Edge-heterogeneous personalized federated learning intrusion detection method
By employing personalized pruning algorithms and similarity-weighted model aggregation strategies, the problems of low federated learning efficiency and low model performance caused by resource and data heterogeneity in IoT environments are solved. This enables efficient intrusion detection and personalized model generation, improving detection accuracy and resource utilization efficiency.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING UNIV OF TECH
- Filing Date
- 2023-10-26
- Publication Date
- 2026-07-14
AI Technical Summary
Existing federated learning-based intrusion detection technologies cannot effectively address the inefficiencies and poor model performance caused by resource constraints and device heterogeneity in IoT environments, especially when edge devices have heterogeneous resources and large differences in data distribution.
We employ a personalized pruning algorithm and a similarity-weighted model aggregation strategy. We collect client resource information through a cloud server, select suitable clients for model pre-training, and perform personalized pruning based on the resource information. Then, we use a similarity-weighted model aggregation strategy to aggregate heterogeneous client models, thereby achieving fine-grained model parameter updates.
It improves the efficiency of federated learning and the accuracy of intrusion detection, reduces computational and communication overhead, can adapt to the resource and data heterogeneity of different devices, and enhances the adaptability and detection capabilities of the model.
Smart Images
Figure CN117375947B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network information security technology, and relates to intrusion detection methods in Internet of Things (IoT) scenarios, particularly a personalized federated learning intrusion detection method for edge heterogeneity. Background Technology
[0002] With the continued expansion of 5G commercialization and the rollout of 6G strategic deployment, massive numbers of IoT devices are rapidly connecting to the internet, and attacks targeting IoT devices are experiencing explosive growth. To address complex cyberattacks and ensure the secure development of industrial sectors, industry and academia are focusing increasing attention and research on IoT intrusion detection technology to counter potential security threats.
[0003] Currently, cloud-based deep learning algorithms can train intrusion detection models with ubiquitous detection capabilities by collecting massive amounts of intrusion samples from IoT devices, but they mainly have two drawbacks:
[0004] 1) Edge devices often process sensitive data, and transmitting this data to cloud servers for intrusion detection may pose risks to data privacy and security;
[0005] 2) Edge devices are typically unable to monitor and detect network activities within the local area network if the connection to the central server is interrupted when the network is unstable or disconnected.
[0006] Federated learning is a novel distributed machine learning technique. Its core idea is to train a global model across multiple data sources with local data, building it by exchanging model parameters or intermediate results without needing to exchange local sample data, thus achieving data privacy protection. However, in IoT environments, federated learning training involves a massive number of participants, with significant differences in data characteristics and device functionality across different terminals, as well as varying communication network environments. This results in substantial differences in local requirements, making it difficult to train a federated model suitable for all participants. To address the challenges of heterogeneous device performance and data, and to further meet the personalized needs of local participants, the federated learning model must obtain a high-quality, personalized model for each device. Summary of the Invention
[0007] This invention discloses a personalized federated learning intrusion detection system for edge heterogeneous environments. It addresses the shortcomings of existing federated learning-based intrusion detection technologies in edge heterogeneous scenarios, which suffer from low efficiency due to resource heterogeneity in IoT devices with varying resource constraints, and low performance of intrusion detection models caused by differences in data distribution among devices.
[0008] The technical solution adopted in this invention is a personalized federated learning intrusion detection method for edge heterogeneity, which includes the following four steps:
[0009] Step 1: The cloud server collects the processing frequency and communication bandwidth of the CPU and GPU of the IoT clients, then selects the client with the highest processing frequency and communication bandwidth to distribute the convolutional neural network model as the local model, and performs a round of pre-training on the local model. After local training, the model is uploaded to the cloud server.
[0010] Step 2: Using the client-side local model received in Step 1, the cloud server combines the client's resource information to execute a personalized pruning algorithm.
[0011] Furthermore, the process of the cloud server executing a personalized pruning algorithm in step 2, based on the client's resource information, specifically includes:
[0012] Step 21: Calculate the channel importance score of the global convolutional neural network model;
[0013] Step 22: Sort the channels according to their importance scores from lowest to highest;
[0014] Step 23: Calculate the tradeoff score of the current model by decreasing the number of channels in order of sorting.
[0015] Step 24: Determine if the score is negative;
[0016] Step 25: If the score is non-negative, add the current channel index to the list and return to step 23;
[0017] Step 26: If the score is negative, stop the loop;
[0018] Step 27: Calculate the channel index with the highest score in the list and use it as the channel pruning index for the current client.
