Industrial internet traffic classification method based on adaptive hierarchical differential privacy federated learning
By employing adaptive hierarchical differential privacy federated learning, combined with hierarchical privacy-enhanced noise and adaptive learning rate, the risk of privacy data leakage in federated learning within the Industrial Internet is addressed, resulting in faster model convergence and higher accuracy.
Patent Information
- Application Number
- CN202410234822.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-03-01
- Publication Date
- 2026-01-23
- Estimated Expiration
- 2044-03-01
AI Technical Summary
Existing federated learning poses a risk of privacy data leakage during interactions in the Industrial Internet, and it is difficult to balance the effectiveness of defense with the convergence and accuracy of the model.
An adaptive hierarchical differential privacy federated learning method is adopted. By adding hierarchical privacy noise and adapting the learning rate range, combined with mutual information and gradient pruning, the noise level and learning rate are dynamically adjusted to improve privacy defense capability and model accuracy.
It achieves faster model convergence speed in the Industrial Internet, improves privacy protection capabilities and model accuracy, and reduces the impact of noise on model performance.
Smart Images
Figure CN118316642B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of privacy noise allocation, and in particular to an industrial internet traffic classification method based on adaptive hierarchical differential privacy federated learning. Background Technology
[0002] Federated learning, as a form of distributed machine learning, offers significant advantages in terms of privacy protection and lower computational and communication costs. However, while federated learning prevents client-side private data from leaving the local storage environment, current research indicates that even if data exchanged between the client and server is exposed, there is still a serious risk of privacy breaches.
[0003] To further enhance the privacy of federated learning, differential privacy algorithms have been widely applied in large-scale scenarios such as the Industrial Internet. However, to address the lack of specificity in defenses and the inability to balance defense effectiveness with model performance, it is crucial to mitigate the challenges posed by random noise in differential privacy to model convergence and accuracy. Summary of the Invention
[0004] This invention addresses the problems of existing technologies by providing an industrial internet traffic classification method based on adaptive hierarchical differential privacy federated learning. The adaptive hierarchical differential privacy technology proposed in this invention takes into account both defense performance and model convergence and accuracy, and can be widely used in industrial internet scenarios, improving the intelligence and efficiency of production while ensuring privacy and security.
[0005] To address the above technical problems, this invention provides the following technical solution: an industrial internet traffic classification method based on adaptive hierarchical differential privacy federated learning, comprising the following steps:
[0006] S1. Each client collects traffic data from the terminal control smart device and preprocesses it to build a traffic data training sample dataset, including normal traffic, malicious traffic and corresponding classification labels;
[0007] S2. The central server selects clients, and each selected client constructs its own local traffic data classification neural network. Then, the selected clients train their local traffic data classification neural networks using the traffic data training sample dataset. Based on the clients' local traffic data classification neural networks, the central server constructs a global traffic data classification neural network, and integrates and backpropagates the client's local traffic data classification neural networks to update the global traffic data classification neural network, thus obtaining a global traffic data classification model. During the training process, layered privacy noise addition, determining the adaptive learning rate variation range, and selecting an adaptive learning rate scheme based on the federated learning data task are used to ensure that the variance of the added noise remains consistent.
[0008] S3. Using a global traffic classification model, classify the data traffic of real-time terminal control smart devices to determine whether it is normal traffic or malicious traffic.
[0009] Furthermore, in step S1 above, the traffic data consists of all data packets that have the same five-tuple, namely, source IP, source port, destination IP, destination port, and transport protocol.
[0010] Furthermore, the preprocessing in step S1 mentioned above specifically involves the visualization of traffic data, including the following steps:
[0011] S101. Split continuous traffic data into discrete traffic data;
[0012] S102. Clean up and delete the traffic data, and trim it to the same preset length;
[0013] S103. Convert each byte in the traffic data into a grayscale image, treating it as a pixel.
