Device security assessment method and system based on edge computing power compensation and privacy computing

Abstract

The present invention discloses a device security assessment method and system based on edge computing power compensation and privacy computing, which relates to the field of security assessment technology, including a data acquisition and preprocessing unit, a data expansion and enhancement unit, a device security assessment model training unit, a security assessment unit, a privacy computing and security assurance unit, and a system management and feedback unit. The present invention uses a generative adversarial network based on weight decay for sample generation of device network data, and through dynamic monitoring of data feature distribution and adaptive noise modulation, the generated samples are consistent with the real device network data in multi-dimensional characteristics. The present invention uses an extreme learning machine based on damping factor as a classifier model, and improves the privacy protection capability of the device security assessment model through a distributed federated learning architecture.

Description

Technical Field

[0001] The present invention relates to the field of security assessment technology, and in particular to a device security assessment method and system based on edge computing power compensation and privacy computing. Background Art

[0002] With the rapid development of the Internet of Things and the Industrial Internet, the scale and complexity of device networks continue to increase, and the security issues of devices are becoming increasingly prominent. There are many types of abnormal behaviors and security threats in device networks, including DDoS attacks, memory overflows, data leaks, etc. These threats may cause device failure, data leakage, and even system crashes.

[0003] In the prior art, a Chinese invention patent with publication number CN119204709A proposes an AI-based intelligent risk assessment system and method for scientific and technological equipment. The system includes: a multidimensional data and model building module collects multidimensional parameters of equipment operation, performs correlation analysis on the relationship between parameters, extracts the characteristics of each parameter, and constructs an equipment operation status model. The present invention can accurately identify abnormal points in the operation process by normalizing the multidimensional parameters of the equipment and analyzing the correlation between parameters, and according to the entropy value fluctuation of the parameter time series, and provides an efficient abnormality detection method by conducting an in-depth analysis of the trend and degree of the entropy value mutation point, so that potential risks can be exposed in advance. The extreme value deviation during the operation of the equipment is analyzed, and the future change trend of the parameters is predicted, so that the critical state of the equipment can be judged in advance, which provides forward-looking information for risk management and avoids the operation risk caused by extreme deviation; the Chinese invention patent with publication number CN119201510A proposes a memory fault processing method, device, electronic device and readable storage medium, in which the electronic device can determine the first storage unit of the fault and isolate the first storage unit. The electronic device can perform stress testing on the first storage unit to obtain the fault level of the first storage unit. The electronic device performs corresponding operations on the first storage unit according to the fault level of the first storage unit, wherein when the fault level of the first storage unit indicates that the first storage unit is at the first risk level, the operation includes releasing the isolation of the first storage unit. In the present application, after isolating the faulty storage unit, the storage unit can also be stress tested to obtain the true fault level of the storage unit. Among them, when the fault level of the first storage unit is the first risk level, the electronic device can release the isolation of the first storage unit, the first storage unit can continue to be used, and the number of available storage units can be increased; the Chinese invention patent with publication number CN119180579A proposes a method, apparatus, device and readable medium for abnormal evaluation of waybills. The method includes: determining a triple including a target waybill, a target initiator of the target waybill, and a target operator for delivery of the target waybill, wherein the object transported by the target waybill is marked as having a lost behavior; determining a target subgraph matching the triple from a multidimensional heterogeneous graph; determining a first abnormality probability of the triple based on the determined target subgraph; determining a second abnormality probability of the triple based on relevant information of the target waybill, the target initiator, and the target operator in the triple using a trained first machine learning model; and determining an abnormality evaluation result for the triple based on relevant information of the triple, the first abnormality probability, and the second abnormality probability using a trained second machine learning model, wherein the abnormality evaluation result indicates whether the loss behavior of the target waybill is a risky behavior.

[0004] The existing technology has the following shortcomings: 1. In the task of equipment security assessment, the existing generation method lacks fine-grained modeling of the multi-dimensional characteristics of equipment network data, and the authenticity and distribution consistency of the generated samples are poor; 2. In the task of equipment security assessment, the traditional generative adversarial network is prone to gradient vanishing or mode collapse problems when processing high-dimensional equipment network data, resulting in the inability to effectively enhance the generalization ability of the model by expanding the samples; 3. In the task of equipment security assessment, the traditional classification algorithm has an overfitting problem when processing high-dimensional nonlinear equipment network data, and it is difficult to effectively distinguish between normal states and abnormal categories; 4. In the task of equipment security assessment, there is a lack of feature selection mechanism, and redundant features have a large interference on model training, resulting in a decrease in classification performance; 5. In the task of equipment security assessment, for the problem of uneven distribution of data categories, it is difficult for the existing methods to improve the classification accuracy of small categories; 6. In the task of equipment security assessment, the traditional algorithm does not provide sufficient data privacy protection and cannot meet the privacy requirements of equipment network data processing. Summary of the invention

[0005] The technical problem to be solved by the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a device security assessment method and system based on edge computing power compensation and privacy computing.

[0006] The technical solution adopted to solve the above technical problems is: a device security assessment method based on edge computing power compensation and privacy computing, including the following steps: S1, collect and preprocess data, and manually label the collected data, and the labeled categories include "label 0, indicating normal equipment" and "label 1, indicating abnormal equipment"; S2, generate device network data based on the generative adversarial network with weight decay, and expand and enhance the data; S3, in the distributed federated learning architecture, use the extreme learning machine algorithm based on damping factor as the classifier model; S4, use the machine learning model to evaluate and classify the security status of the device, and through edge computing power compensation, complete part of the computing tasks locally, reduce bandwidth pressure and response time, and improve real-time detection capabilities; S5, use privacy computing technology to ensure data security, protect the privacy of user data and the security of system operation; S6, monitor and optimize the operating status of the system, provide users with intuitive feedback and operation interface, and monitor the operating status of edge devices and central servers in real time.

[0007] Furthermore, the attributes of the data in S1 include: response time , Equipment temperature , Processing Capacity 、CPU usage , memory usage , bandwidth usage , Safety score , location information , User operation type , Number of tasks .

