Federated learning-based alliance chain distributed denial of service attack real-time detection method and system

Abstract

The application provides a kind of method and system for real-time detection of distributed denial-of-service attack based on alliance chain of federal learning, alliance chain includes multiple nodes participating in federal learning, including multiple training layer nodes and multiple monitoring layer nodes, each node is alternately used as training layer node and monitoring layer node, method includes: when node is used as training layer node, DDoS attack network traffic data is formed into data set, local attack detection local model is trained according to data set, updated local model parameters and detection accuracy are obtained and sent to cloud aggregator, so that cloud aggregator determines corresponding multiple weight coefficients according to multiple updated detection accuracies and aggregates multiple updated local model parameters to obtain updated global model parameters and sends to alliance chain;When node is used as monitoring layer node, update global model parameters are obtained from alliance chain and local model is updated to monitor DDoS attack in real time, and DDoS attack network traffic data is collected in real time to update data set.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning and network security, and particularly relates to a method and system for real-time detection of distributed denial of service attacks on a consortium chain based on federated learning. BACKGROUND

[0002] Distributed Denial of service (DDoS) attacks are one of the largest and most unpredictable security threats. In the current consortium chain carbon trading environment, the network architecture is still manually configured, and DDoS attacks are becoming more and more common. DoS attacks are attacks initiated by a single source, while DDoS attacks use multiple hosts to attack the system. When such an attack occurs, it is extremely challenging to determine the source of the attack, as attackers disguise their identity by using fake IP addresses.

[0003] In the existing consortium chain carbon trading network, DDoS attacks are mainly targeted at the member pool, users, and their communication media. In a peer-to-peer system, DDoS can be executed in different forms, such as guiding the blockchain network, users, and member pools to be directed to a false or fake network by denying access to the real network. This process can be performed by hackers by hijacking a small number (<100) of Border Gateway Protocol (BGP) prefixes. Another method of DDoS attack on a consortium chain network is to perform a flood attack on the Memory Pool through spam transactions by the attacker in the network. In a consortium chain, the member pool serves as a transaction repository, where all shared transactions of peers are initially recorded and await confirmation. Once an IoT node generates a transaction, it is propagated among all synchronized IoT peers, and the resulting transaction will wait for confirmation in the member pool. The size of the member pool grows with the growth of unconfirmed transactions, and the actual user has to pay more fees to prioritize his / her unconfirmed transactions, which becomes an opportunity for attackers. DDoS attacks affect the carbon trading ecosystem. When a DDoS attack is made on a trading exchange, it causes a sharp decline in the number of large carbon transactions at that exchange. Therefore, in order to detect DDoS attacks that occur when a consortium chain carbon trade is made, a secure and robust security mechanism is needed.

[0004] DDoS monitoring includes three elements: IP tracking, defense (or mitigation), and detection. Due to the open architecture of the Internet, attackers can simply spoof source IP addresses and break detection methods based on source addresses, making it easy for them to manipulate detection algorithms. By spoofing hop detection, the Time-To-Live (TTL) value of the attacked packet can also be changed.

[0005] Traditional DDoS attack monitoring models use centralized training, which cannot quickly process massive amounts of data, and once the trainer is attacked, the training of the DDoS monitoring model will stop. Some scholars consider mobilizing various computing resources to speed up the training of the model by using distributed training. However, in the process of distributed training, the privacy of the trainer is easily leaked.

[0006] The network security community has recently begun to study federated learning (FL) more and more as a means of collaboratively training deep learning models using decentralized network threat profiles without exposing the training set. Nonetheless, the application of FL in network security is still in its early stages, and many useful considerations have not been well covered.

[0007] The above studies have discussed the application of FL in network security and intrusion detection, mainly relying on federated averaging (FEDAVG), which is a FL mechanism introduced by McMahan et al. that requires a representative test set on the server side to control the training process. However, the FEDAVG algorithm averages the model parameters of each client, where the well-trained clients are dragged down by the poorly trained devices, resulting in longer training times and lower model accuracy. This results in a serious waste of computing resources, which does not comply with the low-carbon environmental protection policy.

[0008] Therefore, there are some problems in the training base stage of the blockchain transaction DDoS model: first, a single training model is vulnerable to attacks, leading to paralysis and slow training speed; second, distributed training easily leaks the privacy of the trainer, and the trainers for detecting blockchain carbon transaction anomaly models are mostly deployed on nodes in the blockchain, which also store a lot of carbon transaction information that cannot be leaked; third, the traditional federated learning model takes the average of the parameters of different clients in the aggregation process, and the well-trained clients cannot fully exert their advantages, resulting in slow aggregation speed. In the field of monitoring blockchain transaction DDoS attacks, there is also a problem of being unable to monitor network traffic in real time. SUMMARY

[0009] In view of this, the embodiments of the present application provide a federated learning-based alliance chain distributed denial of service attack real-time detection method and system to eliminate or improve one or more defects in the prior art.

