Training method of intrusion detection model and Internet of Things system

Abstract

The invention relates to the technical field of intrusion detection, and discloses a training method of an intrusion detection model, and in the method, since abnormal edge servers with poor running states and network states are isolated during training of the intrusion detection model, only training parameters uploaded by normal edge servers are utilized to perform subsequent training, and the training efficiency of the intrusion detection model is improved. According to the method, the process of waiting for the abnormal edge server to upload the training parameters can be avoided, so that the influence of network delay on the training process is reduced, the training efficiency of an intrusion detection model is improved, and the influence on network intrusion detection is reduced. The invention further discloses an Internet of Things system.

Description

Technical Field

[0001] The present application relates to the field of intrusion detection technology, for example, to a training method for an intrusion detection model and an Internet of Things system. Background Art

[0002] At present, with the rapid development of science and technology, Internet of Things (IoT) devices generate a large amount of data. A large amount of data plays a key role in real-time monitoring, production optimization, predictive maintenance and intelligent decision-making. In the Cyber-Physical-Social System (CPSS), a large amount of data can reflect various parameters in the production process to help managers understand the production status in real time. By analyzing a large amount of data, managers can understand the bottlenecks and inefficient links in the production process, thereby optimizing the production process and improving production efficiency and product quality. However, the huge amount of data is prone to the risk of network intrusion.

[0003] In order to detect network intrusion, in the related art, an intrusion detection model is mainly used to detect network intrusion. In addition, in order to protect data privacy, a federated learning method is used in the related art to train the intrusion detection model.

[0004] However, due to network delays in the network environment, when the federated learning method is used in related technologies to train intrusion detection models, training delays are prone to occur, thereby affecting the training efficiency of the intrusion detection model and further affecting the detection of network intrusions. Summary of the invention

[0005] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0006] The embodiments of the present application provide a training method for an intrusion detection model and an Internet of Things system, which can improve the training efficiency of the intrusion detection model when the intrusion detection model is trained using a federated learning method.

[0007] In a first aspect, an embodiment of the present application provides a training method for an intrusion detection model, which is applied to an Internet of Things system, wherein the Internet of Things system includes a central server, an edge server cluster, and an edge node cluster; wherein the edge node cluster includes multiple terminal devices, the edge server cluster includes multiple edge servers, the edge servers in the edge server cluster are respectively connected to the central server and the terminal device, and the edge servers in the edge server cluster are in a one-to-many relationship with the multiple terminal devices in the edge node cluster, and the terminal device is integrated with an intrusion detection model; the method includes:

[0008] The terminal device collects local network data and sends the network data to the edge server;

[0009] The edge server uses the network data to iteratively train the intrusion detection model, and when the iterative training reaches a preset condition, uploads the training parameters of the intrusion detection model to the central server;

[0010] The central server detects the operation status of the plurality of edge servers respectively, and detects the network status of the plurality of edge servers respectively, and selects a normal edge server from the plurality of edge servers according to the operation status and the network status;

[0011] The central server updates the training parameters according to the training parameters uploaded by the normal edge server, and sends the updated training parameters to the normal edge server;

[0012] The normal edge server updates the intrusion detection model according to the updated training parameters, and iteratively trains the updated intrusion detection model again until a trained intrusion detection model is obtained.

[0013] Optionally, before the edge server uses the network data to iteratively train the intrusion detection model, the method further includes: the central server initializing the intrusion detection model, and sending the initialized intrusion detection model to the terminal device through the edge server.

[0014] Optionally, the edge server uses the network data to iteratively train the integrated intrusion detection model, including: the edge server preprocesses the network data; the edge server inputs the preprocessed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs the categories of the network features.

[0015] Optionally, a normal edge server is screened out from the plurality of edge servers according to the running status and the network status, including: the central server determines whether the edge server fails according to the running status, and when the edge server does not fail, obtains the network delay of the edge server based on the network status; the central server compares the network delay of the edge server with a network delay threshold; the central server determines that the edge server is a normal edge server when the network delay of the edge server is less than the network delay threshold.

[0016] Optionally, the central server updates the training parameters according to the training parameters uploaded by the normal edge server, including: the central server performs an aggregation operation based on the training parameters uploaded by the normal edge server to update the training parameters.

[0017] In a second aspect, an embodiment of the present application provides an Internet of Things system, including a central server, an edge server cluster and an edge node cluster; the edge node cluster includes a plurality of terminal devices, the edge server cluster includes a plurality of edge servers, the edge servers in the edge server cluster are respectively connected to the central server and the terminal device, and the edge servers in the edge server cluster are in a one-to-many relationship with the plurality of terminal devices in the edge node cluster, and the terminal device is integrated with an intrusion detection model; wherein:

[0018] The terminal device is used to collect local network data and send the network data to the edge server;

[0019] The edge server is used to iteratively train the intrusion detection model using the network data, and upload the training parameters of the intrusion detection model to the central server when the iterative training reaches a preset condition;

[0020] The central server is used to detect the operation status of the plurality of edge servers respectively, and the network status of the plurality of edge servers respectively, and select a normal edge server from the plurality of edge servers according to the operation status and the network status;

[0021] The central server is further configured to update the training parameters according to the training parameters uploaded by the normal edge server, and send the updated training parameters to the normal edge server;

[0022] The normal edge server is used to update the intrusion detection model according to the updated training parameters, and iteratively train the updated intrusion detection model again until a trained intrusion detection model is obtained.

