Anti-poisoning federated privacy leakage detection method based on local personalized learning

Abstract

The present application provides a method for detecting federal privacy leakage with anti-poisoning based on local personalized learning, which includes: the IoT device determines the logical adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category, the predicted label and the true label; the network parameters of the initial detection model are adjusted based on the logical adjustment loss value to obtain a candidate detection model; the reference model parameters are obtained from the candidate detection model, and the reference model parameters are sent to the central server; the central server determines the initial global model parameters based on multiple reference model parameters; the central server determines the target global model parameters based on the initial global model parameters, and sends the target global model parameters to the IoT device, so that the IoT device obtains the target detection model based on the target global model parameters. Through the technical solution of the present application, it is possible to accurately know whether the privacy data is leaked.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an anti-poisoning federal privacy leakage detection method based on local personalized learning. Background Art

[0002] With the rapid development of Internet of Things technology, more and more devices are connected to the Internet. These devices are called Internet of Things devices. Internet of Things devices can include smart home devices, industrial control equipment, medical equipment, etc. While providing convenience, Internet of Things devices also bring risks of privacy leakage and security risks.

[0003] IoT devices need to collect and process a large amount of private data (also known as sensitive data), which may include user location information, health data, and living habits. If such private data is improperly accessed or leaked, it will pose a serious threat to user privacy.

[0004] However, there is no effective way to detect whether the private data of IoT devices has been leaked. It is impossible to accurately know whether the private data has been leaked, and it is impossible to protect the security of IoT devices. Summary of the invention

[0005] The present application provides an anti-poisoning federated privacy leakage detection method based on local personalized learning. The privacy leakage detection system includes a central server and multiple IoT devices. The method includes:

[0006] The IoT device inputs the traffic features corresponding to the sample traffic data into the initial detection model to obtain the predicted label of the sample traffic data; determines the logic adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category, the predicted label and the real label of the sample traffic data; adjusts the network parameters of the initial detection model based on the logic adjustment loss value to obtain a candidate detection model; obtains reference model parameters from the candidate detection model, and sends the reference model parameters to a central server;

[0007] The central server obtains a plurality of reference model parameters, determines a pre-global model parameter based on the plurality of reference model parameters; selects a normal reference model parameter from the plurality of reference model parameters based on a similarity between each reference model parameter and the pre-global model parameter; determines a centroid global model parameter based on the normal reference model parameter; divides the plurality of reference model parameters into legal reference model parameters and illegal reference model parameters based on a similarity between each reference model parameter and the centroid global model parameter;

[0008] The central server performs a weighted operation on the legal reference model parameters to obtain the initial global model parameters; or performs a weighted operation on the legal reference model parameters and the illegal reference model parameters to obtain the initial global model parameters, wherein the weighted coefficient of the legal reference model parameters is greater than the weighted coefficient of the illegal reference model parameters;

[0009] The central server determines the target global model parameters based on the initial global model parameters, and sends the target global model parameters to the IoT device, so that the IoT device obtains a target detection model based on the target global model parameters, and the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

[0010] The present application provides an anti-poisoning federated privacy leakage detection method based on local personalized learning, which is applied to an Internet of Things device and includes:

[0011] Inputting the flow characteristics corresponding to the sample flow data into the initial detection model to obtain the predicted label of the sample flow data; determining the logical adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label and the true label of the sample flow data;

[0012] Adjusting the network parameters of the initial detection model based on the logical adjustment loss value to obtain a candidate detection model; obtaining reference model parameters from the candidate detection model, and sending the reference model parameters to a central server so that the central server obtains target global model parameters based on the reference model parameters;

[0013] The target global model parameters are obtained from a central server, and a target detection model is obtained based on the target global model parameters, where the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

[0014] The present application provides an anti-poisoning federated privacy leakage detection method based on local personalized learning, which is applied to a central server and includes:

[0015] Acquire multiple reference model parameters from multiple IoT devices, and determine pre-global model parameters based on the multiple reference model parameters; select normal reference model parameters from the multiple reference model parameters based on the similarity between each reference model parameter and the pre-global model parameter;

[0016] Determining centroid global model parameters based on the normal reference model parameters;

[0017] Based on the similarity between each reference model parameter and the centroid global model parameter, dividing the multiple reference model parameters into legal reference model parameters and illegal reference model parameters;

[0018] Performing a weighted operation on the legal reference model parameters to obtain initial global model parameters; or performing a weighted operation on the legal reference model parameters and the illegal reference model parameters to obtain initial global model parameters, and the weighted coefficient of the legal reference model parameters is greater than the weighted coefficient of the illegal reference model parameters;

[0019] The target global model parameters are determined based on the initial global model parameters, and the target global model parameters are sent to the IoT device, so that the IoT device obtains a target detection model based on the target global model parameters, and the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

[0020] The present application provides an anti-poisoning federated privacy leakage detection device based on local personalized learning, which is applied to an Internet of Things device and includes:

[0021] A determination module is used to input the flow characteristics corresponding to the sample flow data into the initial detection model to obtain the predicted label of the sample flow data; based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category, the predicted label and the real label of the sample flow data, determine the logical adjustment loss value;

[0022] A training module, configured to adjust the network parameters of the initial detection model based on the logic adjustment loss value to obtain an adjusted detection model, and determine a candidate detection model based on the adjusted detection model;

[0023] A sending module, used for obtaining reference model parameters from the candidate detection model, and sending the reference model parameters to the central server, so that the central server obtains the target global model parameters based on the reference model parameters;

[0024] An acquisition module is used to obtain the target global model parameters from the central server, and obtain a target detection model based on the target global model parameters; wherein the target detection model is used to perform privacy leakage detection on the traffic data to be detected of the Internet of Things device.

[0025] The present application provides an anti-poisoning federated privacy leakage detection device based on local personalized learning, the device is applied to a central server, and the device includes:

[0026] An acquisition module, used for acquiring multiple reference model parameters from multiple IoT devices;

[0027] a determination module, configured to determine a pre-global model parameter based on the multiple reference model parameters; select a normal reference model parameter from the multiple reference model parameters based on a similarity between each reference model parameter and the pre-global model parameter; determine a centroid global model parameter based on the normal reference model parameter; and divide the multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on a similarity between each reference model parameter and the centroid global model parameter;

[0028] A processing module, configured to perform a weighted operation on the legal reference model parameters to obtain initial global model parameters; or to perform a weighted operation on the legal reference model parameters and the illegal reference model parameters to obtain initial global model parameters, wherein the weighted coefficient of the legal reference model parameters is greater than the weighted coefficient of the illegal reference model parameters;

[0029] A sending module is used to determine the target global model parameters based on the initial global model parameters, and send the target global model parameters to the Internet of Things device, so that the Internet of Things device obtains a target detection model based on the target global model parameters, and the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

[0030] The present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above-mentioned anti-poisoning federal privacy leakage detection method based on local personalized learning.

[0031] The present application provides an Internet of Things device, including: a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the above-mentioned anti-poisoning federal privacy leakage detection method based on local personalized learning.

[0032] The present application provides a central server, including: a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the above-mentioned anti-poisoning federal privacy leakage detection method based on local personalized learning.

[0033] The present application provides a machine-readable storage medium, which stores machine-executable instructions that can be executed by a processor; wherein the processor is used to execute the machine-executable instructions to implement the above-mentioned anti-poisoning federal privacy leakage detection method based on local personalized learning.