[0019] Step 3: The cloud server distributes the pruned personalized model to the clients. All clients participating in federated learning use the personalized model for local training and then upload it to the cloud.
[0020] Step 4: The cloud server uses a similarity-weighted model aggregation strategy to aggregate heterogeneous client models.
[0021] Furthermore, the process of aggregating heterogeneous client models using a similarity-weighted model aggregation strategy in step 4 specifically includes:
[0022] Step 41: Calculate the average number of all client channels, using channels as the unit;
[0023] Step 42: Calculate the cosine similarity between each participant's current channel and the mean;
[0024] Step 43: Divide the cosine similarity of the current participant by the sum of the cosine similarities of all participants;
[0025] Step 44: Use the ratio from Step 43 as the weighting coefficient for the current participant in the aggregation, and then update the global model parameters.
[0026] Based on the above method, the technical solution of the present invention also includes a personalized federated learning intrusion detection system for edge heterogeneity, comprising:
[0027] The convolutional neural network-based intrusion detection module is used to train the convolutional neural network by taking traffic data as input, and obtain basic intrusion detection models in the cloud and on-premises, which are used for model reuse and parameter inheritance in federated learning.
[0028] The model compression module based on personalized pruning takes resource information from heterogeneous clients as input and then adaptively assigns an appropriate pruning rate to edge clients based on the quantitative relationship between resource consumption and model performance.
[0029] Furthermore, the model compression module based on personalized pruning includes:
[0030] Channel Importance Evaluation Module: It is used to determine the importance of the global model in the cloud, aiming to retain the channels with high importance and cut off the redundant channels during the model compression process.
[0031] The weighted score evaluation module is used to weigh the performance and resource information of the target client after the importance judgment, and calculate an appropriate pruning rate for the target client.
[0032] Model pruning module: It is used to prune the global model according to the channel index number of the convolution and generate a sub-model to send to the target client.
[0033] The similarity-weighted asynchronous model aggregation module takes local clients that have completed local training as input, and then allows local models with different network structures to be asynchronously aggregated on the server, so that the aggregated model can better adapt to the overall data distribution.
[0034] Furthermore, the similarity-weighted asynchronous model aggregation module includes:
[0035] Cosine similarity calculation module: It is used to calculate the cosine similarity between each channel of the target client and the average of all clients participating in federated learning under that channel, and obtain the similarity weighting coefficient.
[0036] Global model parameter update module: It is used to aggregate the heterogeneous local models participating in the training in this round by channel as the aggregation unit to obtain the new round of global model parameters.
[0037] The beneficial effects of this invention are:
[0038] I. This invention proposes a federated learning framework for intrusion detection oriented towards edge heterogeneity. This framework enables participants to have personalized models to address the heterogeneity of resource constraints at edge nodes, thereby improving the efficiency of federated learning; at the same time, it enables fine-grained aggregation of local models with different network structures to address the problem of non-independent and identically distributed data among nodes, thereby improving the accuracy of intrusion detection.
[0039] Second, this invention proposes a personalized pruning decision algorithm, which adaptively allocates an appropriate pruning rate to edge clients based on the quantitative relationship between resource consumption and model performance. This algorithm enables edge clients with heterogeneous resources to participate in federated learning with personalized local models, thereby reducing computational and communication overhead.
[0040] Third, this invention proposes a fine-grained model parameter update scheme. This scheme refines the aggregation granularity from the entire model to the channel level, and introduces a similarity weighting coefficient to better control the weight and contribution of each channel. This fine-grained model update scheme allows local models with different network structures to be asynchronously aggregated on the server, enabling the aggregated model to better adapt to the overall data distribution, thereby mitigating the performance degradation of federated learning caused by non-IID data issues. Attached Figure Description
[0041] Figure 1 This is a flowchart illustrating a personalized federated learning intrusion detection method for edge heterogeneity as described in this invention.
[0042] Figure 2 This is a schematic diagram of the process of using resource information from edge heterogeneous clients to perform personalized pruning from the global model in the cloud in Embodiment 1 of the present invention.
