A network intrusion detection method based on federated learning

Abstract

The application discloses a network intrusion detection method based on federal learning, which comprises the following steps: collecting flow direction data according to local network conditions by each participant, screening and preprocessing the data, and generating a local network traffic data set; the federal learning adopts the idea of parameter circulation transmission, a part of nodes are selected for training in turn in each round, and the training results are applied to the next round; the training is stopped after a set number of training rounds; and finally, the nodes apply the final training results to the local intrusion network model to perform the intrusion detection task. The application can realize federal learning under the heterogeneous condition of local data of each participant, cancels the setting of a central server, and protects data privacy and network security to the greatest extent.

Description

Technical Field

[0001] This invention relates to the field of network intrusion detection technology, and specifically to a network intrusion detection method based on federated learning. Background Technology

[0002] With the rapid development of internet and communication technologies, various networks have become extremely large. The dramatic increase in connected devices has also expanded the attack surface of networks, placing higher demands on network security. Against this backdrop, network intrusion technology has become a crucial means of protecting network security. Currently, common intrusion detection systems include signature-based systems and systems based on machine learning and deep learning. However, signature-based systems struggle to identify unknown attacks, and attackers can bypass them by changing their attack methods and strategies.

[0003] Federated learning is a distributed machine learning model that allows participants to jointly build models without sharing data. This avoids the privacy risks associated with centralized data storage on a central server and makes better use of distributed resources.

[0004] In some practical applications, federated learning nodes may need to adjust the dataset based on local conditions. In network intrusion detection tasks, attack patterns may change as the network operates, and different nodes may face different attack methods. Each node needs to build its dataset based on its local network conditions, resulting in different data distributions across datasets. When faced with heterogeneous datasets, using common federated learning aggregation algorithms such as FedAvg may lead to low accuracy or even model convergence issues.

[0005] Furthermore, in terms of security, federated learning enables joint learning without sharing data, thus ensuring data security to a certain extent. However, commonly used federated learning algorithms use a central processing unit (CPU) for federated aggregation, which still presents a single point of failure. If the CPU is affected, it can still pose a security risk to the network. For example, Chinese patent CN116708009 A discloses a network intrusion detection method based on federated learning, including: establishing an LSTM-based federated learning intrusion detection framework; processing the intrusion dataset by the client; the server (federated learning center platform) sending the global federated learning model to the client (an institutional network); the client training the federated learning model based on local data and sending the trained parameters and loss values ​​to the server; the server performing a weighted average calculation based on the data volume to generate a new global model. This process is repeated until the model converges and its performance stabilizes. The trained model is then sent to the client for real-time intrusion detection. Summary of the Invention

[0006] This invention addresses the shortcomings of existing technologies by providing a network intrusion detection method based on federated learning. While protecting data privacy, it makes full use of data from different nodes to build a secure and efficient network intrusion detection model, thus solving the problems of poor training effect and insufficient security of federated learning when faced with heterogeneous data.

[0007] To address the aforementioned technical problems, this invention provides a network intrusion detection method based on federated learning, comprising the following steps:

[0008] S1. Each node collects local network traffic to establish a local network traffic dataset. The collected traffic dataset is classified according to the attack type, and the training set and test set are divided and preprocessed. K nodes are selected from all nodes as nodes to participate in this round of training, and the selected nodes are sorted in a certain order.

[0009] S2. Each participant trains the model in sequence based on the local network traffic dataset, and uses the final training parameters of the local node as the initial model parameters of the next node. The next node uses the initial model parameters to train the model based on the local network traffic dataset until the last node obtains the final model parameters for this round.

[0010] S3. Select K nodes from the nodes that were not selected in the previous round as nodes to participate in the next round of training. The first node to be trained uses the final model parameters of the previous round as the initial model parameters. The selected nodes are trained according to step S2.

[0011] S4. Repeat steps S2 and S3 until the set number of training rounds is reached, then stop training. Record the model parameters and test results of the last 3 training rounds, and send the training results of the last 3 rounds to each node. Each node will evaluate the results locally and select appropriate model parameters as its local model parameters.

[0012] S5. Each node uses its local model parameters described in step S4 to perform intrusion detection tasks.

[0013] Preferably, when performing intrusion detection tasks, each local node deploys a local neural network model using its local model parameters; traffic data is collected in real time from network traffic, and after preprocessing and feature extraction of the traffic data, it is input into the model to obtain the prediction result of the traffic classification; if the prediction result is normal traffic, it is allowed to pass, and if it is abnormal traffic, corresponding measures are taken.

[0014] Preferably, the preprocessing in step S1 is as follows: each node preprocesses the dataset, performs one-hot encoding on the non-numerical fields of the dataset, converts string data into numeric data that is easy to train, and standardizes and normalizes the feature values ​​of the dataset.

