Model training method, intrusion detection method, device, equipment, medium and product

Abstract

The application discloses a model training method, an intrusion detection method, a device, equipment, a medium and a product. The method comprises the following steps: acquiring first parameters obtained by training a first model by using local data of each client device in at least one training group; for the at least one training group, aggregating the first parameters associated with each training group to obtain second parameters corresponding to each training group; and updating third parameters corresponding to a second model according to the second parameters and the number of times that each training group participates in updating the second model within a preset time, until the second model converges, thereby obtaining the trained second model. According to the application, joint training can be performed without uploading local data, the data security of the client device can be ensured, local training can be performed by using the computing capacity of each client device, the convergence speed and precision of model training can be improved, and the accuracy of the network intrusion detection result can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to, but is not limited to, the technical field of network attack detection, and in particular to a model training method, an intrusion detection method, a device, equipment, a medium and a product. BACKGROUND

[0002] With the increase of network complexity, network systems are threatened by various security vulnerabilities, including network intrusion attacks. Network intrusion attacks can cause privacy leaks, property losses and system failures. Therefore, network intrusion detection is crucial.

[0003] In related technologies, network intrusion detection is performed by a machine learning method, which requires a large amount of labeled data to train the model. In the field of network security, due to the privacy involved in local data, many users are reluctant to share their personal data for model training, making it relatively difficult to obtain a large amount of labeled data, which limits the model training. And the local training performance, data distribution and network environment of different client devices are different, which further makes the convergence speed of model training different, resulting in poor model training results, thereby affecting the accuracy of network intrusion detection results. SUMMARY

[0004] Therefore, the present application provides a model training method, an intrusion detection method, a device, equipment, a medium and a product, which can ensure the data security of client devices, improve the convergence speed and accuracy of model training, and improve the accuracy of network intrusion detection results.

[0005] The technical scheme of the present application embodiment is implemented as follows:

[0006] In a first aspect, the present application provides a model training method, comprising: obtaining a first parameter obtained by each client device in at least one training group training a first model with its own local data, the first model being used for intrusion detection on the local data; aggregating the first parameter associated with each training group for at least one training group, to obtain a second parameter corresponding to each training group; updating a third parameter corresponding to a second model according to the second parameter and the number of times each training group participates in updating the second model within a preset time, until the second model converges, to obtain a trained second model, wherein the structure of the second model and the first model is the same.

[0007] In some embodiments, the third parameter corresponding to the second model is updated according to the second parameter and the number of times that each training group participates in updating the second model within a preset time, including: summing the number of times that at least one training group participates in updating the second model within the preset time to obtain a total number of times; sorting the at least one training group according to the time cost corresponding to each training group to obtain a serial number of each training group; and updating the third parameter according to the serial number, the total number of times, the number of times, and the second parameter.

[0008] In some embodiments, the third parameter is updated according to the serial number, the total number of times, the number of times, and the second parameter, including: for the i th training group, determining a first weight corresponding to the i th training group according to the number of times that the N-i+1 th training group participates in updating the second model within the preset time and the total number of times, where i and N are positive integers, and N is the number of training groups; obtaining a fourth parameter by weighted summation operation according to the first weight and the second parameter corresponding to the training group corresponding to the first weight; and updating the third parameter to the fourth parameter.

[0009] In some embodiments, the second parameter corresponding to each training group is obtained by aggregating the first parameter associated with each training group, including: determining a second weight corresponding to each client device according to the data amount corresponding to each client device in each training group and the total sum of the data amounts corresponding to all client devices in each training group; and obtaining the second parameter by weighted summation operation according to the second weight and the first parameter corresponding to each client device.

[0010] In some embodiments, after the second parameter corresponding to each training group is obtained by aggregating the first parameter associated with each training group for at least one training group, the method further includes: in the case that a preset condition is met, determining the time cost corresponding to each client device according to the average time cost corresponding to each client device in each training group and the number of client devices included in each training group; determining whether each client device matches the training group in which the client device is located according to the time cost and a preset evaluation threshold; and moving at least one client device to another training group in the case that at least one client device does not match the training group of at least one client device.

[0011] In some embodiments, before the first parameter obtained by training the first model by each client device in at least one training group through respective local data is obtained, the method further includes: collecting data of each client device by a data collection plug-in in each client device to obtain training data; and preprocessing the training data to obtain local data.

[0012] In a second aspect, the application provides an intrusion detection method, comprising: obtaining to-be-detected data; inputting the to-be-detected data into a trained second model to obtain an intrusion detection result corresponding to the to-be-detected data; wherein the second model is obtained by: obtaining first parameters obtained by each client device in at least one training group training a first model through respective local data, the first model being used for intrusion detection on the local data; for the at least one training group, aggregating the first parameters associated with each training group to obtain second parameters corresponding to each training group; and updating third parameters corresponding to the second model according to the second parameters and a number of times that each training group participates in updating of the second model within a preset time, until the second model converges, wherein the second model and the first model have the same structure.

[0013] In some embodiments, the updating of the third parameters corresponding to the second model according to the second parameters and the number of times that each training group participates in updating of the second model within the preset time comprises: performing summation operation on the number of times that the at least one training group participates in updating of the second model within the preset time to obtain a total number of times; sorting the at least one training group according to time consumption corresponding to each training group to obtain a serial number of each training group; and updating the third parameters according to the serial number, the total number of times, the number of times and the second parameters.

[0014] In some embodiments, after the to-be-detected network traffic data is inputted into the trained second model to obtain an intrusion detection result corresponding to the to-be-detected network traffic data, the method further comprises: obtaining attack situations in the intrusion detection results of different client devices; and constructing a data analysis platform based on the attack situations to analyze the attack situations.

[0015] In some embodiments, the obtaining of the to-be-detected data comprises: collecting data of the at least one client device through a data collection plug-in in the at least one client device to obtain network traffic data; and preprocessing the network traffic data to obtain the to-be-detected data.

[0016] In a third aspect, the application provides a model training apparatus, comprising: a first obtaining module configured to obtain first parameters obtained by each client device in at least one training group training a first model through respective local data, the first model being used for intrusion detection on the local data; a first determining module configured to, for the at least one training group, aggregate the first parameters associated with each training group to obtain second parameters corresponding to each training group; and a second determining module configured to update third parameters corresponding to the second model according to the second parameters and a number of times that each training group participates in updating of the second model within a preset time, until the second model converges, to obtain a trained second model, wherein the second model and the first model have the same structure.

[0017] In some embodiments, the second determining module comprises: a first determining unit configured to sum the number of times that at least one training group participates in updating of the second model within a preset time to obtain a total number of times; a second determining unit configured to sort the at least one training group according to a time cost corresponding to each training group to obtain a serial number of each training group; and an updating unit configured to update a third parameter according to the serial number, the total number of times, the number of times, and a second parameter.

[0018] In some embodiments, the updating unit is configured to: for an i th training group, determine a first weight corresponding to the i th training group according to a number of times that an N-i+1 th training group participates in updating of the second model within a preset time and the total number of times, where i and N are positive integers and N is the number of training groups; obtain a fourth parameter through weighted summation operation according to the first weight and a second parameter corresponding to the training group corresponding to the first weight; and update the third parameter to the fourth parameter.

[0019] In some embodiments, the first determining module is configured to: determine a second weight corresponding to each client device according to a data amount corresponding to each client device in each training group and a total sum of data amounts corresponding to all client devices in each training group; and obtain a second parameter through weighted summation operation according to the second weight and a first parameter corresponding to each client device.

