A federated learning backdoor attack detection method and device for a UAV network

Abstract

The application provides a federated learning backdoor attack detection method and device for a UAV network, and relates to the technical fields of UAV network and federated learning security. The method comprises the following steps: in each round of the decentralized federated learning, a server calculates the relative model deviation between its model parameters and the model parameters of adjacent servers, and further calculates the deviation change rate; when the change rate exceeds a preset threshold, the model parameters are rolled back and the round is marked as abnormal; then, the UAVs in the abnormal round are given instantaneous scores and time average scores, and the scores are integrated into a comprehensive malicious score through exponential operation; finally, a clustering algorithm is used to perform two classification on the comprehensive malicious scores of all UAVs, and according to the comparison of the number of UAVs in the clustering results, the group with less number is determined as a set of malicious UAVs. The application can effectively identify and locate backdoor attacks, and improve the security and robustness of federated learning of the UAV network.

Description

Technical Field

[0001] This invention relates to the field of unmanned aerial vehicle (UAV) network and federated learning security technology, specifically a method and apparatus for detecting backdoor attacks in federated learning systems for UAV networks. Background Technology

[0002] In recent years, unmanned aerial vehicle (UAV) networks have been widely used in edge computing and collaborative inference tasks due to their flexible deployment and wide-area coverage capabilities. To achieve efficient model training while protecting data privacy, federated learning has been introduced into UAV networks, forming a decentralized federated learning architecture. However, the limited computing power of UAV nodes, the dynamic changes in network topology, and the anonymity of nodes in this architecture make the system highly vulnerable to backdoor attacks. Existing defense methods are mainly divided into two categories: attack mitigation and backdoor filtering. While attack mitigation methods can reduce the impact of attacks to some extent, they cannot completely eliminate backdoors. Backdoor filtering methods rely on distance metrics or gradient direction analysis to detect malicious updates, but their effectiveness is limited when facing highly concealed and diverse advanced backdoor attacks, and they are difficult to adapt to the propagation characteristics of attacks in decentralized environments.

[0003] Furthermore, most existing methods focus on filtering malicious updates, neglecting the challenge of locating the source of attacks in dynamic, anonymous drone networks. Due to the lack of an effective mechanism for identifying malicious drones, even if a backdoor attack is detected, the system cannot fundamentally block the attack source, leading to the continued spread of the attack and severely impacting model security and system reliability. Therefore, how to efficiently filter backdoor updates while accurately locating malicious drones has become a key challenge in improving the security of drone federated learning. Summary of the Invention

[0004] To address the technical problems mentioned in the background section, this invention proposes a federated learning backdoor attack detection method and apparatus for unmanned aerial vehicle (UAV) networks.

[0005] Therefore, the technical solution adopted by the present invention is as follows:

[0006] S1: In each round of decentralized federated learning, after the server updates the model parameters using drone data, it calculates the relative model deviation between the server model parameters and the model parameters of adjacent servers, and calculates the rate of change of the relative model deviation between the current round and the previous round to obtain the deviation gradient; when the deviation gradient exceeds a preset threshold, the server model parameters are rolled back to the state of the previous round, and the round is marked as an abnormal round.

[0007] S2: Perform instantaneous scoring and time-averaged scoring on the drones in the abnormal rounds; integrate the instantaneous scores and time-averaged scores through exponential calculation to generate a comprehensive malicious score;

[0008] S3: Use the K-means clustering algorithm to perform binary classification on the comprehensive malicious score of all drones to obtain two sets of clustering results; compare the number of drones contained in the two sets of clustering results, and determine the malicious drones in combination with the preset judgment rules.

[0009] Furthermore, the update process of the model parameters follows the gradient descent algorithm.

[0010] Furthermore, the calculation process for the relative model deviation is as follows:

[0011] In the round In this process, the server uses the collected drone data to complete local training and obtain the updated model parameters;

[0012] The server communicates with all neighboring servers in the decentralized drone network topology to obtain their current model parameters;

[0013] Calculate the difference norm between the model parameters and the parameters of each neighboring model, and take the average value as the relative model bias. The calculation formula is as follows.

[0014]

[0015] in, For rounds Chinese server The relative model bias, To communicate with the server The number of adjacent servers, For rounds Chinese server The parameters of the l-th layer model in the model, For rounds The nth one with the server The model parameters of layer l in adjacent servers, Let L be the L2 norm, and L be the total number of layers in the model.

