Abnormal data identification method and device in computing power network based on federated Bayesian learning

Abstract

The present invention discloses a method and device for identifying abnormal data in a computing power network based on federated Bayesian learning. Under the computing power network architecture, a decentralized federated learning framework is constructed based on a Bayesian neural network, and each computing power node in the framework has multiple computing power attributes; the computing power node with rich data volume and strong computing power is selected as the starting training node for the first training, and after the training is completed, the intrinsic interpretability is used to analyze the features with the greatest impact on the input layer. According to the evaluation of the computing power attributes, the next computing power node to participate in the training is selected, and the key features are passed to the changed computing power node to adjust its prior distribution accordingly, and then training is carried out. Repeat the operation until the model converges and the performance is stable. The present invention not only utilizes the scheduling of computing power nodes in the computing power network to improve resource utilization, but also ensures the privacy of data. In addition, the present invention also gives full play to the anti-fitting and interpretability of the Bayesian neural network to ensure the accuracy of deep learning.

Description

Technical Field

[0001] The present invention relates to the fields of computing power networks and Bayesian federation, and in particular to a method and device for identifying abnormal data in a computing power network based on federated Bayesian learning. Background Art

[0002] In the data-driven technology era, deep learning has become a key technology to promote the development of monitoring systems. It has shown great potential and application value in many fields. With the popularization of Internet of Things (IoT) technology, monitoring equipment can collect and exchange data in real time through the network, which not only improves the monitoring efficiency, but also makes the training and application of deep learning models more complicated. Deep learning technology must be able to efficiently process large amounts of data and accurately identify various patterns to prevent potential risks and ensure the continuous operation of the system. However, the complexity of the monitoring environment and the huge amount of data flow pose significant challenges to the design and training of the model, especially when the data scale is limited, the overfitting problem is particularly prominent.

[0003] To improve the generalization of models and reduce overfitting, researchers have developed a variety of strategies. Data augmentation enriches the training set by creating data variations, while regularization techniques prevent the model from overfitting the training data by limiting model complexity. Dropout is an effective regularization method that randomly "drops" neurons during training to enhance the robustness of the model. Early stopping rules monitor the performance on the validation set to end training early to avoid overfitting. Model ensembles improve the overall generalization performance by combining the predictions of multiple models.

[0004] Federated learning (FL), as an innovative machine learning paradigm, allows multiple participants to collaborate on training models without sharing original data, which not only protects data privacy but also adapts to the diversity of data distribution. It is especially suitable for scenarios with limited data size or strict requirements on data privacy. Computing network, as a new concept of network architecture, aims to improve the utilization efficiency of computing resources and optimize user experience by deeply integrating computing and network resources. The research and practice of computing network have shown that it has significant potential to solve the shortcomings of edge computing resource limitations and computing task allocation and scheduling, opening up new ways for the training and deployment of deep learning models.

[0005] Although deep learning technology has made significant progress in the field of anomaly detection, existing solutions still have limitations in handling unknown data and anti-fitting. These models tend to over-rely on known normal data patterns during the training phase, resulting in limited generalization capabilities and difficulty in making accurate judgments when encountering unknown anomaly types. This limitation is particularly prominent in practical applications because real-world data often contains a variety of anomalies that have not been learned by the model. In addition, existing anomaly detection models may exhibit unstable behavior when faced with small changes in data distribution, which limits their applicability in dynamic environments.

