An information technology detection system with security protection based on big data
By constructing an information technology detection system based on big data, the problems of heterogeneity and malicious nodes in federated learning were solved, achieving stable and reliable information security detection and improving the model's adaptability and security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 贵州电子科技职业学院
- Filing Date
- 2026-01-26
- Publication Date
- 2026-05-19
AI Technical Summary
Existing federated learning methods fail to effectively consider the high heterogeneity of business structures, log formats, and threat distribution among participants, leading to local overfitting, gradient conflicts, and unstable global accuracy. Furthermore, they lack effective identification and governance of malicious nodes, affecting the security and reliability of the detection system.
A big data-based information technology detection system is adopted, including modules for log access and preprocessing, label alignment and embedding, model training and updating, federated coordination, distillation guidance, and blockchain evidence storage. The system dynamically groups and weights the data by calculating migration loss values, introduces a node reputation governance mechanism and on-chain auditability guarantee, generates a distillation consistency model, and deploys it.
It achieves stable, reliable and efficient information security detection in heterogeneous environments, improves the adaptability and stability of the model aggregation process, effectively suppresses gradient interference from low-reliability nodes, and ensures the traceability and security of the model evolution path.
Smart Images
Figure CN121567489B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information technology detection technology, and in particular to an information technology detection system with security protection based on big data. Background Technology
[0002] With the development of big data technology and artificial intelligence models, information technology security detection systems are gradually evolving towards intelligence and interconnection. Traditional security detection methods are facing unprecedented challenges. To address the limitations of data coverage from a single organization, existing research has begun to explore the introduction of federated learning frameworks into security detection tasks to achieve cross-organizational model collaboration. However, most existing federated learning methods are based on the homogeneity assumption and fail to effectively consider the high heterogeneity of business structures, log formats, and threat distributions among participants. In practical applications, problems such as local model overfitting, gradient conflicts, and unstable global accuracy often occur, leading to drastic fluctuations in detection performance.
[0003] Furthermore, existing federated learning frameworks generally assume the trustworthiness of participating nodes, lacking effective mechanisms for identifying and governing malicious or low-quality nodes. Issues such as nodes uploading poisoned gradients, replaying old parameters, or exhibiting abnormal participation frequencies can directly disrupt the global model's update path and even lead to privacy breaches, severely impacting the security and reliability of the entire detection system. While some research attempts to introduce differential privacy or homomorphic encryption techniques to enhance the data protection capabilities of federated frameworks, these techniques often neglect the trustworthiness assessment and global governance of node behavior, making them ill-equipped to handle complex game theory and attack behaviors in open environments.
[0004] In summary, there is an urgent need for a joint detection framework that integrates multi-dimensional heterogeneous modeling capabilities, node reputation governance mechanisms, and on-chain auditable assurance capabilities to achieve more stable, reliable, and efficient information security detection capabilities. Summary of the Invention
[0005] One objective of this invention is to propose a security-protected information technology detection system based on big data, which provides fundamental support for security and governance in multi-organization collaborative environments.
[0006] According to an embodiment of the present invention, a big data-based information technology detection system with security protection includes the following modules:
[0007] The log access and preprocessing module is used to collect large amounts of multi-source heterogeneous log data and generate standardized feature data streams;
[0008] The label alignment and embedding module is used to perform local label normalization and embedding mapping on the normalized feature data stream at each participating node and generate a fused feature vector.
[0009] The model training and update module is used to train a local model based on fused feature vectors, calculate the local gradient, and perform fixed-point quantization, homomorphic encryption, and differential privacy processing on the local gradient to generate encrypted gradients.
[0010] The federated coordination module receives encrypted gradients and calculates the migration loss based on the fused feature vectors, performing dynamic clustering and weighted aggregation to obtain the global model.
[0011] The distillation guidance module is used to guide low-reputation nodes to perform distillation training based on the fused feature vectors using soft labels generated by high-reputation nodes, thereby generating a distillation consistency model.
[0012] The blockchain evidence storage module is used to write the parameters in the global model of the current round into the sidechain for evidence storage.
[0013] The inference deployment module is used to deploy the fused global model and the distillation consistency model to each node.
[0014] A security-protected information technology detection method based on big data, used to execute a security-protected information technology detection system based on big data, includes the following steps:
[0015] S1. Perform high-throughput real-time acquisition of multi-source heterogeneous log big data, and clean, transform and columnar store the multi-source heterogeneous log big data to obtain a standardized feature data stream;
[0016] S2. At each participating node, perform local label normalization and embedding mapping on the normalized feature data stream and generate a fused feature vector. Train a local model based on the fused feature vector.
[0017] S3. Continuously perform sliding window entropy detection on the standardized feature data stream. When feature distribution drift is detected, construct a dynamic feature evolution model, expand the feature representation space, and synchronously update the input layer of the local model.
[0018] S4. Calculate the local gradient based on the local model, quantize the gradient and process it with homomorphic encryption algorithm and differential privacy mechanism to generate encrypted gradient and upload it to the federated coordination end. The federated coordination end performs dynamic grouping driven by migration loss based on the difference in migration loss between the encrypted gradient on the global validation set and the local validation set, groups the participating nodes in real time and sets the shared layer depth, learning rate and synchronization frequency for each group to form a federated grouping configuration.
[0019] S5. The federated coordination end calculates the weights of the encryption gradients within each group based on migration loss, node activity, and global contribution, and performs a weighted federated average to obtain the global model.
[0020] S6. Before each round of aggregation, select the local model of the node with reputation above the threshold as the teacher model, send the soft label of the local labeled feature data of the teacher model to the node with reputation below the threshold, add a consistency regularization term to the training objective of the node with reputation below the threshold, complete the cross-domain knowledge distillation and generate the distillation consistency model.
[0021] S7. Write the federated cluster configuration, distillation consensus model hash, and reputation entropy index of each node into the blockchain sidechain, and use the Byzantine fault tolerance and proof-of-stake hybrid consensus mechanism to complete the tamper-proof evidence storage and form event metadata;
[0022] S8. Write event metadata into the blockchain sidechain, automatically construct a risk label association graph, and generate federated consensus risk factors at the federated coordination end through graph embedding method;
[0023] S9. Deploy the updated global model, distillation consistency model, and federated consensus risk factors to each edge node, perform real-time inference on the standardized feature data stream, and output threat detection results and confidence assessment reports.