[0008] Furthermore, the training process of the weight decay-based generative adversarial network in S2 includes the following steps:

[0009] S201, initialize the network parameters of the generator and the discriminator. Through the initialization strategy, ensure the balanced training of the generator and the discriminator. The parameter initialization method is expressed as:

[0010]

[0011]

[0012] In the formula, is the weight of the generator, is the variance at initialization, is the weight of the discriminator, Initialize the function for the generator's parameters, is the parameter initialization function of the discriminator, the parameter initialization function of the generator and the parameter initialization function of the discriminator are normal distribution functions with a mean of 0. and All of them are subject to the mean of 0 and the variance of Normal distribution of

[0013] S202, during the training process, dynamically monitor the characteristic distribution of the real device network data, update the learning target planning strategy according to the statistical characteristics and annotation information of the collected device network data, and adjust the learning target in an iterative cycle to gradually approach the real distribution and optimize the diversity of the generator output, which is expressed as:

[0014]

[0015] In the formula, For the generator to input The output distribution of is the parameter update operation, The learning rate updated for generating the device network data distribution, is the target distribution of real device network data, is the output distribution of the current generator, is the input noise of the generator;

[0016] S203, adopts an adaptive noise modulation mechanism to achieve fine-grained control of the generator output by dynamically adjusting the distribution of input noise. The statistical characteristics of the noise are dynamically adjusted based on the loss feedback in the current training batch. The device network data generation requires fine control in multiple feature dimensions. By adjusting the mean and variance of the input noise, adaptive noise modulation enables the generator to generate diversified device network data samples more flexibly, improve the fine-grained control capability of generated data, and adapt to the requirements of multi-dimensional attributes of device network data. The implementation method of adaptive noise modulation is expressed as:

[0017]

[0018] In the formula, is the modulated noise input, is the mean function of the noise, is the modulation intensity, is the standard deviation modulation function of the noise, is element-wise multiplication, A random noise vector that maintains the original distribution characteristics;

[0019] The mean function of the noise and the standard deviation modulation function of the noise are calculated based on the current batch generator loss and are expressed as:

[0020]

[0021]

[0022] In the formula, is the first modulation parameter, controlling the sensitivity of the mean adjustment, is the hyperbolic tangent function, which is used to limit the range of mean adjustment. , is a smooth ReLU function used to ensure the non-negativity of variance adjustment, is the second modulation parameter, controlling the sensitivity of the standard deviation adjustment;

[0023] S204, using the dynamic learning target to generate initial samples, the samples are input into the discriminator to obtain feedback information, and through the output of the discriminator, the generator adjusts its own parameters to generate device network data that is closer to the target distribution. The parameter update method of the generator is expressed as:

[0024]

[0025] In the formula, are the parameters of the generator, Update the learning rate for the generator's parameters, is the updated weight of the generator, is the gradient of the generator parameters, is the discriminator function, is the generator function, is the modulated noise input;

[0026] The gradient calculation of the generator parameters takes into account the entire path from the generator output to the discriminator input, expressed as:

[0027]

[0028] In the formula, The number of samples fed into the generator, is the symbol of partial derivative, For the samples of noise input;

[0029] S205, using real device network data samples and generated device network data samples to train the discriminator to optimize its distinguishing ability. The parameter updating method of the discriminator is expressed as:

[0030]

[0031] In the formula, are the parameters of the discriminator, Update the learning rate for the discriminator parameters is the updated weight of the discriminator, is the gradient of the discriminator parameters, is a real device network data sample, To generate device network data samples, the real device network data samples and the generated device network data samples have the same characteristic attributes;

[0032] The gradient of the discriminator parameters considers the gradient of each part in the loss function, and uses the difference evaluation of the generated device network data samples and the real device network data samples. The calculation method is expressed as:

[0033]

[0034] In the formula, is the number of discriminant samples in the training batch, For the A sample of real device network data. For the Generate device network data samples, are the parameters of the discriminator;

[0035] S206, after each training iteration, the weight decay coefficient is updated according to the change of the training loss. By adaptively adjusting the parameter update rate, the generator and the discriminator always maintain a balanced competitive relationship, thereby improving the stability of the training. The weight decay adjustment method is expressed as:

[0036]

[0037]

[0038] In the formula, is the weight decay rate, Set to 0.95;

[0039] S207, after iterative training, the generator outputs the expanded device network data samples, performs feature distribution analysis on the output samples, and compares them with the real device network data to ensure the diversity of the generated device network data. The cyclic optimization process improves the quality and authenticity of the expanded data based on the multi-dimensional distribution characteristics of the device network data, which is expressed as:

[0040]

[0041] In the formula, is the Kullback-Leibler divergence, which is used to measure the difference between two distributions. is the distribution of real device network data, To generate the distribution of device network data, This is a sample of real device network data;

[0042] In order to analyze the distribution differences in more detail, the calculation method for generating the distribution of device network data is expressed as:

[0043]

[0044] In the formula, For the generator about The conditional probability density function of is the derivative of the input noise of the generator, is the input noise of the generator;

[0045] S208, the analysis results are used to adjust the target distribution parameters, and the generator and the discriminator are retrained to further optimize the quality of the generated device network data. The retraining optimization strategy is achieved by adjusting the target distribution of the generator to generate the device network data, which is expressed as:

[0046]

[0047] In the formula, Generate target distribution of device network data for the generator, is the retraining update factor, For input The current output of the generator at time .

[0048] Furthermore, the training process of the extreme learning machine algorithm based on the damping factor in S3 includes the following steps:

[0049] S301, initialize the parameters of the extreme learning machine. is the hidden layer weight matrix of the extreme learning machine, is the hidden layer node of the extreme learning machine Weight value, is the hidden layer bias vector of the extreme learning machine, which is initialized randomly and the initialized parameters obey the normal distribution with a mean of 0 and a variance of the unit matrix;

[0050] The calculation method of the hidden layer output matrix of the extreme learning machine is expressed as:

[0051]

[0052] In the formula, is the hidden layer output matrix, is the Sigmoid activation function, The device network data input to the extreme learning machine, Transpose the input device network data for the extreme learning machine;

[0053] S302, dynamically adjust and memorize historical gradient information in the extreme learning machine weight matrix training, and implement the correction of the weight matrix according to the incremental update method. The calculation method is expressed as:

[0054]

[0055] In the formula, is the updated hidden layer weight matrix, is the update increment of the extreme learning machine weight;