[0043] Figure 3 This is a schematic diagram of the process of aggregating heterogeneous client models using a similarity-weighted model aggregation strategy in Embodiment 1 of the present invention;
[0044] Figure 4 This is a model architecture diagram for client-side local intrusion detection in Embodiment 2 of the present invention;
[0045] Figure 5 This is an experimental result diagram showing the reduction of time overhead for a resource-constrained edge client in Embodiment 2 of the present invention while maintaining the accuracy of intrusion detection;
[0046] Figure 6 The figure shows the experimental results of the method of the present invention having a shorter training time compared to other methods in different edge heterogeneous scenarios in Embodiment 2 of the present invention;
[0047] Figure 7 This is an experimental result diagram showing the computational complexity and number of parameters under different edge heterogeneous scenarios in Embodiment 2 of the present invention;
[0048] Figure 8 This is a graph showing the experimental results of the global model's accuracy under different data distributions in Embodiment 2 of the present invention;
[0049] Figure 9 This is a graph showing the experimental results of the average accuracy of the client-side model under different data distributions in Embodiment 2 of the present invention. Detailed Implementation
[0050] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.
[0051] Example 1
[0052] like Figure 1 As shown, Embodiment 1 is a personalized federated learning intrusion detection method for edge heterogeneity. This method consists of four steps: The server collects resource information from IoT clients, selects clients with sufficient resources to distribute convolutional models, trains the local models, and then uploads them to the cloud server. The cloud server executes a personalized pruning algorithm based on the client's resource information. The cloud server distributes the pruned personalized models to the clients, and all clients participating in federated learning train their personalized models locally before uploading them to the cloud. The cloud server uses a similarity-weighted model aggregation strategy to aggregate the heterogeneous client models. Specific details are described below:
[0053] Step 1: The cloud server collects resource information from IoT clients, selects clients with sufficient resources to distribute convolutional neural network models, pre-trains the local models, and then uploads the models to the cloud server after local training.
[0054] Step 2: As Figure 2 As shown, using the model received in step 1, the cloud server combines the client's resource information to execute a personalized pruning algorithm.
[0055] Furthermore, the process of the cloud server executing a personalized pruning algorithm in step 2, based on the client's resource information, specifically includes:
[0056] Step 21: Calculate the channel importance score of the global convolutional neural network model. Because defining the importance of model channels reflects which channels are redundant, pruning can be performed based on importance to generate sub-models with higher accuracy. To enable global pruning of convolutional layers, this paper defines channel importance as the loss difference caused by removing a specific channel from the network. Since calculating the loss difference is very time-consuming for neural networks, this invention approximates the loss difference using the product of the gradient and norm of a channel, which allows for rapid calculation. The calculation method is as follows:
[0057]
[0058] Where I c (w) represents the importance evaluation of the c-th channel of the model parameters, g s w represents the gradient of the s-th neuron within the channel. s Let L represent the norm of the s-th neuron. c The smaller the value of (w), the smaller the impact of that channel on the model's output and loss function.
[0059] Step 22: Sort channels by importance score from lowest to highest; unlike methods that require sensitivity analysis, the method in this paper can consider the importance of channels globally, therefore, each channel is directly sorted as follows:
[0060] I(w)=Sort(I1(w), I2(w),...,I C (w))
[0061] Where I(w) represents the sorted set after the importance evaluation is sorted in descending order.
[0062] Step 23: Calculate the tradeoff score of the current model by decreasing the number of channels sequentially according to the sorting order. Since different clients have different resource capabilities, this invention defines a scoring criterion to achieve a tradeoff between efficiency and accuracy. The purpose is to select the sub-model for the client with the highest pruning rate. The scoring method is as follows:
[0063]
[0064] Where α i It is a sub-element within the pruning rate set, where P represents the pruning rate of the set. i The pruning rate, R k (α i ) is the pruning rate of the k-th client, which is α. i The score at that time, the numerator represents the score when the pruning rate is α. i The sum of the importance of time-series models, T k (αi ) indicates that when the pruning rate is α i At that time, the theoretical time for the kth client.
[0065] Step 24: Determine if the score is negative;
[0066] Step 25: If the score is non-negative, add the current channel index to the list and return to step 23;
[0067] Step 26: If the score is negative, stop the loop;
[0068] Step 27: Calculate the channel index with the highest score in the list and use it as the channel pruning index for the current client.
[0069] Step 3: The cloud server distributes the pruned personalized model to the clients. All clients participating in federated learning use the personalized model for local training and then upload it to the cloud.
[0070] Step 4: As Figure 3 As shown, the cloud server employs a similarity-weighted model aggregation strategy to aggregate heterogeneous client models. The client sends the trained sub-model parameters to the server for aggregation. Due to differences in pruning rates among different clients, the sub-models participating in global aggregation have different structures. Furthermore, traditional federated learning model aggregation algorithms only work when local models and the global model share the same structure, and cannot aggregate local models with different structures. Therefore, this invention designs a heterogeneous model aggregation algorithm to ensure the effectiveness of heterogeneous federated training.