[0016] Furthermore, the formula for calculating the deviation gradient is as follows:

[0017]

[0018] in, For rounds Chinese server The deviation gradient;

[0019] Set a deviation threshold, and perform the following operation when the deviation gradient is greater than the deviation threshold:

[0020] The server i performs a parameter rollback operation to restore the model parameters to the state of the previous round;

[0021] Mark round τ as an abnormal round of server i and record it in the abnormal round set.

[0022] Furthermore, the setting of the deviation threshold is mainly based on the following three aspects:

[0023] By collecting a large amount of historical data from normal training processes, we statistically analyze the distribution characteristics of the gradient relative to the model deviation during benign model updates.

[0024] By balancing the security requirements of drone networks with the efficiency of model training, the optimal threshold is selected by adjusting the threshold on the validation set and evaluating the detection accuracy and false alarm rate. This allows the system to effectively detect backdoor attacks without excessively interfering with normal training.

[0025] In actual deployment, an adaptive threshold mechanism is adopted to dynamically adjust the deviation threshold according to the system's operating status.

[0026] Furthermore, the formula for calculating the instantaneous score is as follows:

[0027]

[0028] in, Set of abnormal rounds Chinese drones Instantaneous score, In abnormal rounds In the middle, when drones The drone group that provides data to server i At that time, the server The resulting bias gradient, Abnormal round The drone group provides data to server i;

[0029] The formula for calculating the average score over time is as follows:

[0030]

[0031] in, Set of abnormal rounds Chinese drones Average score over time This is a status indicator function, representing the state when an abnormal cycle occurs. The deviation gradient is greater than the deviation threshold, and the drone... In abnormal rounds When sending data to server i, ,otherwise , This represents the number of abnormal rounds.

[0032] Furthermore, the formula for calculating the comprehensive maliciousness score is as follows:

[0033]

[0034] in, Drones that provide data to server i The overall malicious rating.

[0035] Furthermore, the implementation process of the K-means clustering algorithm is as follows:

[0036] Step 1: Construct a malicious rating set;

[0037] Step 2: Randomly select one of the comprehensive malicious scores from the malicious score set as the first initial center for clustering;

[0038] Calculate the Euclidean distance between each of the comprehensive malicious scores in the malicious score set and the first initial center, and select the comprehensive malicious score with the largest Euclidean distance as the second initial center;

[0039] Step 3: Calculate the Euclidean distance between each of the comprehensive malicious scores and the first and second initial centers respectively, and assign the comprehensive malicious scores to the initial centers with the closest Euclidean distance to obtain two initial clusters;

[0040] Step 4: Calculate the mean of all the comprehensive malicious scores in the two initial clusters, and use the mean as the new cluster center;

[0041] Step 5: Iterate through steps 3 and 4 until the absolute value of the difference between two consecutive cluster centers is less than the preset iteration threshold or the preset maximum number of iterations is reached, then end the iteration.

[0042] Step 6: Finally, two sets of clustering results are obtained, which include all drones and do not overlap with each other;

[0043] The rules for determining malicious drones are as follows:

[0044] Calculate the difference in the comprehensive malice scores of the two cluster centers and set a score difference threshold;

[0045] When the absolute value of the difference is greater than or equal to the scoring difference threshold, the drones in the clustering results with fewer drones are marked as a malicious drone set;

[0046] The identity information of malicious drones is recorded in a blacklist, and data from these drones in subsequent rounds will be directly rejected, thus blocking the propagation path of backdoor attacks from the source.

[0047] When the absolute value of the difference is less than the scoring difference threshold or the ratio of the difference between the number of drones in the two groups to the total number of drones is less than the preset quantity threshold, it is determined that there are no clearly malicious drones, only abnormal round records are retained, and no blacklist is marked.

[0048] A federated learning backdoor attack detection device for unmanned aerial vehicle (UAV) networks, the device comprising:

[0049] Anomaly detection and filtering module: In each round of decentralized federated learning, after the server updates the model parameters using drone data, it calculates the relative model deviation between the server's model parameters and those of adjacent servers, and calculates the rate of change of the relative model deviation between the current round and the previous round to obtain the deviation gradient; when the deviation gradient exceeds a preset threshold, the server's model parameters are rolled back to the state of the previous round, and the round is marked as an abnormal round;

[0050] Scoring module: performs instantaneous scoring and time-averaged scoring on drones in the abnormal rounds; integrates the instantaneous scoring and time-averaged scoring through exponential calculation to generate a comprehensive malicious score;

[0051] Identification and localization module: The K-means clustering algorithm is used to perform binary classification on the comprehensive maliciousness score of all drones, resulting in two sets of clustering results; the number of drones included in the two sets of clustering results is compared, and malicious drones are determined in combination with preset judgment rules.