[0010] The first aspect of the present application provides a federated learning-based alliance chain distributed denial of service attack real-time detection method, the alliance chain comprising a plurality of supervised nodes participating in federated learning, the plurality of supervised nodes comprising a plurality of training layer supervised nodes and a plurality of monitoring layer supervised nodes, and each supervised node being alternately used as a training layer supervised node and a monitoring layer supervised node, the method comprising:

[0011] When the supervision node is used as a training layer supervision node, the supervision node forms a data set of distributed denial of service attack network traffic data, trains a locally deployed attack detection local model according to the data set to obtain local model parameters and a corresponding detection accuracy, takes the updated local model parameters and detection accuracy as updated local model parameters and detection accuracy, and sends the updated local model parameters and detection accuracy to a cloud-side aggregator, so that the cloud-side aggregator determines a plurality of weight coefficients of corresponding local model parameters according to a plurality of updated detection accuracies from a plurality of training layer supervision nodes, aggregates a plurality of updated local model parameters from a plurality of training layer supervision nodes according to the plurality of weight coefficients to obtain global model parameters, takes the updated global model parameters as updated global model parameters, and sends the updated global model parameters to the alliance chain;

[0012] When the supervision node is used as a monitoring layer supervision node, the supervision node obtains the updated global model parameters from the alliance chain, updates a locally deployed attack detection local model according to the updated global model parameters to monitor distributed denial of service attacks in real time, and collects real-time distributed denial of service attack network traffic data to update the data set.

[0013] In some embodiments of the present application, the higher the detection accuracy, the greater the weight coefficient of the corresponding local model parameter.

[0014] In some embodiments of the present application, if the supervision node recovers after being attacked by a distributed denial of service attack, the supervision node obtains updated global model parameters from the alliance chain when it is used as a monitoring layer supervision node.

[0015] In some embodiments of the present application, when the cloud-side aggregator is abnormal due to a distributed denial of service attack, the supervision node randomly selects any one of the plurality of supervision nodes as a new aggregator;

[0016] When the cloud-side aggregator recovers after being attacked by a distributed denial of service attack, the selected supervision node sends the updated global model parameters to the cloud-side aggregator.

[0017] In some embodiments of the present application, when the maximum number of alternations or the maximum number of aggregations reaches a preset number threshold, the training and updating of the model are stopped.

[0018] The second aspect of the present application provides a distributed denial of service attack real-time detection method based on a federation learning alliance chain, the alliance chain comprising a plurality of supervision nodes participating in the federation learning, the plurality of supervision nodes comprising a plurality of training layer supervision nodes and a plurality of monitoring layer supervision nodes, and each supervision node being alternately used as a training layer supervision node and a monitoring layer supervision node, the method comprising:

[0019] The cloud aggregator receives a plurality of updated local model parameters and corresponding detection accuracies from a plurality of supervisor nodes used as training layer supervisor nodes; the updated local model parameters and corresponding detection accuracies are obtained by training a locally deployed attack detection local model according to a data set formed by the distributed denial of service attack network traffic data by the supervisor nodes used as training layer supervisor nodes;

[0020] A plurality of weight coefficients of the corresponding local model parameters are determined according to the plurality of updated detection accuracies, and the plurality of updated local model parameters are aggregated according to the plurality of weight coefficients to obtain global model parameters as updated global model parameters, and the updated global model parameters are sent to the alliance chain, so that the supervisor nodes used as monitoring layer supervisor nodes obtain the updated global model parameters from the alliance chain, update the locally deployed attack detection local model according to the updated global model parameters to monitor the distributed denial of service attack in real time, and collect real-time distributed denial of service attack network traffic data to update the data set.

[0021] In some embodiments of the present application, if the supervisor node is abnormal due to a distributed denial of service attack, and the time interval between the time when the cloud aggregator sends the updated global model parameters to the alliance chain and the time when the updated local model parameters sent by the supervisor node used as a training layer supervisor node are received exceeds a preset time threshold, the cloud aggregator ignores or discards the updated local model parameters sent by the supervisor node, and aggregates the updated local model parameters sent by other training layer supervisor nodes that do not have abnormalities.