[0020] In some embodiments, the model training apparatus further comprises: a third determining module configured to, after aggregating the first parameter associated with each training group for the at least one training group to obtain a second parameter corresponding to each training group, determine a time cost corresponding to each client device according to an average time cost corresponding to each client device in each training group and a number of client devices included in each training group when a preset condition is met; a fourth determining module configured to determine whether each client device matches a training group in which the client device is located according to the time cost and a preset evaluation threshold; and a moving module configured to move at least one client device to another training group when at least one client device does not match a training group of at least one client device.

[0021] In some embodiments, the model training apparatus further comprises: a collecting module configured to collect training data by collecting data of each client device through a data collection plug-in in each client device before obtaining the first parameter obtained by each client device by training the first model through respective local data in the at least one training group; and a preprocessing module configured to preprocess the training data to obtain the local data.

[0022] In a fourth aspect, the present application provides an intrusion detection device, comprising: a second acquisition module configured to acquire to-be-detected data; a detection module configured to input the to-be-detected data into a trained second model to obtain an intrusion detection result corresponding to the to-be-detected data; wherein the second model is obtained by: acquiring first parameters obtained by each client device in at least one training group training a first model through respective local data, the first model being configured to perform intrusion detection on the local data; for the at least one training group, aggregating the first parameters associated with each training group to obtain second parameters corresponding to each training group; and updating third parameters corresponding to the second model according to the second parameters and a number of times each training group participates in updating of the second model within a preset time, until the second model converges, wherein the second model and the first model have the same structure.

[0023] In some embodiments, the updating of the third parameters corresponding to the second model according to the second parameters and the number of times each training group participates in updating of the second model within the preset time comprises: performing summation operation on the number of times the at least one training group participates in updating of the second model within the preset time to obtain a total number of times; sorting the at least one training group according to time consumption corresponding to each training group to obtain a serial number of each training group; and updating the third parameters according to the serial number, the total number of times, the number of times, and the second parameters.

[0024] In some embodiments, the intrusion detection device further comprises: a third acquisition module configured to acquire attack conditions in the intrusion detection results of different client devices after the to-be-detected network traffic data is input into the trained second model to obtain an intrusion detection result corresponding to the to-be-detected network traffic data; and a construction module configured to construct a data analysis platform based on the attack conditions to analyze the attack conditions.

[0025] In some embodiments, the second acquisition module is configured to perform the following steps: collecting data of the at least one client device through a data collection plug-in in the at least one client device to obtain network traffic data; and pre-processing the network traffic data to obtain the to-be-detected data.

[0026] In a fifth aspect, the present application provides an electronic device, comprising a memory and a processor, the memory storing a computer program capable of running on the processor, and when the processor executes the computer program, part or all steps of the above method are realized.

[0027] In a sixth aspect, the present application provides a computer readable storage medium, which stores a computer program, and when the computer program is executed by a processor, part or all steps of the above method are realized.

[0028] In a seventh aspect, the present application provides a computer program product, comprising a computer program or instructions, which, when executed by a processor, implement some or all of the steps in the above method.

[0029] In an eighth aspect, the present application provides a computer program, comprising computer readable code, which, when run in an electronic device, causes a processor in the electronic device to perform some or all of the steps in the above method.

[0030] In the present application, the first parameters obtained by training the first model by the respective local data of each client device in the at least one training group are obtained, the first model being used for intrusion detection on the local data; for the at least one training group, the first parameters associated with each training group are aggregated to obtain the second parameters corresponding to each training group; and the third parameters corresponding to the second model are updated according to the second parameters and the number of times each training group participates in the update of the second model within a preset time, until the second model converges, to obtain the trained second model. Through the above scheme, joint training is performed without uploading the local data by each client device, which can guarantee the data security of the client device, and the computing power of each client device is used for local training, which can improve the convergence speed and accuracy of model training, reduce the pressure of the central server, and thus improve the accuracy of the network intrusion detection result. In addition, compared with the traditional synchronous aggregation training mode of federated learning, the hierarchical asynchronous aggregation mode of the present application saves a large amount of time overhead, can make the overall training more efficient, and effectively reduces the overall training time, that is, achieves the effect of higher model accuracy and shorter use time under the same model.

[0031] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, but not limiting the technical solutions of the present application. BRIEF DESCRIPTION OF DRAWINGS

[0032] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the technical solutions of the present application.

[0033] Figure 1 is a structural schematic diagram of an electronic device provided by an embodiment of the present application;

[0034] Figure 2 is a structural schematic diagram of a model training device provided by an embodiment of the present application;

[0035] Figure 3 is a structural schematic diagram of an intrusion detection device provided by an embodiment of the present application;

[0036] Figure 4is a structural schematic diagram of a model training system provided by an embodiment of the present application.

[0037] Figure 5 is an implementation flow schematic diagram of a model training method provided by an embodiment of the present application.

[0038] Figure 6 is another implementation flow schematic diagram of a model training method provided by an embodiment of the present application.

[0039] Figure 7 is an implementation flow schematic diagram of an intrusion detection method provided by an embodiment of the present application. DETAILED DESCRIPTION

[0040] The embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. In the following description, reference is made to the accompanying drawings which form a part hereof and in which are shown by way of illustration specific aspects in which aspects of the present application can be practiced. It is to be understood that other aspects can be used and structural or logical changes can be made without departing from the scope of the present application. The following detailed description, therefore, is not to be taken in a limiting sense, as the scope of the present application is defined by the appended claims. For example, it is to be understood that the teachings of the disclosure, which describe one or more specific methods, can be equally applied to corresponding devices or systems for performing the described methods, and vice versa. For example, if one or more specific method steps are described, a corresponding device can include one or more units such as functional units to perform the described one or more method steps (for example, one unit performing the one or more steps, or multiple units, each of which performs either one or more of the multiple steps), even if such one or more units are not explicitly described or illustrated in the drawings. On the other hand, for example, if a specific apparatus is described based on one or more units, such as functional units, a corresponding method can include a step to perform the functionality of the one or more units (for example, one step performing the functionality of the one or more units, or multiple steps, each of which performs the functionality of one or more of the multiple units), even if such one or more steps are not explicitly described or illustrated in the drawings. Further, it is to be understood that features of the various example embodiments and / or aspects described herein can be combined with each other, unless explicitly stated otherwise.

[0041] With the increase of network complexity, network systems are threatened by various security vulnerabilities, including network intrusion attacks. Network intrusion attacks can be understood as an attempt to destroy the confidentiality, integrity or availability of a computer network, or to bypass the security mechanism of a computer or network. At present, network intrusion detection systems (NID) have become an urgent demand of the times and the research direction of a large number of scholars. Some intrusion detection methods in the related art are as follows:

[0042] (1) Feature-based detection: Using predefined features, rules, or patterns to identify known attack patterns, which can be based on specific signatures or behavioral characteristics of attacks. This method can quickly identify known attacks but cannot capture unknown, new attacks.

[0043] (2) Anomaly-based detection: By establishing a model of normal behavior, detecting abnormal behavior that deviates significantly from this model. This method can discover unknown, new attacks but is also prone to false positives, as some normal behavior may be mistakenly considered abnormal.

[0044] (3) Traffic analysis: Monitoring network traffic and analyzing data packets, traffic patterns, and transmission protocols to identify potential attack behavior or abnormal traffic patterns. This method may have difficulty in discovering attacks in a timely manner in large traffic scenarios.

[0045] (4) Machine learning detection: Using machine learning algorithms such as support vector machines (SVM), decision trees, random forests, and neural networks to train models and identify abnormal patterns. This method can handle large amounts of data and discover complex attack patterns.

[0046] The above intrusion detection methods have the following shortcomings:

[0047] (1) Difficulty in identifying new threats: Signature or rule-based intrusion detection methods often have difficulty identifying new, unknown attack forms, as they can only identify previously known attack patterns.

[0048] (2) High false positive rate: Anomaly-based intrusion detection methods are prone to false alarms, mistaking normal behavior as abnormal or attack behavior, causing administrators to waste resources on false alarms.

