Intrusion detection model training method and Internet of Things system

Abstract

This application relates to the field of intrusion detection technology and discloses a method for training an intrusion detection model. During intrusion detection model training, abnormal edge servers with poor operating and network conditions are isolated, and subsequent training is performed using only training parameters uploaded by normal edge servers. This avoids waiting for abnormal edge servers to upload training parameters, thereby reducing the impact of network latency on the training process, improving the training efficiency of the intrusion detection model, and further reducing the impact on network intrusion detection. This application also discloses an Internet of Things system.

Description

Technical Field

[0001] The present application relates to the field of intrusion detection technology, for example, to a training method for an intrusion detection model and an Internet of Things system. Background Art

[0002] With the rapid development of science and technology, Internet of Things (IoT) devices are generating vast amounts of data. This vast amount of data plays a key role in real-time monitoring, production optimization, predictive maintenance, and intelligent decision-making. In cyber-physical-social systems (CPSS), this vast amount of data can reflect various parameters in the production process, helping managers to gain a real-time understanding of production status. By analyzing this vast amount of data, managers can identify bottlenecks and inefficiencies in the production process, thereby optimizing production processes and improving production efficiency and product quality. However, this massive amount of data poses a significant risk of cyber intrusion.

[0003] To detect network intrusions, related technologies primarily employ intrusion detection models. Furthermore, to protect data privacy, related technologies employ federated learning methods to train intrusion detection models.

[0004] However, due to network delays in the network environment, when the federated learning method is used in related technologies to train intrusion detection models, training delays are prone to occur, thereby affecting the training efficiency of the intrusion detection model and further affecting the detection of network intrusions. Summary of the Invention

[0005] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical elements or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.

[0006] The embodiments of the present application provide a training method for an intrusion detection model and an Internet of Things system, which can improve the training efficiency of the intrusion detection model when the intrusion detection model is trained using a federated learning method.

[0007] In a first aspect, an embodiment of the present application provides a training method for an intrusion detection model, which is applied to an Internet of Things system, wherein the Internet of Things system includes a central server, an edge server cluster, and an edge node cluster; wherein the edge node cluster includes multiple terminal devices, the edge server cluster includes multiple edge servers, the edge servers in the edge server cluster are respectively connected to the central server and the terminal devices, and the edge servers in the edge server cluster have a one-to-many relationship with the multiple terminal devices in the edge node cluster, and the terminal devices are integrated with an intrusion detection model; the method includes:

[0008] The terminal device collects local network data and sends the network data to the edge server;

[0009] The edge server uses the network data to iteratively train the intrusion detection model, and when the iterative training reaches a preset condition, uploads the training parameters of the intrusion detection model to the central server;

[0010] The central server detects the operating status of the plurality of edge servers respectively, and detects the network status of the plurality of edge servers respectively, and selects a normal edge server from the plurality of edge servers according to the operating status and the network status;

[0011] The central server updates the training parameters according to the training parameters uploaded by the normal edge server, and sends the updated training parameters to the normal edge server;

[0012] The normal edge server updates the intrusion detection model according to the updated training parameters, and iteratively trains the updated intrusion detection model again until a trained intrusion detection model is obtained.

[0013] Optionally, before the edge server uses the network data to iteratively train the intrusion detection model, the method further includes: the central server initializing the intrusion detection model, and sending the initialized intrusion detection model to the terminal device through the edge server.

[0014] Optionally, the edge server uses the network data to iteratively train the integrated intrusion detection model, including: the edge server preprocesses the network data; the edge server inputs the preprocessed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs the category of the network features.

[0015] Optionally, a normal edge server is screened out from the plurality of edge servers based on the operating status and the network status, including: the central server determines whether the edge server fails based on the operating status, and when the edge server does not fail, obtains the network delay of the edge server based on the network status; the central server compares the network delay of the edge server with a network delay threshold; and the central server determines that the edge server is a normal edge server when the network delay of the edge server is less than the network delay threshold.

[0016] Optionally, the central server updates the training parameters according to the training parameters uploaded by the normal edge server, including: the central server performs an aggregation operation based on the training parameters uploaded by the normal edge server to update the training parameters.

[0017] In a second aspect, an embodiment of the present application provides an Internet of Things system, comprising a central server, an edge server cluster, and an edge node cluster; the edge node cluster comprises a plurality of terminal devices, the edge server cluster comprises a plurality of edge servers, the edge servers in the edge server cluster are respectively connected to the central server and the terminal devices, and the edge servers in the edge server cluster have a one-to-many relationship with the plurality of terminal devices in the edge node cluster, and the terminal devices are integrated with an intrusion detection model; wherein:

[0018] The terminal device is used to collect local network data and send the network data to the edge server;

[0019] The edge server is configured to iteratively train the intrusion detection model using the network data, and upload the training parameters of the intrusion detection model to the central server when the iterative training reaches a preset condition;

[0020] The central server is configured to respectively detect the operating status of the plurality of edge servers and the network status of the plurality of edge servers, and select a normal edge server from the plurality of edge servers based on the operating status and the network status;

[0021] The central server is further configured to update the training parameters according to the training parameters uploaded by the normal edge server, and send the updated training parameters to the normal edge server;

[0022] The normal edge server is used to update the intrusion detection model according to the updated training parameters, and iteratively train the updated intrusion detection model again until a trained intrusion detection model is obtained.

[0023] Optionally, the central server is further configured to initialize the intrusion detection model and send the initialized intrusion detection model to the terminal device via the edge server.

[0024] Optionally, the edge server is specifically configured to preprocess the network data; input the preprocessed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs categories of the network features.

