Network intrusion detection method based on federated learning

Abstract

The invention discloses a federated learning-based network intrusion detection method, which comprises the following steps that: each participant collects flow data according to a local network condition, screens and preprocesses the data and generates a local network flow data set, the federated learning adopts an idea of parameter cyclic transmission, partial nodes are selected for training in sequence in each round, and the local network flow data set is obtained; and the training result is applied to the next round, training is stopped after the set number of training rounds is reached, the final training result is applied to the local intrusion network model by each node, and an intrusion detection task is executed. According to the invention, federated learning under the condition of local data isomerism of each participant can be realized, setting of a central server is canceled, and data privacy and network security are protected to a greater extent.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, and in particular to a network intrusion detection method based on federated learning. Background Art

[0002] With the rapid development of the Internet and communication technology, various networks have become very large. With the sharp increase in access devices, the network's attack surface has also become larger, and higher requirements have been placed on network security. In this context, network intrusion technology has become an important means of protecting network security. Currently, common intrusion detection systems are signature-based systems and machine learning and deep learning-based systems. However, signature-based systems are difficult to identify unknown attacks, and attackers can bypass them by changing attack methods and strategies.

[0003] Federated learning is a distributed machine learning model that allows participants to jointly model without sharing data. It can not only avoid the privacy risks brought about by centralized data storage on central servers, but also make better use of decentralized resources.

[0004] In some actual application environments, federated learning nodes may need to adjust data sets according to local conditions. In network intrusion detection tasks, attack patterns may change as the network runs, and each node may face different attack methods. Each node needs to build a data set based on the local network conditions, resulting in different data distributions in each data set. When facing heterogeneous data sets, using common federated learning aggregation algorithms such as FedAvg may result in low accuracy or even failure to converge the model.

[0005] In terms of security, federated learning can achieve joint learning without sharing data, which guarantees data security to a certain extent. However, the commonly used federated learning algorithm uses the central processing unit for federated aggregation, which still has the problem of single point failure. If the central processing unit is affected, it will still bring security risks to the network. For example, the Chinese patent with publication number CN116708009 A discloses a network intrusion detection method based on federated learning, including: establishing a federated learning intrusion detection framework of LSTM; the client processes the intrusion data set; the server (federated learning center platform) sends the federated learning global model to the client (a certain institution network); the client performs federated learning training based on local data, and sends the trained parameters and loss values ​​to the server; the server performs weighted average calculation based on the amount of data to generate a new global model. Repeat the operation until the model converges and the performance is stable. Then send the trained model to the client for real-time intrusion detection. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention provides a network intrusion detection method based on federated learning, which fully utilizes data from different nodes while protecting data privacy, builds a safe and efficient network intrusion detection model, and is used to solve the problems of poor training effect and insufficient security of federated learning when facing heterogeneous data.

[0007] In order to solve the above technical problems, the present invention provides a network intrusion detection method based on federated learning, comprising the following steps:

[0008] S1. Each node collects local network traffic to establish a local network traffic data set, classifies the collected traffic data set by attack type, and divides and preprocesses the training set and test set. K nodes are selected from all nodes as nodes participating in this round of training, and the selected nodes are sorted in a certain order;

[0009] S2. Each participant performs model training according to the local network traffic data set in sequence, and uses the final training parameters of the local node as the initial model parameters of the next node. The next node uses the initial model parameters to perform model training according to the local network traffic data set until the last node obtains the final model parameters of this round;

[0010] S3, select K nodes from the nodes that have not been selected in the previous round as nodes participating in the next round of training, the first node to be trained uses the final model parameters of the previous round as the initial model parameters, and the selected nodes are trained according to step S2;

[0011] S4, repeat steps S2 and S3, stop training after reaching the set number of training rounds, record the model parameters and test results of the last three rounds of training, send the last three rounds of training results to each node, and each node evaluates locally and selects appropriate model parameters as its local model parameters;

[0012] S5. Each node uses its local model parameters described in step S4 to perform the intrusion detection task.

[0013] Preferably, when performing intrusion detection tasks, each local node uses its local model parameters to deploy a local neural network model; collects traffic data from network traffic in real time, preprocesses and extracts features from the traffic data, and then inputs the data into the model to obtain a prediction result for the traffic classification; if the prediction result is normal traffic, it is allowed to pass; if it is abnormal traffic, corresponding measures are taken.

[0014] Preferably, the preprocessing of step S1 is as follows: each node preprocesses the data set, performs one-hot encoding on the non-numeric fields of the data set, converts string type data into a numeric type that is convenient for training, and standardizes and normalizes the feature values ​​of the data set.

