A network intrusion detection method, device and system based on federated learning

Abstract

The application relates to a network intrusion detection method, device and system based on federated learning, and belongs to the technical field of network security detection, wherein the method comprises three parts of data preprocessing, local model training and global model aggregation. In the data preprocessing stage, high-quality samples are created for minority sample classes through an SMOTE-ENN algorithm to alleviate the problem of unbalanced data distribution, redundant data is deleted through an mRMR algorithm, independent high-quality features are selected, data redundancy is eliminated, data noise is reduced, and the quality of a data set is improved, so that the speed of an algorithm and the accuracy of an intrusion detection model are improved; in the local model training, an integrated learning model is used as a local classification model, and decision tree, random forest, extreme random tree and gradient boosting tree algorithms are selected as base selectors of the integrated learning model, the application of the algorithms reduces the bias and variance of a single model, and the robustness, generalization ability and accuracy of the model can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security detection, and particularly relates to a network intrusion detection method, device and system based on federated learning. BACKGROUND

[0002] The intrusion detection system safeguards the network security by monitoring the network in real time, analyzing user activities and taking countermeasures. If the user's behavior violates the security policy, the system will issue an alarm or directly terminate the process. Network intrusion detection is divided into anomaly intrusion detection and misuse intrusion detection. The former identifies behaviors inconsistent with known patterns by learning and modeling normal network activities. It is based on the analysis of network traffic, system resource utilization, user behavior and other data to discover activities significantly different from normal behavior, and is suitable for detecting new and unknown attack forms. The latter is based on the identification of prior attack characteristics, and identifies known attack behaviors by matching known attack rules or feature libraries, and is suitable for detecting known attack patterns, such as identifying and defending against known viruses, malicious software and common attack behaviors.

[0003] A Network Intrusion Detection System (NIDS) is an important security mechanism that monitors and analyzes network traffic and system behavior to identify and respond to malicious attacks, thereby helping to protect computer networks and the data and resources within them from various threats and attacks, including but not limited to hacking, viruses, Trojans, botnets, etc. In recent years, Machine Learning (ML), including shallow models, especially Deep Learning (DL), has made great progress and become the mainstream method of network intrusion detection, widely used in government agencies, military systems, enterprise organizations, financial and medical industries, etc. without human intervention. Although existing network intrusion algorithms have made great progress, users need to upload their private data to a central entity, which may lead to exposure of their sensitive data. At the same time, the model is simple and has a small scope of application, and as the size of the network increases, the diversity of data types also brings new challenges to the detection efficiency and generalization ability of the algorithm. The existing network intrusion algorithms have the following shortcomings: (1) Data privacy issues: Traditional methods usually need to collect and store a large amount of network traffic data on centralized servers, and users' sensitive information may be leaked or misused; (2) High demand for computing resources: Deep learning models usually require a large amount of computing resources and high-performance hardware for training and inference, which cannot be met by edge devices or low-power devices; (3) Limited model generalization ability: IoT devices generate less traffic, so the training data generated will also be less, and the generality of the sample will decrease, resulting in poor recognition ability of the model for unknown behavior.

[0004] To solve these problems, Federated Learning (FL)-based network intrusion detection methods have emerged. Federated learning not only protects data privacy, but also takes advantage of distributed computing and resource sharing to improve the generalization ability of the model. Through the cooperation of multiple participants in training, federated learning can effectively improve the accuracy and robustness of the network intrusion detection system. Due to these advantages, FL provides new opportunities for more effective application of ML algorithms in IDS.

[0005] Although Federated Intrusion Detection System (FIDS) based on federated learning shows advantages over traditional models, and many researchers have proposed excellent network intrusion detection system models based on federated learning, these models still have the following defects and vulnerabilities:

[0006] (1) High false positives using non-IID data: In federated learning, the size, type, ambiguity, and complexity of the participant data vary. This can lead to asymmetrically trained local models, which, when aggregated, will result in underfit global models, thus affecting the performance of the model. In addition to this, if the local client holds data containing redundant, imbalanced, or poisoned features or values, the corresponding model can fail regardless of the amount of training.

