity satisfies preset conditions as malicious code models.

[0107] Optionally, in one embodiment, see [link to relevant documentation]. Figure 8 This application provides another flowchart illustrating a malicious code detection method when there are multiple attackers.

[0108] Step 201: Obtain the number of attackers configured.

[0109] Specifically, the number of attackers can be pre-estimated based on experience, and the number can be configured accordingly based on the assumptions.

[0110] Step 202: When the configured attacker count representation requires the detection of multiple attackers, remove the model distance set corresponding to the malicious code model and the model distance of the malicious code model from the model distance sets corresponding to the other single local models respectively, to obtain the updated model distance sets corresponding to the other single local models respectively.

[0111] For example, the central side collects all client models, and for each client model... calculate Compared with the remaining models Model distance D i,j This will give you a list of distances. Therefore, a total of k distance lists can be obtained.

[0112] The largest D in the middle i,j Representative model With model The model with the lowest similarity is more likely to be a malicious code model, therefore the model... A vote is conducted, and the above operation is performed on all distance lists. All votes are tallied, and client models with a vote count greater than or equal to a threshold t are identified as malicious code models. In the case of multiple attackers, the above steps are executed first. Assuming the client model... If it is determined to be a malicious code model, then Distance list for client models other than D in i,z After removing the subtraction, we get k-1 new distance lists, which are the updated model distance sets.

[0113] Step 203: For the updated model distance sets corresponding to each of the other single local models, trigger the step of determining the local model whose model distance satisfies the preset condition from the local model set according to the model distance sets corresponding to different single local models, and using it as the malicious code model, until the configured number of malicious code models are detected.

[0114] Then, the updated model is voted on to obtain the next malicious code model. Steps 202 and 203 are repeated until the number of pre-assumed attackers is detected.

[0115] In summary, this application has successfully detected malicious code from multiple attackers, maximizing the detection of malicious code models and minimizing the risks they pose to the federated learning process.

[0116] In addition to the aforementioned malicious code model detection method, this application also provides a malicious code model detection device, the composition of which is as follows: Figure 9 As shown.

[0117] The model acquisition unit 10 is used to acquire the local models generated by each edge device through its own local model training, and obtain a local model set.

[0118] The first determining unit 20 is used to determine the similarity between a single local model in the local model set and each other local model other than the single local model, so as to obtain the similarity set corresponding to each single local model.

[0119] The second determining unit 30 is used for:

[0120] Based on the similarity sets corresponding to the different individual local models, the local models whose similarity satisfies the preset conditions are determined from the local model set and used as malicious code models.

[0121] In one embodiment, the model acquisition unit 10 is specifically used for:

[0122] The local model set is obtained by training the corresponding pre-trained model on each edge device based on its local data.

[0123] The pre-trained model is either the current round global model obtained by the edge device from the central device, or a model built locally by the edge device. The current round global model is either a model obtained by the central device updating the previous round global model based on the latest local model set obtained from each edge device, or a model built based on the latest local model set obtained from each edge device.

[0124] In one embodiment, the first determining unit 20 is specifically used for:

[0125] The model distances between each individual local model in the local model set and all other local models are determined, resulting in a set of model distances for each individual local model. Model distance is used to characterize model similarity, and there is an inverse correlation between model distance and model similarity. Parameter data for each individual local model and each other local model at their corresponding positions are obtained.

[0126] Based on the parameter data of the single local model and each other local model at each corresponding position parameter, the parameter distance between the single local model and each other local model at each corresponding position parameter is determined.

[0127] Based on the parameter distances between the single local model and each other local model at their respective corresponding position parameters, the model distances between the single local model and each other local model are determined, thus obtaining the model distances between the single local model and each other local model in the local model set.

[0128] A preset statistic is determined for the parameter distance between the single local model and each other local model at each corresponding position parameter. The preset statistic is then used as the model distance between the single local model and each other local model in the local model set.

[0129] In one embodiment, the second determining unit 30 is specifically used for:

[0130] Based on the model distance sets corresponding to different individual local models, the local models whose model distances satisfy preset conditions are determined from the local model sets and used as malicious code models.