[0015] Preferably, in step S1, to ensure the safety of the training process, each node should reduce the sharing of local model parameters and data. Therefore, a random generation method is adopted in the node selection stage, and the selected nodes are randomly sorted.

[0016] Compared with the prior art, the present invention has the following advantages:

[0017] (1) By using the parameter looping method, the setting of the central server is eliminated, which avoids the risk of single point of failure when using the central server and improves the security of the federated learning model.

[0018] (2) The model can still achieve convergence and accuracy even when the data of each node is heterogeneous. In the NSL-KDD dataset, the 20 nodes are divided into heterogeneous datasets, and 5 nodes are selected for training each time. After the model converges, the accuracy is 63%, which is better than the accuracy of 57% when FedAvg is used for centralized training. Attached Figure Description

[0019] Figure 1 This is a flowchart of a network intrusion detection method based on federated learning according to the present invention;

[0020] Figure 2 Example diagram for passing node parameters. Detailed Implementation

[0021] To make the objectives and advantages of the present invention clearer, the present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] like Figure 1 As shown, this invention is a network intrusion detection method based on federated learning. Each participant collects flow data according to the local network conditions, filters and preprocesses the data to generate a local network traffic dataset. Federated learning adopts the idea of ​​parameter cyclical transmission. In each round, some nodes are selected for training in sequence, and the training results are applied to the next round. The final training results are applied to the local intrusion network model.

[0023] Specifically, the following steps are included:

[0024] Phase 1: Data Processing and Preparation

[0025] Taking 20 nodes as an example, each node negotiates and selects one node as the control node. This node, while completing its own training, is responsible for controlling the training process, such as the training order of each node, and recording training information such as the training rounds. This node, besides being one of the nodes in the federated learning, is only responsible for controlling the training process; this is just an example. This control function can also be accomplished in other ways, such as by combining it with blockchain.

[0026] S1. Each node collects network traffic data based on its local network environment, filters and cleans the traffic data to remove redundant and invalid data, and labels the data. Basic traffic information is recorded, such as source IP, destination IP, source port, and destination port, along with traffic characteristics such as duration, protocol type, transmission rate, packet length, traffic status, and number of login attempts. Traffic is classified into normal traffic and different types of attack traffic through automatic labeling using predefined rules or manual labeling. A dataset is generated using the traffic characteristics and classification, and the training set and dataset are divided according to a certain ratio. Each node should generate the dataset according to a unified traffic feature extraction rule and dataset format.

[0027] S2. Each node preprocesses the dataset, performs one-hot encoding on some non-numerical fields such as protocol type, service type, and label, converts string data into numeric types that are easy to train, and standardizes and normalizes the feature values ​​of the dataset.

[0028] S3. During the continuous operation of the intrusion detection system, each node continuously collects data and updates or expands the dataset according to steps S1 and S2, and appropriately adjusts the proportion of each type of traffic in the dataset.

[0029] Phase Two: Federated Learning Training

[0030] S4. Each node uses a unified model for local training. The local model can be chosen independently; here, a fully connected neural network architecture with two hidden layers is used. The local node first initializes the model parameters, trains the model using the local dataset, and stops training after reaching a threshold number of epochs, then evaluates the model performance. Model performance evaluation mainly includes accuracy (ACC), precision (PRE), recall, and F1 score. During the evaluation, TP, TN, FP, and FN represent true positives, true negatives, false positives, and false negatives, respectively.

[0031] The formula for calculating accuracy (ACC) is:

[0032]

[0033] The formula for calculating Precision Rate (PRE) is:

[0034]

[0035] The formula for calculating recall rate is:

[0036]

[0037] The formula for calculating F1Score is:

[0038]

[0039] S5. Randomly select K nodes from all nodes. The value of K can be adjusted as needed; in this embodiment, it is set to 5. The selected nodes participate in federated learning sequentially. The first node performs local training first, and the parameters after training are denoted as Wik, where i is the training round and k is the Kth node. Assuming this is the i-th round of training, the locally trained model parameters Wik are passed to the second node as its initial parameters. The second node uses these parameters to initialize its model parameters. After training, the obtained model parameters are passed to the next node until all nodes have been trained. The model parameters Wi obtained by the last node are used as the final model parameters for this round of training. Figure 2 Example diagram for passing node parameters.

[0040] S6. Select K nodes again and use the final model parameters Wi obtained from the previous training round as the initial parameters for this training round. At this time, the training round is i+1. Each node uses the initial parameters and trains according to step S5 above to obtain the final model parameters Wi+1 for this round.