[0007] (2) Communication overhead: Federated learning requires frequent communication between participants to transfer model parameters and updates. Depending on the network bandwidth, server traffic, packet transmission loss, time taken for communication, and other parameters can vary greatly. Moreover, the use of different devices in the network will inevitably result in varying computing capabilities of each device. In light of the above, the overall throughput of any federated network is low in real-world scenarios. SUMMARY

[0008] In view of the problems of low precision, insufficient generalization ability, difficulty in processing large-scale high-dimensional data and unbalanced data, and privacy leakage of existing network intrusion detection models, the present application proposes a network intrusion detection method, device and system based on federated learning, which can improve the detection efficiency of the algorithm and save computing resources while protecting user privacy.

[0009] To solve the above problems, the present application adopts the following technical solutions:

[0010] A network intrusion detection method based on federated learning, comprising the following steps:

[0011] Step 1: using a feature engineering method to preprocess the original data set to obtain processed data, and dividing the processed data into K parts, and then dispersing the data of the K parts to K local models respectively;

[0012] Wherein, the feature engineering method for preprocessing the original data set comprises the following steps:

[0013] S1-1: sequentially performing data cleaning, one-hot encoding and Z-score processing on the original data set to obtain normalized data;

[0014] S1-2: using the SMOTE-ENN algorithm to create new samples and eliminate noise samples for the normalized data to obtain high-quality sample data;

[0015] S1-3: Calculate the value of mRMR of high-quality sample data in the feature space by using the mRMR algorithm, and delete redundant data according to the value of mRMR, and finally obtain processed data, wherein mRMR=maxD-minR, maxD represents the maximum correlation between the feature and the target variable, and minR represents the minimum redundancy standard between the features;

[0016] Step 2: Construct the local model by using the ensemble learning model, select the decision tree algorithm, the random forest algorithm, the extreme random tree algorithm and the gradient boosting tree algorithm as the base selector of the ensemble learning model, train and update the ensemble learning model by using the processed data, and upload the parameters of the ensemble learning model to the central server after each round of training is completed;

[0017] Step 3: The central server aggregates the parameters uploaded by all local models according to the FedAvg strategy, generates the parameters of the global model, and trains new data by using the parameters of the global model to obtain a trained global model, and the central server distributes the parameters of the trained global model to the K local models, and the K local models perform parameter updating and training until the local model converges, and the converged local model performs network intrusion detection by using the parameters of the global model and outputs the network intrusion detection classification result.

[0018] Correspondingly, the application also provides a network intrusion detection device based on federated learning, comprising:

[0019] The data preprocessing module is configured to preprocess the original data set by using a feature engineering method to obtain processed data, and divide the processed data into K parts, and then distribute the data of the K parts to the K local models respectively;

[0020] The local model comprises a local model constructed by using an ensemble learning model, and the decision tree algorithm, the random forest algorithm, the extreme random tree algorithm and the gradient boosting tree algorithm are selected as the base selector of the ensemble learning model, the ensemble learning model is trained and updated by using the processed data, and the parameters of the ensemble learning model are uploaded to the central server after each round of training is completed;

[0021] The central server is configured to aggregate the parameters uploaded by all local models according to the FedAvg strategy, generate the parameters of the global model, and train new data by using the parameters of the global model to obtain a trained global model, and the central server distributes the parameters of the trained global model to the K local models, and the K local models perform parameter updating and training until the local model converges, and the converged local model performs network intrusion detection by using the parameters of the global model and outputs the network intrusion detection classification result.

[0022] The data preprocessing module comprises:

[0023] The processing submodule is configured to sequentially perform data cleaning, one-hot encoding and Z-score processing on the original data set to obtain normalized data.

[0024] The data balancing and noise reduction submodule is configured to create new samples and eliminate noise samples for the normalized data by using an SMOTE-ENN algorithm to obtain high-quality sample data.

[0025] The redundancy removal submodule is configured to calculate the mRMR value of the high-quality sample data in the feature space by using an mRMR algorithm, and delete redundant data according to the mRMR value, to finally obtain processed data, wherein mRMR = maxD-minR, maxD represents the maximum correlation between the feature and the target variable, minR represents the minimum redundancy criterion between the features, and the calculation formulas of maxD and minR are as follows:

[0026]

[0027]

[0028] wherein S is a feature set, fi is a feature, c is a target class, and I is mutual information.