[0023] Optionally, the central server is further used to initialize the intrusion detection model, and send the initialized intrusion detection model to the terminal device through the edge server.

[0024] Optionally, the edge server is specifically used to preprocess the network data; input the preprocessed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs the categories of the network features.

[0025] Optionally, the central server is specifically used to determine whether the edge server fails according to the operating status, and when the edge server does not fail, obtain the network delay of the edge server based on the network status; compare the network delay of the edge server with a network delay threshold; when the network delay of the edge server is less than the network delay threshold, determine that the edge server is a normal edge server.

[0026] Optionally, the central server is specifically configured to perform an aggregation operation based on the training parameters uploaded by the normal edge server to update the training parameters.

[0027] The intrusion detection model training method and Internet of Things system provided in the embodiments of the present application can achieve the following technical effects:

[0028] In the IoT system, when the edge server trains the intrusion detection model integrated in the terminal device, it can use the local network data for iterative training, and when the iterative training reaches the preset conditions, the training parameters of the intrusion detection model are uploaded to the central server. In the process of the edge server uploading the training parameters to the central server, the central server can respectively detect the operating status and network status of multiple edge servers to filter out normal edge servers from multiple edge servers, wherein the normal edge server refers to an edge server with a good operating status and network status. When the central server updates the training parameters according to the training parameters uploaded by the edge server, it can be implemented only according to the training parameters uploaded by the normal edge server, and the updated training parameters are sent to the normal edge server, so that the normal edge server updates the intrusion detection model based on the updated training parameters, and iteratively trains the updated intrusion detection model again, and repeats until a trained intrusion detection model is obtained. In the embodiment of the present application, since the abnormal edge servers with poor operating status and network status are isolated when training the intrusion detection model, only the training parameters uploaded by the normal edge servers are used for subsequent training, the process of waiting for the abnormal edge servers to upload the training parameters can be avoided, thereby reducing the impact of network delays on the training process, thereby improving the training efficiency of the intrusion detection model, and further reducing the impact on network intrusion detection.

[0029] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] One or more embodiments are exemplarily described by corresponding drawings, which do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements, and the drawings do not constitute a scale limitation, and wherein:

[0031] Figure 1 is a schematic diagram of an Internet of Things system provided by an embodiment of the present application;

[0032] Figure 2 is a schematic diagram of a training method for an intrusion detection model provided in an embodiment of the present application;

[0033] Figure 3 It is a schematic diagram of the accuracy of test data when different models are applied, provided in an embodiment of the present application;

[0034] Figure 4 This is a graph showing the performance of an intrusion detection model in IID data provided by an embodiment of the present application;

[0035] Figure 5 This is a performance diagram of an intrusion detection model provided in an embodiment of the present application on N-IID data;

[0036] Figure 6 It is a schematic diagram of stability training of an intrusion detection model provided in an embodiment of the present application on IID data;

[0037] Figure 7 It is a schematic diagram of stability training of an intrusion detection model provided in an embodiment of the present application on N-IID data;

[0038] Figure 8 It is a schematic diagram of the network delay performance of NIID data by an intrusion detection model provided in an embodiment of the present application;

[0039] Fig. 9 It is a schematic diagram of the convergence speed of an intrusion detection model provided in an embodiment of the present application in a network delay environment. DETAILED DESCRIPTION

[0040] The terms "first", "second", etc. in the specification, claims, and drawings of the embodiments of the present application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.

[0041] Unless otherwise stated, the term "plurality" means two or more.

[0042] In the embodiment of the present application, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B.

[0043] The term "and / or" is a description of the association relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or, A and B.

[0044] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0045] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0046] Combination Figure 1 As shown, an embodiment of the present application provides a network architecture diagram of an Internet of Things system, and the Internet of Things system includes at least a central server, an edge server cluster, and an edge node cluster. Among them, the edge node cluster includes multiple terminal devices, the edge server cluster includes multiple edge servers, the edge servers in the edge server cluster are connected to the central server and the terminal devices respectively, and the edge servers in the edge server cluster and the multiple terminal devices in the edge node cluster are in a one-to-many relationship, and the terminal devices are integrated with an intrusion detection model.

[0047] In an embodiment of the present application, the central server may be a cloud server, and the terminal device may be a smart device equipped with multiple sensors.

[0048] At present, with the rapid development of science and technology, IoT devices generate a large amount of data. A large amount of data plays a key role in real-time monitoring, production optimization, predictive maintenance and intelligent decision-making. In the cyber-physical social system, a large amount of data can reflect various parameters in the production process to help managers understand the production status in a timely manner. By analyzing a large amount of data, managers can understand the bottlenecks and inefficient links in the production process, thereby optimizing the production process and improving production efficiency and product quality. In addition, by conducting in-depth analysis of a large amount of data, faults can be predicted, maintenance can be arranged in advance, and equipment downtime and maintenance costs can be reduced. Furthermore, data also provides a basis for intelligent decision-making, which can help enterprises make more accurate decisions in resource allocation and production planning.

[0049] However, the huge amount of data is prone to the risk of cyber intrusion. Due to regional heterogeneity, cyber-physical social systems show significant differences. In a highly heterogeneous environment, data security is difficult to ensure and communication latency is high. Among them, data privacy and cyber attacks are the main factors affecting data security. It is necessary to protect data privacy during data collection, transmission and storage, and defend against cyber attacks; in a heterogeneous environment, effective access management and control must be ensured to prevent unauthorized access and operation.

