A method for identifying IoT devices based on HFL

Abstract

The present invention relates to the field of IoT device identification technology, solving the technical problems of privacy leakage, high communication costs, and poor model versatility in traditional centralized identification methods. In particular, it relates to an IoT device identification method based on HFL. Relying on a horizontal federated learning training mechanism, it allows multiple edge devices to train models locally and effectively protects data privacy and reduces communication costs by only uploading model parameters. At the edge device level, features are extracted from the device behavior traffic packet header, and an improved lightweight AlexNet network is used to autonomously learn complex feature representations at different levels to achieve efficient device classification. At the same time, a weighted cross-entropy loss function and the SGD optimization technique with the introduction of a momentum parameter are used to address the statistical heterogeneity problem that is prevalent in distributed learning scenarios.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things device identification, and in particular to an Internet of Things device identification method based on HFL. Background Art

[0002] With the rapid development of technology, the number of IoT devices has exploded. The IoT has penetrated numerous key sectors, including smart homes and cities, retail, healthcare, transportation, agriculture, the military, and manufacturing, becoming an integral part of modern society. However, this rapid increase in the number of IoT devices also presents numerous challenges. In network environments, IoT devices face security threats such as fraud, account theft, and malicious attacks. Accurate device identification is crucial for ensuring network security and improving service quality.

[0003] Traditional IoT device identification methods typically rely on passively monitoring network traffic and extracting features. Machine learning models are then built through centralized training to identify devices. However, this centralized training approach has two significant drawbacks. First, privacy concerns arise. Centralized device identification methods require data to be transmitted to a central location for training, which can lead to privacy leaks and serious privacy risks. Second, communication costs are high. Centralized training requires transferring large amounts of data from various data sources to a central location. This can be slow when network bandwidth is limited, and data loss, corruption, or interruptions can occur during data transmission due to the complexity of the network environment. Ensuring data privacy and addressing communication costs are crucial and indispensable for achieving accurate device identification. Furthermore, this machine learning-based device identification approach is limited by its reliance on feature extraction, where researchers extract features from raw traffic data that are helpful for device identification based on their own prior knowledge. This approach generally lacks versatility and is difficult to adapt to diverse network environments. While the IoTDevID method achieves a universal feature subset through a rigorous feature selection process, this process also incurs significant additional labor costs and computational overhead.

[0004] Therefore, the problems of existing device identification methods can be summarized as follows:

[0005] 1) Lack of protection of data privacy;

[0006] 2) The communication cost of the device identification method using centralized training is too high;

[0007] 3) Manual feature selection lacks universality and is difficult to apply to different network environments, and results in additional labor costs and increased computational overhead. Summary of the Invention

[0008] In response to the shortcomings of the existing technology, the present invention provides an IoT device identification method based on HFL, which solves the technical problems of traditional centralized identification methods such as privacy leakage, high communication costs, and poor model versatility.

[0009] To solve the above technical problems, the present invention provides the following technical solution: a method for identifying IoT devices based on HFL, which includes the following steps:

[0010] Obtain device behavior traffic data generated by IoT devices during operation, and generate grayscale image datasets for local training by all participants through data preprocessing;

[0011] Build local models and deploy them to all participants in the horizontal federated learning system;

[0012] Each participant trains the local model based on the locally generated grayscale image dataset and the received initial model parameters, and uploads the new local model parameters to the federated learning server after training is completed;

[0013] The federated learning server aggregates the local model parameters uploaded by each participant to obtain the global model parameters;

[0014] Calculate the average loss of local training samples in the current global round and determine whether the federated learning server outputs the final model parameter ω GE ;

[0015] When the average loss of the global model tends to be stable, the global model stops global round iterative training, and the federated learning server outputs the final model parameter ω GE ;

[0016] Otherwise, the global model parameters are broadcast again to each participant to update the local model parameters, and serve as the initial model parameters for local training and federated learning iterations in the next local round.

[0017] Furthermore, the process of pre-processing the device behavior flow data includes:

[0018] Based on a single raw data packet containing device behavior traffic data, the Scapy tool is used to extract detailed data information including each network protocol layer, payload entropy, and protocol features from the packet header of the raw data packet, and then converted into a CSV file to obtain one-dimensional sample data;

[0019] Perform data cleaning on the one-dimensional sample data and remove feature columns whose values ​​are the same in all samples of all categories;

[0020] The one-dimensional sample data is normalized to 0-255 according to the feature column and converted into a two-dimensional grayscale image to obtain a grayscale image dataset as the input of the two-dimensional convolutional neural network.

[0021] Furthermore, the construction process of the local model includes:

[0022] Building a local training model architecture based on the AlexNet network, which consists of an input layer, four convolutional layers, three pooling layers, and three fully connected layers;

[0023] Initialize the weights and biases of the convolutional layer and the fully connected layer in the local training model architecture to obtain the initial model parameters. The initialization formula is:

[0024]

[0025] In the formula, the weight W has a mean of 0 and a variance of Normal distribution; n in is the number of input neurons;

[0026] Establish a weighted loss function L for the local training model architecture in local rounds of iterative training ω , the expression is:

[0027]

[0028] Where B is the batch size; C is the number of categories; y ij is the true label of category j corresponding to sample i; p ij is the predicted label of category j corresponding to sample i; ω j is the weight value of category j;

[0029] The local training model architecture is optimized based on the stochastic gradient descent update method with the introduction of momentum parameter α to obtain a local model applied to each participant.