[0034] It can be seen from the above technical solutions that in the embodiment of the present application, by obtaining the target detection model, the target detection model is used to detect the privacy leakage of the traffic data to be detected, so as to timely know whether the privacy data of the IoT device is leaked, that is, accurately know whether the privacy data is leaked, and when there is a privacy leakage in the traffic data to be detected, stop sending the traffic data to be detected, and perform security protection on the IoT device. When the IoT device trains the candidate detection model, the loss value is adjusted logically to perform model training for local personalized learning to adapt to the data distribution of each IoT device and solve the problem of low model detection accuracy caused by uneven data distribution. The central server can screen out legal reference model parameters and illegal reference model parameters, generate target global model parameters based on legal reference model parameters, thereby identifying illegal IoT devices participating in the training, and avoiding generating target global model parameters based on illegal reference model parameters of illegal IoT devices, so as to effectively defend against poisoning attacks and ensure the performance of target global model parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 It is a flowchart of the anti-poisoning federated privacy leakage detection method based on local personalized learning;

[0036] Figure 2 It is a flowchart of the anti-poisoning federated privacy leakage detection method based on local personalized learning;

[0037] Figure 3 It is a flowchart of the anti-poisoning federated privacy leakage detection method based on local personalized learning;

[0038] Figure 4 is a structural schematic diagram of a privacy leakage detection system in one embodiment of the present application;

[0039] Figure 5 It is a flowchart of the anti-poisoning federated privacy leakage detection method based on local personalized learning;

[0040] Fig. 6A It is a structural diagram of a federated privacy leakage detection device for anti-poisoning based on local personalized learning;

[0041] Figure 6B It is a structural diagram of a federated privacy leakage detection device for anti-poisoning based on local personalized learning;

[0042] Figure 7 It is a hardware structure diagram of an electronic device in one embodiment of the present application. DETAILED DESCRIPTION

[0043] In the embodiment of the present application, a method for detecting a federated privacy leak based on local personalized learning to prevent poisoning is proposed, which can be applied to a privacy leak detection system. The privacy leak detection system can include a central server and multiple IoT devices. Figure 1 FIG. 4 is a flow chart of the method, which may include:

[0044] Step 101: The IoT device inputs the traffic characteristics corresponding to the sample traffic data into the initial detection model to obtain a predicted label for the sample traffic data; determines a logical adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label and the true label of the sample traffic data; adjusts the network parameters of the initial detection model based on the logical adjustment loss value to obtain a candidate detection model; obtains reference model parameters from the candidate detection model, and sends the reference model parameters to the central server.

[0045] Step 102: The central server obtains multiple reference model parameters, and determines a pre-global model parameter based on the multiple reference model parameters; selects a normal reference model parameter from the multiple reference model parameters based on a similarity between each reference model parameter and the pre-global model parameter; determines a centroid global model parameter based on the normal reference model parameter; and divides the multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on a similarity between each reference model parameter and the centroid global model parameter.

[0046] Step 103: The central server performs weighted operations on the legal reference model parameters to obtain initial global model parameters; or performs weighted operations on the legal reference model parameters and the illegal reference model parameters to obtain initial global model parameters, wherein the weighted coefficients of the legal reference model parameters are greater than the weighted coefficients of the illegal reference model parameters.

[0047] Step 104: The central server determines the target global model parameters based on the initial global model parameters, and sends the target global model parameters to the IoT device, so that the IoT device obtains a target detection model based on the target global model parameters. The target detection model is used to perform privacy leakage detection on the traffic data to be detected.

[0048] Exemplarily, based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label and the true label of the sample traffic data, determining the logic adjustment loss value may include but is not limited to: using the following formula to determine the logic adjustment loss value: ;in, L can represent the logistic adjustment loss value, C It can represent the total number of categories supported by the initial detection model. It can represent the first i The weight of each category, i The value range is 1 to C , It can represent the unique hot encoding corresponding to the true label, It can represent the unique hot encoding corresponding to the predicted label, It can represent the first i The correction vector for each class, Can represent the sigmoid function.

[0049] Exemplarily, for each category, the method for obtaining the weight of the category may include: if the sample data set includes multiple sample traffic data, based on the true label of each sample traffic data, counting the frequency of the sample traffic data of the category; determining the weight of the category based on the frequency, and the weight of the category is inversely proportional to the frequency. For each category, the method for obtaining the correction vector of the category may include: if the sample data set includes multiple sample traffic data, based on the true label of each sample traffic data, counting the frequency of the sample traffic data of the category; generating the correction vector of the category based on the frequency and the unique hot encoding corresponding to the category.

[0050] Exemplarily, adjusting the network parameters of the initial detection model based on the logical adjustment loss value to obtain a candidate detection model may include but is not limited to: determining the cross entropy loss value based on the predicted label and the true label; performing a weighted operation on the logical adjustment loss value and the cross entropy loss value to obtain the target loss value; adjusting the network parameters of the initial detection model based on the target loss value to obtain an adjusted detection model; if the adjusted detection model has converged, determining the adjusted detection model as the candidate detection model; if the adjusted detection model has not converged, determining the adjusted detection model as the initial detection model, and returning to execute the operation of inputting the traffic features corresponding to the sample traffic data into the initial detection model to obtain the predicted label of the sample traffic data.

[0051] Exemplarily, based on the similarity between each reference model parameter and the pre-global model parameter, a normal reference model parameter is selected from multiple reference model parameters, which may include but is not limited to: for each reference model parameter, if the similarity (such as cosine similarity) between the reference model parameter and the pre-global model parameter is greater than a first similarity threshold, the reference model parameter is selected as a normal reference model parameter; if the similarity is not greater than the first similarity threshold, the reference model parameter is selected as an abnormal reference model parameter.

[0052] Based on the similarity between each reference model parameter and the centroid global model parameter, multiple reference model parameters are divided into legal reference model parameters and illegal reference model parameters, which may include but is not limited to: for each reference model parameter, if the similarity between the reference model parameter and the centroid global model parameter is greater than a second similarity threshold, the reference model parameter is selected as a legal reference model parameter; if the similarity is not greater than the second similarity threshold, the reference model parameter is selected as an illegal reference model parameter.

[0053] Exemplarily, after dividing multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on the similarity between each reference model parameter and the centroid global model parameter, the central server can also send alarm information to the IoT device corresponding to the illegal reference model parameter, so that the IoT device determines that there is an abnormality in the IoT device based on the alarm information.

[0054] It can be seen from the above technical solutions that in the embodiment of the present application, by obtaining the target detection model, the target detection model is used to detect the privacy leakage of the traffic data to be detected, so as to timely know whether the privacy data of the IoT device is leaked, that is, accurately know whether the privacy data is leaked, and when there is a privacy leakage in the traffic data to be detected, stop sending the traffic data to be detected, and perform security protection on the IoT device. When the IoT device trains the candidate detection model, the loss value is adjusted logically to perform model training for local personalized learning to adapt to the data distribution of each IoT device and solve the problem of low model detection accuracy caused by uneven data distribution. The central server can screen out legal reference model parameters and illegal reference model parameters, generate target global model parameters based on legal reference model parameters, thereby identifying illegal IoT devices participating in the training, and avoiding generating target global model parameters based on illegal reference model parameters of illegal IoT devices, so as to effectively defend against poisoning attacks and ensure the performance of target global model parameters.

[0055] In the embodiment of the present application, a method for detecting federated privacy leakage based on local personalized learning is proposed, which is applied to IoT devices. Figure 2 As shown, it is a schematic diagram of the process of the method, comprising:

[0056] Step 201: Input the traffic characteristics corresponding to the sample traffic data into the initial detection model to obtain the predicted label of the sample traffic data; determine the logical adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label and the true label of the sample traffic data.