[0029] The application further provides a network intrusion detection system based on federated learning, comprising a processor and a memory connected with the processor, wherein the memory stores instructions executable by the processor, and the instructions are executed by the processor to implement the steps of the network intrusion detection method based on federated learning.

[0030] The application provides a network intrusion detection method based on federated learning, which is light and can effectively detect various attacks. The method combines federated learning method on the basis of ensemble learning, improves the robustness, generalization ability and accuracy of the model, protects user privacy, and thus better meets the needs of practical applications. Meanwhile, the method introduces an improved feature engineering method, eliminates data redundancy, balances the data set, reduces data noise, improves the quality of the data set, and achieves the effects of improving the algorithm speed and the accuracy of the intrusion detection model, thereby ensuring the reliability and security of the network system. Compared with the prior art, the application has the following beneficial effects:

[0031] (1) According to the characteristics of network intrusion detection data, including uneven distribution of data, high dimensionality of data and complexity of model, etc., the integrated learning is used as a local classification model, and the decision tree (DT), random forest (RF), extremely randomized tree (ET) and eXtreme Gradient Boosting (XGBoost) algorithm are selected as the base selector of the integrated learning model, the application of these algorithms reduces the bias and variance of a single model, can improve the robustness, generalization ability and accuracy of the model, has good performance in network intrusion detection tasks, can provide diversified model prediction results, and is applied to federated learning, which can protect the privacy of data and model;

[0032] (2) The feature engineering is used to optimize the data set before model initialization: the SMOTE-ENN algorithm can create high-quality samples for minority sample classes, alleviate the problem of unbalanced data distribution, and the mRMR algorithm can delete redundant data and select independent high-quality features. The above methods eliminate data redundancy, reduce data noise and improve data set quality, so as to improve the algorithm speed and the accuracy of the intrusion detection model. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 A principle diagram of a network intrusion detection method based on federated learning according to an embodiment of the present application;

[0034] Figure 2 A flowchart of data preprocessing in an embodiment of the present application;

[0035] Figure 3 A schematic diagram of a local model based on integrated learning in an embodiment of the present application;

[0036] Figure 4 A schematic diagram of a global model of federated learning in an embodiment of the present application. DETAILED DESCRIPTION

[0037] The preferred embodiments of the present application will be specifically described below in combination with the accompanying drawings, wherein the drawings constitute a part of the present application, and are used to illustrate the principles of the embodiments of the present application, and are not used to limit the scope of the present application.

[0038] As Figure 1As shown, the embodiment of the application provides a network intrusion detection method based on federated learning, wherein the federated learning processes the model training task by distributing it to multiple participants, and obtains a global model through model aggregation, thereby realizing distributed computing and privacy protection, so that more devices and participants can participate in the intrusion detection task, and the utilization efficiency of computing resources is improved. The method of the application mainly includes three parts: data preprocessing, local model training, and global model aggregation. In the data preprocessing stage, the application of feature engineering method is performed on the original data set such as NUSW-NB15 data set, high-quality data is provided for the model, and then the processed data is divided into K parts and distributed to K local models respectively. In the local model training, a basic local model is defined, that is, a local model, an ensemble learning method is realized in the local model, and the local data is used for training and updating. After each round of training, the participants upload the local model parameters after the ensemble learning to the central server. In the global model aggregation stage, after the central server receives the local model parameters uploaded by the participants, the model parameters are aggregated according to the FedAvg strategy, the global model parameters are obtained and fed back to the participants, and the participants are guided to train and update the local model in the next round.

[0039] Step 1: The original data set is preprocessed by the feature engineering method to obtain processed data, and the processed data is divided into K parts, and then the K parts of data are distributed to K local models respectively.

[0040] In the data preprocessing stage, the network data is processed by the improved feature engineering method and the synthetic minority oversampling technique (SMOTE), which can effectively reduce feature redundancy, alleviate the class imbalance attack detection problem, reduce data noise and improve data quality.

