Federal learning method and system based on dynamic clustering and double-ring cooperative training
Through the federated learning method of dynamic clustering and dual-loop collaborative training, the problems of model adaptability and privacy protection under the heterogeneity and dynamic changes of industrial control equipment are solved, efficient knowledge sharing and communication optimization are achieved, and the security detection capabilities of industrial control systems are improved.
Patent Information
- Application Number
- CN202510831966.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-20
- Publication Date
- 2025-09-26
AI Technical Summary
Traditional centralized security detection methods have the risk of data privacy leakage. The strong heterogeneity of industrial control equipment makes it difficult for a single global model to adapt. Traditional federated learning has high communication overhead and is difficult to meet real-time requirements. The static clustering mechanism lacks adaptability, knowledge sharing efficiency is low, and high-performance equipment cannot effectively help low-performance equipment improve.
A federated learning method based on dynamic clustering and dual-loop collaborative training is adopted. Dynamic clustering is performed by similarity of non-sensitive features to form multiple federated subclusters. The inner loop independently performs knowledge distillation training, while the outer loop model is trained in a shared manner. The hierarchical clustering algorithm and weighted fusion mechanism are used to optimize the model to achieve dynamic adaptation and privacy protection.
It improves the convergence and knowledge sharing efficiency of the collaborative detection model of the industrial control system, adapts to the heterogeneity and dynamic changes of equipment, reduces communication overhead, and improves the adaptability and privacy protection capabilities of model training.
Smart Images
Figure CN120706504A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of federated learning, and in particular to a federated learning method and system based on dynamic clustering and dual-loop collaborative training. Background Art
[0002] With the rapid development of the Industrial Internet, industrial control systems face increasingly severe cybersecurity threats. Traditional centralized security detection methods pose the risk of data privacy leaks, while existing federated learning solutions face the following challenges in industrial control scenarios: Industrial control devices are highly heterogeneous, making a single global model difficult to adapt to the diverse characteristics of different devices; the high global aggregation communication overhead of traditional federated learning makes it difficult to meet real-time requirements; static clustering mechanisms lack adaptability due to the frequent dynamic changes in industrial control environments; and knowledge sharing is inefficient, preventing high-performance devices from effectively improving low-performance devices. Summary of the Invention
[0003] The purpose of the present invention is to provide a federated learning method based on dynamic clustering and dual-loop collaborative training, which is used for.
[0004] In order to achieve the above object, the present invention provides the following technical solutions: A federated learning method based on dynamic clustering and dual-loop collaborative training, including: Step 1: Receive non-sensitive features from each industrial control device participating in federated learning; Step 2: clustering the industrial control devices according to the similarity of each of the non-sensitive features to form multiple federated subclusters; Step 3: Each of the federated sub-clusters independently performs inner-loop knowledge distillation training, and each of the federated sub-clusters performs outer-loop model sharing training to determine whether the training end condition is met; Step 4: Update the non-sensitive features and repeat steps 2, 3, and 4 until the training end condition is reached.
[0005] A further technical solution is that the non-sensitive features include traffic statistical features and device behavior features.
[0006] A further technical solution is that the receiving of local non-sensitive features from each industrial control device participating in federated learning includes: The non-sensitive features in a single device are serially spliced to form a non-sensitive feature string, the non-sensitive feature string is compressed to obtain a feature vector of the non-sensitive feature string, and the feature vector is encrypted.
[0007] A further technical solution is that clustering the industrial control devices according to the similarity of each of the non-sensitive features includes: Calculating the non-sensitive feature similarity between devices based on the feature vector to obtain a similarity matrix; The similarity matrix is analyzed by a hierarchical clustering algorithm to achieve clustering of industrial control equipment.
[0008] A further technical solution is that the loss function of the inner-loop knowledge distillation training is expressed by the following formula:
[0009] In the formula, α and β are hyperparameters, and α+β=1, is the local task loss, is the KL divergence, is the local model regularization loss of industrial control equipment.
[0010] A further technical solution is that the termination conditions of the inner loop knowledge distillation training include: KL divergence The decline is less than 5% for 2 consecutive rounds or the maximum number of training rounds reaches 5 rounds.