[0015] Preferably, in step S1, in order to ensure the security of the training process, each node should reduce the sharing of local model parameters and data, so a random generation method is adopted in the node selection stage, and the selected nodes are randomly sorted.

[0016] Compared with the prior art, the present invention has the following advantages:

[0017] (1) By using the parameter loop transmission method, the setting of the central server is eliminated, the single point failure risk when using the central server is avoided, and the security of the federated learning model is improved.

[0018] (2) The convergence and accuracy of the model can still be guaranteed when the data of each node is heterogeneous. In the NSL-KDD dataset, the 20 nodes are divided into heterogeneous data sets, and 5 nodes are selected for training each time. The accuracy of the model after convergence is 63%, which is better than the accuracy of 57% when using FedAvg for centralized training. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flow chart of a network intrusion detection method based on federated learning of the present invention;

[0020] Figure 2 Pass an example graph for the node parameter. DETAILED DESCRIPTION

[0021] In order to make the purpose and advantages of the present invention more clear, the present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0022] like Figure 1 As shown, the present invention is a network intrusion detection method based on federated learning. Each participant collects flow data according to the local network situation, screens and preprocesses the data, and generates a local network traffic data set. Federated learning adopts the idea of ​​parameter cyclic transmission. In each round, some nodes are selected for training in turn, and the training results are applied to the next round, and the final training results are applied to the local intrusion network model.

[0023] The specific steps include:

[0024] Phase 1: Data processing and preparation

[0025] Taking 20 nodes as an example, each node negotiates to select a node as the control node. While completing its own training work, this node is responsible for controlling the training process such as the training order of each node, and recording training information such as training rounds. In addition to being one of the nodes in federated learning, this node is only responsible for controlling the training process. This is just an example. This control function can also be completed through other methods such as combining blockchain.

[0026] S1. Each node collects network traffic data according to the local network environment, filters and cleans the traffic data, removes redundant and invalid data, and labels the data. Record basic traffic information, such as source IP, destination IP, source port and destination port, and record traffic characteristics, such as duration, protocol type, transmission rate, packet length, traffic status, number of login attempts, etc. Automatically label through predefined rules or manually label to classify traffic, including normal traffic and different types of attack traffic, use traffic characteristics and classification to generate data sets, and divide training sets and data sets according to a certain ratio. Each node should generate a data set according to unified traffic feature extraction rules and data set format.

[0027] S2. Each node preprocesses the data set, performs one-hot encoding on some fields of the data set, such as protocol type, service type, label and other non-numeric fields, converts string type data into numeric types that are easy to train, and standardizes and normalizes the feature values ​​of the data set.

[0028] S3. During the continuous operation of the intrusion detection system, each node continuously collects data and updates or expands the data set according to steps S1 and S2, and appropriately adjusts the proportion of each type of traffic in the data set.

[0029] Phase 2: Federated Learning Training

[0030] S4. Each node uses a unified model for local training. The local model used can be selected by itself. Here, a fully connected neural network architecture with 2 hidden layers is used. The local node first initializes the model parameters and uses the local data set for model training. The training round stops after reaching the threshold, and the model performance is evaluated. The model performance evaluation mainly includes accuracy ACC, precision PRE, recall Recall and F1 Score. During the evaluation process, TP, TN, FP, and FN represent true positive, true negative, false positive, and false negative, respectively.

[0031] The calculation formula of accuracy ACC is:

[0032]

[0033] The calculation formula of precision PRE is:

[0034]

[0035] The calculation formula for recall is:

[0036]

[0037] The calculation formula of F1Score is:

[0038]

[0039] S5. Randomly select K nodes from each node. The value of K can be adjusted by itself. In this embodiment, it is set to 5. The selected nodes participate in federated learning in order. The first node first performs local training. The parameters after training are Wik, where i is the round of training and k is the Kth node. It is assumed that this is the i-th round of training. After the local training is completed, the model parameters Wik after local training are passed to the second node as the initial parameters of the second node. The second node uses the parameters to initialize the model parameters. After the training is completed, the obtained model parameters are passed to the next node until all nodes are trained. The model parameters Wi obtained by the last node training are used as the final model parameters of this round of training. Figure 2 Pass an example graph for the node parameter.

[0040] S6. Select K nodes again and use the final model parameters Wi obtained in the previous round of training as the initial parameters for this round of training. At this time, the training round is i+1. Each node uses the initial parameters to perform training according to the above step S5 to obtain the final model parameters Wi+1 of this round.

[0041] S7. After the training is completed, determine whether the global communication round is greater than the set global communication round threshold. If it is less, continue with steps S4, S5, and S6; if it is greater, the training is completed, and the control node records the final model parameter wk of the last three rounds as the global model parameter w of this training.