[0056] The update increment of the extreme learning machine's weight can effectively adjust the contribution of each hidden layer node to reduce the amount of calculation and improve training efficiency. The calculation method is expressed as:

[0057]

[0058] In the formula, is the learning rate of the extreme learning machine weight update increment, is the gradient of the loss function of the extreme learning machine to the updated hidden layer weight matrix, is the derivative of the Sigmoid activation function, is the hidden layer output matrix calculated by the updated hidden layer weight matrix, is the damping factor of the extreme learning machine;

[0059] S303, in order to prevent overfitting in the training of high-dimensional nonlinear device network data, a damping factor is used and the factor is adaptively adjusted each time the weight is updated to reduce the risk of over-adjustment of parameters in complex device network data scenarios. The calculation method is expressed as:

[0060]

[0061] In the formula, is the damping factor hyperparameter, is the factor that controls the damping adjustment rate, The L2 norm of the device network data input to the extreme learning machine, is the L2 norm, is the local adjustment coefficient, is the second-order derivative of the loss function of the extreme learning machine with respect to the updated hidden layer weight matrix;

[0062] In order to make the local adjustment coefficient adaptively adjusted according to the current gradient change amplitude, the update calculation method is expressed as:

[0063]

[0064] In the formula, is the local adjustment coefficient after this iteration adjustment, is the learning factor of the local adjustment coefficient, is the first-order derivative of the loss function of the extreme learning machine with respect to the updated hidden layer weight matrix;

[0065] S304, dynamically remove useless or redundant features during the training process, and increase the extreme learning machine's attention to effective features. The feature selection matrix is ​​used to represent the contribution of features in the current model. Device network data often contains redundant or irrelevant features. The feature selection matrix is ​​used to automatically remove redundant features during the training process. When detecting "memory overflow" attacks, the feature selection matrix will gradually reduce the weights of fields that are irrelevant to the attack pattern, thereby focusing on the request size or time distribution that is strongly related to the features. The calculation method is expressed as:

[0066]

[0067] In the formula, is the feature selection matrix after this iteration update, is the feature selection matrix of the previous iteration, is the update factor for feature selection, is the gradient of the loss function with respect to the input device network data, is the feature importance function, which is used to evaluate the importance of each feature in the current training process;

[0068] The feature importance function adjusts the selection probability of each feature according to the change of each feature during the training process. The calculation method is expressed as:

[0069]

[0070] In the formula, is the damping factor hyperparameter;

[0071] S305, the loss function of the extreme learning machine adopts an adaptive adjustment item based on data distribution, which can be adaptively optimized for device network data of different complexity, and maintain a high classification accuracy in multi-category and high-dimensional device network data scenarios. In the classification task, the category distribution of device network data is extremely unbalanced, and the calculation method is expressed as:

[0072]

[0073] In the formula, is the loss function of the extreme learning machine, is the number of samples input to the extreme learning machine in the current batch, For the The true labels of the device network data samples, is the model prediction output, is the regularization coefficient of the extreme learning machine, is the number of neurons in the hidden layer of the extreme learning machine, is the hidden layer node of the extreme learning machine Weight value, is the loss function adjustment factor, is the output of the hidden layer of the extreme learning machine eigenvalues;

[0074] S306, through the convergence check and early stopping mechanism to avoid excessive iterations and resource waste, terminate the training at the right time, expressed as:

[0075]

[0076]

[0077] In the formula, is the loss change of the extreme learning machine, is the loss function of the extreme learning machine in the previous iteration, It is the preset threshold for judging convergence.

[0078] The device security assessment system based on edge computing power compensation and privacy computing includes:

[0079] The data collection and preprocessing unit is used to collect data and ensure the integrity and reliability of the data during the collection stage. Through the edge computing node, the data is initially cleaned, denoised and standardized locally to reduce invalid information and optimize the subsequent computing resource usage;

[0080] A data expansion and enhancement unit, used to increase the number of samples of the trained device network data expansion model;

[0081] The device security assessment model training unit conducts training and optimization of the distributed federated learning architecture based on the computing power advantage of edge computing nodes. The edge nodes update the model through local data instead of directly transmitting the original data, thereby protecting user privacy. The central server is responsible for integrating the model parameters uploaded by each edge node, improving the overall model performance through collaborative training, and ensuring the generalization ability in the device security assessment task;

[0082] The security assessment unit uses machine learning models to evaluate and classify the security status of the device. Through edge computing power compensation, the security assessment unit completes part of the computing tasks locally, reducing bandwidth pressure and response time, while improving real-time detection capabilities;

[0083] Privacy computing and security assurance unit, used to protect the privacy of user data and the security of system operation;

[0084] The system management and feedback unit is used to monitor and optimize the operating status of the system, provide users with an intuitive feedback and operation interface, monitor the operating status of edge devices and central servers in real time, and intelligently allocate resources according to the complexity and urgency of the task.

[0085] The beneficial effects of the present invention are as follows: (1) In the task of equipment security assessment, the present invention adopts a generative adversarial network based on weight decay for sample generation of equipment network data. By dynamically monitoring the data feature distribution and adaptive noise modulation, the generated samples are consistent with the real equipment network data in multi-dimensional characteristics.

[0086] (2) In the device security assessment task, the present invention adopts a weight decay mechanism to dynamically adjust the parameter update rate of the generator and the discriminator, thereby solving the problem that traditional generative adversarial networks are prone to gradient vanishing or mode collapse in device network data generation.

[0087] (3) In the device security assessment task, the present invention adaptively adjusts the distribution of input noise based on the loss feedback in the current training batch, achieves precise control of the fine-grained characteristics of the generated samples, and makes the characteristic distribution of the generated samples closer to the real scenario of the device network data.

[0088] (4) In the device security assessment task, the present invention adopts an extreme learning machine based on a damping factor as a classifier model, and improves the privacy protection capability of the device security assessment model through a distributed federated learning architecture.

[0089] (5) In the task of equipment security assessment, the present invention utilizes a feature selection matrix to dynamically remove redundant features during the training process, thereby enhancing the model's focus on the effective features of the equipment network data.

