Satellite network anomaly detection method based on federated learning

Abstract

The satellite network anomaly detection method based on federated learning relates to the field of satellite network communication technology and solves the problems that the existing detection system cannot effectively learn the feature model between data and cannot achieve the balance between optimal model training and communication overhead. The present invention preprocesses the open source data set, constructs the CvT-LSTM model, designs a general framework with a single server and K participants, and uses an aggregation strategy based on the weighting of local data volume and anomaly detection model accuracy. The anomaly detection model parameters of the selected client are uploaded to the global model, and after aggregation by the global model, they are sent to all clients. This method avoids the interference of low-quality data, reduces the transmission and calculation of invalid data from the source, significantly reduces communication costs, and only allows highly representative clients to participate in global model aggregation, minimizing the communication burden while ensuring model performance.

Description

Technical Field

[0001] The present invention relates to the field of satellite network communication technology, and in particular to a satellite network anomaly detection method based on federated learning. The detection method is used to achieve a balance between optimal model training and communication overhead when randomly selecting clients for training. Background Art

[0002] As satellite internet applications continue to expand and network connectivity becomes increasingly complex, the cybersecurity threats it faces are also intensifying. The construction and protection of satellite internet will become a core issue in the "air-space-ground integrated" system of the 6G era. Satellite internet utilizes advanced satellite communication technology to connect various devices to a global network, acting as a mobile base station in the sky. These base stations can reach areas beyond the reach of ground-based base stations, providing uninterrupted and efficient network interaction. To protect the normal communication of satellite networks, anomaly detection solutions must be designed in advance.

[0003] Traditional intrusion detection systems often rely on continuous data exchange and analysis, which can lead to significant bandwidth usage and increased operating costs, posing additional challenges to satellite communication systems. Machine learning-based satellite network anomaly detection methods either only consider spatial or temporal features or fail to fully extract spatiotemporal features between data, effectively failing to learn the characteristic patterns between data. Federated learning-based satellite network anomaly detection methods randomly select clients for training, failing to achieve a balance between optimal model training and communication overhead. To address these issues, the present invention designs a federated learning-based satellite network anomaly detection method. Summary of the Invention

[0004] In order to solve the problems that the existing detection system cannot effectively learn the feature model between data and cannot achieve the balance between optimal model training and communication overhead, the present invention provides a satellite network anomaly detection method based on federated learning.

[0005] The satellite network anomaly detection method based on federated learning is implemented by the following steps:

[0006] Step 1: Preprocess the data set and use the sliding window method to construct a fixed-length message sequence;

[0007] Step 2: Build a CvT-LSTM model as an anomaly detection model for the anomaly detection task of message sequences;

[0008] The CvT-LSTM model includes a spatial feature extraction module and a temporal feature extraction module;

[0009] The spatial feature extraction module is used to extract spatial features from the input message sequence, and further extract temporal features from the spatial features using the temporal feature extraction module, and implement multi-classification anomaly detection and binary classification anomaly detection through a fully connected layer, with the category corresponding to the maximum value as the final detection result;

[0010] Step 3: Set up a single server and A client-side federated learning framework; using selection clients for each round of federated training;

[0011] Step 4: Using an aggregation strategy based on the weighted local data volume and local model accuracy, the anomaly detection model parameters of the selected clients are uploaded to the global model, which is then aggregated by the global model and sent to all clients.

[0012] Beneficial effects of the present invention:

[0013] The method described in the present invention dynamically optimizes and screens based on client training performance and data quality to improve the convergence speed and accuracy of the global model; it constructs a spatiotemporal feature extraction model that integrates CvT and LSTM to improve the modeling and recognition capabilities of complex attack sequences.

[0014] The method described in this paper addresses the communication overhead issue in federated learning by employing a tournament selection method to intelligently screen high-quality clients, avoiding interference from low-quality data. This reduces the transmission and computation of invalid data at the source, significantly lowering communication costs. By allowing only highly representative clients to participate in global model aggregation, the communication burden is minimized while ensuring model performance.