[0006] At present, neural learning models based on Bayesian neural networks have been widely studied and have proven their effectiveness in improving detection accuracy. Despite this, existing methods often ignore the optimal use of computing resources during actual deployment, resulting in serious waste of resources, especially after the introduction of probability distribution, Bayesian neural networks require a lot of calculations, so their demand for computing resources is much higher than other ordinary neural networks. In addition, limited by the size of the data set, the training effect of the neural network is not ideal, and there are obvious defects in identifying unknown abnormal traffic. Existing centralized deep learning methods require centralized collection of network traffic data from different institutions, which not only increases the risk of data leakage, but also raises concerns about privacy protection. Although these problems can be partially solved by adjusting the model structure or generating synthetic data sets, the implementation of these methods in actual network environments is still complex and challenging. Although centralized federated learning methods can alleviate the problem of insufficient data, they need to frequently upload parameters to the central server during training, which also poses the risk of privacy leakage. Decentralized federated learning provides a solution that can both solve the problem of insufficient data sets and protect data privacy. Summary of the invention

[0007] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a method and device for identifying abnormal data in a computing power network based on federated Bayesian learning.

[0008] The technical solution specifically adopted by the present invention is as follows: a method for identifying abnormal data in a computing power network based on federated Bayesian learning, the method comprising the following steps:

[0009] (1) Build a computing network, using independent user terminals holding data sets as computing nodes to participate in federated learning;

[0010] (2) Determine the starting training computing node based on the amount of data and computing power. After the computing node completes local training, use the Bayesian neural network to analyze and identify the feature channel and its variance that have the greatest impact on the input layer of the Bayesian neural network; evaluate the computing power and network conditions to select the next computing node to participate in the training, and pass the feature channel information and variance data to the computing node;

[0011] (3) The computing node participating in the training adjusts the variance of the corresponding channel of the local prior distribution according to the received feature channel information and variance data, and then performs local learning training and transmits the feature channel information and variance data to the next computing node participating in the training according to the method of step (2);

[0012] (4) Repeat the iterative process of (3) until the local loss function value on the computing power node converges, send the Bayesian model parameters to all computing power nodes, obtain the final trained neural network model, input real-time data, and determine whether the data is abnormal based on the data type predicted by the model.

[0013] Furthermore, each computing power node has computing power capacity, privacy-preserving data volume, and network status attributes.

[0014] Furthermore, the computing power node processes and labels the local data set, inputs it into the Bayesian neural network for training, and outputs the data type.

[0015] Furthermore, in step (3), the nodes participating in training in the computing network are scheduled in real time based on computing power and network conditions, with network conditions being the first consideration and computing power being the second.

[0016] Furthermore, the computing nodes as user terminals all store data locally. The computing nodes use the locally stored data to perform local Bayesian neural network training locally. After completing the local training, the trained distribution parameters are obtained. , using the inherent interpretability of Bayesian neural networks to analyze and identify the feature channels and their variances that have the greatest impact on the input layer .

[0017] Furthermore, computing nodes hold privacy-preserving data. When participating in the same federated learning task, each computing node must ensure that it belongs to the same industry category and uses the same type of data set for model training.

[0018] Furthermore, the data stored locally in each computing node is composed of fields formed by the data characteristics of the data packet. The specific steps of the data processing and type labeling are as follows:

[0019] (1) Filter the data stored locally on the computing nodes and select the features that need to be trained;

[0020] (2) Normalizing the values ​​of each attribute field in the data processed in step (1);

[0021] (3) Convert the type labels in the data processed in step (2) into one-hot encodings, corresponding to normal data and all abnormal types respectively;

[0022] (4) The data processed in step (3) is divided into a training set and a test set. The training set participates in federated learning training, and the test set is used to test whether the final model is suitable for local data.

[0023] Furthermore, after receiving the trained model parameters, each computing node updates the local Bayesian neural network model; the computing node inputs the prepared test data into the updated model to check whether it meets the detection requirements of the local data. If it meets the requirements, the real-time data is input into the updated model to detect whether there are any abnormalities in the data through the model's predicted output.

[0024] Furthermore, when any computing power node detects that the accuracy of the local Bayesian neural network model is lower than the preset performance threshold, or identifies a new data type, an update mechanism will be triggered to notify all participating computing power nodes to restart a round of federated learning process to update and optimize the Bayesian neural network model.

[0025] On the other hand, the present invention also provides a device for identifying abnormal data in a computing power network based on federated Bayesian learning, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method for identifying abnormal data in a computing power network based on federated Bayesian learning.