[0071] Furthermore, the process of aggregating heterogeneous client models using a similarity-weighted model aggregation strategy in step 4 specifically includes:
[0072] Step 41: Calculate the average number of channels across all clients, channel by channel. Since the pruning method in this paper treats convolutional layers as a uniform scale, we can define the global model as having a total of C channels. The server then updates the parameters sequentially, channel by channel, by traversing the global model's channels. Furthermore, besides the different sub-model structures of the clients, there is also the issue of non-independent identically distributed (non-IID) parameters among the clients, leading to differences in parameter distribution among the sub-models after local training. To overcome the impact of this uneven distribution on the global model update, let K be the number of clients participating in the aggregation of the c-th channel. Then, the parameters... In Euclidean space, their arithmetic mean can be expressed as:
[0073]
[0074] in This represents the arithmetic mean vector of K vectors.
[0075] Step 42: Calculate the cosine similarity between each participant's current channel and the mean; obtain the arithmetic mean of the channels in step 41. Next, cosine similarity is calculated between each of the n parameters and w to obtain a similarity set. The size of this set is the number of clients participating in the channel c update. The cosine similarity is calculated as follows:
[0076]
[0077] in This represents the arithmetic mean vector of the nth client on channel c. The cosine similarity.
[0078] Step 43: Divide the cosine similarity of the current participant by the sum of the cosine similarities of all participants;
[0079] Step 44: Update the ratio from Step 43 as the weighting coefficient for the current participant's participation in the aggregation. The global parameter update method is as follows:
[0080]
[0081] in This represents the parameter of the c-th channel of the global model after t rounds of federated aggregation. The weighting coefficients represent the sample size. This represents the similarity weighting coefficient for the k-th client and the c-th channel.
[0082] Based on the above method, the technical solution of the present invention also includes a personalized federated learning intrusion detection system for edge heterogeneity, comprising:
[0083] The convolutional neural network-based intrusion detection module is used to train the convolutional neural network by taking traffic data as input, and obtain basic intrusion detection models in the cloud and on-premises, which are used for model reuse and parameter inheritance in federated learning.
[0084] The model compression module based on personalized pruning takes resource information from heterogeneous clients as input and then adaptively assigns an appropriate pruning rate to edge clients based on the quantitative relationship between resource consumption and model performance.
[0085] Furthermore, the model compression module based on personalized pruning includes:
[0086] Channel Importance Evaluation Module: It is used to determine the importance of the global model in the cloud, aiming to retain the channels with high importance and cut off the redundant channels during the model compression process.
[0087] The weighted score evaluation module is used to weigh the performance and resource information of the target client after the importance judgment, and calculate an appropriate pruning rate for the target client.
[0088] Model pruning module: It is used to prune the global model according to the channel index number of the convolution and generate a sub-model to send to the target client.
[0089] The similarity-weighted asynchronous model aggregation module takes local clients that have completed local training as input, and then allows local models with different network structures to be asynchronously aggregated on the server, so that the aggregated model can better adapt to the overall data distribution.
[0090] Furthermore, the similarity-weighted asynchronous model aggregation module includes:
[0091] Cosine similarity calculation module: It is used to calculate the cosine similarity between each channel of the target client and the average of all clients participating in federated learning under that channel, and obtain the similarity weighting coefficient.
[0092] Global model parameter update module: It is used to aggregate the heterogeneous local models participating in the training in this round by channel as the aggregation unit to obtain the new round of global model parameters.
[0093] Example 2
[0094] Example 2 presents an experiment on an IoT network dataset. The BoT-IoT dataset was created by designing a real-world network environment in the CyberRangeLab at UNSW Canberra, combining normal traffic and botnet traffic. This example demonstrates the robustness and effectiveness of the proposed method for network intrusion detection in IoT scenarios. In the data partitioning, 70% of the dataset is used for local training, 10% for local scenario testing, and 20% for global scenario testing. Notably, the global scenario is tested on the same test data, while the local scenario is tested on test data distributed to each client. This example defines Y to describe the degree of non-IID, representing the percentage of data belonging to one label for each user, with the remaining data belonging to other labels. To demonstrate the effectiveness of the proposed solution under different degrees of non-IID scenarios, this example divides the data distribution into two different scenarios: y = 20% and y = 40%.