[0015] In terms of performance, the method described in the present invention improves the convergence speed of the global model and enhances the accuracy of the final model. On the UNSW-NB15 dataset, compared with the existing DFL-ID, Precision, Recall and F1-Score are improved by 1.9%, 2.8% and 2.9% respectively. Then, CvT and LSTM are integrated to improve the anomaly detection capability of time series data and enhance the modeling capability of complex time series data. On the STIN satellite network security dataset, the multi-classification accuracy is improved by 3%-25% compared with all methods. Compared with the centralized deep autoencoder (Centralized DAE), even in the federated learning scenario, the method of the present invention still improves by 2.8% in multi-classification tasks and shows better generalization ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 Schematic diagram of the satellite communication architecture of the satellite network anomaly detection method based on federated learning according to the present invention;

[0017] Figure 2 A schematic diagram of the model of the satellite network anomaly detection method based on federated learning described in the present invention;

[0018] Figure 3 This is a schematic diagram of the spatial feature extraction module structure in the CvT-LSTM model;

[0019] Figure 4 This is the schematic diagram of the LSTM time feature extractor;

[0020] Figure 5 Schematic diagram of the federated learning architecture based on genetic optimization in satellite communications according to the present invention;

[0021] Figure 6 This is a schematic diagram of the federated learning process described in the present invention;

[0022] Figure 7 Graph showing experimental results of the present invention comparing binary classification models on the UNSW-NB15 dataset;

[0023] Figure 8 The figures are experimental results of the comparison of the multi-classification models of the present invention on the UNSW-NB15 dataset; wherein, (a) is a comparison result of the CvT-LSTM model of the present invention and other models in Accuracy, (b) is a comparison result of the CvT-LSTM model of the present invention and other models in Precision, (c) is a comparison result of the CvT-LSTM model of the present invention and other models in Recall, and (d) is a comparison result of the CvT-LSTM model of the present invention and other models in F1-Score;

[0024] Figure 9 These are experimental effect diagrams for comparing the multi-classification models of the present invention on the STIN dataset; among them, (a) is a comparison effect diagram of the CvT-LSTM model of the present invention and other models in Accuracy, (b) is a comparison effect diagram of the CvT-LSTM model of the present invention and other models in Precision, (c) is a comparison effect diagram of the CvT-LSTM model of the present invention and other models in Recall, and (d) is a comparison effect diagram of the CvT-LSTM model of the present invention and other models in F1-Score. DETAILED DESCRIPTION

[0025] Specific implementation method 1. Combination Figures 1 to 6This implementation describes a federated learning-based satellite network anomaly detection method. This method first proposes a time series anomaly detection model that integrates Convolutional Vision Transformer (CvT) and Long Short-Term Memory (LSTM) networks (CvT-LSTM model). Specifically, the model combines a Convolutional Vision Transformer (CvT) with a Long Short-Term Memory (LSTM) network for anomaly detection in time series data within a federated learning framework. This model ensures data security while using a genetic algorithm to select high-quality clients for aggregation, thereby improving the convergence speed of the global model and enhancing its final performance.

[0026] like Figure 1 As shown, the satellite network anomaly detection method described in this embodiment is designed for a three-tier satellite communication system architecture, which can be divided into satellite network, ground station, and end-user. In this architecture, the satellite network includes inter-satellite communication, communication between satellite and ground station, forwarding user commands to ground station, and communication between satellite and end-user. The ground station includes inter-ground station communication, communication between ground station and satellite network, and communication between ground station and end-user. The end-user includes communication between user and satellite and between user and ground station. First, a CvT-LSTM model is deployed on each client and the central server. Using a federated learning approach, the CvT-LSTM model fully extracts spatial and temporal features across data, generating richer feature representations for higher accuracy. Each participant (client) then trains the model locally using a local dataset. Finally, the weights are uploaded to the cloud. After aggregation by the global model, each participant downloads the updated model.

