Intrusion detection model construction method fused with badger algorithm

Abstract

The invention provides an intrusion detection model construction method fused with a badger algorithm, and the method comprises the steps: S1, initializing the model parameters of a global LSTM model, and transmitting the model parameters to all nodes; s2, each node endows each node with a comprehensive score according to the model parameters and the performance parameters of the node; s3, selecting a node with the highest comprehensive score as a leader node, loading the original LSTM model by other nodes, independently training the original LSTM model by using local data, generating a parameter change set, and then sending the parameter change set to the leader node; s4, the leader node adopts a badger algorithm to aggregate the global LSTM model according to the parameter change set; and S5, repeating the steps S2-S4 until the maximum number of iterations is reached, and obtaining an intrusion detection model. The problems that in the prior art, training data privacy safety of an intrusion detection model is low, and model training efficiency and detection precision are low are solved.

Description

Technical Field

[0001] The present invention relates to the field of mobile communication technology, and in particular to a method for constructing an intrusion detection model integrating a honey badger algorithm. Background Art

[0002] With the rapid development of the Internet of Things (IoT) and smart devices, emerging network environments such as low-altitude intelligent networks have gradually become popular, but they have brought increasingly complex network security challenges. Due to the large number of devices and their dispersion, centralized intrusion detection systems can no longer effectively respond to real-time security threats in distributed environments. To this end, Federated Learning (FL), as a distributed model training method, allows each device to collaboratively train models without sharing original data, effectively protecting data privacy. However, traditional federated learning has problems with local optimality and insufficient global search capabilities when aggregating models, resulting in limited intrusion detection effects in complex dynamic environments. Summary of the invention

[0003] In view of the deficiencies in the prior art, the present invention provides a method for constructing an intrusion detection model integrating a honey badger algorithm, which solves the problems in the prior art of low privacy security of training data of the intrusion detection model, and low model training efficiency and detection accuracy.

[0004] According to an embodiment of the present invention, a method for constructing an intrusion detection model integrating a honey badger algorithm includes:

[0005] S1: Initialize the model parameters of the global LSTM model and send the model parameters to all nodes;

[0006] S2: Each node is assigned a comprehensive score based on the model parameters and its own performance parameters;

[0007] S3: The node with the highest comprehensive score is selected as the leader node. The other nodes load the original LSTM model and train the original LSTM model independently using local data to generate a parameter change set, which is then sent to the leader node.

[0008] S4: The leader node aggregates the global LSTM model using the Honey Badger algorithm based on the parameter change set;

[0009] S5: Repeat steps S2-S4 until the maximum number of iterations is reached to obtain an intrusion detection model.

[0010] Preferably, the performance parameters include model contribution and node online time;

[0011] Before S1, each node initializes the built-in LSTM model and obtains an initial model contribution and node online time based on the performance of the LSTM model and the current online time.

[0012] Preferably, a threshold is set for the number of times each node is selected as a leader node. When the number exceeds the threshold, the node will be automatically excluded when the leader node is selected next time, and it is assumed that the LSTM model of the node has converged.

[0013] Preferably, in S2, a reputation score can be assigned to each node based on the model parameters and its own performance parameters, and then the computing power of each node is evaluated, and the evaluation result is weighted and fused with the reputation score to obtain a comprehensive score.

[0014] Preferably, the evaluation formula of the computing capability is as follows:

[0015]

[0016] Among them, CP is the CPU performance of the node, M is the memory capacity, and B is the network bandwidth.

[0017] Preferably, in S3, after other nodes train the original LSTM model, the performance parameters of the original LSTM model of the node will be updated.

[0018] Preferably, after the other nodes train the original LSTM model, the changes in the model parameters before and after the training are recorded to obtain a parameter change set;

[0019] The parameter variation set is as follows:

[0020] Input gate: i t =σ(W i ·[h t-1 ,x t ]+b i );

[0021] Forget gate: f t =σ(W f ·[h t-1 ,x t ]+b f );

[0022] Output gate: o t =σ(W o ·[h t-1 ,x t ]+b o );

[0023] Unit status update: C t =f t ·C t-1 +it tanh(W C ·[h t-1 ,x t ]+b C );

[0024] Hidden state: h t =o t tanh(C t ).

