Federal learning threat detection method and system based on Modbus

Abstract

The invention relates to the technical field of federated learning, in particular to a Modbus-based federated learning threat detection method and system. The method comprises the following steps: preprocessing acquired binary network traffic data to obtain Json file data; performing feature extraction on the Json file data; initializing a federal learning model, and performing model training by using the extracted features to obtain a plurality of important parameters of the model; summarizing a plurality of important parameters of the model to obtain a global important parameter position; updating the model based on the global important parameter position to obtain a personalized federal learning model; and performing network threat detection by using the personalized federal learning model. According to the method, the network flow can be represented from multiple dimensions, and the network threat detection effect is improved from the data level while support is provided for the federated learning framework to realize multi-source input.

Description

Technical Field

[0001] The present invention relates to the technical field of federated learning, and in particular to a Modbus-based federated learning threat detection method and system. Background Art

[0002] As a common language in the field of industrial control, Modbus protocol has been widely used in industries related to the national economic lifeline, such as energy, transportation, and petrochemicals.

[0003] Federated learning is a distributed machine learning technology whose core advantage is that it allows all participants to jointly train an ideal global model while protecting privacy. However, fragmented industrial control scenarios pose huge challenges to the direct application of federated learning. First, due to the diversity of network environments and the unpredictability of attacks, the data owned by federated learning clients is heterogeneous, which leads to weight differences between local models and affects the performance of federated learning. Although some personalized federated learning methods claim to alleviate this problem, they all aim to reduce the deviation between the global model and the local model while ignoring the potential similarity between clients. In addition, the goal of federated learning should take into account both global and local optimization. In other words, the client should have the ability to detect local network threats and at the same time obtain the ability to detect unknown threats through federated learning.

[0004] Secondly, in order to easily quantify and control the imbalance of data, most federal threat detection methods distribute client data on a specific data set. This means that all data actually comes from the same test platform. However, in practice, there are many sources of network threat data, which may come from the traffic of real industrial control systems or the traffic generated by security analysis tools related to the system. The client has the right to choose appropriate data to build a detection model according to its own needs. To achieve this goal, a more efficient network traffic feature extraction method must be proposed.

[0005] Finally, the Modbus control network uses the Modbus protocol to exchange data between nodes, but the communication method between the server and the client in most federated learning solutions is mainly based on traditional IT protocols. Although they apply various security encryption technologies to ensure privacy, they can easily attract extra attention from attackers. Because attackers can clearly know that the equipment involved in federated learning is performing a task outside of an industrial process. Therefore, this puts higher requirements on the federated learning solution in the Modbus control network, that is, the need to consider the concealment of communication.

[0006] The paper "Personalized federated learning of execution&evaluation dualnetwork for CPS intrusion detection." proposes an industrial federated threat detection solution with an execution-evaluation dual network that can generate global and local models simultaneously. The generation of its personalized model still depends on the global model created in the execution network. However, when the data is not independent and identically distributed, it is difficult for the execution network to generate a global model with good performance for all clients. In addition, this method uses the cosine distance of each local model parameter to measure the similarity between models. Due to the large parameter scale of the neural network, this method will cause the problem of dimensionality disaster.

[0007] The paper “An Effective Clustered Federated Learning Framework for Industrial Internet of Things Intrusion Detection” proposes an industrial network threat detection method based on clustered federated learning. This method finds federated clients with similar data distribution by performing time series clustering on model evaluation indicators, and jointly trains a common network threat detection model for them. Using time series clustering to mine similar relationships between clients requires the prerequisite that the clients are naturally grouped. However, in practice, the data distribution between clients may be different, which will cause the method to fail. In addition, this method aims to improve the performance of local models on local data, but ignores the learning of global information, and the model has poor robustness.

[0008] In summary, the existing federated learning network threat detection methods applied to industrial control networks have problems such as poor model generalization ability, lack of unified feature representation methods, and easy to attract the attention of attackers, which makes it difficult to be applied in fragmented industrial scenarios, and has low practicality and reference value. Summary of the invention

[0009] In order to solve the above-mentioned problems, the present invention provides an intelligent bidding method and system. A personalized detection model is generated for each federated client by calculating the similarity relationship of important parameters of each local model during the federated training process, and the federated learning is allowed to optimize the personalized and global parts at the same time. In addition, the method can support multi-source data input and ensure the confidentiality of federated communication.

