Network node abnormal data sensing method and device based on agent federated learning, storage medium and equipment
By deploying the Isolation Forest algorithm of agent-fed learning on network nodes and aggregating parameters using the federated learning model, the problems of dynamic perception and data privacy in traditional methods are solved, and efficient and accurate identification of network anomaly data is achieved.
Patent Information
- Application Number
- CN202510928647.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-07
- Publication Date
- 2025-10-28
AI Technical Summary
Traditional methods for detecting abnormal data in network nodes require periodic intervention, cannot achieve dynamic detection, and pose a risk of data privacy leakage.
The method of agent-based federated learning is adopted, and the isolated forest algorithm is deployed on network nodes. The parameters are aggregated through the federated learning model, and the autonomous learning ability of the agents and the lightweight algorithm are used to detect abnormal data, avoiding the uploading of raw data and protecting data privacy.
It enables efficient and accurate identification of abnormal data in dynamic network environments, improving detection efficiency and flexibility while ensuring data privacy. It is highly adaptable and has strong generalization ability.
Smart Images
Figure CN120856580A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network anomaly data perception technology, specifically to a method, apparatus, storage medium, and device for network node anomaly data perception based on agent-based federated learning. Background Technology
[0002] Network nodes are the hubs of data transmission. Abnormal data can cause network nodes to overload or crash, leading to the paralysis of the entire network. By monitoring network nodes in real time, data anomalies can be quickly detected, problematic nodes can be located rapidly, and isolation or repair measures can be taken to prevent the spread of faults.
[0003] Traditional methods for detecting anomaly data in network nodes include rule-based and machine learning model-based methods. Rule-based methods require manual updates to the rule base, while machine learning model-based methods require periodic training to adapt to different data distributions. Both methods require regular intervention and cannot achieve dynamic detection of anomalies. Furthermore, traditional methods require uploading the raw network data of network nodes, resulting in high bandwidth demands and difficulties in ensuring data privacy. Summary of the Invention
[0004] To address the problems existing in the prior art, this invention provides a method, apparatus, storage medium, and device for sensing abnormal network node data based on agent-based federated learning, which enables dynamic sensing of abnormal network node data while ensuring data privacy.
[0005] To achieve the above technical objectives, the present invention adopts the following technical solution: a method for perceiving abnormal data of network nodes based on agent-based federated learning, comprising the following steps: Step S1: Set up an agent in each network node, deploy the Isolation Forest algorithm in each agent, and deploy the Federated Learning model in the central server; Step S2: Each agent initially adjusts the parameters of the Isolation Forest algorithm according to the network data transmission task of the corresponding network node, and uploads the parameters of the Isolation Forest algorithm to the Federated Learning Model; Step S3: The federated learning model aggregates the parameters of the isolated forest algorithm in the agents into global parameters and distributes them to each agent; Step S4: Each agent fuses the global parameters and the initially adjusted parameters to update the parameters of the Isolation Forest algorithm; Step S5: The agent inputs the network data collected in real time from the network nodes into the isolated forest algorithm for parameter updates, detects abnormal data, and reports it to the central server.
[0006] Further, step S2 includes the following sub-steps: Step S2.1: Construct a reward function in the agent to measure the parameter adjustment strategy of the Isolation Forest algorithm; Step S2.2: The agent receives the current parameters and network data of the Isolation Forest algorithm, calculates the reward function, and adjusts the parameters of the Isolation Forest algorithm using the policy gradient algorithm with the goal of maximizing the long-term cumulative reward function. Step S2.3: Upload the adjusted parameters of the Isolation Forest algorithm to the Federated Learning Model.
[0007] Furthermore, the reward function The construction process is as follows:
[0008] in, This represents the accuracy reward for the agent's perception of network data anomalies under the current parameter adjustment strategy. express The weighting coefficients, This represents the reward for the agent to adapt to changes in network data distribution under the current parameter adjustment strategy. express The weighting coefficients, This represents the efficiency penalty term for the agent's perception of network data anomalies under the current parameter adjustment strategy. express The weighting coefficients.