[0014] Furthermore, in step S2 mentioned above, the hierarchical privacy-preserving noise addition during training specifically involves calculating the mutual information between the output weights of each layer of the neural network and the traffic data to determine the noise addition scheme for each client, including the following sub-steps:
[0015] A-201. Using batch size B of traffic data as input, calculate the mutual information between the output and the original traffic data for each layer, as shown in the following formula:
[0016] ,
[0017] In the formula, express and The mutual information expression, i.e., privacy risk; This represents the corresponding KL divergence expression; and These represent the original data in the client with a batch size of B and the output of a certain layer of the model, respectively. , and They represent and The joint and marginal distributions; Describe the joint distribution Expectations; Indicates network parameters; Indicates marginal distribution Expectations;
[0018] A-202. Before adding noise, based on the principle of differential privacy, interactive data between the client and the central server is required. Gradient clipping is performed within a preset range to limit the gradient to... Internal, interactive data Calculate as follows:
[0019] ,
[0020] This is the upper limit of the gradient size;
[0021] A203. Calculate the privacy risks of each layer of the neural network according to step A-201. Distribute the noise added to the i-th layer:
[0022] ,
[0023] in This represents the privacy budget for this federated learning; the client weights the noise by applying the inverse of the privacy risk of each layer to each layer.
[0024] A204. Add Laplace noise for defense. The noise addition to the i-th layer is as follows:
[0025] ,
[0026] in This represents the sensitivity in differential privacy, specifically expressed as... Its learning rate and gradient upper limit The impact.
[0027] Furthermore, in the aforementioned step S2, determining the adaptive learning rate variation range specifically includes the following sub-steps:
[0028] B-201. Train federated learning for a preset number of rounds and test the change in the loss function of the neural network output under different learning rates.
[0029] B-202. Select the learning rate range based on the change in the loss function. Use the change in the loss function as the selection benchmark. The appropriate learning rate range is determined as follows: .
[0030] Furthermore, in the aforementioned step S2, selecting an adaptive learning rate scheme based on the federated learning data task specifically includes the following sub-steps:
[0031] C-201. Using a piecewise decaying learning rate, the learning rate in the k-th round of learning is expressed as follows:
[0032] ,
[0033] in The initial learning rate, i.e., the minimum learning rate. , As a decreasing factor, E is the number of global iterations.
[0034] C-202. Based on the noise budget corresponding to the adaptive learning rate change, redefine the corresponding privacy budget as follows:
[0035] .
[0036] Compared with the prior art, the beneficial technical effects of the present invention using the above technical solution are as follows:
[0037] 1. Thanks to the adaptive learning rate, this invention enables the model to have better convergence performance and faster convergence speed than other models with added noise.
[0038] 2. By assessing the privacy leakage risk based on the mutual information between the model parameters and the original data at each layer, and adding noise of an appropriate amount accordingly, a better and more accurate privacy defense capability can be achieved.
[0039] 3. Due to the inclusion of adaptive privacy budget, the noise added in each round is appropriate and controllable, which can minimize the impact of privacy defense methods on model accuracy. Attached Figure Description
[0040] Figure 1 This is a schematic diagram of the implementation method of the present invention.
[0041] Figure 2 This is a diagram of the federated learning framework for traffic classification in this invention. Detailed Implementation
[0042] To better understand the technical content of the present invention, specific embodiments are described below in conjunction with the accompanying drawings.
[0043] In this invention, various aspects of the invention are described with reference to the accompanying drawings, in which numerous illustrative embodiments are shown. Embodiments of the invention are not limited to those depicted in the drawings. It should be understood that the invention is implemented through any of the various concepts and embodiments described above, as well as the concepts and embodiments described in detail below, because the concepts and embodiments disclosed herein are not limited to any particular implementation. Furthermore, some aspects of the invention disclosed may be used alone or in any suitable combination with other aspects of the invention disclosed.