[0010] In a first aspect, the present invention provides a Modbus-based federated learning threat detection method, which adopts the following technical solution: A Modbus-based federated learning threat detection method, comprising: Get binary network traffic data; Preprocess the acquired binary network traffic data to obtain Json file data; Extract features from Json file data; Initialize the federated learning model, use the extracted features to train the model, and obtain several important parameters of the model; By summarizing several important parameters of the model, the global important parameter positions are obtained; Update the model based on the global important parameter positions to obtain a personalized federated learning model; Cyber ​​threat detection using personalized federated learning models.

[0011] Furthermore, the acquisition of binary network traffic data includes acquiring five data sets: industrial control traffic data, low-interaction industrial honeypot data, high-interaction industrial honeypot data, attack tool data, and mixed data. The number of clients is set to N=20, the number of training rounds is T=150, the proportion of important parameters is K%=5%, and the balance factor is , learning rate , 80% of the data in each client is used for training, and 20% of the data is used for local model evaluation.

[0012] Furthermore, the obtained binary network traffic data is preprocessed to obtain Json file data, including using Tshark API to preprocess the binary network traffic into Json file data, and dividing the Json file data into three groups of Session, Flow and Packet according to different feature extraction granularities.

[0013] Furthermore, the feature extraction of the Json file data includes basic feature extraction and Modbus protocol feature extraction, wherein the basic feature extraction includes extracting features from the IT level, including quantity features, time features, byte features, protocol features and port number features; the Modbus protocol feature extraction includes extracting features related to the Modbus data packet, including whether the request is responded to, Trans-ID, Unit-Id, function code, starting address of read and write operations, and address length of read and write operations.

[0014] Furthermore, the extracted features are used to train the model to obtain several important parameters of the model, including training a federated learning model based on local data to obtain trained model parameters, calculating the cumulative contribution of each model parameter using a formula to obtain the importance of each parameter, selecting several parameters as important model parameters of the local model according to the importance, and marking the positions of all important parameters.

[0015] Furthermore, the global important parameter positions are obtained by summarizing several important parameters of the model, including extracting marked important model parameters from the model, and calculating the correlation coefficient matrix of each model according to the important model parameters, which is expressed as: (4.2) Among them, the correlation coefficient matrix ; N is the number of clients, Represents the similarity coefficient vector between the important model parameters of client i and other important model parameters, Represents important model parameters for client i Important model parameters with client j Similarity coefficient, softmax() is a normalization function, which ensures that the cumulative sum of each row in matrix A is 1. Represents important model parameters for client i and important model parameters of client j The set of all joint probability distributions of is x appears in and y appears in probability. Represents the expected distance between all x and y, and its minimum value is and The EMD distance is , Stored The EMD distance of other important model parameters, and the function max() is the maximum value function.

[0016] Further, the updating of the model based on the global important parameter position to obtain the personalized model includes updating the model based on a correlation coefficient formula to form a personalized model for each client, and the correlation coefficient formula is expressed as: is the correlation coefficient between client i and other clients, is the local model of client i, =0.7 is the balance factor.

[0017] In the second aspect, a Modbus-based federated learning threat detection system includes: The data acquisition module is configured to acquire binary network traffic data; The preprocessing module is configured to preprocess the acquired binary network traffic data to obtain Json file data; The feature extraction module is configured to extract features from Json file data; The model training module is configured to initialize the federated learning model, perform model training using the extracted features, and obtain several important parameters of the model; The parameter module is configured to obtain the global important parameter positions by summarizing several important parameters of the model; An updating module is configured to update the model based on the global important parameter positions to obtain a personalized federated learning model; The detection module is configured to utilize a personalized federated learning model for network threat detection.

[0018] In a third aspect, the present invention provides a computer-readable storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded and executed by a processor of a terminal device, for example, a Modbus-based federated learning threat detection method.

[0019] In a fourth aspect, the present invention provides a terminal device comprising a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, and the instructions are suitable for being loaded and executed by the processor to implement the Modbus-based federated learning threat detection method.