[0049] (3) Real-time challenges: Traffic analysis-based intrusion detection methods may face performance and scalability challenges in the face of large-scale networks or scenarios requiring real-time response.

[0050] (4) Need for large amounts of data: Many machine learning methods require large amounts of labeled data to train models, and obtaining large-scale labeled data in the network security field may be relatively difficult.

[0051] (5) Privacy and data sharing issues: Generally speaking, the larger the training data set, the higher the model performance may be. However, local data such as user network traffic, related shell commands, etc. involve privacy, so many users are reluctant to share personal data for model training, which has certain limitations on model training. Most existing machine learning-based intrusion detection methods use a large amount of user data for training, which has a large privacy problem.

[0052] (6) Distributed machine learning training framework training efficiency problem: As a distributed machine learning framework, federated learning usually maintains a global model. However, the local training performance, data distribution, and communication transmission time of different edge devices may differ, especially considering the intrusion detection task, different devices have different network environments. This will cause the global model training result to be poor or reduce the convergence speed of the overall model training.

[0053] Based on the above problems, the present application proposes a model training method, obtaining the first parameter obtained by training the first model by each client device in at least one training group through the local data of each client device, the first model being used for intrusion detection on the local data; for at least one training group, the first parameter associated with each training group is aggregated to obtain the second parameter corresponding to each training group; according to the second parameter and the number of times each training group participates in the update of the second model within a preset time, the third parameter corresponding to the second model is updated until the second model converges, obtaining the trained second model. Through the above scheme, joint training is performed without uploading local data by each client device, which can ensure the data security of the client device, and the computing power of each client device is used for local training, which can improve the convergence speed and accuracy of model training, reduce the pressure on the central server, and thus improve the accuracy of network intrusion detection results. At the same time, compared with the traditional synchronous aggregation training mode of federated learning, the hierarchical asynchronous aggregation mode of the present application saves a lot of time overhead, which can make the overall training more efficient and effectively reduce the overall training time, that is, achieve the effect of higher model accuracy and shorter use time under the same model.

[0054] In some embodiments, the method described in the embodiments of the present application can be applied to the network security intrusion detection scene. In some embodiments, the method described in the embodiments of the present application can also be applied to the security protection system of the cloud security center. In some embodiments, the method described in the embodiments of the present application can also be applied to small and medium-sized enterprises and organizations, reducing the security investment threshold and realizing light asset operation. In some embodiments, the method described in the embodiments of the present application can also provide corresponding support in cross-field applications (such as financial risk control, smart city, etc.), coping with new technology challenges (Internet of Things, edge computing, blockchain, etc.), etc.

[0055] The following describes an exemplary application of the electronic device provided by the embodiments of the present application. The electronic device provided by the embodiments of the present application can be a notebook computer, a tablet computer, a desktop computer, a mobile device (for example, a mobile phone, a wearable smart watch, a dedicated messaging device), an electric vehicle, an electric bicycle, or the like, but is not limited thereto. Alternatively, the electronic device can also be implemented as a server.

[0056] In some embodiments, the server can be a standalone physical server, a server cluster composed of multiple physical servers, or a distributed system, and can also be a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, and basic cloud computing services such as big data and artificial intelligence platforms, but is not limited thereto. In some embodiments, the server and the electronic device can be directly or indirectly connected through wired or wireless communication, which is not specifically limited in the embodiments of the present application.

[0057] Referring to Figure 1 , Figure 1 is a structural schematic diagram of the electronic device provided by the embodiments of the present application, Figure 1 The electronic device 100 shown in FIG. 1 includes at least one processor 110, a memory 150, at least one network interface 120, and a user interface 130. The various components in the electronic device 100 are coupled together through a bus system 140. It can be understood that the bus system 140 is used to realize the connection and communication between the components. In addition to the data bus, the bus system 140 also includes a power bus, a control bus, and a status signal bus. However, for the purpose of clear illustration, all kinds of buses are marked as the bus system 140 in Figure 1 .

[0058] The processor 110 can be an integrated circuit chip with signal processing capability, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0059] The user interface 130 includes one or more output devices 131 that enable the presentation of media content, including one or more speakers and / or one or more visual display screens. The user interface 130 also includes one or more input devices 132, including user interface components that facilitate user input, such as a keyboard, a mouse, a microphone, a touch screen display, a camera, other input buttons and controls.

[0060] The memory 150 can be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical drives, and the like. The memory 150 optionally includes one or more storage devices remotely located from the processor(s) 110 in a physical location.

[0061] The memory 150 includes volatile memory or nonvolatile memory, and can also include both volatile and nonvolatile memory. Nonvolatile memory can be read only memory (ROM), volatile memory can be random access memory (RAM). The memory 150 described in embodiments of the present application is intended to include any suitable type of memory.

[0062] In some embodiments, the memory 150 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or a subset or superset thereof, which are exemplarily illustrated below.

[0063] The operating system 151 includes system programs for processing various basic system services and performing hardware-related tasks, such as a framework layer, a core library layer, a driver layer, and the like, for implementing various basic services and processing hardware-based tasks.

[0064] The network communication module 152 is used to reach other computing devices via one or more (wired or wireless) network interfaces 120, exemplary network interfaces 120 including Bluetooth, wireless fidelity (WiFi), universal serial bus (USB), and the like.

[0065] The presentation module 153 is used to enable the presentation of information via one or more output devices 131 (e.g., display screens, speakers, and the like) associated with the user interface 130 (e.g., user interfaces for operating peripheral devices and displaying content and information).

[0066] The input processing module 154 is used to detect and interpret one or more user inputs or interactions from one or more input devices 132.

[0067] In some embodiments, the model training method provided by the embodiments of the present application can be implemented in a software manner and stored in the memory 150. Referring to Figure 2 , Figure 2is a structural schematic diagram of a model training apparatus provided by an embodiment of the present application, which can be software in the form of programs and plug-ins, etc. The model training apparatus 155 includes the following software modules: a first obtaining module 1551, a first determining module 1552, and a second determining module 1553. These modules are logical, and thus can be combined or further split according to the functions implemented. The functions of the various modules will be described below.

[0068] In other embodiments, the model training apparatus 155 provided by an embodiment of the present application can be implemented in a hardware manner. As an example, the model training apparatus 155 provided by an embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the model training method provided by an embodiment of the present application. For example, the processor in the form of a hardware decoding processor can use one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0069] In some embodiments, the intrusion detection method provided by an embodiment of the present application can be implemented in a software manner and stored in the memory 150. Referring to Figure 3 , Figure 3 is a structural schematic diagram of an intrusion detection apparatus provided by an embodiment of the present application, which can be software in the form of programs and plug-ins, etc. The intrusion detection apparatus 156 includes the following software modules: a second obtaining module 1561 and a detection module 1562. These modules are logical, and thus can be combined or further split according to the functions implemented. The functions of the various modules will be described below.

[0070] In other embodiments, the intrusion detection apparatus 156 provided by an embodiment of the present application can be implemented in a hardware manner. As an example, the intrusion detection apparatus 156 provided by an embodiment of the present application can be a processor in the form of a hardware decoding processor, which is programmed to execute the intrusion detection method provided by an embodiment of the present application. For example, the processor in the form of a hardware decoding processor can use one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, or other electronic components.

[0071] The model training method provided by an embodiment of the present application will be described below in conjunction with an exemplary application and implementation of an electronic device provided by an embodiment of the present application.

[0072] In some embodiments, the model training method provided by the embodiments of the present application can be applied to a model training system, which can be used to train an intrusion detection model (e.g., a second model).