[0131] For each individual local model, based on the model distance set corresponding to the individual local model, determine the local models in the local model set whose model distances satisfy the distance condition with the individual local model, and use them as candidate models; the distance condition should at least be used to ensure that the model distance between the determined candidate model and the individual local model is greater than the model distance between the non-candidate models in the model distance set and the individual local model; initiate voting requests for the candidate models corresponding to different individual local models respectively.

[0132] Obtain the voting results of the candidate models corresponding to different single local models.

[0133] Based on the obtained voting results, the local models that meet the voting conditions among the candidate models corresponding to different single local models are identified as malicious code models.

[0134] The preset conditions include the distance condition and the voting condition.

[0135] In one embodiment, the apparatus further includes:

[0136] The attacker count acquisition unit is used to obtain the configured number of attackers.

[0137] The model distance removal unit is used to remove the model distance set corresponding to the malicious code model and the model distance of the malicious code model from the model distance sets corresponding to different single local models when the configured attacker number representation requires the detection of multiple attackers, so as to obtain the updated model distance sets corresponding to the other single local models.

[0138] The third determining unit is used to trigger the step of determining the local model whose model distance satisfies the preset condition from the local model set based on the updated model distance set corresponding to each of the other single local models, as a malicious code model, until the configured number of malicious code models are detected.

[0139] In addition, embodiments of this application also provide a computer-readable medium storing a computer program thereon, characterized in that, when the computer program is executed by a processor, it can be used to implement various processing steps of the malicious code model detection method.

[0140] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0141] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.

[0142] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0143] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0144] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting malicious code models, characterized in that, include: Obtain the local models generated by each edge device through its own local model training to obtain a local model set; Determine the similarity between each individual local model in the local model set and each of the other local models besides the individual local model, and obtain the similarity sets corresponding to each individual local model; Based on the similarity sets corresponding to the different single local models, the local models whose similarity meets the preset conditions are determined from the local model set and used as malicious code models. The step of determining the similarity between each individual local model in the local model set and each of the other local models outside the individual local model, to obtain the similarity sets corresponding to each individual local model, includes: The model distances between each individual local model in the local model set and all other local models outside the individual local model are determined to obtain the model distance sets corresponding to different individual local models; wherein, model distance is used to characterize model similarity, and the model distance and model similarity are inversely correlated; Wherein, determining the model distance between each individual local model in the local model set and each of the other local models besides the individual local model includes: Obtain the parameter data of the single local model and each other local model at each corresponding position; Based on the parameter data of the single local model and each other local model at each corresponding position parameter, determine the parameter distance between the single local model and each other local model at each corresponding position parameter; Based on the parameter distance between the single local model and each other local model at each corresponding position parameter, the model distance between the single local model and each other local model is determined, and the model distance between the single local model and each other local model in the local model set is obtained respectively. The step of determining the model distance between the single local model and each other local model based on the parameter distance between the single local model and each other local model at each corresponding position parameter, and obtaining the model distance between the single local model in the local model set and each other local model respectively, includes: A preset statistic is determined for the parameter distance between the single local model and each other local model at each corresponding position parameter. This preset statistic is then used as the model distance between the single local model and the corresponding other local models. The preset statistic is the sum of the parameter distances between each corresponding position parameter of the local models. Given two models... and The model distance is the sum of the distances of each parameter: ； in, and For the model and Neuron parameter values ​​at the same location represent and The distance, where n is the total number of parameters to be calculated; The step of determining, based on the similarity sets corresponding to the different individual local models, local models whose similarity satisfies preset conditions from the local model set as malicious code models includes: For each individual local model, based on the model distance set corresponding to the individual local model, determine the local models in the local model set whose model distances satisfy the distance condition with the individual local model, and use them as candidate models; the distance condition should at least be used to ensure that the model distance between the determined candidate model and the individual local model is greater than the model distance between the non-candidate models in the model distance set and the individual local model; Initiate a voting request for candidate models corresponding to different single local models; Obtain the voting results of the candidate models corresponding to different single local models; Based on the obtained voting results, the local models that meet the voting conditions among the candidate models corresponding to different single local models are identified as malicious code models. The preset conditions include the distance condition and the voting condition.