[0026] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0027] The present invention proposes a federated Bayesian learning framework and method in a computing power network, which ensures detection accuracy while protecting data privacy, can accurately predict unknown data, and can maximize the use of computing power resources to increase resource utilization. In the framework of Bayesian federation in computing power networks, the present invention combines the characteristics of deep learning data, and proposes a Bayesian federated learning framework for deep learning and related data processing, parameter transfer and other algorithms. The invention selects the Bayesian neural network model as the characteristic of deep learning in federated learning, and utilizes the interpretability, anti-fitting and correct prediction of unknown data of the Bayesian neural network to meet the requirements of deep learning in real scenarios. The federated Bayesian learning framework and method in the computing power network proposed by the present invention prove the feasibility of deep learning of shared data sets under the premise of protecting data privacy.

[0028] This paper proposes a federated Bayesian learning framework and method in a computing network, aiming to achieve the protection of data privacy while ensuring the accuracy of detection and accurately predicting unknown data. Based on the Bayesian federated learning framework, this paper innovatively proposes a Bayesian federated learning framework and related algorithms for deep learning, including data processing and parameter transfer mechanisms, targeting the characteristics of deep learning data.

[0029] The present invention selects the Bayesian neural network model as the core of federated learning, making full use of the interpretability, anti-fitting, and correct prediction capabilities of the Bayesian neural network for unknown data, which fully meet the needs of deep learning in real-world scenarios. These advantages of the Bayesian neural network enable the method of the present invention to provide higher accuracy and reliability when processing abnormal traffic in complex network environments.

[0030] In addition, the federated Bayesian learning framework and method in the computing network of the present invention has been proven through practical application that deep learning of shared data sets is not only feasible but also can effectively improve detection performance under the premise of protecting data privacy. This method provides a new perspective in the field of deep learning and is expected to promote the development and application of related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0032] Figure 1 This is a schematic diagram of the training framework.

[0033] Figure 2 Schematic diagram of data processing.

[0034] Figure 3 It is a flow chart of the present invention.

[0035] Figure 4 A structural diagram of an abnormal data identification device in a computing power network based on federated Bayesian learning provided by the present invention. DETAILED DESCRIPTION

[0036] In order to make the above-mentioned purpose, features and advantages of the present invention more obvious and easy to understand, the specific implementation mode of the present invention is described in detail below in conjunction with the accompanying drawings. In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention can be implemented in many other ways different from those described herein, and those skilled in the art can make similar improvements without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below. The technical features in each embodiment of the present invention can be combined accordingly without conflicting with each other.

[0037] The present invention combines the basic characteristics of abnormal data with the basic method of federated Bayesian to pre-process the data, and then applies it to the deep learning model training of the data, thereby ensuring the accuracy of the data while protecting the privacy of the data.

[0038] The core of the present invention is to propose a framework including several computing nodes participating in federated learning. The computing nodes as clients all store the data that needs to be trained. Among them, client max represents the computing nodes with abundant data and sufficient computing resources, and Represents the distribution parameters obtained after training each computing power node, where Represents the computing power node , Represents the round of federated learning . Represents the analyzed important channels of the input layer and their corresponding variances. Only the inherent interpretability of the Bayesian neural network is used after training to analyze and identify the features that have the greatest impact on the input layer, thereby ensuring that the data can be retained locally in each computing power node, and the collaborative training of multiple data sets can be realized. Based on this framework, the present invention proposes a data preprocessing method suitable for a federated Bayesian learning framework in a computing power network, which mainly includes data normalization, encoding of label data, and data set division. The local learning process of the computing power node is to adjust the variance of the corresponding channel of the local prior distribution according to the received channel and variance information, and then perform local learning training, complete the specified number of iterations, and use the interpretability of the Bayesian neural network for in-depth analysis again. Based on the analysis results and computing power attributes, the next training node is selected, and the updated channel information and variance data are passed out. Repeat the above operation until the convergence requirements are met. Finally, the computing power node that completes the training sends the model parameters to each computing power node participating in the federated learning, and each computing power node performs deep learning according to the model.