[0052] Compared with the prior art, the advantages of the present invention are as follows:

[0053] 1. This invention can proactively block the propagation of attacks by dynamically detecting anomalies and performing model rollbacks based on relative model deviations. Furthermore, by combining malicious scoring and cluster analysis, it can accurately identify malicious drones that launch attacks, curbing subsequent attacks at the source and significantly improving the overall defense depth.

[0054] 2. The detection mechanism proposed in this invention has minimal interference with normal model updates. By analyzing the relative deviation of model parameters rather than their absolute values ​​and comprehensively evaluating instantaneous and long-term behavior, it can effectively distinguish between malicious attacks and benign model fluctuations. While efficiently detecting various advanced backdoor attacks, it minimizes misjudgments of benign drones and normal training processes, thus ensuring the accuracy of the federated learning main task.

[0055] 3. This invention does not rely on a fixed central server or global perspective. Its mechanism based on local relative bias and distributed scoring is naturally suited to the characteristics of dynamic changes in UAV network topology and node anonymity. The introduction of unsupervised clustering makes it possible to identify malicious nodes adaptively based on the current network state without the need for pre-labeled data, thus possessing stronger robustness and practical deployment feasibility. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0058] Figure 2 This is a schematic diagram illustrating the basis for setting the deviation threshold in this invention;

[0059] Figure 3 This is a schematic diagram of the K-means clustering algorithm of the present invention. Detailed Implementation

[0060] To achieve the above objectives, this invention provides a federated learning backdoor attack detection method for unmanned aerial vehicle (UAV) networks. Please refer to [link to relevant documentation]. Figure 1 This includes:

[0061] S1: In each round of decentralized federated learning, after the server updates the model parameters using drone data, it calculates the relative model deviation between the server model parameters and the model parameters of adjacent servers, and calculates the rate of change of the relative model deviation between the current round and the previous round to obtain the deviation gradient; when the deviation gradient exceeds a preset threshold, the server model parameters are rolled back to the state of the previous round, and the round is marked as an abnormal round.

[0062] In the decentralized federated learning architecture of this invention, the models of all servers must meet a consistency benchmark to ensure the validity of the calculation of relative model deviations, specifically including:

[0063] All servers use the same structural model;

[0064] The initial model parameters are generated uniformly by a trusted third party on the network, using a fixed random seed to ensure that the model parameters of all servers are exactly the same before starting training.

[0065] All servers use the same loss function, optimizer, and hyperparameters;

[0066] Before each training round, the hash values ​​of the model parameters are compared to confirm that all models involved in the bias calculation are updated models from the same round. If the hash values ​​are inconsistent, temporary synchronization is triggered, and incremental parameters are transmitted from the server with smaller parameter differences to the server with larger differences. The relative model bias is calculated after all adjacent servers have unified their model versions.

[0067] The model parameters on the server can be represented as follows:

[0068]

[0069] in, For server Model parameters, and Servers The middle model The weight matrix and bias vector of the layer, The number of layers in the model;

[0070] All parameters This forms a multidimensional vector.

[0071] The model update process follows the gradient descent algorithm;

[0072] In this embodiment, Taking a layer-by-layer feedforward neural network as an example, the first layer... A layer can be represented as:

[0073]

[0074] in, This is the output of the l-th layer. For the first , and These are the weight matrix and bias term of the l-th layer, respectively;

[0075] After obtaining the predicted values ​​through forward propagation, the loss function R is calculated, and the gradients of the parameters of each layer are calculated through backpropagation.

[0076]

[0077] in, Let R be the loss function with respect to the weight matrix of the l-th layer. The partial derivatives, For the loss function R with respect to the bias term of the l-th layer The partial derivatives, For the error term of the l-th layer, For the first Transpose the output of the layer;

[0078] Update parameters using gradient descent:

[0079]

[0080] in, This is the preset learning rate.

[0081] Relative model bias is used to quantify the degree of deviation between the server's model state and the current overall consensus state of the system. The calculation process is as follows:

[0082] In the round In this process, the server uses the drone data it collects to complete local training and obtain updated model parameters;

[0083] The server communicates with all neighboring servers in the decentralized drone network topology to obtain their current model parameters;

[0084] Calculate the difference norm between the model parameters and the parameters of each neighboring model, and take the average value as the relative model bias. The calculation formula is as follows:

[0085]

[0086] in, For rounds Chinese server The relative model bias, To communicate with the server The number of adjacent servers, For rounds Chinese server The parameters of the l-th layer model in the model, For rounds The nth one with the server The model parameters of layer l in adjacent servers, It is an L2 norm.