[0050] In order to solve the above problems, in the related art, a learning method of federated learning is used to train the intrusion detection model. Federated learning is a distributed machine learning method that can perform model training without centralizing data, thereby effectively protecting data privacy. Moreover, the implementation of federated learning in cyber-physical social systems can reduce data transmission, minimize communication delays, and keep data localized, thereby preventing data leakage. In addition, federated learning enhances the security of the entire system by allowing local models in various regions to share attack detection experience and achieve cross-regional collaborative defense. Optimizing the communication protocols and transmission paths in federated learning can further improve system efficiency and security. In this way, federated learning can solve problems related to system security and efficiency by ensuring data privacy protection, enhancing attack detection, and optimizing communication.

[0051] However, due to the wide distribution of devices in the IoT system and the limited communication range, the edge server can only cover part of the area, and there may be terminal devices that cannot communicate with any edge server. Among them, whether a terminal device is within the communication range of the edge server can be determined by the following formula:

[0052] d(v i ,e j )≤R ej (1)

[0053] In the above formula (1), v i Indicates terminal equipment, ej represents the edge server, d(v i ,e j ) represents the distance between the terminal device and the edge device, R ej Indicates the communication radius of the edge server.

[0054] In this way, by judging whether the distance between the terminal device and the edge server is less than or equal to the communication radius of the edge server, it can be determined whether the terminal device is within the communication range of the edge server. When there is a terminal device that is not within the communication range of any edge server, the terminal device can only communicate with the central server through the ground network, which is likely to increase network delay. Due to the network delay in the network environment, when the learning method of federated learning is used to train the intrusion detection model in the related art, the problem of training delay is prone to occur, thereby affecting the training efficiency of the intrusion detection model, and further affecting the detection of network intrusion.

[0055] Additionally, in cyber-physical-social systems, the types of cyber attacks can be as follows:

[0056] Denial of service attack: The attacker sends a large number of requests to a specific edge node, overloading the edge node so that it cannot process normal communication requests, resulting in communication congestion and system failure.

[0057] Power routing overhead broadcast exploitation attack: The attacker broadcasts a large number of invalid data packets, causing edge nodes (such as sensors and actuators) in the cyber-physical social system to consume a lot of resources, including power resources and computing power resources, when processing data packets.

[0058] Remote-to-local attack: An attacker remotely accesses a system through a network and attempts to gain local user privileges. This allows the attacker to take control of system resources, modify configurations, or access sensitive information, including personal data, trade secrets, or detailed information about critical infrastructure in a cyber-physical social system.

[0059] User-to-root attack: The attacker elevates permissions from a normal user to a super user (i.e., root user), gaining the ability to access and tamper with all data within the cyber-physical social system. This may cause the function of the cyber-physical social system to partially or completely fail, disrupting normal operation.

[0060] The above-mentioned attack behaviors may cause the following problems for network intrusion detection devices in the cyber-physical social system:

[0061] Increased communication delay: The attack causes unstable communication between nodes, making some nodes unable to upload data in time, resulting in increased overall communication delay.

[0062] Reduced data transfer rate: Due to network congestion and node failures, the data transfer rate is significantly reduced, affecting the real-time performance of the system.

[0063] Reduced system reliability: Node failures and data tampering attacks reduce system reliability and interfere with normal operations.

[0064] Data security risks: Through remote-to-local attacks and user-to-root attacks, attackers can access or modify sensitive data, resulting in data leakage and privacy risks.

[0065] The above attacks may cause nodes in the cyber-physical social system to be unable to upload data or perform tasks in a timely manner, thereby reducing the performance of the entire network and may cause some nodes to paralyze or malfunction.

[0066] In view of this, an embodiment of the present application provides a training method for an intrusion detection model, which can be applied to the Internet of Things system in the above embodiment. In the embodiment of the present application, when training the intrusion detection model, by isolating the abnormal edge server with poor operating status and network status, only using the training parameters uploaded by the normal edge server for subsequent training, the process of waiting for the abnormal edge server to upload the training parameters can be avoided, thereby reducing the impact of network delay on the training process, so as to improve the training efficiency of the intrusion detection model, thereby reducing the impact on network intrusion detection, and can also avoid the abnormal edge server from participating in the training process, thereby affecting data security.

[0067] Combination Figure 2 As shown, the embodiment of the present application provides a method for training an intrusion detection model, the method comprising the following steps:

[0068] S21, the terminal device collects local network data and sends the network data to the edge server;

[0069] S22, the edge server uses local network data to iteratively train the intrusion detection model.

[0070] S23, when the iterative training reaches the preset conditions, the edge server uploads the training parameters of the intrusion detection model to the central server.

[0071] S24, the central server detects the operating status of the plurality of edge servers respectively, and detects the network status of the plurality of edge servers respectively.

[0072] S25, the central server selects a normal edge server from multiple edge servers according to the operation status and network status.

[0073] S26, the central server updates the training parameters according to the training parameters uploaded by the normal edge server, and sends the updated training parameters to the normal edge server.

[0074] S27, the normal edge server updates the intrusion detection model according to the updated training parameters.

[0075] S28, the normal edge server iteratively trains the updated intrusion detection model again until a trained intrusion detection model is obtained.