[0039] The federated Bayesian learning framework and method in the computing power network realizes the application of Bayesian neural network technology in the computing power network. Compared with traditional neural networks, Bayesian neural networks introduce the concept of probability distribution in model parameters, and regard each parameter as a probability distribution, which significantly increases the complexity of calculation. This design makes Bayesian neural networks have higher requirements on processing power. During the training stage, the computing power network framework of the present invention performs real-time scheduling through computing power attributes, optimizes the allocation of computing power resources, and maximizes resource utilization. In addition, the framework also ensures the performance and accuracy of Bayesian neural networks when performing complex probability inference tasks through efficient computing power allocation strategies.

[0040] The following is a detailed description of a specific implementation of a method for identifying abnormal data in a computing network based on federated Bayesian learning in a preferred embodiment of the present invention. The specific steps of the detection method are as follows:

[0041] (1) Under the computing power network architecture, a decentralized federated learning framework is constructed based on the Bayesian neural network, in which each computing power node holding a data set participates as an independent client, and each computing power node has attributes such as computing power capacity, data ownership, and network status.

[0042] like Figure 1 As shown, the present invention shows a schematic diagram of a federated Bayesian framework. The framework is composed of multiple computing nodes as clients, and these computing nodes can be independent entities with data sets, such as industrial production bases or other specific institutions. In this framework, the computing nodes are trained to analyze the feature channels and their variances that have the greatest impact on the input layer, while the model architecture itself remains unchanged, and only the channels and corresponding variance information need to be updated. To achieve this process, each computing node is pre-configured with a Bayesian neural network model. In general, each computing node automatically collects and preprocesses local data, and then iteratively trains the Bayesian neural network model. After the computing node completes a round of iterations locally, it uses the inherent interpretability of the Bayesian neural network to analyze and identify the feature channels and their variances that have the greatest impact on the input layer. Send it to the next computing node participating in the training. The next computing node adjusts the variance of the corresponding channel of the local prior distribution based on the received channel and variance information, and starts a new round of local training, thereby ensuring that the data is retained locally in each computing node and realizing the collaborative training of multiple data sets. Based on this framework, the data of all institutions participating in federated learning are stored locally, and the input layer channel information after model training is shared among computing nodes. In addition, necessary preprocessing can be performed on the training data to meet the specific needs of model training. This design ensures that data control is retained in the hands of each participating computing node, effectively protecting the privacy of network traffic data.

[0043] It is worth noting that computing nodes can choose to continue to participate in training or exit the federated learning process at any time. Although there is no upper limit on the number of computing nodes participating in federated learning, too many computing nodes may lead to longer training cycles and slower convergence. This may be due to the increase in the size of the dataset and the resulting increase in communication costs.

[0044] It should be noted that the computing power nodes of the client of federated learning in the present invention are a general term. The clients participating in federated learning can be any computing power nodes that need to perform deep learning, including but not limited to various industrial production bases, various network operators, various financial institutions, and various medical institutions. These computing power nodes all hold sensitive data, which cannot be directly shared for privacy protection and data security considerations. When participating in the same federated learning task, each computing power node must ensure that it belongs to the same industry category and uses the same type of data set for model training to ensure the consistency of the training process and the reliability of the results.

[0045] (2) Each computing node participating in federated learning performs necessary data processing and type annotation on the local data set to ensure that the data meets the input specifications of the Bayesian neural network. In this framework, the input of the Bayesian neural network is data features, and the output is data type;

[0046] The classification of data is to divide the data into normal data and other abnormal data, and the abnormal types for different types of data are different. In the network traffic anomaly detection, abnormal data types such as NMRI, CMRI, MSCI, MPCI, MFCI, DoS, and Reco are included. Therefore, in an embodiment of the present invention, the output type classification of the corresponding Bayesian neural network model includes normal data and abnormal data, and the types of abnormal data further subdivided include NMRI, CMRI, MSCI, MPCI, MFCI, DoS, and Reco. According to different actual situations, the abnormal data type can be further expanded, and there is no restriction on this.