[0087] The bias gradient reflects the relative growth rate of the model parameter bias and is a key indicator for detecting backdoor attacks. The calculation formula is as follows:

[0088]

[0089] in, For rounds Chinese server The deviation gradient;

[0090] Set a deviation threshold, and perform the following actions when the deviation gradient is greater than the deviation threshold:

[0091] Server i immediately performs a parameter rollback operation, restoring the model parameters to the state of the previous round;

[0092] Mark round τ as the abnormal round of server i and record it in the abnormal round set;

[0093] The deviation threshold is set based on the following three main aspects; please refer to [link / reference]. Figure 2 :

[0094] By collecting a large amount of historical data from normal training processes, we statistically analyze the distribution characteristics of the gradient relative to the model deviation during benign model updates.

[0095] By balancing the security requirements of drone networks with the efficiency of model training, the optimal threshold is selected by adjusting the threshold on the validation set and evaluating the detection accuracy and false alarm rate. This allows the system to effectively detect backdoor attacks without excessively interfering with normal training.

[0096] In actual deployment, an adaptive threshold mechanism is adopted to dynamically adjust the deviation threshold according to the system's operating status. The specific operation is as follows:

[0097] In the early stages of training, the model parameters change significantly, so the threshold can be increased appropriately.

[0098] In the later stages of training, the model tends to converge and the parameter changes gradually. The threshold can be appropriately reduced to improve the detection sensitivity.

[0099] By updating the mean and standard deviation in real time through a sliding window, the threshold can be adapted to the features of different training stages.

[0100] To understand why biased gradients can effectively detect backdoor attacks, it is necessary to analyze the mechanism by which backdoor attacks affect model parameters.

[0101] During normal federated learning, when the server updates the model with benign data, the model can make correct predictions based on the learned knowledge, resulting in a small loss function value. Therefore, the update magnitude of the model parameters is moderate, and the relative model bias remains stable.

[0102] When the server receives an update containing backdoor data, the attack causes drastic changes in the model parameters, specifically manifested in the following process:

[0103] Since the original model has not yet learned backdoor trigger patterns, it will predict backdoor data samples with triggers uploaded by malicious drones based on its existing clean knowledge, tending to assign these backdoor samples to the model's original correct category. However, the attackers have maliciously relabeled the tags of these backdoor sample data to the target category. This leads to a significant discrepancy between the model's predictions and the altered labels, specifically manifested as follows:

[0104]

[0105] in, The model's predicted value for backdoor sample data Target category specified by the attacker The losses between The loss between the model's predicted values ​​and the original correct categories;

[0106] This abnormally large prediction error will cause the gradient of the loss function with respect to the parameters to increase during backpropagation. According to the update rule of gradient descent, the update magnitude of the model parameters is proportional to the gradient. Therefore, the model parameters will change drastically. This drastic change will cause a significant deviation between the model parameters of the server affected by the backdoor attack and the model parameters of its neighboring servers, resulting in a sharp increase in the relative model bias.

[0107] S2: Perform instantaneous scoring and time-averaged scoring on the drones in the abnormal rounds; integrate the instantaneous scores and time-averaged scores through exponential calculation to generate a comprehensive malicious score;

[0108] Instantaneous scoring is based on the relative model bias gradient to assess the immediate contribution of the drone to anomalous behavior within the set of anomalous rounds;

[0109] Instantaneous scoring function Defined as:

[0110]

[0111] in, Set of abnormal rounds Chinese drones Instantaneous score, In abnormal rounds In the middle, when drones The drone group that provides data to server i At that time, the server The resulting bias gradient, Abnormal round The drone group provides data to server i;

[0112] Instantaneous scoring function for UAVs All abnormal rounds participated in The deviation gradients are summed up. The larger the value, the more severe the abnormal deviation of the model parameters caused by the drone in the rounds it participated in, and the more obvious the malicious behavior.

[0113] The time-averaged score quantifies the proportion of rounds in which drones are flagged as malicious during long-term observation, and is used to identify persistent attack behavior;

[0114] Time average rating function Defined as:

[0115]

[0116] in, For drones in abnormal round sets Average score over time This is a status indicator function, representing the state when an abnormal cycle occurs. The deviation gradient is greater than the deviation threshold, and the drone... In abnormal rounds When sending data to server i, ;otherwise , This represents the number of abnormal rounds.