[0011] A further technical solution is that outer-loop model shared training is performed between the federated sub-clusters, including: The weighted aggregation of the TOP-K local models of each federated sub-cluster is used as the sub-cluster representative model; The sub-cluster representative models form a ring topology according to the numbering and share the outer ring model; The devices corresponding to each of the federated subclusters receive an outer ring model; The validity of the outer loop model is verified according to the preset verification rules. If the model is invalid, the model is discarded; otherwise, the fusion weight of the outer loop model and the current local model is calculated, and the fusion weight is weighted and fused to update the local model.
[0012] A further technical solution is that the conditions for the end of the training include: The average model difference of all subclusters is less than 0.1 for two consecutive rounds; The validation set improvement is less than 0.5 for three consecutive rounds.
[0013] Compared with the existing technology, the federated learning method based on dynamic clustering and dual-loop collaborative training provided by the present invention has the following beneficial effects: This method utilizes a dynamic clustering mechanism based on the similarity of non-sensitive encrypted features and a dual-loop collaborative mechanism to optimize and improve communication efficiency, dynamic adaptability, and privacy protection. It is particularly suitable for industrial internet security scenarios characterized by strong device heterogeneity, high data privacy requirements, and variable system topologies. Compared to traditional federated learning methods, this method significantly improves the convergence of collaborative detection model training for industrial control systems using equivalent computing resources. Dynamic clustering also enhances the adaptability of the clustering mechanism and improves knowledge sharing efficiency.
[0014] The present invention also provides a federated learning system based on dynamic clustering and dual-loop collaborative training, comprising: Feature abstraction module, used to receive non-sensitive features from each industrial control device participating in federated learning; A dynamic clustering controller, configured to cluster the industrial control devices according to the similarity of each of the non-sensitive features to form a plurality of federated subclusters; An inner-loop training engine, configured to independently perform inner-loop knowledge distillation training on each of the federated sub-clusters; An outer-loop coordination module, configured to execute outer-loop model sharing training among the federated sub-clusters and determine whether a training end condition has been met; The adaptive optimization module is used to update the non-sensitive features, and each of the federated subclusters repeatedly performs inner-loop knowledge distillation training and outer-loop model sharing training until the training end condition is met.
[0015] Compared with the prior art, the beneficial effects of the federated learning system based on dynamic clustering and dual-loop collaborative training provided by the present invention are the same as the beneficial effects of the federated learning method based on dynamic clustering and dual-loop collaborative training described in the above technical solution, which will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS
[0016] Figure 1 This is a flow chart of an overall method provided by an embodiment of the present invention; Figure 2 This is a flow chart of outer loop model shared training provided by an embodiment of the present invention; Figure 3 4 is a schematic diagram of a ring topology training path of M sub-clusters provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0017] This specific embodiment is merely an explanation of the present invention and is not intended to limit the present invention. After reading this specification, those skilled in the art may make non-creative modifications to this embodiment as needed. However, as long as such modifications are within the scope of the claims of the present invention, they are protected by patent law.
[0018] It should be noted that, in the present invention, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the present invention should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.
[0019] The embodiments of the present invention are described in further detail below with reference to the accompanying drawings.
[0020] The embodiment of the present invention provides a federated learning method based on dynamic clustering and dual-loop collaborative training. The main process of the method is described as follows. Figure 1 As shown: Step S1: Receive non-sensitive features from each industrial control device participating in federated learning.
[0021] Non-sensitive features are local features of industrial control devices, including traffic statistics and device behavior features. Traffic statistics include the Q1 / Q3 quantiles of packet length and protocol type entropy; device behavior features include the Fourier base frequency of operation instructions.
[0022] Receiving non-sensitive features from industrial control devices includes: serially concatenating the non-sensitive features from a single device to form a non-sensitive feature string, compressing the non-sensitive feature string to obtain a feature vector for the non-sensitive feature string, and encrypting the feature vector. Specifically, each non-sensitive feature in the industrial control device is subjected to maximum and minimum normalization; the non-sensitive feature string is compressed into an N-bit feature vector using a principal component analysis algorithm, where the dimension N satisfies 8≤N≤12 to balance transmission efficiency and expressiveness; and homomorphic encryption is used to encrypt the N-bit feature vector after PCA processing to ensure that the server cannot restore the original data.
[0023] Step S2: clustering the industrial control devices according to the similarity of each of the non-sensitive features to form a plurality of federated subclusters.
[0024] The specific process of clustering the industrial control devices is to calculate the similarity of the non-sensitive features between devices based on the feature vectors to obtain a similarity matrix; and then analyze the similarity matrix using a hierarchical clustering algorithm to cluster the industrial control devices. The hierarchical clustering algorithm uses a merging threshold of 0.7 and a splitting threshold of 0.4.