[0025] Optionally, the central server is specifically used to determine whether the edge server fails based on the operating status, and when the edge server does not fail, obtain the network delay of the edge server based on the network status; compare the network delay of the edge server with a network delay threshold; when the network delay of the edge server is less than the network delay threshold, determine that the edge server is a normal edge server.

[0026] Optionally, the central server is specifically configured to perform an aggregation operation based on the training parameters uploaded by the normal edge server to update the training parameters.

[0027] The intrusion detection model training method and Internet of Things system provided in the embodiments of the present application can achieve the following technical effects:

[0028] In an IoT system, when an edge server trains an intrusion detection model integrated into a terminal device, it can perform iterative training using local network data. When the iterative training reaches a preset condition, the training parameters of the intrusion detection model are uploaded to a central server. While the edge server is uploading the training parameters to the central server, the central server can separately monitor the operating status and network status of multiple edge servers to select healthy edge servers from the multiple edge servers. Healthy edge servers are those with good operating and network status. When the central server updates the training parameters based on the training parameters uploaded by the edge servers, it can do so solely based on the training parameters uploaded by healthy edge servers. The central server then sends the updated training parameters to the healthy edge servers, allowing them to update their intrusion detection models based on the updated training parameters and iteratively train the updated intrusion detection models again. This cycle continues until a trained intrusion detection model is achieved. In an embodiment of the present application, since abnormal edge servers with poor operating status and network status are isolated when training the intrusion detection model, only training parameters uploaded by normal edge servers are used for subsequent training, the process of waiting for abnormal edge servers to upload training parameters can be avoided, thereby reducing the impact of network delays on the training process, thereby improving the training efficiency of the intrusion detection model and reducing the impact on network intrusion detection.

[0029] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] One or more embodiments are exemplarily described by corresponding drawings. These exemplary descriptions and drawings do not limit the embodiments. Elements with the same reference numerals in the drawings are shown as similar elements. The drawings do not constitute a scale limitation. In addition,

[0031] Figure 1 is a schematic diagram of an Internet of Things system provided by an embodiment of the present application;

[0032] Figure 2 is a schematic diagram of a training method for an intrusion detection model provided in an embodiment of the present application;

[0033] Figure 3 This is a schematic diagram of the accuracy of test data when different models are applied, provided in an embodiment of the present application;

[0034] Figure 4 This is a graph showing the performance of an intrusion detection model provided by an embodiment of the present application on IID data;

[0035] Figure 5 This is a graph showing the performance of an intrusion detection model provided in an embodiment of the present application on N-IID data;

[0036] Figure 6 Schematic diagram of stability training of an intrusion detection model on IID data provided by an embodiment of the present application;

[0037] Figure 7 Schematic diagram of stability training of an intrusion detection model provided in an embodiment of the present application on N-IID data;

[0038] Figure 8 Schematic diagram of network delay performance of NIID data by an intrusion detection model provided in an embodiment of the present application;

[0039] Figure 9 This is a schematic diagram of the convergence speed of an intrusion detection model provided in an embodiment of the present application in a network delay environment. DETAILED DESCRIPTION

[0040] In the description, claims, and drawings of the embodiments of the present application, the terms "first," "second," and the like are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate for the purposes of describing the embodiments of the present application herein. In addition, the terms "including," "having," and any variations thereof are intended to cover non-exclusive inclusions.

[0041] Unless otherwise stated, the term "plurality" means two or more.

[0042] In the embodiments of the present application, the character " / " indicates that the preceding and following objects are in an "or" relationship. For example, A / B means: A or B.

[0043] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.

[0044] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.

[0045] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The accompanying drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the sake of convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.

[0046] Combine Figure 1 As shown, an embodiment of the present application provides a network architecture diagram of an Internet of Things system, which includes at least a central server, an edge server cluster, and an edge node cluster. The edge node cluster includes multiple terminal devices, and the edge server cluster includes multiple edge servers. The edge servers in the edge server cluster are connected to the central server and the terminal devices, respectively. The edge servers in the edge server cluster form a one-to-many relationship with the multiple terminal devices in the edge node cluster, and the terminal devices are integrated with intrusion detection models.

[0047] In an embodiment of the present application, the central server may be a cloud server, and the terminal device may be a smart device equipped with multiple sensors.

[0048] With the rapid development of science and technology, IoT devices are generating vast amounts of data. This vast amount of data plays a key role in real-time monitoring, production optimization, predictive maintenance, and intelligent decision-making. In cyber-physical systems, this vast amount of data can reflect various parameters in the production process, helping managers to keep abreast of production status. Analysis of this vast amount of data allows managers to identify bottlenecks and inefficiencies in the production process, thereby optimizing production processes and improving production efficiency and product quality. Furthermore, in-depth analysis of this vast amount of data can predict failures, preemptively schedule maintenance, and reduce equipment downtime and maintenance costs. Furthermore, data provides the foundation for intelligent decision-making, helping companies make more accurate decisions regarding resource allocation and production planning.

[0049] However, the sheer volume of data increases the risk of cyber intrusion. Cyber-physical social systems exhibit significant variations due to regional heterogeneity. In highly heterogeneous environments, data security is difficult to guarantee, and communication latency is high. Data privacy and cyberattacks are the primary factors impacting data security. Protecting data privacy and defending against cyberattacks are crucial during data collection, transmission, and storage. Effective access management and control are also essential in heterogeneous environments to prevent unauthorized access and manipulation.