[0025] Preferably, the method of aggregating the global LSTM model using the Honey Badger algorithm includes:

[0026] Select the parameter change sets with the largest and smallest changes from the parameter change sets, and then randomly perturb the two parameter change sets to generate exploration parameters;

[0027] Count all parameter change sets and generate development parameters;

[0028] The exploration parameters and development parameters are weightedly fused to generate an optimized parameter set, and the global LSTM model updates the parameters according to the optimized parameter set.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] By selecting a leader node, other nodes use their own collected data to load the global LSTM model independently for training, and then the leader node aggregates the training results of other nodes. Since the data of each node is relatively independent and not shared with each other, the security of the training data is effectively protected. In addition, the leader node is selected and the LSTM model is trained based on the reputation score and computing power, avoiding the bottleneck problem caused by low-performance nodes serving as leaders, ensuring that the leader node selection not only depends on computing resources, but also takes into account historical contributions and stability. This can enhance the robustness and accuracy of the global model and help improve detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 A flow chart for constructing an intrusion detection model according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0033] like Figure 1 As shown, the embodiment of the present invention proposes a method for constructing an intrusion detection model integrating a honey badger algorithm, including:

[0034] S1: Initialize the model parameters of the global LSTM model and send the model parameters to all nodes.

[0035] Initialize the parameters θ0 of the global LSTM model and distribute them to the nodes. Each node has its own original LSTM model θ locally. i =θ0;

[0036] S2: Each node is assigned a comprehensive score based on the model parameters and its own performance parameters;

[0037] Each node P i An initial reputation score R is assigned based on its historical performance i The initial value of the reputation score can be determined by the following factors:

[0038] (1) Model contribution C i : Nodes are scored based on their contribution to model training in previous iterations. Contribution can be based on the quality and size of model updates.

[0039]

[0040] (2) Node online time U i : Record the online time of the node during the training period. The higher the node stability and the longer the online time, the higher the reputation score.

[0041]

[0042] Among them, T i Represents node P i The online time during the training period, T total Indicates the total duration of participation in training.

[0043] Combining the above two factors, the reputation score of each node is initialized:

[0044]

[0045] Wherein, α and β are weight coefficients, satisfying α+β=1.

[0046] The group learning system will test the computing power of each node. Evaluated by the following factors:

[0047] CPU performance CP i : Based on the computing power of the node device (such as CPU frequency and core number).

[0048] Memory capacity M i : Consider the size of the node memory.

[0049] Network bandwidth B i : The upload and download speed of the nodes, ensuring the efficiency of data exchange during aggregation.

[0050] The computing power of each node is scored as follows:

[0051]

[0052] Among them, γ, δ and ε are the weights of different computing capability indicators, satisfying γ+δ+ε=1.

[0053] For each node, its reputation score R i and computing power The comprehensive score S of each node is calculated by weighted formula i :

[0054]

[0055] Among them, λ is a parameter that controls the trade-off between reputation score and computing power, 0≤λ≤1.

[0056] Selecting leader nodes and training LSTM models based on reputation scores and computing power avoids bottleneck problems caused by low-performance nodes serving as leaders, ensuring that leader node selection not only depends on computing resources but also takes into account historical contributions and stability. This can enhance the robustness and accuracy of the global model and help improve detection accuracy.

[0057] A threshold is set for the number of times each node is selected as a leader node. When the number exceeds the threshold, the node will be automatically excluded when the leader node is selected next time, and the LSTM model of the node is assumed to have converged.

[0058] S3: The node with the highest comprehensive score is selected as the leader node. The other nodes load the original LSTM model and train the original LSTM model independently using local data to generate a parameter change set, which is then sent to the leader node.

[0059] According to the comprehensive score, the node with the highest comprehensive score is selected as the leader node. There is a threshold for the number of times each node is selected as the leader node. When the number exceeds the threshold, the node will be automatically excluded when the leader node is selected next time, and it is assumed that the LSTM model of the node has converged.

[0060] After training the original LSTM model, other nodes record the changes in model parameters before and after training to obtain the parameter change set Δθ i ;

[0061] The parameter variation set is as follows:

[0062] ① Input gate: i t =σ(W i ·[h t-1 ,x t ]+b i);

[0063] ②Forget gate: f t =σ(W f ·[h t-1 ,x t ]+b f );

[0064] ③Output gate: o t =σ(W o ·[h t-1 ,x t ]+b o );

[0065] ④Unit status update: C t =f t ·C t-1 +i t tanh(W C ·[h t-1 ,x t ]+b C );

[0066] ⑤Hidden state: h t =o t tanh(C t ).

[0067] After that, other nodes will i Sent to the leader node.

[0068] S4: The leader node aggregates the global LSTM model using the Honey Badger algorithm based on the parameter change set.

[0069] According to the calculated comprehensive score S i , select the node P with the highest score leader As the leader node of the current round, it assumes the server role and is responsible for executing the model aggregation task of the Honey Badger algorithm.

