Model training method, intrusion detection method, device, equipment, medium and product

Abstract

The invention discloses a model training method and device, an intrusion detection method and device, equipment, a medium and a product, and the method comprises the steps: obtaining a first parameter obtained after each client device in at least one training group carries out the training of a first model through the local data of each client device; for at least one training group, aggregating the first parameters associated with each training group to obtain second parameters corresponding to each training group; and according to the second parameter and the number of times that each training group participates in updating of the second model within the preset time, updating a third parameter corresponding to the second model until the second model converges, and obtaining a trained second model. According to the invention, joint training is carried out without uploading local data, the data security of the client devices can be ensured, local training is carried out by using the computing power of each client device, the convergence speed and precision of model training can be improved, and the accuracy of a network intrusion detection result is improved.

Description

Technical Field

[0001] The present application relates to but is not limited to the field of network attack detection technology, and in particular to a model training method, intrusion detection method, device, equipment, medium and product. Background Art

[0002] As network complexity increases, network systems face threats from various security vulnerabilities, including network intrusion attacks. Network intrusion attacks can lead to privacy leaks, property losses, and system paralysis. Therefore, network intrusion detection becomes critical.

[0003] In the related art, network intrusion detection is performed through machine learning methods. This method requires a large amount of labeled data to train the model. In the field of network security, since local data involves privacy, many users are reluctant to share personal data for model training, making it relatively difficult to obtain a large amount of labeled data, which imposes certain restrictions on model training. In addition, the local training performance, data distribution, and network environment of different client devices are different, which further makes the convergence speed of model training different, resulting in poor model training results, thereby affecting the accuracy of network intrusion detection results. Summary of the invention

[0004] In view of this, the present application provides a model training method, intrusion detection method, device, equipment, medium and product, which can ensure the data security of client devices, improve the convergence speed and accuracy of model training, and improve the accuracy of network intrusion detection results.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] In a first aspect, the present application provides a model training method, comprising: obtaining a first parameter obtained after each client device in at least one training group trains a first model through its respective local data, the first model being used to perform intrusion detection on the local data; for at least one training group, aggregating the first parameter associated with each training group to obtain a second parameter corresponding to each training group; updating a third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, until the second model converges to obtain a trained second model, wherein the second model has the same structure as the first model.

[0007] In some embodiments, a third parameter corresponding to the second model is updated based on the second parameter and the number of times each training group participates in the update of the second model within a preset time, including: summing the number of times at least one training group participates in the update of the second model within the preset time to obtain a total number of times; sorting at least one training group based on the time overhead corresponding to each training group to obtain a sequence number for each training group; and updating the third parameter based on the sequence number, the total number of times, the number of times, and the second parameter.

[0008] In some embodiments, the third parameter is updated according to the sequence number, the total number of times, the number of times and the second parameter, including: for the ith training group, according to the number of times and the total number of times the N-i+1th training group participates in the update of the second model within a preset time, determining the first weight corresponding to the ith training group, wherein i and N are positive integers and N is the number of training groups; obtaining the fourth parameter by a weighted sum operation according to the first weight and the second parameter corresponding to the training group corresponding to the first weight; and updating the third parameter to the fourth parameter.

[0009] In some embodiments, the first parameters associated with each training group are aggregated to obtain a second parameter corresponding to each training group, including: determining a second weight corresponding to each client device based on the amount of data corresponding to each client device in each training group and the sum of the amount of data corresponding to all client devices in each training group; and obtaining the second parameter through a weighted sum operation based on the second weight and the first parameter corresponding to each client device.

[0010] In some embodiments, after aggregating the first parameters associated with each training group for at least one training group to obtain the second parameters corresponding to each training group, the method further includes: determining the time overhead corresponding to each client device based on the average time overhead corresponding to each client device in each training group and the number of client devices included in each training group when a preset condition is met; determining whether each client device matches the training group in which each client device is located based on the time overhead and a preset evaluation threshold; and moving at least one client device to other training groups when at least one client device does not match the training group of at least one client device.

[0011] In some embodiments, before obtaining the first parameter obtained after each client device in at least one training group trains the first model through its respective local data, the method further includes: collecting data from each client device through a data collection plug-in in each client device to obtain training data; and preprocessing the training data to obtain local data.

[0012] In a second aspect, the present application provides an intrusion detection method, including: obtaining data to be detected; inputting the data to be detected into a trained second model to obtain an intrusion detection result corresponding to the data to be detected; wherein the second model is obtained in the following manner: obtaining a first parameter obtained after each client device in at least one training group trains the first model through its respective local data, the first model being used to perform intrusion detection on the local data; for at least one training group, aggregating the first parameter associated with each training group to obtain a second parameter corresponding to each training group; updating a third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, until the second model converges, wherein the second model has the same structure as the first model.

[0013] In some embodiments, a third parameter corresponding to the second model is updated based on the second parameter and the number of times each training group participates in the update of the second model within a preset time, including: summing the number of times at least one training group participates in the update of the second model within the preset time to obtain a total number of times; sorting at least one training group based on the time overhead corresponding to each training group to obtain a sequence number for each training group; and updating the third parameter based on the sequence number, the total number of times, the number of times, and the second parameter.

[0014] In some embodiments, after inputting the network traffic data to be detected into the trained second model to obtain the intrusion detection results corresponding to the network traffic data to be detected, the above method also includes: obtaining the attack situation in the intrusion detection results of different client devices; based on the attack situation, building a data analysis platform to analyze the attack situation.

[0015] In some embodiments, obtaining the data to be detected includes: collecting data from at least one client device through a data collection plug-in in at least one client device to obtain network traffic data; and preprocessing the network traffic data to obtain the data to be detected.

[0016] In a third aspect, the present application provides a model training device, comprising: a first acquisition module, used to obtain a first parameter obtained after each client device in at least one training group trains a first model through its respective local data, the first model being used to perform intrusion detection on the local data; a first determination module, used to aggregate the first parameter associated with each training group for at least one training group to obtain a second parameter corresponding to each training group; a second determination module, used to update a third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, until the second model converges to obtain a trained second model, wherein the second model has the same structure as the first model.

[0017] In some embodiments, the second determination module includes: a first determination unit, used to sum the number of times at least one training group participates in the update of the second model within a preset time to obtain a total number of times; a second determination unit, used to sort at least one training group according to the time overhead corresponding to each training group to obtain a sequence number of each training group; an updating unit, used to update the third parameter according to the sequence number, the total number of times, the number of times and the second parameter.

[0018] In some embodiments, the updating unit is used to perform the following steps: for the ith training group, determine the first weight corresponding to the ith training group based on the number of times and the total number of times the N-i+1th training group participates in the update of the second model within a preset time, wherein i and N are positive integers and N is the number of training groups; obtain a fourth parameter by a weighted sum operation based on the first weight and the second parameter corresponding to the training group corresponding to the first weight; and update the third parameter to the fourth parameter.

[0019] In some embodiments, the first determination module is used to perform the following steps: determine the second weight corresponding to each client device based on the amount of data corresponding to each client device in each training group and the sum of the amount of data corresponding to all client devices in each training group; and obtain the second parameter by performing a weighted sum operation based on the second weight and the first parameter corresponding to each client device.