[0050] To address these issues, related technologies employ federated learning to train intrusion detection models. Federated learning is a distributed machine learning method that enables model training without centralized data, effectively protecting data privacy. Furthermore, implementing federated learning in cyber-physical social systems can reduce data transmission, minimize communication latency, and maintain data localization, thereby preventing data leakage. Furthermore, federated learning enhances the security of the entire system by allowing local models in each region to share attack detection experience, enabling cross-regional collaborative defense. Optimizing the communication protocols and transmission paths in federated learning can further improve system efficiency and security. In this way, federated learning can address issues related to system security and efficiency by ensuring data privacy, enhancing attack detection, and optimizing communication.

[0051] However, due to the wide distribution of devices in the IoT system and the limited communication range, edge servers can only cover certain areas, and there may be terminal devices that cannot communicate with any edge server. Among them, whether a terminal device is within the communication range of the edge server can be determined by the following formula:

[0052] d(v i ,e j )≤R ej (1)

[0053] In the above formula (1), v i Indicates terminal equipment, ej represents the edge server, d(v i ,e j ) represents the distance between the terminal device and the edge device, R ej Indicates the communication radius of the edge server.

[0054] In this way, by determining whether the distance between the terminal device and the edge server is less than or equal to the edge server's communication radius, it is possible to determine whether the terminal device is within the edge server's communication range. When a terminal device is not within the communication range of any edge server, it can only communicate with the central server via the ground network, which can increase network latency. Due to network latency in the network environment, the related art's use of federated learning methods to train intrusion detection models is prone to training delays, which can affect the training efficiency of the intrusion detection model and, in turn, the detection of network intrusions.

[0055] Additionally, in cyber-physical-social systems, the types of cyber attacks can be as follows:

[0056] Denial of service attack: The attacker sends a large number of requests to a specific edge node, overloading the edge node and making it unable to process normal communication requests, resulting in communication congestion and system failure.

[0057] Power routing overhead broadcast exploitation attack: The attacker broadcasts a large number of invalid data packets, causing edge nodes (such as sensors and actuators) in the cyber-physical social system to consume a large amount of resources, including power resources and computing power resources, when processing data packets.

[0058] Remote-to-local attacks: Attackers access a system remotely through the network and attempt to gain local user privileges. This allows them to control system resources, modify configurations, or access sensitive information, including personal data, trade secrets, or detailed information about critical infrastructure in cyber-physical social systems.

[0059] User-to-root attack: An attacker elevates privileges from a regular user to a superuser (i.e., root user), gaining the ability to access and tamper with all data within a cyber-physical social system. This can cause the system to partially or completely fail, disrupting normal operations.

[0060] The above-mentioned attack behaviors may cause the following problems for network intrusion detection devices in cyber-physical social systems:

[0061] Increased communication delay: The attack causes unstable communication between nodes, making some nodes unable to upload data in time, resulting in increased overall communication delay.

[0062] Reduced data transmission rate: Due to network congestion and node failures, the data transmission rate is significantly reduced, affecting the real-time performance of the system.

[0063] Reduced system reliability: Node failures and data tampering attacks reduce system reliability and interfere with normal operations.

[0064] Data security risks: Through remote-to-local attacks and user-to-root attacks, attackers can access or modify sensitive data, leading to data leakage and privacy risks.

[0065] The above attacks may cause nodes in the cyber-physical social system to be unable to upload data or perform tasks in a timely manner, thereby reducing the performance of the entire network and may cause some nodes to be paralyzed or malfunction.

[0066] In view of this, an embodiment of the present application provides a method for training an intrusion detection model, which can be applied to the Internet of Things system in the above embodiment. In this embodiment of the present application, when training the intrusion detection model, by isolating abnormal edge servers with poor operating status and network status, and only using the training parameters uploaded by normal edge servers for subsequent training, the process of waiting for abnormal edge servers to upload training parameters can be avoided, thereby reducing the impact of network delays on the training process, thereby improving the training efficiency of the intrusion detection model, and further reducing the impact on network intrusion detection. It can also prevent abnormal edge servers from participating in the training process, thereby affecting data security.

[0067] Combine Figure 2 As shown, the embodiment of the present application provides a method for training an intrusion detection model, which includes the following steps:

[0068] S21, the terminal device collects local network data and sends the network data to the edge server;

[0069] S22, the edge server uses local network data to iteratively train the intrusion detection model.

[0070] S23, when the iterative training reaches the preset conditions, the edge server uploads the training parameters of the intrusion detection model to the central server.

[0071] S24, the central server detects the operating status of the multiple edge servers respectively, and detects the network status of the multiple edge servers respectively.

[0072] S25, the central server selects a normal edge server from multiple edge servers according to the operation status and network status.

[0073] S26, the central server updates the training parameters according to the training parameters uploaded by the normal edge server, and sends the updated training parameters to the normal edge server.

[0074] S27, the normal edge server updates the intrusion detection model according to the updated training parameters.

[0075] S28, the normal edge server iteratively trains the updated intrusion detection model again until a trained intrusion detection model is obtained.

[0076] By adopting the training method of the intrusion detection model provided in the embodiment of the present application, in the Internet of Things system, when the edge server trains the intrusion detection model integrated in the terminal device, it can use local network data for iterative training, and when the iterative training reaches the preset conditions, the training parameters of the intrusion detection model are uploaded to the central server. During the process of the edge server uploading the training parameters to the central server, the central server can respectively detect the operating status and network status of multiple edge servers to filter out normal edge servers from the multiple edge servers, wherein the normal edge server refers to an edge server with a good operating status and network status. When the central server updates the training parameters based on the training parameters uploaded by the edge server, it can only be implemented based on the training parameters uploaded by the normal edge server, and the updated training parameters can be sent to the normal edge server, so that the normal edge server updates the intrusion detection model based on the updated training parameters, and iteratively trains the updated intrusion detection model again, and repeats this cycle until a trained intrusion detection model is obtained. In an embodiment of the present application, since abnormal edge servers with poor operating status and network status are isolated when training the intrusion detection model, only training parameters uploaded by normal edge servers are used for subsequent training, the process of waiting for abnormal edge servers to upload training parameters can be avoided, thereby reducing the impact of network delays on the training process, thereby improving the training efficiency of the intrusion detection model and reducing the impact on network intrusion detection.