[0047] The specific processing method of the data stored locally in each computing node needs to be designed according to the input requirements of the model. Figure 2 As shown, in the embodiment of the present invention, the data stored locally in each computing node is composed of various attribute fields of the data packet, so the specific steps of data processing and attack type labeling in (2) above are as follows:

[0048] (2.1) Filter the data stored locally on the computing nodes and select the features that need to be trained.

[0049] (2.2) Normalize the values ​​of each attribute field in the data processed in (2.1);

[0050] (2.3) The abnormal type labels in the data processed by (2.2) are converted into one-hot encoding, corresponding to normal traffic data and all abnormal types respectively.

[0051] (2.4) The data processed by (2.3) is divided into a training set and a test set. The training set is used to participate in federated learning training, and the test set is used to test whether the final model is suitable for local data.

[0052] Preferably, in (2.2), the normalization used is mean-variance normalization.

[0053] (3) In the first training, computing nodes with abundant data and strong computing power will be selected as the starting training nodes. The computing nodes will perform federated learning training based on local data. After completing local training, the inherent interpretability of Bayesian neural networks will be used to analyze and identify the feature channels and their variances that have the greatest impact on the input layer. Based on the computing power attribute evaluation, the next computing power node to participate in the training will be selected, and the key channel information and variance data will be passed to the node.

[0054] In the federated Bayesian learning framework of the present invention, the information exchanged between the computing power nodes is the core posterior distribution, which captures the reasoning results of each node based on its local data set. In addition, since the nodes participating in the training for the first time do not rely on the posterior distribution input of other nodes, they are relatively less affected by network fluctuations. In view of this, in order to minimize the adverse effects of small-scale data sets on the entire federal system in the early stages of training, the present invention proposes to increase the proportion of privacy-protected data and computing power in node selection evaluation when evaluating computing power node selection in the initial stage of training, and give priority to those nodes with rich computing power resources and large data volumes. Such a strategy is intended to provide more robust guidance for the training process of federated Bayesian learning and ensure the reliability and effectiveness of the training results.

[0055] After the first round of training, the information transmission between nodes depends on the exchange of posterior distributions, and the amount of data of its parameters is relatively large, which places higher requirements on network bandwidth and transmission efficiency. Therefore, when determining the computing nodes to participate in the subsequent training after the first training, the network transmission efficiency and the computing power of the nodes must be considered comprehensively. In this context, we adjusted the node selection strategy to give priority to nodes with excellent network conditions and abundant computing resources. This strategy change not only optimizes the transmission efficiency of the posterior distribution parameters, but also helps to improve the overall performance of federated Bayesian learning in the computing network framework by making full use of the computing resources of each node. When selecting computing nodes, the performance of network conditions accounts for the highest proportion of the entire evaluation index, followed by computing power. Selecting nodes with good network connection conditions and abundant computing resources will provide strong support for the efficient execution and learning of the federated Bayesian learning algorithm in a distributed network environment.

[0056] The Bayesian neural network used in the present invention is a local deep learning model of the computing power node. The Bayesian neural network adds the Bayesian reasoning method on the basis of the traditional neural network. BNNs not only learn the value of each parameter, but also learn the uncertainty of the parameter.

[0057] Bayes' theorem can be used to infer the weight distribution by using existing data as the initial observation condition, that is, , before training, the dataset and weights are combined into a joint distribution , this joint distribution is obtained through the prior distribution Defined, the posterior distribution is calculated by Bayes' theorem . As shown in the formula:

[0058] (1)

[0059] (2)

[0060] The denominator in formula (2) represents the marginal likelihood probability, which is a key inference parameter in the Bayesian neural network. In the federated learning process of deep learning, it is transferred between computing nodes and trained together.