[0024] Optionally, S1 includes the following steps:
[0025] S11. Collect multi-source heterogeneous log big data in real time from terminal logs, network traffic logs, host operation logs, application behavior logs, and business tracing logs to construct the original log dataset. :
[0026]
[0027] in, Indicates the first A large amount of multi-source heterogeneous log data, The total number of log entries collected. Timestamps generated for logs For data source identification, This is a vector representing the numerical representation of the original log. Label the content category of the log;
[0028] S12. Perform format standardization and time alignment operations on the original log dataset to generate a uniform and structured log dataset, and organize it in columnar storage to improve the parallel processing performance for high-frequency field access.
[0029] S13. Perform noise cleaning and field missing value completion operations on the structured log dataset, remove invalid logs and fill in missing field values, and convert each multi-source heterogeneous log big data into a feature vector. ;
[0030] S14. Perform a normalization operation on the set of all feature vectors, normalizing all feature dimensions to the interval. The normalized feature set is written into the log feature database in a columnar storage structure to construct a standardized feature data stream. .
[0031] Optionally, S2 includes the following steps:
[0032] S21. Each participating node in the set of all participating nodes Receive standardized feature data stream Extract the corresponding local original tag set from the local system. The local original label set contains all log category labels known to the participating node, and the sample size of the local original label set is [missing information]. ;
[0033] S22. Participating Nodes After receiving the standardized feature data stream, refer to the predefined global label specification set. The process involves standardizing the labels by constructing a mapping function to map each local label in the original local label set to a unique standard label in the global label specification set, thereby generating a local labeled sample set. Each locally labeled sample is composed of a standardized feature vector and its corresponding standard label.
[0034] S23. Participating Nodes For each locally labeled sample, perform an embedding mapping operation on the standard label, using a dimension of The embedding matrix encodes each standard label into a The label embedding vector is concatenated with the normalized feature vector to obtain a new set of fused feature vectors. The method for constructing the fused feature vector set remains consistent across all participating nodes, and is based on... The eigenvectors of dimension are uniformly represented, where Represents the dimension of the standardized feature vector. Indicates the dimension of the label embedding vector;
[0035] S24. Participating Nodes With fused feature vector set Using the standardized label set as input, a local model is trained. During training, cross-entropy is used as the loss function, and minimizing the local training error is the optimization objective to obtain the local model parameters corresponding to the participating nodes. .
[0036] Optionally, S3 includes the following steps:
[0037] S31. Each participating node in the set of all participating nodes Receiving standardized feature data streams Then, based on the sliding window mechanism, the distribution of feature data is monitored in real time, and a window of length of [length missing] is constructed. sliding window ,in Indicates time The standardized feature vector received at each time step, Represents the dimension of the standardized feature vector. Set the preset sliding window size;
[0038] S32. Calculate the sliding window The entropy values of each feature dimension within the time frame are used to obtain the time. Window entropy vector at time step And record the window entropy sequence for all times in time series format. Each entropy value in the window entropy vector Indicates the first Each feature dimension in the window Internal entropy;
[0039] S33. A weighted moving average function is used to smooth the trend of the window entropy sequence, generating a smoothed entropy trend function. The entropy change of each feature dimension is dynamically modeled using an entropy trend function. If the following drift criterion is met:
[0040] ;
[0041] Then it is considered that the current feature distribution has drifted, and when the judgment is true, the feature evolution modeling mechanism is triggered; where, To detect the interval step size The entropy trend function, Indicates the detection interval step size. This represents the drift threshold, where k is the feature dimension;
[0042] S34. After triggering the feature evolution modeling mechanism, participating nodes After detecting a sudden change in entropy trend in the standardized feature data stream, a dynamic feature evolution model is constructed based on the temporal variation pattern of the abrupt feature dimension within the sliding window. Dynamic feature evolution model to expand feature subspace As the core representation, the extended feature subspace is concatenated with the original standardized feature space to obtain a new fused feature space. ,in To expand the dimensions of the features, This represents the newly extracted evolutionary feature vector;
[0043] S35. Participating Nodes Expand the feature subspace The fused feature vector is concatenated with the original standardized feature vector to obtain a new fused feature vector. ,in This represents the concatenated fused feature vector and the dynamic feature evolution model. The structural information in the model is used as a version control record;
[0044] S36. Update the local model input structure, changing the input layer dimension from the original... Expand to This forms a local model input structure consistent with the current fusion feature space, and retains the weight structure of the dynamic feature evolution model as the old state transfer part, realizing a continuous transition and parameter sharing between the local model and the dynamic feature evolution model.
[0045] Optionally, S4 includes the following steps:
[0046] S41. Each participating node in the set of all participating nodes After completing the local model After training, based on the fused feature vector set Calculate the gradient parameters of the local model to obtain the set of original local gradient vectors. The local original gradient vector set contains the gradient results of all learnable parameters in the model;
[0047] S42. Participating Nodes Each gradient value in the local original gradient vector set is subjected to fixed-point quantization, using a uniform quantization step size. Mapping floating-point gradient values to integer representations generates a set of quantized gradient vectors. Each element in the set of quantized gradient vectors represents the direction and magnitude of the corresponding parameter after quantization in the current round of training;
[0048] S43. Participating Nodes For the set of quantized gradient vectors Perform homomorphic encryption to generate intermediate encryption gradient results. Based on the differential privacy mechanism, a noise vector is superimposed on the intermediate results of the encrypted gradient. The perturbation intensity of each noise component is determined by the differential privacy budget parameter. With quantization step size Together, they determined the final encrypted gradient vector. ;
[0049] S44. Participating Nodes Upload the final encrypted gradient vector to the federal coordinator The federal coordinator uses the global verification set of the current round. With the local validation set of the participating node Evaluate the performance difference between the global model and the local model separately, and calculate the migration loss value of the participating node. The migration loss value represents the degree of deviation between the global model and the local model in terms of predictive ability, and is used to measure the degree of heterogeneity between the data distribution of participating nodes and the global model.
[0050]
[0051] in, This represents the model loss on the local validation set of the participating nodes. This represents the model loss on the global validation set. A higher transfer loss value indicates a greater distributional difference between the participating node and the global model.
[0052] 45. The federal coordinator calculates the migration loss value of all participating nodes. Implement a migration loss-driven dynamic clustering mechanism to divide all participating nodes into several subgroups. Each subgroup contains participating nodes with similar migration loss characteristics, forming a multi-level heterogeneous adaptation structure;
[0053] S46. The federated coordination end is based on a multi-level heterogeneous adaptation structure, targeting each subgroup. Set the shared layer depth parameter separately Local learning rate parameter Synchronization frequency parameter with model update Generate federated cluster configuration .