[0030] Furthermore, the expression of the stochastic gradient descent update method introducing the momentum parameter α is:

[0031]

[0032] Where η is the learning rate; is the loss function with respect to the parameter θ t-1 The gradient at the current position; v t is the update direction and step size.

[0033] Furthermore, the parameter aggregation formula is:

[0034]

[0035] Where K is the number of clients participating in local updates in this round; is the local model parameter of the i-th client; ω t is the global model parameter after parameter aggregation.

[0036] Furthermore, the global model parameters are broadcasted again to each participant to update the local model parameters, which serve as the initial model parameters for the local training and federated learning iterations in the next local round. The specific process includes:

[0037] Randomly and uniformly sample K clients from N clients to form the participant set S e , and each participant P i ∈S e Receive the initial model parameters ω sent by the federated learning server e ;

[0038] Each participant is based on the grayscale image dataset and the initial model parameters ω e Perform local training for rounds c = 0, 1, 2, ..., LE-1, where LE is the number of local training rounds.

[0039] Traverse the local grayscale image dataset D i For each batch B, the average loss of local training samples in the current local round is calculated.

[0040] According to the average loss Update the local model to get new local model parameters, the expression is:

[0041]

[0042] Where α is the learning rate, which is used to control the gradient descent step size; is the gradient of the loss function with respect to the parameters;

[0043] Calculate the update amount of the local model The federated learning server receives and aggregates updates from all participants Get the new global model parameters and determine whether they are the final model parameters ω after GE round global training GE .

[0044] Furthermore, the loss average The calculation formula is:

[0045]

[0046] Where B = {x, y} is the batch of the local grayscale image dataset, including input x and label y; is the initial model parameter of participant i; |D i| is the total number of samples in the grayscale image dataset; Loss() is the weighted cross entropy loss function; is the predicted value for the input x.

[0047] Furthermore, the update amount The calculation formula is:

[0048]

[0049] Where, ω e-1 are the global model parameters after the last global round of training; Client P in the current global round i Local model parameters after local training.

[0050] By means of the above technical solution, the present invention provides an IoT device identification method based on HFL, which has at least the following beneficial effects:

[0051] 1. This invention introduces a horizontal federated learning mechanism and an improved convolutional neural network to build a multi-party collaborative training platform, ensuring data privacy. It also automatically selects data packet features, eliminating the tedious process of manual feature selection, fully exploring hidden patterns in the data, and improving the accuracy of IoT device recognition.

[0052] 2. This invention can provide a privacy and cost-effective solution for the deployment of large-scale IoT device identification systems. At the same time, its effectiveness and generalization capabilities under different data distributions provide a strong basis for its application in actual IoT device identification scenarios, fully demonstrating the effectiveness and generalization capabilities of the model.

[0053] 3. This invention leverages a horizontal federated learning training mechanism, allowing multiple edge devices to train models locally. By only uploading model parameters, it effectively protects data privacy and reduces communication costs. It utilizes an improved lightweight AlexNet network to autonomously learn complex feature representations at different levels, enabling efficient device classification. It also utilizes a weighted loss function and SGD optimization techniques with a momentum parameter to address the statistical heterogeneity common in distributed learning scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0055] Figure 1 This is a framework diagram of the IoT device identification model based on ConFedDI in the present invention;

[0056] Figure 2is a network structure diagram of the local model in the present invention;

[0057] Figure 3 A comparison chart of the model performance on the CIC dataset in the present invention;

[0058] Figure 4 This is a comparison chart of the model performance on the UNSW dataset in this invention. DETAILED DESCRIPTION

[0059] To make the above-mentioned objectives, features, and advantages of the present invention more clearly understood, the present invention is further described below in detail with reference to the accompanying drawings and specific embodiments. This will enable a full understanding of how this application uses technical means to solve technical problems and achieve technical effects, and to implement the invention accordingly.

[0060] In the field of IoT device identification, research methods have evolved from traditional machine learning to neural networks and then to federated learning. Early methods relied on manual feature selection and centralized training, which led to insufficient data privacy protection and high communication costs. With the development of neural networks, device identification has moved away from reliance on manual feature selection, but privacy issues remain prominent. The recent emergence of federated learning has provided new insights into addressing data privacy issues, but its application in IoT device identification still faces challenges. For example, traditional machine learning methods for IoT device identification suffer from reliance on feature selection and insufficient privacy protection. While neural network methods have improved recognition performance, they have not effectively addressed privacy concerns. Federated learning methods, while showing potential in privacy protection, still need to improve model performance and communication efficiency.

[0061] With the explosive growth of IoT devices, device identification has become a key requirement for ensuring network security and service quality. However, traditional centralized identification methods have problems such as privacy leakage, high communication costs, and poor model versatility. For the above problems, please refer to Figures 1-4, this embodiment proposes an IoT device identification method ConFedDI based on horizontal federated learning and convolutional neural networks. This method relies on the horizontal federated learning training mechanism, allowing multiple edge devices to train models locally, and effectively protects data privacy and reduces communication costs by only uploading model parameters. At the edge device level, features are extracted from the device behavior traffic packet header, and the improved lightweight AlexNet network is used to autonomously learn complex feature representations at different levels to achieve efficient device classification. The weighted cross entropy loss function and the SGD optimization technology with the introduction of momentum parameters are used to deal with the statistical heterogeneity problem that is prevalent in distributed learning scenarios. In terms of experiments, a large number of experiments were conducted on two public datasets. The ablation experiment showed that ConFedDI performs better than the M3CNN model and has lower communication costs. The comparative experiment shows that ConFedDI performs better than the HFedDI and IoTDevID methods, and the F1 scores of the ConFedDI method on the two datasets reached 99.44% and 99.75% respectively. As Figure 1 As shown, the method includes the following processes:

[0062] S1. Obtain device behavior traffic data generated during the operation of IoT devices, and generate a grayscale image dataset for local training by each participant through data preprocessing. The process of preprocessing device behavior traffic data includes:

[0063] Based on a single original data packet containing device behavior traffic data, the Scapy tool is used to extract detailed data information including each network protocol layer, payload entropy, and protocol characteristics from the packet header of the original data packet, and then converted into a CSV file to obtain one-dimensional sample data.

