A method for constructing an intrusion detection model by fusing honey badger algorithm
By introducing the honey badger algorithm into federated learning, nodes with high comprehensive scores are selected as leader nodes for model aggregation, which solves the problems of local optima and insufficient global search in traditional federated learning, and achieves more efficient and secure intrusion detection results.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- CHONGQING COLLEGE OF ELECTRONICS ENG
- Filing Date
- 2024-11-22
- Publication Date
- 2026-06-05
Smart Images
Figure CN119544299B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of mobile communication technology, and in particular to a method for constructing an intrusion detection model that integrates the honey badger algorithm. Background Technology
[0002] With the rapid development of the Internet of Things (IoT) and smart devices, emerging network environments such as low-altitude intelligent networks are becoming increasingly common, but they also bring increasingly complex cybersecurity challenges. Due to the large number and dispersed nature of these devices, centralized intrusion detection systems are no longer efficient in dealing with real-time security threats in distributed environments. To address this, Federated Learning (FL), as a distributed model training method, allows devices to collaboratively train models without sharing raw data, effectively protecting data privacy. However, traditional federated learning suffers from local optima and insufficient global search capabilities during model aggregation, resulting in limited intrusion detection effectiveness in complex and dynamic environments. Summary of the Invention
[0003] To address the shortcomings of existing technologies, this invention provides a method for constructing an intrusion detection model that integrates the honey badger algorithm. This method solves the problems of low privacy and security of training data, as well as low training efficiency and detection accuracy in existing intrusion detection models.
[0004] According to an embodiment of the present invention, a method for constructing an intrusion detection model incorporating the honey badger algorithm includes:
[0005] S1: Initialize the model parameters of the global LSTM model and send the model parameters to all nodes;
[0006] S2: Each node is assigned a comprehensive score based on the model parameters and its own performance parameters;
[0007] S3: Select the node with the highest comprehensive score as the leader node. Other nodes load the original LSTM model and independently train the original LSTM model using local data to generate a parameter change set. Then, send the parameter change set to the leader node.
[0008] S4: The leader node aggregates the global LSTM model based on the parameter change set using the honey badger algorithm;
[0009] S5: Repeat steps S2-S4 until the maximum number of iterations is reached to obtain the intrusion detection model.
[0010] Preferably, the performance parameters include model contribution and node online duration;
[0011] Before S1, each node initializes the built-in LSTM model and obtains an initial model contribution and node online time based on the performance of the LSTM model and the current online time.
[0012] Preferably, a threshold is set for the number of times each node is selected as the leader node. When the number of times exceeds the threshold, the node will be automatically excluded when selecting the leader node next time, and it will be assumed that the LSTM model of the node has converged.
[0013] Preferably, in S2, a reputation score can be assigned to each node based on the model parameters and its own performance parameters. Then, the computing power of each node is evaluated, and the evaluation results are weighted and fused with the reputation score to obtain a comprehensive score.
[0014] Preferably, the formula for evaluating computing power is as follows:
[0015]
[0016] Where CP represents the node's CPU performance, M represents the memory capacity, and B represents the network bandwidth.
[0017] Preferably, in S3, after other nodes train the original LSTM model, they will update the performance parameters of the original LSTM model of that node.
[0018] Preferably, after other nodes train the original LSTM model, they record the changes in model parameters before and after training to obtain a parameter change set.
[0019] The set of parameter variations is as follows:
[0020] Input gate: i t =σ(W i ·[h t-1 ,x t ]+b i );
[0021] Forgotten Gate: f t =σ(W f ·[h t-1 ,x t ]+b f );
[0022] Output gate: o t =σ(W o ·[h t-1 ,x t ]+b o );
[0023] Unit state update: C t =f t ·C t-1 +it ·tanh(W C ·[h t-1 ,x t ]+b C );
[0024] Hidden state: h t =o t ·tanh(C t ).
[0025] Preferably, the method of using the honey badger algorithm to aggregate the global LSTM model includes:
[0026] The parameter change sets with the largest and smallest changes are selected from the parameter change sets. Then, the two parameter change sets are randomly perturbed to generate exploration parameters.
[0027] Collect all parameter change sets and generate development parameters;
[0028] The exploration parameters and development parameters are weighted and fused to generate an optimized parameter set, and the global LSTM model updates the parameters based on the optimized parameter set.