[0057] Step 202: adjust the network parameters of the initial detection model based on the logical adjustment loss value to obtain a candidate detection model; obtain reference model parameters from the candidate detection model, and send the reference model parameters to the central server so that the central server obtains the target global model parameters based on the reference model parameters.

[0058] Step 203: Obtain target global model parameters from the central server, and obtain a target detection model based on the target global model parameters. The target detection model is used to perform privacy leakage detection on the traffic data to be detected.

[0059] Exemplarily, based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label and the true label of the sample traffic data, the logical adjustment loss value is determined, which may include but is not limited to: using the following formula to determine the logical adjustment loss value: ;in, L can represent the logistic adjustment loss value, C It can represent the total number of categories supported by the initial detection model. It can represent the first i The weight of each category, i The value range is 1 to C , It can represent the unique hot encoding corresponding to the true label, It can represent the unique hot encoding corresponding to the predicted label, It can represent the first i The correction vector for each class, Can represent the sigmoid function.

[0060] Exemplarily, for each category, the method for obtaining the weight of the category may include: if the sample data set includes multiple sample traffic data, based on the true label of each sample traffic data, counting the frequency of the sample traffic data of the category; determining the weight of the category based on the frequency, and the weight of the category is inversely proportional to the frequency. For each category, the method for obtaining the correction vector of the category may include: if the sample data set includes multiple sample traffic data, based on the true label of each sample traffic data, counting the frequency of the sample traffic data of the category; generating the correction vector of the category based on the frequency and the unique hot encoding corresponding to the category.

[0061] Exemplarily, adjusting the network parameters of the initial detection model based on the logical adjustment loss value to obtain a candidate detection model may include but is not limited to: determining the cross entropy loss value based on the predicted label and the true label; performing a weighted operation on the logical adjustment loss value and the cross entropy loss value to obtain the target loss value; adjusting the network parameters of the initial detection model based on the target loss value to obtain an adjusted detection model; if the adjusted detection model has converged, determining the adjusted detection model as the candidate detection model; if the adjusted detection model has not converged, determining the adjusted detection model as the initial detection model, and returning to execute the operation of inputting the traffic features corresponding to the sample traffic data into the initial detection model to obtain the predicted label of the sample traffic data.

[0062] It can be seen from the above technical solution that in the embodiment of the present application, when training the candidate detection model of the IoT device, a logical adjustment loss value is used to perform model training for local personalized learning to adapt to the data distribution of each IoT device and solve the problem of low model detection accuracy caused by uneven data distribution.

[0063] In the embodiment of the present application, a method for detecting federated privacy leakage based on local personalized learning is proposed and applied to the central server. Figure 3 As shown, it is a schematic diagram of the process of the method, comprising:

[0064] Step 301: Acquire multiple reference model parameters from multiple IoT devices, determine pre-global model parameters based on the multiple reference model parameters; and select normal reference model parameters from the multiple reference model parameters based on the similarity between each reference model parameter and the pre-global model parameter.

[0065] Step 302: Determine centroid global model parameters based on normal reference model parameters.

[0066] Step 303: Based on the similarity between each reference model parameter and the centroid global model parameter, multiple reference model parameters are divided into legal reference model parameters and illegal reference model parameters.

[0067] Step 304: Perform weighted calculation on the legal reference model parameters to obtain initial global model parameters; or, perform weighted calculation on the legal reference model parameters and the illegal reference model parameters to obtain initial global model parameters, and the weighted coefficient of the legal reference model parameters is greater than the weighted coefficient of the illegal reference model parameters.

[0068] Step 305: determine the target global model parameters based on the initial global model parameters, and send the target global model parameters to the IoT device, so that the IoT device obtains a target detection model based on the target global model parameters. The target detection model is used to perform privacy leakage detection on the traffic data to be detected.

[0069] Exemplarily, based on the similarity between each reference model parameter and the pre-global model parameter, a normal reference model parameter is selected from multiple reference model parameters, which may include but is not limited to: for each reference model parameter, if the similarity (such as cosine similarity) between the reference model parameter and the pre-global model parameter is greater than a first similarity threshold, the reference model parameter is selected as a normal reference model parameter; if the similarity is not greater than the first similarity threshold, the reference model parameter is selected as an abnormal reference model parameter.

[0070] Based on the similarity between each reference model parameter and the centroid global model parameter, multiple reference model parameters are divided into legal reference model parameters and illegal reference model parameters, which may include but is not limited to: for each reference model parameter, if the similarity between the reference model parameter and the centroid global model parameter is greater than a second similarity threshold, the reference model parameter is selected as a legal reference model parameter; if the similarity is not greater than the second similarity threshold, the reference model parameter is selected as an illegal reference model parameter.

[0071] Exemplarily, after dividing multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on the similarity between each reference model parameter and the centroid global model parameter, the central server can also send alarm information to the IoT device corresponding to the illegal reference model parameter, so that the IoT device determines that there is an abnormality in the IoT device based on the alarm information.

[0072] It can be seen from the above technical solution that in the embodiment of the present application, legal reference model parameters and illegal reference model parameters can be screened out, and target global model parameters can be generated based on the legal reference model parameters, so as to identify illegal IoT devices participating in the training, avoid generating target global model parameters based on illegal reference model parameters of illegal IoT devices, and effectively defend against poisoning attacks and ensure the performance of the target global model parameters.

[0073] The above technical solutions of the embodiments of the present application are described below in combination with specific application scenarios.

[0074] In order to detect whether the privacy data of IoT devices has been leaked, federated learning can be used to train a detection model, and the traffic data of IoT devices can be detected based on the detection model to find out whether the privacy data of IoT devices has been leaked. Federated learning provides a method to train detection models without sharing original data, which can protect the privacy data in IoT devices. In the detection of privacy data leakage, the detection model has high robustness and accuracy, which can ensure the effective identification of privacy leakage behavior.

[0075] However, in the IoT scenario, due to differences in the device types, usage environments, and usage patterns of IoT devices, the data distribution of different IoT devices is often non-independent and identically distributed, and non-independent and identically distributed data may lead to poor training results for the detection model, especially when the global model is aggregated, the model parameters of different IoT devices may conflict with each other, affecting the performance of the final global model. In response to the above findings, in this embodiment, when training candidate detection models for IoT devices, a logical adjustment loss value is used to perform model training for local personalized learning to adapt to the data distribution of each IoT device and solve the problem of low model detection accuracy caused by uneven data distribution.

[0076] In addition, in the IoT scenario, IoT devices may be subject to various malicious attacks, such as attempts to steal or tamper with private data, and malicious attacks will initiate poisoning attacks by tampering with the local data or model parameters of IoT devices. In this way, when the global model is aggregated, the model parameters of the malicious attack will be integrated, thereby affecting the performance of the final global model. In view of the above findings, in this embodiment, illegal IoT devices participating in training can be identified to avoid generating target global model parameters based on illegal reference model parameters of illegal IoT devices, which can effectively defend against poisoning attacks and ensure the performance of target global model parameters.

[0077] The present application embodiment proposes an anti-poisoning federated privacy leakage detection method based on local personalized learning, which can be applied to the privacy leakage detection system. Figure 4 The privacy leakage detection system includes a central server and multiple IoT devices. The IoT devices may include but are not limited to smart home devices, industrial control devices, medical devices, etc. There is no restriction on the type of IoT devices. Figure 5 FIG. 4 is a flow chart of the method, which may include:

[0078] Step 501: The IoT device obtains a sample data set and a configured initial detection model.