[0061] In an embodiment of the present invention, the training of the Bayesian neural network model by the computing power node is similar to the conventional training method, that is, after the computing power node prepares the Bayesian neural network model, it collects data stored locally at different times and processes it to meet the input requirements of the model. Each network traffic data and its annotated label constitute a training sample; then each training sample is input into the Bayesian neural network model, and the prior distribution parameters of each Bayesian neural network are affected by the parameters transmitted by the previous computing power node. The loss of the predicted label and the true value label of each training sample is calculated, and the loss mean of all training samples is used as the loss function value. According to the loss function value, the model parameters of the Bayesian neural network model are optimized by the gradient descent algorithm to minimize the prediction error and improve the generalization ability of the model; finally, after completing the local training, the intrinsic interpretability of the Bayesian neural network is used to analyze and identify the feature channels and their variances that have the greatest impact on the input layer. According to the computing power attribute evaluation, the next computing power node participating in the training is selected, and the key channel information and variance data are passed to the node for its subsequent training process.

[0062] Specifically, the computing node adjusts the variance of the corresponding channel of the local prior distribution according to the received channel and variance information, and then performs local learning training. The input data set of each computing node represents the data at a certain time t, as shown in the following formula (3). Each of its elements represents the characteristics of each data packet field, and there are a total of indivual.

[0063] (3)

[0064] The input label of each computing power node is It represents the standard value of the corresponding data type, including normal data. As shown in formula (4). Each element of it represents the type of data label, with a total of kind.

[0065] (4)

[0066] However, the marginal likelihood probability is very complicated to calculate, which leads to a surge in the amount of calculation of the posterior distribution. In order to solve this problem, we introduce variational Bayes to approximate the posterior distribution. Since the posterior distribution depends on the marginal likelihood and the calculation of the marginal likelihood is very difficult, it is necessary to derive it through an approximate method. By starting from the marginal likelihood, we can introduce the variational distribution and use the Jensen inequality to get the evidence lower bound (ELBO).

[0067] (5)

[0068] (6)

[0069] In formula (6) For the variational distribution, using Jensen’s inequality, we can get:

[0070] (7)

[0071] The right-hand side is the lower bound of the evidence we are looking for.

[0072] (8)

[0073] In the above formula, represents the variational distribution, represents the true distribution of the data. The corresponding value is the logarithm of the marginal likelihood probability. Among them, because it is impossible to be exactly the same as the posterior distribution, the KL divergence It must always be greater than or equal to 0, and the calculation is very complicated. But we want to minimize the KL divergence to increase the similarity with the posterior distribution, so we can maximize its expected value, which is equivalent to minimizing the KL divergence, and transform the process of minimizing the KL divergence into the process of maximizing elbo.

[0074] In deep learning, the true value of the elbo loss function we usually use is -ELBO, that is, the obtained loss function can be called the evidence lower bound and can be expressed as formula (9):

[0075] (9)

[0076] When performing an interpretable analysis channel, first, analyze the output layer, find the important neurons in each output layer, that is, the category of data, and find the input channel at its corresponding position. Find the output channel corresponding to the previous layer according to the input channel, and repeat the above operation in the corresponding output channel until the input layer. It is worth noting that since the layers in the neural network are expanded during analysis, when processing the convolution layer, the input channel analyzed is not its real input channel, but its flattened input channel. Therefore, we need to divide the convolution kernel to get its real input channel, so as to find its corresponding output channel in the previous layer. When the important input channel of the input layer is analyzed, the corresponding features of the corresponding timely data can reduce the weight of the corresponding channel to improve the model's trust in the feature, so that it plays a more important role in subsequent training.

