5G Internet of Things intrusion detection method and system based on federal transfer learning

Abstract

The invention relates to the technical field of data processing, and discloses a 5G Internet of Things intrusion detection method and system based on federal transfer learning. The 5G Internet of Things intrusion detection method based on federal transfer learning comprises the following steps: firstly, cleaning and standardizing multi-source heterogeneous data to obtain initial training data, dividing the data according to equipment distribution and initializing parameters to obtain a basic training set, and performing local training and global updating to obtain a feature parameter set; migration mapping is carried out on source domain and target domain features to obtain a migration feature set, multi-dimensional features are fused to obtain fused feature data, and finally anomaly analysis and risk assessment are carried out to generate a detection report. Local training and safe aggregation of the data are realized through federal learning, and the adaptive capacity of the model in a new scene is improved by utilizing transfer learning.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, and in particular to a 5G Internet of Things intrusion detection method and system based on federated transfer learning. BACKGROUND

[0002] Under the background of rapid development of 5G and Internet of Things technology, the number of network devices and terminals shows explosive growth, and the types of devices and communication methods are increasingly diversified. Traditional intrusion detection methods are mainly based on single detection rules or static feature patterns, which are difficult to effectively cope with complex and variable network environments. At the same time, with the continuous evolution of attack methods, attack behaviors show stronger concealment and confusion, and it is difficult for centralized detection architecture to discover and respond to new attacks in a timely manner. In addition, existing intrusion detection technologies often need to upload a large amount of raw data to the central server for analysis, which not only brings a large communication overhead, but also has potential data leakage risks. Especially in the Internet of Things scenario, the computing resources and storage capacity of terminal devices are significantly different, and how to fully utilize distributed computing resources for collaborative detection while protecting data privacy has become a key problem to be solved.

[0003] The prior art has the following disadvantages: first, the traditional detection method lacks consideration of device heterogeneity, and cannot adaptively allocate tasks according to device capability differences; second, existing feature extraction methods mainly process single data sources, and it is difficult to effectively fuse complex features in multi-source heterogeneous data; third, the generalization ability of the detection model is insufficient, and a large amount of training data needs to be collected again when facing new scenarios; finally, the existing method lacks effective privacy protection mechanism, and there is a risk of data leakage in the model training and updating process. SUMMARY

[0004] The present application provides a 5G Internet of Things intrusion detection method and system based on federated transfer learning, which is used to fully utilize distributed computing resources to build a collaborative learning framework under the premise of protecting terminal data privacy, realize efficient processing and feature transfer of multi-source heterogeneous data, and thus improve the accuracy and generalization ability of intrusion detection. The method realizes local training and safe aggregation of data through federated learning, uses transfer learning to improve the adaptability of the model in new scenarios, and combines differential privacy and other technologies to protect sensitive data, effectively solving the key problems existing in the prior art.

[0005] In a first aspect, the present application provides a 5G Internet of Things intrusion detection method based on federated transfer learning, which comprises: According to the multi-source heterogeneous data generated by the Internet of Things device, the device running data, network communication data and application interaction data are cleaned and standardized to obtain initial training data; The initial training data is divided according to the device distribution, and the training parameters and aggregation parameters are initialized to obtain a basic training set; The basic training set is subjected to local model training and global weight updating, and the training results of each terminal are aggregated to obtain a feature parameter set; The source domain features and target domain features in the feature parameter set are subjected to feature migration and spatial mapping, and the feature distribution is aligned to obtain a migration feature set; The time sequence features, statistical features and relationship features in the migration feature set are fused and pattern extracted, and the feature weights are dynamically allocated to obtain fused feature data; The fused feature data is subjected to traffic anomaly analysis, attack feature identification and risk level evaluation to generate an intrusion detection report containing attack type, risk level and disposal suggestion.

[0006] In a second aspect, the application provides a 5G Internet of Things intrusion detection system based on federated transfer learning, comprising: A processing module for cleaning and standardizing device running data, network communication data and application interaction data from multi-source heterogeneous data generated by Internet of Things devices to obtain initial training data; A division module for dividing the initial training data according to the device distribution and initializing the training parameters and aggregation parameters to obtain a basic training set; An updating module for local model training and global weight updating of the basic training set, and aggregating the training results of each terminal to obtain a feature parameter set; A migration module for feature migration and spatial mapping of source domain features and target domain features in the feature parameter set, and aligning the feature distribution to obtain a migration feature set; An extraction module for fusing and pattern extracting time sequence features, statistical features and relationship features in the migration feature set, and dynamically allocating feature weights to obtain fused feature data; A generation module for traffic anomaly analysis, attack feature identification and risk level evaluation of the fused feature data to generate an intrusion detection report containing attack type, risk level and disposal suggestion.

