Cooperative network intrusion detection method based on hierarchical federal mutual learning and block chain

Abstract

The invention discloses a collaborative network intrusion detection method based on hierarchical federal mutual learning and a block chain. A network is divided into a plurality of regions; the intrusion detection model serves as a global model to detect network intrusion; the intrusion detection model is optimized through a federal mutual learning method; in the domain, the organizations are paired in pairs under the assistance of chain codes to carry out deep mutual learning, and cooperatively train and update the model; and among the domains, each regional coordinator further improves the performance of the local model through federal mutual learning (FL). The chain code and the oracle machine ensure the safety of on-chain and off-chain interaction and the credibility of model testing. A token-based hierarchical incentive mechanism is designed to promote domain knowledge sharing and cooperation, and a global sustainable optimization closed loop is realized. The learning framework provides a safe, credible, transparent and extensible ecology for distributed model training. Compared with a reference algorithm, the method shows higher feature learning ability. The introduction of an incentive mechanism further promotes knowledge transmission and model performance improvement.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and specifically is a collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain. Background Art

[0002] With the rapid development and popularization of network technology, new network attack methods emerge in an endless stream. The evolving network threats have brought serious impacts on the information system security of individuals, enterprises and even countries. As an important technical means of network security protection, network intrusion detection systems have received extensive attention and research. Due to its advantages in adaptability and flexibility, deep learning has become the mainstream solution for intrusion detection. Among them, Graph Neural Network (GNN) [1] has shown great potential in complex network traffic detection with its powerful graph structure data representation learning ability. However, these deep learning-based intrusion detection models face a common challenge, that is, they require a large amount of network traffic data for model training, while it is difficult for a single organization or institution to independently obtain sufficient data resources, which restricts the generalization ability of the model and the scalability of the solution.

[0003] Federated Learning (FL) is a distributed machine learning paradigm that allows multiple participants to collaboratively train a shared global model through interaction and aggregation of model parameters without sharing the original data [2]. This model solves problems such as data privacy protection and data silos. Blockchain is a decentralized distributed ledger technology that maintains a reliable chain of transaction records through distributed nodes. It uses blocks as the basic unit, and after all nodes in the network reach a consensus on legal transactions, they are packaged and recorded in the chain in an orderly manner, forming an encrypted, tamper-proof, and traceable distributed data chain.

[0004] Challenging Problems and Related Work:

[0005] Blockchain and FL are important enabling technologies for building large-scale network intrusion detection systems. Blockchain's secure data sharing and access control mechanisms enhance data privacy protection [3]. Blockchain-assisted incentive mechanisms [4] can mobilize the enthusiasm of participants and promote effective collaboration and contribution. Despite many potential advantages, building a scalable and sustainably optimized intrusion detection framework faces many challenging issues:

[0006] (1) Efficient fusion of inter-domain and intra-domain knowledge. In traditional FL, participants only perform weighted aggregation and sharing of model parameters in the later stage of each round of training to optimize global model parameters. However, for some attack types with small sample sizes, the detection capability of the global model is bottlenecked. FedFA[5] uses feature anchors to simultaneously adjust features and calibrate classifiers across clients. This enables client models to be updated in a shared feature space using consistent classifiers during local training. HFL-VNE[6] is a VNE architecture based on horizontal FL. Local servers are deployed in each physical domain, which can effectively aggregate local features and reduce resource fragmentation. At the same time, a deep reinforcement learning model is deployed in each server to dynamically adjust and optimize resource allocation in multi-domain physical networks. Reference [7] proposes a vertical FL system based on cloud wireless access networks. Air computing is used to achieve fast and accurate model aggregation, and the communication lag problem is alleviated through geographical collaborative model aggregation. The above schemes mainly rely on horizontal and vertical FL to average or weight model parameters, which makes it difficult to achieve targeted knowledge learning.

[0007] (2) Trusted data transmission and verification. Efficient access to required off-chain test data is important and necessary for improving intrusion detection performance. If training data and model parameters are directly uploaded to the blockchain, it will bring heavy storage pressure to the entire system. If the training data is stored off-chain, smart contracts cannot directly access it, making it difficult to perform complex operations such as training and testing on the chain. Reference [8] proposes an audit mechanism that stores all supply chain events in the blockchain in the form of hashes. Users of the supply chain system can query the integrity, data source, and traceability of the blockchain through an intermediate server that establishes communication between the blockchain and the supply chain. Gao et al. [9] proposed a cross-chain data migration architecture based on a data migration oracle, which can not only receive external requests, but also open communication channels between two heterogeneous blockchains. However, requests from different regions may differ, which requires the model to adapt to the interaction needs of different levels.

[0008] (3) Incentive design that takes into account both the overall and local aspects. Incentive mechanisms are key to ensuring the sustainability of FL systems. Existing personalized incentive mechanisms are mostly user-centric and have a single-layer flat structure in terms of business logic. Reference

[10] introduces a P-RAN operation and incentive mechanism designed using blockchain. Through smart contracts and P-RAN incentive policies, relays that provide more and higher-quality P-RAN services will receive more rewards. BtRaI

[11] is a medical service incentive mechanism based on blockchain and trusted reputation evaluation. The token-based reward and punishment mechanism encourages honest participation in the blockchain, inhibits potential misconduct, and promotes the improvement of service quality in the healthcare system. Existing work cannot take into account the demands of different levels of participants in the overall and local aspects, and cannot effectively reflect overall fairness. Summary of the invention

[0009] Although the multi-party collaborative intrusion detection method has high flexibility and scalability, it faces bottlenecks in terms of system security, credibility and sustainability.

[0010] In this regard, the present invention proposes a collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain. The network is divided into multiple regions, and the intrusion detection model is used as a global model to detect network intrusion. The intrusion detection model is optimized by a federated mutual learning method, which is based on a blockchain-enhanced hierarchical graph federated mutual learning intrusion detection framework and includes federated mutual learning in dimensions.

[0011] Within the domain, organizations are paired up with the assistance of chain codes to conduct deep mutual learning, and collaboratively train and update global models.

[0012] Between domains, regional coordinators further improve model performance through federated mutual learning.

[0013] Chaincode and oracle ensure the security of on-chain and off-chain interactions and the credibility of model testing.

[0014] The present invention designs a token-based hierarchical incentive mechanism, promotes domain knowledge sharing and cooperation, and realizes a closed loop of global sustainable optimization.