[0064] Most of the existing technical research is based on multiple data packets to build device fingerprints. Specifically, according to specific identifiers such as IP and MAC addresses, the data packets of a device from different scenarios are merged to build a device fingerprint. This method has certain advantages. It can improve the overall device recognition performance of the model by capturing the characteristics of the device under different network behaviors. At the same time, this method has certain limitations. It is not suitable for devices that do not use IP protocols or use low-energy protocols (such as ZigBee, Bluetooth low energy and other related devices). These devices themselves lack independent IP addresses, MAC addresses and other extractable identification features like traditional network devices. Instead, they share some underlying identifiers with other related connected devices. Therefore, it is difficult to construct an effective device fingerprint by combining multiple data packets based on specific identifiers such as IP and MAC.

[0065] However, this problem can be avoided by constructing fingerprints using a single data packet, thereby identifying these special devices. Therefore, in order to improve the scope of use of the model, this embodiment adopts a method for constructing fingerprints based on a single data packet. Features are extracted from the packet header of the original data packet (pcap format file) using the scapy tool and then converted into a csv file. The extracted features include detailed data information of each network protocol layer (including Ethernet layer (Ether), ARP layer, LLC layer, EAPOL layer, IP layer, ICMP layer, etc.), and payload entropy and protocol features are also added in addition. Payload entropy refers to a measure of the uncertainty or randomness of the information contained in the payload part (user data or application layer information actually carried in the data packet) in the network data packet. Protocol features map the used protocol to integer values. These two features have been proven to be useful in the experimental process of the prior art.

[0066] Data cleaning is performed on the one-dimensional sample data to remove feature columns whose values ​​are identical across all samples in all categories. This is called outlier processing, thereby removing feature columns that interfere with normalization. In this embodiment, data cleaning is performed to remove feature columns whose values ​​are identical across all samples in all categories. The reason for this is that such features do not provide effective information for distinguishing different samples, and their presence interferes with subsequent processing steps such as normalization.

[0067] The one-dimensional sample data is normalized to 0-255 according to the feature column and converted into a two-dimensional grayscale image to obtain a grayscale image dataset as the input of the two-dimensional convolutional neural network. Specifically, the feature values ​​of each column are first normalized to map the values ​​to the range of 0 to 255 (for grayscale conversion). The normalization operation is based on the expression:

[0068]

[0069] Among them, max col and min col They refer to the maximum and minimum values ​​of the features in this column, respectively, x refers to the feature value, and y refers to the normalized value.

[0070] The one-dimensional sample data is transformed into a two-dimensional matrix, and the missing values ​​are filled with 0. The two-dimensional matrix is ​​then processed into a grayscale image. Specifically, each element in the matrix is ​​regarded as a grayscale value, and each sample is converted into a corresponding grayscale image. The larger the grayscale value, the whiter the corresponding color, and vice versa.

[0071] S2. Build a local model and deploy it to each participant in the horizontal federated learning system. In this embodiment, the federated learning method can be divided into horizontal federated learning HFL and vertical federated learning VFL. Horizontal federated learning is also called feature-aligned federated learning. In this mode, the data features (dimensions) used by each edge device are the same, but the data samples are different. It is generally suitable for occasions with relatively high privacy protection requirements. Vertical federated learning refers to the partial overlap of data samples between edge devices, but different data features (dimensions). This method can well integrate data of different dimensions from all parties, mine richer information, and thus give full play to the data advantages of all parties.

[0072] After a detailed and comprehensive study and comparison of the definitions and applicable scenarios of horizontal federated learning and vertical federated learning, considering that in the IoT device identification scenario of this embodiment, the data presents the characteristics of similar feature dimensions of each participant but independent samples, and there are strict requirements for data privacy protection. Therefore, this embodiment constructs the following based on horizontal federated learning: Figure 1 The ConFedDI method framework shown in the figure is intended to achieve efficient model training and knowledge sharing while ensuring data privacy and security. The local model construction process includes:

[0073] A local training model architecture is constructed based on the AlexNet network, and the local training model architecture consists of an input layer, four convolutional layers, three pooling layers, and three fully connected layers. In view of the fact that traditional device recognition methods based on machine learning are limited by their dependence on feature extraction, this embodiment proposes to use a convolutional neural network to construct a local training model architecture for IoT device recognition. The selected convolutional neural network is an improved structure based on the AlexNet network. In order to determine the best network structure improvement plan, this embodiment set up a comparative test and obtained the following results through a comprehensive evaluation of performance and computing efficiency. Figure 2 The convolutional neural network structure shown is the local model. The local model consists of an input layer, four convolutional layers, three pooling layers, and three fully connected layers (the last fully connected layer is used as the output layer).