[0041] The process of preprocessing the original data set by the feature engineering method includes the following steps, as shown in Figure 2

[0042] S1-1: The original data set is sequentially subjected to data cleaning, one-hot encoding and Z-score processing to obtain normalized data;

[0043] S1-2: The SMOTE-ENN algorithm is used to create new samples and eliminate noise samples for the normalized data to obtain high-quality sample data;

[0044] ​S1-3: Calculate the value of mRMR of high-quality sample data in the feature space by using the mRMR algorithm, and delete redundant data according to the value of mRMR, and finally obtain processed data, wherein mRMR = maxD-minR, maxD represents the maximum correlation between the feature and the target variable, and minR represents the minimum redundancy standard between the features.

[0045] Specifically, in the data preprocessing stage, the overlapping samples can be processed by using the data cleaning technology. The NUSW-NB15 dataset is used as the original dataset, and there is a text data column in the dataset, and the machine learning cannot directly process the text data, so it is necessary to use the One-Hot Encoding to convert the text column into a binary feature vector. Since the features collected in the network traffic data often have great range differences, which may cause bias to the model training. The embodiment adopts the Z-score method to normalize the features to similar scales, and the performance of the ML model on the normalized dataset is often better. Assuming that x is the original feature value, μ and σ are the mean and standard deviation of the feature value respectively, and each normalized feature value x n is expressed as:

[0046]

[0047] The SMOTE method can be used to create new instances for the minority class to balance the dataset. However, the disadvantage of the SMOTE algorithm is that the generated minority class samples are easy to overlap with the surrounding majority class samples, thereby affecting the efficiency of the classifier. The SMOTE-ENN algorithm is used in the embodiment to delete data overlapping with the majority class samples and some unnecessary data, and finally obtain a balanced data, i.e. high-quality sample data, for training the model. The ENN algorithm completes the downsampling operation by eliminating noise samples, which defines the noise samples as the samples belonging to different classes found by the sample according to the Euclidean distance. Assuming that there are two m-dimensional vectors x = {x1, x2, …, x m}, y = {y1, y2, …, y m}, the Euclidean distance calculation formula is as follows:

[0048]

[0049] The data set after the above processing will encounter high-dimensional challenges in the feature space, which will significantly increase the time complexity of algorithm training and prediction and the susceptibility to overfitting. According to the complex nonlinear relationship in the network traffic feature data and the different patterns exhibited by different types of intrusions on multiple features, the mRMR algorithm effectively captures these nonlinear relationships and quantifies the correlation between features and target variables based on mutual information. By utilizing information entropy, information gain, and mutual information, among other information theory concepts, the mRMR algorithm assesses the information value of features, allowing for the rapid selection of a subset of features that are both informative and unique. The present embodiment utilizes the mRMR algorithm to calculate the mRMR values of high-quality sample data in the feature space and deletes redundant data based on the mRMR values, ultimately obtaining processed data, where the mRMR value is calculated by the difference between the maximum correlation maxD and the minimum redundancy criterion minR:

[0050] mRMR = maxD - minR

[0051] The formulas for calculating maxD and minR are as follows:

[0052]

[0053]

[0054] where S is the feature set, f i is the feature, c is the target class, and I is the mutual information.

[0055] According to the definition of mutual information, when variables X and Y are completely independent in statistics, there is no common information between the two variables. Conversely, the higher the degree of dependence between the two variables, the greater the value of mutual information. The amount of shared information is greater. The formula for calculating mutual information I(x, Y) is as follows:

[0056]

[0057] where p(x) is the probability distribution of variable X, p(u) is the probability distribution of variable Y, and p(x, y) is the joint probability distribution of variables X and Y.

[0058] The feature engineering method is used to optimize the data set before model initialization, and the SMOTE-ENN algorithm can create high-quality samples for minority sample classes, alleviating the problem of data distribution imbalance. The mRMR algorithm can delete redundant data and select independent high-quality features. The above methods eliminate data redundancy, reduce data noise, and improve data set quality, thereby achieving the effect of improving algorithm speed and intrusion detection model accuracy.

[0059] Step 2: Construct each local model with ensemble learning model, and select decision tree algorithm, random forest algorithm, extremely randomized trees algorithm and gradient boosting tree algorithm as the base selector of the ensemble learning model, train and update the ensemble learning model using the processed data, and upload the parameters of the ensemble learning model to the central server after each round of training is completed.