[0027] The specific steps of the satellite network anomaly detection method of this embodiment are as follows:

[0028] Step 1: Preprocess the UNSW-NB15 open source dataset and the STIN open source dataset, including data cleaning, missing value filling, normalization, and sampling processing;

[0029] Step 1-1: Data cleaning: convert non-numeric items in the data into corresponding numeric forms through mapping methods, including label columns; use 0 to represent "normal" and 1 to represent "abnormal", thereby converting categorical data into numerical data;

[0030] Step 1-2: Fill missing values. Check if there are any missing values ​​or invalid characters in the entire dataset. If so, replace them with 0.

[0031] Steps 1-3, normalization, convert all processed data to a specific range, between 0 and 1, to help the classifier remove bias in the source data. Normalization is performed using the min-max normalization algorithm.

[0032] Steps 1-4: Sampling is determined based on the ratio of normal to abnormal labels. If the ratio is greater than 5:1, data oversampling is performed to maintain data balance.

[0033] Steps 1-5: Use the sliding window method to construct a fixed-length message sequence , the formula is as follows:

[0034] ;

[0035] in, , represents the sequence length, Indicates the feature dimension (number of channels) at each time step.

[0036] To minimize sample size and maintain a low repetition rate, the sequence length (sliding window size) is set to 20, and the sliding length is set to 10. Sequences with a length less than 20 are discarded. Each sequence is assigned a SeqType tag. If all data points in a sequence are normal, the entire sequence is marked as normal (SeqType = 0). If any attack information is present in a sequence, the sequence is marked as 1 (SeqType = 1).

[0037] Step 2: Model design; Figures 2 to 4 shown.

[0038] Figure 2 The CvT-LSTM model in the federated learning framework is used as a local model (anomaly detection model). The central server first initializes the global model and sends the initialized model parameters to each client. Each client uses the local dataset to train the CvT-LSTM model, extracting spatial and temporal features. The weight parameters of each model are: , uploaded to the global model, the global model is updated through an aggregation strategy based on the weighted local data volume and local model accuracy, where r represents the communication round. Finally, the updated global model parameters are sent to each client, that is, Each client updates its local anomaly detection model based on the parameters issued by the global model. It then trains the updated anomaly detection model using its local dataset, updating its parameters. This process continues iterating until the specified communication round r = 50. The various layers of the anomaly detection model, such as the convolutional projection layer, multi-head self-attention layer, and LSTM layer, are used to extract different types of features. Residual connections and weight matrices ensure information flow and optimization.

[0039] Figure 3 In the convolutional projection layer, the spatial features of the input are extracted and the feature mapping is performed through 1×1 convolution. The mapped data is then split into h parts, where h is the number of heads in the multi-head self-attention mechanism. Each head generates a query through an independent linear transformation ( ),key( ), and value ( ) matrix, that is: , and then calculate the attention score on each head by and The similarity calculation, scaling and softmax normalization of the weight distribution are obtained. Matrix weighted fusion generates single-head output, and finally the output of all heads, that is, , concatenate and transform by linear transformation (multiply by weight matrix ) are fused to form the final multi-head attention representation Z. This result will be passed to the downstream feedforward layer, where the nonlinear features are enhanced through the ReLU activation function, and the prediction results of the anomaly detection model are finally output.

[0040] In this embodiment, the CvT-LSTM model (anomaly detection model) is used for anomaly detection tasks in sequence data; the CvT-LSTM model includes a spatial feature extraction module (CvT) and a temporal feature extraction module (LSTM);

[0041] The spatial feature extraction module consists of a convolutional projection layer, a multi-head self-attention layer, a feedforward layer, and a residual connection layer; the temporal feature extraction module is implemented by an LSTM model;

[0042] The convolutional projection layer performs the following operations on the input sequence:

[0043] First, a one-dimensional convolutional layer (Conv1D) is used to project the input message sequence to extract the local features of the time series and generate a higher-dimensional representation using the correlation between time steps. Specifically, the message sequence As the input sequence, after the convolution transformation dimension, the converted feature representation is obtained , is the new feature dimension, is the new input sequence length.