[0073] Referring to Figure 4 , Figure 4 is a structural schematic diagram of a model training system provided by the embodiments of the present application. The model training system 400 can include a central server 401 and client devices 402-406. The central server can include a global model layer and a local training layer, and the local training layer can include a local training group 1 (which can be referred to as training group 1) and a local training group 2 (which can be referred to as training group 2). The global model layer is deployed with a global model (e.g., a second model), the client devices 402-406 are each deployed with a local model (e.g., a first model), the local training group 1 and the local training group 2 are each deployed with a third model, and the first model, the second model, and the third model have the same structure and are used for intrusion detection. Their parameters can be the same or different, and the embodiments of the present application do not make specific limitations thereon. The architecture of the model training can be divided into three layers, namely, the global model layer, the local training layer, and the local model layer, and the global model layer and the local training layer are maintained by the central server 401.

[0074] Here, the central server 401 can be a high-performance computer server, which can be used to store and process a large amount of data. It is a centralized server that can centrally manage and control other devices (e.g., the client devices 402-406) in the network. The client devices 402-406 can be computing devices close to data sources or users, such as edge devices, i.e., physical or virtual devices located at the edge of the network, terminal devices, etc. They have the ability to process and store data, can perform real-time data processing, local decision-making, data filtering and preprocessing, etc., reduce data transmission volume, reduce latency, and improve privacy and security. Figure 4

[0075] ​In some embodiments, the central server 401 initializes a global model in the global model layer (such as a long short-term memory (LSTM) model, a convolutional neural network model, etc.), and each local training group (such as the local training group 1 and the local training group 2) respectively distributes the initialized parameters of the global model to the designated client devices, for example, the local training group 1 distributes the initialized parameters of the global model to the client device 402 to the client device 404, and the local training group 2 distributes the initialized parameters of the global model to the client device 405 and the client device 406. The client devices 402 to 406 respectively perform local model training through the local data of each client device, and send the obtained parameters to the central server after a preset number of training rounds. The local training group 1 and the local training group 2 in the central server aggregate the parameters according to the parameters sent by the corresponding client devices, and update the parameters of the third model in each local training group in turn; the global model layer aggregates the parameters of the third model in each local training group to obtain the parameters of the final global model. When the aggregation number of each local training group reaches a preset number, the training time difference of the client devices in different local training groups is evaluated in turn, and the client devices with larger difference from the current local training group will be moved to another local training group with smaller difference, and the above training process is repeated until the global model converges, and the trained global model is obtained. The central server 401 saves the trained global model and sends the trained global model to each local training group and each client device. Each client device can preprocess the obtained network traffic data and input it into the trained global model for intrusion detection analysis. In this way, compared with the traditional intrusion detection learning method, the model training system 400 shown in the figure uses a hierarchical federated learning to improve the efficiency and performance of model training, which can be applied to various tasks, and performs joint training and learning between various client devices on the premise of protecting data privacy. At the same time, the model training system 400 uses a distributed machine learning training architecture, which can effectively identify new network intrusion threats and reduce the false positive rate compared with the traditional intrusion detection method. Figure 4

[0076] In some embodiments, for the above local model (such as the first model) and the global model (such as the second model), the structures are the same, and the final parameters are also the same after training. The first model and the second model are constantly synchronized during training, and the model structures and parameters of the two are consistent after final training.

[0077] It should be noted that: Figure 4 The structure, the number of local training groups, and the number of client devices shown in the figure are only used for illustrative description, and the embodiments of the present application do not make specific limitations thereto.

[0078] ​The model training method provided by the embodiments of the present application will be described below in combination with the model training system.

[0079] Figure 5 is an implementation flow diagram of the model training method provided by the embodiments of the present application. As shown in Figure 5 the model training method of the embodiments of the present application can include steps S510 to S530.

[0080] In step S510, the first parameters obtained by each client device in at least one training group after training the first model by using the respective local data are acquired.

[0081] Here, the first model is used for intrusion detection on the local data. The first model can be an LSTM model, a convolutional neural network model, a logistic regression model, a decision tree model, a random forest model, etc., and can also be other models, which are not specifically limited by the embodiments of the present application. The local data can be relevant data that can be used for intrusion detection and is acquired by each client device from itself. Each training group (also referred to as a local training group) can include a third model, and the third model has the same structure as the first model, and the model parameters of the two can be the same or different, which is not specifically limited by the embodiments of the present application. Each training group can include at least one client device. In the initial stage of model training, the client devices included in each training group can be randomly divided, or can be divided according to the performance of the client devices, or can be divided according to other rules, which are not specifically limited by the embodiments of the present application.

[0082] It can be understood that each client device in at least one training group trains the first model by using the respective local data and a preset model training method, and after each training is completed, the first parameters corresponding to the first model can be obtained. The preset model training method can be a stochastic gradient descent, a gradient descent, an elastic network, a support vector machine, etc., which are not specifically limited by the embodiments of the present application.

[0083] In some embodiments, for step S510, the central server can automatically execute once every preset time length, or can automatically execute once after the training rounds of the first model reach a preset number of rounds, which are not specifically limited by the embodiments of the present application.

[0084] Here, the preset time length can be a preset time length, such as 5 minutes, 10 minutes, or other time length values, which are not specifically limited by the embodiments of the present application. The preset number of rounds can be a preset number of training rounds, such as 15 rounds, 20 rounds, or other values, which are not specifically limited by the embodiments of the present application.

[0085] In some embodiments, for step S510, each client device can upload the first parameter to the training group to which each client device belongs in the central server every preset time length.

[0086] In some embodiments, for step S510, each client device can upload the first parameter obtained in the last round of training to the training group to which each client device belongs in the central server after every preset number of rounds of training.

[0087] In some embodiments, for the first model in step S510, the initial parameters can be obtained by the central server initializing the parameters of the second model in the global model layer, and sent to the client devices included in each training group through the local training layer of the central server.

[0088] In an example, the parameter initialization of the second model can set the values corresponding to the parameters in the second model to 1, for example, initialize ω g = 1, ω g for a parameter in the second model.

[0089] Here, the second model and the first model have the same structure, and the initial parameters of the first model and the initial parameters of the second model can be the same in the model training stage.

[0090] In step S520, for at least one training group, the first parameters associated with each training group are aggregated to obtain the second parameters corresponding to each training group.

[0091] Here, the first parameters associated with each training group can be the first parameters obtained by training the first model through the local data of at least one client device included in each training group. The aggregation can adopt a federated averaging algorithm, or can adopt grouping aggregation, window aggregation, etc., and the embodiments of the present application do not make specific limitations.

[0092] It can be understood that for at least one training group, the local training layer in the central server can perform aggregation operation on the first parameters associated with each training group by adopting a corresponding aggregation algorithm or aggregation manner, thereby obtaining the second parameters corresponding to each training group.

[0093] In some embodiments, the aggregation operation can update the parameters of the third model included in each training group.

[0094] In step S530, according to the second parameters and the number of times each training group participates in the update of the second model within a preset time, the third parameters corresponding to the second model are updated until the second model converges, and the trained second model is obtained.

[0095] Here, the second model and the first model have the same structure. As the model is continuously trained, the updated parameters corresponding to the first model and the updated parameters corresponding to the second model can be the same or different, which is not limited in the embodiments of the present application. The preset time can be a preset time, such as 5 minutes, 10 minutes, or other time values, which is not limited in the embodiments of the present application. The central server updates the second model every preset time, and the number of times each training group participates in the update of the second model within the preset time can be: the number of times each training group participates in the update of the second model within the preset time.

[0096] Understandably, after obtaining the second parameters corresponding to each training group, the third parameters corresponding to the second model are updated through an asynchronous aggregation update manner according to the second parameters and the number of times each training group participates in the update of the second model within the preset time, and the updated third parameters can be obtained until the second model converges, and the trained second model is obtained.