[0020] In some embodiments, the model training device further includes: a third determination module, for aggregating the first parameter associated with each training group for at least one training group to obtain the second parameter corresponding to each training group, and then, if a preset condition is met, determining the time overhead corresponding to each client device according to the average time overhead corresponding to each client device in each training group and the number of client devices included in each training group; a fourth determination module, for determining whether each client device matches the training group in which each client device is located based on the time overhead and a preset evaluation threshold; and a moving module, for moving at least one client device to other training groups if there is a mismatch between at least one client device and the training group of at least one client device.

[0021] In some embodiments, the above-mentioned model training device also includes: a collection module, which is used to collect data from each client device through a data collection plug-in in each client device before obtaining the first parameter obtained after each client device in at least one training group trains the first model through its respective local data to obtain training data; a preprocessing module, which is used to preprocess the training data to obtain local data.

[0022] In a fourth aspect, the present application provides an intrusion detection device, comprising: a second acquisition module, used to acquire data to be detected; a detection module, used to input the data to be detected into a trained second model to obtain an intrusion detection result corresponding to the data to be detected; wherein the second model is obtained in the following manner: obtaining a first parameter obtained after each client device in at least one training group trains the first model through its respective local data, the first model being used to perform intrusion detection on the local data; for at least one training group, aggregating the first parameter associated with each training group to obtain a second parameter corresponding to each training group; updating a third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, until the second model converges, wherein the second model has the same structure as the first model.

[0023] In some embodiments, a third parameter corresponding to the second model is updated based on the second parameter and the number of times each training group participates in the update of the second model within a preset time, including: summing the number of times at least one training group participates in the update of the second model within the preset time to obtain a total number of times; sorting at least one training group based on the time overhead corresponding to each training group to obtain a sequence number for each training group; and updating the third parameter based on the sequence number, the total number of times, the number of times, and the second parameter.

[0024] In some embodiments, the intrusion detection device further includes: a third acquisition module, which is used to obtain the attack situation in the intrusion detection results of different client devices after inputting the network traffic data to be detected into the trained second model to obtain the intrusion detection results corresponding to the network traffic data to be detected; and a construction module, which is used to construct a data analysis platform based on the attack situation to analyze the attack situation.

[0025] In some embodiments, the second acquisition module is used to perform the following steps: collect data from at least one client device through a data collection plug-in in at least one client device to obtain network traffic data; and pre-process the network traffic data to obtain data to be detected.

[0026] In a fifth aspect, the present application provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the computer program, some or all of the steps in the above method are implemented.

[0027] In a sixth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements some or all of the steps in the above method when the computer program is executed by a processor.

[0028] In a seventh aspect, the present application provides a computer program product, comprising a computer program or instructions, which implement some or all of the steps in the above method when executed by a processor.

[0029] In an eighth aspect, the present application provides a computer program, comprising a computer-readable code. When the computer-readable code runs in an electronic device, a processor in the electronic device executes some or all of the steps for implementing the above method.

[0030] In the present application, a first parameter is obtained after each client device in at least one training group trains the first model through its own local data, and the first model is used to perform intrusion detection on the local data; for at least one training group, the first parameter associated with each training group is aggregated to obtain the second parameter corresponding to each training group; according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, the third parameter corresponding to the second model is updated until the second model converges to obtain the trained second model. Through the above scheme, joint training can be performed without each client device uploading local data, which can ensure the data security of the client device, and the computing power of each client device is used for local training, which can improve the convergence speed and accuracy of model training, reduce the pressure on the central server, and thus improve the accuracy of network intrusion detection results. At the same time, compared with the federated learning of the traditional synchronous aggregation training mode, the hierarchical asynchronous aggregation mode of this scheme saves a lot of time overhead, which can make the overall training more efficient and effectively reduce the overall training time, that is, to achieve the effect of higher model accuracy and shorter usage time under the same model.

[0031] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0033] Figure 1 is a structural schematic diagram of an electronic device provided in an embodiment of the present application;

[0034] Figure 2 It is a structural schematic diagram of a model training device provided in an embodiment of the present application;

[0035] Figure 3 It is a structural schematic diagram of an intrusion detection device provided in an embodiment of the present application;

[0036] Figure 4It is a structural schematic diagram of a model training system provided in an embodiment of the present application;

[0037] Figure 5 It is a schematic diagram of an implementation process of the model training method provided in the embodiment of the present application;

[0038] Figure 6 It is another implementation flow diagram of the model training method provided in the embodiment of the present application;

[0039] Figure 7 It is a schematic diagram of an implementation flow of the intrusion detection method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0040] The following is a description of the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. In the following description, reference is made to the drawings that form a part of the present application and show the specific aspects of the embodiments of the present application or the specific aspects of the embodiments of the present application in an illustrative manner. It should be understood that the embodiments of the present application can be used in other aspects and may include structural or logical changes not depicted in the drawings. Therefore, the following detailed description should not be understood in a restrictive sense, and the scope of the present application is defined by the appended claims. For example, it should be understood that the disclosure of the described method can be equally applicable to the corresponding device or system for performing the method, and vice versa. For example, if one or more specific method steps are described, the corresponding device may include one or more units such as functional units to perform the one or more method steps described (for example, one unit performs one or more steps, or multiple units, each of which performs one or more of the multiple steps), even if such one or more units are not explicitly described or illustrated in the drawings. On the other hand, for example, if a specific device is described based on one or more units such as functional units, the corresponding method may include a step to perform the functionality of the one or more units (e.g., a step to perform the functionality of the one or more units, or multiple steps, each of which performs the functionality of one or more of the multiple units), even if such one or more steps are not explicitly described or illustrated in the drawings. Further, it should be understood that, unless otherwise explicitly stated, the features of the various exemplary embodiments and / or aspects described herein may be combined with each other.

[0041] As network complexity increases, network systems face threats from various security vulnerabilities, including network intrusion attacks. Network intrusion attacks can be understood as attempts to undermine the confidentiality, integrity or availability of computer networks, or to bypass computer or network security mechanisms. At present, network intrusion detection systems (NID) have become an urgent need of the times and a research direction for many scholars. The following are some intrusion detection methods in related technologies:

[0042] (1) Signature-based detection: Uses predefined features, rules, or patterns to identify known attack patterns, which may be based on specific signatures or behavioral characteristics of the attack. This approach can quickly identify known attacks, but cannot capture unknown new attacks.

[0043] (2) Anomaly-based detection: By building a normal behavior model, abnormal behaviors that are significantly different from this model are detected. This method can detect unknown new attacks, but it is also prone to false alarms because some normal behaviors may also be mistaken for abnormal behaviors.

[0044] (3) Traffic analysis: Monitor network traffic and analyze data packets, traffic patterns, and transmission protocols to identify potential attack behaviors or abnormal traffic patterns. This method may fail to detect attacks in a timely manner in scenarios with large traffic volumes.

[0045] (4) Machine learning detection: Use machine learning algorithms, such as support vector machine (SVM), decision tree, random forest, and neural network, to train models and identify abnormal patterns. This method can process large amounts of data and discover complex attack patterns.