[0044] Then, a batch normalization layer is introduced to normalize the feature distribution, improve training stability, and accelerate convergence. The feature map is obtained after the convolution operation. , the calculation formula is as follows:

[0045]

[0046] in, is the weight matrix of the convolutional layer, is the convolution kernel weight, that is: represents the output channel , input channel and the convolution kernel position The weight of Represents the input sequence at time step and input channels The value on , where is the step length, is the padding size, For output channels The bias, is the window size of the convolution kernel.

[0047] Finally, nonlinearity is introduced into the network so that complex patterns between data can be learned. The ReLU activation function is used for nonlinear transformation, which is defined as:

[0048] ;

[0049] in, It is the local feature of the output obtained after applying the ReLU activation function, that is, the feature map after convolution After ReLU activation, it converts the negative value in the convolution result to zero, thereby strengthening the network's response to positive features and avoiding the gradient vanishing problem. The local features extracted by convolution are projected into the new feature space, which can be expressed as follows:

[0050] ;

[0051] in, is the feature after projection transformation, which represents the input local feature Representation in the new space. Is a weight matrix that controls the linear transformation from the input feature space to the output feature space, that is, mapping the feature dimension to the model dimension .

[0052] The multi-head self-attention layer convolutionally projects the features As the input of the multi-head attention mechanism , after convolution, the features are mapped to obtain rich intermediate features and generate queries ( ), key (K) and value (V), the formula is as follows:

[0053] ;

[0054] in , , is a learnable weight matrix, are the dimensions of query, key, and value.

[0055] Calculate the attention weight, the formula is as follows:

[0056] ;

[0057] in, Calculate the similarity between query and key, is a scaling factor to ensure numerical stability.

[0058] In this implementation, multiple parallel self-attention mechanisms (heads) are used, each head learning different weights to capture information in different representation subspaces. The outputs of multiple heads are concatenated and linearly transformed; the calculation formula is:

[0059] ;

[0060] Among them, each is the output of the multi-head self-attention mechanism, , where h is the number of attention heads, is the output projection matrix.

[0061] The feed forward layer (FFL) is used for further feature extraction.

[0062] First, a linear transformation is performed, then a nonlinear activation is performed on the result of the linear transformation, and finally a second linear transformation is performed to map the feature dimension back to the original dimension. The formula is as follows:

[0063] ;

[0064] in, is the dimension of the FFL intermediate layer, and the final output feature of FFL , keeping consistent with the dimension of the input message sequence X.

[0065] The residual connection layer outputs the multi-head self-attention mechanism and input (Message sequence X) performs residual connection:

[0066] ;

[0067] in, Represents the output of the residual connection after the attention mechanism, that is, the result after adding the output of the attention mechanism, which is used to enhance the gradient flow and stabilize the model training. Residual connections are also performed: ;

[0068] in, Represents the output of the residual connection after the feed-forward layer, that is, the result after the output of the feed-forward layer is added, which is used to further enhance the gradient flow and stabilize model training.

[0069] In this embodiment, the features output by the residual connection layer are normalized, that is: and Two residual operations to obtain output features , and output features Normalize and obtain spatial features ;

[0070] ;

[0071] Among them, LayerNorm normalizes the features of each input sample;

[0072] The temporal feature extraction module converts the spatial features of the CvT output into As the input of LSTM, the data after fully extracting the contextual relationship is further used to extract the temporal features.