[0079] For example, during the operation of an IoT device, the IoT device may collect multiple sample traffic data, and the sample traffic data may be traffic data sent by the IoT device to other devices, or traffic data sent by other devices to the IoT device. The traffic data may be HTTP traffic data, TCP traffic data, FTP traffic data, etc., and there is no restriction on the type of traffic data.

[0080] The sample traffic data may include the privacy data of IoT devices (also known as sensitive data). This privacy data may include the user's location information, health data, living habits, sensor data, etc. The sample traffic data may also not include the privacy data of IoT devices.

[0081] For each sample traffic data, the real label corresponding to the sample traffic data can be obtained. The real label can be manually calibrated or obtained by a certain algorithm. There is no restriction on the source of the real label. The real label corresponding to the sample traffic data can represent the real category of the sample traffic data. For example, the real label can be 0, indicating that the real category of the sample traffic data is that there is no privacy leakage. The real label can be 1, indicating that the real category of the sample traffic data is that there is a privacy leakage of type A (such as leakage of ID card number). The real label can be 2, indicating that the real category of the sample traffic data is that there is a privacy leakage of type B (such as leakage of mobile phone number), and so on.

[0082] In summary, the IoT device can obtain a sample data set, which may include multiple sample traffic data, and the sample data set includes a true label corresponding to each sample traffic data.

[0083] Exemplarily, the IoT device can obtain an initial detection model (the initial detection model can also be called an initial privacy leakage detection model). The initial detection model can be pre-configured or obtained using a certain algorithm. There is no restriction on the source of the initial detection model. The initial detection model is used to detect whether there is a privacy leakage in the traffic data. If there is a privacy leakage in the traffic data, the initial detection model is also used to identify the type of privacy leakage in the traffic data (such as leakage of ID card number, leakage of mobile phone number, etc.).

[0084] The initial detection model can be a model based on a neural network, or a model based on a deep learning algorithm. There is no restriction on the network structure of the initial detection model, as long as it can achieve privacy leakage detection. For example, the initial detection model can be a classifier that supports multiple categories.

[0085] The initial detection model can support multiple categories to support C For example, C is a positive integer greater than 1, that is C To represent the total number of categories supported by the initial detection model. For example, the initial detection model supports category 0, category 1, category 2, and so on. Category 0 means there is no privacy leakage, category 1 means there is privacy leakage of type A, category 2 means there is privacy leakage of type B, and so on.

[0086] Step 502: For each sample flow data in the sample data set, the IoT device inputs the flow feature corresponding to the sample flow data into the initial detection model to obtain a predicted label for the sample flow data.

[0087] Exemplarily, the IoT device may preprocess the sample data set, such as removing invalid sample flow data, performing data cleaning on abnormal sample flow data, etc., and there is no restriction on this preprocessing process.

[0088] For each sample flow data in the sample data set, a sample flow data is used as an example to illustrate that the flow characteristics corresponding to the sample flow data can be obtained. For example, the sample flow data is subjected to feature extraction by a feature extractor to obtain the flow characteristics corresponding to the sample flow data.

[0089] After obtaining the traffic characteristics corresponding to the sample traffic data, the traffic characteristics can be input into the initial detection model, and the initial detection model processes the traffic characteristics to obtain the predicted label of the sample traffic data and output the predicted label of the sample traffic data. There is no restriction on this processing process.

[0090] The predicted label of the sample traffic data may indicate the predicted category of the sample traffic data. For example, the predicted label may be 0, indicating that the predicted category of the sample traffic data is category 0, which is a category without privacy leakage. The predicted label may be 1, indicating that the predicted category of the sample traffic data is category 1, which is a category with type A privacy leakage. The predicted label may be 2, indicating that the predicted category of the sample traffic data is category 2, which is a category with type B privacy leakage, and so on.

[0091] Step 503: The IoT device determines a logical adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label of the sample traffic data, and the true label of the sample traffic data.

[0092] For example, in order to adapt to the data distribution of each IoT device and solve the problem of low model detection accuracy caused by uneven data distribution, a logical adjustment loss function can be configured, and the logical adjustment loss value can be determined by the logical adjustment loss function. The logical adjustment loss value is used to perform model training for local personalized learning, that is, the logical adjustment loss value is used to personalize the model to adapt to the data distribution of each IoT device. For example, the logical adjustment loss function can also be called a small batch logical adjustment loss function, that is, a small amount of sample traffic data is used to determine the logical adjustment loss value. The logical adjustment loss function can be adjusted at the output layer of the model (such as the output layer of the initial detection model) to deal with the problem of data imbalance.

[0093] The input data of the logical adjustment loss function can be the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label of the sample traffic data, and the true label of the sample traffic data. The output data of the logical adjustment loss function can be the logical adjustment loss value. There is no restriction on this logical adjustment loss function.

[0094] For example, an example of the logistic adjustment loss function can be shown in formula (1), that is, the logistic adjustment loss value can be determined by formula (1). Of course, this is just an example of the logistic adjustment loss function, as long as the input data of the logistic adjustment loss function includes the total number of categories, the weight of each category, the correction vector of each category, the predicted label and the true label.

[0095] Formula (1)

[0096] In formula (1), L Can represent logistically adjusted loss value. C It can represent the total number of categories supported by the initial detection model. Assuming that the initial detection model supports category 0, category 1, category 2, and category 3, the total number of categories C can be 4. It can represent the first i The weight of each category, i The value range is 1 to C , It can represent the first i The correction vector of each category, for example, if i is 1, then represents the weight of category 0, represents the correction vector of category 0. If i is 2, then represents the weight of category 1, represents the correction vector for class 1, and so on.

[0097] In formula (1), It can represent the unique hot encoding corresponding to the true label. If the true label corresponds to category 0, the unique hot encoding corresponding to the true label is It can be 1000. If the true label corresponds to category 1, then the one-hot encoding corresponding to the true label is It can be 0100, and so on. It can represent the one-hot encoding corresponding to the predicted label. If the predicted label corresponds to category 0, the one-hot encoding corresponding to the predicted label is It can be 1000. If the predicted label corresponds to category 1, the one-hot encoding corresponding to the predicted label is It can be 0100, and so on.

[0098] In formula (1), Can represent the sigmoid function, which is used for Perform normalization operation, Convert to probability, such as Convert to a numeric value between 0 and 1.

[0099] Obviously, after substituting the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label of the sample traffic data, and the true label of the sample traffic data into formula (1), the logical adjustment loss value can be obtained.

[0100] Exemplarily, for each category, the weight of the category may be obtained by configuring the weight of each category based on experience, without limiting the weight of each category, and the sum of the weights of all categories may be 1, for example, the weight of category 0 is 0.3, the weight of category 1 is 0.2, the weight of category 2 is 0.4, and the weight of category 3 is 0.1. Alternatively, the weight of each category may be determined based on the frequency of each category.

[0101] In order to determine the frequency of each category, the following method can be used: if the sample data set includes multiple sample traffic data, then based on the true label of each sample traffic data, the frequency of the sample traffic data of each category is counted, and the frequency of the sample traffic data can be the frequency of the category. For example, if the sample data set includes 100 sample traffic data, the true labels of 80 sample traffic data correspond to category 0, the true labels of 10 sample traffic data correspond to category 1, the true labels of 8 sample traffic data correspond to category 2, and the true labels of 2 sample traffic data correspond to category 3, then the frequency of category 0 is 0.8, the frequency of category 1 is 0.1, the frequency of category 2 is 0.08, and the frequency of category 2 is 0.02.