[0046] The above intrusion detection methods have the following disadvantages:

[0047] (1) Difficulty in identifying new threats: Signature- or rule-based intrusion detection methods are usually difficult to identify new, unknown forms of attack because they can only identify previously known attack patterns.

[0048] (2) High false alarm rate: Anomaly-based intrusion detection methods are prone to false alarms, mistaking normal behavior for abnormal or attack behavior, resulting in management personnel resources being wasted on false alarms.

[0049] (3) Real-time challenge: Intrusion detection methods based on traffic analysis may face performance and scalability challenges in large-scale networks or scenarios that require real-time response.

[0050] (4) Requires a large amount of data: Many machine learning methods require a large amount of labeled data to train the model, but it may be relatively difficult to obtain large-scale labeled data in the field of cybersecurity.

[0051] (5) Privacy and data sharing issues: Generally speaking, the larger the training data set, the higher the model performance may be. However, local data such as user network traffic and related shell commands involve privacy, so many users are reluctant to share personal data for model training, which brings certain restrictions to model training. Most existing machine learning-based intrusion detection methods use a large amount of user data for training, which has major privacy issues.

[0052] (6) Training efficiency issues of distributed machine learning training framework: Federated learning, as a distributed machine learning framework, usually maintains a global model. However, different edge devices may have different local training performance, data distribution, and communication transmission time with the central server. Especially considering the intrusion detection task, different devices have different network environments. This will lead to poor global model training results or reduce the convergence speed of the overall model training.

[0053] Based on the above problems, the present application proposes a model training method, which obtains a first parameter obtained after each client device in at least one training group trains a first model through its own local data, and the first model is used to perform intrusion detection on the local data; for at least one training group, the first parameter associated with each training group is aggregated to obtain a second parameter corresponding to each training group; according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, the third parameter corresponding to the second model is updated until the second model converges to obtain the trained second model. Through the above scheme, joint training is performed without each client device uploading local data, which can ensure the data security of the client device, and the computing power of each client device is used for local training, which can improve the convergence speed and accuracy of model training, reduce the pressure on the central server, and thus improve the accuracy of network intrusion detection results. At the same time, compared with the federated learning of the traditional synchronous aggregation training mode, the hierarchical asynchronous aggregation mode of this scheme saves a lot of time overhead, which can make the overall training more efficient and effectively reduce the overall training time, that is, to achieve the effect of higher model accuracy and shorter usage time under the same model.

[0054] In some embodiments, the method described in the embodiments of the present application can be applied to network security intrusion detection scenarios. In some embodiments, the method described in the embodiments of the present application can also be applied to the security protection system of the cloud security center. In some embodiments, the method described in the embodiments of the present application can also be applied to small and medium-sized enterprises and organizations to lower the threshold for security investment and achieve asset-light operation. In some embodiments, the method described in the embodiments of the present application can also provide corresponding support in cross-domain applications (such as financial risk control, smart cities, etc.), responding to new technological challenges (Internet of Things, edge computing, blockchain, etc.), etc.

[0055] The following describes an exemplary application of the electronic device provided in the embodiment of the present application. The electronic device provided in the embodiment of the present application can be a laptop, a tablet computer, a desktop computer, a mobile device (e.g., a mobile phone, a wearable smart watch, a dedicated messaging device), an electric car, an electric bicycle, and other rechargeable devices, but is not limited thereto. Alternatively, the electronic device can also be implemented as a server.

[0056] In some embodiments, the server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, and big data and artificial intelligence platforms, but is not limited thereto. In some embodiments, the server and the electronic device may be directly or indirectly connected via wired or wireless communication, and this is not specifically limited in the embodiments of the present application.

[0057] See also Figure 1 , Figure 1 is a structural schematic diagram of an electronic device provided in an embodiment of the present application, Figure 1 The electronic device 100 shown includes: at least one processor 110, a memory 150, at least one network interface 120 and a user interface 130. The various components in the electronic device 100 are coupled together via a bus system 140. It is understood that the bus system 140 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 140 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, the bus system 140 is not described in detail. Figure 1 Various buses are labeled as bus system 140 .

[0058] The processor 110 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc., where the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0059] The user interface 130 includes one or more output devices 131 that enable presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 130 also includes one or more input devices 132, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0060] The memory 150 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. The memory 150 may optionally include one or more storage devices that are physically remote from the processor 110.

[0061] The memory 150 includes a volatile memory or a nonvolatile memory, and may also include both volatile and nonvolatile memories. The nonvolatile memory may be a read-only memory (ROM), and the volatile memory may be a random access memory (RAM). The memory 150 described in the embodiments of the present application is intended to include any suitable type of memory.

[0062] In some embodiments, the memory 150 can store data to support various operations, examples of which include programs, modules, and data structures, or a subset or superset thereof, as exemplarily described below.

[0063] The operating system 151 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, etc., which are used to implement various basic businesses and process hardware-based tasks.

[0064] The network communication module 152 is used to reach other computing devices via one or more (wired or wireless) network interfaces 120. Exemplary network interfaces 120 include: Bluetooth, WiFi, and universal serial bus (USB).

[0065] The presentation module 153 is used to enable presentation of information (eg, a user interface for operating peripheral devices and displaying content and information) via one or more output devices 131 (eg, a display screen, a speaker, etc.) associated with the user interface 130 .

[0066] The input processing module 154 is configured to detect one or more user inputs or interactions from one of the one or more input devices 132 and to translate the detected inputs or interactions.

[0067] In some embodiments, the model training method provided in the embodiments of the present application can be implemented in software and stored in the memory 150. Figure 2 , Figure 2It is a structural diagram of the model training device provided in the embodiment of the present application, which can be software in the form of programs and plug-ins, etc. The model training device 155 includes the following software modules: a first acquisition module 1551, a first determination module 1552, and a second determination module 1553. These modules are logical, so they can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be explained below.

[0068] In other embodiments, the model training device 155 provided in the embodiment of the present application can be implemented in hardware. As an example, the model training device 155 provided in the embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the model training method provided in the embodiment of the present application. For example, the processor in the form of a hardware decoding processor can adopt one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0069] In some embodiments, the intrusion detection method provided in the embodiments of the present application can be implemented in software and stored in the memory 150. Figure 3 , Figure 3 1 is a schematic diagram of the structure of the intrusion detection device provided in the embodiment of the present application, which can be software in the form of programs and plug-ins, etc. The intrusion detection device 156 includes the following software modules: a second acquisition module 1561, a detection module 1562, and these modules are logical, so they can be arbitrarily combined or further split according to the functions implemented. The functions of each module will be described below.

[0070] In other embodiments, the intrusion detection device 156 provided in the embodiment of the present application may be implemented in hardware. As an example, the intrusion detection device 156 provided in the embodiment of the present application may be a processor in the form of a hardware decoding processor, which is programmed to execute the intrusion detection method provided in the embodiment of the present application. For example, the processor in the form of a hardware decoding processor may be one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, or other electronic components.