[0073] like Figure 4 As shown, in this embodiment, Figure 4 This is the structure of an LSTM (Long Short-Term Memory) unit. LSTM is a recurrent neural network (RNN) structure that can capture long-term dependencies. The main components of the diagram include:

[0074] Input Gate ( ): Determine the input candidate state at the current moment How much is added to the current cell state;

[0075] Forget Gate ( ): Control the cell state at the previous moment how much is retained;

[0076] Cell status ( ): Update the cell state at the current moment through the action of the forget gate and the input gate;

[0077] Output Gate ( ): Determines the cell state at the current moment How much flow goes to the hidden state LSTM effectively manages and updates information by combining three gates (input gate, forget gate, and output gate) with the tanh activation function, solving the gradient vanishing problem faced by traditional RNN in long sequence learning. , is the input vector of the current time step t and the previous time step t-1, usually expressed as feature input; , , It is the hidden state of the LSTM unit, which can also be called short-term memory. It is also one of the network outputs. , , It is a cell state used for storing long-term memories, which is one of the core advantages of LSTM. is the candidate cell state, and the intermediate state generated by the tanh function is used to update . The symbol represents element-wise multiplication and is often used in gating mechanisms to control the flow of information. The symbol represents element addition, which is used to merge the old state and the new candidate state.

[0078] In this embodiment, the forget gate The output range is [0, 1], where 0 means completely forgotten and 1 means completely retained:

[0079] ;

[0080] in, and Represents the weight and bias of the forget gate, is the output of the LSTM neuron at the previous moment, Indicates that the sigmoid activation function ensures Keep between [0,1].

[0081] The input gate determines how much of the input information of the current time step needs to be retained in the memory cell state. The memory state of the feature vector is:

[0082] ;

[0083] in, and are the weights and biases of the memory cell network. The weight of the temporary memory state relative to the entire memory stream is given by Expressed as:

[0084] ;

[0085] in, and is the weight and bias of the input gate. Combined with the output of the forget gate and the input gate, the memory unit state is updated to obtain the memory state of LSTM at that moment :

[0086] ;

[0087] Output Gate Determine the hidden state (output) of the current time step, control the output part, and map the memory unit state to [-1, 1] through the tanh function:

[0088] ;

[0089] ;

[0090] in, and are the weight and bias of the output gate. Get the inactivated output through the fully connected layer ;

[0091] ;

[0092] in, and are the weight vector and bias vector of the fully connected layer.

[0093] Finally, the fully connected layer completes multi-class anomaly detection and binary anomaly detection, that is, M=2 or M The calculation formula of the SoftMax function is as follows:

[0094] ;

[0095] Where M is the number of categories, The model's normalized score (logit) for the tth class is calculated using the exponential function Convert it into a positive weight, the denominator is the sum of the score indices of all categories m=1,2,…,M, used for normalization to ensure that the sum of all predicted probabilities is 1; where t represents the target category for which the probability is being calculated, and m is the index used to traverse all categories. Finally, It represents the predicted probability that the input belongs to the tth category, and the category corresponding to the maximum value is taken as the final detection result.

[0096] Will For the loss function, the cross entropy loss function is used, and its calculation formula is as follows:

[0097] ;

[0098] in, is a sign function (0 or 1), if the true category of sample i is equal to m, it takes 1, otherwise it takes 0, represents the predicted probability that sample i belongs to category m, and B represents the number of samples.

[0099] Step 3. Set up a server with a single A general federated learning (FL) framework for 1 participant (client) Clients are used for each round of federated training; the specific process is as follows:

[0100] Step 3-1, randomly generate multiple client selection schemes as the initial population, and set the population size to Q. Each individual is a length The binary vector , used to represent the client selection scheme, where K represents the total number of clients, i.e., the total number of anomaly detection models; , represents the selection status of the k-th client. Specifically, Indicates that the kth client is selected to participate in training, Indicates that it is not selected to participate in global aggregation;

[0101] Step 3-2: In each iteration, select individuals with higher fitness to generate the next generation; use the tournament selection method. The formula for tournament selection is as follows:

[0102] ;