[0060] Ensemble Learning (EL) is a machine learning method that combines multiple different models to improve the accuracy and stability of classification or regression. The main idea of ensemble learning is to combine multiple weak classifiers or weak regressors to form a more powerful ensemble model. In the ensemble model, each member model classifies or regresses the data, and the final result can be integrated by majority voting, weighted average or other rules. Ensemble learning can improve the accuracy of the model, especially for high-dimensional, complex data sets or data sets with noise, and has better robustness and generalization ability. Common ensemble learning algorithms include Random Forest, AdaBoost, Gradient Boosting Machine (GBM) and others.

[0061] In the local model training phase, decision tree (DT), random forest (RF), extremely randomized trees (ET) and eXtreme Gradient Boosting (XGBoost) algorithms are selected as the base selector of the ensemble learning to improve the generalization ability and robustness of the algorithm.

[0062] As Figure 3As shown, after data processing through step 1-1 to step 1-3, the obtained processed data is trained using an ensemble learning model to develop a local intrusion detection model. In this scheme, decision tree (DT), random forest (RF), extreme random tree (ET) and gradient boosting tree (XGBoost) algorithms are selected as the base selector of the ensemble learning model. DT is a common ML algorithm that uses tree structure to fit data and make predictions. DT algorithm has multiple hyperparameters that need to be tuned, including tree depth, minimum sample split, minimum sample leaf, maximum sample node and minimum weight fraction leaf, etc. RF is an ensemble learning model that uses majority voting rule to combine multiple decision tree classifiers, while ET combines a set of random decision trees built on different subsets of the dataset. XGBoost is a gradient-boosting decision tree (GBDT) based algorithm designed to improve speed and performance, and it also has a hyperparameter, learning rate, which determines the convergence speed.

[0063] This embodiment selects decision tree (DT), random forest (RF), extreme random tree (ET) and gradient boosting tree (XGBoost) algorithms as the base selector of the ensemble learning according to the characteristics of network intrusion detection data, including uneven distribution of data, high dimensionality of data and complexity of model, etc. These algorithms reduce the bias and variance of single model, improve the robustness, generalization ability and accuracy of the model, and have good performance in network intrusion detection tasks, which can provide diversified model prediction results. At the same time, it is applied to federated learning to protect the privacy of data and model.

[0064] Step 3: The central server aggregates the parameters uploaded by all local models according to the FedAvg strategy, generates the parameters of the global model, and uses the parameters of the global model to train new data to obtain the trained global model. The central server distributes the parameters of the trained global model to the K local models, and the K local models update and train the parameters until the local models converge. The converged local models use the parameters of the global model for network intrusion detection and output network intrusion detection classification results.

[0065] As Figure 4 shown, in the global model aggregation stage, the central server aggregates the parameters of the local models and distributes the global model parameters to the participants. The participants update the model parameters according to the feedback of the global model parameters. This process can reduce the training pressure of the local model and protect the privacy of the user.

[0066] The federated learning has obvious advantages in processing a large amount of high-dimensional data. After receiving the uploaded parameters of the local models, the central server performs parameter aggregation and global model training. Specifically, the central server performs weighted average on the uploaded parameters of all the local models to generate the parameters of the global model. Then, the central server uses the parameters of the global model to train new data to obtain the final global model. The new data used for global model training refers to new samples in the local data collected by each local model after model training. These new samples are generated during the local model training and can be user data, sensor data or other types of data collected by the participants.

[0067] Finally, the central server distributes the parameters of the trained global model to the local models and updates the local models until the local models converge. In this way, the local models can use the parameters of the global model for network intrusion detection and output network intrusion detection classification results.

[0068] In the above process, let N k be the size of the local data set of the kth participant, θ k be the local model parameter of the kth participant, ω k be the weight of the kth participant, then the participant weight ω k and the calculation formula of the global model parameter θ are as follows:

[0069]

[0070]

[0071] The present application provides a lightweight network intrusion detection method based on federated learning, which can effectively detect various attacks. The method combines federated learning method on the basis of ensemble learning, improves the robustness, generalization ability and accuracy of the model, protects user privacy, and thus better meets the needs of practical application. At the same time, the method introduces an improved feature engineering method, which eliminates data redundancy, balances the data set, reduces data noise, improves the quality of the data set, and achieves the effect of improving the algorithm speed and the accuracy of the intrusion detection model, ensuring the reliability and security of the network system.