[0076] By adopting the training method of the intrusion detection model provided in the embodiment of the present application, in the Internet of Things system, when the edge server trains the intrusion detection model integrated in the terminal device, it can use the local network data for iterative training, and when the iterative training reaches the preset conditions, the training parameters of the intrusion detection model are uploaded to the central server. In the process of the edge server uploading the training parameters to the central server, the central server can respectively detect the operating status and network status of multiple edge servers to filter out normal edge servers from multiple edge servers, wherein the normal edge server refers to an edge server with a good operating status and network status. When the central server updates the training parameters according to the training parameters uploaded by the edge server, it can be implemented only according to the training parameters uploaded by the normal edge server, and the updated training parameters are sent to the normal edge server, so that the normal edge server updates the intrusion detection model based on the updated training parameters, and iteratively trains the updated intrusion detection model again, and repeats until a trained intrusion detection model is obtained. In the embodiment of the present application, since the abnormal edge servers with poor operating status and network status are isolated when training the intrusion detection model, only the training parameters uploaded by the normal edge servers are used for subsequent training, the process of waiting for the abnormal edge servers to upload the training parameters can be avoided, thereby reducing the impact of network delays on the training process, thereby improving the training efficiency of the intrusion detection model, and further reducing the impact on network intrusion detection.

[0077] Optionally, before the above step S22, that is, before the edge server uses network data to iteratively train the integrated intrusion detection model, the central server also initializes the intrusion detection model and sends the initialized intrusion detection model to the terminal device through the edge server.

[0078] In this implementation, in order to detect attacks on complex networks, the intrusion detection model can be a parallel convolutional network (PCDNet) model, in which one-dimensional convolutions are applied in parallel to comprehensively analyze the input network data. In addition, each convolution path processes the network data independently, which can also ensure computational efficiency.

[0079] Optionally, in the above step S22, the edge server uses the network data to iteratively train the integrated intrusion detection model, including preprocessing the network data, inputting the preprocessed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs the category of the network features.

[0080] In this implementation, network data is divided into two categories, namely numerical type and categorical type, and categorical network data is further divided into discrete type and continuous type. In order to uniformly process network data, it is necessary to perform label encoding on categorical network data. Specifically, the categories can be converted into discrete numbers based on the total number of categories. After label encoding, features with many categories may have a large range between their minimum and maximum values. In order to accelerate the convergence of the model, regularization techniques can be used to scale the data to the range of [0, 1] to ensure uniform normalization between different feature types.

[0081] Taking the parallel convolutional network model as an example, after the preprocessed network data is input into the parallel convolutional network model, each convolution path of the parallel convolutional network model will independently process the network data to generate multi-scale features. The multi-scale features are fused to capture deep features of different scales and levels. A set of parameterized convolution kernels and corresponding bias vectors are used to generate feature maps. The specific formula is as follows:

[0082]

[0083] In the above formula (2), represents the feature map, represents the parameterized convolution kernel, X (l-1 ) represents the deep features, Represents the bias vector, I represents the level of the convolution kernel, K represents the size of the convolution kernel, * represents the convolution operation, and l represents the level.

[0084] After that, the obtained feature map is processed by the deep transformation layer, which includes a series of convolution operations to further purify and abstract features. The specific formula is as follows:

[0085]

[0086] In the above formula (3), D (l) Indicates the depth transformation operation on the lth layer. represents the feature map, Represents the feature map obtained after the deep transformation operation.

[0087] Finally, the high-level features are mapped to the probability distribution of the output class through the fully connected layer and the Softmax function. The specific formula is as follows:

[0088]

[0089] In the above formula (4), represents the predicted probability of the i-th sample in the j-th category. exp(z i (j)) represents the z of the exponential function e i (j) power, z i (j) represents the output of the last connected layer in the jth dimension, and U is the number of attack types.

[0090] Optionally, in the above steps S23 to S28, the edge server can upload the training parameters of the intrusion detection model to the central server when the iterative training reaches a preset condition. The preset condition may be that the number of iterative training times reaches a set number, or the input network data training is completed, which is not specifically limited in this application.

[0091] The running status of the edge server can reflect whether the edge server is paralyzed or malfunctions due to an attack, and the network status of the edge server can reflect whether there is high latency when the edge server communicates.

[0092] Furthermore, in the above step S25, a normal edge server is selected from multiple edge servers according to the operation status and the network status, including: the central server determines whether the edge server fails according to the operation status, and obtains the network delay of the edge server based on the network status when the edge server does not fail. The central server compares the network delay of the edge server with the network delay threshold. When the network delay of the edge server is less than the network delay threshold, the central server determines that the edge server is a normal edge server.

[0093] Furthermore, in the above step S26, the central server updates the training parameters according to the training parameters uploaded by the normal edge servers, including: the central server performs an aggregation operation based on the training parameters uploaded by the normal edge servers to update the training parameters.

[0094] In the above implementation, due to the large amount of network data generated by the cyber-physical social system, the centralized learning model cannot train and distinguish normal traffic from attack traffic in real time, and single-point detection has privacy risks. Therefore, a distributed learning method can be used.

[0095] Federated Averaging (FedAvg) is a federated learning algorithm that allows multiple edge servers to collaboratively train a shared model while maintaining local network data. It solves the privacy problem by only sharing model updates instead of original data. The specific formula is as follows:

[0096]

[0097] In the above formula (5), w t+1 represents the weight of the global model after the tth round of iterative training, k represents the number of edge servers participating in federated learning, and n k represents the number of network data samples owned by the kth terminal device, n represents the total number of network data samples owned by all edge servers, represents the weight of the intrusion detection model trained by the k-th edge server after the t-th iteration.

[0098] The federated average algorithm has multiple rounds of communication. Each edge server performs η local stochastic gradient descent (SDG) iterations in one round, and the value of η is set to a fixed value in all edge servers and communication rounds.