[0022] The third aspect of the present application provides a distributed denial of service attack real-time detection system based on a federated learning alliance chain, which comprises a computer device, the computer device comprising a processor, a memory and a computer program stored on the memory, the processor being configured to execute the computer program, and when the computer program is executed, the system implements the steps of the method of the first aspect or the steps of the method of the second aspect.

[0023] The fourth aspect of the present application provides a computer readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the steps of the method of the first aspect or the steps of the method of the second aspect.

[0024] The fifth aspect of the present application provides a computer program product comprising computer instructions, the computer instructions being executed by a processor to implement the steps of the method of the first aspect or the steps of the method of the second aspect.

[0025] The application discloses a federated learning-based alliance chain distributed denial of service attack real-time detection method and system, wherein the alliance chain comprises a plurality of supervision nodes participating in federated learning, the plurality of supervision nodes comprise a plurality of training layer supervision nodes and a plurality of monitoring layer supervision nodes, and each supervision node is alternately used as the training layer supervision node and the monitoring layer supervision node, so that the real-time monitoring of the DDoS attack and the training update of the local attack detection local model can be simultaneously realized, and the DDoS attack can be discovered in time. Moreover, the corresponding weight is determined according to the training effect of the attack detection local model, the plurality of local model parameters obtained by training are aggregated according to the determined weight, the aggregated model parameters, i.e., the updated global model parameters, are obtained and used for model updating and real-time monitoring of the monitoring layer supervision node, the advantage of the model with good training effect can be fully exerted, so that the training speed of the model is improved, the training precision and accuracy of the model are rapidly improved (ultimately 98.77%), and the time of the federated learning is effectively shortened. Meanwhile, no interaction is performed between the training layer supervision nodes and the monitoring layer supervision nodes in the process of the federated learning, and the privacy of the terminal device or the client of the supervision node can be effectively protected.

[0026] Additional advantages, objects, and features of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following or can be learned by practice of the application. The objects and other advantages of the application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0027] To a person skilled in the art, it will be understood that the objects and advantages of the application realized by the application are not limited to the above specific description, and the above and other objects realized by the application will be more clearly understood according to the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0028] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application.

[0029] Figure 1 A schematic diagram of an alliance chain carbon trading scene, which is one of application scenes of a federated learning-based alliance chain distributed denial of service attack real-time detection method of an embodiment of the application;

[0030] Figure 2 An architecture schematic diagram of a federated learning-based alliance chain distributed denial of service attack real-time detection system in an embodiment of the application;

[0031] Figure 3 A flow schematic diagram of a federated learning-based alliance chain distributed denial of service attack real-time detection method in an embodiment of the application;

[0032] Figure 4A flowchart of a method for detecting a distributed denial of service attack in real time based on a federated learning-based alliance chain according to another embodiment of the present application is shown in FIG. 6.

[0033] Figure 5 A curve diagram of detection accuracy of a local model for attack detection based on federated learning according to an embodiment of the present application is shown in FIG. 7.

[0034] Figure 6 A curve diagram of loss value of a local model for attack detection based on federated learning according to an embodiment of the present application is shown in FIG. 8.

[0035] Figure 7 A comparison diagram of accuracy of a local model for attack detection based on federated learning and a LUCID model according to an embodiment of the present application is shown in FIG. 9.

[0036] Figure 8 A comparison diagram of loss value of a local model for attack detection based on federated learning and a LUCID model according to an embodiment of the present application is shown in FIG. 10. DETAILED DESCRIPTION

[0037] In order to make the objects, technical solutions and advantages of the present application clearer, further detailed description will be given to the present application in combination with embodiments and drawings. Herein, the illustrative embodiments of the present application and their descriptions are used to explain the present application, but not as a limitation to the present application.

[0038] It should be noted that, in order to avoid the present application being obscured by unnecessary details, only structures and / or processing steps closely related to the solutions according to the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0039] It should be emphasized that the term “comprises / comprising” is used herein to indicate the presence of a feature, element, step or component, but not to exclude the presence or addition of one or more other features, elements, steps or components.