[0007] In the technical solutions provided in the present application, the device operation data, network communication data and application interaction data are cleaned and standardized, effectively improving the data quality and availability and laying a reliable foundation for subsequent analysis. The process of dividing the initial training data according to the device distribution and initializing the training parameters and aggregation parameters realizes the reasonable allocation of computing tasks and fully utilizes distributed computing resources. In the local model training and global weight updating stage, through the safe parameter aggregation mechanism, the data privacy is protected and the continuous optimization of the model performance is ensured. The design of feature migration and space mapping significantly improves the generalization ability of the model, enabling the detection system to quickly adapt to new application scenarios. The fusion processing of time series features, statistical features and relationship features enhances the comprehensiveness and discriminability of feature representation and improves the accuracy of anomaly detection. Finally, through the traffic anomaly analysis, attack feature identification and risk level evaluation of the fused feature data, a complete intrusion detection report is formed, providing strong support for security protection. This multi-level feature processing and analysis method not only improves the accuracy and real-time performance of detection, but also reduces the false positive rate of the system. At the same time, the distributed architecture based on federated learning significantly reduces the communication overhead and improves the overall efficiency of the system. BRIEF DESCRIPTION OF DRAWINGS

[0008] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor based on these drawings.

[0009] Figure 1 An embodiment schematic diagram of the 5G Internet of Things intrusion detection method based on federated transfer learning in the embodiments of the present application; Figure 2 An embodiment schematic diagram of the 5G Internet of Things intrusion detection system based on federated transfer learning in the embodiments of the present application. DETAILED DESCRIPTION

[0010] The embodiments of the present application provide a 5G Internet of Things intrusion detection method and system based on federated transfer learning. The terms "first", "second", "third", "fourth" and the like (if any) in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" or "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0011] For ease of understanding, the specific process of the embodiments of the present application is described below. Please refer to Figure 1 One embodiment of the 5G Internet of Things intrusion detection method based on federated transfer learning in the embodiments of the present application includes: Step S101, according to the multi-source heterogeneous data generated by the Internet of Things device, the device running data, the network communication data and the application interaction data are cleaned and standardized, and the initial training data is obtained; Step S102, the initial training data is divided according to the device distribution, and the training parameters and the aggregation parameters are initialized, and the basic training set is obtained; Step S103, the basic training set is subjected to local model training and global weight updating, the training results of each terminal are aggregated, and the feature parameter set is obtained; Step S104, the source domain features and the target domain features in the feature parameter set are subjected to feature transfer and spatial mapping, and the feature distribution is aligned, and the transfer feature set is obtained; Step S105, the time sequence features, the statistical features and the relationship features in the transfer feature set are subjected to fusion and pattern extraction, and the feature weights are dynamically allocated, and the fusion feature data is obtained; Step S106, the fusion feature data is subjected to traffic anomaly analysis, attack feature identification and risk level evaluation, and an intrusion detection report containing attack type, risk level and disposal suggestion is generated.

[0012] It can be understood that the execution subject of the present application can be a 5G Internet of Things intrusion detection system based on federated transfer learning, and can also be a terminal or a server, and the specific execution subject is not limited herein. The embodiments of the present application take the server as the execution subject for example.

[0013] Specifically, multi-source heterogeneous data generated by Internet of Things devices is processed. Internet of Things devices generate a large amount of different types of data during operation, including device operation data, network communication data, and application interaction data. Device operation data reflects the working state of the device, involving CPU usage, memory occupation, power consumption level, and other indicators; network communication data records the communication behavior between devices, including data packet characteristics, traffic characteristics, protocol characteristics, and other information; application interaction data describes the interaction process between the device and the external system, including API call sequence, user access record, and other contents. Cleaning and standardizing the raw data is a key step to ensure the accuracy of subsequent analysis. The data cleaning process removes abnormal data points through numerical range detection, removes damaged data packets through data integrity detection, and removes invalid interaction records through validity verification. Data standardization converts data of different sources and formats into a standard format, ensuring data consistency and comparability. The initial training data obtained through these processes lays the foundation for subsequent analysis.

[0014] After obtaining the initial training data, data division needs to be performed according to the distribution characteristics of the devices. This step performs hierarchical processing of the data through device performance evaluation, and divides the devices into different groups according to their processing capacity and storage capacity. For each device group, the training batch is determined through resource threshold division, and the training period and batch size are allocated to each terminal through the data distribution mechanism. At the same time, the training configuration data is encrypted using a secure encryption protocol to establish a secure communication channel between terminals. The initial parameters are calculated by aggregating the weights, and appropriate global aggregation period and participation rate threshold are set to form the basic training set. Based on the divided basic training set, each terminal begins local training. The local parameters are updated through iterative gradient calculation, and the gradient is perturbed using the differential privacy mechanism to protect data privacy. The training results are uploaded to the edge service node through the secure channel, and the weight balancing mechanism is used in the edge node for regional intermediate aggregation. The aggregated parameters are uploaded to the cloud server to update the global model, and finally the feature parameter set is generated. For the obtained feature parameter set, feature migration and spatial mapping processing are needed. First, the features of the source domain and the target domain are extracted through feature decomposition to establish the correspondence between the features of different domains. The features are aligned through distribution distance calculation to reduce the feature distribution difference between different domains. An incremental migration strategy is adopted to migrate the features layer by layer according to their complexity, and the migration effect is evaluated through feature evaluation indicators. Finally, the migrated features are merged to form the migration feature set.