[0077] Optionally, before the above step S22, that is, before the edge server uses network data to iteratively train the integrated intrusion detection model, the central server also initializes the intrusion detection model and sends the initialized intrusion detection model to the terminal device through the edge server.

[0078] In this implementation, to detect attacks on complex networks, the intrusion detection model can be a Parallel Convolution Detection Network (PCDNet) model. This model applies one-dimensional convolutions in parallel to comprehensively analyze input network data. Furthermore, each convolution path processes network data independently, ensuring computational efficiency.

[0079] Optionally, in the above step S22, the edge server uses the network data to iteratively train the integrated intrusion detection model, including preprocessing the network data and inputting the preprocessed network data into the intrusion detection model so that the intrusion detection model extracts network features and outputs the category of the network features.

[0080] In this embodiment, network data is divided into two categories: numerical and categorical. Categorical network data is further divided into discrete and continuous types. To uniformly process network data, label encoding is required for the categorical network data. Specifically, the categories can be converted into discrete numbers based on the total number of categories. After label encoding, features with many categories may have a large range between their minimum and maximum values. To accelerate model convergence, regularization techniques can be used to scale the data to the range of [0, 1] to ensure uniform normalization across different feature types.

[0081] Taking the parallel convolutional network model as an example, after the preprocessed network data is input into the parallel convolutional network model, each convolution path of the parallel convolutional network model will independently process the network data to generate multi-scale features. The multi-scale features are fused to capture deep features of different scales and levels. A set of parameterized convolution kernels and corresponding bias vectors are used to generate feature maps. The specific formula is as follows:

[0082]

[0083] In the above formula (2), represents the feature map, represents the parameterized convolution kernel, X (l-1 ) represents deep features, Represents the bias vector, I represents the level of the convolution kernel, K represents the size of the convolution kernel, * represents the convolution operation, and l represents the level.

[0084] After that, the obtained feature map is processed by the deep transformation layer, which includes a series of convolution operations to further purify and abstract features. The specific formula is as follows:

[0085]

[0086] In the above formula (3), D (l) Indicates the depth transformation operation on the lth layer, represents the feature map, Represents the feature map obtained after the depth transformation operation.

[0087] Finally, the high-level features are mapped to the probability distribution of the output class through the fully connected layer and the Softmax function. The specific formula is as follows:

[0088]

[0089] In the above formula (4), It represents the predicted probability of the i-th sample in the j-th category. exp(z i (j)) represents the z of the exponential function e i (j) power, z i (j) represents the output of the last connected layer in the jth dimension, and U is the number of attack types.

[0090] Optionally, in steps S23 to S28 above, the edge server may upload the training parameters of the intrusion detection model to the central server when the iterative training meets a preset condition. The preset condition may be that the number of iterative training times reaches a set number, or that the training of the input network data is completed, which is not specifically limited in this application.

[0091] The running status of the edge server can reflect whether the edge server is paralyzed or malfunctioning due to an attack, and the network status of the edge server can reflect whether there is high latency when the edge server communicates.

[0092] Furthermore, in step S25, selecting a normal edge server from the plurality of edge servers based on the operating status and network status includes: the central server determining whether the edge server has failed based on the operating status; and if the edge server has not failed, obtaining the network latency of the edge server based on the network status. The central server compares the network latency of the edge server with a network latency threshold. If the network latency of the edge server is less than the network latency threshold, the central server determines that the edge server is normal.

[0093] Furthermore, in the above step S26, the central server updates the training parameters according to the training parameters uploaded by the normal edge servers, including: the central server performs an aggregation operation based on the training parameters uploaded by the normal edge servers to update the training parameters.

[0094] In the above implementation, due to the large amount of network data generated by the cyber-physical social system, a centralized learning model cannot train and distinguish between normal traffic and attack traffic in real time, while single-point detection poses privacy risks. Therefore, a distributed learning approach can be adopted.

[0095] Federated Averaging (FedAvg) is a federated learning algorithm that allows multiple edge servers to collaboratively train a shared model while maintaining local network data. It addresses privacy concerns by sharing only model updates rather than raw data. The specific formula is as follows:

[0096]

[0097] In the above formula (5), w t+1 represents the weight of the global model after the tth round of iterative training, k represents the number of edge servers participating in federated learning, and n k represents the number of network data samples owned by the kth terminal device, n represents the total number of network data samples owned by all edge servers, represents the weight of the intrusion detection model trained by the k-th edge server after the t-th iteration.

[0098] The federated averaging algorithm has multiple rounds of communication. Each edge server performs η local stochastic gradient descent (SDG) iterations in one round, and the value of η is set to a fixed value across all edge servers and communication rounds.

[0099] The federated averaging algorithm performs best when edge servers have continuous access to the central server and have similar training times. However, in large-scale network intrusion detection environments, due to data and system heterogeneity, unstable communication, and imbalanced training times, some edge servers may be unable to upload the training parameters of the intrusion detection model in a timely manner, causing the global model update to deviate from the expected optimization path.