[0071] The model training method provided in the embodiment of the present application will be explained below in combination with the exemplary application and implementation of the electronic device provided in the embodiment of the present application.

[0072] In some embodiments, the model training method provided in the embodiments of the present application can be applied to a model training system, which can be used to train an intrusion detection model (eg, a second model).

[0073] See also Figure 4 , Figure 4 It is a structural diagram of the model training system provided in the embodiment of the present application. The model training system 400 may include: a central server 401, client devices 402 to 406. Among them, the central server may include a global model layer and a local training layer, and the local training layer may include a local training group 1 (which may be referred to as training group 1) and a local training group 2 (which may be referred to as training group 2). A global model (such as a second model) is deployed in the global model layer, and local models (such as a first model) are deployed in client devices 402 to 406. A third model is deployed in local training group 1 and local training group 2, and the first model, the second model, and the third model have the same structure and are all used for intrusion detection. Their parameters may be the same or different, and the embodiment of the present application does not specifically limit this. The architecture of model training can be divided into three layers, namely: a global model layer, a local training layer, and a local model layer, and the global model layer and the local training layer are maintained by the central server 401 401.

[0074] Here, the central server 401 can be a high-performance computer server that can be used to store and process a large amount of data. It is a centralized server that can centrally manage and control other devices in the network (such as Figure 4 The client devices 402 to 406 in the figure). The client devices 402 to 406) can be computing devices close to the data source or user, such as edge devices, i.e., physical or virtual devices located at the edge of the network, terminal devices, etc., which have the ability to process and store data, and can perform tasks such as real-time data processing, local decision-making, data filtering and pre-processing, reduce data transmission volume, reduce latency, and improve privacy and security.

[0075] In some embodiments, the central server 401 initializes the global model in the global model layer (e.g., a long short-term memory network (LSTM) model, a convolutional neural network model, etc.), and each local training group (e.g., local training group 1 and local training group 2) distributes the parameters of the global model after initialization to the designated client devices, such as: local training group 1 distributes the parameters of the global model after initialization to client devices 402 to 404, and local training group 2 distributes the parameters of the global model after initialization to client devices 405 and 406. Client devices 402 to 406 perform local model training using their own local data, and send the obtained parameters to the central server after a preset number of training rounds. Local training group 1 and local training group 2 in the central server aggregate the parameters according to the parameters sent by their corresponding client devices, and update the parameters of the third model in each local training group in turn; the global model layer aggregates the parameters of the third model in each local training group to obtain the parameters of the final global model. When the number of aggregations of each local training group reaches the preset number, the training time differences of the client devices in different local training groups are evaluated in turn. The client devices with larger differences from the current local training group will be moved to another local training group with smaller differences. The above training process is repeated until the global model converges to obtain the trained global model. The central server 401 saves the trained global model and sends the trained global model to each local training group and each client device. Each client device can pre-process the acquired network traffic data and input it into the trained global model for intrusion detection analysis. In this way, compared with the traditional intrusion detection learning method, the use of Figure 4 The model training system 400 shown uses hierarchical federated learning to improve the efficiency and performance of model training, and can be applied to a variety of tasks. It performs joint training and learning between various client devices under the premise of protecting data privacy. At the same time, the model training system 400 uses a distributed machine learning training architecture. Compared with traditional intrusion detection methods, it can effectively identify new network intrusion threats and reduce false alarm rates.

[0076] In some embodiments, for the above-mentioned local model (e.g., the first model) and the global model (e.g., the second model), the two have the same structure and the same final parameters after training. The first model and the second model are constantly synchronized during the training process, and after the training is finally completed, the model structures and parameters of the two are consistent.

[0077] It should be noted that: Figure 4 The structure, number of local training groups, number of client devices, etc. shown in the figure are only for exemplary description and are not specifically limited in the embodiments of the present application.

[0078] The model training method provided in the embodiment of the present application is described below in combination with the above-mentioned model training system.

[0079] Figure 5 Schematic diagram of an implementation flow of the model training method provided in the embodiment of the present application. Figure 5 As shown, the model training method of the embodiment of the present application may include steps S510 to S530.

[0080] In step S510, first parameters are obtained after each client device in at least one training group trains the first model using respective local data.

[0081] Here, the first model is used to perform intrusion detection on local data. The first model can be an LSTM model, a convolutional neural network model, a logistic regression model, a decision tree model, a random forest model, etc., and can also be other models, which are not specifically limited in the embodiments of the present application. Local data can be relevant data that each client device obtains from itself and can be used for intrusion detection. Each training group (also referred to as a local training group) may include a third model, and the third model has the same structure as the first model, and the model parameters of the two may be the same or different, which is not specifically limited in the embodiments of the present application. Each training group may include at least one client device. In the initial stage of model training, the client devices included in each training group may be randomly divided, or divided according to the performance of the client device, or divided according to other rules, which is not specifically limited in the embodiments of the present application.

[0082] It is understandable that each client device in at least one training group trains the first model using the preset model training method through its own local data, and after each training, the first parameter corresponding to the first model can be obtained. The preset model training method can be stochastic gradient descent, gradient descent, elastic network, support vector machine, etc., which is not specifically limited in the embodiments of the present application.

[0083] In some embodiments, for step S510, the central server may automatically execute it once every preset time period, or may automatically execute it once after the number of training rounds of the first model reaches a preset number of rounds. This embodiment of the present application does not specifically limit this.

[0084] Here, the preset duration can be a preset duration, such as 5 minutes, 10 minutes, or other duration values, which are not specifically limited in the embodiments of the present application. The preset number of rounds can be a preset number of training rounds, such as 15 rounds, 20 rounds, or other values, which are not specifically limited in the embodiments of the present application.

[0085] In some embodiments, for step S510, each client device may upload the first parameter to the training group to which each client device belongs in the central server at a preset time interval.

[0086] In some embodiments, for step S510, each client device may upload the first parameter obtained in the last round to the training group to which each client device belongs in the central server after each preset number of training rounds.

[0087] In some embodiments, for the first model in step S510, its initial parameters can be obtained by the central server after initializing the parameters of the second model in the global model layer, and sent to the client devices included in each training group through the local training layer of the central server.

[0088] In one example, the parameters of the second model are initialized, and the values ​​corresponding to the parameters in the second model may be set to 1. For example, ω g =1,ω g is a parameter in the second model.

[0089] Here, the second model has the same structure as the first model, and during the model training phase, the initial parameters of the first model and the initial parameters of the second model may be the same.

[0090] In step S520, for at least one training group, first parameters associated with each training group are aggregated to obtain second parameters corresponding to each training group.

[0091] Here, the first parameter associated with each training group can be the first parameter obtained after at least one client device included in each training group trains the first model through its own local data. Aggregation can adopt a federated average algorithm, or group aggregation, window aggregation, etc., which is not specifically limited in the embodiments of the present application.

[0092] It can be understood that, for at least one training group, the local training layer in the central server can adopt a corresponding aggregation algorithm or aggregation method to perform an aggregation operation on the first parameter associated with each training group, so as to obtain a second parameter corresponding to each training group.

[0093] In some embodiments, the aggregation operation may update the parameters of the third model included in each training group.