[0015] Security analysis shows that the proposed method provides a safe, reliable, transparent and scalable ecosystem for distributed model training. Experimental results show that the proposed method exhibits stronger feature learning ability than the benchmark algorithm. The introduction of the incentive mechanism further promotes knowledge transfer and model performance improvement. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Represents the layered architecture enabled by blockchain;

[0017] Figure 2It represents the federated mutual learning architecture within the domain;

[0018] Figure 3 Represents the application process of the Merkle tree in testing smart contracts within the domain;

[0019] Figure 4 represents the inter-domain federated mutual learning architecture;

[0020] Figure 5 Represents the application process of the Merkle tree in testing smart contracts within the domain;

[0021] Figure 6 Represents a hierarchical incentive architecture;

[0022] Figure 7(a) to Figure 7(c) Represents the F1 score of Proposed-1 and Proposed-3, where:

[0023] Figure 7(a) shows the F1 score of ToN-IoT.

[0024] Figure 7(b) shows the F1 score on CSE-CIC-IDS2018.

[0025] Figure 7(c) shows the F1 score on BoT-IoT;

[0026] Figure 8(a) to Figure 8(c) Represents the accuracy, precision and recall of ToN-IoT, where:

[0027] Figure 8(a) shows the accuracy.

[0028] Figure 8(b) shows the accuracy.

[0029] Figure 8(c) shows the recall rate;

[0030] Figure 9(a) to Figure 9(c) This is a visualization of Proposed-1 network flow classification, where:

[0031] Figure 9(a) shows the classification visualization effect in ToN-IoT.

[0032] Figure 9(b) shows the classification visualization effect in CSE-CIC-IDS2018.

[0033] Figure 9(c) shows the classification visualization effect in BoT-IoT. DETAILED DESCRIPTION

[0034] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments.

[0035] 1 Main Contributions and Structural Division

[0036] In response to the challenges in existing technologies, a network intrusion detection method that integrates blockchain and hierarchical federated mutual learning is proposed, with the aim of building a secure, reliable, transparent and scalable network security defense ecosystem.

[0037] The main contributions include the following three aspects:

[0038] The proposed federated mutual learning architecture includes two levels of optimization, namely: the overall generalization of the multi-classification model and the identification of the "short board" type. Within the domain, under the scheduling of the chain code, each organization plays the role of both student and teacher, and uses knowledge differences to achieve "learning from each other's strengths and weaknesses". Between domains, regional coordinator nodes are allowed to learn from each other and integrate network flow detection knowledge between other domains.

[0039] Dedicated oracle nodes and chaincode-based dual verification mechanisms are developed to ensure the authenticity of the on-chain and off-chain collaborative testing process and results. Sensitive model test data is retained off-chain. Trusted third-party off-chain data providers are designated to provide the required data set samples for the testing phase on demand.

[0040] A hierarchical token incentive mechanism that takes into account both overall and local benefits is designed. The test results recorded on the chain are used to judge the contributions of the participants and serve as the basis for fair and reasonable token rewards. This differentiated design promotes domain knowledge sharing and cooperation and realizes a closed loop of global sustainable optimization. The experimental results show that compared with the baseline algorithm, the proposed method not only improves the average index of multi-classification, but also breaks through the bottleneck of limited recognition of specific attack traffic.

[0041] The subsequent content of this article is arranged as follows: Section 2 designs a blockchain-assisted hierarchical federated mutual learning framework to support large-scale network intrusion detection scenarios; Section 3 designs a chain code and oracle-assisted joint training strategy; Section 4 introduces the experimental design and parameter setting; Section 5 analyzes the results; and Section 6 summarizes the entire article.

[0042] 2. Hierarchical federated mutual learning architecture based on blockchain

[0043] 2.1 Network scenarios and role division

[0044] The hierarchical federated mutual learning architecture designed by the present invention includes collaboration at two levels: intra-domain and inter-domain. Figure 1 As shown, the entities participating in the collaboration under this framework include:

[0045] Organization: The global model downloaded from the regional coordinator is used as the initial model. The organization uses local data to update the intrusion detection model based on the Graph Neural Network (GNN). After the local model (the model trained by each organization) is trained, each organization sends a transaction request for model performance testing to the chaincode. The test results determine the mutual learning pairing. The token reward takes into account the contribution to the mutual learning of the federation within the domain.

[0046] ·Regional coordinator: As the central server in the region, it is responsible for aggregating the model parameters of organizations within its jurisdiction to generate a global model in the region. As a client between regions, each regional coordinator jointly trains a global personalized model through federated mutual learning. Coordinators can receive rewards based on their contribution to inter-domain federated mutual learning. (The present invention adopts hierarchical federated learning, with two aggregations. The first is the aggregation within the region, which forms a "global model within the region").

[0047] Chaincode: Contains chaincodes used to guide intra-domain and inter-domain collaboration. The former covers interdependent intra-domain test smart contracts, intra-domain pairing smart contracts, and intra-domain token distribution smart contracts. The latter includes inter-domain test smart contracts, inter-domain pairing smart contracts, and inter-domain token distribution smart contracts.

[0048] Oracle: The oracle node plays a trusted intermediary role, allowing the test smart contract to access off-chain data. A dedicated oracle node is deployed in each region, and inter-region testing is maintained by a unique oracle node.

[0049] Off-chain data providers: Including off-chain data providers for intra-domain and inter-domain, each organization and regional coordinator node separately maintains the data set required for testing. Only the corresponding organization or regional coordinator has access rights. All off-chain data providers must comply with the test data set construction standards (including: data collection, annotation, distribution constraints, etc.) to ensure the consistency of the test set.

[0050] 2.2 Hierarchical Collaborative Learning Framework

[0051] like Figure 1 As shown in the figure, the proposed hierarchical learning framework can be abstracted into three levels, including the intra-domain learning layer, the inter-domain learning layer, and the incentive layer. From the perspective of training, the model is aggregated from the bottom up; from the perspective of incentives, tokens are distributed from the top down.

[0052] Intra-domain learning layer. Each region contains multiple organizations and a regional coordinator. After training the local intrusion detection model, each organization initiates a transaction request to the chaincode deployed on the blockchain. After the intra-domain test smart contract is triggered, the oracle node corresponding to the region obtains the intra-domain off-chain data set and completes the model test. Based on the test results, the intra-domain pairing smart contract is triggered. Organizations are paired, and the regional coordinator federates the optimized model parameters of each organization under its jurisdiction through deep mutual learning (DML).