[0015] On the basis of the migrated feature set, the time series features, statistical features, and relationship features need to be fused and pattern extracted. Periodic patterns are extracted through time series dimension analysis, distribution rules are mined through statistical quantity calculation, and topological structure features are found through correlation analysis. Different types of features are assigned weights through correlation calculation, and a dynamic updating mechanism is used to adjust the importance of the features. Finally, the various features are combined into fused feature data through multi-dimensional feature fusion. Based on the fused feature data, intrusion detection analysis is performed. Abnormal traffic is detected through traffic baseline calculation, and specific attack features are identified through attack pattern matching. The identified attack behaviors are assessed for harm degree, and the risk level is quantified. The attack type is determined according to the threat level division, the corresponding defense strategy and disposal suggestion are formulated, and finally a standardized intrusion detection report is generated.

[0016] For example, during the data collection phase, it is recorded that the CPU usage suddenly soared from the normal 30% to 95%, and a large number of abnormal external requests were detected. After cleaning and standardizing these raw data, they are divided into a high-performance device group for training. During local training, parameters are continuously optimized through gradient calculation, and privacy protection processing is performed before uploading. After feature migration, the system captures typical DDoS attack feature patterns: high-frequency access requests in a short period of time, fixed target addresses, uniform request time intervals, etc. After fusion analysis of these features, the system determines that this is a high-risk level DDoS attack, and provides corresponding protection suggestions in the detection report. The entire process demonstrates the effectiveness and practical value of the method in actual scenarios.

[0017] In the embodiments of the present application, by cleaning and standardizing the device running data, network communication data, and application interaction data, the data quality and usability are effectively improved, laying a reliable foundation for subsequent analysis. The process of dividing the initial training data according to device distribution and initializing training parameters and aggregation parameters realizes the rational allocation of computing tasks and makes full use of distributed computing resources. In the local model training and global weight updating stage, through a secure parameter aggregation mechanism, data privacy is protected and the performance of the model is continuously optimized. The design of feature migration and space mapping significantly improves the generalization ability of the model, enabling the detection system to quickly adapt to new application scenarios. The fusion of time series features, statistical features, and relationship features enhances the comprehensiveness and discriminability of feature representation, improving the accuracy of anomaly detection. Finally, through traffic anomaly analysis, attack feature identification, and risk level assessment of the fused feature data, a complete intrusion detection report is formed, providing strong support for security protection. This multi-level feature processing and analysis method not only improves the accuracy and real-time performance of the detection, but also reduces the false positive rate of the system. At the same time, the distributed architecture based on federated learning significantly reduces the communication overhead and improves the overall efficiency of the system.

[0018] In a specific embodiment, the process of performing step S101 can specifically include the following steps: (1) Data format parsing processing is performed according to the multi-source heterogeneous data to extract device running data, network communication data, and application interaction data; (2) The device running data is subjected to numerical range detection processing to eliminate abnormal data points, thereby obtaining first processed data; (3) The network communication data is subjected to data integrity detection processing to eliminate damaged data packets, thereby obtaining second processed data; (4) The application interaction data is subjected to validity verification processing to eliminate invalid interaction records, thereby obtaining third processed data; (5) The first processed data, the second processed data, and the third processed data are subjected to data cleaning processing to remove duplicate records, thereby obtaining cleaned data; (6) The cleaned data is subjected to numerical normalization and format unification processing, thereby obtaining initial training data.

[0019] Specifically, different types of data generated by the Internet of Things device are subjected to format parsing. The data format parsing processing separates the device running data, the network communication data, and the application interaction data from the original data stream by identifying the data header information, parsing the data structure, and extracting the valid fields. The device running data includes indicators such as CPU occupancy, memory usage, and disk read / write speed; the network communication data records information such as data packet size, transmission protocol, source / destination address; and the application interaction data includes API call time, request parameters, and return results. For the extracted device running data, abnormal points are eliminated through numerical range detection. The numerical range detection sets a reasonable threshold interval based on historical statistical rules, and marks and eliminates data points that are outside the interval. For example, for CPU occupancy data, an effective interval of [0%, 100%] can be set to eliminate obviously abnormal negative values or data points exceeding 100%. At the same time, in combination with the correlation rules between indicators, data combinations that do not conform to the normal working state are identified. The first processed data obtained through this processing is more true and reliable.

[0020] For network communication data, corrupted data packets need to be removed through data integrity checks. Data integrity checks identify data packets corrupted during transmission through methods such as checksum calculation, header integrity verification, and protocol format checks. For example, it checks whether the TCP packet checksum is correct, whether the IP header length is valid, and whether protocol fields conform to specifications. The second-processed data obtained through this process ensures the integrity of network communication records. Application interaction data needs to undergo validity verification to remove invalid interaction records. Validity verification includes multiple dimensions such as request validity checks, parameter format verification, and business logic verification. For example, it verifies whether API calls contain necessary authentication information, whether request parameters conform to interface specifications, and whether operation sequences meet business constraints. The third-processed data obtained through this process guarantees the validity of the interaction behavior.

[0021] The three types of processed data require data cleaning to remove duplicate records. The data cleaning process identifies duplicate data through timestamp comparison, content feature matching, and association rule verification. For example, it merges duplicate sampled data from the same time point, deletes duplicate data packets caused by network retransmissions, and removes duplicate submissions of the same requests. The dataset obtained through cleaning is more concise and accurate.