[0102] Based on the frequency of each category, the weight of the category can be determined based on the frequency, and the weight of the category is inversely proportional to the frequency. For example, the weight of category 0 can be less than the weight of category 1, the weight of category 1 can be less than the weight of category 2, and the weight of category 2 can be less than the weight of category 3. Or,

[0103] The weight of the category can be determined based on the frequency and the adjustment coefficient, and the adjustment coefficient is inversely proportional to the frequency. For example, the adjustment coefficient of category 0 is smaller than that of category 1, the adjustment coefficient of category 1 is smaller than that of category 2, and the adjustment coefficient of category 2 is smaller than that of category 3. If the adjustment coefficient of category 0 is 0.1, the adjustment coefficient of category 1 is 0.2, the adjustment coefficient of category 2 is 0.3, and the adjustment coefficient of category 3 is 0.4, then the weight of category 0 can be 0.08 (0.8*0.1), the weight of category 1 can be 0.02, the weight of category 2 can be 0.024, and the weight of category 3 can be 0.008. Or,

[0104] After obtaining the weight of category 0 as 0.08, the weight of category 1 as 0.02, the weight of category 2 as 0.024, and the weight of category 3 as 0.008, the weight of each category can be increased in proportion so that the sum of the weights of each category is 1.

[0105] Of course, the above is only an example of determining the weight of each category, and there is no limitation on this determination method.

[0106] Exemplarily, for each category, the correction vector of the category may be obtained by: determining the correction vector of each category according to the frequency of each category. In order to determine the frequency of each category, if the sample data set includes multiple sample flow data, the frequency of the sample flow data of each category is counted based on the true label of each sample flow data, and the frequency of the sample flow data may be the frequency of the category.

[0107] For each category, a correction vector for the category can be generated based on the frequency of the category and the one-hot encoding corresponding to the category. For example, if the frequency of category 0 is 0.8, the one-hot encoding corresponding to category 0 is 1000, so it can be determined that the correction vector for category 0 is [0.8, 0, 0, 0], that is, a 4*1 dimensional matrix. If the frequency of category 1 is 0.1, the one-hot encoding corresponding to category 1 is 0100, so it can be determined that the correction vector for category 1 is [0, 0.1, 0, 0], and so on. Of course, this is just an example of determining the correction vector, and there is no limitation to this. The correction vector (also called the correction value) is determined based on the data distribution and is calculated based on the frequency of each category in the sample data set, that is, the correction vector of each category is calculated based on the frequency.

[0108] Step 504: The IoT device determines a target loss value based on the logic adjustment loss value. For example, the logic adjustment loss value is determined as the target loss value. Alternatively, a cross entropy loss value is determined based on the predicted label and the true label, and a weighted operation is performed on the logic adjustment loss value and the cross entropy loss value to obtain the target loss value.

[0109] Exemplarily, a cross entropy loss function may be preconfigured, the input data of the cross entropy loss function is the predicted label of the sample traffic data and the true label of the sample traffic data, the output data of the cross entropy loss function is the cross entropy loss value, and no restrictions are imposed on this cross entropy loss function. Obviously, after obtaining the predicted label of the sample traffic data and the true label of the sample traffic data, the cross entropy loss value may be determined based on the predicted label and the true label, such as the greater the absolute value of the difference between the predicted label and the true label, the greater the cross entropy loss value, and the smaller the absolute value of the difference between the predicted label and the true label, the smaller the cross entropy loss value.

[0110] When performing weighted operation to obtain the target loss value, the weighted coefficient of the logic-adjusted loss value is greater than the weighted coefficient of the cross-entropy loss value, or the weighted coefficient of the logic-adjusted loss value is equal to the weighted coefficient of the cross-entropy loss value, or the weighted coefficient of the logic-adjusted loss value is less than the weighted coefficient of the cross-entropy loss value.

[0111] Step 505: The IoT device adjusts the network parameters of the initial detection model based on the target loss value to obtain an adjusted detection model, and obtains a candidate detection model based on the adjusted detection model.

[0112] Exemplarily, when adjusting the network parameters of the initial detection model, that is, for the back-propagation process, the target loss value (that is, the weighted value of the logical adjustment loss value and the cross entropy loss value) is used to update the network parameters. The cross entropy loss value can ensure that the model learns patterns from the data, and the logical adjustment loss value can ensure that the model adapts to the imbalance of the data, thereby improving the generalization ability of the model on local data.

[0113] When adjusting the network parameters of the initial detection model based on the target loss value, gradient descent or other optimization algorithms can be used to adjust the network parameters. The goal of adjusting the network parameters is to make the target loss value smaller and smaller. There is no restriction on the network parameter adjustment process. When adjusting the network parameters, the learning rate and other hyperparameters can be adjusted to ensure the stability and efficiency of the model training.

[0114] After obtaining the adjusted detection model, it can be determined whether the adjusted detection model has converged. If the adjusted detection model has converged (such as the target loss value is less than the threshold), the adjusted detection model is determined as a candidate detection model. If the adjusted detection model has not converged, the adjusted detection model is determined as the initial detection model, and the process returns to step 502 to repeat the above steps until the adjusted detection model has converged.

[0115] For example, after obtaining the candidate detection model, a test data set (the test data set is obtained in a similar manner to the sample data set) can be used to evaluate the performance of the candidate detection model to ensure that the personalized adjusted candidate detection model can effectively process local data. For example, the prediction accuracy of the candidate detection model can be determined based on the test data set. If the prediction accuracy is greater than a threshold, the candidate detection model can be output. If the prediction accuracy is not greater than the threshold, the candidate detection model is retrained.

[0116] By adopting logical adjustment of loss value training to obtain candidate detection models, the candidate detection model of each IoT device can be personalized to adapt to the local data of this IoT device. Especially when processing non-independent and identically distributed data, this personalized adjustment is particularly important. This not only improves the accuracy of the candidate detection model, but also enhances the adaptability and robustness of the candidate detection model to different data distributions.

[0117] Step 506: The IoT device obtains reference model parameters from the candidate detection model (ie, the network parameters in the candidate detection model are used as reference model parameters), and sends the reference model parameters to the central server.

[0118] Exemplarily, the IoT device sends reference model parameters to the central server instead of sending original data to the central server, thereby avoiding leakage of original data and ensuring data security.

[0119] Step 507: The central server obtains multiple reference model parameters.

[0120] Exemplarily, for each IoT device, the IoT device can obtain reference model parameters based on local data and send the reference model parameters to the central server. In this way, the central server can obtain the reference model parameters sent by multiple IoT devices, that is, multiple reference model parameters can be obtained.

[0121] Step 508: The central server determines pre-global model parameters based on multiple reference model parameters.

[0122] Exemplarily, the central server can collect the reference model parameters sent by all IoT devices and use a weighted algorithm or other aggregation algorithm to update the global privacy leakage detection model. Considering the non-independent and identically distributed characteristics of the data, the personalized adjustment ensures the robustness of the global privacy leakage detection model.

[0123] For example, since there may be IoT devices that launch poisoning attacks in the federated learning environment, that is, the reference model parameters of the IoT devices will reduce the performance of the global privacy leakage detection model, it is also necessary to detect illegal IoT devices, identify IoT devices that may launch poisoning attacks, and limit the impact of illegal IoT devices when the global model is updated to protect the robustness and accuracy of the global model.

[0124] Before detecting illegal IoT devices, a pre-global model parameter can be calculated and used as a benchmark for subsequent comparisons, that is, illegal IoT devices are detected based on the pre-global model parameter.

[0125] For example, in order to calculate the pre-global model parameters, after obtaining the reference model parameters sent by all IoT devices, weighted operations (such as weighted average operations) can be performed on all reference model parameters, and the model parameters after the weighted operations (i.e., the average value of all reference model parameters) are used as the pre-global model parameters.