[0054] Optionally, S5 includes the following steps:
[0055] S51. The federal coordination node calculates the weighting factor for each participating node. :
[0056] ;
[0057] in, Subgroup The first in Each participating node , , These are the weighted hyperparameters corresponding to each indicator. For participating nodes The migration loss value, For participating nodes The migration loss value, Indicates participating nodes The node activity Indicates participating nodes Global contribution Indicates participating nodes The node activity Indicates participating nodes Global contribution;
[0058] S52. Federal coordination based on each subgroup The encrypted gradient vector and its corresponding weighting factor A weighted federated average operation is performed to obtain intermediate global model parameters at the subgroup level. ;
[0059] S53. The federated coordinator will allocate intermediate global model parameters to all subgroups. Cross-group fusion is performed, and a multi-group weighted fusion strategy is implemented based on the performance of each subgroup on the validation set to generate the final global model parameter set for the current round. The update is then pushed to all participating nodes to complete the global model update.
[0060] Optionally, S6 includes the following steps:
[0061] S61. Before each round of aggregation operation, the federated coordinator evaluates the reputation of all participating nodes based on their behavior in previous rounds and the reputation entropy index of participating nodes recorded on the blockchain sidechain. A unified reputation threshold is set. When the reputation entropy index of a participating node is higher than the reputation threshold, the participating node is assigned to the teacher participating node set; otherwise, it is assigned to the student participating node set.
[0062] S62. Each teacher participation node in the set of teacher participation nodes It uses the local model trained in the current round to infer its local labeled feature data set and generates the corresponding soft label set. ;
[0063] S63. Each teacher participating node encrypts the generated soft tag set and securely forwards it to one or more student participating nodes with reputation entropy below the reputation threshold through the federated coordinator. After receiving multiple soft tag sets from different teacher participating nodes, the student participating nodes aggregate the soft tags according to a unified averaging fusion strategy to form a fused soft tag set. ;
[0064] S64. After receiving the fused soft label set, each student participating node introduces a consistency regularization term during the original local model training process. The consistency regularization term constrains the difference between the current output of the model and the fused soft label. The difference is calculated in the form of the distance between the predicted probability distributions and is used to measure the degree of approximation between the student model and the fused soft label.
[0065] S65. Student-participating nodes construct a joint training objective function. The objective function consists of two parts: one is the standard supervised learning loss, which measures the error between the local model output used by the student node for distillation training and the local standard label; the other is the consistency regularization loss, which measures the deviation between the local model output and the fused soft label. The two losses are weighted and combined by the distillation balance coefficient to control the learning ratio of the local model between local label learning and soft label guidance.
[0066] S66. Each student participating node completes model training and updates based on the joint training objective function, generating new local model parameters, which are the distillation consistency model parameters. .
[0067] The beneficial effects of this invention are:
[0068] (1) This invention constructs a migration loss value by calculating the performance difference between each participating node on the local validation set and the global validation set, and uses this value as the basis for clustering and weight calculation. Nodes are dynamically assigned to subgroups with similar migration characteristics, and then differentiated shared layer depth and learning rate strategies are set. At the same time, a combination of migration loss, node activity and historical contribution is introduced into the weighted aggregation to generate fusion weights, ensuring that the model aggregation process is more adaptive and stable, and effectively solving the problem of federated average oscillation and non-convergence under heterogeneous distribution.
[0069] 2) This invention introduces the node reputation entropy recorded in the blockchain into the knowledge distillation process, sets a threshold to distinguish between teacher nodes and student nodes, allows high-reputation nodes to provide knowledge transfer with soft labels to low-reputation nodes, guides their model behavior to evolve towards high quality, and in the process of training the distillation consistency model, student nodes construct a joint loss function and use the modal consistency of soft labels to achieve model correction and stability improvement, which can effectively suppress gradient interference from low-reputation nodes, and at the same time realize knowledge sharing and structural adaptation.
[0070] (3) This invention unifies and structures the key metadata in each training process, including federated cluster configuration hash, dynamic feature evolution model version hash, distillation consistency model hash, and node reputation entropy index set, and writes it into a high-throughput blockchain sidechain built on Byzantine fault tolerance and proof-of-stake mechanism. The on-chain mechanism generates an immutable timestamp and structural proof for each iteration of the model, ensuring that node behavior, parameter changes and model evolution path are traceable and accountable, providing basic support for security and governance in a multi-agency collaborative environment. Attached Figure Description
[0071] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:
[0072] Figure 1 This is a flowchart of an information technology detection system with security protection based on big data, as proposed in this invention. Detailed Implementation
[0073] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.
[0074] refer to Figure 1 A security-protected information technology detection system based on big data includes the following modules:
[0075] The log access and preprocessing module is used to collect large amounts of multi-source heterogeneous log data and generate standardized feature data streams;
[0076] The label alignment and embedding module is used to perform local label normalization and embedding mapping on the normalized feature data stream at each participating node and generate a fused feature vector.
[0077] The model training and update module is used to train a local model based on fused feature vectors, calculate the local gradient, and perform fixed-point quantization, homomorphic encryption, and differential privacy processing on the local gradient to generate encrypted gradients.
[0078] The federated coordination module receives encrypted gradients and calculates the migration loss based on the fused feature vectors, performing dynamic clustering and weighted aggregation to obtain the global model.
[0079] The distillation guidance module is used to guide low-reputation nodes to perform distillation training based on the fused feature vectors using soft labels generated by high-reputation nodes, thereby generating a distillation consistency model.
[0080] The blockchain evidence storage module is used to write the parameters in the global model of the current round into the sidechain for evidence storage.
[0081] The inference deployment module is used to deploy the fused global model and the distillation consistency model to each node.
[0082] A security-protected information technology detection method based on big data, used to execute a security-protected information technology detection system based on big data, includes the following steps:
[0083] S1. Perform high-throughput real-time acquisition of multi-source heterogeneous log big data, and clean, transform and columnar store the multi-source heterogeneous log big data to obtain a standardized feature data stream;
[0084] S2. At each participating node, perform local label normalization and embedding mapping on the normalized feature data stream and generate a fused feature vector. Train a local model based on the fused feature vector.
[0085] S3. Continuously perform sliding window entropy detection on the standardized feature data stream. When feature distribution drift is detected, construct a dynamic feature evolution model, expand the feature representation space, and synchronously update the input layer of the local model.