[0100] To address potential attacks and communication instability in large-scale networks, edge server operating status and network status can be monitored to detect network congestion and paralysis caused by abnormal behavior. This allows for timely adjustment of relevant edge server parameters to maintain the stability and security of the training process.

[0101] The process of training an intrusion detection model using the federated averaging algorithm can be as follows:

[0102] The input is the weights or parameters w of the initialized model (0) , the output is the weights or parameters w of the final model (K) .

[0103] Specifically, initialize the weights of the global model. For each round of aggregation, perform the following operations:

[0104] Receive global weight w (k-1) Perform local training;

[0105] Update based on the local model after x SGD iterations;

[0106] Calculate the error function E i and control parameter delay Delay;

[0107] Receive updated gradients and aggregate them;

[0108] Isolate abnormal edge servers (Delay ≥ γ);

[0109] Update x to minimize G(x);

[0110] Distribute η to normal edge servers (Delay < γ).

[0111] Furthermore, detected anomalous edge servers can be selectively isolated or have their communication frequency reduced to minimize negative impacts on global model training. Parameters are adjusted based on the state of each worker node to minimize the global loss function within time and resource constraints. This approach improves the efficiency and robustness of the federated learning process, ensuring timely and accurate network intrusion detection.

[0112] Normal edge servers receive the intrusion detection model from the central server and update it locally using local network data. After each worker node completes xi SGD iterations, it sends the local model weight w and control parameter Delay to the central server.

[0113] The central server collects the parameters of the local model from each edge server and performs an aggregation operation. During the aggregation process, the central server also receives the edge server's control parameters, including the network delay Delay. The central server compares the Delay with the network delay threshold and isolates abnormal edge servers with delays exceeding the threshold. The central server then calculates a new approximate x value for each end device and sends it to the normal end devices participating in the next round of training.

[0114] In order to solve the problem of low training efficiency and result deviation caused by network congestion caused by network attacks in large-scale network intrusion environments, this implementation can optimize the number of local iterative training times of the terminal device to minimize the global loss function. The calculation formulas for local loss and global loss are as follows:

[0115]

[0116] The above formula (6) is the calculation formula for local loss, where f j (w) represents the loss metric of the model parameters on data sample j, G i (w) represents the average value of the gradient of function f at point w on the i-th node of the graph or the result of the Laplace operator, which is used to reflect the cumulative effect of a small perturbation on other nodes in the graph when the perturbation is applied to node i. i | represents the set D i The number of elements in , that is, the number of adjacent nodes or degree of node i. In graph theory, degree refers to the number of edges connected to a node.

[0117]

[0118] In the above formula (7), G(w) represents the weighted sum of the average values ​​of the gradient of function f at point w on the graph, which is the average value of the gradient on the entire graph, where the gradient of each node is weighted according to its degree (i.e., the number of adjacent nodes). i (w) represents the average value of the gradient of function f at point w on the i-th node of the graph or the result of the Laplace operator, which is used to reflect the cumulative effect of a small perturbation on other nodes in the graph when the perturbation is applied to node i. i | represents the set D i The number of elements in is the number of adjacent nodes or degree of node i. In graph theory, degree refers to the number of edges connected to a node. D represents the sum of the degrees of all nodes in the graph. In graph theory, the sum of the degrees of all nodes in a graph is equal to twice the total number of edges in the graph, because each edge contributes to the degrees of two nodes.

[0119] The total time consumption of the constraint condition cannot exceed the budget time T, the formula is as follows:

[0120]

[0121] In the above formula (8), in the kth round, the time resources consumed by each local SGD iteration on each worker node i is The time resources consumed by each global aggregation step is c k , assuming that the time of all local SGD iterations x in round k is are the same, and the global aggregate time c of all working nodes k The same is true.

[0122] To convert the formula into a more tractable form, we approximate it by taking an upper bound on the loss function as follows:

[0123]

[0124] In the above formulas (9) and (10), the objective function decreases as x increases. Therefore, the optimal value for any x is

[0125] To simplify the analysis, this embodiment neglects the rounding operation to perform an approximate calculation and substitutes it into the formula to obtain the following formula:

[0126]

[0127] In the above formula (11), as the gradient descends, the value of {x} changes, thereby reducing the value of the function G(x). Therefore, an approximate optimal result {x} is obtained, which minimizes the value of the function G(x) at the end of the gradient descent.

[0128] In this embodiment, the following calculation process is also present:

[0129]

[0130] I=G(w0)-G(w * ) (15)

[0131] In the above formulas (12) to (15), D i represents the size of the local training dataset on node i, ρ i represents the Lipschitz constant of the loss function at node i, g i (η i ) represents the error term function of node i when the number of local SGD iterations is η. Φ i represents the control parameter, η i represents the number of local SGD iterations for node i. For each round k, gradient descent is used to minimize the objective function G(η). Assuming that the initial η is the same for all working nodes, adjusting the value of η through gradient descent can reduce the value of the objective function, ultimately setting an approximately optimal number of iterations for different end devices.

[0132] To demonstrate the beneficial effects of the above embodiments, the present application provides a method for verifying a training method for an intrusion detection model. In this method, PCDNet is a parallel convolutional network model, Fed-LSNIDS (Federated Locally Selective Network Intrusion Detection System) is a federated locally selective network intrusion detection system, and FedAvg is a federated averaging algorithm. Specifically, the method is as follows:

[0133] NSL-KDD is a network intrusion detection dataset that provides a standardized testbed. This dataset improves upon the KDD Cup 1999 dataset by eliminating redundant and noisy data while retaining the essential features and complexity required for intrusion detection. NSL-KDD contains a wide range of traffic, content, and temporal features, describing network communication behavior. The dataset categorizes attack types into five categories: Normal, Probe, Remote-to-Local (R2L), User-to-Root (U2R), and Denial of Service (DoS). This diversity of attack types enables NSL-KDD to effectively simulate real-world network environments and, therefore, is widely used to validate large-scale network intrusion models. The dataset consists of two files: KDDtrain+.txt and KDDtest+.txt, containing non-redundant training and test data, respectively. In this dataset, normal traffic and Denial of Service (DoS) attacks dominate, while User-to-Root (U2R) and Remote-to-Local (R2L) attacks are relatively rare in the training set but become more prevalent in the test set. The detailed data distribution is shown in Table 1.