[0025] The non-sensitive feature similarity between devices is calculated using the following formula:
[0026] Where, L is the similarity value, S i For devices i The eigenvector of S j For devices j The eigenvector of .
[0027] Step S3: Each of the federated sub-clusters independently performs inner-loop knowledge distillation training, and each of the federated sub-clusters performs outer-loop model sharing training.
[0028] Specifically, each federated sub-cluster first performs inner-loop knowledge distillation training in parallel. Once the inner-loop knowledge distillation training reaches the termination condition, the outer-loop model sharing training is performed. When the training end condition is met, the outer-loop model sharing training terminates.
[0029] Among them, the loss function of inner loop knowledge distillation training is expressed by the following formula:
[0030] In the formula, α and β are hyperparameters, and α+β=1, is the local task loss, is the KL divergence between the outer loop model and the local model of the industrial control equipment, is the regularization loss of the local model of industrial control equipment. , expressed by the following formula:
[0031] Where, is the L2 weight decay, is the gradient penalty term, λ is the weighted hyperparameter, and Υ is the conventional representation of regularization loss. Among them, the preferred λ=10 -3 , Υ=10 -4 , used to prevent overfitting and improve the generalization of the model.
[0032] The termination condition of inner loop knowledge distillation training is: KL divergence The decline is less than 5% for 2 consecutive rounds or the maximum number of training rounds reaches 5 rounds.
[0033] The outer-loop model shared training is performed between each federated sub-cluster, which includes the following steps. Figure 2 : Step S31: Weighted aggregation of the local models of each federated sub-cluster TOP-K as the sub-cluster representative model.
[0034] TOP-K refers to the top K local models in the federated sub-cluster, with K preferably being 3. The weight of the top K local models in each federated sub-cluster is: ; The weight of the sub-cluster representative model is: The fusion weight of the outer loop model is: , the fusion weight of the current local model is: , the weighted fusion of the fusion weight is: .
[0035] Step S32: The representative models of the sub-clusters form a ring topology according to their numbers and share the outer ring model.
[0036] The M subclusters represent the ring topology of the model. Figure 3As shown: .
[0037] Step S33: The devices corresponding to each of the federated sub-clusters receive the outer ring model; Step S34: Verify the validity of the outer loop model according to the preset verification rules. If the model is invalid, discard the model; otherwise, calculate the fusion weight of the outer loop model and the current local model, and weightedly fuse the fusion weight to update the local model.
[0038] The default validation rules are .in, is the accuracy of the received outer loop model on the local validation set, is the accuracy of the current local model on the local validation set.
[0039] The conditions for the end of training include that the average difference of local models in all federated subclusters is less than 0.1 for two consecutive rounds; and the improvement of local validation sets is less than 0.5 for three consecutive rounds.
[0040] Step S4: Update the non-sensitive features and repeat steps 2, 3 and 4 until the training ends.
[0041] Non-sensitive features are updated when changes occur to industrial control equipment participating in federated learning, including device offline or heartbeat packet loss for more than three minutes. When a new device is added, the non-sensitive features of the new device are assigned to the cluster whose similarity with the maximum existing federated sub-clusters is greater than δ1. If the similarity between the non-sensitive features of the new device and all existing federated sub-clusters is less than δ1, a new sub-cluster is created, and the initial training rounds for the new sub-cluster are set to 1.5 times that of the other federated sub-clusters. δ1 is 1 / 2 the similarity between the centers of the two closest clusters.
[0042] This method utilizes a dynamic clustering mechanism based on the similarity of non-sensitive encrypted features and a dual-loop collaborative mechanism to optimize and improve communication efficiency, dynamic adaptability, and privacy protection. It is particularly suitable for industrial internet security scenarios characterized by strong device heterogeneity, high data privacy requirements, and variable system topologies. Compared to traditional federated learning methods, this method significantly improves the convergence of collaborative detection model training for industrial control systems using equivalent computing resources. Dynamic clustering also enhances the adaptability of the clustering mechanism and improves knowledge sharing efficiency.