[0099] The federated average algorithm performs best when edge servers can continuously access the central server and have similar training time. However, in a large-scale network intrusion detection environment, due to the heterogeneity of data and systems, unstable communication, and imbalanced training time, some edge servers may not be able to upload the training parameters of the intrusion detection model in time, which causes the global model update to deviate from the expected optimization path.

[0100] In order to deal with potential attacks and communication instability in large-scale networks, the operating status and network status of edge servers can be monitored to detect network congestion and paralysis caused by abnormal behavior. The parameters of related edge servers can be adjusted in time to maintain the stability and security of the training process.

[0101] The process of training the intrusion detection model using the federated average algorithm can be as follows:

[0102] The input is the weights or parameters w of the initialized model (0) , the output is the weights or parameters w of the final model (K) .

[0103] Specifically, initialize the weights of the global model. For each round of aggregation, perform the following operations:

[0104] Receive the global weight w (k-1) Perform local training;

[0105] Update based on the local model after x SGD iterations;

[0106] Calculate the error function E i and control parameter delay Delay;

[0107] Receive updated gradients and aggregate them;

[0108] Isolate abnormal edge servers (Delay ≥ γ);

[0109] Update x to minimize G(x);

[0110] Distribute η to normal edge servers (Delay < γ).

[0111] In addition, for detected abnormal edge servers, they can be selectively isolated or have their communication frequency reduced to reduce the negative impact on global model training. Parameters are adjusted based on the status of each working node to minimize the global loss function within time and resource constraints. This approach can improve the efficiency and robustness of the federated learning process, thereby ensuring timeliness and accuracy in network intrusion detection.

[0112] Normal edge servers receive intrusion detection models from the central server and update them locally using local network data. After each worker node completes xi SGD iterations, it sends the local model weights w and control parameters Delay to the central server.

[0113] The central server collects the parameters of the local model from each edge server and performs an aggregation operation. During the aggregation operation, the central server also receives the control parameters of the edge server, which include the network delay Delay of the edge server. The central server compares Delay with the network delay threshold and isolates the abnormal edge servers that are higher than the network delay threshold. Then, the central server calculates a new approximate x value for each terminal device and sends it to the normal terminal devices participating in the next round of training.

[0114] In order to solve the problem of low training efficiency and result deviation caused by network congestion caused by network attacks in a large-scale network intrusion environment. In this implementation, the number of iterative training performed locally on the terminal device can be optimized to minimize the global loss function. The calculation formulas for local loss and global loss are as follows:

[0115]

[0116] The above formula (6) is the calculation formula for local loss, where f j (w) represents the loss metric of the model parameters on data sample j, G i (w) represents the average value of the gradient of function f at point w or the result of the Laplace operator on the i-th node of the graph, which is used to reflect the cumulative effect of a small disturbance on other nodes in the graph when a small disturbance is applied to node i. i | represents the set D i The number of elements in is the number of adjacent nodes or degree of node i. In graph theory, degree refers to the number of edges connected to a node.

[0117]

[0118] In the above formula (7), G(w) represents the weighted sum of the average values ​​of the gradient of function f at point w on the graph, which is the average value of the gradient on the entire graph, where the gradient of each node is weighted according to its degree (i.e., the number of adjacent nodes). i (w) represents the average value of the gradient of function f at point w or the result of the Laplace operator on the i-th node of the graph, which is used to reflect the cumulative effect of a small disturbance on other nodes in the graph when a small disturbance is applied to node i. i | represents the set D i The number of elements in , that is, the number of adjacent nodes or degree of node i. In graph theory, degree refers to the number of edges connected to a node. D represents the sum of the degrees of all nodes in the graph. In graph theory, the sum of the degrees of all nodes in a graph is equal to twice the total number of edges in the graph, because each edge contributes to the degree of two nodes.

[0119] The total time consumption of the constraint condition cannot exceed the budget time T, the formula is as follows:

[0120]

[0121] In the above formula (8), in the kth round, the time resource consumed by each local SGD iteration on each worker node i is The time resource consumed by each global aggregation step is c k , assuming that the time for all local SGD iterations x in round k is are the same, and the global aggregate time c of all working nodes k The same is true.

[0122] To convert the formula into a more tractable form, we approximate it by taking an upper bound on the loss function as follows:

[0123]

[0124] In the above formulas (9) and (10), the objective function decreases as x increases. Therefore, the optimal value for any x is

[0125] In order to simplify the analysis, the implementation method performs approximate calculation by ignoring the rounding operation and substituting it into the formula to obtain the following formula:

[0126]

[0127] In the above formula (11), as the gradient decreases, the value of {x} changes, thereby reducing the value of the function G(x). Therefore, an approximate optimal result {x} is obtained, which minimizes the value of the function G(x) at the end of the gradient descent.

[0128] In this implementation, there is also the following calculation process:

[0129]

[0130] I=G(w0)-G(w * ) (15)

[0131] In the above formulas (12) to (15), D i represents the size of the local training dataset on node i, ρ i represents the Lipschitz constant of the loss function at node i, g i (η i ) represents the error term function of node i when the number of local SGD iterations is η. Φ i represents the control parameter, η i Represents the number of local SGD iterations of node i. For each round k, gradient descent is used to minimize the objective function G(η). Assuming that the initial η is the same for all working nodes, adjusting the value of η by gradient descent can reduce the value of the objective function, and finally set an approximate optimal number of iterations for different terminal devices.