[0041] S7. After training ends, determine whether the number of global communication rounds is greater than the set global communication rounds threshold. If it is less than the threshold, continue with steps S4, S5, and S6. If it is greater than the threshold, training ends, and the control node records the final model parameters wk of the last three rounds as the global model parameters w for this training.

[0042] Phase 3: Applying Training Results

[0043] S8. During the last three training rounds, the last node in each round sends the final model parameters Wi to all nodes. At this point, all nodes will receive the model parameters obtained from the last three training rounds. Each local node evaluates these three sets of model parameters and selects the optimal parameters as its final model parameters to eliminate the influence of training errors.

[0044] S9. Each local node uses the above steps to select the optimal parameters and deploy the local neural network model. Data is collected in real time from network traffic, preprocessed, and feature-extracted before being input into the model to obtain the prediction result for the traffic classification. If the prediction is normal traffic, it is allowed to pass; if it is abnormal traffic, corresponding measures are taken.

[0045] The experimental environment (example) uses the NSL-KDD dataset, with a total of 20 nodes. Therefore, the NSL-KDD dataset is divided into 20 clients, and a test set is retained for calculating test accuracy. The partitioning method is Dirichlet partitioning, with parameter α ranging from 0 to 1 to represent the heterogeneity of client data. α is set to 0.1 to construct a non-independent, identically distributed data environment. The number of traffic prediction types is 5: normal traffic, DOS, R2L, U2R, and Probe. The local model for each node is a unified neural network with two hidden layers and one fully connected layer.

[0046] In this scheme, the number of nodes K selected in each round is set to 5, and the total training round threshold is set to 1000. Here, each local node trains the local model for 5 rounds.

[0047] The reference environment (comparative example) uses a federated learning architecture with a central server. Each node uses the same dataset to construct a non-independent and identically distributed environment. The central server uses FedAvg as the federated aggregation algorithm. After the local nodes have completed training, the parameters are uploaded to the central server for aggregation. The total training round threshold is set to 1000 rounds. In each round, all nodes participate in the training. Here, each local node has 5 training rounds.

[0048] Both schemes achieved convergence after testing. The training results were evaluated by calculating Accuracy, Precision, Recall, and F1-score. The results show that the scheme of this invention achieves convergence on non-independent and identically distributed data and outperforms the central server federated learning scheme using FedAvg as the aggregation algorithm. The training results of the two schemes (comparative example and experimental example) are shown in Table 1.

[0049] Table 1

[0050] Accuracy Precision Recall F1 score Central 57％ 60％ 58％ 59％ Sequential 63％ 65％ 62％ 63.5％

[0051] The above embodiments are merely specific examples to further illustrate the purpose, technical solution, and beneficial effects of the present invention, and the present invention is not limited thereto. Any modifications, equivalent substitutions, improvements, etc., made within the scope of the disclosure of the present invention are included within the protection scope of the present invention.

Claims

1. A network intrusion detection method based on federated learning, characterized in that, Includes the following steps: S1. Each node collects local network traffic to build a local network traffic dataset. The collected traffic dataset is classified according to attack type, and training and test sets are divided and preprocessed. K nodes are selected from all nodes as nodes to participate in this round of training, and the selected nodes are sorted in a certain order. Random generation is used in the node selection stage, and the selected nodes are randomly sorted. S2. Each participant trains the model in sequence based on the local network traffic dataset, and uses the final training parameters of the local node as the initial model parameters of the next node. The next node uses the initial model parameters to train the model based on the local network traffic dataset until the last node obtains the final model parameters for this round. S3. Select K nodes from the nodes that were not selected in the previous round as nodes to participate in the next round of training. The first node to be trained uses the final model parameters of the previous round as the initial model parameters. The selected nodes are trained according to step S2. S4. Repeat steps S2 and S3 until the set number of training rounds is reached, then stop training. Record the model parameters and test results of the last 3 training rounds, and send the results of the last 3 training rounds to each node. Each node will evaluate the results locally and select appropriate model parameters as its local model parameters. S5. Each node uses its local model parameters described in step S4 to perform intrusion detection tasks.

2. The network intrusion detection method based on federated learning according to claim 1, characterized in that: When performing intrusion detection tasks, each local node uses its local model parameters to deploy a local neural network model; Traffic data is collected in real time from network traffic. After preprocessing and feature extraction, the traffic data is input into the model to obtain the prediction result of the traffic classification. If the prediction result is normal traffic, it is allowed to pass; if it is abnormal traffic, corresponding measures are taken.

3. A network intrusion detection method based on federated learning according to claim 1 or 2, characterized in that: The preprocessing in step S1 is as follows: each node preprocesses the dataset, performs one-hot encoding on the non-numerical fields of the dataset, converts string data into numeric data that is easy to train, and standardizes and normalizes the feature values ​​of the dataset.

Images