[0043] This embodiment also discloses a federated learning system based on dynamic clustering and dual-loop collaborative training, including: Feature abstraction module, used to receive non-sensitive features from each industrial control device participating in federated learning; A dynamic clustering controller, configured to cluster the industrial control devices according to the similarity of each of the non-sensitive features to form a plurality of federated subclusters; An inner-loop training engine, configured to independently perform inner-loop knowledge distillation training on each of the federated sub-clusters; An outer-loop coordination module, configured to execute outer-loop model sharing training among the federated sub-clusters and determine whether a training end condition has been met; The adaptive optimization module is used to update the non-sensitive features, and each of the federated subclusters repeatedly performs inner-loop knowledge distillation training and outer-loop model sharing training until the training end condition is met.
[0044] The various unit modules in the various embodiments of the present application can be integrated into a processing module, or each module can exist physically separately, or two or more modules can be integrated into a single module. The above-mentioned integrated unit modules can be implemented in the form of hardware or software functional units.
[0045] Although the present invention has been described with reference to specific features and embodiments thereof, it will be apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the invention. Accordingly, this specification and drawings are merely illustrative of the invention as defined by the appended claims and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the invention. It will be apparent that various modifications and variations may be made to the present invention by those skilled in the art without departing from the spirit and scope of the invention. Thus, the present invention is intended to include such modifications and variations as fall within the scope of the claims of the present invention and their equivalents.
Claims
1. A federated learning method based on dynamic clustering and dual-loop collaborative training, characterized in that: include: Step 1: Receive non-sensitive features from each industrial control device participating in federated learning; Step 2: clustering the industrial control devices according to the similarity of each of the non-sensitive features to form multiple federated subclusters; Step 3: Each of the federated sub-clusters independently performs inner-loop knowledge distillation training, and each of the federated sub-clusters performs outer-loop model sharing training to determine whether the training end condition is met; Step 4: Update the non-sensitive features and repeat steps 2, 3, and 4 until the training end condition is reached.
2. The method according to claim 1, characterized in that The non-sensitive features include traffic statistics features and device behavior features.
3. The method according to claim 1, characterized in that The receiving of local non-sensitive features from each industrial control device participating in federated learning includes: The non-sensitive features in a single device are serially spliced to form a non-sensitive feature string, the non-sensitive feature string is compressed to obtain a feature vector of the non-sensitive feature string, and the feature vector is encrypted.
4. The method according to claim 3, characterized in that Clustering the industrial control devices according to the similarity of each of the non-sensitive features includes: Calculating the non-sensitive feature similarity between devices based on the feature vector to obtain a similarity matrix; The similarity matrix is analyzed by a hierarchical clustering algorithm to achieve clustering of industrial control equipment.
5. The method according to claim 1, wherein The loss function of the inner loop knowledge distillation training is expressed as follows:
6. In the formula, α and β are hyperparameters, and α + β = 1, is the local task loss, is the KL divergence, is the local model regularization loss of industrial control equipment.
7. The method according to claim 1, characterized in that The termination conditions of the inner loop knowledge distillation training include: KL divergence The decline is less than 5% for 2 consecutive rounds or the maximum number of training rounds reaches 5 rounds.
8. The method according to claim 1, characterized in that The outer-loop model shared training is performed between the federated sub-clusters, including: The weighted aggregation of the TOP-K local models of each federated sub-cluster is used as the sub-cluster representative model; The sub-cluster representative models form a ring topology according to the numbering and share the outer ring model; The devices corresponding to each of the federated subclusters receive an outer ring model; The validity of the outer loop model is verified according to the preset verification rules. If the model is invalid, the model is discarded; otherwise, the fusion weight of the outer loop model and the current local model is calculated, and the fusion weight is weighted and fused to update the local model.
9. The method according to claim 1, characterized in that The conditions for the end of the training include: The average model difference of all subclusters is less than 0.1 for two consecutive rounds; The validation set improvement is less than 0.5 for three consecutive rounds.
10. A federated learning system based on dynamic clustering and dual-loop collaborative training, characterized in that: include: Feature abstraction module, used to receive non-sensitive features from each industrial control device participating in federated learning; A dynamic clustering controller, configured to cluster the industrial control devices according to the similarity of each of the non-sensitive features to form a plurality of federated subclusters; An inner-loop training engine, configured to independently perform inner-loop knowledge distillation training on each of the federated sub-clusters; An outer-loop coordination module, configured to execute outer-loop model sharing training among the federated sub-clusters and determine whether a training end condition has been met; The adaptive optimization module is used to update the non-sensitive features, and each of the federated subclusters repeatedly performs inner-loop knowledge distillation training and outer-loop model sharing training until the training end condition is met.