[0022] Finally, the cleaned data undergoes normalization and format standardization. Data normalization maps indicators with different dimensions to the [0,1] interval, eliminating the influence of different dimensions. Format standardization converts data from different sources into a unified data structure and representation, facilitating subsequent processing. For example, timestamps in different formats are standardized to a standard time format, and performance indicators in different units are standardized to the same unit of measurement. The resulting initial training data has good standardization and processability.

[0023] In one specific embodiment, the process of performing step S102 may specifically include the following steps: (1) The initial training data is processed in layers by evaluating the equipment performance, and equipment group data is generated according to the processing capacity and storage capacity; (2) The equipment group data is processed by dividing it into resource thresholds, and the training batches are divided according to the computing load and memory usage to obtain the equipment training parameters; (3) The training parameters of the equipment are allocated to the training rounds through the data distribution mechanism, and the training cycle and batch size are allocated to each terminal to obtain the training configuration data; (4) The training configuration data is encrypted using a secure encryption protocol to establish a secure communication channel between terminals and obtain encrypted training data; (5) Initialize the encrypted training data by calculating aggregate weights, set the global aggregation period and participation rate threshold, and obtain the aggregation configuration data; (6) Combine and map the aggregation configuration data and the encrypted training data to form a basic training set.

[0024] Specifically, the performance of the Internet of Things terminal device is evaluated. The performance evaluation evaluates the device from two dimensions of processing capability and storage capacity. The processing capability includes CPU frequency, core number, instruction set, and the like, and the storage capacity includes memory size, storage space, and the like. Through the performance evaluation, the device is classified, and the initial training data is divided into layers according to the device performance level to generate device grouping data. For the device grouping data, the training batch is divided based on the resource threshold. The resource threshold mainly considers two key indicators of computing load and memory occupation. The computing load reflects the computing resource consumption of the device, and the memory occupation represents the storage resource usage in the training process. According to these indicators, the appropriate training batch size is determined for devices of different performance levels to generate corresponding device training parameters.

[0025] For the determined device training parameters, the training round is allocated through a data distribution mechanism. The data distribution mechanism allocates appropriate training period and batch size to each terminal according to the performance level and network connection status of the device. High-performance devices are allocated more training rounds and larger batch size, and low-performance devices use smaller training size to avoid resource exhaustion. The training configuration data obtained in this way ensures the reasonable allocation of the training task. In order to ensure the security of the training process, the training configuration data needs to be encrypted. The encryption processing uses a secure encryption protocol to encrypt and protect the training parameters, and at the same time establishes a secure communication channel between the terminals. The encryption protocol uses a public key encryption system to ensure the security of the data in the parameter transmission process. The encrypted training data obtained through this process can be safely transmitted in the network.

[0026] For the encrypted training data, parameter initialization is needed through aggregation weight calculation. The aggregation weight calculation considers factors such as data quality and computing contribution of the device, and sets reasonable global aggregation period and participation rate threshold. The aggregation period determines the frequency of model updates, and the participation rate threshold controls the number of devices participating in each round of training. The aggregation configuration data obtained in this way provides control parameters for the subsequent training process. Finally, the aggregation configuration data and the encrypted training data are combined and mapped. The combination mapping establishes the correspondence between the configuration parameters and the training data, and integrates information such as training task, data size, and update strategy. Through this process, a complete basic training set is formed, which provides input data for subsequent federated learning training. These data contain all the information required for training, including original data, training parameters, security mechanisms, and aggregation strategies.

[0027] In a specific embodiment, the process of performing step S103 can specifically include the following steps: (1) Perform local training processing on the basic training set through iterative gradient calculation, calculate the parameter update amount of each terminal, and obtain the local training result; (2) Perform gradient perturbation processing on the local training result through the differential privacy mechanism, add random noise to protect data privacy, and obtain encrypted gradient data; (3) Perform parameter upload processing on the encrypted gradient data through a secure transmission channel, transmit to the edge service node, and obtain regional aggregation data; (4) Perform intermediate aggregation processing on the regional aggregation data through the weight balancing mechanism, fuse the training results of terminals within the region, and obtain intermediate parameter data; (5) Perform parameter update processing on the intermediate parameter data through the global aggregation protocol, complete global model update on the cloud server, and obtain global parameter data; (6) Perform parameter decomposition processing on the global parameter data through the feature extraction method to generate a feature parameter set.

[0028] Specifically, the basic training set is processed through iterative gradient calculation. Iterative gradient calculation uses the gradient descent method to continuously optimize model parameters through multiple iterations. In each iteration, the gradient of the loss function with respect to the parameters is calculated, and the parameter value is updated according to the learning rate. For each terminal, its own parameter update amount is calculated independently, and the gradient change in each iteration is recorded. The local training result obtained in this way reflects the training effect of each terminal based on local data. In order to protect data privacy, differential privacy processing is required for the local training result. The differential privacy mechanism protects the privacy of the original data by adding random noise to the gradient. The size of the noise is controlled by the privacy budget parameter, and a larger privacy budget provides stronger privacy protection but may affect model performance. The processed encrypted gradient data not only retains the effective information of the training, but also ensures that the original data cannot be deduced inversely.