[0040] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0041] For the current alliance chain transaction process, for example, it can be as follows Figure 1In the illustrated alliance chain carbon trading scenario, the DDoS attack behavior occurs, and the embodiment of the present application proposes a real-time detection method and system for alliance chain distributed denial of service attack based on federated learning. The architecture of the real-time detection system for alliance chain distributed denial of service attack based on federated learning in the embodiment of the present application includes the following parts: a cloud aggregator for federated learning located on the cloud, a plurality of supervision nodes participating in federated learning constituting an alliance chain, and an attacker. Figure 2 In the architecture of the real-time detection system for alliance chain distributed denial of service attack based on federated learning, the Internet of Things terminals are divided into two groups, such as group 1 and group 2, and the Internet of Things terminals or clients in the two groups are used as the above-mentioned supervision nodes. In the process of participating in federated learning, each supervision node can be used as a training layer supervision node for training a local attack detection model, and can also be used as a monitoring layer supervision node for monitoring the DDoS attack generated in the Internet of Things network formed by the Internet of Things terminals in group 1 and group 2 in real time. The attacker can initiate a DDoS attack on any supervision node (Internet of Things terminal 1, 2, …, 2P) or cloud aggregator at any time, and each supervision node can be used as a DDoS attack monitoring device to monitor itself and all other supervision nodes in the same group and all supervision nodes in different groups in real time. The architecture of the real-time detection system for alliance chain DDoS attack in the embodiment of the present application integrates model training and monitoring, can simultaneously perform model training and real-time monitoring, and obtains a stable DDoS attack detection model through the combination of supervision nodes and cloud aggregators and the alternation of group 1 and group 2 as training layer and monitoring layer, realizes real-time monitoring and detection of DDoS attack in the Internet of Things scenario, and thus can effectively resist DDoS attack.

[0042] As Figure 2As shown, in the multiple rounds of model training and real-time monitoring process (or aggregation process) alternately performed by the multiple supervision nodes in groups 1 and 2, the first round can first take group 1 as the training layer and the supervision nodes in group 1 as the training layer supervision nodes for training of the local attack detection local model. Of course, group 2 can also be taken as the training layer first. Group 1 first acquires the initial DDoS attack network traffic data, which is composed of multiple data streams. The initial DDoS attack network traffic data is marked, and the IoT terminal / supervision node of group 1 learns the marked initial DDoS attack network traffic data locally, that is, the pre-set attack detection local model locally deployed on the supervision node as the training layer is trained using the marked initial DDoS attack network traffic data. After training, the corresponding local model parameters and detection accuracy are obtained. In this way, the second round alternately takes group 1 as the monitoring layer, and the supervision nodes in group 1 as the monitoring layer supervision nodes. The attack detection local model trained locally by the node is used to monitor the DDoS attack in the IoT network in real time and collect the latest DDoS attack network traffic data, which is used as an updated data set for training the attack detection local model of the supervision node again in the third round.

[0043] The supervision nodes in group 1 as the training layer send the local model parameters and detection accuracy obtained by training the corresponding attack detection local model to the cloud aggregator. The cloud aggregator determines multiple weight coefficients of the corresponding local model parameters according to the multiple detection accuracies received from the multiple supervision nodes in group 1, and aggregates the multiple local model parameters received from the multiple supervision nodes in group 1 based on the multiple weight coefficients to obtain global model parameters and send the global model parameters to the consortium chain. All supervision nodes in groups 1 and 2 can share the global model parameters received by the consortium chain. Further, the higher the detection accuracy, the greater the weight coefficient of the corresponding local model parameter, which can make the attack detection local model of the IoT terminal with better training effect and higher training precision have greater weight in aggregation, fully exerting its advantages.

[0044] In the first round, group 2 is simultaneously used as a monitoring layer, and the supervisory nodes in group 2 are used as monitoring layer supervisory nodes for real-time monitoring of the Internet of Things DDoS attack. Of course, group 1 can also be used as a monitoring layer. The Internet of Things terminals / supervisory nodes of group 2 obtain the global model parameters from the alliance chain, update the preset attack detection local model locally deployed according to the global model parameters, and real-time monitor the DDoS attack in the Internet of Things network and collect the current DDoS attack network flow data in real time as an updated data set for training the attack detection local model locally deployed by the supervisory node in the second round. In this way, the supervisory node in group 2 alternately used as the training layer in the second round uses the updated data set obtained in the first round to train and update the local attack detection local model, and obtains updated local model parameters and an updated detection accuracy after the training and updating are completed. Here, the attack detection local model trained in the second round is used for DDoS attack monitoring again in the third round. Then, the node sends the updated local model parameters and the updated detection accuracy obtained by local training of the corresponding attack detection local model to the cloud aggregator, the cloud aggregator determines a plurality of weight coefficients according to the plurality of updated detection accuracies received from the plurality of supervisory nodes in group 2, and aggregates the plurality of updated local model parameters received from the plurality of supervisory nodes in group 2 based on the plurality of weight coefficients to obtain updated global model parameters and send the updated global model parameters to the alliance chain to update the global model parameters stored in the alliance chain. All supervisory nodes can share the updated global model parameters in the alliance chain. Further, the higher the detection accuracy, the greater the corresponding weight coefficient, so that the attack detection local model of the Internet of Things terminal with better training effect and higher training precision has a greater weight in aggregation, and fully plays its advantages.