[0090] (6) In the device security assessment task, the present invention adopts an adaptive loss function to dynamically adjust the model's attention to rare categories according to the category distribution of device network data, effectively improving the classification accuracy of small category threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0091] Figure 1 This is a generative adversarial network model diagram based on weight decay in the present invention. DETAILED DESCRIPTION

[0092] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0093] The device security assessment method based on edge computing power compensation and privacy computing in this embodiment includes the following steps:

[0094] S1, collects and preprocesses data, and manually labels the collected data. The labeling categories include "label 0, indicating that the device is normal" and "label 1, indicating that the device is abnormal".

[0095] The "label 1, indicating device anomaly" category is further subdivided into specific threat types, such as "DDoS attack" and "memory overflow", to meet complex security assessment needs. The data collection source is mainly based on device operation logs, network communication records and user interaction data. The collection method adopts real-time stream processing technology (collecting data while processing data), and uses edge computing nodes deployed at each network entrance to capture and encrypt and transmit to the central data processing center in real time. The data storage format adopts the structured JSON data format.

[0096] The attributes of the data include: response time , Equipment temperature , Processing Capacity 、CPU usage , memory usage , bandwidth usage , Safety score , location information , User operation type , Number of tasks In this embodiment, the data are shown in the following table.

[0097]

[0098] For text features, this embodiment uses the Word2Vec algorithm to vectorize the text. The Word2Vec algorithm is a commonly used vectorization algorithm in this field. It scans the texts to be vectorized based on a preset large-scale corpus and represents each word as a one-hot encoded vector. The dimension of the one-hot encoded vector is equal to the size of the vocabulary in the corpus.

[0099] S2, generates device network data based on the generative adversarial network with weight decay, and expands and enhances the data.

[0100] The collection, acquisition, labeling and preprocessing of device network data are time-consuming and labor-intensive, and insufficient training samples can easily lead to poor model generalization ability and affect the accuracy of the model.

[0101] The generative adversarial network includes a generator and a discriminator. The generator continuously adjusts its output through the information fed back by the discriminator, so that the generated device network data samples are closer to the real device network data in terms of characteristic attributes (such as the number of tasks and the type of operation). At the same time, the discriminator optimizes itself through the difference between the generated data and the real data, so that it is more accurate in the ability to distinguish specific device attributes and improves the authenticity of the expanded data. This embodiment dynamically adjusts the parameter update rate of the generator and the discriminator by adopting the weight decay method to avoid the model from falling into the problem of gradient vanishing or mode collapse, thereby enhancing the diversity and authenticity of the generated device network data samples.

[0102] like Figure 1 The figure shows a model diagram of a generative adversarial network based on weight decay. The training process of a generative adversarial network based on weight decay includes the following steps:

[0103] S201, initialize the network parameters of the generator and the discriminator. Through the initialization strategy, ensure the balanced training of the generator and the discriminator. The parameter initialization method is expressed as:

[0104]

[0105]

[0106] In the formula, is the weight of the generator, is the variance at initialization, is the weight of the discriminator, Initialize the function for the generator's parameters, is the parameter initialization function of the discriminator, the parameter initialization function of the generator and the parameter initialization function of the discriminator are normal distribution functions with a mean of 0. and All of them are subject to the mean of 0 and the variance of The normal distribution of .

[0107] S202, during the training process, dynamically monitor the characteristic distribution of the real device network data, update the learning target planning strategy according to the statistical characteristics and annotation information of the collected device network data, adjust the learning target in iterations, gradually approach the real distribution, and optimize the diversity of the generator output. The device network data often has statistical characteristics and annotation information (such as response time, memory occupancy, etc.). The model updates the learning target of the generator by dynamically monitoring the characteristics, so that the generated data gradually approaches the distribution of the real device network data, ensuring that the generated data not only increases in quantity, but also keeps consistent with the real device network data in characteristic distribution, thereby improving the representativeness of the data, which is expressed as:

[0108]

[0109] In the formula, Is the generator for the input The output distribution of is the parameter update operation, is the learning rate for generating updates to the device network data distribution, Set to 0.01, is the target distribution of real device network data, is the output distribution of the current generator, is the input noise of the generator.

[0110] S203, adopts an adaptive noise modulation mechanism to achieve fine-grained control of the generator output by dynamically adjusting the distribution of input noise. The statistical characteristics of the noise (such as mean and variance) are dynamically adjusted based on the loss feedback in the current training batch. The device network data generation requires fine control on multiple feature dimensions (such as bandwidth occupancy, security score, etc.). By adjusting the mean and variance of the input noise, adaptive noise modulation enables the generator to generate diversified device network data samples more flexibly, improve the fine-grained control capability of generated data, and adapt to the requirements of multi-dimensional attributes of device network data. The implementation method of adaptive noise modulation is expressed as:

[0111]

[0112] In the formula, is the modulated noise input, is the mean function of the noise, is the modulation intensity Set to 0.2, is the standard deviation modulation function of the noise, is element-wise multiplication, is a random noise vector that maintains the original distribution characteristics.

[0113] The mean function of the noise and the standard deviation modulation function of the noise are calculated based on the current batch generator loss and are expressed as:

[0114]

[0115]

[0116] In the formula, is the first modulation parameter, controlling the sensitivity of the mean adjustment, is the hyperbolic tangent function, which is used to limit the range of mean adjustment. , is a smooth ReLU function used to ensure the non-negativity of variance adjustment, is the second modulation parameter, which controls the sensitivity of the standard deviation adjustment.

[0117] S204, using the dynamic learning target to generate initial samples, the samples are input into the discriminator to obtain feedback information, and through the output of the discriminator, the generator adjusts its own parameters to generate device network data that is closer to the target distribution. The parameter update method of the generator is expressed as:

[0118]

[0119] In the formula, are the parameters of the generator, Update the learning rate for the generator's parameters, Set to 0.01 is the updated weight of the generator, is the gradient of the generator parameters, is the discriminator function, is the generator function, is the modulated noise input.

[0120] The gradient calculation of the generator parameters takes into account the entire path from the generator output to the discriminator input, expressed as:

[0121]

[0122] In the formula, The number of samples fed into the generator, is the symbol of partial derivative, For the samples of noise input.