[0009] Furthermore, the aggregation process of the global parameters is as follows:
[0010] in, Indicates a global parameter. K Indicates the number of intelligent agents. express K index, Indicates passing through the first k The parameters of the Isolation Forest algorithm were initially adjusted by the individual agents. Indicates the first k The amount of network data collected by each intelligent agent This represents the amount of network data collected by all intelligent agents.
[0011] Furthermore, in step S4, the process by which the agent fuses the global parameters and the initially adjusted parameters is as follows:
[0012] in, Indicates the first k The parameters of the Isolation Forest algorithm are obtained by fusing global parameters and initially adjusted parameters by an agent. express The weighting coefficients.
[0013] Furthermore, step S5 includes the following sub-steps: Step S5.1: The agent normalizes the network data collected in real time from the network nodes sequentially; Step S5.2: Input the normalized network data into the Isolation Forest algorithm with the total number of isolation trees determined. Randomly sample the normalized network data according to the subsample size of each isolation tree until all network data is isolated. Step S5.3: Calculate the path normalization length of the isolation tree traversed by each network data; Step S5.4: Mark network data whose path normalization length in the isolation tree exceeds a set threshold as abnormal data and report it to the central server.
[0014] Furthermore, the calculation process for the path normalization length of each network data traversed by the isolation tree is as follows:
[0015] in, Represents network data x The normalized path length of the isolated trees traversed. Represents network data x Average path length across all isolated trees Indicates the first k The normalization constant of all network data collected by the agent. , Indicates the total number of isolated trees. This represents Euler's constant.
[0016] Furthermore, the present invention also provides a network node anomaly data perception device that applies the network node anomaly data perception method based on agent-based federated learning, comprising: network nodes, a central server, agents set in each network node, and a federated learning model set in the central server; the central server is used to coordinate the network data transmission tasks of each network node, and the network nodes are used to execute the network data transmission tasks. The agent incorporates an isolated forest algorithm, which uploads the parameters of the isolated forest algorithm to the federated learning model of the central server. The agent is used to collect network data of the corresponding network nodes performing tasks in real time, identify abnormal data through the isolated forest algorithm, and send alarms to the central server. The federated learning model is used to aggregate the parameters of the isolated forest algorithm in each agent into global parameters, which are then distributed to the agents in each network node through a central server to update the parameters of the isolated forest algorithm.
[0017] Furthermore, the present invention also provides a computer-readable storage medium storing a computer program that enables a computer to execute the network node anomaly data perception method based on agent-based federated learning.
[0018] Furthermore, the present invention also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the network node abnormal data perception method based on agent-based federated learning.
[0019] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention uses a lightweight isolated forest algorithm deployed on network nodes to detect abnormal network data. It constructs an isolation tree by randomly dividing the feature space and relies solely on the distribution characteristics of network data to isolate abnormal data. No data labeling is required, and it can adapt to changes in the dynamic network environment. (2) The present invention sets the intelligent agent on the network node to form a distributed detection system, which can support large-scale network expansion. At the same time, the intelligent agent has the ability to learn autonomously and can adjust the parameters of the isolated forest algorithm by using the policy gradient algorithm with the goal of maximizing the long-term cumulative reward function, thereby realizing the dynamic perception of abnormal data of network nodes, which can significantly improve the efficiency, accuracy and flexibility of network anomaly detection. (3) This invention aggregates the parameters of the isolated forest algorithm in the agent into global parameters through the federated learning model. Each agent only needs to upload the parameters of the isolated forest algorithm instead of the original network data, which can avoid the leakage of the original network data and protect data privacy. At the same time, the introduction of global parameters into the isolated forest algorithm enables the isolated forest algorithm to cover a wider range of network anomaly data identification, which is highly adaptable and greatly improves the generalization ability of the agent. Attached Figure Description
[0020] Figure 1 This is a flowchart of the network node anomaly data perception method based on agent-based federated learning according to the present invention; Figure 2 This is a schematic diagram of the network node anomaly data perception device based on agent-based federated learning according to the present invention. Detailed Implementation
[0021] The technical solution of the present invention will be further explained and described below with reference to the accompanying drawings.