[0053] Inter-domain learning layer. After completing the local intrusion detection model training, each regional coordinator node also initiates a transaction request to the inter-domain chain code. After the inter-domain test smart contract is triggered, the inter-domain oracle node obtains the inter-domain off-chain data set and completes the model test. Based on the test results, the inter-domain pairing smart contract is triggered. Regional coordinators are paired for mutual learning. After DML, the best performing regional coordinator is selected as the manager to aggregate all regional coordinator models and generate the final global model parameters.

[0054] Incentive layer. The incentive mechanism is divided into two levels: inter-domain and intra-domain, which are oriented to regional coordinators and organizations respectively. In the FL process, differentiated token incentives are allocated according to the contribution value of the participants to the global model. The automatic execution of token distribution smart contracts ensures that the incentive allocation process is open and transparent.

[0055] 2.3 Design Goals

[0056] The design goals of the proposed scheme include the following aspects:

[0057] ·Scalability: The addition of each new node or area will not affect the overall structure of the system and can adapt to the ever-changing real network environment.

[0058] Fairness: The token distribution process is open and transparent, ensuring the fairness and sustainable development of the entire system.

[0059] Transparency: The chaincode deployed on the blockchain is traceable, auditable, and verifiable to all nodes, ensuring the transparency and openness of key links such as model evaluation, mutual learning, and aggregation. The operation records cannot be tampered with, avoiding fairness risks caused by human manipulation.

[0060] Data privacy protection: In mutual learning and federated aggregation, each participant only needs to share model parameters or prediction results instead of raw data, reducing the exposure of sensitive information.

[0061] 3 Chaincode and Oracle-Assisted Collaborative Model Training

[0062] The present invention follows the principles of decentralization, participant autonomy and local data constraints, and designs a hierarchical federated mutual learning architecture, aiming to achieve intrusion detection by taking into account knowledge fusion, incentive fairness and sustainable optimization.

[0063] 3.1 Intra-domain federation mutual learning

[0064] In the intra-domain federated mutual learning layer, organizations can make full use of each other's data and model advantages to achieve a win-win situation. The model as a student makes up for its own "shortcomings" by learning the advantages of another organization's knowledge about specific traffic types; the model as a teacher imparts its own advantages to other organizations.

[0065] The workflow of a round of intra-domain federation mutual learning is shown in Figure 2 :

[0066] ① The organization downloads the initial model parameters from the regional coordinator and uses the collected network flows to train the local intrusion detection model.

[0067] ② The organization sends a test request to the chaincode. The domain test smart contract automatically evaluates the performance of each organization model and pairs organizations through the domain pairing smart contract.

[0068] ③ Organizations that are successfully paired learn the intrusion detection knowledge of each other’s models by transferring models to each other.

[0069] ④After mutual learning, each organization will upload the optimized model parameters to the coordinator of its region.

[0070] ⑤The regional coordinator performs weighted aggregation of the model parameters of the organizations in the region to generate a new global model.

[0071] Repeat the above intra-domain federation mutual learning iterative process until the model converges in this region. The steps in the above link are described in detail below.

[0072] A. Local model training

[0073] Organization o under the jurisdiction of regional coordinator c will extract features z from GNN u,v Input to the classifier, and finally get the network flow x i The probability p of being classified as category m c,o,m For multi-classification, the objective function of GNN training is expressed as the cross entropy error between the predicted value and the correct label,

[0074]

[0075] in

[0076]

[0077] The set of output weight matrices of tissue o in the region is W c,o ={w1,...,w c,K}. According to the calculated loss function L1, the gradient weight matrix w c,k Updated to

[0078]

[0079] This completes a training iteration process, where ε is the learning rate.

[0080] B. In-domain model performance testing

[0081] After training the local model, an organization sends a test request to the chaincode in the domain (see Figure 2 Step ② in ). Before uploading local model parameters, each participating organization first calculates the hash value of these parameters to form the leaf nodes of the Merkle tree. The organization uploads the local model parameters and the corresponding hash value to the smart contract. After receiving the data, the smart contract calculates the hash value of the uploaded data and compares it with the transmitted hash value to ensure that the data has not been tampered with during the upload process.

[0082] After receiving the local model parameters of the organization in region c, the in-domain test smart contract will call the pre-registered oracle node to obtain the off-chain test data set of the organization. As a trusted intermediary, the oracle node can safely introduce off-chain data into the in-domain model test smart contract. The in-domain test smart contract saves and returns the test results for other contracts to call. Figure 3 The application process of the Merkle tree in the domain test smart contract is shown. The leaf nodes represent the hash values ​​of the model parameters uploaded by each organization, and the internal nodes are obtained by calculating the hash values ​​of the child nodes. The final Merkle root is used to verify the integrity of the overall data.

[0083] C. Intra-domain mutual learning pairing

[0084] According to the performance results returned by the in-domain test contract, the in-domain pairing smart contract matches organizations in order of ranking, and those with a ranking difference within the threshold α are allowed to pair. KL divergence is used to measure the difference between the probability distributions of each pair of organizations. The smaller the value, the more similar the two models are.

[0085] Assume that organizations o and o′ are successfully paired by the domain pairing smart contract. c,o , W c,o′ are encoded into high-dimensional vector representations. The prediction results of these two organizational models are represented as p c,o and p c,o′ From p c,o to p c,o′ The KL divergence of is calculated as

[0086]

[0087] The total loss function of organization o is expressed as

[0088] L c,o =L 1,c,o +D KL (p c,o′ ||p c,o ) (5)

[0089] Similar to organization o, the objective loss function of organization o′ is calculated as

[0090] L c,o′ =L 1,c,o′ +D KL (p c,o ||p c,o′ ) (6)

[0091] Each organization minimizes the loss function to promote DML model training. A large KL divergence means that for certain specific traffic types, there are significant differences in the detection results of the two models. In this case, a simple parameter average can allow the student model to "learn" the teacher model's superior knowledge in identifying specific traffic types. Through DML, each organization's client model can continuously improve its own detection performance. The above model comparison and aggregation process is automatically looped under the control of the intra-domain pairing smart contract until all paired organizations reach model performance convergence.

[0092] D. Intra-domain federation aggregation

[0093] After a round of intra-regional mutual learning is completed, each organization sends a model test transaction to the intra-domain test smart contract again. The optimized parameters W of each organization c,o The accuracy obtained after the test is expressed as A c,o ′. The updated local parameters from the jurisdiction of regional coordinator c are aggregated by regional coordinator c as

[0094]

[0095] in B c The set and number of organizations within the region governed by regional coordinator c.