[0045] Through the supervisory nodes in group 1 and group 2, the above alternating process is alternately used as a training layer supervisory node and a monitoring layer supervisory node in multiple rounds, that is, the iterative training and updating of the local attack detection local model in the two groups are alternately performed multiple times, and finally the effective real-time detection of the DDoS attack in the Internet of Things network is realized.

[0046] Figure 3 A flowchart of a kind of alliance chain distributed denial of service attack real-time detection method based on federal learning for an embodiment of the application. As shown in Figure 3 The alliance chain includes a plurality of supervisory nodes participating in federal learning, the plurality of supervisory nodes include a plurality of training layer supervisory nodes and a plurality of monitoring layer supervisory nodes, and each supervisory node is alternately used as a training layer supervisory node and a monitoring layer supervisory node. The method mainly includes the following steps:

[0047] Step S110, when the supervision node is used as a training layer supervision node, the supervision node forms a distributed denial of service attack network traffic data set, trains a locally deployed attack detection local model according to the data set to obtain local model parameters and corresponding detection accuracy, as updated local model parameters and detection accuracy, and sends the updated local model parameters and detection accuracy to the cloud aggregator, so that the cloud aggregator determines a plurality of weight coefficients of the corresponding local model parameters according to a plurality of updated detection accuracies from a plurality of training layer supervision nodes, aggregates a plurality of updated local model parameters from a plurality of training layer supervision nodes according to the plurality of weight coefficients to obtain global model parameters, as updated global model parameters, and sends the updated global model parameters to the alliance chain.

[0048] Specifically, the plurality of supervision nodes includes a plurality of training layer supervision nodes and a plurality of monitoring layer supervision nodes, which means that model training and DDoS attack monitoring can be simultaneously implemented in the process of alternately converting the training function and the monitoring function of the supervision node each time.

[0049] In the first or first round of aggregation of the regulatory node used as the training layer regulatory node, when the locally deployed attack detection local model is initially trained, a known DDoS attack network traffic data set containing multiple data streams can be obtained first to form an initial data set, each data stream in the data set is labeled and preprocessed, the labeled data set is divided into a training set and a test set, and the training set and the test set are each divided into multiple sets, the number of training sets and the number of test sets are the same as the number of training layer regulatory nodes (the regulatory node used as the training layer regulatory node). Each training layer regulatory node is randomly assigned one training set and one test set after division. After the training layer regulatory node obtains the divided training set and test set, the preset attack detection local model locally deployed in the training layer regulatory node is trained using the training set, the local model parameters are obtained after the training is completed, and the attack detection local model after training is used to test and verify the test set to obtain the detection accuracy, thereby obtaining multiple local model parameters corresponding to multiple training layer regulatory nodes and multiple detection accuracies. In the subsequent alternating process, the real-time DDoS attack network traffic data collected by the regulatory node when the regulatory node is used as a monitoring layer regulatory node forms a data set and is used as an updated data set, and the local attack detection local model is updated by using the updated data set to perform data processing and local training according to the above-mentioned labeling preprocessing and training process when the regulatory node is used as a training layer regulatory node again, to obtain updated local model parameters and an updated detection accuracy, and the existing local model parameters and detection accuracy are updated. The updated local model parameters and the updated detection accuracy are sent to the cloud aggregator, so that the cloud aggregator updates the global model parameters on the basis of the last or last round to obtain updated global model parameters, and updates the global model parameters on the alliance chain.

[0050] In an embodiment of the present application, the higher the detection accuracy, the greater the weight coefficient of the corresponding local model parameter. The attack detection local model with better training effect and higher training precision can have greater weight during aggregation, thereby fully exerting its advantages.

[0051] The loss function of the local attack detection local model is:

[0052]

[0053] Where t represents the tth aggregation round or number, n represents the number of samples participating in training, l() represents the loss function between the predicted value and the true value, y i represents the true value of the ith sample, represents the prediction value of the local attack detection local model or the trainer of the regulatory node numbered p for the ith sample in the t-1 round, i represents the sample serial number, and Ω(f pt) = y t is a regularization term, and y represents a regularization parameter. The above loss function is minimized to represent the prediction value of the local attack detection local model in the pth supervision node when the supervision node is used as or as a training layer supervision node, which is trained in the tth aggregation process of the DDoS attack network traffic data. After training, the parameters of the local attack detection local model will be sent to the cloud aggregator.

[0054] Step S120, when the supervision node is used as a monitoring layer supervision node, the supervision node obtains the updated global model parameters from the consortium chain, updates the locally deployed attack detection local model according to the updated global model parameters to monitor the distributed denial of service attack in real time, and collects real-time distributed denial of service attack network traffic data to update the data set.