[0020] In summary, the present invention has the following beneficial technical effects: (1) This application proposes a network traffic representation method based on multi-granularity. This method can characterize network traffic from multiple dimensions. While providing support for the federated learning framework to implement multi-source input, it also improves the network threat detection effect from the data level. (2) This application proposes a similarity update algorithm based on important model parameters, which enhances the collaboration effect between similar clients to better adapt to local application scenarios. At the same time, the personalized model can also integrate global knowledge, so that the model also has global scene detection capabilities. (3) This application proposes a covert federal communication scheme for Modbus control networks. This scheme uses the standard Modbus protocol to realize information exchange between servers and clients, making the devices performing federated learning behave more like real industrial control devices, thereby concealing the federated learning process and reducing attackers' attention to federated devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a schematic diagram of the process of the hidden personalized federated learning threat detection method of Example 1 of the present invention; Figure 2 is a flow chart of a method for extracting network traffic characteristics according to Embodiment 1 of the present invention; Figure 3 is a client training flow chart of embodiment 1 of the present invention; Figure 4 is an F1 score graph of different feature extraction methods on various data sets according to Example 1 of the present invention; Figure 5 It is a local and global test accuracy effect diagram of scenario 1-Dirichlet~(0.3) of embodiment 1 of the present invention; Figure 6 This is a graph showing the local and global test accuracy of Dirichlet~(0.3) in scenario 2 of embodiment 1 of the present invention; Figure 7 It is a time cost t graph of different methods of Example 1 of the present invention under scenario 2 - Dirichlet~(0.3); Figure 8 is a Modbus covert communication deployment diagram of Example 1 of the present invention; Fig. 9 This is a diagram showing the proportion of session lengths between different protocol clients and attackers in Example 1 of the present invention; Fig.10 It is a system structure diagram of embodiment 1 of the present invention. DETAILED DESCRIPTION

[0022] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0023] Example 1 Reference Figure 1 , a Modbus-based federated learning threat detection method of this embodiment includes: Get binary network traffic data; Preprocess the acquired binary network traffic data to obtain Json file data; Extract features from Json file data; Initialize the federated learning model, use the extracted features to train the model, and obtain several important parameters of the model; By summarizing several important parameters of the model, the global important parameter positions are obtained; Update the model based on the global important parameter positions to obtain a personalized federated learning model; Cyber ​​threat detection using personalized federated learning models.

[0024] Specifically, This embodiment uses five data sets, namely industrial control flow data, low-interaction industrial honeypot data, high-interaction industrial honeypot data, attack tool data and mixed data, to comprehensively evaluate the method proposed in the present invention. Among them, the industrial control flow data is the network flow data collected in a small power simulation system. In addition to the normal system polling and manual operation flow, the flow also includes 6 types of attack flow. The low-interaction industrial honeypot data is the flow from 10 different attack organizations collected by a low-interaction Modbus honeypot from July 2017 to February 2023. The flow from the same organization is considered to belong to the same type of attack. The high-interaction industrial honeypot data is composed of 4 different types of attack flow collected by a high-interaction Modbus honeypot. The attack tool data uses 5 public attack tools to scan 10 Modbus real industrial control devices exposed on the Internet and collects data. The mixed data set is composed of the above four data sets. The specific distribution of the data set is shown in Table 1, and the total data packet represents the total amount of normal and attack packets. In this embodiment, the number of clients is N=20, the number of training rounds is T=150, the proportion of important parameters selected is K%=5%, and the balance factor , learning rate . 80% of the data in each client is used for training, and 20% of the data is used for local model evaluation.

[0025] Table 1 A Modbus-based federated learning threat detection method of this embodiment includes the following steps: Step 1: The client executes the network traffic feature extraction method to convert the network traffic into structured data. Figure 2 As shown, the specific steps are: (1) Use Tshark API to preprocess binary network traffic into Json file data.