[0096] Through the above-mentioned intra-regional federated mutual learning process, each organization can not only fully utilize the model knowledge of other organizations, but also improve its own ability to detect specific network traffic types. The automated process of chaincode supervision ensures the fairness and reliability of the mutual learning process. Ultimately, the intrusion detection models of various organizations are aggregated by the federation into a global optimal model within a region.

[0097] 3.2 Inter-domain federation mutual learning

[0098] The inter-domain federated mutual learning layer is responsible for optimizing the global model. The main workflow is shown in Figure 4 :

[0099] ① The regional coordinator uses local data to fine-tune the local model and generates a global model within the domain through the above-mentioned intra-domain federated mutual learning.

[0100] ② The regional coordinator sends a test request to the chaincode. The inter-domain test smart contract automatically evaluates the performance of each regional coordinator model and pairs the regional coordinators through the inter-domain pairing smart contract.

[0101] ③ After the regional coordinator nodes are paired, they transfer the models to each other and perform DML to integrate the intrusion detection knowledge of the other region.

[0102] ④ Based on the updated model parameters recorded on the chain, the domain test smart contract evaluates the performance of each regional coordinator, selects the best performing regional coordinator, and aggregates the models of each regional coordinator.

[0103] Repeat the above inter-domain federation mutual learning process until the global model inter-domain layer converges. The steps in the above link are described in detail below.

[0104] A. Inter-domain model performance testing

[0105] Regional global model parameter W c It is uploaded to the chaincode by initiating a transaction request. After receiving the request, the inter-domain test smart contract calls the pre-registered inter-domain oracle node to securely access the off-chain test data set exclusive to each regional coordinator. The inter-domain oracle node is responsible for obtaining the corresponding test data from the inter-domain off-chain data provider. Using the obtained test data set, the inter-domain test smart contract calculates the performance indicators of each regional coordinator model on local data, and finally saves and returns the results of the model test for other contracts to call.

[0106] Figure 5 The application process of the Merkle tree in the inter-domain learning layer is shown. The leaf nodes represent the hash values ​​of the model parameters uploaded by each region, and the internal nodes are obtained by calculating the hash values ​​of the child nodes. The final Merkle root is used to verify the integrity of the overall data.

[0107] B. Inter-domain mutual learning pairing

[0108] Based on the model test results returned by the inter-domain test contract, the inter-domain pairing smart contract determines the pairing relationship between the regional coordinators. For each pair of paired regional coordinator models, the inter-domain pairing smart contract calculates the KL divergence value between the pair of model parameter vectors. If the regional coordinators c and c′ are matched successfully, the model prediction results p of the two arec With p c′ The KL divergence between is calculated as

[0109]

[0110] The total loss function of regional coordinator c is expressed as

[0111] L c =L 1,c +D KL (p c′ ||p c ) (9)

[0112] Similarly, the objective loss function for the regional coordinator c' is calculated as

[0113] L c′ =L 1,c′ +D KL (p c ||p c′ ) (10)

[0114] The two regional coordinators update the model parameters by minimizing the loss function. For a pair of models with a large KL divergence value, the inter-domain pairing smart contract performs the operation of averaging the model parameters, so that the student model can "learn" the teacher's knowledge of detecting specific types of traffic. The above pairing mutual learning process is automatically cycled under the control of the inter-domain pairing smart contract until all regional coordinator model pairings complete a certain number of iterations or reach other set stop conditions. In this process, the fingerprint changes of each regional coordinator model are recorded in the blockchain.

[0115] C. Inter-domain federation aggregation

[0116] Until all paired regional coordinators reach model performance convergence, the regional coordinators perform model iteration and training locally, and the model parameters are updated to W c ′, and the updated performance index is A through the inter-domain test smart contract test c ′. The inter-domain test smart contract selects the regional coordinator with the best performance to be responsible for the federation aggregation process and sets the model parameters W of each regional coordinator. c ′ is integrated into the global parameter W. In order to make the regional coordinators with better performance get better attention, thereby enhancing the performance of the overall model, according to A c ′Assigning relatively advantageous attention weights

[0117]

[0118] in C is the set and number of regional coordinators.

[0119] 3.3 Layered Incentives

[0120] Taking into account the differences in demands of participants at different levels, we design a layered token incentive structure that takes into account both the overall and local aspects, such as Figure 4 As shown. This hierarchical incentive is designed to achieve fair and differentiated incentives and promote the healthy operation of the entire FL system. According to the contribution of the participating entities in FL, the coordinator is issued a corresponding token reward; the coordinator retains a part as his own income, and the other part is distributed according to the organization's contribution to FL in the region.

[0121] A. Inter-domain Token Distribution

[0122] A of regional coordinator c after mutual learning according to the inter-domain test smart contract record c ′, the regional token distribution smart contract transfers the corresponding number of tokens to the account of regional coordinator c. After receiving the tokens, regional coordinator c retains a portion of them and distributes the rest to various organizations in the jurisdiction. The amount of tokens allocated to regional coordinator c is calculated as:

[0123]

[0124] Where r represents the balance of the token incentive pool.

[0125] B. In-domain Token Distribution

[0126] According to the contribution of organization o to the performance improvement of paired organization o′ in the mutual learning process recorded by the domain test smart contract, the domain token distribution smart contract distributes token rewards to each organization. The number of tokens obtained by organization o is expressed as

[0127]

[0128] C.Sustainability Optimization

[0129] The final model fingerprint, performance evaluation, token incentive allocation and other key information will be uploaded to the chain to ensure the traceability and transparency of the entire process. The model information includes the model parameters of each participant within and between domains and the global model parameters. The performance evaluation includes the accuracy of each regional coordinator model, the election results of the manager regional coordinator and the attention weight of each regional coordinator. The token incentive allocation information includes the number of tokens distributed by the smart contract to each regional coordinator and the token redistribution record of the regional coordinator to each organization in the region.

[0130] In the next round of hierarchical learning, regional coordinators can use the previously stored model performance indicators to adjust the training hyperparameters and aggregation weights of this round. When training locally, each organization can also refer to the previous contribution information and adjust its own training strategy. The whole process forms a closed loop across the horizontal and vertical directions. Through knowledge sharing and incentives, the performance of the overall system is improved.