[0103] is the best client selection scheme selected from the tournament, Indicates that each individual in the tournament candidate set is examined in turn, where each individual represents a complete client selection scheme. In order to distinguish different individuals, the client selection scheme can also be expressed as , that is, the qth client selection scheme; , each is a binary vector of length K, consisting of multiple elements Composition, indicating whether the kth client is selected to participate in training, is multiple The collection of f( ) is the fitness function value of the client selection scheme, which is used to evaluate the quality of the scheme. Each time, 3 individuals are randomly selected from the population. , select the one with the highest fitness to enter the next generation. Select individuals for crossover operation, randomly select two crossover points and exchange the middle part to explore more solution space. The crossover formula is as follows:

[0104] ;

[0105] in, arrive Select information for the client after crossover. By performing mutation operations on some bits of individuals (such as changing from 1 to 0, or from 0 to 1), the diversity of the population is increased to prevent the algorithm from falling into a local optimal solution. The mutation formula is:

[0106] ;

[0107] Randomly flip some bits in the client selection scheme, iterate 10 times or after meeting the convergence condition, output the optimal scheme. The fitness of the individual is calculated by the evaluation function, and the client selection scheme with the largest fitness function is output. The formula is:

[0108] ;

[0109] Where S={ } is the selected client set, satisfying , whose size is NM, where Indicates that the u-th client is selected, ; is the accuracy of the selected u-th client, fitness function Calculated based on the accuracy of the selected client.

[0110] Step 4: Set the total size of the training dataset to: ; is the total amount of data from the selected clients, that is: ; Adopt an aggregation strategy based on the weighted local data volume and local model accuracy to upload the anomaly detection model parameters of the selected client to the global model , after being aggregated by the global model, it is sent to all clients. The aggregation formula is:

[0111] ;

[0112] in, is the anomaly detection model parameter obtained by local training of the selected u-th client, D u is the dataset held locally by the selected u-th client; is the data volume of the selected u-th client, is the accuracy of the selected u-th client, is the number of clients selected, are the global model parameters after aggregation;

[0113] like Figure 5 and Figure 6 As shown, in this embodiment, Figure 5 This is a federated learning framework in a satellite network. The diagram includes multiple satellite nodes (anomaly detection models 1 through K), each of which trains a local model (anomaly detection model). High-quality clients participate in global model aggregation, while ground stations are responsible for aggregating local models and updating the global model. Upload and download traffic represent data transmission between clients and ground stations, respectively. This framework implements distributed model training and optimization over a satellite network.

[0114] Figure 6 This is the interaction between the client and server in federated learning. The client trains an anomaly detection model locally and uploads it. The server receives the updates and aggregates them to generate a global model. It then sends the initial and updated global models back to the client.

[0115] Specific implementation method 2: Figure 7 and Figure 9 This embodiment is an experimental example of the satellite network anomaly detection method based on federated learning described in Specific Implementation 1.

[0116] In this embodiment, Figure 7For binary classification results on the UNSW-NB15 dataset, the proposed method was compared with other methods, including Deep Federated Learning (DFL-ID), a centralized deep autoencoder (DAE), and standalone LSTM and CvT models. The proposed model achieved 99.95% accuracy on the binary classification task, with precision, recall, and F1-score exceeding 99%. Specifically, compared to DFL-ID, the proposed method achieved at least 1.5% improvement in precision, 2.0% improvement in recall, and 2.0% improvement in F1-score. The proposed method also outperformed the centralized DAE, which achieved slightly lower accuracy but similar precision / recall, demonstrating the effectiveness of the proposed CvT-LSTM architecture. The proposed method's superior performance on the UNSW-NB15 dataset is attributed to its ability to capture long-range temporal dependencies (via LSTM) and global feature interactions (via Transformer-based attention), which are incapable of simpler standalone LSTM or CNN models. The inclusion of both spatial and temporal feature extractors enables the proposed method to learn complex attack patterns that evolve over time, resulting in superior accuracy. Furthermore, ablation experiments were conducted, demonstrating that the proposed model achieves approximately 1% performance improvement over the CvT and LSTM methods alone, further demonstrating its ability to fully extract multidimensional features and improve classification accuracy when processing complex datasets.