[0117] Time-average scoring function for calculating drones The proportion of rounds marked as abnormal out of the total evaluation rounds reflects the drone's... A persistent malicious tendency;

[0118] The time-average scoring mechanism can effectively reduce misjudgments of benign drones. In decentralized drone networks, due to the dynamic allocation of drone groups, benign drones may accidentally send data to the same server in the same round as malicious drones, causing that round to be marked as an abnormal round. However, the time-average score of benign drones will remain at a low level, while the time-average score of malicious drones that continuously launch attacks will increase significantly, thus achieving effective differentiation between the two.

[0119] To comprehensively consider both the immediate abnormal behavior and long-term malicious trends of the drone, this invention integrates the instantaneous score and the time-averaged score through an exponential calculation to generate a comprehensive malicious score for the drone u. The calculation formula is as follows:

[0120]

[0121] in, Drones that provide data to server i Overall malicious rating;

[0122] The formula first normalizes the instantaneous score to obtain the average instantaneous score, then multiplies it by the time average score, and finally amplifies the difference through an exponential function.

[0123] This design has the following advantages: On the one hand, the exponential function can make the score gap between malicious drones and benign drones expand exponentially. When a malicious drone continues to inject backdoor data, its overall malicious score will increase rapidly.

[0124] On the other hand, the multiplication operation ensures that only drones with both high instantaneous scores and high time average scores will obtain an abnormally high comprehensive score, avoiding the limitations of a single indicator; for benign drones that occasionally participate in abnormal rounds, because their time average scores are low, even if their instantaneous scores are high, their comprehensive scores will still remain within a reasonable range.

[0125] S3: Use the K-means clustering algorithm to perform binary classification on the comprehensive malicious score of all drones to obtain two sets of clustering results; compare the number of drones contained in the two sets of clustering results, and determine the malicious drones in combination with the preset judgment rules.

[0126] Because malicious and benign drones differ significantly in their overall malice rating, this invention uses the K-means clustering algorithm to perform binary classification on the rating set, dividing the drones into two clusters. and ;

[0127] The K-means clustering process is as follows, please refer to [link / reference]. Figure 3 :

[0128] Step 1: Construct a malicious scoring set:

[0129]

[0130] in, The total number of drones;

[0131] Step 2: Randomly select one comprehensive malicious score from the malicious score set as the first initial center for clustering;

[0132] Calculate the Euclidean distance between each comprehensive malicious score in the malicious score set and the first initial center, and select the comprehensive malicious score with the largest Euclidean distance as the second initial center;

[0133] Step 3: Calculate the Euclidean distance between each comprehensive malicious score and the first and second initial centers respectively, and assign the comprehensive malicious score to the initial center with the closest Euclidean distance to obtain two initial clusters;

[0134] Step 4: Calculate the mean of all comprehensive malicious scores in the two initial clusters, and use the mean as the new cluster center;

[0135] Step 5: Iterate through steps 3 and 4 until the absolute value of the difference between two consecutive cluster centers is less than the preset iteration threshold or the preset maximum number of iterations is reached, then end the iteration.

[0136] In this embodiment, the iteration threshold is set to 0.00001, with a range of 0.000001 to 0.0001, which can be flexibly adjusted according to the accuracy requirements of the scenario. The maximum number of iterations is set to 50. 50 is an intermediate value in clustering tasks. On the one hand, most common data can converge within 50 iterations. On the other hand, the time cost of 50 iterations is low, which is suitable for scenarios such as UAV networks that have certain real-time requirements. If the data is more complex, it can be increased to 100. If the data is simple, it can be reduced to 20.

[0137] Step 6: Finally, two sets of clustering results are obtained, which include all drones and do not overlap.

[0138] The rules for determining malicious drones are as follows:

[0139] Calculate the difference in the comprehensive malice scores of the two cluster centers and set a score difference threshold;

[0140] When the absolute value of the difference is greater than or equal to the scoring difference threshold, the drones in the clustering results with fewer drones are marked as a malicious drone set;

[0141] The identity information of malicious drones is recorded in a blacklist, and data from these drones will be directly rejected in subsequent rounds, thus blocking the propagation path of backdoor attacks at the source.