[0029] Compared with the prior art, the present invention has the following beneficial effects:
[0030] By selecting a leader node, other nodes independently train the global LSTM model using their own collected data. The leader node then aggregates the training results from the other nodes. Since each node's data is relatively independent and not shared, the security of the training data is effectively protected. In addition, selecting the leader node and training the LSTM model based on reputation score and computing power avoids the bottleneck problem caused by low-performance nodes serving as leaders. This ensures that the selection of the leader node not only depends on computing resources but also takes into account historical contributions and stability. This enhances the robustness and accuracy of the global model and helps improve detection precision. Attached Figure Description
[0031] Figure 1 This is a flowchart illustrating the construction process of the intrusion detection model in an embodiment of the present invention. Detailed Implementation
[0032] The technical solutions of the present invention will be further described below with reference to the accompanying drawings and embodiments.
[0033] like Figure 1 As shown in the figure, this invention proposes a method for constructing an intrusion detection model that integrates the honey badger algorithm, including:
[0034] S1: Initialize the model parameters of the global LSTM model and send the model parameters to all nodes.
[0035] Initialize the parameters θ0 of the global LSTM model and distribute them to the nodes. Each node has its own local original LSTM model θ. i =θ0;
[0036] S2: Each node is assigned a comprehensive score based on the model parameters and its own performance parameters;
[0037] Each node P i An initial credit score R will be assigned based on their historical performance. i The initial value of a credit score can be determined by the following factors:
[0038] (1) Model contribution C i This involves scoring nodes based on their contribution to model training in previous iterations. Contribution can be based on the quality and magnitude of model updates.
[0039]
[0040] (2) Node online duration U i Record the online time of nodes during training. The higher the node stability and the longer the online time, the higher the reputation score.
[0041]
[0042] Among them, T i Represents node P i During the training period, T total This indicates the total duration of participation in training.
[0043] Taking into account the two factors mentioned above, initialize the reputation score for each node:
[0044]
[0045] Here, α and β are weighting coefficients, satisfying α+β=1.
[0046] The swarm learning system will test the computing power of each node. The following factors were evaluated:
[0047] CPU performance CP i Based on the computing power of the node device (such as CPU frequency and number of cores).
[0048] Memory capacity M i Consider the size of the node's memory.
[0049] Network bandwidth B i The upload and download speeds of nodes ensure efficient data exchange during aggregation.
[0050] The computing power score for each node is:
[0051]
[0052] Where γ, δ, and ε are the weights of different computing power indicators, satisfying γ+δ+ε=1.
[0053] For each node, its reputation score R is considered. i and computing power The overall score S for each node is calculated using a weighted formula. i :
[0054]
[0055] Where λ is a parameter that controls the trade-off between reputation score and computing power, 0≤λ≤1.
[0056] By selecting leader nodes and training LSTM models using reputation scores and computing power, the bottleneck problem caused by low-performance nodes serving as leaders is avoided. This ensures that the selection of leader nodes not only depends on computing resources but also takes into account historical contributions and stability. This enhances the robustness and accuracy of the global model and helps improve detection precision.
[0057] There is a threshold for the number of times each node can be selected as the leader node. When the number of times exceeds the threshold, the node will be automatically excluded in the next selection of the leader node, and it will be assumed that the LSTM model of the node has converged.
[0058] S3: Select the node with the highest comprehensive score as the leader node. Other nodes load the original LSTM model and independently train the original LSTM model using local data to generate a parameter change set. Then, send the parameter change set to the leader node.
[0059] Based on the overall score, the node with the highest overall score is selected as the leader node. There is a threshold for the number of times each node can be selected as the leader node. When the number of times exceeds the threshold, the node will be automatically excluded in the next selection of the leader node, and it will be assumed that the LSTM model of the node has converged.
[0060] Other nodes record the changes in model parameters before and after training the original LSTM model, obtaining the parameter change set Δθ. i ;
[0061] The set of parameter variations is as follows:
[0062] ① Input gate: i t =σ(W i ·[h t-1 ,x t ]+b i);
[0063] ② Gate of Oblivion: f t =σ(W f ·[h t-1 ,x t ]+b f );
[0064] ③ Output gate: o t =σ(W o ·[h t-1 ,x t ]+b o );
[0065] ④ Unit state update: C t =f t ·C t-1 +i t ·tanh(W C ·[h t-1 ,x t ]+b C );
[0066] ⑤ Hidden state: h t =o t ·tanh(C t ).
[0067] Then other nodes will Δθ i Send to the leader node.
[0068] S4: The leader node aggregates the global LSTM model using the honey badger algorithm based on the parameter change set.
[0069] Based on the calculated comprehensive score S i Select the node P with the highest score. leader As the leader node in the current round, it assumes the role of server and is responsible for executing the model aggregation task of the honey badger algorithm.