[0086] S4. Calculate the local gradient based on the local model, quantize the gradient and process it with homomorphic encryption algorithm and differential privacy mechanism to generate encrypted gradient and upload it to the federated coordination end. The federated coordination end performs dynamic grouping driven by migration loss based on the difference in migration loss between the encrypted gradient on the global validation set and the local validation set, groups the participating nodes in real time and sets the shared layer depth, learning rate and synchronization frequency for each group to form a federated grouping configuration.
[0087] S5. The federated coordination end calculates the weights of the encryption gradients within each group based on migration loss, node activity, and global contribution, and performs a weighted federated average to obtain the global model.
[0088] S6. Before each round of aggregation, select the local model of the node with reputation above the threshold as the teacher model, send the soft label of the local labeled feature data of the teacher model to the node with reputation below the threshold, add a consistency regularization term to the training objective of the node with reputation below the threshold, complete the cross-domain knowledge distillation and generate the distillation consistency model.
[0089] S7. Write the federated cluster configuration, distillation consensus model hash, and reputation entropy index of each node into the blockchain sidechain, and use the Byzantine fault tolerance and proof-of-stake hybrid consensus mechanism to complete the tamper-proof evidence storage and form event metadata;
[0090] S8. Write event metadata into the blockchain sidechain, automatically construct a risk label association graph, and generate federated consensus risk factors at the federated coordination end through graph embedding method;
[0091] This invention records key information such as attack source, attack type, threat confidence, and response time by writing the metadata of high-confidence threat events detected by each node into the blockchain sidechain and recording the transaction on the chain. Due to the adoption of a hybrid consensus algorithm of Byzantine fault tolerance and proof-of-stake, this evidence storage mechanism has high reliability and immutability, ensuring that even in a cross-institutional collaborative environment, every threat detection, response, and evolution has legal-level audit and traceability capabilities, which is significantly better than traditional centralized log or offline backup solutions.
[0092] S9. Deploy the updated global model, distillation consistency model, and federated consensus risk factors to each edge node, perform real-time inference on the standardized feature data stream, and output threat detection results and confidence assessment reports.
[0093] This invention deploys the global model, distillation consensus model, and consensus risk factors to edge nodes via hot updates, eliminating the need for downtime, restarts, or manual intervention. Upon receiving an update, nodes can instantly switch inference engines, ensuring that the global detection model can be deployed within seconds in the event of sudden changes in the threat environment. Real-world testing shows that in a government cloud environment with 30 nodes, the average model switching time is less than 1.8 seconds, significantly better than traditional federated learning deployment mechanisms (which typically take over 5 minutes). During inference, nodes not only rely on the model itself but also dynamically weight the inference results using federated consensus risk factors, assigning higher detection weights to high-risk categories and dynamically adjusting confidence thresholds, effectively improving the identification rate of new threats and variant attacks. Compared to inference without risk factors, the average recall rate for threat detection is increased by 6.3%, and the false negative rate is reduced by 4.8%.
[0094] In this embodiment, S1 includes the following steps:
[0095] S11. Collect multi-source heterogeneous log big data in real time from terminal logs, network traffic logs, host operation logs, application behavior logs, and business tracing logs to construct the original log dataset. :
[0096]
[0097] in, Indicates the first A large amount of multi-source heterogeneous log data, The total number of log entries collected. Timestamps generated for logs For data source identification, This is a vector representing the numerical representation of the original log. Label the content category of the log;
[0098] S12. Perform format standardization and time alignment operations on the original log dataset to generate a uniform and structured log dataset, and organize it in columnar storage to improve the parallel processing performance for high-frequency field access.
[0099] S13. Perform noise cleaning and field missing value completion operations on the structured log dataset, remove invalid logs and fill in missing field values, and convert each multi-source heterogeneous log big data into a feature vector. ;
[0100] S14. Perform a normalization operation on the set of all feature vectors, normalizing all feature dimensions to the interval. The normalized feature set is written into the log feature database in a columnar storage structure to construct a standardized feature data stream. .
[0101] This invention constructs a unified, standardized feature data stream. This process transforms heterogeneous logs from multiple sources (such as terminal, network, host, and application logs) into a set of feature vectors with a consistent format, clear semantics, and stable structure. The workflow encompasses sliding window acquisition, field alignment, missing data completion, normalization, and columnar feature storage, significantly improving log processing throughput and training sample quality.
[0102] In this embodiment, S2 includes the following steps:
[0103] S21. Each participating node in the set of all participating nodes Receive standardized feature data stream Extract the corresponding local original tag set from the local system. The local original label set contains all log category labels known to the participating node, and the sample size of the local original label set is [missing information]. ;
[0104] S22. Participating Nodes After receiving the standardized feature data stream, refer to the predefined global label specification set. The process involves standardizing the labels by constructing a mapping function to map each local label in the original local label set to a unique standard label in the global label specification set, thereby generating a local labeled sample set. Each locally labeled sample is composed of a standardized feature vector and its corresponding standard label.
[0105] S23. Participating Nodes For each locally labeled sample, perform an embedding mapping operation on the standard label, using a dimension of The embedding matrix encodes each standard label into a The label embedding vector is concatenated with the normalized feature vector to obtain a new set of fused feature vectors. The method for constructing the fused feature vector set remains consistent across all participating nodes, and is based on... The eigenvectors of dimension are uniformly represented, where Represents the dimension of the standardized feature vector. Indicates the dimension of the label embedding vector;
[0106] S24. Participating Nodes With fused feature vector set Using the standardized label set as input, a local model is trained. During training, cross-entropy is used as the loss function, and minimizing the local training error is the optimization objective to obtain the local model parameters corresponding to the participating nodes. .
[0107] This invention solves the problem of tag system differences by constructing a mapping function from local tags to global tags at each participating node, and introduces a tag embedding matrix. By encoding discrete label information into a continuous representation and concatenating it into the feature vector, the model's ability to understand label semantics is enhanced.
[0108] In this embodiment, S3 includes the following steps:
[0109] S31. Each participating node in the set of all participating nodes Receiving standardized feature data streams Then, based on the sliding window mechanism, the distribution of feature data is monitored in real time, and a window of length of [length missing] is constructed. sliding window ,in Indicates time The standardized feature vector received at each time step, Represents the dimension of the standardized feature vector. Set the preset sliding window size;
[0110] S32. Calculate the sliding window The entropy values of each feature dimension within the time frame are used to obtain the time. Window entropy vector at time step And record the window entropy sequence for all times in time series format. Each entropy value in the window entropy vector Indicates the first Each feature dimension in the window Internal entropy;
[0111] S33. A weighted moving average function is used to smooth the trend of the window entropy sequence, generating a smoothed entropy trend function. The entropy change of each feature dimension is dynamically modeled using an entropy trend function. If the following drift criterion is met:
[0112] ;
[0113] If the current feature distribution is considered to have shifted, the feature evolution modeling mechanism will be triggered when the determination is true.