[0142] When the absolute value of the difference is less than the scoring difference threshold or the ratio of the difference between the number of drones in the two groups to the total number of drones is less than the preset quantity threshold, it is determined that there are no clearly malicious drones; only abnormal round records are retained, and they are not marked on the blacklist.

[0143] To ensure the stability of K-means clustering, K-means clustering is performed three times on the same set of criticisms. If the overlap rate of the malicious drone set in the three results is ≥90%, then the set is selected; if the overlap rate is <90%, the initial centers are readjusted and clustering is performed again.

[0144] In this embodiment, the scoring difference threshold is set to 2, with a value range of 1.8 to 2.2. The specific setting is based on the following:

[0145] The threshold is determined based on the natural difference in the comprehensive malicious rating of the two types of drones, avoiding confusion due to thresholds that are too close or missed detection due to thresholds that are too far apart.

[0146] Based on the actual pattern that malicious drones usually score significantly higher than benign drones, the threshold is set to fall within the range that reflects this significant difference.

[0147] Drawing on industry-standard ranges for determining the effectiveness of group differences in clustering or classification tasks, we ensure that the thresholds conform to general difference judgment logic.

[0148] It reserves space for dynamic adaptation, which can be fine-tuned according to network fluctuations to ensure that it can still stably distinguish between the two groups under different operating conditions.

[0149] In this embodiment, the quantity threshold is set to 10%, because 10% is a common threshold in the field of cluster analysis to judge whether the distribution of a group is close to equal. When the difference between the two groups is less than 10%, the industry generally believes that the data does not show a clear distribution of minority and majority groups. At this time, the clustering results lack the natural rationality of group differentiation, and forced judgment is easy to deviate from the essential characteristics of the data.

[0150] Example 1: A decentralized federated learning simulation environment was built based on Python and PyTorch frameworks to simulate a network containing 50 drones and 10 servers. The network topology was generated using a random graph and dynamically changed during training, with some links randomly reconnected every 10 rounds. The federated learning task was image classification, using the CIFAR-10 dataset. The model structure was a 5-layer convolutional neural network (CNN), including 3 convolutional layers and 2 fully connected layers. Training was performed for 100 rounds with a learning rate of 0.01 and a batch size of 32.

[0151] Ten percent of the drones were randomly selected as malicious nodes. Backdoor triggers were injected into the local data of these drones, specifically by adding a 3×3 pixel white square to the lower right corner of the image and uniformly changing the label to the target category. The attack started in round 20 and continued until the end of training.

[0152] Table 1, Setting of Key Parameters

[0153] Parameter name Setting value illustrate Deviation threshold 0.1 Bias gradient threshold that triggers model rollback Iteration threshold 0.00001 K-means clustering iteration stopping threshold Maximum number of iterations 50 Maximum number of iterations for K-means clustering Scoring Difference Threshold 2 The threshold for determining the cluster center difference of malicious drones Quantity threshold 10% The threshold for determining the validity of clustering results Learning rate (η) 0.01 Gradient descent updates the learning rate of parameters Number of model layers (L) 5 Total number of layers in a CNN model

[0154] Table 2 shows the performance comparison between the present invention and distance-based and gradient-direction-based filtering methods.

[0155] method Detection accuracy (%) False alarm rate (%) Model accuracy (%) Distance-based filtering methods 85.2 8.5 78.3 Gradient-oriented filtering methods 88.7 6.2 80.1 This invention 95.4 3.1 85.6

[0156] As can be seen from Table 2, the method of the present invention has a higher detection accuracy than existing methods, while the false alarm rate is reduced to 3.1%, indicating that the present invention can more accurately identify malicious drones without affecting benign nodes. In addition, the model accuracy remains at 85.6%, indicating that the present invention effectively maintains the performance of the federated learning model while defending against backdoor attacks.

[0157] A federated learning backdoor attack detection device for unmanned aerial vehicle (UAV) networks, the device comprising:

[0158] Anomaly detection and filtering module: In each round of decentralized federated learning, after the server updates the model parameters using drone data, it calculates the relative model deviation between the server's model parameters and those of adjacent servers, and calculates the rate of change of the relative model deviation between the current round and the previous round to obtain the deviation gradient; when the deviation gradient exceeds a preset threshold, the server's model parameters are rolled back to the state of the previous round, and the round is marked as an abnormal round;

[0159] Scoring module: performs instantaneous scoring and time-averaged scoring on drones in the abnormal rounds; integrates the instantaneous scoring and time-averaged scoring through exponential calculation to generate a comprehensive malicious score;

[0160] Identification and localization module: The K-means clustering algorithm is used to perform binary classification on the comprehensive maliciousness score of all drones, resulting in two sets of clustering results; the number of drones included in the two sets of clustering results is compared, and malicious drones are determined in combination with preset judgment rules.