[0094] In step S530, the third parameter corresponding to the second model is updated according to the second parameter and the number of times each training group participates in updating the second model within a preset time, until the second model converges to obtain a trained second model.

[0095] Here, the second model has the same structure as the first model. As the model is continuously trained, the updated parameters corresponding to the first model and the updated parameters corresponding to the second model may be the same or different, and the embodiments of the present application do not specifically limit this. The preset time may be a pre-set time, such as 5 minutes, 10 minutes, or other time values, and the embodiments of the present application do not specifically limit this. The central server updates the second model at preset time intervals, and the number of times each training group participates in the update of the second model within the preset time may be: the number of times each training group participates in the update of the second model within the preset time.

[0096] It can be understood that after obtaining the second parameter corresponding to each training group, the third parameter corresponding to the second model is updated by asynchronous aggregation update according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, and the updated third parameter can be obtained until the second model converges to obtain the trained second model.

[0097] In some embodiments, whether the second model converges can be determined by the loss value of the second model, which can be specifically: the input of the second model is predicted by the updated third parameter to obtain the output of the second model, and the loss value of the second model can be calculated based on the true value corresponding to the output of the second model and the input of the second model through the corresponding loss function. When the loss value is less than the preset threshold, it means that the second model converges; when the loss value is greater than or equal to the preset threshold, it means that the second model does not converge, and it is necessary to continue training the second model, and the above steps S510 to S530 can be repeated.

[0098] In an embodiment of the present application, through the above-mentioned steps S510 to S530, joint training is performed without the need for each client device to upload local data, which can ensure the data security of the client device, and use the computing power of each client device for local training, which can improve the convergence speed and accuracy of model training, reduce the pressure on the central server, and thus improve the accuracy of network intrusion detection results. At the same time, compared with the federated learning of the traditional synchronous aggregation training mode, the hierarchical asynchronous aggregation mode of this scheme saves a lot of time overhead, which can make the overall training more efficient and effectively reduce the overall training time, that is, achieve the effect of higher model accuracy and shorter usage time under the same model.

[0099] In some embodiments, after step S520, the model training method may further include: each client device corresponding to at least one training group receives a second parameter sent by at least one training group, so that each client device can train its own first model based on the second parameter.

[0100] In some embodiments, the above-mentioned step S530 of updating the third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time may include: step a, summing the number of times at least one training group participates in the update of the second model within the preset time to obtain the total number of times; step b, sorting at least one training group according to the time overhead corresponding to each training group to obtain the sequence number of each training group; step c, updating the third parameter according to the sequence number, the total number of times, the number of times and the second parameter.

[0101] Here, the time overhead corresponding to each training group can be the average time overhead of all client devices in the training group. The average time overhead may include the local training time of the client device and the communication time overhead for uploading and downloading the model, etc. The embodiment of the present application does not make specific limitations on this.

[0102] In an example, the average time overhead of the client device may be the average time overhead of the most recent j iterations of the client device, where j is a positive integer greater than 1.

[0103] It can be understood that there are differences in training communication overheads between the training groups. Some training groups complete training in a shorter time, while others complete training more slowly. If the second model updates the third parameter in a synchronous aggregation manner, it may affect the training performance. Therefore, the update of the second model can be performed in an asynchronous aggregation manner. Based on this, the number of times at least one training group participates in the update of the second model within a preset time is obtained, and then the number of times corresponding to all training groups is summed, that is, the number of times corresponding to all training groups is added to obtain the total number of times. Then, at least one training group is sorted according to the time overhead corresponding to each training group. For example, the sequence number of each training group can be obtained by sorting from small to large according to the time overhead corresponding to each training group. Finally, according to the sequence number of each training group, the total number of times, the number of times at least one training group participates in the update of the second model within a preset time, and the second parameter, the third parameter is updated in an asynchronous aggregation manner. In this way, updating the third parameter in the above manner can improve the training efficiency and reduce the adverse effects of different network environments and communication performances on model training.

[0104] In some embodiments, the above step c may include: step c1, for the ith training group, determining the first weight corresponding to the ith training group based on the number of times and the total number of times the N-i+1th training group participates in the update of the second model within a preset time; step c2, obtaining a fourth parameter through a weighted sum operation based on the first weight and the second parameter corresponding to the training group corresponding to the first weight; step c3, updating the third parameter to the fourth parameter.

[0105] Wherein, i and N are positive integers, N is the number of training groups, and i can be the sequence number of the training group obtained by sorting the time overheads corresponding to the training groups from small to large.

[0106] Here, the third parameter can be updated by asynchronous aggregation: for a training group that participates in the update of the second model more times within a preset time, it means that the training speed of the training group is faster, the time overhead corresponding to the training group is smaller, and accordingly, the sequence number of the training group is higher. At this time, the proportion of the training group in the update process can be set to be smaller, so as to achieve the effect of enabling each training group to participate in the update of the second model in a balanced manner.

[0107] It can be understood that for the i-th training group, the first weight corresponding to the i-th training group can be obtained by dividing the number of times and the total number of times the N-i+1-th training group participates in the update of the second model within the preset time. Then, according to the first weight and the second parameter corresponding to the training group corresponding to the first weight, the fourth parameter can be obtained through a weighted sum operation, and finally the third parameter is updated to the fourth parameter. In this way, the update of the third parameter is realized, so that each training group can participate in the update of the second model in a balanced manner, which is conducive to improving the efficiency of model training and accelerating the convergence of the model.

[0108] In some embodiments, for the above steps c1 to c3, the calculation process can be expressed by the following formula (1):

[0109]

[0110] Among them, R (N-i+1) represents the number of times the N-i+1th training group participates in the update of the second model within the preset time; R represents the total number of times; ω i represents the second parameter corresponding to the i-th training group; represents the first weight corresponding to the i-th training group; ω g Represents the updated third parameter.

[0111] In some embodiments, the above-mentioned step S520 may include: step a1, determining the second weight corresponding to each client device based on the amount of data corresponding to each client device in each training group and the sum of the amount of data corresponding to all client devices in each training group; step a2, obtaining the second parameter by weighted summation operation based on the second weight and the first parameter corresponding to each client device.

[0112] Here, the data volume corresponding to each client device may be: the number of data items corresponding to each client device. The total data volume corresponding to all client devices in each training group may be: the total number of data items obtained by summing the data volumes corresponding to each client device included in each training group.

[0113] It can be understood that the second weight corresponding to each client device can be obtained by dividing the amount of data corresponding to each client device in each training group by the sum of the amount of data corresponding to all client devices in each training group. Then, the first product corresponding to each client device is obtained by multiplying the second weight and the first parameter corresponding to the client device corresponding to the second weight, and finally the second parameter is obtained by adding the first products. In this way, the second parameter is obtained by synchronous aggregation, and only the first parameter needs to be uploaded, the communication overhead is low, and the local data of each client device is used for training, which can improve the accuracy and generalization performance of the model.