[0131] 3.4 Security Analysis

[0132] This section analyzes the security scheme of the proposed method from a theoretical perspective:

[0133] Privacy protection defense: Federated mutual learning avoids data concentration within and between domains, which can effectively prevent data theft and leakage. Participants only exchange model parameters instead of original data, further protecting data privacy. Blockchain provides trusted access control and encryption mechanisms to ensure data security during the interaction process.

[0134] Distributed robustness: The proposed method adopts a decentralized design to avoid the risk of single point failure. Each organization and regional coordinator trains locally, and computing and storage resources are fully utilized. DML enables the model to incorporate richer knowledge and enhances robustness against adversarial attacks.

[0135] Model security: Blockchain smart contracts publicly verify model performance and ensure the authenticity of model test results. The immutability of blockchain ensures the credibility of model updates and token incentives.

[0136] Interaction process protection: On-chain records ensure the auditability of the participants’ behaviors, which is conducive to identifying and punishing malicious behaviors. The layered architecture and token incentive mechanism alleviate the motivation for attacks caused by conflicts of interest such as infighting and deception. When matching organizations, matching is based on model performance to reduce the possibility of knowledge loop attacks.

[0137] 4 Experimental setup

[0138] 4.1 Dataset Selection

[0139] The network intrusion detection datasets ToN-IoT (https: / / ieee-dataport.org / documents / toniot-datasets), CSE-CIC-IDS2018 (https: / / www.unb.ca / cic / datasets / ids-2018.html), and BoT-IoT (https: / / ieee-dataport.org / documents / bot-iot-dataset) are used to verify the intrusion detection performance of the proposed method. These three datasets consist of different types of benign network flows and attack flows, and have been widely used to evaluate the performance of Internet and IoT intrusion detection algorithms.

[0140] ToN-IoT, generated by ACCS in Cyber ​​Range Lab with real large-scale networks as representatives. The dataset comes from network traffic and log data collected from actual IoT devices and systems. The dataset contains 796,380 (3.56%) benign flows and 21,542,641 (96.44%) attack flows, totaling 22,339,021 flows.

[0141] CSE-CIC-IDS2018, jointly released by the Communications Security Establishment (CSE) and the Canadian Institute for Cybersecurity (CIC). Traffic captured from a variety of real environments is integrated to generate network traffic. The dataset contains 13,484,708 (83.07%) benign flows and 2,748,235 (16.93%) attack flows, totaling 16,232,943 flows.

[0142] BoT-IoT, released by the Cyber ​​Range Lab of the Australian Centre for Cyber ​​Security (ACCS), covers multiple types of botnet attacks in IoT. The dataset contains 477 (0.01%) benign flows and 3,668,045 (99.99%) attack flows, for a total of 3,668,522 flows.

[0143] 4.2 Benchmark Algorithms and Hyperparameters

[0144] The mutual learning pairing and the training hyperparameters in (12) are set to α = 5 and β = 0.5. We chose Hyperledger Fabric as the blockchain platform. Hyperledger Fabric is an open source enterprise-level distributed ledger technology with high modularity and flexibility. The smart contract is implemented in Go language and deployed in the chain code of Hyperledger Fabric.

[0145] In order to observe the contribution of the layered framework, DML, and incentive mechanism to the overall performance, the proposed methods are divided into three categories:

[0146] Proposed-1: Hierarchical federated mutual learning architecture, including the proposed chaincode automatic supervision model mutual learning and aggregation process, and the token incentive mechanism to improve the overall model optimization.

[0147] Proposed-2: Compared with Proposed-1, no incentive mechanism is introduced to promote participants to contribute to the model.

[0148] Proposed-3: Compared with Proposed-2, there is no model mutual learning process with automatic chaincode supervision.

[0149] The following three benchmark schemes are selected to evaluate the effectiveness of the proposed method.

[0150] Baseline-1

[12] : A centralized intrusion detection model based on E-GraphSAGE. All data are concentrated on a central node to train the model.

[0151] Baseline-2

[12]

[13] : Single-layer FL averaging algorithm. The E-GraphSAGE-based intrusion detection model is trained locally, and all participating nodes average and aggregate model parameters on the central server.

[0152] Baseline-3

[13]

[14] : Single-layer FL averaging algorithm. Local training of LSTM-based intrusion detection model.

[0153] 4.3 Performance indicators

[0154] Accuracy, precision, recall and F1-score are used to evaluate the detection results. The evaluation criteria are calculated as follows:

[0155]

[0156] Among them, TP (True Positive) means that the model correctly predicts the positive sample as a positive sample; TN (True Negative) means that the model correctly predicts the negative sample as a negative sample; FP (False Positive) means that the model incorrectly predicts the negative sample as a positive sample; FN (False Negative) means that the model incorrectly predicts the positive sample as a negative sample.

[0157] 5 Results Analysis

[0158] 5.1 Analysis of the Enhanced Effect of DML on Hierarchical FL

[0159] For different data sets, Figure 7(a) to Figure 7(c)The performance of hierarchical federated mutual learning and hierarchical FL without DML in multi-category tasks is compared and analyzed. The experiment counts the F1 scores of the two methods for each network traffic type on the datasets ToN-IoT, CSE-CIC-IDS2018, and BoT-IoT. It can be observed that compared with Proposed-3 without the introduction of DML, Proposed-1 has achieved a small improvement in the F1 scores of most traffic categories.

[0160] Specifically, compared with Proposed-3, Proposed-1 on the dataset ToN-IoT, the F1 scores of Normal and XSS traffic increased from 98.94% and 98.95% to 99.96% and 99.78%, respectively. When Proposed-1 was applied to the dataset CSE-CIC-IDS2018, Proposed-1 had different degrees of improvement in the F1 scores of different traffic types. The classification F1 score of Web traffic increased from 88.76% to 95.29%, and the F1 score of Bot traffic increased from 97.87% to 99.95%. For the DDoS type, although the increase in the F1 score was not large, the difference was statistically significant through the significance test. It is particularly worth noting that for the BoT-IoT dataset, Proposed-1 has a 1-5% improvement in the F1 score when detecting most traffic types. These performance improvements confirm the necessity of adding DML links on top of regional collaboration, so that successfully paired regional coordinators can learn from each other’s knowledge of detecting specific traffic types, which further improves the model’s ability to perceive subtle differences in traffic.

[0161] 5.2 Ablation Experiment

[0162] The experimental results on the ToN-IoT dataset show that the overall accuracy, precision, and recall of Proposed-1 training are higher than those of Baseline-2 and Baseline-3, and closer to the centralized training upper limit of Baseline-1. This verifies the effectiveness of the federated mutual learning mechanism and incentive design.