[0074] The role of the input layer is to perform preliminary processing on the grayscale images in the grayscale image dataset so that they meet the input requirements of subsequent network layers. Considering that the image size after grayscale conversion of the sample data is 9×9, all four convolutional layers use smaller convolution kernel sizes, such as 3×3. This helps to better capture local features in small images and avoids losing too much detail due to overly large convolution kernels. In the setting, the number of convolution kernels is gradually increased as the network goes deeper. This can gradually increase the richness of features and enable the network to learn more complex and discriminative feature representations. All three pooling layers use maximum pooling. Because maximum pooling only focuses on the maximum value within each receptive field, it can better highlight significant features and gradually reduce noise interference. The number of neurons in the first two fully connected layers is 512. The last fully connected layer is used as the output layer, and the number of neurons contained is consistent with the number of device types in the dataset. Regarding the use of activation functions, except for the output layer which uses the SoftMax activation function, the other hidden layers all use the Relu function as the activation function. The Softmax activation function is used to convert the output of the output layer into a probability distribution form to determine the category of the model output. The Relu activation function can effectively alleviate the problem of model non-convergence caused by the vanishing gradient.

[0075] In the federated learning framework, since the devices (clients) participating in the learning have different data distributions, the model may face the problem of statistical heterogeneity, resulting in unstable or biased training results. To address this challenge, this embodiment adopts a series of methods based on the existing technology to optimize the training process of the local model to reduce the impact of statistical heterogeneity. The details are as follows:

[0076] In deep learning models, weight initialization is crucial to the convergence speed and final performance of the network. Traditional random initialization methods may cause the output values ​​of network layer activations to explode or disappear during training, affecting the learning ability of the model. Therefore, this embodiment adopts the Kaiming weight initialization technique, which is particularly suitable for networks using the ReLU activation function. Kaiming initialization ensures that the variance of the output values ​​of the network layer remains within a reasonable range by adjusting the weight distribution, avoiding the problem of disappearance or explosion of activation values. Specifically, the weights and biases of the convolutional layer and the fully connected layer in the local training model architecture are initialized to obtain the initial model parameters. The initialization formula is:

[0077]

[0078] In the formula, the weight W has a mean of 0 and a variance of Normal distribution; n in is the number of input neurons. For convolutional neural networks, n in =k×k×C in, where k×k is the convolution kernel size, C in is the number of input channels.

[0079] In this embodiment, weights and biases enable the neural network to learn complex patterns and features in the data, thereby achieving the task of classifying the input data. Specifically, weights are responsible for extracting and combining features, while biases increase the model's flexibility and expressiveness, helping it better fit the data. During training, the backpropagation algorithm continuously adjusts the values ​​of weights and biases to minimize the model's loss function, thereby improving model performance.

[0080] This embodiment obtains the initial values ​​of the parameters through Kaiming initialization. Specifically, for the convolutional layer, its weights are initialized using the Kaiming normal distribution (sampled from a normal distribution with a mean of 0 and a standard deviation of sqrt(2 / n), where n is the number of input channels), and the bias is initialized to 0. For the fully connected layer, the weights are sampled from a normal distribution with a mean of 0 and a standard deviation of 0.01, and the bias is initialized to 0. This initialization method can provide better gradient flow in the early stages of training, help the neural network converge faster, and retain the nonlinear characteristics of the ReLU activation function, thereby enhancing the learning ability of the local model.

[0081] Deep learning processes data and calculates losses through forward propagation, and then adjusts weights through backpropagation and gradient descent algorithms to achieve feature learning and model optimization. In this process, when the label distribution is tilted, the model will be more biased towards predicting categories with larger amounts of data, resulting in deviations in model training results. The weighted loss function proposed in this embodiment can effectively deal with the problem of uneven label distribution. Specifically, a weighted loss function L is established for the local training model architecture in the local round iterative training. ω , the expression is:

[0082]

[0083] For the local model used as a classification convolutional neural network in this embodiment, the final output is a tensor of size B×C. In the formula, B is the batch size; C is the number of categories; y ij is the true label of category j corresponding to sample i; p ij is the predicted label of category j corresponding to sample i; ω j is the weight value of category j, which is usually measured by dividing the total number of samples by the number of category samples.

[0084] The weighted loss function L established in this embodiment is ωBy assigning different weights to different categories, the model pays more attention to categories with less data during training, reducing classification bias caused by statistical heterogeneity. At the same time, it can improve the model's ability to recognize minority categories in deep learning.

[0085] In a horizontal federated learning system, due to the differences in training data among clients, traditional SGD optimization may fall into local optimal solutions on some clients, resulting in poor overall performance of the model.

[0086] Among them, the basic stochastic gradient descent (SGD) update formula is:

[0087]

[0088] This embodiment uses the SGD optimization method with the introduction of a momentum parameter, that is, the local training model architecture is optimized based on the stochastic gradient descent update method with the introduction of the momentum parameter α, and the local model applied to each participant is obtained. The expression of the stochastic gradient descent update method with the introduction of the momentum parameter α is:

[0089]

[0090] Where η is the learning rate; ▽J(θ t-1 ) is the loss function with respect to the parameter θ t-1 The gradient at the current position; v t is the update direction and step size.

[0091] The introduction of the momentum parameter α proposed in this embodiment enables the optimizer to consider not only the current gradient but also the previous gradient update direction when updating parameters. This can help the local model jump out of the local optimal solution more quickly when facing statistically heterogeneous client data, accelerate the optimization process in horizontal federated learning, improve the training efficiency of the local model on different clients, and at the same time improve the adaptability and generalization ability of the local model when facing statistically heterogeneous data.