[0114] In some embodiments, for the above steps a1 and a2, the calculation process can be expressed by the following formula (2):

[0115]

[0116] Where m represents the number of client devices included in a training group; n k represents the data volume corresponding to the kth client device in the training group; n represents the total data volume corresponding to all client devices in the training group; represents a second weight corresponding to the k-th client device in the training group; represents the first parameter corresponding to the kth client device in the training group; ω r+1 Indicates the second parameter corresponding to the training group.

[0117] In some embodiments, after the above-mentioned step S520, the model training method may further include: step b1, determining the time overhead corresponding to each client device according to the average time overhead corresponding to each client device in each training group and the number of client devices included in each training group when a preset condition is met; step b2, determining whether each client device matches the training group in which each client device is located according to the time overhead and a preset evaluation threshold; step b3, moving at least one client device to other training groups when there is no match between at least one client device and the training group of at least one client device.

[0118] Here, the preset condition may be that the number of rounds of aggregation of the training group reaches a preset threshold, and the preset threshold may be a preset value. Other training groups may be understood as training groups that match at least one client device.

[0119] In one example, the preset condition may be r%h f =0.

[0120] Where r is a positive integer, which represents the number of iterations of model aggregation in a training group; hf is a positive integer, which represents the preset round number threshold and h f ≤r; % indicates the remainder operation.

[0121] It can be understood that regular evaluation is essential for quality verification of model training, and the average time overhead can be used to evaluate the performance and network environment of the first model of each client device so as to perform joint training with the third model included in the training group to which the client device belongs. Therefore, under the condition of meeting the preset conditions, each training group in the central server can determine the time overhead corresponding to each client device according to the average time overhead corresponding to each client device in each training group and the number of client devices included in each training group through mathematical operations or other means. Then, according to the size relationship between the time overhead and the preset evaluation threshold, it is determined whether each client device matches the training group to which each client device belongs. When the time overhead corresponding to at least one client device is greater than the preset evaluation threshold, it means that at least one client device does not match the training group of at least one client device, and the client device needs to be regrouped, that is, the client device is moved to another training group. In this way, since the time overhead corresponding to the client device can characterize the training situation of the client device, each client device is evaluated based on the time overhead corresponding to the client device, and the client device is assigned to a matching training group. This can be adapted to the complex network environment of different client devices. Client devices with similar network environments and training performance can be assigned to the same training group, which can improve the training efficiency of the model and avoid errors caused by differences between client devices, thereby achieving adaptive grouping and improving the quality of model training.

[0122] In some embodiments, for the above step b1, the calculation process can be expressed by the following equations (3) to (4):

[0123]

[0124] Among them, d k represents the time overhead corresponding to the kth client device; represents the average time overhead corresponding to all client devices in a training group; C k represents the average time overhead corresponding to the kth client device; m represents the number of client devices included in the training group; F k Indicates that d is converted using the sigmoid function k The result is converted to a value in the interval [0,1].

[0125] In some embodiments, for the preset evaluation threshold in step b2 above, its calculation process can be expressed by the following formula (5):

[0126] L = 0.5 - α × 0.01 (5)

[0127] Wherein, L represents the preset evaluation threshold; α represents the weight parameter for adjusting the preset evaluation threshold, and its value range may be [0,1].

[0128] In some embodiments, after the above step b2, the model training method may further include: when each client device matches the training group to which each client device belongs, retaining each client device in the training group to which it belongs.

[0129] In some embodiments, other training groups in the above step b3 may be determined by a pre-set movement rule or by other methods, which is not limited in this embodiment of the present application.

[0130] In some embodiments, after the above step b2, the model training method may further include: if at least one client device does not match any training group, a new training group is created based on the model parameters of the training group in which the at least one client device was originally located, and the at least one client device is moved to the newly created training group for model training of the at least one client device. In this way, it is ensured that each client device has its own training group, so as to facilitate joint training of the client devices.

[0131] In some embodiments, before the above step S510, the model training method further includes: collecting data from each client device through a data collection plug-in in each client device to obtain training data; and preprocessing the training data to obtain local data.

[0132] Here, the data collection plug-in can be an agent plug-in or other plug-in capable of local data collection, which is not specifically limited in the embodiments of the present application. The data collection plug-in can be installed on a security product of a client device. A security product can be understood as security software or hardware installed on a client device, such as a cloud security center, a terminal protection center, etc., which is used to protect the client device and the data it processes from potential security threats. The training data can be the network traffic data corresponding to the client device.

[0133] It can be understood that by collecting or generating data for each client device through the data collection plug-in in each client device, training data can be obtained. The training data here will not be uploaded to the central server, but stored in each client device. Then, the data collection plug-in in each client device pre-processes the corresponding training data to obtain local data. In this way, the user's privacy can be protected and data security can be maintained.

[0134] In some embodiments, for the above-mentioned preprocessing, the training data can be processed into a data set including the following attribute features: source internet protocol (IP) address, source IP port, destination IP address, destination IP port, transmission protocol (such as internet control message protocol (ICMP), coding polling protocol (CPP), user datagram protocol (UDP), etc.), the time when the network flow is first detected, the duration of the network flow, the number of transmitted bytes, the number of transmitted data packets, the OR (or) cascade of all transmission control protocol (TCP) flags, category labels (such as normal, attacker, victim, suspicious or unknown, etc.), attack type (such as port scanning, distributed denial of service (DDOS), brute force cracking, etc.), attack identity document (ID), etc.

[0135] In some embodiments, for the above preprocessing, a label encoder can be used to convert categorical features into digital form; the feature data set can also be normalized by using a MinMax Scaler, which can calculate the minimum and maximum values ​​of the features and scale the data to a range of 0-1.

[0136] Figure 6 FIG. 1 is another implementation flow diagram of the model training method provided in the embodiment of the present application. Figure 6 As shown, the embodiment of the present application mainly introduces the updating process of the third parameter, which may specifically include steps S610 to S650.

[0137] In step S610, first parameters are obtained after each client device in at least one training group trains the first model using respective local data.

[0138] In step S620, for at least one training group, first parameters associated with each training group are aggregated to obtain second parameters corresponding to each training group.

[0139] In step S630, the number of times that at least one training group participates in updating the second model within a preset time is summed to obtain a total number of times.

[0140] In step S640, at least one training group is sorted according to the time overhead corresponding to each training group to obtain a sequence number of each training group.

[0141] In step S650, the third parameter is updated according to the sequence number, the total number of times, the number of times and the second parameter until the second model converges to obtain a trained second model.

[0142] The intrusion detection method provided in the embodiment of the present application will be described below in conjunction with the exemplary application and implementation of the electronic device provided in the embodiment of the present application.

[0143] Figure 7 FIG. 1 is a schematic diagram of an implementation process of the intrusion detection method provided in the embodiment of the present application. Figure 7 As shown, the intrusion detection method of the embodiment of the present application may include steps S710 to S720.

[0144] Step S710, obtaining data to be detected.

[0145] Here, the data to be detected may come from at least one client device, and may be data associated with intrusion detection.

[0146] Step S720, input the data to be detected into the trained second model to obtain the intrusion detection result corresponding to the data to be detected.

[0147] The second model is obtained in the following manner: obtaining a first parameter after each client device in at least one training group trains the first model through its own local data, and the first model is used to perform intrusion detection on the local data; for at least one training group, aggregating the first parameter associated with each training group to obtain a second parameter corresponding to each training group; updating a third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time until the second model converges, wherein the second model has the same structure as the first model.