[0029] The encrypted gradient data needs to be uploaded to the edge service node through a secure transmission channel. The secure transmission channel uses an encryption communication protocol to ensure that the data is not stolen or tampered with during transmission. The edge service node collects gradient data uploaded by all terminals within the region to form regional aggregation data. These data contain the training result information of all terminals within the region. The collected regional aggregation data is processed through the weight balancing mechanism for intermediate aggregation. The weight balancing mechanism considers factors such as data quality and calculation contribution of terminals to allocate reasonable weights to the training results of different terminals. The training results within the region are fused through weighted averaging to obtain intermediate parameter data reflecting regional characteristics.

[0030] The intermediate parameter data is then updated by a global aggregation protocol. Global aggregation is performed on a cloud server, integrating intermediate parameters from different regions. The aggregation process takes into account the differences in data distribution between regions, ensuring the accuracy of the aggregation results through protocol rules. The resulting global parameter data reflects the training contributions of all terminals. Finally, feature extraction and parameter decomposition are performed on the global parameter data. The feature extraction method identifies important feature patterns from the global parameters, including temporal features and statistical features. Parameter decomposition splits complex parameter structures into basic feature components, facilitating subsequent feature transfer and pattern recognition. The resulting feature parameter set contains complete feature information, laying the foundation for subsequent intrusion detection analysis.

[0031] In a specific embodiment, the process of performing step S104 can specifically include the following steps: (1) performing feature extraction processing on the feature parameter set by feature decomposition to separate source domain features and target domain features, and obtaining feature division data; (2) performing mapping relationship processing on the feature division data by shared feature calculation to establish a correspondence between domain features, and obtaining feature mapping data; (3) performing feature alignment processing on the feature mapping data by distribution distance calculation to reduce feature distribution differences, and obtaining aligned feature data; (4) performing gradual transfer processing on the aligned feature data by feature level division, and transferring layer by layer according to feature complexity, and obtaining layered feature data; (5) performing transfer effect processing on the layered feature data by feature evaluation index, calculating the feature transfer degree, and obtaining feature evaluation data; (6) performing feature merging processing on the feature evaluation data by feature fusion method, and generating a transfer feature set.

[0032] Specifically, in the feature transfer and spatial mapping phase, the feature parameter set is first processed by feature decomposition. The feature decomposition process uses principal component analysis to separate complex feature parameters into source domain features and target domain features. Source domain features come from existing training data and contain known attack patterns and behavior features; target domain features come from new application scenarios and reflect feature distribution in new environments. Feature division data obtained by feature decomposition clearly distinguishes the feature properties of different domains. For feature division data, a mapping relationship between domains needs to be established by shared feature calculation. Shared feature calculation is based on feature similarity measurement and identifies feature patterns common to source and target domains. The calculation process includes correlation analysis of feature vectors, semantic similarity calculation, etc. This mapping relationship establishes a correspondence between features in different domains, forming feature mapping data.

[0033] For the established feature mapping data, feature alignment is performed through distribution distance calculation. Distribution distance calculation uses statistical measures such as maximum mean difference to calculate the difference between the source domain and the target domain feature distribution. By minimizing the distribution distance, the feature representation is adjusted to align between different domains. The aligned feature data obtained in this way reduces the distribution difference between domains. The aligned feature data needs to be gradually migrated through feature level division. The gradual migration strategy is layered according to the complexity of the features, starting from the bottom layer of simple features and gradually migrating to the top layer of complex features. This hierarchical migration method can effectively control the stability of the migration process and obtain structured hierarchical feature data.

[0034] For hierarchical feature data, feature evaluation indicators are needed to measure the migration effect. Feature evaluation uses multiple indicators, including feature retention rate, distribution consistency, recognition accuracy, etc. Through these indicators, the degree of feature migration is calculated to evaluate the effectiveness of the migration process. The evaluation results form feature evaluation data to provide guidance for feature fusion. Finally, the feature evaluation data is merged through feature fusion methods. Feature fusion uses a weighted combination method to assign weights to features at different levels according to the evaluation results. The fusion process considers the importance, reliability and migration effect of the features, and integrates multiple levels of features into a unified feature representation.

[0035] In a specific embodiment, the process of performing step S105 can specifically include the following steps: (1) Perform sequence decomposition processing on the migration feature set through time series dimension analysis to extract periodic patterns in the time series features and obtain time series analysis data; (2) Perform feature statistical processing on the time series analysis data through statistical quantity calculation to extract distribution rules in the statistical features and obtain statistical analysis data; (3) Perform relationship analysis processing on the statistical analysis data through correlation mining to extract topological structures in the relationship features and obtain relationship analysis data; (4) Perform weight allocation processing on the time series analysis data, statistical analysis data and relationship analysis data through feature correlation calculation to obtain feature weight data; (5) Perform weight adjustment processing on the feature weight data through a dynamic update mechanism to calculate the importance of the features and obtain weight update data; (6) Perform feature combination processing on the weight update data through multi-dimensional feature fusion to generate fused feature data.