[0092] S3. Each participant trains their local model based on the locally generated grayscale image dataset and the received initial model parameters. After training, they upload the new local model parameters to the federated learning server. During the first global iteration, the federated learning server initializes the global model parameters. The server then distributes these initialized initial model parameters to each client. Upon receiving these parameters, the client uses them as the initialization parameters for its local model.

[0093] In the second and subsequent global iterations, after the previous global iteration, the federated learning server aggregates the local model parameters uploaded by each client to obtain new global model parameters. The federated learning server then distributes the new global model parameters to each client, and the client uses these parameters to update the local model as the starting parameters for the next round of local training. In this embodiment, the processing of local model parameters is as follows:

[0094] The client uses the local grayscale image dataset for training, then passes the grayscale image dataset into the local model, and calculates the output results through each layer of the local model.

[0095] Based on the output of the local model and the true label, the client calculates the value of the loss function, which measures the difference between the prediction result of the local model and the true label.

[0096] Based on the value of the loss function, the client uses the backpropagation algorithm to calculate the gradient of the parameters of each layer of the local model. The gradient represents the rate of change of the loss function with respect to the parameters, and the gradient can be used to determine how to adjust the parameters to reduce the loss.

[0097] The client uses an optimization algorithm to update the parameters of the local model based on the calculated gradients. The client performs multiple rounds of training iterations locally. After local training, the client uploads the updated local model parameters to the federated learning server.

[0098] S4. The federated learning server aggregates the local model parameters uploaded by each participant to generate global model parameters. In federated learning, particularly horizontal federated learning, multiple devices or clients train local models on their local data and send these updates to a central server for aggregation to form a global model. This process enables collaborative model training while protecting data privacy.

[0099] In this embodiment, the aggregation strategy of the local model parameters is a simplified strategy based on FedAvg. For example, the parameter aggregation formula is:

[0100]

[0101] Where K is the number of clients participating in local updates in this round; is the local model parameter of the i-th client; ω t is the global model parameter after parameter aggregation.

[0102] In this strategy, it is assumed that the number of local updates performed by each client is exactly the same during the global update phase of each global round. This assumption ensures that under the simple average aggregation strategy, each client model participating in the aggregation has a relatively consistent update degree, avoiding aggregation bias that may be caused by large differences in the number of client updates.

[0103] S5. Calculate the average loss of local training samples in the current global round and determine whether the federated learning server outputs the final model parameter ω GE ; During this process, the loss value of the model will be calculated in each iteration, and the convergence of the model will be continuously monitored.

[0104] When the average loss of the global model tends to be stable, that is, convergence, the global model stops the global round iterative training, and the federated learning server outputs the final model parameter ω GE Otherwise, the global model parameters are broadcast again to each participant to update the local model parameters, and serve as the initial model parameters for local training and federated learning iteration in the next local round.

[0105] In each global iteration, each participant (client) trains its own local model based on local data. The parameters of these local models are then aggregated into the global model. Over multiple iterations, the global model continuously absorbs local information from each client and gradually adjusts its parameters, thereby optimizing model performance. Because data distributions often vary between clients, global iterations allow the model to learn and adapt across diverse data distributions. Through multiple iterations, the model better adapts to heterogeneous data, maintaining good performance across a wide range of data distributions. Therefore, in each global iteration, clients only need to upload local model parameters without sharing their original data. This way, even after multiple iterations, data remains locally stored, effectively protecting data privacy. As the number of iterations increases, the model gradually converges (as determined by calculating the validation set loss on the aggregated global model), eventually reaching a stable state and achieving good global performance.

[0106] By adopting global round iterative training, the model has higher accuracy, better generalization ability, and enhanced privacy protection effect on a global scale, thereby ensuring the stability and reliability of the model, allowing the model to gradually converge to a stable state and avoiding drastic fluctuations in the model during training.

[0107] The global model parameters are broadcasted again to each participant to update the local model parameters, which serve as the initial model parameters for local training and federated learning iterations in the next local round. The specific process includes:

[0108] Randomly and uniformly sample K clients from N clients to form the participant set S e , and each participant P i ∈S e Receive the initial model parameters ω sent by the federated learning server e , that is, the federated learning server broadcasts the current initial model parameters to all selected clients.

[0109] In this example, model parameters refer to the weights and biases of each convolutional layer and each fully connected layer. For a convolutional layer with 32 kernels, each of size 3×3, and 3 input channels, the number of weight parameters for this layer is 32×3×3×3, plus 32 bias parameters. For a fully connected layer with an input dimension of 100 and an output dimension of 50, the number of weight parameters is 100×50, and the number of bias parameters is 50.

[0110] Each participant is based on the grayscale image dataset and the initial model parameters ω e Perform local training for rounds c = 0, 1, 2, …, LE-1, where LE is the number of local training rounds and controls the number of local iterations on the client. In real-world scenarios, each client's data is unique and contains specific local features. Local training rounds provide the local model with more opportunities to deeply explore the characteristics and patterns of this local data. Furthermore, data distributions often vary between clients, so local training rounds help the model adapt to their respective data distributions.

[0111] If the client only performs one round of local training before uploading the model parameters, it will result in frequent communication and increase communication overhead. By performing multiple rounds of local iterations, the client can update the model multiple times locally and then upload the updated model parameters to the server, reducing the number of communications with the server and lowering communication costs.

[0112] During local training, multiple iterations can smoother model gradient updates. Each round of training calculates gradients based on the current local data and updates model parameters. Multiple iterations comprehensively consider information from different batches of data, avoiding the drastic fluctuations in model parameters caused by the randomness of a single gradient calculation, thereby improving model stability. This results in higher accuracy and generalization capabilities, while also saving communication resources and making the training process more stable and faster.