2. The method according to claim 1, characterized in that, The process of obtaining the local models generated by each edge device through its own local model training to obtain a local model set includes: Get the local models generated by each edge device training its corresponding pre-trained model based on its local data, and obtain the local model set; The pre-trained model is either the current round global model obtained by the edge device from the central device, or a model built locally by the edge device. The current round global model is either a model obtained by the central device updating the previous round global model based on the latest local model set obtained from each edge device, or a model built based on the latest local model set obtained from each edge device.

3. The method according to claim 1, characterized in that, The step of determining local models whose similarity satisfies preset conditions from the set of local models based on the similarity sets corresponding to the different single local models, and using them as malicious code models, includes: Based on the model distance sets corresponding to different individual local models, the local models whose model distances satisfy preset conditions are determined from the local model sets and used as malicious code models.

4. The method according to claim 1, characterized in that, The number of identified malicious code models is one, and each malicious code model represents an attacker; the method further includes: Get the number of attackers configured; When the attacker count representation needs to detect multiple attackers, the model distance set corresponding to the malicious code model and the model distance of the malicious code model in the model distance sets corresponding to other single local models are removed from the model distance sets corresponding to different single local models to obtain the updated model distance sets corresponding to the other single local models. For each of the other single local models, the updated model distance set is used to trigger a step of determining the local model whose model distance meets the preset condition from the local model set based on the model distance set corresponding to each single local model, as a malicious code model, until the configured number of malicious code models are detected.

5. A malicious code model detection device, characterized in that, include: The model acquisition unit is used to acquire the local models generated by each edge device through its own local model training, and obtain a local model set; The first determining unit is used to determine the similarity between a single local model in the local model set and each of the other local models besides the single local model, so as to obtain the similarity set corresponding to each of the different single local models; The second determining unit is used to determine, based on the similarity sets corresponding to the different single local models, the local models whose similarity satisfies the preset conditions from the local model set, and use them as malicious code models. The first determining unit is used to determine the model distances between each individual local model in the local model set and each of the other local models besides the individual local model, thereby obtaining a set of model distances corresponding to each individual local model; wherein, model distance is used to characterize model similarity, and the model distance and model similarity are inversely correlated; The first determining unit is used to obtain parameter data of the single local model and each other local model at each corresponding position; Based on the parameter data of the single local model and each other local model at each corresponding position parameter, determine the parameter distance between the single local model and each other local model at each corresponding position parameter; Based on the parameter distance between the single local model and each other local model at each corresponding position parameter, the model distance between the single local model and each other local model is determined, and the model distance between the single local model and each other local model in the local model set is obtained respectively. The first determining unit is configured to determine a preset statistic corresponding to the parameter distance between the single local model and each other local model at each corresponding position parameter, and use the determined preset statistic as the model distance between the single local model and the corresponding other local models; the preset statistic is the sum of the parameter distances at each corresponding position parameter between the local models, given two models. and The model distance is the sum of the distances of each parameter: ； in, and For the model and Neuron parameter values ​​at the same location represent and The distance, where n is the total number of parameters to be calculated; The second determining unit is configured to, for each single local model, determine, based on the model distance set corresponding to the single local model, local models in the local model set whose model distances satisfy a distance condition with respect to the single local model, as candidate models; the distance condition is at least configured to ensure that the model distance between the determined candidate model and the single local model is greater than the model distance between the non-candidate models in the model distance set and the single local model. Initiate a voting request for candidate models corresponding to different single local models; Obtain the voting results of the candidate models corresponding to different single local models; Based on the obtained voting results, the local models that meet the voting conditions among the candidate models corresponding to different single local models are identified as malicious code models. The preset conditions include the distance condition and the voting condition.

6. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it can be used to implement the malicious code model detection method as described in any one of claims 1-4.

Images