[0042] Phase 3: Applying training results

[0043] S8, the last node of each round of the last three rounds of training sends the final model parameters Wi of this round to all nodes. At this time, all nodes will obtain the model parameters obtained by the last three rounds of training. Each local node evaluates these three sets of model parameters and selects the optimal parameters as its final model parameters to eliminate the influence of training errors.

[0044] S9. Each local node uses the above steps to select the optimal parameters to deploy the local neural network model. Collect data from network traffic in real time, pre-process and extract features from the traffic data, and then input the model to obtain the prediction result of the traffic classification. If the prediction is normal traffic, it is allowed to pass. If it is abnormal traffic, take corresponding measures.

[0045] The experimental environment (experimental example) uses the NSL-KDD dataset and sets the total number of nodes to 20. Therefore, the NSL-KDD dataset is divided into 20 clients, and the test set is retained to calculate the test accuracy. The partitioning method is Dirichlet partitioning, and the parameter α is 0-1 to indicate the degree of heterogeneity of the client data. The parameter α is set to 0.1 to construct a non-independent and identically distributed data environment. The number of traffic prediction types is 5, namely normal traffic, DOS, R2L, U2R, and Probe. The local model of each node is unified into a neural network with two hidden layers and one fully connected layer.

[0046] In this scheme, the number of nodes K selected for each round is set to 5, and the total training round threshold is set to 1000. Here, each local node trains the local model for 5 rounds.

[0047] The reference environment (comparative proportion) uses a federated learning architecture using a central server. Each node uses the same data set partition to build a non-independent and identically distributed environment. The central server uses FedAvg as the federated aggregation algorithm. After the local node is trained, the parameters are uploaded to the central server for aggregation. The total training round threshold is set to 1000 rounds. All nodes participate in the training in each round. Here, each local node has 5 training rounds.

[0048] After testing, both schemes can reach convergence. The training results are evaluated. Accuracy, Precision, Recall and F1-score are calculated and compared. It can be found that the scheme of the present invention can reach convergence under non-independent and identically distributed data and is better than the central server federated learning scheme using FedAvg as the aggregation algorithm. The training results of the two schemes (comparative example and experimental example) are shown in Table 1.

[0049] Table 1

[0050] Accuracy Precision Recall F1-score Central 57％ 60％ 58％ 59％ Sequential 63％ 65％ 62％ 63.5％

[0051] The above embodiments are only specific examples for further describing the purpose, technical solutions and beneficial effects of the present invention, and the present invention is not limited thereto. Any modification, equivalent replacement, improvement, etc. made within the scope of the disclosure of the present invention are included in the protection scope of the present invention.

Claims

1. A network intrusion detection method based on federated learning, characterized in that: The following steps are involved: S1. Each node collects local network traffic to establish a local network traffic data set, classifies the collected traffic data set by attack type, and divides and preprocesses the training set and test set. K nodes are selected from all nodes as nodes participating in this round of training, and the selected nodes are sorted in a certain order; S2. Each participant performs model training according to the local network traffic data set in sequence, and uses the final training parameters of the local node as the initial model parameters of the next node. The next node uses the initial model parameters to perform model training according to the local network traffic data set until the last node obtains the final model parameters of this round; S3, select K nodes from the nodes that have not been selected in the previous round as nodes participating in the next round of training, the first node to be trained uses the final model parameters of the previous round as the initial model parameters, and the selected nodes are trained according to step S2; S4, repeat steps S2 and S3, stop training after reaching the set number of training rounds, record the model parameters and test results of the last three rounds of training, send the results of the last three rounds of training to each node, and each node will evaluate locally and select appropriate model parameters as its local model parameters; S5. Each node uses its local model parameters described in step S4 to perform the intrusion detection task.

2. According to claim 1, a network intrusion detection method based on federated learning is characterized in that: When performing intrusion detection tasks, each local node deploys a local neural network model using its local model parameters; Traffic data is collected from network traffic in real time, and after preprocessing and feature extraction, the traffic data is input into the model to obtain the prediction result of the traffic classification; if the prediction result is normal traffic, it is allowed to pass, and if it is abnormal traffic, corresponding measures are taken.

3. A network intrusion detection method based on federated learning according to claim 1 or 2, characterized in that: The preprocessing of step S1 is as follows: each node preprocesses the data set, performs one-hot encoding on the non-numeric fields of the data set, converts string type data into a numeric type that is convenient for training, and standardizes and normalizes the feature values ​​of the data set.

4. A network intrusion detection method based on federated learning according to claim 1 or 2, characterized in that: In step S1, a random generation method is adopted in the node selection stage, and the selected nodes are randomly sorted.

Images