[0044] refer to Figure 1This invention provides an adaptive hierarchical differential privacy federated learning method for the Industrial Internet, comprising the following steps:
[0045] S1. Each client collects traffic data from the terminal control smart device and preprocesses it to build a traffic data training sample dataset, including normal traffic, malicious traffic and corresponding classification labels;
[0046] S2. The central server selects clients, and each selected client constructs its own local traffic data classification neural network. Then, the selected clients train their local traffic data classification neural networks using the traffic data training sample dataset. Based on the clients' local traffic data classification neural networks, the central server constructs a global traffic data classification neural network, and integrates and backpropagates the client's local traffic data classification neural networks to update the global traffic data classification neural network, thus obtaining a global traffic data classification model. During the training process, layered privacy noise addition, determining the adaptive learning rate variation range, and selecting an adaptive learning rate scheme based on the federated learning data task are used to ensure that the variance of the added noise remains consistent.
[0047] S3. Using a global traffic classification model, classify the data traffic of real-time terminal control smart devices to determine whether it is normal traffic or malicious traffic.
[0048] refer to Figure 2 This invention utilizes traffic data generated by terminals in a factory when controlling intelligent devices. For example, in a workshop network with privacy protection requirements, various terminals control various intelligent devices, such as robotic arms, AGVs, or lifting platforms. The workshop's central server can monitor and sample the network traffic used by each terminal. This invention uses ten types of normal traffic collected by IXIA BPS and collects traffic data from ten terminals exhibiting malicious traffic consumption or malicious attack tendencies. The collected traffic data is defined as all data packets with the same five-tuple: source IP, source port, destination IP, destination port, and transport level protocol. To avoid the traffic data feature selection step, this invention performs visualization processing on the traffic data. First, continuous traffic is split into discrete traffic units; then, the traffic data is cleaned and deleted, removing empty or duplicate files; next, the files are trimmed to a uniform length, here uniformly trimmed to 784 bytes. If this is not met, zeros are added to the end; each byte in the original file is treated as a pixel and converted into an image. Finally, the image is converted into an IDX format file, and the data participating in federated learning is a 28*28 byte grayscale image.
[0049] The client of this invention, also known as the workshop server, collects traffic data at a node on the network. After preprocessing the data, it is trained to learn the websites and applications to which it belongs, thus classifying the data. This facilitates timely action when a website or application exhibits a tendency or behavior of maliciously consuming network resources.
[0050] The global traffic data classification neural network constructed in this invention uses the FedSGD (Federated Stochastic Gradient Descent) framework.
[0051] The central server, possessing significant computing and storage capabilities, integrates the learning model. The clients are the workshop clients with privacy concerns. The central server selects clients to participate in the learning process and sends them the global model. Upon selecting the clients to participate in the learning process, each client collects traffic data for local model training, and then calculates the gradient of the local model's loss function. The data is sent to a central server for integration and backpropagation to obtain a new global model. This process iterates continuously until the loss function meets the convergence requirement, at which point learning stops.
[0052] In practice, the maximum number of learning epochs for the entire model is 5000. It uses a local learning model with two convolutional layers and one fully connected layer, and the optimizer is Adam.
[0053] In step S2, the hierarchical privacy noise addition during training specifically includes the following steps:
[0054] Mutual information is used to determine the privacy leakage risk of different neural network layers. Differential privacy, as a means of defending against attackers stealing information by adding random noise, requires adding noise based on the privacy risk level of the interaction parameters to increase its defensive targeting. In this embodiment, the noise addition scheme for different workshop servers is determined by calculating the mutual information between the output weights of each neural network layer and the original data.
[0055] A-201. Using batch size B of traffic data as test input, calculate the mutual information between the output and the original data for each layer, as shown in the following formula:
[0056] ,
[0057] In the formula, express and The mutual information expression, i.e., privacy risk; This represents the corresponding KL divergence expression; and These represent the original data in the client with a batch size of B and the output of a certain layer of the model, respectively. , and They represent and The joint and marginal distributions; Describe the joint distribution Expectations; Indicates network parameters; Indicates marginal distribution The expectation. Among them. The value of represents the amount of private information contained in each layer of the neural network, which is also the risk of privacy leakage. The larger the value, the greater the possibility of privacy leakage, and the more noise is needed for defense.