[0036] Specifically, the migration feature set is analyzed in the time dimension. The time dimension analysis adopts a sequence decomposition method to decompose the time series data into trend components, seasonal components, and random components. By analyzing the periodic patterns in the time series features, the regularity of attack behavior in the time dimension is identified. The time series analysis data obtained through this process reflects the time evolution characteristics of attack behavior. For the time series analysis data, statistical processing is performed through statistical quantity calculation. Statistical quantity calculation includes the calculation of basic statistical quantities (mean, variance, skewness, kurtosis) and high-order statistical quantities, and the distribution law is extracted from the statistical features. These statistical indicators describe the distribution characteristics of attack behavior, including central tendency, dispersion degree, and distribution form. The statistical analysis data obtained through statistical processing describes the statistical law of attack behavior.

[0037] For the statistical analysis data, relationship analysis is needed through association mining. Association mining is based on graph theory and network analysis methods to extract topological structure information from relationship features. The analysis process includes multiple dimensions such as node connection relationship, path characteristics, and community structure, revealing the association patterns between attack behaviors. The relationship analysis data obtained in this way reveals the network structure characteristics of attack behavior. For the three types of analysis data obtained, weight allocation is performed through feature correlation calculation. Feature correlation calculation is based on mutual information, Pearson correlation coefficient, and other measurement indicators to evaluate the correlation strength between different features. According to the correlation analysis results, the time series features, statistical features, and relationship features are reasonably weighted to form feature weight data.

[0038] Feature weight data needs to be adjusted through a dynamic updating mechanism. The dynamic updating mechanism calculates the importance of the features in real time according to the recognition effect and environmental changes of the features. The updating process considers the stability, discriminability, and timeliness of the features to dynamically adjust the feature weights. The weight update data obtained in this way can adapt to the dynamic changes of the network environment. Finally, the weight update data is combined through multi-dimensional feature fusion. Multi-dimensional feature fusion adopts a weighted combination method to integrate features of different dimensions according to the updated weights. The fusion process maintains the advantages of various features while improving the comprehensiveness of feature representation. The fusion feature data generated in this way provides complete feature description for subsequent intrusion detection.

[0039] In a specific embodiment, the process of performing step S106 can specifically include the following steps: (1) Perform anomaly detection processing on the fusion feature data through traffic baseline calculation, mark abnormal traffic data points, and obtain traffic analysis data; (2) Perform feature recognition processing on the traffic analysis data through attack pattern matching to identify attack behavior features, and obtain attack recognition data; (3) The attack identification data is processed by risk calculation through hazard degree evaluation, the attack hazard level is quantified, and risk evaluation data is obtained; (4) The risk evaluation data is classified by threat level division, the attack type and risk level are determined, and threat classification data is obtained; (5) The threat classification data is disposed by defense strategy generation, the defense countermeasures are formulated, and disposal scheme data is obtained; (6) The disposal scheme data is formatted by report generation rules, and an intrusion detection report is generated.

[0040] Specifically, the fusion feature data is detected for anomaly through traffic baseline calculation. The traffic baseline calculation establishes a normal behavior model based on historical data, including baseline values of multiple dimensions such as traffic size, access frequency, and protocol distribution. Through deviation analysis with baseline values, data points that obviously deviate from the normal range are marked. These abnormal points may represent potential attack behaviors, forming traffic analysis data. For the traffic analysis data, attack pattern matching is used for feature recognition. Attack pattern matching is based on a predefined attack feature library, which contains feature descriptions of known attack types. The matching process compares the detected abnormal behavior with the attack features through feature similarity calculation, and identifies the specific attack behavior features. The attack identification data obtained in this way contains detailed attack feature information.

[0041] For the identified attack behavior, risk calculation is needed through hazard degree evaluation. The hazard degree evaluation quantitatively analyzes from multiple angles such as attack influence range, damage degree, and duration. The evaluation process considers factors such as the importance of affected assets, vulnerability exploitation difficulty, and attack success probability, and obtains specific risk evaluation data. The risk evaluation data is classified by threat level division. Threat level division divides different types of attack behaviors into different risk levels based on risk scoring standards. The classification process considers the technical features and actual hazards of attacks, and determines the specific risk level for each attack. The threat classification data obtained in this way clearly shows the type and severity of the attack.

[0042] For the classified threats, a disposal suggestion is made through defense strategy generation. The defense strategy generation is based on attack features and system protection capabilities to develop corresponding defense measures for different types of attacks. The disposal suggestion includes immediate response schemes, protection configuration adjustments, system reinforcement suggestions, etc., forming complete disposal scheme data. Finally, the disposal scheme data is formatted through report generation rules. The report generation follows standardized template specifications to integrate detection results, risk assessments, and disposal suggestions into a standardized report format. The generated intrusion detection report contains complete information such as attack details, risk levels, and disposal schemes, providing decision support for security operation personnel. The report adopts a clear structure and professional description to ensure accurate information transmission.