[0126] Step 509: The central server selects a normal reference model parameter from a plurality of reference model parameters based on the similarity (such as cosine similarity) between each reference model parameter and the pre-global model parameter.

[0127] Exemplarily, for each reference model parameter, the similarity between the reference model parameter and the pre-global model parameter may be calculated, and if the similarity is greater than a first similarity threshold (which may be configured based on experience), the reference model parameter may be selected as a normal reference model parameter. If the similarity is not greater than the first similarity threshold, the reference model parameter may be selected as an abnormal reference model parameter.

[0128] Exemplarily, the similarity may be cosine similarity, distance similarity, etc., and there is no restriction on the type of similarity. Taking cosine similarity as an example, see formula (2), which is an example of calculating the cosine similarity between the reference model parameters and the pre-global model parameters, and there is no restriction on the calculation method.

[0129] P = (k1·k2) / ( ) Formula (2)

[0130] In formula (2), P may represent the cosine similarity between the reference model parameter and the pre-global model parameter, k1 may represent the reference model parameter, and k2 may represent the pre-global model parameter.

[0131] In formula (2), · represents the vector dot product, Represents the norm of a vector.

[0132] Step 510: The central server determines centroid global model parameters based on normal reference model parameters.

[0133] Exemplarily, after all reference model parameters are distinguished into normal reference model parameters and abnormal reference model parameters, the centroid global model parameter can be determined based on all normal reference model parameters, and the centroid global model parameter is independent of the abnormal reference model parameter. The centroid global model parameter can also be called the central global model parameter, which is the center point of all normal reference model parameters initially screened.

[0134] For example, the centroid global model parameters can be determined using the following formula (3): θ centroid In formula (3), M is the number of normal reference model parameters, θ j is the jth normal reference model parameter.

[0135] Formula (3)

[0136] Step 511: The central server divides the multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on the similarity between each reference model parameter and the centroid global model parameter.

[0137] Exemplarily, for each reference model parameter, the similarity between the reference model parameter and the centroid global model parameter may be calculated, and if the similarity is greater than a second similarity threshold (which may be configured based on experience), the reference model parameter may be selected as a legal reference model parameter. If the similarity is not greater than the second similarity threshold, the reference model parameter may be selected as an illegal reference model parameter.

[0138] Exemplarily, the similarity may be cosine similarity, distance similarity, etc., and there is no restriction on the type of similarity. Taking cosine similarity as an example, see formula (2), which is an example of calculating the cosine similarity between the reference model parameters and the centroid global model parameters, and k2 may represent the centroid global model parameters.

[0139] Step 512: The central server performs weighted operations on the legal reference model parameters to obtain initial global model parameters. Alternatively, the central server performs weighted operations on the legal reference model parameters and the illegal reference model parameters to obtain initial global model parameters, wherein the weighted coefficients of the legal reference model parameters are greater than the weighted coefficients of the illegal reference model parameters.

[0140] Exemplarily, after dividing multiple reference model parameters into legal reference model parameters and illegal reference model parameters, initial global model parameters can be obtained based on all legal reference model parameters, thereby eliminating the influence of illegal reference model parameters. For example, weighted operations (such as weighted average operations) are performed on legal reference model parameters to obtain initial global model parameters, that is, the average value of all legal reference model parameters is used as the initial global model parameter. Since the initial global model parameter is the average value of all legal reference model parameters, it has nothing to do with illegal reference model parameters, so it can effectively defend against poisoning attacks and ensure the performance of model parameters.

[0141] Exemplarily, the legal reference model parameters and the illegal reference model parameters may be weighted to obtain the initial global model parameters, and the weight coefficient of the legal reference model parameters is greater than the weight coefficient of the illegal reference model parameters, thereby reducing the influence of the illegal reference model parameters. For example, the weight coefficients of all legal reference model parameters may be the same or different. The weight coefficients of all illegal reference model parameters may be the same or different. The minimum weight coefficient of the legal reference model parameters is greater than the maximum weight coefficient of the illegal reference model parameters. By reducing the weight coefficient of the illegal reference model parameters, the influence of the illegal reference model parameters is reduced, thereby being able to effectively defend against poisoning attacks and ensure the performance of the model parameters.

[0142] Exemplarily, the central server can send an alarm message to the IoT device corresponding to the illegal reference model parameter, so that the IoT device determines that there is an abnormality in the IoT device based on the alarm message, such as the IoT device determines that there is a poisoning attack on the IoT device based on the alarm message. In this way, corresponding security measures can be taken for the IoT device to avoid poisoning attacks, and there is no restriction on this process.

[0143] Step 513: The central server determines target global model parameters based on the initial global model parameters.

[0144] For example, the central server can construct a detection model to be trained, and the network parameters of the detection model to be trained can be the initial global model parameters. The central server can use the sample data set of the central server (i.e., the data set constructed by the central server) to train the detection model to be trained to obtain a trained detection model, and there is no restriction on the training process of the detection model to be trained. After obtaining the trained detection model, the network parameters in the trained detection model can be used as the target global model parameters.

[0145] Step 514: The central server sends the target global model parameters to the IoT device, so that the IoT device acquires the target detection model based on the target global model parameters.

[0146] For example, the central server can send the target global model parameters to the IoT devices corresponding to the legal reference model parameters, but not send the target global model parameters to the IoT devices corresponding to the illegal reference model parameters. For the IoT devices corresponding to the legal reference model parameters, after receiving the target global model parameters, the IoT devices can build an initial detection model, and the network parameters in the initial detection model can be the target global model parameters. The IoT devices determine the target detection model based on the initial detection model.

[0147] For example, the IoT device may use the initial detection model as the target detection model. Alternatively, the IoT device may fine-tune the initial detection model to further improve the detection accuracy of the initial detection model and obtain a fine-tuned target detection model. Alternatively, the IoT device may execute steps 502 to 505 to obtain an adjusted detection model, and obtain a target detection model based on the adjusted detection model.

[0148] In a possible implementation, after obtaining the target detection model, the IoT device can output the target detection model, deploy the target detection model, and perform privacy leakage detection on the traffic data to be detected based on the target detection model. Alternatively, after obtaining the target detection model, the IoT device can use the target detection model as a candidate detection model, return to step 506, repeat the above steps, and continuously improve the performance and robustness of the global model through multiple rounds of iterative optimization until the iterative optimization is completed and the target detection model is deployed.

[0149] Exemplarily, after deploying the target detection model, the IoT device can perform privacy leakage detection on the traffic data to be detected based on the target detection model. For example, the IoT device collects the traffic data to be detected, inputs the traffic features corresponding to the traffic data to be detected into the target detection model, and the target detection model processes the traffic features to obtain the predicted label of the traffic data to be detected, and outputs the predicted label of the traffic data to be detected. The predicted label represents the predicted category of the traffic data to be detected. For example, the predicted label can be 0, indicating that the predicted category is category 0, and category 0 is a category where there is no privacy leakage. The predicted label can be 1, indicating that the predicted category is category 1, and category 1 is a privacy leakage of type A. The predicted label can be 2, indicating that the predicted category is category 2, and category 2 is a privacy leakage of type B, and so on.

[0150] IoT devices can use target detection models to detect potential privacy leaks in real time. Once privacy leaks are detected, response measures can be taken immediately, such as issuing alarms and blocking malicious communications.

[0151] It can be seen from the above technical solution that in the embodiment of the present application, when training the candidate detection model of the IoT device, a logical adjustment loss value is used to perform model training for local personalized learning to adapt to the data distribution of each IoT device and solve the problem of low model detection accuracy caused by uneven data distribution.