[0058] A-202, Gradient Clipping: Before adding noise to the model, based on the principle of differential privacy, it is necessary to ensure the data exchange between the workshop server and the central server. To maintain a certain range, gradient clipping is required:
[0059] ,
[0060] The main purpose of this step is to limit the gradient to... Inside, This is the upper limit of the gradient size.
[0061] A-203. Allocate the noise budget for each layer based on the privacy leakage risk, and calculate the privacy risk of each layer of the neural network based on step A-201. Here, the noise added to each layer i is further allocated:
[0062] ,
[0063] in This represents the privacy budget for this federated learning process. The client, i.e., the workshop server, weights the noise distribution by multiplying the inverse of the privacy risk for each layer. With Laplace noise added as a defense, the noise addition formula for the i-th layer is: ,
[0064] in The sensitivity in differential privacy is specifically expressed as It is mainly affected by the learning rate and gradient upper limit The impact.
[0065] Federated learning, with fewer training epochs, records the changes in its loss function. When the learning rate is too low, the model converges slowly, and due to insufficient weight update steps, convergence performance is poor, leading to low learning accuracy or even failure to fit the model. Conversely, when the learning rate is too high, the amount of weight updates becomes extremely large, causing the model to oscillate or diverge during training. Therefore, choosing an appropriate range for the learning rate is crucial.
[0066] In order to select a suitable range of adaptive learning rate variation, this invention uses a small number of rounds to test the change of loss function output by the neural network model under different learning rates.
[0067] In step S2, when determining the range of adaptive learning rate variation, the changes in the neural network loss function value with a learning rate between 0.0001 and 1 are recorded over 8 rounds of learning. Based on experience, when the learning rate is greater than 0.5, the loss function often exhibits large oscillations; therefore, the test values for the learning rate are concentrated within 0.5.
[0068] Then, the characteristics of the loss function's changes were observed to select the learning rate range. Because datasets in the Industrial Internet are more complex and model convergence is slower and more difficult with added noise, a significant decrease in the loss function cannot be achieved in a few rounds. Therefore, in this invention, a learning rate that allows for appropriate changes in the loss function in the early stages of learning was selected, i.e., the change in the loss function was used as the selection criterion. The average change in the loss function over 8 rounds was taken, and learning rates with almost zero change in the loss function and excessively large changes were removed. The final suitable learning rate range was determined as follows: .
[0069] In model optimization, several commonly used learning rate decay methods include piecewise decay, smooth decay, and cyclic decay. Piecewise decay allows operators to adaptively adjust the learning rate based on previous training trends, offering flexibility, but requires experience accumulation in the early stages. Smooth decay results in faster model convergence, but also incurs higher computational costs and makes it difficult to find suitable learning rate parameters. Cyclic decay allows the learning rate to vary between two reasonable boundary values, preventing the model from becoming trapped in local minima and saddle points due to excessively small learning rates in the later stages of training. However, its limited learning rate range can affect model convergence, and the flexibility of the learning rate variation method needs improvement.
[0070] In order to achieve rapid convergence in the early stage of learning and maintain stability in the later stage of learning, while also considering the cost of adaptive learning rate, a segmented decay learning rate was adopted.
[0071] In step S2, an adaptive learning rate scheme is selected based on the federated learning data task, which specifically includes the following sub-steps:
[0072] C-201. Determine the adaptive learning rate variation parameters; when this invention uses a piecewise decaying learning rate, the learning rate for the k-th round is expressed as:
[0073] ,
[0074] in The initial learning rate is also the minimum learning rate. , This is the decrease factor, which is adjusted according to the learning rounds. The learning rate adjustment interval is performed in E rounds of global iterations across the model and task. Assuming the learning rate is adjusted for the interval, the descent factor is:
[0075] ,
[0076] C-202, the noise budget varies according to the adaptive learning rate; according to the Laplacian mechanism differential privacy-related formulas above, the magnitude of the added noise is related to the learning rate and the upper bound of gradient clipping, therefore the corresponding privacy budget is redefined:
[0077] ,
[0078] This ensures that as the learning rate decreases with each learning round, the privacy budget decreases simultaneously, thus keeping the noise variance constant.