[0095] Regarding the model structure for local network intrusion detection, this example uses the following structure: Figure 4As shown, the main body of the model consists of 5 convolutional layers (conv) and 2 fully connected layers (FC), with batch normalization layers (BatchNorm) used between each layer. The activation function for the intermediate layers is ReLU.
[0096] To verify the reduction of resource overhead for heterogeneous clients by the personalized model pruning method proposed in this invention, this example experimentally analyzes the time overhead and accuracy of 10 clients participating in federated learning. This example is conducted in a heterogeneous environment with a data distribution of Y = 40%, which is done to verify the effectiveness of the proposed method in non-IID scenarios. Figure 5 As shown, the method proposed in this invention can reduce the time cost to a certain extent while ensuring client accuracy and under resource constraints.
[0097] To understand how the heterogeneity of client resources affects federated learning efficiency, this example deploys experiments in environments with low, medium, and high heterogeneity levels. Figure 6 The figure illustrates the time required for various federated learning frameworks to achieve the target accuracy under different levels of heterogeneity. It shows that the training time of the proposed method is significantly lower than other methods. Furthermore, in a single round of global communication, the maximum latency depends on the limitations of the client with the weakest resource capabilities, which can be seen from... Figure 6 It was observed that the time required increased sequentially from low to high heterogeneity. Furthermore, the higher the degree of heterogeneity, the greater the performance difference. In addition, this example statistically compares the number of floating-point calculations and communication parameters between this invention and other methods, such as... Figure 7 As shown.
[0098] To verify the effectiveness of the global model generated by the proposed method, this paper conducts accuracy tests on the global model after each round of communication. Furthermore, experiments are performed under data distribution scenarios with varying degrees of non-IID to demonstrate its effectiveness in heterogeneous data environments. Figure 8 As shown in the experimental results, when the data distribution Y = 20%, i.e., the degree of non-IID is low, the proposed method is comparable in performance to FedAvg. However, when the data distribution y = 40%, the accuracy of the proposed method is improved by 1.64%, 1.26%, and 1.75% respectively compared to the comparison method, and the convergence speed is also higher than other methods. Furthermore, as... Figure 9As shown, to test whether the proposed solution can handle common local network scenarios, a test set of client-side data was used to test the local model of each client. The accuracy curves of the two dataset distributions clearly demonstrate that the proposed method converges faster than FedProx and HeteFL, and the client-side accuracy can reach the same level as FedAvg.
[0099] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A personalized federated learning intrusion detection method for edge heterogeneity, characterized in that, include: Step 1: The cloud server collects the processing frequency and communication bandwidth of the CPU and GPU of the IoT client, then selects the client with the highest processing frequency and communication bandwidth to distribute the convolutional neural network model as the local model, and performs a round of pre-training on the local model. After local training, the model is uploaded to the cloud server. Step 2: Using the client-side local model received in Step 1, the cloud server combines the client's resource information to execute a personalized pruning algorithm; Step 3: The cloud server distributes the pruned personalized model to the client. All clients participating in federated learning use the personalized model for local training and then upload it to the cloud. Step 4: The cloud server uses a similarity-weighted model aggregation strategy to aggregate heterogeneous client models; The process of aggregating heterogeneous client models using a similarity-weighted model aggregation strategy in step 4 specifically includes: Step 41: Calculate the average number of all client channels, using channels as the unit; Step 42: Calculate the cosine similarity between each participant's current channel and the mean; Step 43: Divide the cosine similarity of the current participant by the sum of the cosine similarities of all participants; Step 44: Use the ratio from Step 43 as the weighting coefficient for the current participant's participation in aggregation, and then update the global model parameters; Step 41: Calculate the average number of channels across all clients, using channels as the unit; the pruning method treats convolutional layers as a uniform scale, defining the total number of channels in the global model. Then the server updates the parameters sequentially by traversing the channels of the global model, channel by channel; in addition to the different sub-model structures of the clients, there is also the problem of non-independent and identically distributed among the clients, which leads to differences in the parameter distribution among the sub-models after local training; participating in the first The number of clients aggregated by each channel is Then the parameter In Euclidean space, the arithmetic mean is expressed as: in This represents the arithmetic mean vector of K vectors. Step 42: Calculate the cosine similarity between each participant's current channel and the mean; obtain the arithmetic mean of the channels in step 41. After that, let Each parameter is used to calculate the cosine similarity with w, resulting in a similarity set. The size of this set is the number of channels involved. The number of updated clients and the calculation method for cosine similarity are as follows: in This represents the arithmetic mean vector of the nth client on channel c. Cosine similarity; Step 43: Divide the cosine similarity of the current participant by the sum of the cosine similarities of all participants; Step 44: Update the ratio from Step 43 as the weighting coefficient for the current participant's participation in the aggregation. The global parameter update method is as follows: in This represents the parameter of the c-th channel of the global model after t rounds of federated aggregation. The weighting coefficients represent the sample size. This represents the similarity weighting coefficient for the k-th client and the c-th channel.