[0152] In addition, the central server can filter out legal reference model parameters and illegal reference model parameters, and generate target global model parameters based on the legal reference model parameters, thereby identifying illegal IoT devices participating in the training and avoiding generating target global model parameters based on illegal reference model parameters of illegal IoT devices, thereby effectively defending against poisoning attacks and ensuring the performance of the target global model parameters.

[0153] Based on the same application concept as the above method, an anti-poisoning federal privacy leakage detection device based on local personalized learning is proposed in the embodiment of the present application. The device can be applied to IoT devices, see Fig. 6A FIG. 1 is a schematic diagram of the structure of the device, and the device may include:

[0154] The determination module 611 is used to input the flow characteristics corresponding to the sample flow data into the initial detection model to obtain the predicted label of the sample flow data; determine the logical adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category, the predicted label and the real label of the sample flow data;

[0155] A training module 612 is used to adjust the network parameters of the initial detection model based on the logical adjustment loss value to obtain an adjusted detection model, and determine a candidate detection model based on the adjusted detection model;

[0156] A sending module 613 is used to obtain reference model parameters from the candidate detection model, and send the reference model parameters to the central server, so that the central server obtains the target global model parameters based on the reference model parameters;

[0157] The acquisition module 614 is used to obtain the target global model parameters from the central server, and obtain a target detection model based on the target global model parameters; wherein the target detection model is used to perform privacy leakage detection on the traffic data to be detected of the IoT device.

[0158] Exemplarily, the determination module 611 determines the logic adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category, the predicted label and the real label of the sample traffic data by using the following formula to determine the logic adjustment loss value: ;middle,L represents the logic-adjusted loss value, C Indicates the total number of categories supported by the initial detection model, Indicates the first i The weight of each category, i The value range is 1 to C , represents the one-hot encoding corresponding to the true label, represents the one-hot encoding corresponding to the predicted label, Indicates the first i The correction vector for each class, Represents the sigmoid function.

[0159] Exemplarily, for each category, the determination module 611 is specifically used to obtain the weight of the category by: if the sample data set includes multiple sample flow data, then based on the true label of each sample flow data, counting the frequency of the sample flow data of the category; determining the weight of the category based on the frequency, and the weight of the category is inversely proportional to the frequency; for each category, the determination module 611 is specifically used to obtain the correction vector of the category by: if the sample data set includes multiple sample flow data, then based on the true label of each sample flow data, counting the frequency of the sample flow data of the category; generating the correction vector of the category based on the frequency and the unique hot encoding corresponding to the category.

[0160] Exemplarily, when the training module 612 adjusts the network parameters of the initial detection model based on the logical adjustment loss value to obtain a candidate detection model, it is specifically used to: determine the cross entropy loss value based on the predicted label and the true label; perform weighted operation on the logical adjustment loss value and the cross entropy loss value to obtain a target loss value; adjust the network parameters of the initial detection model based on the target loss value to obtain an adjusted detection model; if the adjusted detection model has converged, determine the adjusted detection model as the candidate detection model; if the adjusted detection model has not converged, determine the adjusted detection model as the initial detection model, and return to execute the operation of inputting the traffic characteristics corresponding to the sample traffic data into the initial detection model to obtain the predicted label of the sample traffic data.

[0161] Based on the same application concept as the above method, an anti-poisoning federated privacy leakage detection device based on local personalized learning is proposed in the embodiment of the present application. The device can be applied to the central server, see Figure 6B FIG. 1 is a schematic diagram of the structure of the device, and the device may include:

[0162] An acquisition module 621 is used to acquire multiple reference model parameters from multiple IoT devices;

[0163] A determination module 622 is used to determine a pre-global model parameter based on the multiple reference model parameters; select a normal reference model parameter from the multiple reference model parameters based on the similarity between each reference model parameter and the pre-global model parameter; determine a centroid global model parameter based on the normal reference model parameter; divide the multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on the similarity between each reference model parameter and the centroid global model parameter;

[0164] Processing module 623, used to perform weighted operation on the legal reference model parameters to obtain initial global model parameters; or, perform weighted operation on the legal reference model parameters and the illegal reference model parameters to obtain initial global model parameters, and the weighted coefficient of the legal reference model parameters is greater than the weighted coefficient of the illegal reference model parameters;

[0165] The sending module 624 is used to determine the target global model parameters based on the initial global model parameters, and send the target global model parameters to the IoT device, so that the IoT device obtains a target detection model based on the target global model parameters, and the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

[0166] Exemplarily, when the determination module 622 selects a normal reference model parameter from the multiple reference model parameters based on the similarity between each reference model parameter and the pre-global model parameter, it is specifically used to: for each reference model parameter, if the similarity between the reference model parameter and the pre-global model parameter is greater than a first similarity threshold, the reference model parameter is selected as a normal reference model parameter; if the similarity is not greater than the first similarity threshold, the reference model parameter is selected as an abnormal reference model parameter. When the determination module 622 divides the multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on the similarity between each reference model parameter and the centroid global model parameter, it is specifically used to: for each reference model parameter, if the similarity between the reference model parameter and the centroid global model parameter is greater than a second similarity threshold, the reference model parameter is selected as a legal reference model parameter; if the similarity is not greater than the second similarity threshold, the reference model parameter is selected as an illegal reference model parameter.

[0167] Exemplarily, the sending module 624 is also used to send alarm information to the Internet of Things device corresponding to the illegal reference model parameters after the division into legal reference model parameters and illegal reference model parameters, so that the Internet of Things device determines that there is an abnormality in the Internet of Things device based on the alarm information.

[0168] Based on the same application concept as the above method, an electronic device (such as an Internet of Things device or a central server) is proposed in the embodiment of the present application. Figure 7 As shown, the electronic device includes: a processor 71 and a machine-readable storage medium 72, wherein the machine-readable storage medium 72 stores machine-executable instructions that can be executed by the processor 71; the processor 71 is used to execute the machine-executable instructions to implement the anti-poisoning federal privacy leakage detection based on local personalized learning disclosed in the above example of this application.

[0169] Based on the same application concept as the above method, the embodiment of the present application also provides a machine-readable storage medium, on which a number of computer instructions are stored. When the computer instructions are executed by the processor, the anti-poisoning federal privacy leakage detection based on local personalized learning disclosed in the above example of the present application can be realized. The above-mentioned machine-readable storage medium can be any electronic, magnetic, optical or other physical storage device, which can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Radom Access Memory, random access memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as optical disk, DVD, etc.), or similar storage medium, or a combination thereof.

[0170] Based on the same application concept as the above method, an embodiment of the present application also provides a computer program product, which may include a computer program. When the computer program is executed by a processor, it implements the anti-poisoning federal privacy leakage detection based on local personalized learning disclosed in the above example of the present application.