[0043] The above describes the 5G IoT intrusion detection method based on federated transfer learning in the embodiments of the present application. The 5G IoT intrusion detection system based on federated transfer learning in the embodiments of the present application is described below. Please refer to Figure 2 An embodiment of the 5G IoT intrusion detection system based on federated transfer learning in the embodiments of the present application includes: The processing module 201 is configured to clean and standardize the device operation data, network communication data, and application interaction data according to the multi-source heterogeneous data generated by the IoT device, to obtain initial training data. The division module 202 is configured to divide the initial training data according to device distribution, and initialize the training parameters and aggregation parameters to obtain a basic training set. The update module 203 is configured to perform local model training and global weight update processing on the basic training set, aggregate the training results of each terminal, and obtain a feature parameter set. The transfer module 204 is configured to perform feature transfer and spatial mapping processing on the source domain features and target domain features in the feature parameter set, align the feature distribution, and obtain a transfer feature set. The extraction module 205 is configured to perform fusion and pattern extraction processing on the time series features, statistical features, and relationship features in the transfer feature set, dynamically allocate feature weights, and obtain fusion feature data. The generation module 206 is configured to perform traffic anomaly analysis, attack feature identification, and risk level evaluation processing on the fusion feature data, and generate an intrusion detection report containing attack types, risk levels, and disposal suggestions.

[0044] Through the cooperation of the above components, by cleaning and standardizing the device operation data, network communication data and application interaction data, the data quality and availability are effectively improved, laying a reliable foundation for subsequent analysis. The process of dividing the initial training data according to the device distribution and initializing the training parameters and aggregation parameters realizes the reasonable allocation of computing tasks and fully utilizes distributed computing resources. In the local model training and global weight updating stage, through the safe parameter aggregation mechanism, the data privacy is protected and the continuous optimization of the model performance is ensured. The design of feature migration and space mapping significantly improves the generalization ability of the model, enabling the detection system to quickly adapt to new application scenarios. The fusion processing of time series features, statistical features and relationship features enhances the comprehensiveness and discriminability of feature representation, and improves the accuracy of anomaly detection. Finally, through the traffic anomaly analysis, attack feature identification and risk level evaluation of the fused feature data, a complete intrusion detection report is formed, providing strong support for security protection. This multi-level feature processing and analysis method not only improves the accuracy and real-time performance of the detection, but also reduces the false positive rate of the system. At the same time, the distributed architecture based on federated learning significantly reduces the communication overhead and improves the overall efficiency of the system.

[0045] The above-described and above-embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A 5G Internet of Things intrusion detection method based on federal transfer learning, characterized in that, The 5G Internet of Things intrusion detection method based on federal transfer learning comprises: According to the multi-source heterogeneous data generated by the Internet of Things device, the device running data, network communication data and application interaction data are cleaned and standardized to obtain initial training data; The initial training data is divided according to the device distribution, and the training parameters and aggregation parameters are initialized to obtain a basic training set; The basic training set is subjected to local model training and global weight updating, and the training results of each terminal are aggregated to obtain a feature parameter set; The source domain features and target domain features in the feature parameter set are subjected to feature transfer and spatial mapping, and the feature distribution is aligned to obtain a migration feature set; The time sequence features, statistical features and relationship features in the migration feature set are fused and mode extracted, and the feature weights are dynamically allocated to obtain fusion feature data; The fusion feature data is subjected to traffic anomaly analysis, attack feature identification and risk level evaluation to generate an intrusion detection report containing attack type, risk level and disposal suggestion.

2. The federated transfer learning based 5G IoT intrusion detection method of claim 1, wherein, According to the multi-source heterogeneous data generated by the Internet of Things device, the device running data, network communication data and application interaction data are cleaned and standardized to obtain initial training data, comprising: According to the data format analysis of the multi-source heterogeneous data, the device running data, network communication data and application interaction data are extracted; The device running data is subjected to numerical range detection to eliminate abnormal data points to obtain first processing data; The network communication data is subjected to data integrity detection to eliminate damaged data packets to obtain second processing data; The application interaction data is subjected to validity verification to eliminate invalid interaction records to obtain third processing data; The first processing data, second processing data and third processing data are subjected to data cleaning to remove duplicate records to obtain cleaned data; The cleaned data is subjected to numerical normalization and format unification to obtain the initial training data.

3. The federated transfer learning based 5G IoT intrusion detection method of claim 1, wherein, The initial training data is divided according to the device distribution, and the training parameters and aggregation parameters are initialized to obtain a basic training set, comprising: The initial training data is subjected to hierarchical processing through device performance evaluation, and device grouping data is generated according to processing capacity and storage capacity; The device grouping data is subjected to resource threshold division to divide training batches according to calculation load and memory occupation to obtain device training parameters; The device training parameters are subjected to training round allocation through a data distribution mechanism to allocate training period and batch size to each terminal to obtain training configuration data; The training configuration data is subjected to parameter encryption through a secure encryption protocol to establish a secure communication channel between terminals to obtain encrypted training data; The encrypted training data is subjected to parameter initialization through aggregation weight calculation to set a global aggregation period and participation rate threshold to obtain aggregation configuration data; The aggregation configuration data and the encrypted training data are subjected to combined mapping to form the basic training set.