[0026] (2) The traffic diversion module divides the Json file data into three groups: Session, Flow, and Packet according to different feature extraction granularities. Session is determined by continuous IP data packets in a bidirectional triplet {source IP, destination IP, transport layer protocol} within 10 seconds, which provides a comprehensive view of the network behavior between two IP addresses over a period of time. Flow is uniquely identified by a bidirectional quintuple {source IP, destination IP, source port, destination port, transport layer protocol} within 10 seconds, which provides key statistical features of network node interaction under a specific port. Packet consists of a request-reply pair carrying a valid Modbus protocol payload, which can reflect changes in the current physical process of the system.

[0027] (3) The basic feature extraction module is mainly responsible for extracting features from the IT level, including quantity features, time features, byte features, protocol features, and port number features, as shown in rows 2-6 in Table 2, for a total of 16 features.

[0028] (4) The Modbus protocol feature extraction module is responsible for extracting the features of the Modbus data packet, including whether the request is responded to, Trans-ID, Unit-Id, function code, starting address of read and write operations, and address length of read and write operations, as shown in row 7 of Table 2, for a total of 6 features.

[0029] (5) Repeat (3)-(4) until all groups have been processed.

[0030] Table 2 Feature Type Feature Description quantity time The duration of sessions and flows, the average interval between the arrival of packets in a flow, and the time interval between request and response packets. 4 quantity The number of flows in the session, the number of industrial protocol packets contained in the flow, and the total number of packets in the flow 3 protocol Transport layer and application layer protocols 2 byte The number of bytes in the flow, the average byte size of the data packets in the flow, the transmission rate of the flow, the number of bytes in the request and response packets 5 port Source port and destination port 2 Modbus Whether the request packet is responded, Trans-ID, Unit-Id, function code, starting address of read and write operations, address length of read and write operations 6 Step 2: Initialize the federated learning system. The specific steps are as follows: (1) Client statistics on the range of each feature , in represents all feature ranges of client i, represents the range of the nth feature of client i, represents the minimum value of the nth feature of client i, Represents the maximum value of the nth feature of client i.

[0031] (2) The server requests the client for the feature ranges through the read input register (0x04) function code of the Modbus protocol.

[0032] (3) The client encapsulates each feature range into the Modbus protocol through the Libmodbus API and sends it to the server.

[0033] (4) The server counts all feature ranges of each client and converts the global feature range of each feature into , , , The write holding register (0x10) function code of the Modbus protocol is sent to the client. represents the global scope of all features, represents the global scope of the nth feature, represents the global minimum value of the nth feature, Represents the global maximum value of the nth feature, min{} is the minimum function, and max{} is the maximum function.

[0034] (5) After receiving the global feature range, the client returns a confirmation data packet.

[0035] (6) The server sends the model structure and hyperparameters required for federated learning training through the Modbus protocol write holding register (0x10) function code. The model structure includes 5 neural network layers and the number of neurons in each layer (22, 64, 128, 64, 26). The hyperparameters required for training include the number of federated training rounds. , learning rate , important parameter selection ratio .

[0036] (7) The server sends the model initial parameters through the Modbus protocol write holding register (0x10) function code Since the maximum number of registers that Modbus allows to operate in one request is 123, the present invention flattens the parameters of each layer of the neural network into a one-dimensional vector each time the model parameters are transmitted, and slices them according to formula (2.1).

[0037] (2.1) in is the number of parameters of the j-th layer neural network, is the number of Modbus packets required to transmit the j-th layer neural network parameters. The reason for multiplying by 2 is that Modbus needs to use two registers to store each model parameter in floating point format. Therefore, it takes In addition, during the parameter transmission process, the present invention sends the Trans-ID field for identifying the Modbus request-reply pair in order and incrementally, so that the client can clearly understand the location of the parameter to be received or uploaded, and use it as a basis for packet loss retransmission.

[0038] (7) After receiving the model parameters, the client returns a confirmation data packet.

[0039] (8) The server continuously monitors the training status of the client through the Modbus read discrete output register (0x01) function code.

[0040] Step 3: The client performs model training. The client uses the model sent by the server. Train the model on local data and upload the trained model and important parameter locations to the server. Figure 3 , the specific steps are: (1) The client uses formula (3.1) to train the model on local data and obtain the trained model parameters: (3.1) in Represents the model parameters received by the i-th client in the t-th round of federated training. Function Representatives Perform neural network loss minimization training, = 0.001 represents the learning rate.