[0171] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0172] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for detecting federated privacy leaks based on local personalized learning to prevent poisoning, characterized in that: The privacy leakage detection system includes a central server and multiple IoT devices, and the method includes: The IoT device inputs the traffic features corresponding to the sample traffic data into the initial detection model to obtain the predicted label of the sample traffic data; determines the logic adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category, the predicted label and the real label of the sample traffic data; adjusts the network parameters of the initial detection model based on the logic adjustment loss value to obtain a candidate detection model; obtains reference model parameters from the candidate detection model, and sends the reference model parameters to a central server; The central server obtains a plurality of reference model parameters, determines a pre-global model parameter based on the plurality of reference model parameters; selects a normal reference model parameter from the plurality of reference model parameters based on a similarity between each reference model parameter and the pre-global model parameter; determines a centroid global model parameter based on the normal reference model parameter; divides the plurality of reference model parameters into legal reference model parameters and illegal reference model parameters based on a similarity between each reference model parameter and the centroid global model parameter; The central server performs a weighted operation on the legal reference model parameters to obtain the initial global model parameters; or performs a weighted operation on the legal reference model parameters and the illegal reference model parameters to obtain the initial global model parameters, wherein the weighted coefficient of the legal reference model parameters is greater than the weighted coefficient of the illegal reference model parameters; The central server determines the target global model parameters based on the initial global model parameters, and sends the target global model parameters to the IoT device, so that the IoT device obtains a target detection model based on the target global model parameters, and the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

2. The method according to claim 1, characterized in that The determining of the logic adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category, the predicted label and the true label of the sample traffic data includes: determining the logic adjustment loss value using the following formula: ； in, L represents the logic-adjusted loss value, C Indicates the total number of categories supported by the initial detection model, Indicates the first i The weight of each category, i The value range is 1 to C , represents the one-hot encoding corresponding to the true label, represents the one-hot encoding corresponding to the predicted label, Indicates the first i The correction vector for each class, Represents the sigmoid function.

3. The method according to claim 1 or 2, characterized in that: For each category, the weight of the category is obtained in the following manner: if the sample data set includes multiple sample flow data, based on the true label of each sample flow data, counting the frequency of the sample flow data of the category; determining the weight of the category based on the frequency, and the weight of the category is inversely proportional to the frequency; For each category, the method for obtaining the correction vector of the category includes: if the sample data set includes multiple sample traffic data, based on the true label of each sample traffic data, counting the frequency of the sample traffic data of the category; based on the frequency and the unique hot encoding corresponding to the category, generating the correction vector of the category.

4. The method according to claim 1, characterized in that The step of adjusting the network parameters of the initial detection model based on the logic adjustment loss value to obtain a candidate detection model includes: Determine a cross entropy loss value based on the predicted label and the true label; Performing a weighted operation on the logic adjustment loss value and the cross entropy loss value to obtain a target loss value; Based on the target loss value, the network parameters of the initial detection model are adjusted to obtain an adjusted detection model; if the adjusted detection model has converged, the adjusted detection model is determined as the candidate detection model; if the adjusted detection model has not converged, the adjusted detection model is determined as the initial detection model, and the operation of inputting the traffic characteristics corresponding to the sample traffic data into the initial detection model is returned to obtain the predicted label of the sample traffic data.

5. The method according to claim 1, characterized in that The selecting a normal reference model parameter from the multiple reference model parameters based on the similarity between each reference model parameter and the pre-global model parameter comprises: for each reference model parameter, if the similarity between the reference model parameter and the pre-global model parameter is greater than a first similarity threshold, selecting the reference model parameter as a normal reference model parameter; if the similarity is not greater than the first similarity threshold, selecting the reference model parameter as an abnormal reference model parameter; The method of dividing the multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on the similarity between each reference model parameter and the centroid global model parameter includes: for each reference model parameter, if the similarity between the reference model parameter and the centroid global model parameter is greater than a second similarity threshold, selecting the reference model parameter as a legal reference model parameter; if the similarity is not greater than the second similarity threshold, selecting the reference model parameter as an illegal reference model parameter.

6. The method according to claim 1, characterized in that After dividing the multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on the similarity between each reference model parameter and the centroid global model parameter, the method further includes: The central server sends an alarm message to the IoT device corresponding to the illegal reference model parameter, so that the IoT device determines that an abnormality exists in the IoT device based on the alarm message.

7. A method for detecting federated privacy leaks based on local personalized learning to prevent poisoning, characterized in that: The method is applied to an Internet of Things device, and the method comprises: Inputting the flow characteristics corresponding to the sample flow data into the initial detection model to obtain the predicted label of the sample flow data; determining the logical adjustment loss value based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category supported by the initial detection model, the predicted label and the true label of the sample flow data; Adjusting the network parameters of the initial detection model based on the logical adjustment loss value to obtain a candidate detection model; obtaining reference model parameters from the candidate detection model, and sending the reference model parameters to a central server so that the central server obtains target global model parameters based on the reference model parameters; The target global model parameters are obtained from a central server, and a target detection model is obtained based on the target global model parameters, where the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

8. A method for detecting federated privacy leaks based on local personalized learning to prevent poisoning, characterized in that: The method is applied to a central server, and the method comprises: Acquire multiple reference model parameters from multiple IoT devices, and determine pre-global model parameters based on the multiple reference model parameters; select normal reference model parameters from the multiple reference model parameters based on the similarity between each reference model parameter and the pre-global model parameter; Determining centroid global model parameters based on the normal reference model parameters; Based on the similarity between each reference model parameter and the centroid global model parameter, dividing the multiple reference model parameters into legal reference model parameters and illegal reference model parameters; Performing a weighted operation on the legal reference model parameters to obtain initial global model parameters; or performing a weighted operation on the legal reference model parameters and the illegal reference model parameters to obtain initial global model parameters, and the weighted coefficient of the legal reference model parameters is greater than the weighted coefficient of the illegal reference model parameters; The target global model parameters are determined based on the initial global model parameters, and the target global model parameters are sent to the IoT device, so that the IoT device obtains a target detection model based on the target global model parameters, and the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

9. A federal privacy leakage detection device for preventing poisoning based on local personalized learning, characterized in that: The device is applied to an Internet of Things device, and the device includes: A determination module is used to input the flow characteristics corresponding to the sample flow data into the initial detection model to obtain the predicted label of the sample flow data; based on the total number of categories supported by the initial detection model, the weight of each category supported by the initial detection model, the correction vector of each category, the predicted label and the real label of the sample flow data, determine the logical adjustment loss value; A training module, configured to adjust the network parameters of the initial detection model based on the logic adjustment loss value to obtain an adjusted detection model, and determine a candidate detection model based on the adjusted detection model; A sending module, used for obtaining reference model parameters from the candidate detection model, and sending the reference model parameters to the central server, so that the central server obtains the target global model parameters based on the reference model parameters; An acquisition module is used to obtain the target global model parameters from the central server, and obtain a target detection model based on the target global model parameters; wherein the target detection model is used to perform privacy leakage detection on the traffic data to be detected of the Internet of Things device.

10. A federal privacy leakage detection device for preventing poisoning based on local personalized learning, characterized in that: The device is applied to a central server, and the device comprises: An acquisition module, used for acquiring multiple reference model parameters from multiple IoT devices; a determination module, configured to determine a pre-global model parameter based on the multiple reference model parameters; select a normal reference model parameter from the multiple reference model parameters based on a similarity between each reference model parameter and the pre-global model parameter; determine a centroid global model parameter based on the normal reference model parameter; and divide the multiple reference model parameters into legal reference model parameters and illegal reference model parameters based on a similarity between each reference model parameter and the centroid global model parameter; A processing module, configured to perform a weighted operation on the legal reference model parameters to obtain initial global model parameters; or to perform a weighted operation on the legal reference model parameters and the illegal reference model parameters to obtain initial global model parameters, wherein the weighted coefficient of the legal reference model parameters is greater than the weighted coefficient of the illegal reference model parameters; A sending module is used to determine the target global model parameters based on the initial global model parameters, and send the target global model parameters to the Internet of Things device, so that the Internet of Things device obtains a target detection model based on the target global model parameters, and the target detection model is used to perform privacy leakage detection on the traffic data to be detected.

Images