[0022] like Figure 1The flowchart below shows the network node anomaly data perception method based on agent-based federated learning according to the present invention. The network node anomaly data perception method includes the following steps: Step S1: Set up an agent in each network node to form a distributed detection system, avoiding the delay caused by transmitting network data to a central server for perception, and supporting large-scale network expansion; deploy the Isolation Forest algorithm in each agent for dynamic perception of anomaly network data; deploy a federated learning model in the central server to enable the Isolation Forest algorithm in the agent to adapt to the perception of anomaly network data in various scenarios while protecting network data privacy.
[0023] Step S2: Each agent initially adjusts the parameters of the Isolation Forest algorithm based on the network data transmission task of the corresponding network node, and uploads the parameters of the Isolation Forest algorithm to the federated learning model. The agent possesses autonomous learning capabilities and can adjust the parameters of the Isolation Forest algorithm using a policy gradient algorithm with the goal of maximizing the long-term cumulative reward function. This enables dynamic perception of abnormal data from network nodes, significantly improving the efficiency, accuracy, and flexibility of network anomaly detection. This includes the following sub-steps: Step S2.1: Construct a reward function in the agent to measure the parameter adjustment strategy of the isolated forest algorithm, wherein the parameters of the isolated forest algorithm include: the total number of isolated trees and the subsampling size of each isolated tree.
[0024] The reward function in this invention The construction process is as follows:
[0025] in, This represents the accuracy reward of the agent in perceiving network data anomalies under the current parameter adjustment strategy. A positive reward is given when the agent correctly perceives abnormal data, and a negative reward is given when the agent misdetects or misses detection. express The weighting coefficients, This represents the reward for the agent to adapt to changes in network data distribution under the current parameter adjustment strategy. A positive reward is given when the agent correctly perceives changes in network data distribution; otherwise, no reward is given. express The weighting coefficients, This represents the efficiency penalty term for the agent's perception of network data anomalies under the current parameter adjustment strategy. This penalty is applied when the agent's data perception efficiency is low, which can optimize resource utilization. express The weighting coefficients are determined. By designing a multi-objective reward function, the perceptual accuracy, adaptability, and efficiency of the isolated forest algorithm can be balanced, avoiding the problems of overfitting or resource waste caused by a single reward.
[0026] Step S2.2: The agent receives the parameters and network data of the current Isolation Forest algorithm, calculates the reward function, and adjusts the parameters of the Isolation Forest algorithm using the policy gradient algorithm with the goal of maximizing the long-term cumulative reward function. Step S2.3: Upload the adjusted parameters of the Isolation Forest algorithm to the Federated Learning Model.
[0027] Step S3: The federated learning model aggregates the parameters of the Isolation Forest algorithm in the agents into global parameters and distributes them to each agent. Each agent only needs to upload the parameters of the Isolation Forest algorithm instead of the original network data, which can avoid the leakage of the original network data and protect data privacy.
[0028] The aggregation process of global parameters in this invention is as follows:
[0029] in, Indicates a global parameter. K Indicates the number of intelligent agents. express K index, Indicates passing through the first k The parameters of the Isolation Forest algorithm were initially adjusted by the individual agents. Indicates the first k The amount of network data collected by each intelligent agent This represents the amount of network data collected by all intelligent agents.
[0030] Step S4: Each agent fuses the global parameters and the initially adjusted parameters to update the parameters of the Isolation Forest algorithm. Introducing global parameters into the Isolation Forest algorithm enables it to cover a wider range of network anomaly data identification, making it more adaptable and greatly improving the generalization ability of the agents.
[0031] In this invention, the process by which the intelligent agent fuses global parameters and initially adjusted parameters is as follows:
[0032] in, Indicates the first k The parameters of the Isolation Forest algorithm are obtained by fusing global parameters and initially adjusted parameters by an agent. express The weighting coefficients.