[0114] in, To detect the interval step size The entropy trend function, Indicates the detection interval step size. This represents the drift threshold, where k is the feature dimension;
[0115] S34. After triggering the feature evolution modeling mechanism, participating nodes After detecting a sudden change in entropy trend in the standardized feature data stream, a dynamic feature evolution model is constructed based on the temporal variation pattern of the abrupt feature dimension within the sliding window. Dynamic feature evolution model to expand feature subspace As the core representation, the extended feature subspace is concatenated with the original standardized feature space to obtain a new fused feature space. ,in To expand the dimensions of the features, This represents the newly extracted evolutionary feature vector;
[0116] S35. Participating Nodes Expand the feature subspace The fused feature vector is concatenated with the original standardized feature vector to obtain a new fused feature vector. ,in This represents the concatenated fused feature vector and the dynamic feature evolution model. The structural information in the model is used as a version control record;
[0117] S36. Update the local model input structure, changing the input layer dimension from the original... Expand to This forms a local model input structure consistent with the current fusion feature space, and retains the weight structure of the dynamic feature evolution model as the old state transfer part, realizing a continuous transition and parameter sharing between the local model and the dynamic feature evolution model;
[0118] This invention constructs a feature evolution identifier vector after the dynamic feature evolution model structure is updated. , used to mark the newly added evolutionary feature dimension in the input of the current dynamic feature evolution model.
[0119] In this embodiment, for common distribution drift and abrupt changes in log data, the sliding window entropy detection mechanism proposed in this invention can capture feature changes in real time by constructing a dynamic feature evolution model. This expands the input space and updates the model structure synchronously, effectively avoiding model degradation caused by static input structure.
[0120] In this embodiment, S4 includes the following steps:
[0121] S41. Each participating node in the set of all participating nodes After completing the local model After training, based on the fused feature vector set Calculate the gradient parameters of the local model to obtain the set of original local gradient vectors. The local original gradient vector set contains the gradient results of all learnable parameters in the model;
[0122] S42. Participating Nodes Each gradient value in the local original gradient vector set is subjected to fixed-point quantization, using a uniform quantization step size. Mapping floating-point gradient values to integer representations generates a set of quantized gradient vectors. Each element in the set of quantized gradient vectors represents the direction and magnitude of the corresponding parameter after quantization in the current round of training;
[0123] S43. Participating Nodes For the set of quantized gradient vectors Perform homomorphic encryption to generate intermediate encryption gradient results. Based on the differential privacy mechanism, a noise vector is superimposed on the intermediate results of the encrypted gradient. The perturbation intensity of each noise component is determined by the differential privacy budget parameter. With quantization step size Together, they determined the final encrypted gradient vector. ;
[0124] S44. Participating Nodes Upload the final encrypted gradient vector to the federal coordinator The federal coordinator uses the global verification set of the current round. With the local validation set of the participating node Evaluate the performance difference between the global model and the local model separately, and calculate the migration loss value of the participating node. The migration loss value represents the degree of deviation between the global model and the local model in terms of predictive ability, and is used to measure the degree of heterogeneity between the data distribution of participating nodes and the global model.
[0125]
[0126] in, This represents the model loss on the local validation set of the participating nodes. This represents the model loss on the global validation set. A higher transfer loss value indicates a greater distributional difference between the participating node and the global model.
[0127] S45. The federated coordinator calculates the migration loss value based on all participating nodes. Implement a migration loss-driven dynamic clustering mechanism to divide all participating nodes into several subgroups. Each subgroup contains participating nodes with similar migration loss characteristics, forming a multi-level heterogeneous adaptation structure;
[0128] S46. The federated coordination end is based on a multi-level heterogeneous adaptation structure, targeting each subgroup. Set the shared layer depth parameter separately Local learning rate parameter Synchronization frequency parameter with model update Generate federated cluster configuration .
[0129] This invention constructs a migration loss value by calculating the performance difference between each participating node on the local validation set and the global validation set, and uses this value as the basis for clustering and weight calculation. Nodes are dynamically assigned to subgroups with similar migration features, and then differentiated shared layer depth and learning rate strategies are set.
[0130] In this embodiment, S5 includes the following steps:
[0131] S51. The federal coordination node calculates the weighting factor for each participating node. :
[0132] ;
[0133] in, Subgroup The first in Each participating node , , These are the weighted hyperparameters corresponding to each indicator. For participating nodes The migration loss value, For participating nodes The migration loss value, Indicates participating nodes The node activity Indicates participating nodes Global contribution Indicates participating nodes The node activity Indicates participating nodes Global contribution;
[0134] Node activity, global contribution, and migration loss metrics are all normalized to ensure uniformity of measurement. The final weighting coefficients are dimensionless real numbers to achieve reliable and differentiated fusion of the gradients uploaded by each node during federated aggregation.
[0135] The weighted formula of S51 is designed to introduce differentiated trust levels among nodes in federated aggregation, making the overall federated system more robust and accurate, and preventing inferior nodes from dragging down the performance of the global model.
[0136] S52. Federal coordination based on each subgroup The encrypted gradient vector and its corresponding weighting factor A weighted federated average operation is performed to obtain intermediate global model parameters at the subgroup level. ;
[0137] S53. The federated coordinator will allocate intermediate global model parameters to all subgroups. Cross-group fusion is performed, and a multi-group weighted fusion strategy is implemented based on the performance of each subgroup on the validation set to generate the final global model parameter set for the current round. The update is then pushed to all participating nodes to complete the global model update.
[0138] In this implementation, a combination of migration loss, node activity, and historical contribution is introduced into the weighted aggregation to generate fusion weights, ensuring that the model aggregation process is more adaptive and stable, and effectively solving the problem of federated averages being prone to oscillation and non-convergence under heterogeneous distributions.
[0139] In this embodiment, S6 includes the following steps:
[0140] S61. Before each round of aggregation operation, the federated coordinator evaluates the reputation of all participating nodes based on their behavior in previous rounds and the reputation entropy index of participating nodes recorded on the blockchain sidechain. A unified reputation threshold is set. When the reputation entropy index of a participating node is higher than the reputation threshold, the participating node is assigned to the teacher participating node set; otherwise, it is assigned to the student participating node set.