[0117] Figure 8The results of multivariate classification on the UNSW-NB15 data show that the proposed method can fully learn the temporal and spatial features between data, achieving an accuracy of 98.87%. The results show that anomaly detection methods that only consider temporal or spatial features, such as random forests (RF), artificial neural networks (ANN), gated recurrent units (GRU), and long short-term memory networks (LSTM), perform poorly, with the best results reaching only 75%. Even ensemble methods that combine the Sequential Feedforward Propagation (SFS) algorithm, while simultaneously considering temporal and spatial features, still fail to fully extract complex spatiotemporal patterns, achieving a best accuracy of only 79%. In contrast, the proposed method, through the effective combination of CvT and LSTM, more comprehensively captures spatiotemporal dependencies. Even compared to a centralized deep autoencoder (DAE), the accuracy is still 1.8% higher. When the DAE is combined with a federated learning approach, while achieving an accuracy of 92%, the proposed method still achieves a 6.8% improvement over DFL-ID. Furthermore, combining Figures (a), (b), (c), and (d), the present invention achieved precision, recall, and F1 scores of 98.87%, 98.87%, and 98.86%, respectively, demonstrating comprehensive advantages across multiple evaluation metrics. In ablation experiments, the CvT method alone, considering only spatial features, achieved an accuracy of 96.79%, while the LSTM method, considering only temporal features, achieved an accuracy of only 75%. By simultaneously learning spatial and temporal features, the present invention achieved the highest accuracy, improving by 2% and 23% compared to CvT and LSTM, respectively.

[0118] Figure 9 The results of multivariate classification on the STIN dataset are shown in Figure 1. The STIN security dataset contains various attack types from terrestrial and satellite networks. Due to resource constraints, differences in attack tolerance, limited computing power, and scarcity of satellite network data, existing research methods are mostly applied to terrestrial networks and fail to fully adapt to satellite network environments. However, the performance of the present invention on the STIN dataset is still excellent. Combined with (a), (b), (c), and (d) in the figure, the performance of the four indicators exceeds 96%. Compared with all the methods in the figure, there is at least a 6% improvement in accuracy, precision, recall, and F1 score.

[0119] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0120] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the patent for this invention shall be determined by the appended claims.

Claims

1. A satellite network anomaly detection method based on federated learning, characterized by: The method is implemented by the following steps: Step 1: Preprocess the data set and use the sliding window method to construct a fixed-length message sequence; Step 2: Build a CvT-LSTM model as an anomaly detection model for the anomaly detection task of message sequences; The CvT-LSTM model includes a spatial feature extraction module and a temporal feature extraction module; The spatial feature extraction module is used to extract spatial features from the input message sequence, and further extract temporal features from the spatial features using the temporal feature extraction module, and implement multi-classification anomaly detection or binary classification anomaly detection through a fully connected layer, with the category corresponding to the maximum value as the final detection result; The spatial feature extraction module includes a convolutional projection layer, a multi-head self-attention layer, a feedforward layer and a residual connection layer; The message sequence X is transformed by convolution to extract local features, and the local features are projected into a new feature space to obtain the feature X after projection transformation. proj ; The feature X after projection transformation proj As the input of the multi-head self-attention layer, multiple parallel self-attention mechanisms are used to learn different weights, and finally the output of the multi-head self-attention layer is linearly transformed to obtain the output feature X atten ; Use the feed-forward layer to process the feature X atten Extract and output spatial features X after passing through the residual connection layer norm ; In the feedforward layer, the output feature X of the multi-head self-attention layer is first atten Perform linear transformation, nonlinear activation, and quadratic linear transformation to obtain features X that are consistent with the dimension of the input message sequence ffl ; The output feature X of the multi-head self-attention layer atten Perform residual connection with the input message sequence to obtain the output features of the residual connection The feature X output by the feedforward layer ffl and output features Perform residual connection and output features The output features and Perform residual operation and normalize to obtain spatial feature X norm ; Step 3: Set up a federated learning framework with a single server and N clients; select NM clients for each round of federated training; Step 4: Using a weighted average-based strategy, the anomaly detection model parameters of the selected clients are uploaded to the global model, which aggregates them and then sends them to all clients.