[0055] In this embodiment, if the supervision node is attacked by a distributed denial of service attack and then recovers, the supervision node obtains the updated global model parameters from the consortium chain when the supervision node is used as a monitoring layer supervision node.

[0056] That is, when any supervision node (local model) in the consortium chain is attacked by a DDoS attack, it can be quickly recovered and continue to train.

[0057] In an embodiment of the present application, when the cloud aggregator is abnormally generated by a distributed denial of service attack, the supervision node randomly selects any one of the plurality of supervision nodes as a new aggregator. In this embodiment, when the cloud aggregator recovers after being attacked by a distributed denial of service attack, the selected supervision node sends the updated global model parameters to the cloud aggregator. That is, when the cloud aggregator is attacked by a DDoS attack, it will not affect the training and monitoring of the local model of any supervision node in the consortium chain and the aggregation operation of the aggregator, that is, the interaction between each supervision node and the aggregator.

[0058] In each aggregation round, the consensus reached by different supervision nodes in the consortium chain records the aggregated model parameters, i.e. the updated global model parameters, on the consortium chain. When any supervision node or cloud aggregator is paralyzed and then recovers due to a network attack, the latest reliable global model parameters can be obtained from the consortium chain.

[0059] In an embodiment of the present application, when the maximum alternation number or the maximum aggregation number reaches a preset number threshold, the training and updating of the model are stopped.

[0060] For example, the preset number threshold reached by the maximum aggregation number can be 200 times. The alternation number refers to the number of aggregations after the first aggregation.

[0061] Figure 4A flowchart of a method for detecting a distributed denial-of-service attack in real time based on a federated learning alliance chain according to another embodiment of the present application is shown in FIG. 10. As shown in FIG. 10, the method for detecting a distributed denial-of-service attack in real time based on a federated learning alliance chain according to the embodiment includes a plurality of supervisory nodes participating in federated learning, the plurality of supervisory nodes including a plurality of training layer supervisory nodes and a plurality of monitoring layer supervisory nodes, and each supervisory node being alternately used as a training layer supervisory node and a monitoring layer supervisory node. The method mainly includes the following steps: Figure 4

[0062] In step S210, the cloud aggregator receives a plurality of updated local model parameters and corresponding detection accuracies from the plurality of supervisory nodes when used as training layer supervisory nodes. The updated local model parameters and corresponding detection accuracies are obtained by training a locally deployed attack detection local model according to a data set formed by distributed denial-of-service attack network traffic data when the supervisory nodes are used as training layer supervisory nodes.

[0063] In step S220, a plurality of weight coefficients of the corresponding local model parameters are determined according to the plurality of updated detection accuracies, and the plurality of updated local model parameters are aggregated according to the plurality of weight coefficients to obtain global model parameters as updated global model parameters. The updated global model parameters are sent to the alliance chain, so that the supervisory nodes when used as monitoring layer supervisory nodes obtain the updated global model parameters from the alliance chain, update the locally deployed attack detection local model according to the updated global model parameters to monitor distributed denial-of-service attacks in real time, and collect real-time distributed denial-of-service attack network traffic data to update the data set.

[0064] Specifically, the cloud aggregator determines a plurality of weight coefficients of the corresponding local model parameters according to the plurality of updated detection accuracies received from the plurality of supervisory nodes when used as or as training layer supervisory nodes according to the following formula:

[0065]

[0066] wherein q p represents the weight coefficient corresponding to the local attack detection local model in the pth supervisory node when used as a training layer supervisory node, acc p represents the updated detection accuracy corresponding to the local attack detection local model in the pth supervisory node when used as a training layer supervisory node, p = 1, …, P, and P represents the total number of supervisory nodes when used as training layer supervisory nodes.

[0067] ​Furthermore, based on multiple weight coefficients, the updated local model parameters received from multiple supervisory nodes used as or acting as supervisory nodes in the training layer are aggregated to obtain the updated global model parameters:

[0068]

[0069] Where, ω * ω represents the updated global model parameters. p This represents the updated local model parameters of the attack detection local model in the p-th supervisory node when it is used as a supervisory node in the training layer.

[0070] In one embodiment of the present invention, if the supervisory node is subjected to a distributed denial-of-service attack and an anomaly occurs, and the time interval between the cloud aggregator sending the updated global model parameters to the consortium blockchain and receiving the updated local model parameters sent by the supervisory node when it is used as a training layer supervisory node exceeds a preset time threshold, the cloud aggregator ignores or discards the updated local model parameters sent by the supervisory node, and aggregates the updated local model parameters sent by other training layer supervisory nodes that have not generated anomalies.