[0079] While the present invention has been described above with reference to preferred embodiments, it is not intended to limit the invention. Those skilled in the art can make various modifications and refinements without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention shall be determined by the claims.
Claims
1. An industrial internet traffic classification method based on adaptive hierarchical differential privacy federated learning, characterized in that, Includes the following steps: S1. Each client collects traffic data from the terminal control smart device and preprocesses it to build a traffic data training sample dataset, including normal traffic, malicious traffic and corresponding classification labels; S2. The central server selects clients, and each selected client constructs its own local traffic data classification neural network. Then, the selected clients train their local traffic data classification neural networks using the traffic data training sample dataset. Based on the clients' local traffic data classification neural networks, the central server constructs a global traffic data classification neural network, and integrates and backpropagates the client's local traffic data classification neural networks to update the global traffic data classification neural network, thus obtaining a global traffic data classification model. During the training process, layered privacy noise addition, determining the adaptive learning rate variation range, and selecting an adaptive learning rate scheme based on the federated learning data task are used to ensure that the variance of the added noise remains consistent. During training, layered privacy-preserving noise enhancement is performed. Specifically, this involves calculating the mutual information between the output weights of each neural network layer and the traffic data to determine the noise enhancement scheme for each client. This includes the following sub-steps: A-201. Using batch size B of traffic data as input, calculate the mutual information between the output and the original traffic data for each layer, as shown in the following formula: ， In the formula, express and The mutual information expression, i.e., privacy risk; This represents the corresponding KL divergence expression; and These represent the original data in the client with a batch size of B and the output of a certain layer of the model, respectively. , and They represent and The joint and marginal distributions; Describe the joint distribution Expectations; Indicates network parameters; Indicates marginal distribution Expectations; A-202. Before adding noise, based on the principle of differential privacy, interactive data between the client and the central server is required. Gradient clipping is performed within a preset range to limit the gradient to... Internal, interactive data Calculate as follows: ， This is the upper limit of the gradient size; A203. Calculate the privacy risks of each layer of the neural network according to step A-201. Distribute the noise added to the i-th layer: ， in This represents the privacy budget for this federated learning; the client weights the noise by multiplying the inverse of the privacy risks of all layers for each layer. A204. Add Laplace noise for defense. The noise addition to the i-th layer is as follows: ， in This represents the sensitivity in differential privacy, specifically expressed as... Its learning rate and gradient upper limit The impact; Selecting an adaptive learning rate scheme based on federated learning data tasks includes the following sub-steps: C-201. Using a piecewise decaying learning rate, the learning rate in the k-th round of learning is expressed as follows: ， in The initial learning rate, i.e., the minimum learning rate. , As a decreasing factor, E is the number of global iterations. C-202. Based on the noise budget corresponding to the adaptive learning rate change, redefine the corresponding privacy budget as follows: ， S3. Using a global traffic classification model, classify the data traffic of real-time terminal control smart devices to determine whether it is normal traffic or malicious traffic.
2. The industrial internet traffic classification method based on adaptive hierarchical differential privacy federated learning according to claim 1, characterized in that, In step S1, the traffic data consists of all data packets that have the same five-tuple, namely source IP, source port, destination IP, destination port, and transport protocol.
3. The industrial internet traffic classification method based on adaptive hierarchical differential privacy federated learning according to claim 1, characterized in that, Step S1, the preprocessing, specifically involves the visualization of traffic data, including the following steps: S101. Split continuous traffic data into discrete traffic data; S102. Clean up and delete the traffic data, and trim it to the same preset length; S103. Convert each byte in the traffic data into a grayscale image, treating it as a pixel.
4. The industrial internet traffic classification method based on adaptive hierarchical differential privacy federated learning according to claim 1, characterized in that, Step S2, determining the range of adaptive learning rate variation, specifically includes the following sub-steps: B-201. Train federated learning for a preset number of rounds and test the change in the loss function of the neural network output under different learning rates. B-202. Select the learning rate range based on the change in the loss function. Use the change in the loss function as the selection benchmark. The appropriate learning rate range is determined as follows: .