[0041] (2) Calculate the cumulative contribution of each model parameter using formula (3.2): (3.2) in represents the cumulative contribution of the mth parameter of the client i model in the first t rounds, represents the gradient of the mth parameter in the tth round of training, is the change of the mth parameter in the tth round. It represents the contribution of the mth parameter in the tth round.

[0042] (3) Selection parameters and calculate the importance of each parameter, as shown in formula (3.3).

[0043] (3.3) in is the cumulative change of the mth parameter of the model. According to the above formula, the importance of all model parameters can be quantitatively evaluated in the present invention. The importance of all local model parameters can be expressed as , M=19456 is the parameter scale of the neural network.

[0044] (4) From The first K% maximum values ​​are selected as the important model parameters of the i-th local model, and their positions are marked by formula (3.4). Important model parameters will be marked as 1, and unimportant model parameters will be marked as 0, forming an important parameter position vector : (3.4) (5) The client generates a confirmation data packet for monitoring step (8) of step 2 to indicate the end of training.

[0045] (6) The server requests the local model parameters from the client through the read input register (0x04) function code of the Modbus protocol.

[0046] (7) The client uses formula (2.1) to set the model parameters Upload the fragments to the server.

[0047] (8) The server requests the location of important parameters from the client through the Modbus protocol's read input register (0x04) function code.

[0048] (9) Client uploads important parameter position vector .

[0049] Step 4: Server model update, the steps include: (1) The server summarizes the important parameter positions of all models to obtain the global important parameter positions , where each element It can be calculated from (4.1) (4.1) in Represents the sum of the position vectors of the mth model parameters.

[0050] (2) The server extracts those model parameters marked as important from the model , and calculated by formula (4.2) The correlation coefficient matrix of each model in .

[0051] (4.2) Where N is the number of clients. Represents the similarity coefficient vector between the important model parameters of client i and other important model parameters, Represents important model parameters for client i Important model parameters with client j , softmax() is a normalization function that ensures that the sum of each row in the matrix A is 1. Represents important model parameters for client i and important model parameters of client j The set of all joint probability distributions of is x appears in and y appears in probability. Represents the expected distance between all x and y, and its minimum value is and The EMD distance is . Stored The EMD distance of other important model parameters, and the function max() is the maximum value function.

[0052] (3) The server updates the model using formula (4.3) to form a personalized model for each client. (4.3) is the correlation coefficient between client i and other clients, and its value is obtained from the previous step. is the local model of client i, =0.7 is the balance factor.

[0053] (4) The server converts the model parameters into The model is divided into pieces and the model parameters are sent through the write holding register (0x10) function code of the Modbus protocol. The number of training rounds is t=t+1.

[0054] Step 5: Repeat steps 3 and 4 until the maximum number of training rounds T=150 is reached, and then the federated learning training ends.

[0055] Experimental verification In order to verify the effectiveness of the method proposed in this invention, we first evaluated the network traffic feature representation method proposed in this invention and the commonly used CICFlowMeter and Honeyeye feature representation methods in terms of performance and detection effect. Figure 4 The feature extraction rate results and F1 scores on different datasets of different network traffic feature representation methods are given respectively.

[0056] As shown in Table 3, CICFlowMeter counts the features of a large number of TCP connection packets when characterizing network traffic, which makes the time cost of this method relatively high. When the amount of data is small, Honeyeye shows good performance, which is mainly because this method only extracts features from data packets containing application layer protocols, and data packets without application layer protocols are directly discarded. However, as the amount of data increases, this method will cause a large amount of memory space to be occupied, thereby significantly reducing its processing speed. In contrast, the method proposed in the present invention can centrally process data packets containing application layer protocols in each data stream, thereby maintaining good performance in a large data volume environment.