[0033] Step S5: The agent inputs the real-time collected network data from network nodes into the Isolation Forest algorithm for parameter updates, detects abnormal data, and reports it to the central server. By deploying a lightweight Isolation Forest algorithm on network nodes, it detects abnormal network data and constructs isolation trees by randomly partitioning the feature space. It relies solely on the distribution characteristics of network data to isolate abnormal data, requiring no data labeling and adapting to changes in the dynamic network environment. This includes the following sub-steps: Step S5.1: The agent normalizes the network data collected in real time from the network nodes sequentially; Step S5.2: Input the normalized network data into the Isolation Forest algorithm with the total number of isolation trees determined. Randomly sample the normalized network data according to the subsample size of each isolation tree until all network data is isolated. Step S5.3: Calculate the path normalization length of the isolation tree traversed by each network data point:
[0034] in, Represents network data x The normalized path length of the isolated trees traversed. Represents network data x Average path length across all isolated trees Indicates the first k The normalization constant of all network data collected by the agent. , Indicates the total number of isolated trees. This represents Euler's constant.
[0035] Step S5.4: Mark network data whose path normalization length in the isolation tree exceeds a set threshold as abnormal data and report it to the central server.
[0036] This invention presents a network node anomaly data perception method based on agent-based federated learning. It utilizes the autonomous learning capabilities of agents to dynamically adjust the parameters of the Isolation Forest algorithm according to the network data transmission tasks of network nodes, achieving accurate anomaly data perception without human intervention. At the same time, through a federated learning model deployed on a central server, it provides global parameters with a wider range of applicable scenarios while ensuring data privacy, thus guaranteeing the generalization capability of dynamic perception of network node anomaly data.
[0037] In one technical solution of the present invention, a network node anomaly data perception device applying the aforementioned network node anomaly data perception method based on agent-based federated learning is also provided, such as... Figure 2It includes: network nodes, a central server, intelligent agents set on each network node, and a federated learning model set on the central server; the central server is used to coordinate the network data transmission tasks of each network node, and the network nodes are used to execute the network data transmission tasks. The agent incorporates an isolated forest algorithm, which uploads the parameters of the isolated forest algorithm to the federated learning model of the central server. The agent is used to collect network data of the corresponding network nodes performing tasks in real time, identify abnormal data through the isolated forest algorithm, and send alarms to the central server. The federated learning model is used to aggregate the parameters of the isolated forest algorithm in each agent into global parameters, which are then distributed to the agents in each network node through a central server to update the parameters of the isolated forest algorithm.
[0038] In one technical solution of the present invention, a computer-readable storage medium is also provided, storing a computer program that enables a computer to execute the network node anomaly data perception method based on agent-based federated learning.
[0039] In one technical solution of the present invention, an electronic device is also provided, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the network node abnormal data perception method based on agent federated learning.
[0040] In the embodiments disclosed in this application, a computer storage medium may be a tangible medium that may contain or store programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of computer storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.
[0041] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0042] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principles of the present invention should be considered within the scope of protection of the present invention.
Claims
1. A method for detecting abnormal data in network nodes based on agent-based federated learning, characterized in that, Includes the following steps: Step S1: Set up an agent in each network node, deploy the Isolation Forest algorithm in each agent, and deploy the Federated Learning model in the central server; Step S2: Each agent initially adjusts the parameters of the Isolation Forest algorithm according to the network data transmission task of the corresponding network node, and uploads the parameters of the Isolation Forest algorithm to the Federated Learning Model; Step S3: The federated learning model aggregates the parameters of the isolated forest algorithm in the agents into global parameters and distributes them to each agent; Step S4: Each agent fuses the global parameters and the initially adjusted parameters to update the parameters of the Isolation Forest algorithm; Step S5: The agent inputs the network data collected in real time from the network nodes into the isolated forest algorithm for parameter updates, detects abnormal data, and reports it to the central server.