[0070] The Honey Badger algorithm first performs a global exploration, simulating the search process for the global optimum. The leader node selects the sets of parameter changes with the largest and smallest changes from the set of parameter changes, and randomly perturbs these two sets to generate exploration parameters.
[0071]
[0072] Where φ is the exploration rate, rand(0,1) is the random number generator, and Δθ max and Δθ min These represent the maximum and minimum values in the local update, respectively.
[0073] While exploring the global optimum, the honey badger algorithm also performs local development, generating development parameters by statistically analyzing the parameter change sets uploaded by each node based on the local model.
[0074]
[0075] Where ρ is the development rate.
[0076] (3) Global Update
[0077] Combining the exploration and development parameters, the parameters of the global LSTM model are finally updated using the following formula:
[0078]
[0079] Where ω is the balance weight parameter for exploration and development, and the balance weight parameter ω for global model updates is dynamically adjusted using the following formula:
[0080]
[0081] Where τ is the adjustment parameter, t is the current iteration number, t0 is the intermediate equilibrium point, and ω gradually transitions from exploration to development over time.
[0082] By selecting a leader node, other nodes independently load the global LSTM model using their own collected data and train it independently. Then, the leader node aggregates the training results of the other nodes. Since the data of each node is relatively independent and not shared with each other, the security of the training data is effectively protected.
[0083] Then repeat steps S2-S4 until the maximum number of iterations is reached to obtain the intrusion detection model.
[0084] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.
Claims
1. A method for constructing an intrusion detection model integrating the honey badger algorithm, characterized in that: include: S1: Initialize the model parameters of the global LSTM model and send the model parameters to all nodes; S2: Each node is assigned a comprehensive score based on the model parameters and its own performance parameters; S3: Select the node with the highest comprehensive score as the leader node. Other nodes load the original LSTM model and independently train the original LSTM model using local data to generate a parameter change set. Then, send the parameter change set to the leader node. S4: The leader node aggregates the global LSTM model based on the parameter change set using the honey badger algorithm, including: selecting the parameter change sets with the largest and smallest changes from the parameter change set, and then randomly perturbing the two parameter change sets to generate exploration parameters. in, For exploration rate, rand(0,1) is a random number generator. and These represent the maximum and minimum values in the local update; Analyze all parameter changes to generate development parameters: in, For development rate; The exploration and development parameters are weighted and fused to generate an optimized parameter set. The global LSTM model then updates its parameters based on this optimized parameter set. in, The balance weight parameters for global model updates are used for exploration and development. Dynamically adjust using the following formula: in, To adjust the parameters, t is the current iteration number. As the intermediate equilibrium point, Over time, the process gradually transitioned from exploration to development. S5: Repeat steps S2-S4 until the maximum number of iterations is reached to obtain the intrusion detection model.
2. The method for constructing an intrusion detection model incorporating the honey badger algorithm as described in claim 1, characterized in that: The performance parameters include model contribution and node online duration; Before S1, each node initializes the built-in LSTM model and obtains an initial model contribution and node online time based on the performance of the LSTM model and the current online time.
3. The method for constructing an intrusion detection model incorporating the honey badger algorithm as described in claim 1, characterized in that: There is a threshold for the number of times each node can be selected as the leader node. When the number of times exceeds the threshold, the node will be automatically excluded in the next selection of the leader node, and it will be assumed that the LSTM model of the node has converged.
4. The method for constructing an intrusion detection model incorporating the honey badger algorithm as described in claim 1, characterized in that: In S2, a reputation score can be assigned to each node based on the model parameters and its own performance parameters. Then, the computing power of each node is evaluated, and the evaluation results are weighted and fused with the reputation score to obtain a comprehensive score.
5. The method for constructing an intrusion detection model incorporating the honey badger algorithm as described in claim 4, characterized in that: The formula for evaluating computing power is as follows: Where CP represents the node's CPU performance, M represents the memory capacity, and B represents the network bandwidth.
6. The method for constructing an intrusion detection model incorporating the honey badger algorithm as described in claim 1, characterized in that: In S3, after other nodes train the original LSTM model, they will update the performance parameters of the original LSTM model of that node.
7. The method for constructing an intrusion detection model incorporating the honey badger algorithm as described in claim 1, characterized in that: After other nodes train the original LSTM model, they record the changes in model parameters before and after training to obtain a set of parameter changes. The set of parameter variations is as follows: Input Gate: ; Forgotten Gate: ; Output gate: ; Cell status update: ; Hidden state: .