[0077] (4) The computing node uses the labeled data set to adjust the variance of the corresponding channel of the local prior distribution according to the received channel and variance information, and then conducts local learning training. After completing the specified number of iterations, it uses the interpretability of the Bayesian neural network for in-depth analysis. Based on the analysis results and computing power attributes, the next training node is selected and the updated channel information and variance data are passed on.

[0078] In the implementation example of the present invention, each computing node modifies the local prior channel variance accordingly after receiving the sent channel information to perform local training iteration. After the iteration is completed, the key channel information and variance data analyzed after training are sent to the next computing node for training.

[0079] (5) Repeat the iterative process in (4) to form a complete decentralized federated learning framework. Train until the loss function value on the computing power node has converged, and send the model parameters to all computing power nodes as the final neural network model.

[0080] (6) The computing node that has completed the final training distributes the deep learning model parameters to each computing node. Each computing node updates the local deep learning model based on the received model parameters. Subsequently, the computing node inputs the local data into the model and implements local deep learning through the classification results output by the model to identify abnormal data types. If it meets the local detection requirements, the model can be placed in real-time data for detection.

[0081] Therefore, in the specific implementation process, when the function value on the computing power node converges and completes the model training, the final Bayesian neural network parameters will be sent to each computing power node participating in the training; each computing power node uses these parameters to update its local Bayesian neural network model and conduct deep learning. The computing power node inputs local data into the model and determines whether there is abnormal data based on the output of the model.

[0082] like Figure 3 As shown in the figure, the basic process of the federated Bayesian learning framework and method in the computing power network is demonstrated. All computing power nodes can freely choose to join or exit federated learning. The participating computing power nodes constitute the federated learning framework and first perform local data processing. The first round of training starts with the optimal computing power node after evaluation. After the training is completed, the inherent interpretability of the Bayesian neural network is used to analyze and identify the feature channels and their variances that have the greatest impact on the input layer. According to the evaluation of computing power attributes, the next computing power node participating in the training is selected, and the key channel information and variance data are passed to the node. Subsequent computing power nodes adjust the variance of the corresponding channel of the local prior distribution based on the received channel and variance information, and start and continue the training process until the model converges on all computing power nodes.

[0083] Finally, when the last computing node to complete training completes model training and the loss function value reaches convergence, the trained model parameters are distributed to all computing nodes. Each computing node updates the local Bayesian neural network model, uses the model to detect data, inputs the remaining local data into the model, detects whether the trained model meets the local data monitoring requirements, and inputs real-time data into the model if it does, and determines whether there is abnormal traffic based on the output of the model. If the computing node finds that the model accuracy has dropped or identifies a new type of anomaly, it will trigger a message to all computing nodes and start a new round of network intrusion federated learning to update the model and maintain the accuracy and timeliness of deep learning.

[0084] Corresponding to the aforementioned embodiment of a method for identifying abnormal data in a computing power network based on federated Bayesian learning, the present invention also provides an embodiment of a device for identifying abnormal data in a computing power network based on federated Bayesian learning.

[0085] See also Figure 4 An embodiment of the present invention provides an abnormal data identification device in a computing power network based on federated Bayesian learning, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement a method for identifying abnormal data in a computing power network based on federated Bayesian learning in the above embodiment.

[0086] An embodiment of an abnormal data identification device in a computing network based on federated Bayesian learning provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From a hardware perspective, if Figure 4 As shown, it is a hardware structure diagram of any device with data processing capability in a computing power network based on federated Bayesian learning provided by the present invention, except Figure 4 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0087] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0088] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0089] An embodiment of the present invention also provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, a method for identifying abnormal data in a computing power network based on federated Bayesian learning in the above embodiment is implemented.

[0090] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0091] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the method for identifying abnormal data in a computing power network based on federated Bayesian learning.

[0092] The above-described embodiment is only a preferred solution of the present invention, but it is not intended to limit the present invention. A person skilled in the relevant technical field may make various changes and modifications without departing from the spirit and scope of the present invention. Therefore, any technical solution obtained by equivalent replacement or equivalent transformation falls within the protection scope of the present invention.