[0132] In order to reflect the beneficial effects of the above embodiments, the embodiment of the present application provides a method for verifying the training method of the intrusion detection model. In this method, PCDNet is a parallel convolutional network model, Fed-LSNIDS (Federated Locally Selective Network Intrusion Detection System) is a federated local selective network intrusion detection system, and FedAvg is a federated average algorithm. Specifically, it is as follows:

[0133] NSL-KDD is a network intrusion detection dataset that provides a standardized test platform. This dataset is improved on the basis of the KDD Cup1999 dataset, eliminating redundant and noisy data while retaining the basic features and complexity required for intrusion detection. NSL-KDD contains a wide range of traffic, content, and time features, describing network communication behavior. The dataset divides attack types into five categories: Normal, Probe, Remote to Local (R2L), User to Root (U2R), and Denial of Service (DoS). The diversity of attack types enables NSL-KDD to effectively simulate the real network environment. Therefore, it is widely used to verify large-scale network intrusion models. The dataset mainly contains two files: KDDtrain+.txt and KDDtest+.txt, which contain non-redundant training data and test data respectively. In this dataset, normal traffic and Denial of Service (DoS) attacks dominate, while User to Root (U2R) and Remote to Local (R2L) attacks are relatively rare in the training set, but become more common in the test set. The detailed data distribution is shown in Table 1 below:

[0134]

[0135] Table 1

[0136] In this implementation, the four data used to evaluate the performance of the model are as follows: True Positives (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN). The performance of the method is evaluated by the following indicators: Accuracy, Precision, Recall, and F1Score. The specific formula is as follows:

[0137]

[0138] In this implementation, in order to independently evaluate the PCDNet model, centralized training was performed using the entire training data set. In order to maintain the consistency of the training set and the test set, it is necessary to exclude attack types that do not exist in the training set. The various deep learning models tested include MLP, CNN, and BGRU, and the intrusion detection model trained in the aforementioned embodiment is compared with CNN-MLP to evaluate the effectiveness of the training method of the intrusion detection model in the aforementioned embodiment.

[0139] Combination Figure 3As shown, in the accuracy comparison, the training method of the intrusion detection model in the aforementioned embodiment achieved a highest accuracy of 89.8% on the test data set, which is better than 88.1% of CNN-MLP and 86.2%, 87.1% and 85.8% of the other three methods in terms of accuracy.

[0140] In this implementation, the PCDNet model performs well in detecting various cyber intrusion behaviors that cyber-physical social systems are susceptible to, and significantly outperforms other classification models in terms of precision, recall, and F1-score. Specifically, Precision, Recall, and F1-Score are shown in Table 2 below:

[0141]

[0142]

[0143] Table 2

[0144] Based on the above Table 2, it can be seen that in terms of accuracy, the PCDNet model performs particularly well in the normal traffic (Normal), remote to local (R2L) and user to root user (U2R) categories, reaching 0.881, 0.985 and 0.857 respectively. This shows that the PCDNet model can accurately identify the attack types in the category and effectively reduce false positives.

[0145] In addition, the PCDNet model performs well in terms of recall rate, and is significantly better than the other four models in terms of recall rate of the four attack types. It can be seen that the PCDNet model is strong in processing sparse data, can capture more target attack instances, and significantly improve the detection rate.

[0146] The F1 score balances precision and recall and is an important indicator for classification tasks. The PCDNet model has shown high performance in multiple categories. In particular, in minority attack types such as R2L and U2R, the F1 scores reached 0.455 and 0.621 respectively, significantly surpassing other detection models. It can be seen that the PCDNet model can accurately identify minority attacks.

[0147] Optionally, in this implementation, two groups of experiments are conducted, and by introducing different delay times for different nodes, the heterogeneity of device hardware and network conditions in the CPSS environment can be simulated.

[0148] The experiment simulates that the data of each node follows an independent and identically distributed statistical distribution in CPSS, and assigns the same mean and variance to each node to ensure the consistency of the data, so that the system performance can be analyzed.

[0149] The experiment also simulated that the data of each node follows non-independent and different statistical distributions in CPSS. By assigning different means and variances to each node and introducing data correlation between nodes to represent the heterogeneity of devices and networks, the system performance is evaluated in this complex scenario. In this implementation, two groups of experiments were conducted: one group used independent and identically distributed (IID) data, and the other group used non-independent and identically distributed (NIID) data to simulate data heterogeneity. Although the data in CPSS is usually non-independent and correlated, under certain conditions, the data may exhibit independent and identically distributed characteristics. For example, when multiple devices or sensors of the same type operate in similar environments, their data may appear to be IID. Through the above experiments, the performance of the framework under different data distribution conditions can be verified.

[0150] Combination Figure 4 As shown, an embodiment of the present application provides a performance diagram of an intrusion detection model on IID data. Among them, in the independent and identically distributed (IID) data scenario, Fed-LSNIDS shows a faster convergence speed in the early and middle stages of training compared with FedAvg. In the CPSS environment, Fed-LSNIDS effectively solves network heterogeneity problems, such as delay differences. Especially in the early stages of training, when the model accuracy is low, FedAvg finds it difficult to quickly improve its performance. In contrast, Fed-LSNIDS converges faster by adaptively adjusting the number of local iterations, and significantly improves the accuracy of the model in a shorter time.

[0151] In the later stages of training, the global model showed strong generalization ability. However, due to the consistent data distribution and independent and identically distributed (IID) characteristics, the impact of network heterogeneity delay on the overall model was mitigated, and FedAvg and Fed-LSNIDS finally achieved similar accuracy. This shows that the Fed-LSNIDS method considering network heterogeneity has obvious advantages in improving the efficiency of model training in CPSS.