[0163] From experimental statistics Figure 8(a) to Figure 8(c) As can be seen from the figure, Proposed-1 can reach 97.85% in accuracy, 97.66% in precision and 97.58% in recall. This is almost the same as Baseline-1's 98.5%, 98.12%, and 97.97%, and slightly higher than Proposed-2's 96.91%, 97.37%, and 97.16%. This proves the positive effect of the designed incentive mechanism on performance.

[0164] Further, by observing Figure 8(a) to Figure 8(c) , the accuracy, precision, and recall of Proposed-1 were maintained at a high level at the beginning of training. In contrast, the initial performance indicators of Proposed-2 were lower than those of Proposed-1, but as the number of training rounds increased, they eventually approached the level of Proposed-1. This is because the incentive mechanism is scientifically and reasonably designed, which can guide different regional coordinators to pursue continuous upgrades of local models, thereby continuously promoting the integrated performance of the global model. On the other hand, DML also has a positive effect. Regional coordinators and organizations can learn from each other about parameter updates, expand their knowledge, and obtain model optimization and improved generalization capabilities.

[0165] In contrast, methods that do not introduce incentives and mutual learning, such as Proposed-2 and Proposed-3, have relatively passive interactions. Due to the lack of knowledge sharing and fusion between regional models, the performance of Proposed-3 is slightly inferior to Proposed-1. However, through continuous federated training, knowledge fusion between models can still be gradually achieved. After sufficient rounds of learning, Proposed-2 and Proposed-3 gradually approach Proposed-1. This shows that the complementarity and mutual assistance of the hierarchical framework are effective.

[0166] 5.3 Visualization Analysis

[0167] Using the t-SNE algorithm, Figure 9 projects the high-dimensional feature vectors learned by Proposed-1 on the three datasets onto a two-dimensional plane for visualization. On the dataset ToN-IoT, it can be clearly seen from the scatter plot that different categories of network traffic form multiple relatively independent and compact clusters, such as normal traffic clusters, Backdoor clusters, DDos clusters, etc. This shows that the model can well learn the distinguishing features of various types of traffic and separate them well in the high-dimensional feature space. Due to the large number of abnormal traffic types, the separation boundaries between clusters are also relatively complex. Overall, most category clusters still maintain good compactness.

[0168] In the CSE-CIC-IDS2018 dataset, most abnormal traffic categories form relatively independent and compact clusters. However, the Infiltration category has obvious overlaps with some other clusters and is not well separated from other categories on the visualization plane. Since Infiltration traffic itself is somewhat hidden and complex, it has some similarities with normal traffic in terms of characteristics.

[0169] In the BoT-IoT dataset, most traffic types form well-separated clusters. It is worth noting that the boundary between the DoS cluster and the DDoS cluster is clearer in the new visualization results than in the first working point, and the overlap area between the two is reduced. This shows that the new architecture has enhanced the feature separation ability of the two intrusion types of DoS and DDoS, and the misclassification situation has improved to a certain extent.

[0170] The above visualization results clearly reflect the classification effect of the proposed hierarchical federated mutual learning intrusion detection method on different data sets. The model can separate most category clusters well, while also exposing the room for further improvement, providing valuable guidance for subsequent model optimization.

[0171] 6 Conclusion

[0172] This paper proposes an intrusion detection method based on hierarchical federated mutual learning. This method divides the intrusion detection model training process into two levels: intra-domain and inter-domain. Through deep model mutual learning, it fully explores the data differences between heterogeneous nodes and significantly improves the generalization performance of the overall model. The chain code automatically supervises the intra-domain and inter-domain model mutual learning and weighted aggregation process to ensure efficient and reliable model training. In addition, the proposed method performs quantitative evaluation and token reward distribution according to the model contribution of each participant, which effectively stimulates knowledge sharing and cooperation between nodes and jointly promotes the improvement of global model quality. The experimental results verify that the proposed method has indeed made progress compared with the traditional single-layer method and reflects a stronger feature learning ability.

[0173] References

[0174] [1]He K,Kim DD,Asghar M R.Adversarial machine learning for network intrusion detection systems:A comprehensive survey[J].IEEE Communications Surveys&Tutorials,2023,25(1):538-566.

[0175] [2]Liu Y, Kang Y, Zou T, et al. Vertical Federated Learning: Concepts, Advances, and Challenges[J]. IEEE Transactions on Knowledge and DataEngineering, 2024.

[0176] [3]Han H,Shiwakoti R K,Jarvis R,et al.Accounting and auditing withblockchain technology and artificial Intelligence:A literature review[J].International Journal of Accounting Information Systems,2023,48:100598.

[0177] [4]Wang Z,Hu Q,Li R,et al.Incentive mechanism design for jointresource allocation in blockchain-based federated learning[J].IEEETransactions on Parallel and Distributed Systems,2023,34(5):1536-1547.

[0178] [5]Zhou T,Zhang J,Tsang D H K.FedFA:Federated Learning with FeatureAnchors to Align Features and Classifiers for Heterogeneous Data[J].IEEETransactions on Mobile Computing,2023,published online.

[0179] [6]Zhang P,Chen N,Li S,et al.Multi-domain virtual network embeddingalgorithm based on horizontal federated learning[J].IEEE Transactions onInformation Forensics and Security,2023,published online.

[0180] [7]Shi Y,Xia S,Zhou Y,et al.Vertical federated learning over cloud-RAN:Convergence analysis and system optimization[J].IEEE Transactions onWireless Communications,2023.

[0181] [8]López-Pimentel J C,Rojas O,Monroy R.Blockchain and off-chain:Asolution for audit issues in supply chain systems[C] / / 2020IEEE InternationalConference on Blockchain(Blockchain).IEEE,2020:126-133.

[0182] [9]Gao Z,Li H,Xiao K,et al.Cross-chain oracle based data migrationmechanismin heterogeneous blockchains[C] / / 2020IEEE 40th InternationalConference on Distributed Computing Systems(ICDCS).IEEE,2020:1263-1268.

[0183]

[10] Liu X,Chen X,Bi Q,et al.Blockchain-based distributed operationand incentive solution for P-RAN[J].Computer Communications,2023,198:77-84.

[0184]

[11] Liu Y,Liu Z,Zhang Q,et al.Blockchain and trusted reputationassessment-based incentive mechanism for healthcare services[J].FutureGeneration Computer Systems,2024,154:59-71.