[0123] S205, using real device network data samples and generated device network data samples to train the discriminator to optimize its distinguishing ability. The parameter updating method of the discriminator is expressed as:

[0124]

[0125] In the formula, are the parameters of the discriminator, Update the learning rate for the discriminator parameters, Set to 0.05 is the updated weight of the discriminator, is the gradient of the discriminator parameters, is a real device network data sample, To generate device network data samples, the real device network data samples and the generated device network data samples have the same characteristic attributes, such as the characteristic attributes including response time , Equipment temperature , Processing Capacity 、CPU usage , memory usage , bandwidth usage , Safety score , location information , User operation type , Number of tasks .

[0126] The gradient of the discriminator parameters considers the gradient of each part in the loss function, and uses the difference evaluation of the generated device network data samples and the real device network data samples. The calculation method is expressed as:

[0127]

[0128] In the formula, is the number of discriminant samples in the training batch, For the A sample of real device network data. For the Generate device network data samples, are the parameters of the discriminator;

[0129] S206, after each training iteration, the weight decay coefficient is updated according to the change of the training loss. By adaptively adjusting the parameter update rate, the generator and the discriminator are always in a balanced competitive relationship to improve the stability of the training. The device network data collection has a specific feature distribution (such as device temperature, CPU usage, etc.). By dynamically adjusting the parameter update rate of the generator and the discriminator, the gradient disappearance or mode collapse problem that may occur in the generated device network data is solved to ensure that the generator can generate device network data with higher authenticity and diversity. The weight decay adjustment method is expressed as:

[0130]

[0131]

[0132] In the formula, is the weight decay rate, Set to 0.95;

[0133] S207, after iterative training, the generator outputs the expanded device network data samples, performs feature distribution analysis on the output samples, and compares them with the real device network data to ensure the diversity of the generated device network data. The cyclic optimization process improves the quality and authenticity of the expanded data based on the multi-dimensional distribution characteristics of the device network data, which is expressed as:

[0134]

[0135] In the formula, is the Kullback-Leibler divergence, which is used to measure the difference between two distributions. is the distribution of real device network data, To generate the distribution of device network data, This is a sample of real device network data.

[0136] In order to analyze the distribution differences in more detail, the calculation method for generating the distribution of device network data is expressed as:

[0137]

[0138] In the formula, For the generator about The conditional probability density function of is the derivative of the input noise of the generator, is the input noise of the generator.

[0139] S208, the analysis results are used to adjust the target distribution parameters, and the generator and the discriminator are retrained to further optimize the quality of the generated device network data. The retraining optimization strategy is achieved by adjusting the target distribution of the generator to generate the device network data, which is expressed as:

[0140]

[0141] In the formula, Generate target distribution of device network data for the generator, is the retraining update factor, Set to 0.3, For input The current output of the generator at time .

[0142] After the equipment network data expansion model training is completed, the trained equipment network data expansion model is used to increase the number of samples. Assuming that the original collected samples are 800, and the equipment network data expansion model expands and generates 200 samples, the expanded equipment network data set contains 1000 samples.

[0143] S3, in the distributed federated learning architecture, the extreme learning machine algorithm based on damping factor is used as the classifier model.

[0144] The device security assessment model training unit uses machine learning technology to train and optimize the distributed federated learning architecture based on the computing power advantages of edge computing nodes. The edge nodes update the model through local data instead of directly transmitting the original data, thereby protecting user privacy. The central server is responsible for integrating the model parameters uploaded by each edge node, improving the overall model performance through collaborative training, and ensuring the generalization capability in device security assessment tasks.

[0145] The extreme learning machine algorithm based on damping factor is used as the classifier model to prevent overfitting of high-dimensional nonlinear device network data during training. The damping factor is used and its value is adaptively adjusted to reduce the risk of excessive parameter adjustment. Redundant features are dynamically eliminated through the feature selection matrix, thereby enhancing the focus on effective features.

[0146] The training process of the extreme learning machine algorithm based on the damping factor includes the following steps:

[0147] S301, initialize the parameters of the extreme learning machine. is the hidden layer weight matrix of the extreme learning machine, is the hidden layer node of the extreme learning machine Weight value, is the hidden layer bias vector of the extreme learning machine, which is initialized randomly and the initialized parameters obey the normal distribution with a mean of 0 and a variance of the unit matrix;

[0148] The calculation method of the hidden layer output matrix of the extreme learning machine is expressed as:

[0149]

[0150] In the formula, is the hidden layer output matrix, is the Sigmoid activation function, The device network data input to the extreme learning machine, Transpose of the input device network data for the extreme learning machine.

[0151] S302, dynamically adjust and memorize historical gradient information in the extreme learning machine weight matrix training, and implement the correction of the weight matrix according to the incremental update method. The calculation method is expressed as:

[0152]

[0153] In the formula, is the updated hidden layer weight matrix, is the update increment of the extreme learning machine weight.

[0154] The update increment of the extreme learning machine's weight can effectively adjust the contribution of each hidden layer node to reduce the amount of calculation and improve training efficiency. The calculation method is expressed as:

[0155]

[0156] In the formula, is the learning rate of the extreme learning machine weight update increment, Set to 0.01, is the gradient of the loss function of the extreme learning machine to the updated hidden layer weight matrix, is the derivative of the Sigmoid activation function, is the hidden layer output matrix calculated by the updated hidden layer weight matrix, is the damping factor of the extreme learning machine.

[0157] S303, in order to prevent overfitting in the training of high-dimensional nonlinear device network data, a damping factor is used and the factor is adaptively adjusted each time the weight is updated, so as to reduce the risk of over-adjustment of parameters in complex device network data scenarios. In the classification of device network data, the data usually contains a large number of high-dimensional nonlinear features, such as the time series of network traffic, protocol fields, IP address distribution, etc. When processing DDoS attack detection tasks, network traffic may experience abnormal surges. The damping factor is used to control the gradient update amplitude to prevent the model from overfitting abnormal features under traffic peaks, while maintaining accurate classification of normal traffic, effectively reducing the sensitivity of the model to abnormal peaks, and improving the robustness of the model. The calculation method is expressed as:

[0158]

[0159] In the formula, is the damping factor hyperparameter, is the factor that controls the damping adjustment rate, The L2 norm of the device network data input to the extreme learning machine, is the L2 norm, is the local adjustment coefficient, is the second-order derivative of the extreme learning machine's loss function with respect to the updated hidden layer weight matrix.