[0113] Traverse the local grayscale image dataset D i For each batch B, the average loss of local training samples in the current local round is calculated. The calculation formula is:

[0114]

[0115] Where B = {x, y} is the batch of the local grayscale image dataset, including input x and label y; is the initial model parameter of participant i; |D i | is the total number of samples in the grayscale image dataset; Loss() is the weighted cross entropy loss function; is the predicted value for the input x.

[0116] According to the average loss Update the local model to get new local model parameters, the expression is:

[0117]

[0118] Where α is the learning rate, which is used to control the gradient descent step size; is the gradient of the loss function with respect to the parameters.

[0119] Calculate the update amount of the local model The calculation formula is:

[0120]

[0121] Where, ω e-1 are the global model parameters after the last global round of training; Client P in the current global round i Local model parameters after local training.

[0122] The federated learning server receives and aggregates updates from all participants Get the new global model parameters and determine whether they are the final model parameters ω after GE round global training GE .

[0123] First, horizontal federated learning, as a distributed learning paradigm, allows multiple participants with different IoT device data samples but similar feature dimensions to collaborate in training while protecting data privacy and reducing communication costs, so as to improve the global accuracy, generalization accuracy, and personalization accuracy of the model in device identification.

[0124] Secondly, the multi-layered structure of a convolutional neural network automatically learns complex feature abstractions at different levels, fully exploiting the network traffic patterns inherent in each data packet. This reduces the computational overhead associated with manual feature selection and increases the model's adaptability to diverse network environments. Experiments have demonstrated that this method offers superior performance in IoT device identification compared to existing methods. Therefore, this embodiment combines horizontal federated learning with convolutional neural networks to achieve high-performance, high-privacy IoT device identification.

[0125] In order to verify the feasibility of IoT device identification, this embodiment conducts simulation analysis through the following experiment. The specific process is as follows:

[0126] 1. Experimental environment and settings

[0127] The experiments in this example used Ubuntu 20.04LTS as the operating system and Python 3.8 as the basic language environment. The training and evaluation of the deep learning model were performed based on the PyTorch 1.11.0 framework, and CUDA was used for GPU acceleration to improve computational efficiency and model training speed. All experimental results were obtained in this consistent environment, ensuring the reproducibility of the research. Other environment information is shown in Table 1, and detailed information on the model training hyperparameter settings is shown in Table 2.

[0128] Table 1 Experimental environment information

[0129]

[0130] Table 2 Training hyperparameter settings

[0131] Serial number Hyperparameters size Serial number Hyperparameters size 1 Global training rounds 20 5 Batch size 64 2 Local training rounds 4 6 Learning rate 0.01 3 Number of clients 10 7 momentum 0.01 4 Number of candidate clients 5 - - -

[0132] 2. Evaluation indicators

[0133] The evaluation process uses two performance metrics: accuracy (Acc) and F1 score, to construct a comprehensive and accurate measurement of model performance. The conventional approach of relying solely on accuracy is abandoned because real-world data is often unevenly distributed. In such imbalanced datasets, errors in identifying minority devices can be masked by correct identifications of majority devices, resulting in a seemingly high overall accuracy, but in reality, the model's ability to identify minority devices is poor, failing to truly reflect the model's actual performance. In contrast, the F1 score, a harmonic mean of precision (which measures the proportion of samples predicted as positive by the model that are actually positive out of all predicted positive samples) and recall (which measures the proportion of samples correctly predicted as positive out of all actual positive samples), strikes a balance between the two, avoiding the evaluation drawbacks of emphasizing a single metric. This more accurately reflects the model's overall ability to identify different device classes in an imbalanced dataset.

[0134] 3. Analysis of experimental results

[0135] The experimental part is divided into two parts. The first part is an ablation experiment to compare the performance differences between the models with and without a federated framework. The second part is to compare and analyze the model in this embodiment with the device identification method in previous work. In order to deal with the device identification ambiguity problem caused by building device fingerprints based on a single data packet (that is, under some conventional device operations, different devices may have the same device behavior), this embodiment adopts an aggregation method similar to that proposed by Kostas et al., aggregating the predicted labels corresponding to multiple traffic packets generated by the same device, and taking the mode as the final predicted label.

[0136] This embodiment uses two public data sets. The first data set used is the CIC data set (CIC-IoT-22dataset), which contains information on six different states: power state, interaction state, scenario state, attack state, idle state, and active state. The active state contains data when the device is used during the day within 30 days. The device behavior traffic generated is the most detailed among the six states and is suitable for benign device identification. It contains a total of 38 different types of devices, which is rich in device types. Therefore, in this study, it is used to build the modeling method.

[0137] The second dataset used is the UNSW-Sydney dataset, which consists of two parts: 28 devices from the UNSW-Sydney IEEE TMC dataset and 4 devices from another study from the same institution, the UNSW-Sydney ACM SOSR dataset. In addition, there are seven non-IoT devices, which are treated as one device in subsequent processing. Therefore, there are a total of 33 device types. This dataset is used to verify the wider versatility of the ConFedDI method in different network environments.

[0138] 3.1 Ablation Experiment

[0139] Ablation experiments were conducted from two perspectives: first, comparing the performance of different convolutional neural network architectures to determine the optimal convolutional model structure; second, comparing the ConFedDI and improved AlexNet models to analyze the performance and communication cost differences between distributed and centralized training. Regarding training parameter settings, the centralized training models were uniformly set to train for 40 epochs, with the remaining training parameters set as shown in Table 2. The federated training parameters are also shown in Table 2. All ablation experiments were conducted on the CIC dataset.