Claims

1. A method for identifying abnormal data in a computing network based on federated Bayesian learning, characterized in that: The method comprises the following steps: (1) Build a computing network, using independent user terminals holding data sets as computing nodes to participate in federated learning; (2) Determine the starting training computing node based on the amount of data and computing power. After the computing node completes local training, use the Bayesian neural network to analyze and identify the feature channel and its variance that have the greatest impact on the input layer of the Bayesian neural network; evaluate the computing power and network conditions to select the next computing node to participate in the training, and pass the feature channel information and variance data to the computing node; (3) The computing node participating in the training adjusts the variance of the corresponding channel of the local prior distribution according to the received feature channel information and variance data, and then performs local learning training and transmits the feature channel information and variance data to the next computing node participating in the training according to the method of step (2); (4) Repeat the iterative process of (3) until the local loss function value on the computing power node converges, send the Bayesian neural network parameters to all computing power nodes, obtain the final trained neural network model, input real-time data, and determine whether the data is abnormal based on the data type predicted by the model.

2. According to claim 1, a method for identifying abnormal data in a computing power network based on federated Bayesian learning is characterized in that: Each computing power node has computing power capacity, privacy-preserving data volume, and network status attributes.

3. According to claim 1, a method for identifying abnormal data in a computing power network based on federated Bayesian learning is characterized in that: The computing power node processes and labels the local data set, inputs the Bayesian neural network for training, and outputs the data type.

4. According to claim 1, a method for identifying abnormal data in a computing power network based on federated Bayesian learning is characterized in that: In step (3), the nodes participating in training in the computing network are scheduled in real time based on computing power and network conditions.

5. According to claim 1, a method for identifying abnormal data in a computing power network based on federated Bayesian learning is characterized in that: The computing nodes as user terminals all store data locally. The computing nodes use the locally stored data to train the local Bayesian neural network. After completing the local training, the trained distribution parameters are obtained. , using the inherent interpretability of Bayesian neural networks to analyze and identify the feature channels and their variances that have the greatest impact on the input layer .

6. According to claim 1, a method for identifying abnormal data in a computing power network based on federated Bayesian learning is characterized in that: Computing nodes hold privacy-protected data. When participating in the same federated learning task, each computing node must ensure that it belongs to the same industry category and uses the same type of data set for model training.

7. According to claim 3, a method for identifying abnormal data in a computing power network based on federated Bayesian learning is characterized in that: The data stored locally in each computing node is composed of fields consisting of data characteristics of data packets. The specific steps of data processing and type annotation are as follows: S1: Filter the data stored locally on the computing nodes and select the features that need to be trained; S2: normalize the values ​​of each attribute field in the data processed by S1; S3: Convert the type labels in the processed data of S2 into one-hot encoding, corresponding to normal data and all abnormal types respectively; S4: Split the processed data in S3 into a training set and a test set. The training set participates in federated learning training, and the test set is used to test whether the final model is suitable for local data.

8. The method for identifying abnormal data in a computing power network based on federated Bayesian learning according to claim 1, characterized in that: After receiving the trained model parameters, each computing node updates the local Bayesian neural network model; the computing node inputs the prepared test data into the updated model to check whether it meets the detection requirements of the local data. If it meets the requirements, the real-time data is input into the updated model to detect whether there are any abnormalities in the data through the model's predicted output.

9. The method for identifying abnormal data in a computing power network based on federated Bayesian learning according to claim 1, characterized in that: When any computing power node detects that the accuracy of the local Bayesian neural network model is lower than the preset performance threshold, or identifies a new data type, an update mechanism will be triggered to notify all participating computing power nodes to restart a round of federated learning process to update and optimize the Bayesian neural network model.

10. A device for identifying abnormal data in a computing network based on federated Bayesian learning, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, it implements a method for identifying abnormal data in a computing power network based on federated Bayesian learning as described in any one of claims 1 to 9.

Images