2. The satellite network anomaly detection method based on federated learning according to claim 1, characterized in that: In step 1, the specific process of preprocessing is: Step 1: Data cleaning: convert the non-numeric items in the data set into corresponding numeric forms through mapping methods; use 0 to represent normal and 1 to represent abnormal, and convert the data into numerical data; Step 1 and 2: Fill missing values. Check if there are any missing values ​​or invalid characters in the dataset. If so, replace them with 0. Step 13: Normalize and convert the processed data to between 0 and 1; Step 14: Sampling. Judge based on the ratio of normal labels to abnormal labels. If the ratio is greater than 5:1, oversampling is performed to maintain data balance.

3. The satellite network anomaly detection method based on federated learning according to claim 1, characterized in that: In step 1, the fixed-length message sequence X is expressed as follows: X=[x1,x2,…,x l ]; Where X∈R T×D , T is the length of the message sequence, D is the feature dimension of each time step; each message sequence corresponds to a label SeqType. If all data points in the message sequence are normal, the message sequence is marked as normal, SeqType = 0; if there is attack information in the message sequence, the message sequence is marked as 1, SeqType = 1.

4. The satellite network anomaly detection method based on federated learning according to claim 1, characterized in that: In step three, the federated learning framework implements distributed model training and optimization through a satellite network; it includes multiple satellite nodes, each of which performs local anomaly detection model training, high-quality clients participate in the aggregation of the global model, the ground station is responsible for aggregating the local anomaly detection model and updating the global model, and upload and download traffic between the client and the ground station realizes data transmission.

5. The satellite network anomaly detection method based on federated learning according to claim 1, characterized in that: In step 3, NM clients are selected for each round of federated training. The specific process is as follows: Step 3.

1. Randomly generate multiple client selection schemes as the initial population, and set the population size to Q; each individual is a binary vector C = [c1, c2, ... c k ,…c K ,], used to represent the client selection scheme; K represents the total number of clients, c k ∈{0,1}, represents the selection state of the kth client; c k =1 means the kth client is selected to participate in training, c k =0 means not selected to participate in global aggregation; Step 3.2: Use the tournament selection method to select the optimal client selection scheme, that is, the client selection scheme with the largest output fitness function; it can be expressed as follows: Where, S={u|c u =1} is the selected client set, satisfying Its size is NM, c u =1 means the uth client is selected, c u ∈c K ;client accuracy[u] is the accuracy of the selected u-th client, and the fitness function f(C) is calculated based on the accuracy of the selected client.

6. The satellite network anomaly detection method based on federated learning according to claim 1, characterized in that: In step 4, the aggregation formula based on the weighted local data volume and local model accuracy is: Among them, W u is the anomaly detection model parameter obtained by local training on the u-th client, D u is the dataset held locally by the selected u-th client, |D u | is the data volume of the u-th client, client accuracy[u] is the accuracy of the u-th client, NM is the number of selected clients, are the global model parameters after aggregation.

7. The satellite network anomaly detection method based on federated learning according to claim 1, characterized in that: The detection method is applied to a three-layer satellite communication system architecture, which is divided into a satellite network, a ground station, and end users. In the system architecture, the satellite network portion includes inter-satellite communication, communication between satellites and ground stations, communication forwarding user commands to ground stations, and communication between satellites and end users. The ground station part includes communication between ground stations, communication between ground stations and satellite networks, and communication between ground stations and end users; The end-user segment includes communications between users and satellites and between users and ground stations; First, an anomaly detection model is deployed on each client and the central server. Federated learning is used to protect the data privacy of each client. The anomaly detection model extracts spatial and temporal features between data. Then, each participant trains the anomaly detection model locally using the local dataset; Finally, the trained anomaly detection model weights are uploaded to the cloud. After being aggregated by the global model, each participant downloads the updated anomaly detection model.

Images