[0097] In some embodiments, whether the second model converges can be determined by the loss value of the second model, which can be specifically: the input of the second model is predicted through the updated third parameters to obtain the output of the second model, and based on the output of the second model and the real value corresponding to the input of the second model, the loss value of the second model can be calculated through the corresponding loss function. In the case where the loss value is less than the preset threshold, it is indicated that the second model converges; in the case where the loss value is greater than or equal to the preset threshold, it is indicated that the second model does not converge, at which time the second model needs to be continuously trained, which can repeat the steps S510 to S530.

[0098] In the embodiments of the present application, through the steps S510 to S530, the joint training is performed without uploading the local data by each client device, which can guarantee the data security of the client device, and the computing power of each client device is used for local training, which can improve the convergence speed and accuracy of model training, reduce the pressure of the central server, and further improve the accuracy of network intrusion detection results. At the same time, compared with the traditional synchronous aggregation training mode of federated learning, the layered asynchronous aggregation mode of the present scheme saves a large amount of time overhead, which can make the overall training more efficient, effectively reduce the overall training time, that is, achieve the effect of higher model accuracy and shorter use time under the same model.

[0099] In some embodiments, after step S520, the model training method can further include: each client device corresponding to at least one training group receives the second parameters sent by at least one training group, so that each client device can train the respective first model based on the second parameters.

[0100] In some embodiments, the updating the third parameter corresponding to the second model according to the second parameter and the number of times that each training group participates in the updating of the second model within the preset time in step S530 can include: step a, summing the number of times that at least one training group participates in the updating of the second model within the preset time to obtain a total number of times; step b, sorting at least one training group according to the time consumption corresponding to each training group to obtain a serial number of each training group; and step c, updating the third parameter according to the serial number, the total number of times, the number of times, and the second parameter.

[0101] Here, the time consumption corresponding to each training group can be the average time consumption of all client devices in the training group, which can include the local training time of the client device and the communication time consumption of uploading and downloading the model, and the like, which is not limited in the embodiments of the present application.

[0102] In an example, the average time consumption of the client device can be the average time consumption of the last j iterations of the client device, where j is a positive integer greater than 1.

[0103] It can be understood that there is a difference in training communication consumption between different training groups, some training groups complete the training in a shorter time, and some training groups complete the training in a longer time. If the second model updates the third parameter in a synchronous aggregation manner, the training performance can be affected. Therefore, the updating of the second model can be in an asynchronous aggregation manner. Based on this, the number of times that at least one training group participates in the updating of the second model within the preset time is obtained, and then the sum of the number of times corresponding to all training groups is obtained, that is, the total number of times is obtained. Then, at least one training group is sorted according to the time consumption corresponding to each training group, for example, the training groups are sorted in ascending order of the time consumption corresponding to each training group, and the serial number of each training group is obtained. Finally, the third parameter is updated by the asynchronous aggregation manner according to the serial number of each training group, the total number of times, the number of times that at least one training group participates in the updating of the second model within the preset time, and the second parameter. In this way, the third parameter is updated by the above manner, which can improve the training efficiency and reduce the adverse effects of different network environments and communication performance on model training.

[0104] In some embodiments, step c can include: step cl, for the i th training group, determining a first weight corresponding to the i th training group according to the number of times that the N-i+1 th training group participates in the updating of the second model within the preset time and the total number of times; step c2, obtaining a fourth parameter by weighted summation operation according to the first weight and the second parameter corresponding to the training group corresponding to the first weight; and step c3, updating the third parameter to the fourth parameter.

[0105] wherein i and N are positive integers, N is the number of training groups, and i can be the serial number of the training group obtained by sorting the training groups in ascending order of the time consumption corresponding to each training group.

[0106] Here, updating the third parameter by means of asynchronous aggregation can be: the more times the training group participates in the update of the second model within the preset time, the faster the training speed of the training group, the smaller the time consumption corresponding to the training group, and accordingly, the earlier the serial number of the sorting. At this time, the proportion of the training group in the updating process can be set smaller to achieve the effect that each training group can participate in the update of the second model evenly.

[0107] Understandably, for the i-th training group, the first weight corresponding to the i-th training group can be obtained by dividing the number of times the N-i+1-th training group participates in the update of the second model within the preset time by the total number of times. Then, the fourth parameter can be obtained by weighted summation operation according to the first weight and the second parameter corresponding to the training group corresponding to the first weight, and finally the third parameter is updated to the fourth parameter, so that the updating of the third parameter is realized, and each training group can participate in the update of the second model evenly, which is conducive to improving the efficiency of model training and accelerating the convergence of the model.

[0108] In some embodiments, the calculation process of steps c1 to c3 described above can be represented by the following formula (1):

[0109]

[0110] wherein R (N-i+1) represents the number of times the N-i+1-th training group participates in the update of the second model within the preset time; R represents the total number of times; ω i represents the second parameter corresponding to the i-th training group; represents the first weight corresponding to the i-th training group; ω g represents the updated third parameter.

[0111] In some embodiments, the step S520 described above can include: step a1, determining the second weight corresponding to each client device according to the data amount corresponding to each client device in each training group and the total data amount corresponding to all client devices in each training group; and step a2, obtaining the second parameter by weighted summation operation according to the second weight and the first parameter corresponding to each client device.

[0112] Here, the data amount corresponding to each client device can be the number of data corresponding to each client device. The total data amount corresponding to all client devices in each training group can be the total number of data obtained by summing the data amount corresponding to each client device included in each training group.

[0113] It can be understood that the data amount corresponding to each client device in each training group is divided by the total data amount corresponding to all client devices in each training group, to obtain the second weight corresponding to each client device. Then, the first product corresponding to each client device is obtained by multiplying the second weight and the first parameter corresponding to the client device corresponding to the second weight, and finally the first products are added to obtain the second parameter. In this way, the second parameter is obtained by means of synchronous aggregation, only the first parameter needs to be uploaded, the communication overhead is low, and the model accuracy and generalization performance can be improved by training with the local data of each client device.

[0114] In some embodiments, the calculation process of steps a1 and a2 described above can be represented by the following formula (2):

[0115]

[0116] wherein m represents the number of client devices included in a certain training group; n k represents the data amount corresponding to the kth client device in the training group; n represents the total data amount corresponding to all client devices in the training group; represents the second weight corresponding to the kth client device in the training group; represents the first parameter corresponding to the kth client device in the training group; ω r+1 represents the second parameter corresponding to the training group.

[0117] In some embodiments, after step S520 described above, the model training method can further include: step b1, determining the time overhead corresponding to each client device according to the average time overhead corresponding to each client device in each training group and the number of client devices included in each training group, under the condition that a preset condition is met; step b2, determining whether each client device matches each training group in which the client device is located according to the time overhead and a preset evaluation threshold; and step b3, moving at least one client device to other training groups under the condition that at least one client device does not match the training group of the at least one client device.

[0118] Here, the preset condition can be that the number of rounds of training group aggregation reaches a preset threshold, which can be a preset value. Other training groups can be understood as training groups matched with at least one client device.

[0119] In an example, the preset condition can be r%h f = 0.

[0120] wherein r is a positive integer, representing the number of iterations of model aggregation of a certain training group; hf is a positive integer, which represents a preset round threshold and h f represents a remainder operation.