2. The personalized federated learning intrusion detection method for edge heterogeneity as described in claim 1, characterized in that, The process of the cloud server executing the personalized pruning algorithm in step 2, based on the client's resource information, specifically includes: Step 21: Calculate the channel importance score of the global convolutional neural network model; Step 22: Sort the channels according to their importance scores from lowest to highest; Step 23: Calculate the tradeoff score of the current model by decreasing the number of channels in order of sorting. Step 24: Determine if the score is negative; Step 25: If the score is non-negative, add the current channel index to the list and return to step 23; Step 26: If the score is negative, stop the loop; Step 27: Calculate the channel index with the highest score in the list and use it as the channel pruning index for the current client.
3. The personalized federated learning intrusion detection method for edge heterogeneity as described in claim 2, characterized in that, The calculation method for step 21 is as follows: in This represents the importance evaluation of the c-th channel of the model parameters. This represents the gradient of the s-th neuron within the channel. This represents the norm of the s-th neuron; The smaller the value, the smaller the impact of that channel on the model's output and loss function.
4. The personalized federated learning intrusion detection method for edge heterogeneity as described in claim 2, characterized in that, Step 22: Sort the channels according to their importance scores from lowest to highest; unlike methods that require sensitivity analysis, the channels are sorted directly; the sorting method is as follows: in This represents the sorted set after the importance evaluations are ranked from highest to lowest.
5. The personalized federated learning intrusion detection method for edge heterogeneity as described in claim 2, characterized in that, Step 23: Calculate the tradeoff score of the current model by decreasing the number of channels sequentially according to the sorting order. Since different clients have different resource capabilities, a scoring criterion is defined to achieve a tradeoff between efficiency and accuracy. The sub-model for the client is generated based on the highest-scoring pruning rate. The score is calculated as follows: in It is a sub-element of the set of pruning rates, where P represents the i-th pruning rate in the set. The pruning rate of the kth client is The score at that time, the numerator represents the score when the pruning rate is 100%. The sum of the importance of time-based models Indicates when the pruning rate is At that time, the theoretical time for the kth client.
6. A detection system implemented using the personalized federated learning intrusion detection method for edge heterogeneity as described in any one of claims 1-5, characterized in that, include: The convolutional neural network-based intrusion detection module is used to train the convolutional neural network by taking traffic data as input, and obtain basic intrusion detection models in the cloud and on-premises, which are used for model reuse and parameter inheritance in federated learning. The model compression module based on personalized pruning takes resource information from heterogeneous clients as input and then adaptively assigns an appropriate pruning rate to edge clients based on the quantitative relationship between resource consumption and model performance.
7. The personalized federated learning intrusion detection system for edge heterogeneity as described in claim 6, characterized in that, The model compression module based on personalized pruning includes: Channel importance evaluation module: It is used to determine the importance of the global model in the cloud, aiming to retain the channels with high importance and cut off the redundant channels during the model compression process; The weighted score evaluation module is used to weigh the performance and resource information of the target client after the importance judgment, and calculate an appropriate pruning rate for the target client. Model pruning module: It is used to prune the global model according to the channel index number of the convolution, generate a sub-model and send it to the target client; The similarity-weighted asynchronous model aggregation module takes local clients that have completed local training as input, and then allows local models with different network structures to be asynchronously aggregated on the server, so that the aggregated model can better adapt to the overall data distribution.
8. The personalized federated learning intrusion detection system for edge heterogeneity as described in claim 6, characterized in that, The similarity-weighted asynchronous model aggregation module includes: Cosine similarity calculation module: It is used to calculate the cosine similarity between each channel of the target client and the average of all clients participating in federated learning under that channel, and obtain the similarity weighting coefficient; Global model parameter update module: It is used to aggregate the heterogeneous local models participating in the training in this round by channel as the aggregation unit to obtain the new round of global model parameters.