[0152] Combination Figure 5As shown, an embodiment of the present application provides a performance diagram of an intrusion detection model on N-IID data. Among them, under non-independent and identically distributed (NIID) data, the training stability and efficiency of FedAvg and Fed-LSNIDS in the CPSS environment show significant differences in the middle and late stages. The accuracy of Fed-LSNIDS is significantly higher than that of FedAvg. Although the accuracy of the global model has fluctuated greatly due to NIID data interference and network congestion, the overall accuracy continues to improve. Fed-LSNIDS effectively reduces the weight drift in CPSS by adjusting the number of training iterations of the local detection node, thereby improving the accuracy of the aggregation model. This shows that Fed-LSNIDS is more robust and efficient in handling data heterogeneity and network latency, especially in the CPSS environment.

[0153] Furthermore, in this implementation, the robustness of the intrusion detection model needs to be evaluated. Figure 6 As shown, the accuracy distribution of the IID dataset over 110 time intervals is shown. The first sub-figure is a violin plot, which combines a box plot and a kernel density estimate. The width of each accuracy level represents its distribution over the 110 time points. The wider part indicates that the model achieves this accuracy level more frequently. A box plot is also included in each violin plot to increase clarity. The second sub-figure is an enlarged box plot for better visualization. Although FedAvg and Fed-LSNIDS have similar accuracies, Fed-LSNIDS is more stable overall. The accuracy distribution of Fed-LSNIDS is highly concentrated around 88%, with lower density at both ends. In contrast, the accuracy of FedAvg is mainly distributed between 87% and 87.5%, with more time intervals showing accuracies below 85%.

[0154] Combination Figure 7 As shown, an embodiment of the present application provides an accuracy distribution on non-independent and identically distributed (NIID) data, wherein Fed-LSNIDS exhibits remarkable stability. In contrast, the accuracy distribution of FedAvg is more dispersed, mainly ranging between 82% and 87%. In addition, during the training process, the accuracy of FedAvg decreased in certain time periods. This instability is mainly due to the heterogeneity in the CPSS environment, which causes the global model to deviate from the optimal update direction. Fed-LSNIDS effectively solves the heterogeneity problem by adaptively adjusting the number of local training iterations. In CPSS, there may be significant differences in device and network performance, resulting in inconsistent model updates. The Fed-LSNIDS method dynamically adjusts the number of training iterations for each node to ensure that the model converges more smoothly in a heterogeneous environment.

[0155] This adaptive adjustment strategy is particularly critical in the later stages of training. Fed-LSNIDS demonstrates strong robustness, effectively maintains high accuracy, and mitigates performance fluctuations caused by heterogeneity. Therefore, Fed-LSNIDS not only enhances the stability of the overall model, but also shows excellent training effects and improves resistance to interference in complex CPSS environments.

[0156] Optionally, combined Figure 8 and Fig. 9 As shown in Figure 2, in a complex environment, the heterogeneity of CPSS may cause nodes with slower performance to be mistaken as vulnerable nodes, which may be exposed to network attacks. At this time, the data is not independent and identically distributed.

[0157] Slow nodes are used to simulate the hardware heterogeneity in the CPSS environment. In this implementation, four different delay time intervals are used in this evaluation, each of which is 110 seconds. The framework consists of five detection nodes, four of which are normal nodes and one is an abnormal node.

[0158] To replicate the real CPSS environment, these slow nodes are partially isolated and their performance is compared with FedAvg and AAFL to evaluate the convergence and accuracy in the same time period. This comparison can better illustrate how distributed detection algorithms handle heterogeneity and node isolation in CPSS.

[0159] The results show that compared with FedAvg and AAFL, the training method of the intrusion detection model provided by the aforementioned embodiment performs better in detection accuracy and convergence speed. Since it is achieved by adaptively isolating high-latency nodes under unstable network conditions, it effectively alleviates the training delay problem caused by high latency in CPSS.

[0160] As can be seen from the above, from the perspective of privacy and security requirements, federated learning is more suitable for cyber-physical social systems. However, in view of the complex, long-distance communications and infrastructure in CPSS, especially the delay differences caused by node heterogeneity, the embodiment of the present application provides an adaptive framework of Fed-LSNIDS. Experimental results show that the training method of the intrusion detection model provided in the embodiment of the present application has the following advantages:

[0161] High performance of detection models: The local node adopts the PCDNet model, which can show excellent precision, recall and F1 score in various attack classifications.

[0162] Faster model convergence: In CPSS, some nodes exhibit slow responses due to long-distance communication delays and node heterogeneity. Fed-LSNIDS accelerates the convergence of the global model by adaptively adjusting the number of iterations for each node in each round.

[0163] Enhanced network delay handling performance: In CPSS, severe network delays may impair the detection performance of local nodes. The impact of delays on model training is mitigated by isolating abnormally slow nodes and applying the adaptive method introduced in Fed-LSNIDS. This stabilization of the aggregation process improves the performance of the model in practical applications.

[0164] In summary, the distributed collaborative detection framework of Fed-LSNIDS proposed in the embodiment of the present application. Taking into account the huge and complex data in CPSS, the PCDNet model is adopted, in which multiple parallel one-dimensional convolutions are used for multi-scale feature fusion to process features from different network flow data. At the same time, the model also uses a deep neural network (DNN) for attack classification. In order to solve the asynchronous training problem caused by distance and communication delay, the embodiment of the present application adopts an adaptive federated aggregation algorithm to handle changes in network delays between devices. In addition, the training method of the intrusion detection model provided in the embodiment of the present application was verified on the NSL-KDD dataset, and the robustness and high accuracy of the intrusion detection model trained on the IID dataset and the NIID dataset were verified. Moreover, in the scenario of simulating network delay in CPSS, the isolation algorithm is superior to other federated learning frameworks in terms of processing efficiency and accuracy.