[0121] It can be understood that periodic evaluation is crucial for verifying the quality of model training, and the average time overhead can be used to evaluate the performance of the first model of each client device and the network environment, so as to jointly train the third model included in the training group to which the client device belongs. Therefore, under the condition of meeting the preset condition, each training group in the central server can determine the time overhead corresponding to each client device in each training group according to the average time overhead corresponding to each client device in each training group and the number of client devices included in each training group through mathematical operation or other means. Then, according to the size relationship between the time overhead and the preset evaluation threshold, it is determined whether each client device matches each training group to which the client device belongs. In the case that the time overhead corresponding to at least one client device is greater than the preset evaluation threshold, it indicates that at least one client device does not match the training group to which at least one client device belongs, at which time the client device needs to be regrouped, that is, the client device is moved to other training groups. In this way, since the time overhead corresponding to the client device can represent the training situation of the client device, evaluating each client device based on the time overhead corresponding to the client device and distributing the client device to the matched training group can adapt to the complex network environment of different client devices, distribute client devices with similar network environment and training performance to the same training group, improve the training efficiency of the model, and avoid errors caused by the differences between the client devices, thereby realizing adaptive grouping and improving the quality of model training.

[0122] In some embodiments, for the above step b1, the calculation process can be represented by the following formulas (3) to (4):

[0123]

[0124] wherein d k represents the time overhead corresponding to the kth client device; represents the average time overhead corresponding to all client devices included in a certain training group; C k represents the average time overhead corresponding to the kth client device; m represents the number of client devices included in the training group; F k represents the result of converting d k to a value in the interval [0, 1] using a sigmoid function.

[0125] In some embodiments, for the preset evaluation threshold in the above step b2, the calculation process can be represented by the following formula (5):

[0126] L = 0.5 - a x 0.01 (5)

[0127] Wherein, L represents a preset evaluation threshold; a represents a weight parameter for adjusting the preset evaluation threshold, and the value range of a can be [0, 1].

[0128] In some embodiments, after the above step b2, the model training method can further include: in the case that each client device is matched with the training group in which the client device is located, retaining each client device in the training group in which the client device is located.

[0129] In some embodiments, for other training groups in the above step b3, the mobile rule can be determined in advance, or other ways can be adopted to determine, and the embodiments of the present application do not limit this.

[0130] In some embodiments, after the above step b2, the model training method can further include: if at least one client device is not matched with all training groups, creating a new training group according to the model parameters of the training group in which the at least one client device is initially located, and moving the at least one client device to the newly created training group for model training of the at least one client device. In this way, it can be ensured that each client device has its own training group for joint training of various client devices.

[0131] In some embodiments, before the above step S510, the model training method further includes: collecting data of each client device through a data collection plug-in in each client device to obtain training data; and preprocessing the training data to obtain local data.

[0132] Here, the data collection plug-in can be an agent plug-in, or other plug-ins that can collect local data, and the embodiments of the present application do not make specific limitations. The data collection plug-in can be installed on a security product of the client device. The security product can be understood as a security software or hardware installed on the client device, such as a cloud security center, a terminal protection center, etc., for protecting the client device and the data processed by the client device from potential security threats. The training data can be network traffic data corresponding to the client device.

[0133] It can be understood that the training data can be obtained by collecting or generating data of each client device through the data collection plug-in in each client device. The training data here will not be uploaded to the central server, but saved in each client device. Then, the respective corresponding training data is preprocessed through the data collection plug-in in each client device, and the local data is obtained. In this way, the privacy of the user can be protected, and the data security can be maintained.

[0134] In some embodiments, for the above preprocessing, the training data can be processed into a dataset including the following attribute features: source internet protocol (IP) address, source IP port, destination IP address, destination IP port, transmission protocol (such as internet control message protocol (ICMP), coding polling protocol (CPP), user datagram protocol (UDP), etc.), time when the network flow is first detected, duration of the network flow, number of transmission bytes, number of transmitted packets, OR concatenation of all transmission control protocol (TCP) flags, class label (such as normal, attacker, victim, suspicious, or unknown, etc.), attack type (such as port scanning, distributed denial of service (DDOS), brute force, etc.), attack identity document (ID), etc.

[0135] In some embodiments, for the above preprocessing, the classification features can be converted into digital form using a label encoder; and the feature dataset can be normalized by using a MinMax Scaler, which can calculate the minimum and maximum values of the features and scale the data to the range of 0-1.

[0136] Figure 6 is another implementation flow diagram of the model training method provided by the embodiments of the present application. As shown in Figure 6 The embodiments of the present application mainly introduce the updating process of the third parameter, which can specifically include steps S610 to S650.

[0137] In step S610, the first parameter obtained by training the first model by each client device in at least one training group through respective local data is acquired.

[0138] In step S620, for at least one training group, the first parameter associated with each training group is aggregated to obtain the second parameter corresponding to each training group.

[0139] In step S630, the number of times that at least one training group participates in the updating of the second model within a preset time is summed to obtain a total number.

[0140] In step S640, according to the time overhead corresponding to each training group, the at least one training group is sorted to obtain a serial number of each training group.

[0141] In step S650, the third parameter is updated according to the serial number, the total number, the number, and the second parameter until the second model converges, and a trained second model is obtained.

[0142] The intrusion detection method provided in the embodiments of the present application will be described below in combination with exemplary applications and implementations of the electronic device provided by the embodiments of the present application.

[0143] Figure 7 is a schematic diagram of an implementation process of the intrusion detection method provided in the embodiments of the present application. As shown in Figure 7 The intrusion detection method provided in the embodiments of the present application can include steps S710 to S720.

[0144] In step S710, to-be-detected data is obtained.

[0145] Here, the to-be-detected data can come from at least one client device, which can be data associated with intrusion detection.

[0146] In step S720, the to-be-detected data is input into the trained second model to obtain an intrusion detection result corresponding to the to-be-detected data.

[0147] The second model is obtained by the following manner: obtaining the first parameter obtained by each client device in at least one training group through training of the first model by using respective local data, the first model being used for intrusion detection on the local data; aggregating the first parameter associated with each training group to obtain the second parameter corresponding to each training group; updating the third parameter corresponding to the second model according to the second parameter and the number of times that each training group participates in the update of the second model within a preset time, until the second model converges, wherein the second model and the first model have the same structure.

[0148] It can be understood that the to-be-detected data is input into the trained second model, the to-be-detected data is predicted by the trained second model, and the output of the second model is the intrusion detection result corresponding to the to-be-detected data.

[0149] In some embodiments, the intrusion detection result in step 720 can include the type of intrusion, such as an attacker, normal traffic, and unknown, and the embodiments of the present application do not limit this.

[0150] In the embodiments of the present application, through steps 710 and 720, the trained second model can be used for intrusion detection to determine whether there is an attack.

[0151] In some embodiments, in the process of obtaining the second model in step S720, the third parameter corresponding to the second model is updated according to the second parameter and the number of times that each training group participates in the update of the second model within a preset time, which can include: summing the number of times that at least one training group participates in the update of the second model within the preset time to obtain a total number; sorting at least one training group according to the time cost corresponding to each training group to obtain a serial number of each training group; and updating the third parameter according to the serial number, the total number, the number of times, and the second parameter. In this way, the training efficiency can be improved, and the adverse effects of different network environments and communication performance on model training can be reduced.

[0152] In some embodiments, after step S720, the intrusion detection method can further include: obtaining attack conditions in the intrusion detection results of different client devices; and constructing a data analysis platform based on the attack conditions to analyze the attack conditions.

[0153] It can be understood that after each client device stores the trained second model, the trained second model can be used to perform real-time intrusion detection and protection on the to-be-detected data of the client device, thereby obtaining intrusion detection results of different client devices. Then, the central server can obtain attack conditions in the intrusion detection results of different client devices, and construct a data analysis platform based on the attack conditions to analyze the attack conditions, so as to determine countermeasures for different attack conditions and better maintain the security of each client device.

[0154] In some embodiments, step S710 can include: collecting data of at least one client device by a data collection plug-in in the at least one client device to obtain network traffic data; and preprocessing the network traffic data to obtain to-be-detected data.