[0148] It can be understood that the data to be detected is input into the trained second model, and the data to be detected is predicted by the trained second model, and the output of the second model is the intrusion detection result corresponding to the data to be detected.

[0149] In some embodiments, the intrusion detection result in step 720 may include: the type of intrusion, such as attacker, normal traffic, and unknown, etc., which is not limited in this embodiment of the present application.

[0150] In the embodiment of the present application, through the above steps 710 and 720, intrusion detection can be performed through the trained second model to determine whether there is an attack.

[0151] In some embodiments, in the process of obtaining the second model in the above step S720, the third parameter corresponding to the second model is updated according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, which may include: summing the number of times at least one training group participates in the update of the second model within a preset time to obtain the total number of times; sorting at least one training group according to the time overhead corresponding to each training group to obtain the sequence number of each training group; and updating the third parameter according to the sequence number, the total number of times, the number of times and the second parameter. In this way, updating the third parameter in the above manner can improve the training efficiency and reduce the adverse effects of different network environments and communication performances on model training.

[0152] In some embodiments, after the above step S720, the above intrusion detection method may further include: obtaining attack situations in intrusion detection results of different client devices; and building a data analysis platform based on the attack situations to analyze the attack situations.

[0153] It can be understood that after storing the trained second model, each client device can use the trained second model to perform real-time intrusion detection and protection on its own data to be detected, thereby obtaining intrusion detection results of different client devices. Then, the central server can obtain the attack situation in the intrusion detection results of different client devices, and build a data analysis platform based on the attack situation to analyze the attack situation, so as to determine countermeasures for different attack situations and better maintain the security of each client device.

[0154] In some embodiments, the above step S710 may include: collecting data from at least one client device through a data collection plug-in in at least one client device to obtain network traffic data; and preprocessing the network traffic data to obtain data to be detected.

[0155] It can be understood that by collecting data from at least one client device through a data collection plug-in in at least one client device, network flow data can be obtained. Then, the network flow data is pre-processed to obtain the data to be detected. In this way, the subsequent intrusion detection process can be facilitated and the detection efficiency can be improved.

[0156] In some embodiments, for the above intrusion detection process, a client device with poor computing performance can upload its own data to be detected to the central server, so that the central server can detect the data to be detected through the trained second model. In this way, the client device can perform intrusion detection without deploying the trained second model, which can avoid reducing the performance of the client device.

[0157] Based on the same inventive concept, the present application embodiment also provides a model training device, such as the model training device 155 in the above embodiment. Figure 2 As shown, the model training device 155 includes: a first acquisition module 1551, used to obtain a first parameter obtained after each client device in at least one training group trains the first model through its respective local data, and the first model is used to perform intrusion detection on the local data; a first determination module 1552, used to aggregate the first parameter associated with each training group for at least one training group to obtain a second parameter corresponding to each training group; a second determination module 1553, used to update a third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, until the second model converges to obtain a trained second model, wherein the second model has the same structure as the first model.

[0158] In some embodiments, the second determination module 1553 includes: a first determination unit, used to sum the number of times at least one training group participates in the update of the second model within a preset time to obtain a total number of times; a second determination unit, used to sort at least one training group according to the time overhead corresponding to each training group to obtain a sequence number of each training group; an updating unit, used to update the third parameter according to the sequence number, the total number of times, the number of times and the second parameter.

[0159] In some embodiments, the updating unit is used to perform the following steps: for the ith training group, determine the first weight corresponding to the ith training group based on the number of times and the total number of times the N-i+1th training group participates in the update of the second model within a preset time, wherein i and N are positive integers and N is the number of training groups; obtain a fourth parameter by a weighted sum operation based on the first weight and the second parameter corresponding to the training group corresponding to the first weight; and update the third parameter to the fourth parameter.

[0160] In some embodiments, the first determination module 1552 is used to perform the following steps: determine the second weight corresponding to each client device based on the amount of data corresponding to each client device in each training group and the sum of the amount of data corresponding to all client devices in each training group; and obtain the second parameter by performing a weighted sum operation based on the second weight and the first parameter corresponding to each client device.

[0161] In some embodiments, the model training device further includes: a third determination module, for aggregating the first parameter associated with each training group for at least one training group to obtain the second parameter corresponding to each training group, and then, if a preset condition is met, determining the time overhead corresponding to each client device according to the average time overhead corresponding to each client device in each training group and the number of client devices included in each training group; a fourth determination module, for determining whether each client device matches the training group in which each client device is located based on the time overhead and a preset evaluation threshold; and a moving module, for moving at least one client device to other training groups if there is a mismatch between at least one client device and the training group of at least one client device.

[0162] In some embodiments, the above-mentioned model training device also includes: a collection module, which is used to collect data from each client device through a data collection plug-in in each client device before obtaining the first parameter obtained after each client device in at least one training group trains the first model through its respective local data to obtain training data; a preprocessing module, which is used to preprocess the training data to obtain local data.

[0163] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. In some embodiments, the functions or modules included in the model training device provided in the embodiment of the present application can be used to execute the method described in the above model training method embodiment. For technical details not disclosed in the embodiment of the model training device of the present application, please refer to the description of the embodiment of the model training method of the present application for understanding.

[0164] Based on the same inventive concept, the present application embodiment also provides an intrusion detection device, such as the intrusion detection device 156 in the above embodiment. Figure 3 As shown, the intrusion detection device 156 includes: a second acquisition module 1561, used to obtain data to be detected; a detection module 1562, used to input the data to be detected into the trained second model to obtain an intrusion detection result corresponding to the data to be detected; wherein the second model is obtained in the following manner: obtaining a first parameter obtained after each client device in at least one training group trains the first model through its respective local data, the first model being used to perform intrusion detection on the local data; for at least one training group, aggregating the first parameter associated with each training group to obtain a second parameter corresponding to each training group; updating the third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, until the second model converges, wherein the second model has the same structure as the first model.

[0165] In some embodiments, a third parameter corresponding to the second model is updated based on the second parameter and the number of times each training group participates in the update of the second model within a preset time, including: summing the number of times at least one training group participates in the update of the second model within the preset time to obtain a total number of times; sorting at least one training group based on the time overhead corresponding to each training group to obtain a sequence number for each training group; and updating the third parameter based on the sequence number, the total number of times, the number of times, and the second parameter.

[0166] In some embodiments, the intrusion detection device further includes: a third acquisition module, which is used to obtain the attack situation in the intrusion detection results of different client devices after inputting the network traffic data to be detected into the trained second model to obtain the intrusion detection results corresponding to the network traffic data to be detected; and a construction module, which is used to construct a data analysis platform based on the attack situation to analyze the attack situation.

[0167] In some embodiments, the second acquisition module 1561 is used to perform the following steps: collect data from at least one client device through a data collection plug-in in at least one client device to obtain network traffic data; and pre-process the network traffic data to obtain data to be detected.

[0168] The description of the above device embodiment is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment.