[0160] In order to make the local adjustment coefficient adaptively adjusted according to the current gradient change amplitude, the update calculation method is expressed as:

[0161]

[0162] In the formula, is the local adjustment coefficient after this iteration adjustment, is the learning factor of the local adjustment coefficient, Set to 0.3, is the first-order derivative of the extreme learning machine's loss function with respect to the updated hidden layer weight matrix.

[0163] S304, dynamically remove useless or redundant features during the training process, and increase the extreme learning machine's attention to effective features. The feature selection matrix is ​​used to represent the contribution of features in the current model. Device network data often contains redundant or irrelevant features. For example, some fields in the HTTP header may be irrelevant to the classification of "label 0, indicating normal device" and "label 1, indicating abnormal device". The redundant features are automatically removed during the training process through the feature selection matrix. When detecting "memory overflow" attacks, the feature selection matrix will gradually reduce the weight of fields that are irrelevant to the attack mode (such as static HTTP headers), thereby focusing on the request size or time distribution that is strongly related to the features. The calculation method is expressed as:

[0164]

[0165] In the formula, is the feature selection matrix after this iteration update, is the feature selection matrix of the previous iteration, is the update factor for feature selection, Set to 0.2, is the gradient of the loss function with respect to the input device network data, It is the feature importance function, which is used to evaluate the importance of each feature in the current training process.

[0166] The feature importance function adjusts the selection probability of each feature according to the change of each feature during the training process. The calculation method is expressed as:

[0167]

[0168] In the formula, is the damping factor hyperparameter.

[0169] S305, in order to effectively process high-dimensional and nonlinear device network data, the loss function of the extreme learning machine adopts an adaptive adjustment item based on data distribution, which can adaptively optimize device network data of different complexities and maintain a high classification accuracy in multi-category high-dimensional device network data scenarios. In the classification task, the category distribution of device network data is extremely unbalanced. For example, "label 0, indicating normal device" traffic may account for more than 90%, while "label 1, indicating abnormal device" (such as "Trojan infection" or "data leakage") accounts for a very low proportion. The adaptive loss function will dynamically adjust the model's attention to small categories according to the data distribution, thereby improving the classification accuracy of rare threats. When detecting small-scale "SQL injection" attacks, the loss function can adaptively improve the model's response to related features, thereby improving the detection performance. The calculation method is expressed as:

[0170]

[0171] In the formula, is the loss function of the extreme learning machine, is the number of samples input to the extreme learning machine in the current batch, For the The real labels of the network data samples of each device, for example, the labels include "label 0, indicating that the device is normal", "label 1, indicating that the device is abnormal", where the "label 1, indicating that the device is abnormal" category is further subdivided into specific threat types, such as "DDoS attack", "memory overflow", etc. is the model prediction output, is the regularization coefficient of the extreme learning machine, is the number of neurons in the hidden layer of the extreme learning machine, is the hidden layer node of the extreme learning machine Weight value, is the loss function adjustment factor, is the output of the hidden layer of the extreme learning machine feature values.

[0172] S306, through the convergence check and early stopping mechanism to avoid excessive iterations and resource waste, terminate the training at the right time, expressed as:

[0173]

[0174]

[0175] In the formula, is the loss change of the extreme learning machine, is the loss function of the extreme learning machine in the previous iteration, is the preset threshold for judging convergence, Set to 0.05.

[0176] S4 uses machine learning models to evaluate and classify the security status of devices, and completes some computing tasks locally through edge computing power compensation, reducing bandwidth pressure and response time, and improving real-time detection capabilities.

[0177] The assessment categories include "Label 0, indicating that the device is normal" and "Label 1, indicating that the device is abnormal". The "Label 1, indicating that the device is abnormal" category is further subdivided into specific threat types, such as "DDoS attack" and "memory overflow" to meet complex security assessment needs.

[0178] S5 uses privacy computing technology to ensure data security, protect the privacy of user data and the security of system operation.

[0179] Privacy computing includes differential privacy, multi-party secure computing, homomorphic encryption, and federated learning.

[0180] Differential privacy technology adds noise to the data to ensure that even if a single piece of data is leaked, the specific content cannot be inferred.

[0181] Multi-party secure computation allows multiple parties to collaborate on computations without disclosing each other's data.

[0182] Homomorphic encryption supports direct operations on encrypted data, ensuring the privacy of data during transmission and processing.

[0183] Federated learning avoids data centralization and distributes training tasks to multiple edge nodes, minimizing the need to transmit sensitive data.

[0184] S6 monitors and optimizes the operating status of the system, provides users with intuitive feedback and operation interfaces, monitors the operating status of edge devices and central servers in real time, including computing resources, storage utilization, and network bandwidth, and intelligently allocates resources based on the complexity and urgency of the task.

[0185] For example, for security assessment tasks that require real-time processing, the system will give priority to allocating edge nodes with stronger computing power; for non-real-time tasks, idle resources can be used for processing, thereby improving the overall efficiency of the system.

[0186] The system management and feedback unit records the operation logs of each unit in a centralized and distributed manner, including details of data collection, model training, security assessment, and privacy calculation processes. At the same time, the system monitoring module will generate operation status reports at regular intervals and automatically detect abnormal conditions during operation (such as insufficient computing power, network interruption, or abnormal device offline), triggering an early warning mechanism.

[0187] The device security assessment system based on edge computing power compensation and privacy computing in this embodiment includes:

[0188] The data collection and preprocessing unit is used to collect data while ensuring the integrity and reliability of the data during the collection stage. Through the edge computing node, the data is initially cleaned, denoised and standardized locally to reduce invalid information and optimize subsequent computing resource usage.

[0189] The data expansion and enhancement unit is used to increase the number of samples of the trained device network data expansion model.

[0190] The device security assessment model training unit conducts training and optimization of the distributed federated learning architecture based on the computing power advantage of edge computing nodes. The edge nodes update the model through local data instead of directly transmitting the original data, thereby protecting user privacy. The central server is responsible for integrating the model parameters uploaded by each edge node, improving the overall model performance through collaborative training, and ensuring the generalization capability in device security assessment tasks.

[0191] The security assessment unit uses a machine learning model to evaluate and classify the security status of the device. Through edge computing power compensation, the security assessment unit completes part of the computing tasks locally, reducing bandwidth pressure and response time, while improving real-time detection capabilities.