[0185]

[12] Mirlashari M,Rizvi S A M.Enhancing IoT intrusion detection systemwith modified E-GraphSAGE:a graph neural network approach[J].InternationalJournal of Information Technology,2024:1-9.

[0186]

[13] Zhang C,Xie Y,Bai H,et al.A survey on federated learning[J].Knowledge-Based Systems,2021,216:106775.

[0187]

[14] Imrana Y,Xiang Y,Ali L,et al.A bidirectional LSTM deep learningapproach for intrusion detection[J].Expert Systems with Applications,2021,185:115524.

Claims

1. A collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain, where the network is divided into multiple regions, where the region is also called "intra-domain" and the regions are also called "inter-domain". The intrusion detection model is used as a global model to detect network intrusions; Its characteristics are The intrusion detection model is optimized through the federated mutual learning method. Within the domain, organizations pair up with each other to conduct deep mutual learning with the assistance of chain codes, and jointly train and update the model. Between domains, regional coordinators further improve the performance of local models through federated mutual learning FL. a. Entities in the network include: Organization: The global model downloaded from the regional coordinator is used as the initial model of the local model. The organization uses local data to train and update the local model. After the local model training is completed, each organization sends a transaction request for model performance testing to the chain code. The test results determine the mutual learning pairing. Considering the contribution of the federated mutual learning in the domain, the organization is rewarded with tokens. Regional coordinator: As the central server in the region, it is responsible for aggregating the model parameters of organizations within its jurisdiction to generate a global model in the region; as a client between regions, each regional coordinator jointly trains a personalized global model through federated mutual learning; regional coordinators are rewarded based on their contribution to inter-domain federated mutual learning; Chaincode: including chaincodes used to guide intra-regional and inter-regional collaboration; chaincodes guiding intra-regional collaboration include interdependent intra-domain testing smart contracts, intra-domain pairing smart contracts, and intra-domain token distribution smart contracts; chaincodes guiding inter-regional collaboration include interdependent inter-domain testing smart contracts, inter-domain pairing smart contracts, and inter-domain token distribution smart contracts; Oracle: The oracle node is a trusted intermediary that helps test smart contracts to access off-chain data. A dedicated oracle node is deployed in each region, and inter-domain testing is maintained by a unique oracle node. Off-chain data providers: including off-chain data providers for the domain and off-chain data providers for the inter-domain. They maintain the test data sets required for each organization and regional coordinator node separately; only the corresponding organization or regional coordinator has access rights; all off-chain data providers comply with the test data set construction standards; b. The hierarchical federated mutual learning framework of the intrusion detection model includes: intra-domain federated mutual learning layer, inter-domain federated mutual learning layer and incentive layer; Intra-domain federated mutual learning layer: Each region has multiple organizations and a regional coordinator; after training the local intrusion detection model, each organization initiates a transaction request to the chain code deployed on the blockchain; after the intra-domain test smart contract is triggered, the oracle node corresponding to the region obtains the intra-domain off-chain data set and completes the model test; based on the test results, the intra-domain pairing smart contract is triggered; organizations are paired, and the regional coordinator federates the model parameters optimized by the organizations under its jurisdiction through deep mutual learning DML; Inter-domain federation mutual learning layer: After completing the local intrusion detection model training, each regional coordinator node initiates a transaction request to the inter-domain chain code; after the inter-domain test smart contract is triggered, the inter-domain oracle node obtains the inter-domain off-chain data set and completes the model test; based on the test results, the inter-domain pairing smart contract is triggered; regional coordinators are paired for mutual learning; after DML, the regional coordinator with the best performance is selected as the manager to aggregate the model of all regional coordinators and generate the final global model parameters; Incentive layer: The incentive mechanism is divided into two levels: inter-domain and intra-domain, which are aimed at regional coordinators and organizations respectively. In the process of federated learning FL, token incentives are allocated differentially according to the contribution value of the participants to the global model.

2. According to claim 1, the collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain, Its characteristics are In the intra-domain federation mutual learning layer, the steps of a round of intra-domain federation mutual learning are as follows: ① The organization downloads the initial model parameters from the regional coordinator and uses the collected network data to train the local intrusion detection model; ② The organization sends a test request to the chaincode; the domain test smart contract automatically evaluates the performance of each organization model and pairs organizations through the domain pairing smart contract; ③ The successfully paired organizations learn the intrusion detection knowledge of each other’s models by transferring models to each other; ④After mutual learning, each organization will upload the optimized model parameters to the coordinator of its region; ⑤ The regional coordinator performs weighted aggregation of the model parameters of the organizations in the region to generate a new global model; Repeat the above steps ① to ⑤ iteratively until the model converges within this region.

3. According to claim 1, the collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain, Its characteristics are The inter-domain federation mutual learning layer is responsible for optimizing the global model. In the inter-domain federation mutual learning layer, the steps of inter-domain federation mutual learning include: ① The regional coordinator uses local data to fine-tune the local model and generates a global model within the domain through intra-domain federated mutual learning; ② The regional coordinator sends a test request to the chaincode; the inter-domain test smart contract automatically evaluates the performance of each regional coordinator’s model and pairs the regional coordinators through the inter-domain pairing smart contract; ③ After the regional coordinator nodes are paired, they transfer models to each other and conduct deep mutual learning (DML) to integrate the intrusion detection knowledge of the other region; ④ Based on the updated model parameters recorded on the chain, the domain test smart contract evaluates the performance of each regional coordinator, selects the best performing regional coordinator to aggregate the models of each regional coordinator; Repeat the above steps ① to ⑤ until the global model converges at the inter-domain federation mutual learning layer.

4. The collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain according to claim 1, Its characteristic is that Incentive layer: Coordinators are awarded corresponding tokens based on the contribution of the participating entities in the federated learning FL. The coordinators retain a portion of the income as their own, and the other portion is distributed based on the organization’s contribution to the FL in the region.

5. According to the collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain according to claims 2 to 4, Its characteristics are The intrusion detection model is an intrusion detection model based on graph neural network GNN.