[0140] (1) Performance comparison of different convolutional neural network structure settings

[0141] To find the optimal balance between model performance and complexity, this section uses five different improved convolutional architectures based on AlexNet, as shown in Table 3. Table 4 shows the performance comparison results. The results in Table 4 show that M3 performs best across both performance metrics, while also having a relatively low model complexity of 802,150 parameters. Therefore, this convolutional architecture was selected in this example to construct the local training model for federated learning participants.

[0142] Table 3 Different convolutional neural network structure settings (mCn represents the convolution kernel of m×n×n)

[0143] Model number Convolutional layer configuration describe M1 32C3-64C3-128C3-128C3-256C3 Original structure M2 32C3-64C3-128C3-128C3-256C3-256C3 Add a convolution layer M3 32C3-64C3-128C3-256C3 Remove one convolution layer M4 32C3-64C3-256C3 Delete the middle two convolution layers M5 32C3-64C3-128C3 Delete the last two convolution layers

[0144] Table 4 Performance comparison of different convolutional neural network structures

[0145]

[0146] (2) Performance comparison between distributed training and centralized training

[0147] This section compares the performance of the ConFedDI model and the M3 convolutional neural network model, aiming to further explore the practical utility of federated learning in model training. The comparison results are shown in Table 5. As can be seen, before aggregation, the ConFedDI method achieves a three percent improvement in both performance metrics compared to the M3 convolutional network. This demonstrates that the distributed learning mechanism of federated learning enables the model to integrate information from diverse data sources, learning a broader and more diverse representation of device features, thereby enhancing its ability to recognize different types of devices and improving overall model performance. A closer analysis of communication costs reveals that the federated learning method, ConFedDI, is significantly smaller at 612MB, compared to the centralized training method M3CNN's 15GB (8.6GB for the UNSW dataset). This is due to the unique distributed architecture of federated learning. In federated learning, participants only need to upload updated model parameters or gradients in each global communication round, rather than the original large-scale training data. In contrast, the communication cost of centralized training methods is directly proportional to the size of the dataset, as centralized training requires all training data to be transferred from various data sources to a central server at once.

[0148] Table 5 Performance comparison between ConFedDI model and CNN model

[0149]

[0150]

[0151] Table 6 shows the performance of the ConFedDI model on specific device types in the CIC dataset, along with the corresponding confusion matrix heat map for the ConFedDI model on the CIC dataset. As can be seen from the table, before aggregation, the recognition accuracy for most of the 38 device categories exceeded 90%. For a few device categories, such as the Amazon Alexa Echo Dot 1, Amazon Alexa Echo Dot 2, Amazon Alexa Echo Spot, and Amazon Alexa Echo Studio, both metrics were around 65%. This phenomenon can be explained. The confusion matrix heat map shows that these four device categories are highly likely to be identified as each other. This is because these four devices belong to the same Amazon smart home ecosystem and are all smart speakers, sharing similar basic functions and hardware architectures, resulting in a high degree of similarity in their network behavior.

[0152] Table 6 Performance of each device type in the CIC dataset under the ConFedDI model

[0153]

[0154]

[0155] 3.2 Comparative Experiments on Related Work

[0156] To better demonstrate the superiority of the proposed ConFedDI method in model performance and feature selection, this section conducts a comparative experiment. Specifically, ConFedDI is compared with two previous studies: the HFedDI method proposed by Sumitra et al. and the IoTDevID method proposed by Kostas et al. To ensure a more objective comparison, the following experimental setup was used. The comparative experiment was conducted on two datasets: the CIC dataset and the UNSW dataset. Furthermore, both HFedDI and IoTDevID use the same feature space proposed by Kostas et al.

[0157] The experimental results are shown in Table 7. Figure 3 and Figure 4Shown are bar charts corresponding to the CIC dataset and the UNSW dataset. The table shows the specific performance of each model from two dimensions, namely different datasets and the performance scores before and after aggregation. It can be seen from Table 7 that the method proposed in this embodiment performs best in both datasets and the performance scores before and after aggregation. Specifically, compared with the HFedDI method, the method proposed in this article has a performance improvement of nearly 20% on both datasets. This is due to the deep convolutional structure used in the model. The deep convolutional structure can extract more subtle feature changes in the data compared to the model with a fully connected neural network structure, which enables the model to show better performance. The method proposed in this article has slightly improved performance on both datasets compared to the IoTDevID method, but the advantage of the ConFedDI method is that it avoids the tedious feature selection process without losing model performance, and has better data privacy than the IoTDevID method.

[0158] Table 7 Comparison of model performance on the CIC dataset and UNSW dataset

[0159]

[0160] In summary, with the rapid growth in the number of IoT devices and their widespread adoption across various fields, they also face challenges in network security and service quality assurance. Accurate device identification is crucial. Traditional centralized device identification methods suffer from drawbacks such as privacy leakage, high communication costs, and poor feature selection versatility. Federated learning and deep learning technologies have become key solutions to these problems. Therefore, this embodiment proposes the ConFedDI method, which, by introducing a horizontal federated learning mechanism and an improved convolutional neural network, establishes a multi-party collaborative training platform, ensuring data privacy. It also automatically selects packet features, eliminating the tedious process of manual feature selection, fully exploring hidden patterns in the data, and improving the accuracy of IoT device identification. This method combines the advantages of horizontal federated learning and convolutional neural network technologies to reshape the paradigm of IoT device identification. It allows multiple participants to train models locally using their own data, exchanging only model parameters, successfully avoiding privacy risks and significantly reducing communication overhead. The convolutional neural network automatically extracts complex features contained in data packets, eliminating the manual feature screening process, effectively reducing labor and computational costs, and improving recognition accuracy.