[0057] Table 3 Data volume CICFlowMeter (ms) Honeyeye (ms) The method of the present invention (ms) 432 442 9 75 4664 542 120 254 32299 667 883 3439 200300 5963 7896 4276 like Figure 4 As shown in the figure, although the three feature extraction methods all achieved F1 scores above 0.75 on different data sets, the method of the present invention and the Honeyeye method achieved higher performance because they considered the characteristics of the industrial protocol part during feature extraction. In addition, the present invention simultaneously considered the features of the Session, Flow and Packet levels, making it more comprehensive in describing network behavior and more sensitive to the differences in traffic between different types, thereby achieving better detection results.

[0058] Secondly, in order to verify the effectiveness of the federated learning system, this paper sets up two experimental scenarios to compare the proposed federated learning method with the commonly used FedAVG, FedProx, Ditto, IFCA, and CFL. The two experimental scenarios are described as follows: (1) Scenario 1: In Scenario 1, each client only relies on the data provided by a specific functional entity for federated learning. Based on this assumption, this experiment created 20 clients and divided them into 4 groups. Each group of nodes only used one of the four data sets. Therefore, the data between the 4 client groups showed non-independent and identically distributed characteristics. In addition, in order to simulate more complex data distribution, the 5 clients in the same group will follow the Dirichlet method. The distribution is divided into non-independent and identically distributed is the concentration parameter. The smaller its value is, the more extreme the non-independent and identically distributed situation is.

[0059] (2) Scenario 2: Scenario 2 refers to using the data of multiple functional entities for federated learning training when the client is available. At this time, each client will have mixed data of four data sets at the same time. In this scenario, we also set up 20 clients and The distribution simulates non-independent and identically distributed data partitioning, and the data between clients does not overlap.

[0060] For various experimental scenarios, the present invention will implement local and global evaluation of the model respectively. In the local evaluation, the client will evaluate the model on the local data. In scenario one, the global evaluation refers to the client testing the model based on the same group of shared data (one of the four data sets); in scenario two, the global evaluation is to verify the model on a mixed data set. This means that before the data is divided, 20% of the data will be extracted from the five data sets as global evaluation data, and the remaining 80% of the data will be distributed to each client according to the data division method of the above different scenarios. For the two scenarios, this experiment will Parameters in They are set to 0.3 and 0.6 respectively to simulate different non-independent and identically distributed data partitioning situations.

[0061] The experiment counted the accuracy and F1 score of global and local evaluation of each method in each scene, and used the average global and local evaluation to measure the overall performance of the model. The results are shown in Table 4. Figure 5 and Figure 6The accuracy trends of each method in scenario 1-Dirichlet~(0.3) and scenario 2-Dirichlet~(0.3) are given respectively. At the same time, we also record the additional computational overhead incurred by each method in scenario 2-Dirichlet~(0.3) in each round of communication due to additional operations (compared with the traditional FedAVG method), such as Figure 7 shown.

[0062] Table 4 Since FedAVG does not consider the problem of data heterogeneity, its global evaluation and local evaluation have similar performances, both at the lowest level. The method proposed in the present invention achieves the best effect in terms of average indicators by enhancing the collaboration between similar nodes on the basis of fusing global information. The average accuracy was improved by 0.011, 0.028, 0.005 and 0.006 respectively in four different data partitioning cases, and the F1 score was improved by 0.025, 0.031, 0.003 and 0.008. The method that performs closest to the present invention is Ditto, which shows better fairness and achieves good results in global evaluation, but the two-stage optimization method requires edge nodes to be trained twice in each round of training, which makes its time cost per round 40 seconds higher than that of the present invention. FedProx did not show obvious advantages in all indicators, which shows that it is very difficult to train an excellent global model when the data is not independent and identically distributed. Combined with Figure 5 and Figure 6 It can be seen that the proposed method has a faster convergence speed, which is beneficial to reduce the communication overhead of federated learning. In contrast, FedAVG, FedProx and IFCA have greater volatility.

[0063] like Figure 7 As shown, in terms of time overhead, the present invention effectively reduces the computational overhead of client similarity through a personalized model update algorithm of important parameters. In addition, the gradient information of the model in the present invention can be automatically saved during the local model training process, so it does not bring too much time overhead and achieves good results.