[0155] It can be understood that the data collection plug-in in at least one client device can collect data of the at least one client device to obtain network traffic data. Then, the network traffic data is preprocessed to obtain to-be-detected data. In this way, the subsequent intrusion detection process can be facilitated, and the detection efficiency can be improved.

[0156] In some embodiments, for the above intrusion detection process, a client device with poor computing performance can upload to-be-detected data of the client device to a central server for detection by the trained second model. In this way, the client device can perform intrusion detection without deploying the trained second model, thereby avoiding reducing the performance of the client device.

[0157] Based on the same inventive concept, embodiments of this application also provide a model training device, such as the model training device 155 in the above embodiments. Still as Figure 2 As shown, the model training device 155 includes: a first acquisition module 1551, used to acquire first parameters obtained by each client device in at least one training group after training the first model with its own local data, the first model being used for intrusion detection on the local data; a first determination module 1552, used to aggregate the first parameters associated with each training group for at least one training group to obtain second parameters corresponding to each training group; and a second determination module 1553, used to update the third parameters corresponding to the second model based on the second parameters and the number of times each training group participates in updating the second model within a preset time, until the second model converges to obtain the trained second model, wherein the second model has the same structure as the first model.

[0158] In some embodiments, the second determining module 1553 includes: a first determining unit, used to sum the number of times at least one training group participates in updating the second model within a preset time to obtain a total number; a second determining unit, used to sort at least one training group according to the time cost corresponding to each training group to obtain a sequence number for each training group; and an updating unit, used to update a third parameter according to the sequence number, the total number of times, the number of times, and the second parameter.

[0159] In some embodiments, the update unit is used to perform the following steps: for the i-th training group, determine the first weight corresponding to the i-th training group based on the number of times the N-i+1-th training group participates in the update of the second model within a preset time and the total number of times, where i and N are positive integers and N is the number of training groups; obtain the fourth parameter by weighted summation based on the first weight and the second parameter corresponding to the training group corresponding to the first weight; update the third parameter to the fourth parameter.

[0160] In some embodiments, the first determining module 1552 is configured to perform the following steps: determining a second weight for each client device based on the amount of data corresponding to each client device in each training group and the sum of the amounts of data corresponding to all client devices in each training group; and obtaining the second parameter by weighted summation based on the second weight and the first parameter corresponding to each client device.

[0161] In some embodiments, the model training apparatus further includes: a third determining module, configured to, after aggregating the first parameters associated with each training group for at least one training group to obtain the second parameters corresponding to each training group, determine the time cost corresponding to each client device based on the average time cost corresponding to each client device in each training group and the number of client devices included in each training group, provided that preset conditions are met; a fourth determining module, configured to determine whether each client device matches the training group to which it belongs based on the time cost and a preset evaluation threshold; and a moving module, configured to move at least one client device to another training group if at least one client device does not match the training group to which at least one client device belongs.

[0162] In some embodiments, the above-mentioned model training apparatus further includes: an acquisition module, used to acquire data from each client device through a data acquisition plug-in in each client device before acquiring the first parameters obtained by each client device in at least one training group after training the first model with its own local data, to obtain training data; and a preprocessing module, used to preprocess the training data to obtain local data.

[0163] The descriptions of the apparatus embodiments above are similar to those of the method embodiments above, and have similar beneficial effects. In some embodiments, the functions or modules included in the model training apparatus provided in this application can be used to execute the methods described in the model training method embodiments above. For technical details not disclosed in the model training apparatus embodiments of this application, please refer to the descriptions of the model training method embodiments of this application for understanding.

[0164] Based on the same inventive concept, embodiments of this application also provide an intrusion detection device, such as the intrusion detection device 156 in the above embodiments. Still as Figure 3 As shown, the intrusion detection device 156 includes: a second acquisition module 1561 for acquiring data to be detected; and a detection module 1562 for inputting the data to be detected into a trained second model to obtain an intrusion detection result corresponding to the data to be detected. The second model is obtained by: acquiring first parameters obtained by each client device in at least one training group after training the first model using its own local data; the first model is used to perform intrusion detection on the local data; for at least one training group, aggregating the first parameters associated with each training group to obtain second parameters corresponding to each training group; and updating the third parameters corresponding to the second model based on the second parameters and the number of times each training group participates in updating the second model within a preset time, until the second model converges. The second model has the same structure as the first model.

[0165] In some embodiments, the third parameter corresponding to the second model is updated according to the second parameter and the number of times that each training group participates in updating the second model within a preset time, including: summing the number of times that at least one training group participates in updating the second model within the preset time to obtain a total number; sorting the at least one training group according to the time cost corresponding to each training group to obtain a serial number of each training group; and updating the third parameter according to the serial number, the total number, the number of times, and the second parameter.

[0166] In some embodiments, the intrusion detection device further includes: a third acquisition module, configured to acquire attack conditions in the intrusion detection results of different client devices after inputting the to-be-detected network flow data into the trained second model to obtain the intrusion detection results corresponding to the to-be-detected network flow data; and a construction module, configured to construct a data analysis platform based on the attack conditions to analyze the attack conditions.

[0167] In some embodiments, the second acquisition module 1561 is configured to perform the following steps: collecting data of at least one client device through a data collection plug-in in the at least one client device to obtain network flow data; and preprocessing the network flow data to obtain to-be-detected data.

[0168] The above device embodiments are similar to the above method embodiments in description, and have similar beneficial effects to the method embodiments.

[0169] In some embodiments, the intrusion detection device provided by the embodiments of the present application has functions or includes modules that can be used to perform the methods described in the above intrusion detection method embodiments. For technical details not disclosed in the intrusion detection device embodiments of the present application, please refer to the description of the intrusion detection method embodiments of the present application for understanding.

[0170] It should be noted that, in the embodiments of the present application, if the above-mentioned model training method and intrusion detection method are implemented in the form of a software function module and sold or used as an independent product, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes a plurality of instructions for causing an electronic device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in the embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a ROM, a magnetic disk or an optical disk, and various media that can store program codes. Thus, the embodiments of the present application are not limited to any specific hardware, software or firmware, or any combination of hardware, software and firmware.

[0171] An electronic device is provided, including a memory and a processor, the memory stores a computer program which can run on the processor, and the processor implements part or all of the steps of the above method when executing the program.

[0172] A computer readable storage medium is provided, which stores a computer program, and the computer program is executed by a processor to implement part or all of the steps of the above method. The computer readable storage medium can be transitory or non-transitory.

[0173] A computer program is provided, including computer readable code, and when the computer readable code runs in an electronic device, a processor in the electronic device executes part or all of the steps of the above method.

[0174] A computer program product is provided, including a computer program or instructions, and when the computer program or instructions are executed by a processor, part or all of the steps of the above method are implemented. The computer program product can be implemented by hardware, software or a combination thereof. In some embodiments, the computer program product is specifically embodied as a computer storage medium, and in other embodiments, the computer program product is specifically embodied as a software product, such as a software development kit (SDK) and the like.

[0175] It should be noted that the above description of various embodiments tends to emphasize the differences between various embodiments, and the same or similar parts can be mutually referred to. The above description of the device, storage medium, computer program and computer program product embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the device, storage medium, computer program and computer program product embodiments of the present application, please refer to the description of the method embodiments of the present application.

[0176] It should be understood that the "one embodiment" or "an embodiment" mentioned throughout the specification means that the specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily mean the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of each step / process does not mean the execution order, and the execution order of each step / process should be determined by its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above sequence number of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments.

[0177] It should be noted that, in the present document, the terms "comprising", "containing", or any other similar term are intended to encompass non-exclusive inclusions, such that a process, method, article, or apparatus that comprises a list of elements does not necessarily include those elements only, but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element specified by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0178] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other manners. The above described device embodiments are merely schematic. For example, the division of the units is only a logical function division, and there can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed coupling, or direct coupling or communication connection between the components can be indirect coupling or communication connection through some interfaces, devices, or units, and can be electrical, mechanical, or in other forms.