[0192] Privacy computing and security assurance unit, used to protect the privacy of user data and the security of system operation.

[0193] The privacy computing and security assurance unit uses encrypted communication protocols (such as TLS / SSL) to protect the security of data transmission between nodes, and performs integrity checks on data packets to prevent data from being intercepted or tampered with during transmission, thereby ensuring data privacy and communication security in distributed systems.

[0194] The system management and feedback unit is used to monitor and optimize the operating status of the system, while providing users with an intuitive feedback and operation interface to monitor the operating status of edge devices and central servers in real time, including computing resources, storage utilization, and network bandwidth, and intelligently allocate resources based on the complexity and urgency of the task.

[0195] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. A device security assessment method based on edge computing power compensation and privacy computing, characterized in that: The following steps are involved: S1, collect and preprocess the data, and manually label the collected data. The labeling categories include "label 0, indicating that the device is normal" and "label 1, indicating that the device is abnormal"; S2, generates device network data based on the weight decay generative adversarial network, and expands and enhances the data; S3, in the distributed federated learning architecture, the extreme learning machine algorithm based on damping factor is used as the classifier model; S4 uses machine learning models to evaluate and classify the security status of devices, and completes some computing tasks locally through edge computing compensation, reducing bandwidth pressure and response time, and improving real-time detection capabilities; S5, uses privacy computing technology to ensure data security, protect the privacy of user data and the security of system operation; S6 monitors and optimizes the operating status of the system, provides users with intuitive feedback and operation interface, and monitors the operating status of edge devices and central servers in real time.

2. The device security assessment method based on edge computing power compensation and privacy computing according to claim 1 is characterized in that: The attributes of the data in S1 include: response time , Equipment temperature , Processing Capacity 、CPU usage , memory usage , bandwidth usage , Safety score , location information , User operation type , Number of tasks .

3. The device security assessment method based on edge computing power compensation and privacy computing according to claim 1 is characterized in that: The training process of the weight decay-based generative adversarial network in S2 includes the following steps: S201, initialize the network parameters of the generator and the discriminator. Through the initialization strategy, ensure the balanced training of the generator and the discriminator. The parameter initialization method is expressed as: In the formula, is the weight of the generator, is the variance at initialization, is the weight of the discriminator, Initialize the function for the generator's parameters, is the parameter initialization function of the discriminator, the parameter initialization function of the generator and the parameter initialization function of the discriminator are normal distribution functions with a mean of 0. and All of them are subject to the mean of 0 and the variance of Normal distribution of S202, during the training process, dynamically monitor the characteristic distribution of the real device network data, update the learning target planning strategy according to the statistical characteristics and annotation information of the collected device network data, and adjust the learning target in an iterative cycle to gradually approach the real distribution and optimize the diversity of the generator output, which is expressed as: In the formula, For the generator to input The output distribution of is the parameter update operation, The learning rate updated for generating the device network data distribution, is the target distribution of real device network data, is the output distribution of the current generator, is the input noise of the generator; S203, adopts an adaptive noise modulation mechanism to achieve fine-grained control of the generator output by dynamically adjusting the distribution of input noise. The statistical characteristics of the noise are dynamically adjusted based on the loss feedback in the current training batch. The device network data generation requires fine control in multiple feature dimensions. By adjusting the mean and variance of the input noise, adaptive noise modulation enables the generator to generate diversified device network data samples more flexibly, improve the fine-grained control capability of generated data, and adapt to the requirements of multi-dimensional attributes of device network data. The implementation method of adaptive noise modulation is expressed as: In the formula, is the modulated noise input, is the mean function of the noise, is the modulation intensity, is the standard deviation modulation function of the noise, is element-wise multiplication, A random noise vector that maintains the original distribution characteristics; The mean function of the noise and the standard deviation modulation function of the noise are calculated based on the current batch generator loss and are expressed as: In the formula, is the first modulation parameter, controlling the sensitivity of the mean adjustment, is the hyperbolic tangent function, which is used to limit the range of mean adjustment. , is a smooth ReLU function used to ensure the non-negativity of variance adjustment, is the second modulation parameter, controlling the sensitivity of the standard deviation adjustment; S204, using the dynamic learning target to generate initial samples, the samples are input into the discriminator to obtain feedback information, and through the output of the discriminator, the generator adjusts its own parameters to generate device network data that is closer to the target distribution. The parameter update method of the generator is expressed as: In the formula, are the parameters of the generator, Update the learning rate for the generator's parameters, is the updated weight of the generator, is the gradient of the generator parameters, is the discriminator function, is the generator function, is the modulated noise input; The gradient calculation of the generator parameters takes into account the entire path from the generator output to the discriminator input, expressed as: In the formula, The number of samples fed into the generator, is the symbol of partial derivative, For the samples of noise input; S205, using real device network data samples and generated device network data samples to train the discriminator to optimize its distinguishing ability. The parameter updating method of the discriminator is expressed as: In the formula, are the parameters of the discriminator, Update the learning rate for the discriminator parameters is the updated weight of the discriminator, is the gradient of the discriminator parameters, is a sample of real device network data. To generate device network data samples, the real device network data samples and the generated device network data samples have the same characteristic attributes; The gradient of the discriminator parameters considers the gradient of each part in the loss function, and uses the difference evaluation of the generated device network data samples and the real device network data samples. The calculation method is expressed as: In the formula, is the number of discriminant samples in the training batch, For the A sample of real device network data. For the Generate device network data samples, are the parameters of the discriminator; S206, after each training iteration, the weight decay coefficient is updated according to the change of the training loss. By adaptively adjusting the parameter update rate, the generator and the discriminator always maintain a balanced competitive relationship, thereby improving the stability of the training. The weight decay adjustment method is expressed as: In the formula, is the weight decay rate, Set to 0.95; S207, after iterative training, the generator outputs the expanded device network data samples, performs feature distribution analysis on the output samples, and compares them with the real device network data to ensure the diversity of the generated device network data. The cyclic optimization process improves the quality and authenticity of the expanded data based on the multi-dimensional distribution characteristics of the device network data, which is expressed as: In the formula, is the Kullback-Leibler divergence, which is used to measure the difference between two distributions. is the distribution of real device network data, To generate the distribution of device network data, This is a sample of real device network data; In order to analyze the distribution differences in more detail, the calculation method for generating the distribution of device network data is expressed as: In the formula, For the generator about The conditional probability density function of is the derivative of the input noise of the generator, is the input noise of the generator; S208, the analysis results are used to adjust the target distribution parameters, and the generator and the discriminator are retrained to further optimize the quality of the generated device network data. The retraining optimization strategy is achieved by adjusting the target distribution of the generator to generate the device network data, which is expressed as: In the formula, Generate target distribution of device network data for the generator, is the retraining update factor, For input The current output of the generator at time .