[0070] The Honey Badger Algorithm first performs global exploration to simulate the search process for the global optimal solution. The leader node selects the parameter change sets with the largest and smallest changes from the parameter change sets, and randomly perturbs the two parameter change sets to generate exploration parameters:

[0071]

[0072] Among them, φ is the exploration rate, rand(0,1) is the random number generator, Δθ max and Δθ min are the maximum and minimum values ​​in the local update, respectively.

[0073] While exploring the global optimal solution, the Honey Badger algorithm also performs local development. It generates development parameters by counting the parameter change sets uploaded by each node through the local model uploaded by each node:

[0074]

[0075] Among them, ρ is the development rate.

[0076] (3) Global Update

[0077] Combining the exploration parameters and development parameters, the parameters of the global LSTM model are finally updated through the following formula:

[0078]

[0079] Among them, ω is the balance weight parameter of exploration and development. The balance weight parameter ω of the global model update is dynamically adjusted by the following formula:

[0080]

[0081] Among them, τ is the adjustment parameter, t is the current iteration number, t0 is the intermediate balance point, and ω gradually transitions from exploration to development over time.

[0082] By selecting a leader node, other nodes use their own collected data to load the global LSTM model independently for training, and then the leader node aggregates the training results of other nodes. Since the data of each node is relatively independent and not shared with each other, the security of the training data is effectively protected.

[0083] Then, steps S2-S4 are repeated until the maximum number of iterations is reached to obtain the intrusion detection model.

[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A method for constructing an intrusion detection model integrating a honey badger algorithm, characterized in that: include: S1: Initialize the model parameters of the global LSTM model and send the model parameters to all nodes; S2: Each node is assigned a comprehensive score based on the model parameters and its own performance parameters; S3: The node with the highest comprehensive score is selected as the leader node. The other nodes load the original LSTM model and train the original LSTM model independently using local data to generate a parameter change set, which is then sent to the leader node. S4: The leader node aggregates the global LSTM model using the Honey Badger algorithm based on the parameter change set; S5: Repeat steps S2-S4 until the maximum number of iterations is reached to obtain an intrusion detection model.

2. A method for constructing an intrusion detection model integrating a honey badger algorithm as claimed in claim 1, characterized in that: The performance parameters include model contribution and node online time; Before S1, each node initializes the built-in LSTM model and obtains an initial model contribution and node online time based on the performance of the LSTM model and the current online time.

3. The method for constructing an intrusion detection model integrating a honey badger algorithm as claimed in claim 1, characterized in that: A threshold is set for the number of times each node is selected as a leader node. When the number exceeds the threshold, the node will be automatically excluded when the leader node is selected next time, and the LSTM model of the node is assumed to have converged.

4. The method for constructing an intrusion detection model integrating a honey badger algorithm as claimed in claim 1, characterized in that: In S2, a reputation score can be assigned to each node based on the model parameters and its own performance parameters. The computing power of each node is then evaluated, and the evaluation results are weighted and fused with the reputation score to obtain a comprehensive score.

5. The method for constructing an intrusion detection model integrating a honey badger algorithm as claimed in claim 1, characterized in that: The evaluation formula of the computing power is as follows: P i compute =γ·CP i +δ·M i +ε·B i Among them, CP is the CPU performance of the node, M is the memory capacity, and B is the network bandwidth.

6. The method for constructing an intrusion detection model integrating a honey badger algorithm as claimed in claim 1, characterized in that: In S3, after other nodes train the original LSTM model, the performance parameters of the original LSTM model of this node will be updated.

7. The method for constructing an intrusion detection model integrating a honey badger algorithm as claimed in claim 1, characterized in that: After the other nodes train the original LSTM model, they record the changes in the model parameters before and after the training to obtain a parameter change set; The parameter variation set is as follows: Input gate: i t =σ(W i ·[h t-1 ,x t ]+b i ); Forget gate: f t =σ(W f ·[h t-1 ,x t ]+b f ); Output gate: o t =σ(W o ·[h t-1 ,x t ]+b o ); Unit status update: C t =f t ·C t-1 +i t tanh(W C ·[h t-1 ,x t ]+b C ); Hidden state: h t =o t tanh(C t ).

8. The method for constructing an intrusion detection model integrating the honey badger algorithm as claimed in claim 7, characterized in that: Methods for aggregating the global LSTM model using the Honey Badger algorithm include: Select the parameter change sets with the largest and smallest changes from the parameter change sets, and then randomly perturb the two parameter change sets to generate exploration parameters; Count all parameter change sets and generate development parameters; The exploration parameters and development parameters are weightedly fused to generate an optimized parameter set, and the global LSTM model updates the parameters according to the optimized parameter set.

Images