[0179] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units; they can be located in one place, or distributed on a plurality of network units; and part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0180] In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in the form of hardware, or in the form of hardware plus software functional units.

[0181] Those of ordinary skill in the art can understand that all or part of the above-described method embodiments can be completed by program instructions related to hardware. The foregoing program can be stored in a computer readable storage medium, and when the program is executed, the steps of the above-described method embodiments are performed. The foregoing storage medium includes mobile storage devices, ROM, magnetic disks, optical disks, and various other media that can store program codes.

[0182] Alternatively, the above-mentioned integrated units of the present application, if realized in the form of software function modules and sold or used as independent products, can also be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application or the parts that make contributions to the related art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions to make an electronic device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the methods described in the various embodiments of the present application. The aforementioned storage medium includes mobile storage devices, ROM, magnetic discs or optical discs, and various media that can store program codes.

[0183] The above merely describes the embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application.

Claims

1. A model training method, characterized in that, The method comprises: obtaining first parameters obtained after each client device in at least one training group trains a first model on respective local data, the first model being used for intrusion detection on the local data; aggregating the first parameters associated with each training group to obtain second parameters corresponding to each training group; updating third parameters corresponding to a second model according to the second parameters and the number of times each training group participates in updating the second model within a preset time, until the second model converges, to obtain a trained second model, wherein the second model and the first model have the same structure; after the aggregation of the first parameters associated with each training group to obtain the second parameters corresponding to each training group, the method further comprises: determining the time consumption of each client device according to the average time consumption of each client device in each training group and the number of client devices included in each training group, under the condition that a preset condition is met; determining whether the each client device matches the training group in which the each client device is located according to the time consumption and a preset evaluation threshold; moving at least one client device to another training group under the condition that the at least one client device does not match the training group in which the at least one client device is located.

2. The method of claim 1, wherein, The updating of the third parameters corresponding to the second model according to the second parameters and the number of times each training group participates in updating the second model within a preset time comprises: summing the number of times the at least one training group participates in updating the second model within a preset time to obtain a total number of times; sorting the at least one training group according to the time consumption of each training group to obtain a serial number of each training group; updating the third parameters according to the serial number, the total number of times, the number of times, and the second parameters.

3. The method of claim 2, wherein, The updating of the third parameters according to the serial number, the total number of times, the number of times, and the second parameters comprises: for the i-th training group, determining a first weight corresponding to the i-th training group according to the number of times the N-i+1-th training group participates in updating the second model within a preset time and the total number of times, wherein i and N are positive integers, and N is the number of training groups; obtaining a fourth parameter through weighted summation operation according to the first weight and the second parameters corresponding to the training group corresponding to the first weight; updating the third parameters to the fourth parameters.

4. The method of claim 1, wherein, The aggregation of the first parameters associated with each training group to obtain the second parameters corresponding to each training group comprises: determining a second weight corresponding to each client device according to the data amount corresponding to each client device in each training group and the total sum of the data amounts corresponding to all client devices in each training group; obtaining the second parameters through weighted summation operation according to the second weight and the first parameters corresponding to each client device.

5. The method according to any one of claims 1 to 4, characterized in that, Before the first parameters obtained by training the first model by the local data of each client device in the at least one training group, the method further comprises: collecting data of each client device by a data collection plug-in in each client device to obtain training data; preprocessing the training data to obtain the local data.

6. An intrusion detection method characterized by, comprises: obtaining to-be-detected data; inputting the to-be-detected data into the trained second model to obtain an intrusion detection result corresponding to the to-be-detected data; The second model is obtained by the following method: obtaining the first parameters obtained by training the first model by the local data of each client device in the at least one training group, the first model being used for intrusion detection on the local data; for the at least one training group, the first parameters associated with each training group are aggregated to obtain the second parameters corresponding to each training group; under the condition that the preset condition is met, the time overhead corresponding to each client device is determined according to the average time overhead of each client device in each training group and the number of client devices included in each training group; according to the time overhead and the preset evaluation threshold, it is determined whether the each client device and the training group in which the each client device is located match; in the case that at least one client device and the training group of the at least one client device do not match, the at least one client device is moved to other training groups; according to the second parameters and the number of times that each training group participates in the update of the second model within a preset time, the third parameters corresponding to the second model are updated until the second model converges, wherein the structure of the second model and the first model is the same.

7. The method of claim 6, wherein, The third parameters corresponding to the second model are updated according to the second parameters and the number of times that each training group participates in the update of the second model within a preset time, comprising: summing the number of times that the at least one training group participates in the update of the second model within a preset time to obtain a total number of times; sorting the at least one training group according to the time overhead corresponding to each training group to obtain the serial number of each training group; updating the third parameters according to the serial number, the total number of times, the number of times and the second parameters.

8. The method of claim 6, wherein, After the to-be-detected data is input into the trained second model to obtain the intrusion detection result corresponding to the to-be-detected data, the method further comprises: obtaining attack conditions in the intrusion detection results of different client devices; based on the attack conditions, constructing a data analysis platform to analyze the attack conditions.

9. The method according to any one of claims 6 to 8, characterized in that, The to-be-detected data is obtained by the following method: collecting data of at least one client device by a data collection plug-in in the at least one client device to obtain network traffic data; preprocessing the network traffic data to obtain the to-be-detected data.

10. A model training apparatus, comprising: comprises: The first acquisition module is configured to acquire first parameters obtained by each client device in at least one training group after training a first model on respective local data, the first model being configured to perform intrusion detection on the local data. The first determination module is configured to aggregate the first parameters associated with each training group to obtain second parameters corresponding to each training group. The second determination module is configured to update third parameters corresponding to a second model according to the second parameters and the number of times each training group participates in updating the second model within a preset time, until the second model converges, to obtain a trained second model, wherein the second model and the first model have the same structure. The third determination module is configured to, after aggregating the first parameters associated with each training group to obtain second parameters corresponding to each training group, determine the time cost of each client device according to the average time cost of each client device in each training group and the number of client devices included in each training group, if a preset condition is met. The fourth determination module is configured to determine whether each client device matches the training group in which the client device is located according to the time cost and a preset evaluation threshold. The moving module is configured to move at least one client device to another training group if the at least one client device does not match the training group of the at least one client device.

11. An intrusion detection apparatus, characterized by comprising: The second acquisition module is configured to acquire to-be-detected data. The detection module is configured to input the to-be-detected data into the trained second model to obtain an intrusion detection result corresponding to the to-be-detected data. The second model is obtained by: acquiring first parameters obtained by each client device in at least one training group after training a first model on respective local data, the first model being configured to perform intrusion detection on the local data; aggregating the first parameters associated with each training group to obtain second parameters corresponding to each training group; determining the time cost of each client device according to the average time cost of each client device in each training group and the number of client devices included in each training group, if a preset condition is met; determining whether each client device matches the training group in which the client device is located according to the time cost and a preset evaluation threshold; moving at least one client device to another training group if the at least one client device does not match the training group of the at least one client device; and updating third parameters corresponding to a second model according to the second parameters and the number of times each training group participates in updating the second model within a preset time, until the second model converges, wherein the second model and the first model have the same structure. The processor implements the steps in the method of any one of claims 1 to 9 when executing the program.

12. An electronic device comprising a memory and a processor, the memory storing a computer program executable on the processor, characterized in that, ​ 13. A computer readable storage medium having stored thereon a computer program, characterized in that The computer program, which when executed by a processor, implements the steps of the method of any one of claims 1 to 9.

14. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions, which when executed by a processor, implement the steps of the method of any one of claims 1 to 9.

Images