[0134]

[0135] Table 1

[0136] In this implementation, the four data used to evaluate model performance are as follows: True Positives (TP), True Negatives (TN), False Positives (FP), and False Negatives (FN). The performance of the method is evaluated using the following metrics: Accuracy, Precision, Recall, and F1Score. The specific formula is as follows:

[0137]

[0138] In this implementation, centralized training was performed using the entire training dataset to independently evaluate the PCDNet model. To maintain consistency between the training and test sets, attack types not present in the training set were excluded. The various deep learning models tested included MLP, CNN, and BGRU. The intrusion detection model trained in the aforementioned embodiment was compared with the CNN-MLP to evaluate the effectiveness of the training method for the intrusion detection model in the aforementioned embodiment.

[0139] Combine Figure 3As shown in the accuracy comparison, the training method of the intrusion detection model in the aforementioned embodiment achieved a highest accuracy of 89.8% on the test dataset, which is better than 88.1% of CNN-MLP and 86.2%, 87.1% and 85.8% of the other three methods in terms of accuracy.

[0140] In this implementation, the PCDNet model performs well in detecting various cyber-intrusion behaviors that cyber-physical social systems are susceptible to, significantly outperforming other classification models in terms of precision, recall, and F1-score. Specifically, Precision, Recall, and F1-Score are shown in Table 2 below:

[0141]

[0142]

[0143] Table 2

[0144] Based on Table 2, we can see that the PCDNet model performs particularly well in the Normal, Remote to Local (R2L), and User to Root (U2R) categories, achieving precision rates of 0.881, 0.985, and 0.857, respectively. This demonstrates that the PCDNet model can accurately identify attack types within these categories and effectively reduce false positives.

[0145] In addition, the PCDNet model performs well in terms of recall, significantly outperforming the other four models in terms of recall across the four attack types. This shows that the PCDNet model is strong in processing sparse data, capable of capturing more targeted attack instances and significantly improving the detection rate.

[0146] The F1 score, which balances precision and recall, is a crucial metric for classification tasks. The PCDNet model demonstrated high performance across multiple categories. In particular, for minority attack types like R2L and U2R, the F1 scores reached 0.455 and 0.621, respectively, significantly outperforming other detection models. This demonstrates that the PCDNet model can accurately identify minority attacks.

[0147] Optionally, in this embodiment, two groups of experiments are conducted. By introducing different delay times for different nodes, the heterogeneity of device hardware and network conditions in the CPSS environment can be simulated.

[0148] The experiment simulates that the data of each node follows an independent and identically distributed statistical distribution in CPSS and assigns the same mean and variance to each node to ensure the consistency of the data, so that the system performance can be analyzed.

[0149] The experiment also simulated that the data of each node follows non-independent and different statistical distributions in CPSS. By assigning different means and variances to each node and introducing data correlation between nodes to represent the heterogeneity of devices and networks, the system performance is evaluated in this complex scenario. In this implementation, two groups of experiments were conducted: one group used independent and identically distributed (IID) data, and the other group used non-independent and identically distributed (NIID) data to simulate data heterogeneity. Although the data in CPSS is usually non-independent and correlated, under certain conditions, the data may exhibit independent and identically distributed characteristics. For example, when multiple devices or sensors of the same type operate in similar environments, their data may appear to be IID. Through the above experiments, the performance of the framework under different data distribution conditions can be verified.

[0150] Combine Figure 4 As shown, an embodiment of the present application provides a performance diagram of an intrusion detection model on IID data. Specifically, in the independent and identically distributed (IID) data scenario, Fed-LSNIDS shows a faster convergence speed in the early and middle stages of training compared with FedAvg. In the CPSS environment, Fed-LSNIDS effectively solves network heterogeneity problems, such as delay differences. Especially in the early stages of training, when the model accuracy is low, FedAvg finds it difficult to quickly improve its performance. In contrast, Fed-LSNIDS converges faster by adaptively adjusting the number of local iterations, and significantly improves the accuracy of the model in a shorter time.

[0151] In the later stages of training, the global model exhibited strong generalization capabilities. However, due to the consistent data distribution and independent and identically distributed (IID) properties, the impact of network heterogeneity delays on the overall model was mitigated, and FedAvg and Fed-LSNIDS ultimately achieved similar accuracy. This demonstrates that the Fed-LSNIDS approach, which considers network heterogeneity, has a clear advantage in improving model training efficiency in CPSS.

[0152] Combine Figure 5As shown, an embodiment of the present application provides a performance diagram of an intrusion detection model on N-IID data. Among them, under non-independent and identically distributed (NIID) data, the training stability and efficiency of FedAvg and Fed-LSNIDS in the CPSS environment show significant differences in the middle and late stages. The accuracy of Fed-LSNIDS is significantly higher than that of FedAvg. Although the accuracy of the global model has fluctuated greatly due to NIID data interference and network congestion, the overall accuracy continues to improve. Fed-LSNIDS effectively reduces the weight drift in CPSS by adjusting the number of training iterations of the local detection node, thereby improving the accuracy of the aggregate model. This shows that Fed-LSNIDS is more robust and efficient in handling data heterogeneity and network latency, especially in the CPSS environment.