[0161] This invention proposes a backdoor attack detection method and device for federated learning in unmanned aerial vehicle (UAV) networks. By introducing a dynamic detection mechanism for relative model bias, combining a malicious assessment method with instantaneous and time-averaged scores, and a classification strategy based on unsupervised clustering, it achieves accurate detection, proactive interception, and source localization of backdoor attacks in UAV federated learning, effectively improving the system security and robustness in a decentralized dynamic network environment.

[0162] In summary, this invention achieves proactive interception and precise source tracing of backdoor attacks by introducing relative model bias. Furthermore, by leveraging a malicious scoring mechanism that integrates instantaneous and long-term behaviors, it effectively identifies and locates malicious drones while significantly reducing interference with the normal training process. Ultimately, it achieves efficient synergy between security defense and model performance in a highly dynamic decentralized drone network.

[0163] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A federated learning backdoor attack detection method for unmanned aerial vehicle (UAV) networks, characterized in that, The method includes: S1: In each round of decentralized federated learning, after the server updates the model parameters using drone data, it calculates the relative model deviation between the server model parameters and the model parameters of adjacent servers, and calculates the rate of change of the relative model deviation between the current round and the previous round to obtain the deviation gradient; when the deviation gradient exceeds a preset threshold, the server model parameters are rolled back to the state of the previous round, and the round is marked as an abnormal round. S2: Perform instantaneous scoring and time-averaged scoring on the drones in the abnormal rounds; integrate the instantaneous scores and time-averaged scores through exponential calculation to generate a comprehensive malicious score; S3: Use the K-means clustering algorithm to perform binary classification on the comprehensive malicious score of all drones to obtain two sets of clustering results; compare the number of drones contained in the two sets of clustering results, and determine the malicious drones in combination with the preset judgment rules. The implementation process of the K-means clustering algorithm is as follows: Step 1: Construct a malicious rating set; Step 2: Randomly select one of the comprehensive malicious scores from the malicious score set as the first initial center for clustering; Calculate the Euclidean distance between each of the comprehensive malicious scores in the malicious score set and the first initial center, and select the comprehensive malicious score with the largest Euclidean distance as the second initial center; Step 3: Calculate the Euclidean distance between each of the comprehensive malicious scores and the first and second initial centers respectively, and assign the comprehensive malicious scores to the initial centers with the closest Euclidean distance to obtain two initial clusters; Step 4: Calculate the mean of all the comprehensive malicious scores in the two initial clusters, and use the mean as the new cluster center; Step 5: Iterate through steps 3 and 4 until the absolute value of the difference between two consecutive cluster centers is less than the preset iteration threshold or the preset maximum number of iterations is reached, then end the iteration. Step 6: Finally, two sets of clustering results are obtained, which include all drones and do not overlap with each other; The rules for determining malicious drones are as follows: Calculate the difference in the comprehensive malice scores of the two cluster centers and set a score difference threshold; When the absolute value of the difference is greater than or equal to the scoring difference threshold, the drones in the clustering results with fewer drones are marked as a malicious drone set; The identity information of malicious drones is recorded in a blacklist, and data from these drones in subsequent rounds will be directly rejected, thus blocking the propagation path of backdoor attacks from the source. When the absolute value of the difference is less than the scoring difference threshold or the ratio of the difference between the number of drones in the two groups to the total number of drones is less than the preset quantity threshold, it is determined that there are no clearly malicious drones, only abnormal round records are retained, and no blacklist is marked.

2. The method according to claim 1, characterized in that, The update process of the model parameters follows the gradient descent algorithm.

3. The method according to claim 1, characterized in that, The calculation process for the relative model deviation is as follows: In the round In this process, the server uses the collected drone data to complete local training and obtain updated model parameters; The server communicates with all neighboring servers in the decentralized drone network topology to obtain their current model parameters; Calculate the difference norm between the model parameters and the parameters of each neighboring model, and take the average value as the relative model bias. The calculation formula is as follows. in, For rounds Chinese server The relative model bias, To communicate with the server The number of adjacent servers, For rounds Chinese server The parameters of the l-th layer model in the model, For rounds The nth one with the server The model parameters of layer l in adjacent servers, Let L be the L2 norm, and L be the total number of layers in the model.