[0064] Finally, this experiment evaluates the concealment of the Mobus communication scheme by the degree of attraction to external attackers. The experimental evaluation was conducted on a physical server of an Internet Data Center (IDC) equipped with 10 public IP addresses. The server is equipped with two E5-2698 V4 CPUs, 128GB of memory, and the 10 IP addresses are in the same Class C network segment. During the experiment, we deployed Modbus high-interaction honeypots on 6 of the IP addresses to simulate the behavior of real industrial control equipment, and deployed the client program of the present invention on the remaining 4 IPs, of which 2 IPs use the Modbus communication scheme proposed by the present invention to communicate with the server, and the remaining 2 IPs use the HTTP protocol commonly used in federal communications to communicate with the federal server. The server program of the present invention is deployed on two other physical servers, and uses Modbus and HTTP protocols to communicate with the corresponding edge nodes respectively. At the same time, the two servers will also act as remote master devices to access the honeypot nodes in a Modbus polling manner. The overall deployment scheme is as follows. Figure 8 shown.

[0065] The attractiveness of a device running in an industrial control system to external attackers is determined by calculating the number of communications between the attacker and the device within 10 seconds, that is, SessionLength. The larger the SessionLength, the more attractive the device is to attackers, which also means that attackers are willing to invest more effort to obtain target information. In the first month of the experiment, we only opened two IP addresses using the HTTP protocol. In the second month of the experiment, we will open 10 IP addresses at the same time and use the Wireshark tool to capture their attack traffic. The average proportion of SessionLength for each entity is as follows: Fig. 9 The “HTTP-First month” in the figure represents the session distribution of the two IP addresses using HTTP protocol for federated communication in the first month.

[0066] The performance of SessionLength for nodes using Modbus for federated communication is very similar to that of honeypots. and The percentages of the nodes using Modbus for federated communication differed by only 3.2% and 0.5%, indicating that attackers did not pay extra attention to nodes using Modbus for federated communication. Although the SessionLength of nodes using HTTP for federated communication in the second month was also concentrated in rounds 1 and 2, this finding is normal given that most of the attack behaviors captured during the experiment were scanning in nature. In addition, by comparing the session statistics of HTTP federated communication nodes in the two months before and after, it can be found that the SessionLength in the data captured in the second month showed a significant increase, especially This indicates that the use of non-Modbus protocols for communication in Modbus industrial control systems is more likely to attract the attention of attackers and prompt them to invest more attack resources.

[0067] Example 2 This embodiment provides a Modbus-based federated learning threat detection system, including: The data acquisition module is configured to acquire binary network traffic data; The preprocessing module is configured to preprocess the acquired binary network traffic data to obtain Json file data; The feature extraction module is configured to extract features from Json file data; The model training module is configured to initialize the federated learning model, perform model training using the extracted features, and obtain several important parameters of the model; The parameter module is configured to obtain the global important parameter positions by summarizing several important parameters of the model; An updating module is configured to update the model based on the global important parameter positions to obtain a personalized federated learning model; The detection module is configured to utilize a personalized federated learning model for network threat detection.

[0068] As a further embodiment, The system structure of the present invention is as follows Fig.10 As shown, it is mainly composed of a client and a server.

[0069] Server: The server is responsible for aggregating the uploaded local models in a round of federated training. The server first uses the important model parameters of all local models to calculate the similarity relationship between each client, and combines the global average model in the aggregation process to create a personalized detection model for each client. , which is then transmitted covertly to each client through industrial protocols. Multiple rounds of interaction are required between the server and the client to form the final personalized threat detection model.

[0070] Client: The client first converts network traffic into structured data using feature extraction methods. Second, the client trains the personalized detection model sent by the server on local data. , forming a local model . Then, the client selects the local model Finally, the client transmits the location of the local model and important model parameters to the server through the Modbus protocol.

[0071] A computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded and executed by a processor of a terminal device, a Modbus-based federated learning threat detection method.

[0072] A terminal device includes a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, wherein the instructions are suitable for being loaded by the processor and executing the Modbus-based federated learning threat detection method.

[0073] The above are all preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A Modbus-based federated learning threat detection method, characterized in that: include: Get binary network traffic data; Preprocess the acquired binary network traffic data to obtain Json file data; Extract features from Json file data; Initialize the federated learning model, use the extracted features to train the model, and obtain several important parameters of the model; By summarizing several important parameters of the model, the global important parameter positions are obtained; Update the model based on the global important parameter positions to obtain a personalized federated learning model; Cyber ​​threat detection using personalized federated learning models.