[0141] S62. Each teacher participation node in the set of teacher participation nodes It uses the local model trained in the current round to infer its local labeled feature data set and generates the corresponding soft label set. ;
[0142] S63. Each teacher participating node encrypts the generated soft tag set and securely forwards it to one or more student participating nodes with reputation entropy below the reputation threshold through the federated coordinator. After receiving multiple soft tag sets from different teacher participating nodes, the student participating nodes aggregate the soft tags according to a unified averaging fusion strategy to form a fused soft tag set. ;
[0143] S64. After receiving the fused soft label set, each student participating node introduces a consistency regularization term during the original local model training process. The consistency regularization term constrains the difference between the current output of the model and the fused soft label. The difference is calculated in the form of the distance between the predicted probability distributions and is used to measure the degree of approximation between the student model and the fused soft label.
[0144] S65. Student-participating nodes construct a joint training objective function. The objective function consists of two parts: one is the standard supervised learning loss, which measures the error between the local model output used by the student node for distillation training and the local standard label; the other is the consistency regularization loss, which measures the deviation between the local model output and the fused soft label. The two losses are weighted and combined by the distillation balance coefficient to control the learning ratio of the local model between local label learning and soft label guidance.
[0145] S66. Each student participating node completes model training and updates based on the joint training objective function, generating new local model parameters, which are the distillation consistency model parameters. .
[0146] In this embodiment, the present invention introduces the node reputation entropy recorded in the blockchain into the knowledge distillation process, sets a threshold to distinguish between teacher nodes and student nodes, allows high-reputation nodes to provide knowledge transfer with soft labels to low-reputation nodes, guides their model behavior to evolve towards high quality, and in the process of training the distillation consistency model, student nodes construct a joint loss function and use the modal consistency of soft labels to achieve model correction and stability improvement, which can effectively suppress gradient interference from low-reputation nodes, and at the same time realize knowledge sharing and structural adaptation.
[0147] In this embodiment, step S7 includes the following steps:
[0148] S71. After completing each round of global model update, the federated coordinator extracts the set of global model parameters for that round, performs hash digest calculation on the set of global model parameters, and generates a hash value of the global model parameters, which is used to uniquely identify the global model version of the current round.
[0149] S72. The federated coordination end synchronously extracts the federated cluster configuration set formed during this round of federated training, including the shared layer depth parameters, local learning rate parameters and model update synchronization frequency parameters of each subgroup, and calculates its structure hash value after structuring the configuration set;
[0150] S73. The federated coordinator extracts the dynamic feature evolution model structure information from each participating node, marks the version number and generates a version identifier vector, summarizes the dynamic feature evolution model version information of each node into a version set, and performs hash processing on the version set to generate a feature evolution model version hash value.
[0151] S74. The federated coordinator obtains the distillation consistency model parameters generated by each student node in step S66, and performs a hash digest operation on the distillation consistency model parameters of each student node to form a distillation consistency model hash set, which is used to identify the distillation model status of each student node.
[0152] S75. The federal coordination end simultaneously extracts the reputation entropy index of all participating nodes in the current round, forms a reputation entropy index set, and binds the set with the node identifier to form a structured record entry;
[0153] S76. The federation coordinator will jointly construct the following into a complete structured evidence storage data item for this round of federation process: including federation cluster configuration hash, dynamic feature evolution model version hash, distillation consistency model hash set, and node reputation entropy index set, and submit the evidence storage data item as transaction data to the blockchain sidechain;
[0154] S77. The sidechain employs a hybrid consensus algorithm combining Byzantine fault tolerance and proof-of-stake mechanisms to ensure high throughput while maintaining immutable proof of the transaction. After completing consensus verification, the blockchain sidechain adds a timestamp and block index to the data item and records it in the distributed ledger as irrefutable historical evidence for the current round of federated training and aggregation.
[0155] This invention unifies and structures key metadata from each training round, including federated cluster configuration hashes, dynamic feature evolution model version hashes, distillation consistency model hashes, and node reputation entropy index sets, and writes them into a high-throughput blockchain sidechain built on a Byzantine fault-tolerant and proof-of-stake mechanism. The on-chain mechanism generates an immutable timestamp and structural proof for each model iteration, ensuring that node behavior, parameter changes, and model evolution paths are traceable and accountable, providing fundamental support for security and governance in multi-agency collaborative environments. Example
[0156] The federated node-host security log system of a provincial cloud platform received an alert for abnormal behavior from a server with the IP address "HJ-ZW-018". This server established non-whitelisted TCP connections with 12 external IP addresses within just 3 minutes. One of these connections, originating from the IP address "192.168.1.100", had its packet anomaly score exceeding a set threshold for three consecutive sliding windows. Under the dynamic feature evolution module deployed by the method of this invention, the system automatically identifies that the average length of the data packets of the host recently has increased by more than 58% compared with the historical data, the distribution of destination ports has changed abruptly, and the range of newly added ports is concentrated between UDP 6890-6900, which is significantly deviating from the normal business mode.
[0157] The system detected a drift in the current feature distribution, triggering a feature evolution mechanism. It expanded the feature vectors in real time with two new vectors: "destination port cluster density" and "connection duration standard deviation," dynamically updating the local model input space. The node's model recovered its detection accuracy within five training rounds after the update. Subsequently, the system generated an attack event report based on the evolved model output, automatically identifying it as "abnormal lateral movement behavior." The report included the attack time (02:43:17), the attack source IP (192.168.1.100), the target segment (10.28.4.0 / 24), the abnormal feature description (port scanning + rate mutation + protocol switching), and the model confidence score (0.964). The event was recorded on the federated coordination chain, triggering a Level 2 security alert. The municipal finance bureau network administrator performed port isolation 12 seconds after receiving the alert, successfully preventing the attack from spreading.
[0158] Another node—the Y platform—showed frequent 401 unauthorized access logs, involving a user terminal IP "172.20.33.41". The system automatically detected that this terminal attempted to log into multiple backend system modules within 4 minutes, with the access paths being: " / admin / login", " / api / rootcmd", and " / audit / token". These abnormal access path characteristics were identified by the model and marked as "typical crawler probing behavior". Based on the uploaded model gradient and attack prediction distribution, the federated framework participated in the knowledge distillation mechanism, selecting a source from the Provincial Information Office (Reputation Entropy). The model was used as the teacher model to guide the distillation of the Y city bureau node. After distillation, the model was redeployed, and after only one round of training, the node accurately identified the second wave of similar attacks with a confidence level of 0.947, accurately triggering the blocking mechanism.