4. The method according to claim 3, characterized in that, The formula for calculating the deviation gradient is as follows: in, For rounds Chinese server The deviation gradient; Set a deviation threshold, and perform the following operation when the deviation gradient is greater than the deviation threshold: The server i performs a parameter rollback operation to restore the model parameters to the state of the previous round; Mark round τ as an abnormal round of server i and record it in the abnormal round set.

5. The method according to claim 4, characterized in that, The deviation threshold is set based on the following three aspects: By collecting a large amount of historical data from normal training processes, we statistically analyze the distribution characteristics of the gradient relative to the model deviation during benign model updates. By balancing the security requirements of drone networks with the efficiency of model training, the optimal threshold is selected by adjusting the threshold on the validation set and evaluating the detection accuracy and false alarm rate. This allows the system to effectively detect backdoor attacks without excessively interfering with normal training. In actual deployment, an adaptive threshold mechanism is adopted to dynamically adjust the deviation threshold according to the system's operating status.

6. The method according to claim 4, characterized in that, The formula for calculating the instantaneous score is as follows: in, Set of abnormal rounds Chinese drones Instantaneous score, In abnormal rounds In the middle, when drones The drone group that provides data to server i At that time, the server The resulting bias gradient, Abnormal round The drone group provides data to server i; The formula for calculating the average score over time is as follows: in, Set of abnormal rounds Chinese drones Average score over time This is a status indicator function, representing the state when an abnormal cycle occurs. The deviation gradient is greater than the deviation threshold, and the drone... In abnormal rounds When sending data to server i, ,otherwise , This represents the number of abnormal rounds.

7. The method according to claim 6, characterized in that, The formula for calculating the comprehensive malice score is as follows: in, Drones that provide data to server i The overall malicious rating.

8. A federated learning backdoor attack detection device for unmanned aerial vehicle (UAV) networks, characterized in that, The device includes: Anomaly detection and filtering module: In each round of decentralized federated learning, after the server updates the model parameters using drone data, it calculates the relative model deviation between the server's model parameters and those of adjacent servers, and calculates the rate of change of the relative model deviation between the current round and the previous round to obtain the deviation gradient; when the deviation gradient exceeds a preset threshold, the server's model parameters are rolled back to the state of the previous round, and the round is marked as an abnormal round; Scoring module: performs instantaneous scoring and time-averaged scoring on drones in the abnormal rounds; integrates the instantaneous scoring and time-averaged scoring through exponential calculation to generate a comprehensive malicious score; Identification and localization module: The K-means clustering algorithm is used to perform binary classification on the comprehensive maliciousness score of all drones, resulting in two sets of clustering results; the number of drones contained in the two sets of clustering results is compared, and malicious drones are determined in combination with preset judgment rules; The implementation process of the K-means clustering algorithm is as follows: Step 1: Construct a malicious rating set; Step 2: Randomly select one of the comprehensive malicious scores from the malicious score set as the first initial center for clustering; Calculate the Euclidean distance between each of the comprehensive malicious scores in the malicious score set and the first initial center, and select the comprehensive malicious score with the largest Euclidean distance as the second initial center; Step 3: Calculate the Euclidean distance between each of the comprehensive malicious scores and the first and second initial centers respectively, and assign the comprehensive malicious scores to the initial centers with the closest Euclidean distance to obtain two initial clusters; Step 4: Calculate the mean of all the comprehensive malicious scores in the two initial clusters, and use the mean as the new cluster center; Step 5: Iterate through steps 3 and 4 until the absolute value of the difference between two consecutive cluster centers is less than the preset iteration threshold or the preset maximum number of iterations is reached, then end the iteration. Step 6: Finally, two sets of clustering results are obtained, which include all drones and do not overlap with each other; The rules for determining malicious drones are as follows: Calculate the difference in the comprehensive malice scores of the two cluster centers and set a score difference threshold; When the absolute value of the difference is greater than or equal to the scoring difference threshold, the drones in the clustering results with fewer drones are marked as a malicious drone set; The identity information of malicious drones is recorded in a blacklist, and data from these drones in subsequent rounds will be directly rejected, thus blocking the propagation path of backdoor attacks from the source. When the absolute value of the difference is less than the scoring difference threshold or the ratio of the difference between the number of drones in the two groups to the total number of drones is less than the preset quantity threshold, it is determined that there are no clearly malicious drones, only abnormal round records are retained, and no blacklist is marked.

Images