[0072] The present application also provides a network intrusion detection device based on federated learning, which specifically comprises:

[0073] A data preprocessing module is configured to perform data preprocessing on the original data set by using a feature engineering method to obtain processed data, divide the processed data into K parts, and then distribute the data of the K parts to K local models respectively.

[0074] The local module comprises a local model constructed by using an ensemble learning model, and a decision tree algorithm, a random forest algorithm, an extreme random tree algorithm and a gradient boosting tree algorithm are selected as a base selector of the ensemble learning model, the ensemble learning model is trained and updated by using the processed data, and parameters of the ensemble learning model are uploaded to the central server after each round of training is completed;

[0075] The central server is configured to aggregate parameters of all local models uploaded according to a FedAvg strategy, generate parameters of a global model, train new data by using the parameters of the global model, obtain a trained global model, and distribute the parameters of the trained global model to the K local models, so that the K local models are updated and trained until the local models converge, the converged local models perform network intrusion detection by using the parameters of the global model, and network intrusion detection classification results are output.

[0076] The data preprocessing module comprises:

[0077] The processing submodule is configured to sequentially perform data cleaning, one-hot encoding and Z-score processing on the original data set to obtain normalized data.

[0078] The data balancing and noise reduction submodule is configured to create new samples and eliminate noise samples for the normalized data by using an SMOTE-ENN algorithm to obtain high-quality sample data.

[0079] The redundancy removal submodule is configured to calculate an mRMR value of the high-quality sample data in a feature space by using an mRMR algorithm, and delete redundant data according to the mRMR value, to finally obtain processed data, wherein mRMR = maxD-minR, maxD represents the maximum correlation between a feature and a target variable, minR represents the minimum redundancy standard between features, and the calculation formulas of maxD and minR are as follows:

[0080]

[0081]

[0082] wherein S is a feature set, f i is a feature, c is a target class, and I is mutual information.

[0083] Further, the network intrusion detection device based on federated learning further comprises a test module configured to input a test set into the global model for testing, and a classifier of the global model outputs network intrusion detection classification test results.

[0084] The implementation method of the specific functions of each module in the network intrusion detection device based on federated learning can refer to the implementation method described in the network intrusion detection method based on federated learning described above, which will not be described here.

[0085] The application further provides a network intrusion detection system based on federated learning, which comprises a processor and a memory connected with the processor, and the memory stores instructions executable by the processor, and each step of the network intrusion detection method based on federated learning is implemented when the instructions are executed by the processor. Each step of the network intrusion detection method based on federated learning is described above, which will not be described here.

[0086] Each technical feature of the above-described embodiments can be combined arbitrarily, and in order to make the description simple, each technical feature in the above-described embodiments is not described in all possible combinations, however, as long as the combination of the technical features does not exist, it should be considered as the scope of the description.

[0087] The above-described embodiments only express several implementation manners of the application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the application, a number of modifications and improvements can be made, which are all within the protection scope of the application. Therefore, the protection scope of the patent of the application should be subject to the appended claims.

Claims

1. A network intrusion detection method based on federated learning, characterized in that, Includes the following steps: Step 1: Use feature engineering to preprocess the original dataset to obtain processed data, divide the processed data into K parts, and then distribute the data of the K parts to K local models for use; The data preprocessing of the original dataset using feature engineering methods includes the following steps: S1-1: Perform data cleaning, one-hot encoding, and Z-score processing on the original dataset in sequence to obtain normalized data; S1-2: Use the SMOTE-ENN algorithm to create new samples and eliminate noise samples for the normalized data to obtain high-quality sample data; S1-3: Calculate the mRMR value of high-quality sample data in the feature space using the mRMR algorithm, and delete redundant data based on the mRMR value to finally obtain the processed data, where mRMR = maxD - minR, maxD represents the maximum correlation between the feature and the target variable, and minR represents the minimum redundancy standard between features. Step 2: Construct the local model using the ensemble learning model, and select decision tree algorithm, random forest algorithm, extreme random tree algorithm and gradient boosting tree algorithm as the base selector of the ensemble learning model. Use the processed data to train and update the ensemble learning model, and upload the ensemble learning model parameters to the central server after each round of training. Step 3: The central server aggregates the parameters uploaded by all local models according to the FedAvg policy to generate the parameters of the global model. The global model parameters are then used to train the new data to obtain the trained global model. The central server distributes the trained global model parameters to K local models. The K local models update their parameters and train until the local models converge. The converged local models use the global model parameters to perform network intrusion detection and output the network intrusion detection classification results.