2. According to a Modbus-based federated learning threat detection method according to claim 1, it is characterized in that: include: The acquisition of binary network traffic data includes acquiring five data sets: industrial control traffic data, low-interaction industrial honeypot data, high-interaction industrial honeypot data, attack tool data, and mixed data. The number of clients is set to N=20, the number of training rounds is T=150, the proportion of important parameters is K%=5%, and the balance factor is , learning rate , 80% of the data in each client is used for training, and 20% of the data is used for local model evaluation.

3. According to a Modbus-based federated learning threat detection method according to claim 2, it is characterized in that: include: The obtained binary network traffic data is preprocessed to obtain Json file data, including using TsharkAPI to preprocess the binary network traffic into Json file data, and dividing the Json file data into three groups of Session, Flow and Packet according to different feature extraction granularities.

4. The Modbus-based federated learning threat detection method according to claim 3, characterized in that: include: The feature extraction of the Json file data includes basic feature extraction and Modbus protocol feature extraction, wherein the basic feature extraction includes extracting features from the IT level, including quantity features, time features, byte features, protocol features and port number features; the Modbus protocol feature extraction includes extracting features related to the Modbus data packet, including whether the request is responded to, Trans-ID, Unit-Id, function code, starting address of read and write operations, and address length of read and write operations.

5. The Modbus-based federated learning threat detection method according to claim 4, characterized in that: include: The method uses the extracted features to train the model and obtain several important parameters of the model, including training a federated learning model based on local data to obtain the trained model parameters, using a formula to calculate the cumulative contribution of each model parameter to obtain the importance of each parameter, selecting several parameters as important model parameters of the local model according to the importance, and marking the positions of all important parameters.

6. The Modbus-based federated learning threat detection method according to claim 5, characterized in that: include: The above method obtains the global important parameter positions by summarizing several important parameters of the model, including extracting the marked important model parameters from the model, and calculating the correlation coefficient matrix of each model according to the important model parameters, which is expressed as: （4.2） Among them, the correlation coefficient matrix ; N is the number of clients, Represents the similarity coefficient vector between the important model parameters of client i and other important model parameters, Represents important model parameters for client i Important model parameters with client j Similarity coefficient, softmax() is a normalization function, which ensures that the cumulative sum of each row in matrix A is 1. Represents important model parameters for client i and important model parameters of client j The set of all joint probability distributions of is x appears in and y appears in The probability of Represents the expected distance between all x and y, and its minimum value is and The EMD distance is , Stored The EMD distance of other important model parameters, and the function max() is the maximum value function.

7. The Modbus-based federated learning threat detection method according to claim 6, characterized in that: include: The method of updating the model based on the global important parameter position to obtain a personalized model includes updating the model based on a correlation coefficient formula to form a personalized model for each client. The correlation coefficient formula is expressed as: is the correlation coefficient between client i and other clients, is the local model of client i, =0.7 is the balance factor.

8. A Modbus-based federated learning threat detection system, characterized in that: include: The data acquisition module is configured to acquire binary network traffic data; The preprocessing module is configured to preprocess the acquired binary network traffic data to obtain Json file data; The feature extraction module is configured to extract features from Json file data; The model training module is configured to initialize the federated learning model, perform model training using the extracted features, and obtain several important parameters of the model; The parameter module is configured to obtain the global important parameter positions by summarizing several important parameters of the model; An update module is configured to update the model based on the global important parameter positions to obtain a personalized federated learning model; The detection module is configured to utilize a personalized federated learning model for network threat detection.

9. A computer-readable storage medium storing a plurality of instructions, characterized in that: The instructions are suitable for being loaded by a processor of a terminal device and executing the method according to claim 1 .

10. A terminal device, comprising a processor and a computer-readable storage medium, wherein the processor is used to implement each instruction; and the computer-readable storage medium is used to store multiple instructions, characterized in that: The instructions are suitable for being loaded by a processor and executing the method as claimed in claim 1 .

Images