[0169] In some embodiments, the functions or modules included in the intrusion detection device provided in the embodiments of the present application can be used to execute the method described in the above-mentioned intrusion detection method embodiment. For technical details not disclosed in the embodiments of the intrusion detection device of the present application, please refer to the description of the embodiments of the intrusion detection method of the present application for understanding.

[0170] It should be noted that in the embodiment of the present application, if the above-mentioned model training method and intrusion detection method are implemented in the form of a software function module and sold or used as an independent product, they can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable an electronic device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a ROM, a magnetic disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific hardware, software or firmware, or any combination of hardware, software and firmware.

[0171] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the program, some or all of the steps in the above method are implemented.

[0172] The embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, some or all of the steps in the above method are implemented. The computer-readable storage medium can be transient or non-transient.

[0173] An embodiment of the present application provides a computer program, including a computer-readable code. When the computer-readable code is run in an electronic device, a processor in the electronic device executes some or all of the steps for implementing the above method.

[0174] The present application embodiment provides a computer program product, including a computer program or an instruction, which implements some or all of the steps in the above method when the computer program or instruction is executed by a processor. The computer program product can be implemented specifically by hardware, software, or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium, and in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK), etc.

[0175] It should be noted here that the description of the various embodiments above tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. The description of the above device, storage medium, computer program and computer program product embodiments is similar to the description of the above method embodiment, and has similar beneficial effects as the method embodiment. For technical details not disclosed in the embodiments of the device, storage medium, computer program and computer program product of this application, please refer to the description of the method embodiment of this application for understanding.

[0176] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the serial number of each step / process mentioned above does not mean the order of execution, and the execution order of each step / process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The serial numbers of the embodiments of the present application mentioned above are for description only and do not represent the advantages and disadvantages of the embodiments.

[0177] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0178] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0179] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0180] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0181] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks or optical disks.

[0182] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially or in other words, the part that contributes to the relevant technology can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for an electronic device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0183] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application.

Claims

1. A model training method, characterized in that: include: Obtaining first parameters obtained by training a first model using respective local data for each client device in at least one training group, wherein the first model is used to perform intrusion detection on the local data; For the at least one training group, aggregating the first parameters associated with each training group to obtain a second parameter corresponding to each training group; According to the second parameter and the number of times each training group participates in updating the second model within a preset time, the third parameter corresponding to the second model is updated until the second model converges to obtain a trained second model, wherein the second model has the same structure as the first model.

2. The method according to claim 1, characterized in that: The updating of the third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the updating of the second model within a preset time includes: Summing up the number of times that the at least one training group participates in updating the second model within a preset time to obtain a total number of times; Sorting the at least one training group according to the time overhead corresponding to each training group to obtain a sequence number of each training group; The third parameter is updated according to the sequence number, the total number of times, the number of times and the second parameter.

3. The method according to claim 2, characterized in that The updating of the third parameter according to the sequence number, the total number of times, the number of times and the second parameter includes: For the i-th training group, determine the first weight corresponding to the i-th training group according to the number of times the N-i+1-th training group participates in the updating of the second model within a preset time and the total number of times, where i and N are positive integers and N is the number of training groups; Obtaining a fourth parameter through a weighted sum operation according to the first weight and the second parameter corresponding to the training group corresponding to the first weight; The third parameter is updated to the fourth parameter.

4. The method according to claim 1, characterized in that: The aggregating the first parameters associated with each training group to obtain the second parameters corresponding to each training group includes: Determine a second weight corresponding to each client device according to the amount of data corresponding to each client device in each training group and the sum of the amounts of data corresponding to all client devices in each training group; The second parameter is obtained by performing a weighted sum operation according to the second weight and the first parameter corresponding to each client device.

5. The method according to claim 1, characterized in that After aggregating the first parameters associated with each training group for the at least one training group to obtain the second parameters corresponding to each training group, the method further includes: When a preset condition is met, determining the time overhead corresponding to each client device according to the average time overhead corresponding to each client device in each training group and the number of client devices included in each training group; Determining, according to the time cost and a preset evaluation threshold, whether each client device matches the training group to which each client device belongs; In case there is no match between the at least one client device and the training group described by the at least one client device, the at least one client device is moved to another training group.

6. The method according to any one of claims 1 to 5, characterized in that: Before obtaining the first parameter obtained after each client device in at least one training group trains the first model using respective local data, the method further includes: Collecting data from each client device through a data collection plug-in in each client device to obtain training data; The training data is preprocessed to obtain the local data.

7. An intrusion detection method, characterized in that: include: Obtain the data to be tested; Inputting the data to be detected into the trained second model to obtain the intrusion detection result corresponding to the data to be detected; The second model is obtained in the following manner: obtaining a first parameter obtained after each client device in at least one training group trains the first model through its respective local data, and the first model is used to perform intrusion detection on the local data; for the at least one training group, aggregating the first parameter associated with each training group to obtain a second parameter corresponding to each training group; updating a third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time until the second model converges, wherein the second model has the same structure as the first model.

8. The method according to claim 7, characterized in that The updating of the third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the updating of the second model within a preset time includes: Summing up the number of times that the at least one training group participates in updating the second model within a preset time to obtain a total number of times; Sorting the at least one training group according to the time overhead corresponding to each training group to obtain a sequence number of each training group; The third parameter is updated according to the sequence number, the total number of times, the number of times and the second parameter.

9. The method according to claim 7, characterized in that: After inputting the network traffic data to be detected into the trained second model to obtain the intrusion detection result corresponding to the network traffic data to be detected, the method further includes: Obtain attack conditions from intrusion detection results of different client devices; Based on the attack situation, a data analysis platform is constructed to analyze the attack situation.

10. The method according to any one of claims 7 to 9, characterized in that: The step of obtaining the data to be detected includes: Collecting data from at least one client device through a data collection plug-in in at least one client device to obtain network traffic data; The network traffic data is preprocessed to obtain the data to be detected.

11. A model training device, characterized in that: include: A first acquisition module, used to acquire a first parameter obtained by training a first model by each client device in at least one training group using respective local data, wherein the first model is used to perform intrusion detection on the local data; A first determining module is used to aggregate the first parameters associated with each training group for the at least one training group to obtain a second parameter corresponding to each training group; The second determination module is used to update the third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, until the second model converges to obtain a trained second model, wherein the second model has the same structure as the first model.

12. An intrusion detection device, characterized in that: include: The second acquisition module is used to acquire the data to be detected; A detection module, used for inputting the data to be detected into the trained second model to obtain an intrusion detection result corresponding to the data to be detected; The second model is obtained in the following manner: obtaining a first parameter obtained after each client device in at least one training group trains the first model through its respective local data, and the first model is used to perform intrusion detection on the local data; for the at least one training group, aggregating the first parameter associated with each training group to obtain a second parameter corresponding to each training group; updating a third parameter corresponding to the second model according to the second parameter and the number of times each training group participates in the update of the second model within a preset time until the second model converges, wherein the second model has the same structure as the first model.

13. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the program, the steps in the method according to any one of claims 1 to 10 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

15. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps in the method according to any one of claims 1 to 10 are implemented.

Images