4. The federated transfer learning based 5G IoT intrusion detection method of claim 1, wherein, The local model training and global weight updating processing are performed on the basic training set, the training results of each terminal are aggregated, and a feature parameter set is obtained, including: The local training processing is performed on the basic training set through iterative gradient calculation, the parameter update amount of each terminal is calculated, and a local training result is obtained; The local training result is subjected to gradient perturbation processing through a differential privacy mechanism, random noise is added to protect data privacy, and encrypted gradient data is obtained; The encrypted gradient data is subjected to parameter uploading processing through a secure transmission channel and is transmitted to an edge service node to obtain regional aggregation data; The regional aggregation data is subjected to intermediate aggregation processing through a weight balancing mechanism, the training results of terminals within the region are fused, and intermediate parameter data is obtained; The intermediate parameter data is subjected to parameter updating processing through a global aggregation protocol, global model updating is completed on a cloud server, and global parameter data is obtained; The global parameter data is subjected to parameter decomposition processing through a feature extraction method, and the feature parameter set is generated.

5. The federated transfer learning based 5G IoT intrusion detection method according to claim 1, wherein, The source domain feature and the target domain feature in the feature parameter set are subjected to feature migration and spatial mapping processing, the feature distribution is aligned, and a migration feature set is obtained, including: The feature parameter set is subjected to feature extraction processing through feature decomposition, the source domain feature and the target domain feature are separated, and feature division data is obtained; The feature division data is subjected to mapping relationship processing through shared feature calculation, the corresponding relationship between the features of different domains is established, and feature mapping data is obtained; The feature mapping data is subjected to feature alignment processing through distribution distance calculation, the feature distribution difference is reduced, and aligned feature data is obtained; The aligned feature data is subjected to gradual migration processing through feature hierarchical division, and is migrated layer by layer according to the feature complexity, and layered feature data is obtained; The layered feature data is subjected to migration effect processing through a feature evaluation index, the feature migration degree is calculated, and feature evaluation data is obtained; The feature evaluation data is subjected to feature merging processing through a feature fusion method, and the migration feature set is generated.

6. The federated transfer learning based 5G IoT intrusion detection method according to claim 1, wherein, The time sequence feature, the statistical feature, and the relationship feature in the migration feature set are subjected to fusion and mode extraction processing, and the feature weight is dynamically allocated, and fusion feature data is obtained, including: The migration feature set is subjected to sequence decomposition processing through time sequence dimension analysis, the periodic pattern in the time sequence feature is extracted, and time sequence analysis data is obtained; The time sequence analysis data is subjected to feature statistical processing through statistical quantity calculation, the distribution law in the statistical feature is extracted, and statistical analysis data is obtained; The statistical analysis data is subjected to relationship analysis processing through association mining, the topological structure in the relationship feature is extracted, and relationship analysis data is obtained; The time sequence analysis data, the statistical analysis data, and the relationship analysis data are subjected to weight allocation processing through feature correlation calculation, and feature weight data is obtained; The feature weight data is subjected to weight adjustment processing through a dynamic updating mechanism, the feature importance degree is calculated, and weight updating data is obtained; The weight update data is subjected to multi-dimensional feature fusion for feature combination processing to generate the fusion feature data.

7. The federated transfer learning based 5G IoT intrusion detection method of claim 1, wherein, The fusion feature data is subjected to traffic anomaly analysis, attack feature identification and risk level assessment processing to generate an intrusion detection report containing attack type, risk level and disposal suggestion, including: The fusion feature data is subjected to anomaly detection processing through traffic baseline calculation to mark abnormal traffic data points and obtain traffic analysis data; The traffic analysis data is subjected to feature identification processing through attack mode matching to identify attack behavior features and obtain attack identification data; The attack identification data is subjected to risk calculation processing through damage degree assessment to quantify attack damage level and obtain risk assessment data; The risk assessment data is subjected to classification processing through threat level division to determine attack type and risk level and obtain threat classification data; The threat classification data is subjected to disposal suggestion processing through defense strategy generation to develop defense countermeasures and obtain disposal scheme data; The disposal scheme data is subjected to formatting processing through report generation rules to generate the intrusion detection report. 8.A 5G IoT intrusion detection system based on federated transfer learning, used to implement the 5G IoT intrusion detection method based on federated transfer learning as claimed in any one of claims 1-7, characterized in that, The 5G Internet of Things intrusion detection system based on federal transfer learning includes: A processing module is configured to clean and standardize device running data, network communication data and application interaction data based on multi-source heterogeneous data generated by Internet of Things devices to obtain initial training data; A division module is configured to divide the initial training data according to device distribution, and initialize training parameters and aggregation parameters to obtain a basic training set; An update module is configured to train the basic training set locally and update global weights, aggregate training results of each terminal, and obtain a feature parameter set; A transfer module is configured to transfer and spatially map source domain features and target domain features in the feature parameter set, align feature distribution, and obtain a transfer feature set; An extraction module is configured to fuse and extract time sequence features, statistical features and relationship features in the transfer feature set, dynamically allocate feature weights, and obtain fusion feature data; A generation module is configured to analyze the fusion feature data for traffic anomaly, identify attack features and assess risk levels to generate an intrusion detection report containing attack type, risk level and disposal suggestion.

Images