2. The network intrusion detection method based on federated learning according to claim 1, characterized in that, When using the SMOTE-ENN algorithm to eliminate noisy samples, a noisy sample is defined as a sample belonging to a different category among its nearest neighbors found by Euclidean distance.

3. A network intrusion detection method based on federated learning according to claim 1 or 2, characterized in that, The formulas for calculating maxD and minR are as follows: Where S is the feature set, f i is the feature, c is the target category, and I is the mutual information.

4. A network intrusion detection method based on federated learning according to claim 1 or 2, characterized in that, The central server performs a weighted average of the corresponding parameters uploaded by all local models to generate the parameters of the global model.

5. A network intrusion detection method based on federated learning according to claim 1 or 2, characterized in that, The following steps are included after step 3: Step 4: Input the test set into the global model for testing. The classifier of the global model outputs the network intrusion detection classification test results.

6. A network intrusion detection method based on federated learning according to claim 1 or 2, characterized in that, The original dataset used is the NUSW-NB15 dataset.

7. A network intrusion detection device based on federated learning, characterized in that, include: The data preprocessing module is used to preprocess the original dataset using feature engineering methods to obtain processed data, and then divides the processed data into K parts, and distributes the data of the K parts to K local models for use. The local module includes a local model built with an ensemble learning model, and selects decision tree, random forest, extreme random tree and gradient boosting tree algorithms as base selectors for the ensemble learning model. It trains and updates the ensemble learning model with processed data, and uploads the ensemble learning model parameters to the central server after each round of training. The central server is used to aggregate the parameters uploaded by all local models according to the FedAvg policy, generate the parameters of the global model, and use the parameters of the global model to train new data to obtain a trained global model. It is also used to distribute the parameters of the trained global model to K local models, and the K local models update their parameters and train until the local models converge. The converged local models use the parameters of the global model to perform network intrusion detection and output the network intrusion detection classification results. The data preprocessing module includes: The processing submodule is used to perform data cleaning, one-hot encoding, and Z-score processing on the original dataset in sequence to obtain normalized data. The data balancing and noise reduction submodule is used to create new samples and eliminate noise samples for the normalized data using the SMOTE-ENN algorithm, so as to obtain high-quality sample data. The redundancy removal submodule is used to calculate the mRMR value of high-quality sample data in the feature space using the mRMR algorithm, and remove redundant data based on the mRMR value to obtain the processed data. Here, mRMR = maxD - minR, where maxD represents the maximum correlation between the feature and the target variable, and minR represents the minimum redundancy criterion between features. The formulas for calculating maxD and minR are as follows: Where S is the feature set, f i is the feature, c is the target category, and I is the mutual information.

8. A network intrusion detection device based on federated learning according to claim 7, characterized in that, When the data balancing and noise reduction submodule uses the SMOTE-ENN algorithm to eliminate noisy samples, it defines noisy samples as samples belonging to different categories among the nearest neighbor samples found by the sample according to Euclidean distance.

9. A network intrusion detection device based on federated learning according to claim 7 or 8, characterized in that, It also includes a testing module, which is used to input the test set into the global model for testing, and the classifier of the global model outputs the network intrusion detection classification test results.

10. A network intrusion detection system based on federated learning, characterized in that, The method includes a processor and a memory communicatively connected to the processor. The memory stores instructions executable by the processor, which, when executed by the processor, implement the steps of a network intrusion detection method based on federated learning as described in any one of claims 1 to 6.

Images