[0071] Specifically, when regulatory nodes, such as Figure 2 When the IoT terminals in groups 1 and 2 shown are down due to DDoS attacks or crash due to network failures, the cloud aggregator has difficulty receiving model training data, i.e., local model parameters, from the attacked IoT terminals. In this case, this embodiment introduces an asynchronous federated learning mechanism to eliminate the aforementioned interference. When the cloud aggregator distributes the updated aggregation parameters from the previous aggregation round to a monitoring node (i.e., the monitoring node is used as a monitoring layer monitoring node in this round), i.e., the updated global model parameters, a timestamp τ is added to the global model parameters. When the monitoring node sends the latest local model parameters for the current round to the cloud aggregator (i.e., the monitoring node is used as a training layer monitoring node in this round), the time is recorded as τ. ′ The preset time threshold can be 60 seconds, etc., if τ ′ When -τ>60s, the cloud aggregator chooses to discard or ignore the local model parameters sent by the monitoring node. That is, the local model parameters sent by this monitoring node do not participate in the aggregation. Aggregation is only performed on the local model parameters of other training layer monitoring nodes that normally or promptly send data to the cloud aggregator. The aggregated model parameters are used for the next round of model training and updates for that node. In other words, if any monitoring node (local model) in the consortium blockchain is attacked, it will not affect the training of models in other monitoring nodes.

[0072] This invention uses the fedprox aggregation algorithm to experimentally verify the above method, and... Figure 5The detection accuracy of the cloud aggregator (server) and the supervision node (client) is plotted with the increase of the number of aggregations. As shown in Figure 5 , in the first aggregation, the detection accuracy of the three clients is 67.18%, 65.60% and 84.77% respectively. With the continuous iteration and updating of the model and the aggregation of the model parameters, the detection accuracy of the client and the server first increases and then stabilizes at a certain level. It can be seen from Figure 5 that during the aggregation from the first time to the 40th time, the accuracy of the model rapidly increases, and after the 40th aggregation, the accuracy of the model is maintained stable, and the detection accuracy is stably maintained at 98.77%.

[0073] In the embodiment of the application, Figure 6 the loss value of the cloud aggregator (server) and the supervision node (client) is plotted with the increase of the number of aggregations. As shown in Figure 6 , in the first aggregation, the loss Loss value of the three clients is 0.5907, 0.6215 and 0.5968 respectively, and the Loss value of the server is 0.8084. With the continuous aggregation and updating of the model, the loss value of the client and the server gradually decreases. It can be seen from the figure that during the aggregation from the first time to the 50th time, the Loss value rapidly decreases. At the 50th aggregation, the Loss value of the server has decreased to 0.1274, but after the 50th aggregation, the Loss value of the server model gradually tends to be stable and is stably below 0.0787.

[0074] The federated learning-based attack detection local model of the embodiment of the application is compared with the existing LUCID model, and it can be seen from Figure 7 and Figure 8 that with the increase of the iteration number epoch, the performance of the two models is optimized to different degrees, but the detection accuracy of the federated learning-based attack detection local model of the embodiment of the application is always better than that of the LUCID model, that is, the detection accuracy of the model is higher than that of the LUCID model, and the loss value is also smaller than that of the LUCID model. Experiments show that the performance of the federated learning-based attack detection local model of the embodiment of the application is better than that of the existing LUCID model.

[0075] Corresponding to the above method, the embodiment of the application also provides a federated learning-based alliance chain distributed denial of service attack real-time detection system, which comprises a computer device, the computer device comprises a processor and a memory, the memory stores a computer program, and the processor is used to execute the computer program stored in the memory, and when the computer program is executed by the processor, the system realizes the steps of the foregoing method.

[0076] The embodiment of the present application further provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps of the foregoing method. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0077] The embodiment of the present application further provides a computer program product, which comprises computer instructions. The computer instructions are executed by a processor to implement the steps of the foregoing method.

[0078] Those skilled in the art should understand that each example component, system and method described in connection with the embodiments disclosed herein can be implemented in hardware, software or a combination of both. The actual implementation depends on the specific application and design constraints imposed on the overall system. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted through a data signal carried in a carrier wave in a transmission medium or communication link.

[0079] It should be noted that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of well-known methods are omitted. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present application are not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order of the steps, after understanding the spirit of the present application.

[0080] In the present application, the features described and / or illustrated for one embodiment can be used in the same way or in a similar way in one or more other embodiments, and / or in combination with or instead of features of other embodiments.