2. The method for perceiving abnormal network node data based on agent-based federated learning according to claim 1, characterized in that, Step S2 includes the following sub-steps: Step S2.1: Construct a reward function in the agent to measure the parameter adjustment strategy of the Isolation Forest algorithm; Step S2.2: The agent receives the current parameters and network data of the Isolation Forest algorithm, calculates the reward function, and adjusts the parameters of the Isolation Forest algorithm using the policy gradient algorithm with the goal of maximizing the long-term cumulative reward function. Step S2.3: Upload the adjusted parameters of the Isolation Forest algorithm to the Federated Learning Model.
3. The method for perceiving abnormal network node data based on agent-based federated learning according to claim 2, characterized in that, The reward function The construction process is as follows: in, This represents the accuracy reward for the agent's perception of network data anomalies under the current parameter adjustment strategy. express The weighting coefficients, This represents the reward for the agent to adapt to changes in network data distribution under the current parameter adjustment strategy. express The weighting coefficients, This represents the efficiency penalty term for the agent's perception of network data anomalies under the current parameter adjustment strategy. express The weighting coefficients.
4. The method for perceiving abnormal network node data based on agent-based federated learning according to claim 1, characterized in that, The aggregation process of the global parameters is as follows: in, Indicates a global parameter. K Indicates the number of intelligent agents. express K index, Indicates passing through the first k The parameters of the Isolation Forest algorithm were initially adjusted by the individual agents. Indicates the first k The amount of network data collected by each intelligent agent This represents the amount of network data collected by all intelligent agents.
5. The method for perceiving abnormal network node data based on agent-based federated learning according to claim 1, characterized in that, In step S4, the process by which the agent fuses the global parameters and the initially adjusted parameters is as follows: in, Indicates the first k The parameters of the Isolation Forest algorithm are obtained by fusing global parameters and initially adjusted parameters by an agent. express The weighting coefficients.
6. The method for perceiving abnormal network node data based on agent-based federated learning according to claim 1, characterized in that, Step S5 includes the following sub-steps: Step S5.1: The agent normalizes the network data collected in real time from the network nodes sequentially; Step S5.2: Input the normalized network data into the Isolation Forest algorithm with the total number of isolation trees determined. Randomly sample the normalized network data according to the subsample size of each isolation tree until all network data is isolated. Step S5.3: Calculate the path normalization length of the isolation tree traversed by each network data; Step S5.4: Mark network data whose path normalization length in the isolation tree exceeds a set threshold as abnormal data and report it to the central server.
7. A method for perceiving abnormal network node data based on agent-based federated learning according to claim 6, characterized in that, The calculation process for the path normalization length of each network data traversed by the isolation tree is as follows: in, Represents network data x The normalized path length of the isolated trees traversed. Represents network data x Average path length across all isolated trees Indicates the first k The normalization constant of all network data collected by the agent. , Indicates the total number of isolated trees. This represents Euler's constant.
8. A network node anomaly data sensing device that applies the network node anomaly data sensing method based on agent-based federated learning as described in any one of claims 1-7, characterized in that, include: Network nodes, central server, intelligent agents set up on each network node, and federated learning model set up on the central server; The central server is used to coordinate the network data transmission tasks of each network node, and the network node is used to execute the network data transmission tasks. The agent incorporates an isolated forest algorithm, which uploads the parameters of the isolated forest algorithm to the federated learning model of the central server. The agent is used to collect network data of the corresponding network nodes performing tasks in real time, identify abnormal data through the isolated forest algorithm, and send alarms to the central server. The federated learning model is used to aggregate the parameters of the isolated forest algorithm in each agent into global parameters, which are then distributed to the agents in each network node through a central server to update the parameters of the isolated forest algorithm.
9. A computer-readable storage medium storing a computer program, characterized in that, The computer program causes the computer to execute the network node anomaly data perception method based on agent-based federated learning as described in any one of claims 1-7.
10. An electronic device, characterized in that, include: The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the network node anomaly data perception method based on agent-based federated learning as described in any one of claims 1-7.