[0153] Furthermore, in this implementation, the robustness of the intrusion detection model needs to be evaluated. Figure 6 The figure shows the distribution of accuracy over 110 time intervals for the IID dataset. The first subplot is a violin plot, which combines a boxplot and kernel density estimation. The width of each accuracy level represents its distribution over the 110 time points. Wider sections indicate that the model more frequently achieves that accuracy level. Each violin plot also includes a boxplot for increased clarity. The second subplot is a zoomed-in boxplot for better visualization. Although FedAvg and Fed-LSNIDS have similar accuracies, Fed-LSNIDS is generally more stable. The accuracy distribution of Fed-LSNIDS is highly concentrated around 88%, with lower density at both ends. In contrast, FedAvg's accuracy is primarily distributed between 87% and 87.5%, with more time intervals exhibiting accuracies below 85%.

[0154] Combine Figure 7 As shown, an embodiment of the present application provides an accuracy distribution on non-independent and identically distributed (NIID) data, wherein Fed-LSNIDS exhibits remarkable stability. In contrast, the accuracy distribution of FedAvg is more dispersed, mainly ranging between 82% and 87%. In addition, during the training process, the accuracy of FedAvg decreased in certain time periods. This instability is mainly due to the heterogeneity in the CPSS environment, which causes the global model to deviate from the optimal update direction. Fed-LSNIDS effectively solves the heterogeneity problem by adaptively adjusting the number of local training iterations. In CPSS, there may be significant differences in device and network performance, resulting in inconsistent model updates. The Fed-LSNIDS method dynamically adjusts the number of training iterations for each node to ensure that the model converges more smoothly in a heterogeneous environment.

[0155] This adaptive adjustment strategy is particularly critical in the later stages of training. Fed-LSNIDS demonstrates strong robustness, effectively maintaining high accuracy and mitigating performance fluctuations caused by heterogeneity. As a result, Fed-LSNIDS not only enhances overall model stability but also demonstrates superior training performance and improved resistance to interference in complex CPSS environments.

[0156] Optionally, combined Figure 8 and Figure 9 As shown in Figure 2, in complex environments, the heterogeneity of CPSS may cause nodes with slower performance to be mistaken for vulnerable nodes, which may be exposed to network attacks. In this case, the data is not independent and identically distributed.

[0157] Slow nodes are used to simulate the hardware heterogeneity in the CPSS environment. In this implementation, four different delay intervals, each of 110 seconds, are used for this evaluation. The framework consists of five detection nodes, four of which are normal nodes and one is an abnormal node.

[0158] To replicate a real CPSS environment, we partially isolate these slow nodes and compare their performance with FedAvg and AAFL to evaluate convergence and accuracy over the same time period. This comparison better illustrates how distributed detection algorithms handle heterogeneity and node isolation in CPSS.

[0159] The results show that compared with FedAvg and AAFL, the training method of the intrusion detection model provided by the aforementioned embodiment performs better in detection accuracy and convergence speed. Since it is achieved by adaptively isolating high-latency nodes under unstable network conditions, it effectively alleviates the training delay problem caused by high latency in CPSS.

[0160] As can be seen from the above, from the perspective of privacy and security requirements, federated learning is more suitable for cyber-physical social systems. However, to address the complex, long-distance communications and infrastructure in CPSS, especially the latency differences caused by node heterogeneity, this embodiment of the application provides an adaptive framework for Fed-LSNIDS. Experimental results show that the training method for the intrusion detection model provided in this embodiment of the application has the following advantages:

[0161] High performance of the detection model: The local node adopts the PCDNet model, which can demonstrate excellent precision, recall, and F1 scores in various attack classifications.

[0162] Faster model convergence: In CPSS, some nodes exhibit slow responses due to long-distance communication delays and node heterogeneity. Fed-LSNIDS accelerates the convergence of the global model by adaptively adjusting the number of iterations for each node in each round.

[0163] Enhanced network latency handling: In CPSS, severe network latency can impair detection performance at local nodes. By isolating abnormally slow nodes and applying the adaptive approach introduced in Fed-LSNIDS, the impact of latency on model training is mitigated. This stabilization of the aggregation process improves model performance in real-world applications.

[0164] In summary, the distributed collaborative detection framework of Fed-LSNIDS proposed in the embodiment of the present application. Taking into account the huge size and complexity of the data in CPSS, the PCDNet model is adopted, in which multiple parallel one-dimensional convolutions are used for multi-scale feature fusion to process features from different network flow data. At the same time, the model also uses a deep neural network (DNN) for attack classification. In order to solve the asynchronous training problem caused by distance and communication delay, the embodiment of the present application adopts an adaptive federated aggregation algorithm to handle changes in network delay between devices. In addition, the training method of the intrusion detection model provided by the embodiment of the present application was verified on the NSL-KDD dataset. The robustness and high accuracy of the trained intrusion detection model on the IID dataset and the NIID dataset were verified. Moreover, in the scenario of simulating network delay in CPSS, the isolation algorithm is superior to other federated learning frameworks in terms of processing efficiency and accuracy.

[0165] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in the embodiment of the present application. The aforementioned storage medium can be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program code, or a transient storage medium.