[0081] The above description is merely preferred embodiments of the present application, and is not intended to limit the present application. Those skilled in the art can make various modifications and changes to the embodiments of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall fall within the scope of the present application.

Claims

1. A real-time detection method for distributed denial-of-service attacks in consortium blockchains based on federated learning, characterized in that, The consortium blockchain includes multiple supervisory nodes participating in federated learning. These supervisory nodes include multiple training layer supervisory nodes and multiple monitoring layer supervisory nodes, with each supervisory node alternately serving as both a training layer supervisory node and a monitoring layer supervisory node. The method includes: When the supervisory node is used as a training layer supervisory node, it forms a dataset from distributed denial-of-service attack network traffic data, trains a locally deployed attack detection local model based on the dataset to obtain local model parameters and corresponding detection accuracy, and sends the updated local model parameters and detection accuracy to the cloud aggregator. The cloud aggregator then determines multiple weight coefficients for the corresponding local model parameters based on multiple updated detection accuracy from multiple training layer supervisory nodes, aggregates the multiple updated local model parameters from multiple training layer supervisory nodes based on the multiple weight coefficients to obtain global model parameters, sends the updated global model parameters to the consortium blockchain. When the supervisory node is used as a monitoring layer supervisory node, the supervisory node obtains the updated global model parameters from the consortium blockchain, updates the locally deployed attack detection local model according to the updated global model parameters to monitor distributed denial-of-service attacks in real time, and collects real-time distributed denial-of-service attack network traffic data to update the dataset.

2. The method according to claim 1, characterized in that, The higher the detection accuracy, the greater the weight coefficient of the corresponding local model parameters.

3. The method according to claim 1, characterized in that, If the supervisory node recovers after being subjected to a distributed denial-of-service attack, it will obtain updated global model parameters from the consortium blockchain when used as a monitoring layer supervisory node.

4. The method according to claim 1, characterized in that, When the cloud aggregator is subjected to a distributed denial-of-service attack and an anomaly occurs, the monitoring node randomly selects any one of the plurality of monitoring nodes as the new aggregator; When the cloud aggregator recovers from a distributed denial-of-service attack, the selected supervisory node sends updated global model parameters to the cloud aggregator.

5. The method according to claim 1, characterized in that, When the maximum number of alternations or the maximum number of aggregations reaches a preset threshold, the training and updating of the model will be stopped.

6. A real-time detection method for distributed denial-of-service attacks in consortium blockchains based on federated learning, characterized in that, The consortium blockchain includes multiple supervisory nodes participating in federated learning. These supervisory nodes include multiple training layer supervisory nodes and multiple monitoring layer supervisory nodes, with each supervisory node alternately serving as both a training layer supervisory node and a monitoring layer supervisory node. The method includes: The cloud aggregator receives multiple updated local model parameters and corresponding detection accuracies from multiple supervisory nodes used as training layer supervisory nodes; the updated local model parameters and corresponding detection accuracies are obtained by the supervisory nodes used as training layer supervisory nodes forming a dataset from distributed denial-of-service attack network traffic data, and training the locally deployed attack detection local model based on the dataset. Multiple weight coefficients are determined for corresponding local model parameters based on multiple updated detection accuracies. These updated local model parameters are then aggregated based on the weight coefficients to obtain global model parameters, which are used as updated global model parameters. These updated global model parameters are then sent to the consortium blockchain, enabling the supervisory node used as a monitoring layer supervisory node to obtain the updated global model parameters from the consortium blockchain. Based on these updated global model parameters, the locally deployed attack detection local model is updated to monitor distributed denial-of-service attacks in real time and to collect real-time distributed denial-of-service attack network traffic data to update the dataset.

7. The method according to claim 6, characterized in that, If the supervisory node is subjected to a distributed denial-of-service attack and becomes abnormal, and the time interval between the cloud aggregator sending the updated global model parameters to the consortium blockchain and receiving the updated local model parameters sent by the supervisory node when it is used as a training layer supervisory node exceeds a preset time threshold, the cloud aggregator ignores or discards the updated local model parameters sent by the supervisory node, and aggregates the updated local model parameters sent by other training layer supervisory nodes that have not become abnormal.

8. A real-time detection system for distributed denial-of-service attacks on consortium blockchains based on federated learning, comprising a processor, a memory, and a computer program stored in the memory, characterized in that, The processor is configured to execute the computer program, and when the computer program is executed, the system implements the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method as described in any one of claims 1 to 7.

10. A computer program product comprising computer instructions, characterized in that, When executed by a processor, the computer instructions implement the steps of the method according to any one of claims 1 to 7.

Images