[0161] Comparative experiments show that traditional centralized training on a specific dataset requires 15GB of communication overhead (8.6GB on another dataset), while this method only requires 612MB, providing a privacy-conscious and cost-effective solution for large-scale IoT device identification system deployments. The method was validated on two public datasets, achieving excellent device classification accuracy. ConFedDI achieved F1 scores of 99.44% and 99.75% on both datasets, demonstrating its effectiveness and generalization capabilities across diverse data distributions, providing a strong foundation for its application in real-world IoT device identification scenarios.

[0162] Those skilled in the art will appreciate that all or part of the steps in the above-mentioned embodiment methods can be accomplished by instructing the relevant hardware through a program. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0163] The above embodiments provide a detailed introduction to the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A method for identifying IoT devices based on HFL, characterized in that: The method includes the following steps: Obtain device behavior traffic data generated by IoT devices during operation, and generate grayscale image datasets for local training by all participants through data preprocessing; Build local models and deploy them to all participants in the horizontal federated learning system; Each participant trains the local model based on the locally generated grayscale image dataset and the received initial model parameters, and uploads the new local model parameters to the federated learning server after training is completed; The federated learning server aggregates the local model parameters uploaded by each participant to obtain the global model parameters; Calculate the average loss of local training samples in the current global round and determine whether the federated learning server outputs the final model parameter ω GE ; When the average loss of the global model tends to be stable, the global model stops global round iterative training, and the federated learning server outputs the final model parameter ω GE ; Otherwise, the global model parameters are broadcast again to each participant to update the local model parameters, and serve as the initial model parameters for local training and federated learning iterations in the next local round.

2. The method for identifying an IoT device according to claim 1, wherein: The process of preprocessing device behavior traffic data includes: Based on a single raw data packet containing device behavior traffic data, the Scapy tool is used to extract detailed data information including each network protocol layer, payload entropy, and protocol features from the packet header of the raw data packet, and then converted into a CSV file to obtain one-dimensional sample data; Perform data cleaning on the one-dimensional sample data and remove feature columns whose values ​​are the same in all samples of all categories; The one-dimensional sample data is normalized to 0-255 according to the feature column and converted into a two-dimensional grayscale image to obtain a grayscale image dataset as the input of the two-dimensional convolutional neural network.

3. The method for identifying an IoT device according to claim 1, wherein: The process of building the local model includes: Building a local training model architecture based on the AlexNet network, which consists of an input layer, four convolutional layers, three pooling layers, and three fully connected layers; Initialize the weights and biases of the convolutional layer and the fully connected layer in the local training model architecture to obtain the initial model parameters. The initialization formula is: In the formula, the weight W has a mean of 0 and a variance of Normal distribution; n in is the number of input neurons; Establish a weighted loss function L for the local training model architecture in local rounds of iterative training ω , the expression is: Where B is the batch size; C is the number of categories; y ij is the true label of category j corresponding to sample i; p ij is the predicted label of category j corresponding to sample i; ω j is the weight value of category j; The local training model architecture is optimized based on the stochastic gradient descent update method with the introduction of momentum parameter α to obtain a local model applied to each participant.

4. The method for identifying an IoT device according to claim 3, wherein: The expression of the stochastic gradient descent update method introducing the momentum parameter α is: Where η is the learning rate; is the loss function with respect to the parameter θ t-1 The gradient at the current position; v t is the update direction and step size.

5. The method for identifying an IoT device according to claim 1, wherein: The parameter aggregation formula is: Where K is the number of clients participating in local updates in this round; is the local model parameter of the i-th client; ω t is the global model parameter after parameter aggregation.

6. The method for identifying an IoT device according to claim 1, wherein: The global model parameters are broadcasted again to each participant to update the local model parameters, which serve as the initial model parameters for local training and federated learning iterations in the next local round. The specific process includes: Randomly and uniformly sample K clients from N clients to form the participant set S e , and each participant P i ∈S e Receive the initial model parameters ω sent by the federated learning server e ; Each participant is based on the grayscale image dataset and the initial model parameters ω e Perform local training for rounds c = 0, 1, 2, ..., LE-1, where LE is the number of local training rounds. Traverse the local grayscale image dataset D i For each batch B, the average loss of local training samples in the current local round is calculated. According to the average loss Update the local model to get new local model parameters, the expression is: Where α is the learning rate, which is used to control the gradient descent step size; is the gradient of the loss function with respect to the parameters; Calculate the update amount of the local model The federated learning server receives and aggregates updates from all participants Get the new global model parameters and determine whether they are the final model parameters ω after GE round global training GE .

7. The method for identifying an IoT device according to claim 6, wherein: The average loss The calculation formula is: Where B = {x, y} is the batch of the local grayscale image dataset, including input x and label y; is the initial model parameter of participant i; |D i | is the total number of samples in the grayscale image dataset; Loss() is the weighted cross entropy loss function; is the predicted value for the input x.

8. The method for identifying an IoT device according to claim 6, wherein: The update amount The calculation formula is: Where, ω e-1 are the global model parameters after the last global round of training; Client P in the current global round i Local model parameters after local training.

Images