[0166] The above description and the accompanying drawings fully illustrate the embodiments of the present disclosure so that those skilled in the art can practice them. Other embodiments may include structural, logical, electrical, process and other changes. The embodiments represent only possible variations. Unless explicitly required, individual components and functions are optional, and the order of operations may vary. Parts and features of some embodiments may be included in or replace parts and features of other embodiments. Moreover, the words used in this application are only used to describe the embodiments and are not used to limit the claims. As used in the description of the embodiments and claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to also include plural forms. Similarly, the term "and / or" as used in this application refers to any and all possible combinations of one or more associated listings. In addition, when used in this application, the term "comprise" and its variations "comprises" and / or comprising refer to the presence of stated features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or groups of these. In the absence of further restrictions, an element defined by the sentence "comprising a..." does not exclude the presence of other identical elements in the process, method or device that includes the element. In this article, each embodiment may focus on the differences from other embodiments, and the same and similar parts between the various embodiments can be referenced to each other. For the methods, products, etc. disclosed in the embodiments, if they correspond to the method part disclosed in the embodiments, then the relevant parts can be found in the description of the method part.

[0167] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software may depend on the specific application and design constraints of the technical solution. The technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application. The technicians will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0168] In the embodiments disclosed herein, the disclosed methods and products (including but not limited to devices, equipment, etc.) can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units can be merely a logical functional division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to implement this embodiment. In addition, the functional units in the embodiments of the present application may be integrated into a processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

[0169] The flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to the embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the part of the module, program segment or code contains one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. In the description corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different boxes can also occur in an order different from that disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, which can depend on the functions involved. Each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action, or may be implemented by a combination of dedicated hardware and computer instructions.

Claims

1. A training method for an intrusion detection model, characterized in that: The invention is applied to an Internet of Things system, wherein the Internet of Things system includes a central server, an edge server cluster, and an edge node cluster; wherein the edge server cluster includes multiple edge servers, the edge node cluster includes multiple terminal devices, the edge servers in the edge server cluster are connected to the central server and the terminal devices respectively, and the edge servers in the edge server cluster and the multiple terminal devices in the edge node cluster have a one-to-many relationship, and the terminal devices are integrated with an intrusion detection model; the method includes: The terminal device collects local network data and sends the network data to the edge server; The edge server uses the network data to iteratively train the intrusion detection model, and when the iterative training reaches a preset condition, uploads the training parameters of the intrusion detection model to the central server; The edge server detects the operating status of the plurality of edge servers respectively, and detects the network status of the plurality of edge servers respectively, and selects a normal edge server from the plurality of edge servers according to the operating status and the network status; The central server updates the training parameters according to the training parameters uploaded by the normal edge server, and sends the updated training parameters to the normal edge server; The normal edge server updates the intrusion detection model according to the updated training parameters, and iteratively trains the updated intrusion detection model again until a trained intrusion detection model is obtained.

2. The method according to claim 1, characterized in that Before the edge server uses the network data to iteratively train the intrusion detection model, the method further includes: The central server initializes the intrusion detection model and sends the initialized intrusion detection model to the terminal device through the edge server.

3. The method according to claim 1, characterized in that The edge server uses the network data to iteratively train the integrated intrusion detection model, including: The edge server pre-processes the network data; The edge server inputs the pre-processed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs categories of the network features.

4. The method according to claim 1, wherein Filtering a normal edge server from the plurality of edge servers according to the operating state and the network state includes: The central server determines whether the edge server fails according to the operating status, and obtains the network delay of the edge server based on the network status when the edge server does not fail; The central server compares the network delay of the edge server with a network delay threshold; When the network delay of the edge server is less than the network delay threshold, the central server determines that the edge server is a normal edge server.

5. The method according to claim 1, wherein The central server updates the training parameters according to the training parameters uploaded by the normal edge server, including: The central server performs an aggregation operation based on the training parameters uploaded by the normal edge servers to update the training parameters.

6. An Internet of Things system, characterized in that: The system comprises a central server, an edge server cluster, and an edge node cluster; the edge node cluster comprises a plurality of terminal devices, the edge server cluster comprises a plurality of edge servers, the edge servers in the edge server cluster are respectively connected to the central server and the terminal devices, and the edge servers in the edge server cluster and the plurality of terminal devices in the edge node cluster form a one-to-many relationship, and the terminal devices are integrated with an intrusion detection model; wherein: The terminal device is used to collect local network data and send the network data to the edge server; The edge server is configured to iteratively train the intrusion detection model using the network data, and upload the training parameters of the intrusion detection model to the central server when the iterative training reaches a preset condition; The central server is configured to respectively detect the operating status of the plurality of edge servers and the network status of the plurality of edge servers, and select a normal edge server from the plurality of edge servers based on the operating status and the network status; The central server is further configured to update the training parameters according to the training parameters uploaded by the normal edge server, and send the updated training parameters to the normal edge server; The normal edge server is used to update the intrusion detection model according to the updated training parameters, and iteratively train the updated intrusion detection model again until a trained intrusion detection model is obtained.

7. The system according to claim 6, characterized in that The central server is further configured to initialize the intrusion detection model and send the initialized intrusion detection model to the terminal device via the edge server.

8. The system according to claim 6, wherein: The edge server is specifically used to preprocess the network data; input the preprocessed network data into the intrusion detection model, so that the intrusion detection model extracts network features and outputs the categories of the network features.

9. The system according to claim 6, wherein: The central server is specifically configured to determine whether the edge server fails based on the operating status, and when the edge server does not fail, obtain the network delay of the edge server based on the network status; compare the network delay of the edge server with a network delay threshold; and determine that the edge server is a normal edge server when the network delay of the edge server is less than the network delay threshold.

10. The system according to claim 6, wherein: The central server is specifically configured to perform an aggregation operation based on the training parameters uploaded by the normal edge servers to update the training parameters.

Images