4. The device security assessment method based on edge computing power compensation and privacy computing according to claim 1 is characterized in that: The training process of the extreme learning machine algorithm based on the damping factor in S3 includes the following steps: S301, initialize the parameters of the extreme learning machine. is the hidden layer weight matrix of the extreme learning machine, is the hidden layer node of the extreme learning machine Weight value, is the hidden layer bias vector of the extreme learning machine, which is initialized randomly and the initialized parameters obey the normal distribution with a mean of 0 and a variance of the unit matrix; The calculation method of the hidden layer output matrix of the extreme learning machine is expressed as: In the formula, is the hidden layer output matrix, is the Sigmoid activation function, The device network data input to the extreme learning machine, Transpose the input device network data for the extreme learning machine; S302, dynamically adjust and memorize historical gradient information in the extreme learning machine weight matrix training, and implement the correction of the weight matrix according to the incremental update method. The calculation method is expressed as: In the formula, is the updated hidden layer weight matrix, is the update increment of the extreme learning machine weight; The update increment of the extreme learning machine's weight can effectively adjust the contribution of each hidden layer node to reduce the amount of calculation and improve training efficiency. The calculation method is expressed as: In the formula, is the learning rate of the extreme learning machine weight update increment, is the gradient of the loss function of the extreme learning machine to the updated hidden layer weight matrix, is the derivative of the Sigmoid activation function, is the hidden layer output matrix calculated by the updated hidden layer weight matrix, is the damping factor of the extreme learning machine; S303, in order to prevent overfitting in the training of high-dimensional nonlinear device network data, a damping factor is used and the factor is adaptively adjusted each time the weight is updated to reduce the risk of over-adjustment of parameters in complex device network data scenarios. The calculation method is expressed as: In the formula, is the damping factor hyperparameter, is the factor that controls the damping adjustment rate, The L2 norm of the device network data input to the extreme learning machine, is the L2 norm, is the local adjustment coefficient, is the second-order derivative of the loss function of the extreme learning machine with respect to the updated hidden layer weight matrix; In order to make the local adjustment coefficient adaptively adjusted according to the current gradient change amplitude, the update calculation method is expressed as: In the formula, is the local adjustment coefficient after this iteration adjustment, is the learning factor of the local adjustment coefficient, is the first-order derivative of the loss function of the extreme learning machine with respect to the updated hidden layer weight matrix; S304, dynamically remove useless or redundant features during the training process, and increase the extreme learning machine's attention to effective features. The feature selection matrix is ​​used to represent the contribution of features in the current model. Device network data often contains redundant or irrelevant features. The feature selection matrix is ​​used to automatically remove redundant features during the training process. When detecting "memory overflow" attacks, the feature selection matrix will gradually reduce the weights of fields that are irrelevant to the attack pattern, thereby focusing on the request size or time distribution that is strongly related to the features. The calculation method is expressed as: In the formula, is the feature selection matrix after this iteration update, is the feature selection matrix of the previous iteration, is the update factor for feature selection, is the gradient of the loss function with respect to the input device network data, is the feature importance function, which is used to evaluate the importance of each feature in the current training process; The feature importance function adjusts the selection probability of each feature according to the change of each feature during the training process. The calculation method is expressed as: In the formula, is the damping factor hyperparameter; S305, the loss function of the extreme learning machine adopts an adaptive adjustment item based on data distribution, which can be adaptively optimized for device network data of different complexity, and maintain a high classification accuracy in multi-category and high-dimensional device network data scenarios. In the classification task, the category distribution of device network data is extremely unbalanced, and the calculation method is expressed as: In the formula, is the loss function of the extreme learning machine, is the number of samples input to the extreme learning machine in the current batch, For the The true labels of the device network data samples, is the model prediction output, is the regularization coefficient of the extreme learning machine, is the number of neurons in the hidden layer of the extreme learning machine, is the hidden layer node of the extreme learning machine Weight value, is the loss function adjustment factor, is the output of the hidden layer of the extreme learning machine eigenvalues; S306, through the convergence check and early stopping mechanism to avoid excessive iterations and resource waste, terminate the training at the right time, expressed as: In the formula, is the loss change of the extreme learning machine, is the loss function of the extreme learning machine in the previous iteration, It is the preset threshold for judging convergence.

5. A device security assessment system based on edge computing power compensation and privacy computing, applying any one of claims 1 to 4 of the device security assessment method based on edge computing power compensation and privacy computing, comprising: The data collection and preprocessing unit is used to collect data and ensure the integrity and reliability of the data during the collection stage. Through the edge computing node, the data is initially cleaned, denoised and standardized locally to reduce invalid information and optimize the subsequent computing resource usage; A data expansion and enhancement unit, used to increase the number of samples of the trained device network data expansion model; The device security assessment model training unit conducts training and optimization of the distributed federated learning architecture based on the computing power advantage of edge computing nodes. The edge nodes update the model through local data instead of directly transmitting the original data, thereby protecting user privacy. The central server is responsible for integrating the model parameters uploaded by each edge node, improving the overall model performance through collaborative training, and ensuring the generalization ability in the device security assessment task; The security assessment unit uses machine learning models to evaluate and classify the security status of the device. Through edge computing power compensation, the security assessment unit completes part of the computing tasks locally, reducing bandwidth pressure and response time, while improving real-time detection capabilities; Privacy computing and security assurance unit, used to protect the privacy of user data and the security of system operation; The system management and feedback unit is used to monitor and optimize the operating status of the system, provide users with an intuitive feedback and operation interface, monitor the operating status of edge devices and central servers in real time, and intelligently allocate resources according to the complexity and urgency of the task.

Images