[0159] The system detected that the deviation between the distillation consistency model uploaded by node W and the validation set was too high, and the reputation entropy fluctuation reached [a certain value]. The federal coordinator initiated a rapid verification based on on-chain records. The hash of the distilled model recorded in the sidechain did not match the corresponding training log timestamp, confirming an "old model replay attack." The coordinator immediately restricted the node to read-only status and notified its security administrator. The entire response process, from detection to handling, took only 63 seconds. The system quickly located the problematic node through tamper-proof evidence storage, preventing potential model contamination risks.
[0160] During 30 consecutive days of practical operation, the method of this invention was deployed on 28 nodes and a total of 63 high-confidence network attack events were discovered, of which 35 were lateral scanning attacks, 21 were privilege escalation attacks, and 7 were typical backdoor connection behaviors.
[0161] Based on a specific log example, a host with the IP address "10.18.88.55" attempted to submit a command request starting with "wget + base64" through the " / config / shell" interface. This method's model determined it to be "remote code execution behavior" with a confidence level of 0.983. The report was automatically written to the sidechain and pushed to the on-duty administrator. Asset isolation and interface circuit breaking were completed that same evening, preventing the attack from escalating.
[0162] In summary, this embodiment clearly demonstrates the deployment capability of the method of the present invention in real and complex environments, its response efficiency to new threats, and its governance effect on abnormal nodes. It greatly improves the intelligence, reliability, and accuracy of information security detection in distributed scenarios, and has high practicality and promotional value.
[0163] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.
Claims
1. A security-protected information technology detection system based on big data, characterized in that, Includes the following modules: The log access and preprocessing module is used to collect large amounts of multi-source heterogeneous log data and generate standardized feature data streams; The label alignment and embedding module is used to perform local label normalization and embedding mapping on the normalized feature data stream at each participating node and generate a fused feature vector. The model training and update module is used to train a local model based on fused feature vectors, calculate the local gradient, and perform fixed-point quantization, homomorphic encryption, and differential privacy processing on the local gradient to generate encrypted gradients. The federated coordination module receives encrypted gradients and calculates the migration loss based on the fused feature vectors, performing dynamic clustering and weighted aggregation to obtain the global model. This includes the following steps: Calculate the weighting factor for each participating node. : ； in, Subgroup The first in Each participating node , , These are the weighted hyperparameters corresponding to each indicator. For participating nodes The migration loss value, For participating nodes The migration loss value, Indicates participating nodes The node activity Indicates participating nodes Global contribution Indicates participating nodes The node activity Indicates participating nodes Global contribution; Based on each subgroup The encrypted gradient vector and its corresponding weighting factor A weighted federated average operation is performed to obtain intermediate global model parameters at the subgroup level. ; Intermediate global model parameters for all subgroups Cross-group fusion is performed, and a multi-group weighted fusion strategy is implemented based on the performance of each subgroup on the validation set to generate the final global model parameter set for the current round. And push it to all participating nodes to complete the global model update; The distillation guidance module is used to guide low-reputation nodes to perform distillation training based on the fused feature vectors using soft labels generated by high-reputation nodes, thereby generating a distillation consistency model. The blockchain evidence storage module is used to write the parameters in the global model of the current round into the sidechain for evidence storage. The inference deployment module is used to deploy the fused global model and the distillation consistency model to each node.
2. A security-protected information technology detection method based on big data, applied to the security-protected information technology detection system based on big data as described in claim 1, characterized in that, Includes the following steps: S1. Perform high-throughput real-time acquisition of multi-source heterogeneous log big data, and clean, transform and columnar store the multi-source heterogeneous log big data to obtain a standardized feature data stream; S2. At each participating node, perform local label normalization and embedding mapping on the normalized feature data stream and generate a fused feature vector. Train a local model based on the fused feature vector. S3. Continuously perform sliding window entropy detection on the standardized feature data stream. When feature distribution drift is detected, construct a dynamic feature evolution model, expand the feature representation space, and synchronously update the input layer of the local model. S4. Calculate the local gradient based on the local model, quantize the gradient and process it with homomorphic encryption algorithm and differential privacy mechanism to generate encrypted gradient and upload it to the federated coordination end. The federated coordination end performs dynamic grouping driven by migration loss based on the difference in migration loss between the encrypted gradient on the global validation set and the local validation set, groups the participating nodes in real time and sets the shared layer depth, learning rate and synchronization frequency for each group to form a federated grouping configuration. S5. The federated coordination end calculates the weights of the encryption gradients within each group based on migration loss, node activity, and global contribution, and performs a weighted federated average to obtain the global model. S6. Before each round of aggregation, select the local model of the node with reputation above the threshold as the teacher model, send the soft label of the local labeled feature data of the teacher model to the node with reputation below the threshold, add a consistency regularization term to the training objective of the node with reputation below the threshold, complete the cross-domain knowledge distillation and generate the distillation consistency model. S7. Write the federated cluster configuration, distillation consensus model hash, and reputation entropy index of each node into the blockchain sidechain, and use the Byzantine fault tolerance and proof-of-stake hybrid consensus mechanism to complete the tamper-proof evidence storage and form event metadata; S8. Write event metadata into the blockchain sidechain, automatically construct a risk label association graph, and generate federated consensus risk factors at the federated coordination end through graph embedding method; S9. Deploy the updated global model, distillation consistency model, and federated consensus risk factors to each edge node, perform real-time inference on the standardized feature data stream, and output threat detection results and confidence assessment reports.
3. The information technology detection method with security protection based on big data according to claim 2, characterized in that, S1 includes the following steps: S11. Collect multi-source heterogeneous log big data in real time from terminal logs, network traffic logs, host operation logs, application behavior logs, and business tracing logs to construct the original log dataset. ; S12. Perform format standardization and time alignment operations on the original log dataset to generate a uniform and structured log dataset; S13. Based on the structured log dataset, perform noise cleaning and field missing value completion operations, remove invalid logs and fill in missing field values, and convert each multi-source heterogeneous log big data into a feature vector. ; S14. Perform a normalization operation on the set of all feature vectors, normalizing all feature dimensions to the interval. The normalized feature set is written into the log feature database in a columnar storage structure to construct a standardized feature data stream. .