6. The collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain according to claim 5, Its characteristics are In the intra-domain federated mutual learning layer, the local intrusion detection model training method is: Organization o under the jurisdiction of regional coordinator c will extract features z from GNN u,v Input to the classifier, and finally get the network flow x i The probability p of being classified as category m c,o,m ; For multi-classification, the objective function of GNN training is expressed as the cross entropy error between the predicted value and the correct label. in The set of output weight matrices of tissue o in the region is W c,o ={w 1 ,...,w c,K }; According to the calculated loss function L 1 , the gradient weight matrix w c,k Updated to Thus, a training iteration process is completed, where ε is the learning rate; Where y i Represents the classification label for category i, i represents the type index, The table is the gradient calculation symbol; The in-domain model performance test method is: After training the local model, an organization sends a test request to the chaincode in the domain. Before uploading the local model parameters, each participating organization first calculates the hash value of these parameters to form the leaf node of the Merkle tree. The organization uploads the local model parameters and the corresponding hash value to the smart contract. After receiving the smart contract, it calculates the hash value of the uploaded data and compares it with the transmitted hash value to ensure that the data has not been tampered with during the upload process. After receiving the local model parameters of the organization in region c, the in-domain test smart contract calls the pre-registered oracle node to obtain the off-chain test data set of the organization; the oracle node acts as an intermediary to introduce the off-chain data into the in-domain model test smart contract; the in-domain test smart contract saves and returns the test results for other contracts to call; In the Merkle tree, child nodes represent the hash values ​​of model parameters uploaded by each organization, and internal nodes are obtained by calculating the hash values ​​of child nodes; the final Merkle root is used to verify the integrity of the overall data; The intra-domain mutual learning pairing method is: According to the performance results returned by the in-domain test contract, the in-domain pairing smart contract matches organizations in order of ranking, and those with ranking differences within the threshold α are allowed to pair; KL divergence is used to measure the difference between the probability distributions of each pair of organizations. The smaller the value, the more similar the two models are; Assume that organizations o and o′ are successfully paired by the domain pairing smart contract; the two will W c,o , W c,o′ are encoded into high-dimensional vector representations; the prediction results of these two organizational models are represented as p c,o and p c,o′ ; from p c,o to p c,o′ The KL divergence of is calculated as The total loss function of organization o is expressed as L c,o =L 1,c,o +D KL (p c,o′ ||p c,o ) (5) The objective loss function with organization o′ is calculated as L c,o′ =L 1,c,o′ +D KL (p c,o ||p c,o′ ) (6) Each organization minimizes the loss function to promote DML model training; the above model comparison and aggregation process is automatically looped under the control of the domain pairing smart contract until all paired organizations reach model performance convergence; organization o and organization o′ represent two different organizations; The federation aggregation method within a domain is: After a round of mutual learning in the region is completed, each organization sends a model test transaction to the domain test smart contract again; the optimized parameters W of each organization c,o The accuracy obtained after the test is expressed as A c,o ′; the updated local parameters from the jurisdiction of regional coordinator c are aggregated by regional coordinator c as in B c are the set and number of organizations in the region under the jurisdiction of regional coordinator c, respectively.

7. The collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain according to claim 5, Its characteristic is that In the inter-domain federation mutual learning layer, the inter-domain model performance test method is as follows: Regional global model parameter W c Uploaded to the chaincode by initiating a transaction request; After receiving the request, the inter-domain test smart contract calls the pre-registered inter-domain oracle node to securely access the off-chain test data set exclusive to each regional coordinator; the inter-domain oracle node obtains the corresponding test data from the inter-domain off-chain data provider; using the obtained test data set, the inter-domain test smart contract calculates the performance indicators of each regional coordinator model on local data, and finally saves and returns the results of the model test for other contracts to call; In the application of the Merkle tree in the inter-domain learning layer, the leaf nodes represent the hash values ​​of the model parameters uploaded by each region, and the internal nodes are obtained by calculating the hash values ​​of the child nodes; the final Merkle root is used to verify the integrity of the overall data; The inter-domain mutual learning pairing method is: According to the model test results returned by the inter-domain test contract, the inter-domain pairing smart contract determines the pairing relationship between the regional coordinators; for each pair of paired regional coordinator models, the inter-domain pairing smart contract calculates the KL divergence value between the pair of model parameter vectors; if the regional coordinators c and c′ are matched successfully, the model prediction results p of the two are c With p c′ The KL divergence between is calculated as The total loss function of the regional coordinator c is expressed as L c =L 1,c +D KL (p c′ ||p c ) (9) Similarly, the objective loss function for the regional coordinator c' is calculated as L c′ =L 1,c′ +D KL (p c ||p c′ ) (10) The two regional coordinators update the model parameters by minimizing the loss function; The process of pairing and mutual learning is automatically cycled under the control of the inter-domain pairing smart contract until all regional coordinator models have completed a certain number of iterations or reached other set stop conditions; during this process, the fingerprint changes of each regional coordinator model are recorded in the blockchain; The inter-domain federation aggregation method is: Until all paired regional coordinators reach model performance convergence, the regional coordinators perform model iteration and training locally, and the model parameters are updated to W c ′, and the updated performance index is A through the inter-domain test smart contract test c ′; The inter-domain test smart contract selects the regional coordinator with the best performance to be responsible for the federation aggregation process, and sets the model parameters W of each regional coordinator c ′ is integrated into the global parameter W; according to A c ′Assigning relatively advantageous attention weights in C are the set and number of regional coordinators respectively.

8. The collaborative network intrusion detection method based on hierarchical federated mutual learning and blockchain according to claim 5 ， Its characteristic is that in the hierarchical incentive layer, the inter-domain token distribution method is: A of regional coordinator c after mutual learning according to the inter-domain test smart contract record c ′, the regional token distribution smart contract transfers the corresponding number of tokens to the account of regional coordinator c; regional coordinator c retains a portion of the tokens after receiving them, and distributes the rest to various organizations within the jurisdiction; the amount of tokens allocated to regional coordinator c is calculated as: Where r represents the balance of the token incentive pool; The method of distributing tokens within the domain is: According to the contribution of organization o to the performance improvement of paired organization o′ in the mutual learning process recorded by the domain test smart contract, the domain token distribution smart contract distributes token rewards to each organization; the number of tokens obtained by organization o is expressed as The sustainable optimization methods are: The final model information, performance evaluation and token incentive allocation information are uploaded to the chain; The model information includes the model parameters of each participant within and between domains and the global model parameters; The performance evaluation includes the accuracy of each regional coordinator model, the election results of the manager regional coordinator, and the attention weight of each regional coordinator; Token incentive distribution information includes the number of tokens distributed by the smart contract to each regional coordinator and the token redistribution record from the regional coordinator to each organization in the region.

Images