[0165] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present application. The aforementioned storage medium may be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, and other media that can store program codes, or a transient storage medium.

[0166] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible changes. Unless explicitly required, separate components and functions are optional, and the order of operation may vary. The parts and features of some embodiments may be included in or replace the parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and the claims, unless the context clearly indicates, the singular forms of "a", "an" and "the" are intended to include plural forms as well. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of listings containing one or more associated ones. In addition, when used in the present application, the term "comprise" and its variants "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups thereof. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical elements in the process, method or device comprising the elements. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments may refer to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can refer to the description of the method part.

[0167] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods to implement the described functions for each specific application, but such implementations should not be considered to exceed the scope of the embodiments of the present application. The technicians may clearly understand that, for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above may refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here.

[0168] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units can be only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, each functional unit in the embodiment of the present application may be integrated in a processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit.

[0169] The flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to the embodiment of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two continuous boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowchart and the block diagram in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in a different order from the order disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two continuous operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A training method for an intrusion detection model, characterized in that: Applied to an Internet of Things system, the Internet of Things system includes a central server, an edge server cluster and an edge node cluster; wherein the edge server cluster includes multiple edge servers, the edge node cluster includes multiple terminal devices, the edge servers in the edge server cluster are respectively connected to the central server and the terminal devices, and the edge servers in the edge server cluster and the multiple terminal devices in the edge node cluster are in a one-to-many relationship, and the terminal device is integrated with an intrusion detection model; the method includes: The terminal device collects local network data and sends the network data to the edge server; The edge server uses the network data to iteratively train the intrusion detection model, and when the iterative training reaches a preset condition, uploads the training parameters of the intrusion detection model to the central server; The edge server detects the running status of the plurality of edge servers respectively, and detects the network status of the plurality of edge servers respectively, and selects a normal edge server from the plurality of edge servers according to the running status and the network status; The central server updates the training parameters according to the training parameters uploaded by the normal edge server, and sends the updated training parameters to the normal edge server; The normal edge server updates the intrusion detection model according to the updated training parameters, and iteratively trains the updated intrusion detection model again until a trained intrusion detection model is obtained.

2. The method according to claim 1, characterized in that Before the edge server uses the network data to iteratively train the intrusion detection model, the method further includes: The central server initializes the intrusion detection model, and sends the initialized intrusion detection model to the terminal device through the edge server.

3. The method according to claim 1, characterized in that The edge server uses the network data to iteratively train the integrated intrusion detection model, including: The edge server pre-processes the network data; The edge server inputs the preprocessed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs the categories of the network features.

4. The method according to claim 1, characterized in that: Filtering a normal edge server from the plurality of edge servers according to the running state and the network state includes: The central server determines whether the edge server fails according to the operating status, and obtains the network delay of the edge server based on the network status when the edge server does not fail; The central server compares the network delay of the edge server with a network delay threshold; When the network delay of the edge server is less than the network delay threshold, the central server determines that the edge server is a normal edge server.

5. The method according to claim 1, characterized in that The central server updates the training parameters according to the training parameters uploaded by the normal edge server, including: The central server performs an aggregation operation based on the training parameters uploaded by the normal terminal devices to update the training parameters.

6. An Internet of Things system, characterized in that: It includes a central server, an edge server cluster and an edge node cluster; the edge node cluster includes multiple terminal devices, the edge server cluster includes multiple edge servers, the edge servers in the edge server cluster are connected to the central server and the terminal devices respectively, and the edge servers in the edge server cluster and the multiple terminal devices in the edge node cluster are in a one-to-many relationship, and the terminal devices are integrated with an intrusion detection model; wherein: The terminal device is used to collect local network data and send the network data to the edge server; The edge server is used to iteratively train the intrusion detection model using the network data, and upload the training parameters of the intrusion detection model to the central server when the iterative training reaches a preset condition; The central server is used to detect the operation status of the plurality of edge servers respectively, and the network status of the plurality of edge servers respectively, and select a normal edge server from the plurality of edge servers according to the operation status and the network status; The central server is further configured to update the training parameters according to the training parameters uploaded by the normal edge server, and send the updated training parameters to the normal edge server; The normal edge server is used to update the intrusion detection model according to the updated training parameters, and iteratively train the updated intrusion detection model again until a trained intrusion detection model is obtained.

7. The system according to claim 6, characterized in that The central server is also used to initialize the intrusion detection model and send the initialized intrusion detection model to the terminal device through the edge server.

8. The system according to claim 6, characterized in that The edge server is specifically used to preprocess the network data; input the preprocessed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs the categories of the network features.

9. The system according to claim 6, characterized in that The central server is specifically used to determine whether the edge server fails according to the operating status, and when the edge server does not fail, obtain the network delay of the edge server based on the network status; compare the network delay of the edge server with a network delay threshold; and when the network delay of the edge server is less than the network delay threshold, determine that the edge server is a normal edge server.

10. The system according to claim 6, characterized in that The central server is specifically configured to perform an aggregation operation based on the training parameters uploaded by the normal edge server to update the training parameters.

Images