4. The information technology detection method with security protection based on big data according to claim 3, characterized in that, S2 includes the following steps: S21. Each participating node in the set of all participating nodes Receive standardized feature data stream Extract the corresponding local original tag set from the local system. The local original label set contains all log category labels known to the participating node, and the sample size of the local original label set is [missing information]. ; S22. Participating Nodes After receiving the standardized feature data stream, refer to the predefined global label specification set. Perform label standardization operation, and map each local label in the local original label set to a unique standard label in the global label specification set by constructing a mapping function, and generate a local labeled sample set. Each local labeled sample in the local labeled sample set is composed of a standardized feature vector and its corresponding standard label. S23. Participating Nodes For each locally labeled sample, perform an embedding mapping operation on the standard label, using a dimension of The embedding matrix encodes each standard label into a The label embedding vector is concatenated with the normalized feature vector to obtain a new set of fused feature vectors. The method for constructing the fused feature vector set remains consistent across all participating nodes, and is based on... The eigenvectors of dimension are uniformly represented, where Represents the dimension of the standardized feature vector. Indicates the dimension of the label embedding vector; S24. Participating Nodes With fused feature vector set Using the standardized label set as input, a local model is trained. During training, cross-entropy is used as the loss function, and minimizing the local training error is the optimization objective to obtain the local model parameters corresponding to the participating nodes. .
5. The information technology detection method with security protection based on big data according to claim 4, characterized in that, S3 includes the following steps: S31. Each participating node in the set of all participating nodes Receiving standardized feature data streams Then, based on the sliding window mechanism, the distribution of feature data is monitored in real time, and a window of length of [length missing] is constructed. sliding window ,in Indicates time The standardized feature vector received at each time step, Represents the dimension of the standardized feature vector. Set the preset sliding window size; S32. Calculate the sliding window The entropy values of each feature dimension within the time frame are used to obtain the time. Window entropy vector at time step It records the window entropy sequence at all times in time series form, with each entropy value in the window entropy value vector. Indicates the first Each feature dimension in the sliding window Internal entropy; S33. A weighted moving average function is used to smooth the trend of the window entropy sequence, generating a smoothed entropy trend function. The entropy change of each feature dimension is dynamically modeled using an entropy trend function. If the following drift criterion is met: ； If the current feature distribution is considered to have shifted, the feature evolution modeling mechanism will be triggered when the determination is true. in, To detect the interval step size The entropy trend function, Indicates the detection interval step size. This represents the drift threshold, where k is the feature dimension; S34. After triggering the feature evolution modeling mechanism, participating nodes After detecting a sudden change in entropy trend in the standardized feature data stream, a dynamic feature evolution model is constructed based on the temporal variation pattern of the abrupt feature dimension within the sliding window. Dynamic feature evolution model to expand feature subspace As the core representation, the extended feature subspace is concatenated with the original standardized feature space to obtain a new fused feature space. ,in To expand the dimensions of the features, This represents the newly extracted evolutionary feature vector; S35. Participating Nodes Expand the feature subspace The fused feature vector is concatenated with the original standardized feature vector to obtain a new fused feature vector. ,in This represents the concatenated fused feature vector and the dynamic feature evolution model. The structural information in the model is used as a version control record; S36. Update the local model input structure, changing the input layer dimension from the original... Expand to This forms a local model input structure consistent with the current fusion feature space, and retains the weight structure of the dynamic feature evolution model as the old state transfer part, realizing a continuous transition and parameter sharing between the local model and the dynamic feature evolution model.
6. The information technology detection method with security protection based on big data according to claim 5, characterized in that, S4 includes the following steps: S41. Each participating node in the set of all participating nodes After completing the local model After training, based on the fused feature vector set Calculate the gradient parameters of the local model to obtain the set of original local gradient vectors. The local original gradient vector set contains the gradient results of all learnable parameters in the model; S42. Participating Nodes Each gradient value in the local original gradient vector set is subjected to fixed-point quantization, using a uniform quantization step size. Mapping floating-point gradient values to integer representations generates a set of quantized gradient vectors. ; S43. Participating Nodes For the set of quantized gradient vectors Perform homomorphic encryption to generate intermediate encryption gradient results. Based on the differential privacy mechanism, a noise vector is superimposed on the intermediate results of the encrypted gradient. The perturbation intensity of each noise component is determined by the differential privacy budget parameter. With quantization step size Together, they determined the final encrypted gradient vector. ; S44. Participating Nodes Upload the final encrypted gradient vector to the federal coordinator The federal coordinator uses the global verification set of the current round. With the local validation set of the participating node Evaluate the performance difference between the global model and the local model separately, and calculate the migration loss value of the participating node. The migration loss value represents the degree of deviation between the global model and the local model in terms of predictive ability, and is used to measure the degree of heterogeneity between the data distribution of participating nodes and the global model. S45. The federated coordinator calculates the migration loss value based on all participating nodes. Implement a migration loss-driven dynamic clustering mechanism to divide all participating nodes into several subgroups. Each subgroup contains participating nodes with similar migration loss characteristics, forming a multi-level heterogeneous adaptation structure; S46. The federated coordination end is based on a multi-level heterogeneous adaptation structure, targeting each subgroup. Set the shared layer depth parameter separately Local learning rate parameter Synchronization frequency parameter with model update Generate federated cluster configuration .
7. The information technology detection method with security protection based on big data according to claim 2, characterized in that, S6 includes the following steps: S61. Before each round of aggregation operation, the federated coordinator evaluates the reputation of all participating nodes based on their behavior in previous rounds and the reputation entropy index of participating nodes recorded on the blockchain sidechain. A unified reputation threshold is set. When the reputation entropy index of a participating node is higher than the reputation threshold, the participating node is assigned to the teacher participating node set; otherwise, it is assigned to the student participating node set. S62. Each teacher participation node in the set of teacher participation nodes It uses the local model trained in the current round to infer its local labeled feature data set and generates the corresponding soft label set. ; S63. Each teacher participating node encrypts the generated soft tag set and securely forwards it to one or more student participating nodes with reputation entropy below the reputation threshold through the federated coordinator. After receiving multiple soft tag sets from different teacher participating nodes, the student participating nodes aggregate the soft tags according to a unified averaging fusion strategy to form a fused soft tag set. ; S64. After receiving the fused soft label set, each student participating node introduces a consistency regularization term during the original local model training process. The consistency regularization term constrains the difference between the current output of the model and the fused soft label. The difference is calculated in the form of the distance between the predicted probability distributions and is used to measure the degree of approximation between the student model and the fused soft label. S65. Student-participating nodes construct a joint training objective function. The objective function consists of two parts: one is the standard supervised learning loss, which measures the error between the local model output used by the student node for distillation training and the local standard label; the other is the consistency regularization loss, which measures the deviation between the local model output and the fused soft label. The two losses are weighted and combined by the distillation balance coefficient to control the learning ratio of the local model between local label learning and soft label guidance. S66. Each student participating node completes model training and updates based on the joint training objective function, generating new local model parameters, which are the distillation consistency model parameters. .