Personalized federal intrusion detection method based on meta-learning local self-adaption and prototype guidance
By employing a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance, this method addresses the issues of model performance degradation and insufficient identification of unknown attacks caused by data heterogeneity in IoT systems, achieving efficient attack detection and identification.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- BEIJING ELECTRONICS SCI & TECH INST
- Filing Date
- 2026-01-22
- Publication Date
- 2026-05-08
AI Technical Summary
Traditional intrusion detection methods struggle to cope with complex network threats in IoT systems, especially in distributed architectures where data heterogeneity leads to decreased model performance and insufficient ability to identify unknown attacks.
A personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance is adopted. The global model is initialized on the server side and local training is combined with meta-learning local adaptation and prototype alignment constraints to generate a fair global prototype and local model, thereby optimizing the global classifier.
It improves attack detection performance in heterogeneous environments, enhances the ability to generalize and identify unknown attacks, and maintains the robustness and personalized adaptability of the model.
Smart Images
Figure CN122001633A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence technology, and in particular to a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance. Background Technology
[0002] With the rapid expansion of the number of IoT devices and their application scenarios, the cybersecurity threats they face are becoming increasingly severe. Malicious attackers frequently launch DDoS attacks, malicious intrusions, and other cyberattacks by exploiting device vulnerabilities, network protocol flaws, and outdated security measures, posing a continuous and complex threat to IoT systems. Therefore, there is an urgent need to deploy efficient Intrusion Detection Systems (IDS) to ensure the security and stable operation of these systems.
[0003] Traditional intrusion detection methods (such as rule-based signature detection) rely on prior knowledge bases, making them ineffective against today's complex cybersecurity threats. Deep learning-based intrusion detection methods, through end-to-end training, automatically extract and identify traffic features, improving accuracy and generalization capabilities, and achieving significant success. However, deep learning-based intrusion detection methods typically employ a centralized training model, requiring network flow data distributed across various edge devices to be aggregated to a central server for training. This centralized data processing approach carries the risk of information leakage, and sensitive local data is easily misused by the server. Furthermore, centralized intrusion detection is ill-suited for the current distributed architecture of IoT devices; when faced with ever-increasing IoT traffic data, the computational overhead of the central server increases dramatically, incurring additional time costs.
[0004] Federated learning-based intrusion detection algorithms aim to achieve collaborative training of distributed network edge devices to a certain extent, while ensuring data privacy and security. Federated learning, as an emerging distributed machine learning paradigm focused on data privacy protection, transmits local model parameters to a server, where a global model is built to enable collaborative training across multiple clients. Traditional federated learning-based intrusion detection methods primarily utilize existing methods to improve the local model structure and enhance the local identification accuracy of edge devices. These algorithms are often tested on clusters of edge devices with uniformly distributed data. However, network traffic data collected locally by edge devices in distributed IoT architectures exhibits heterogeneity; that is, the local datasets of different edge devices are not independent and identically distributed. Due to differences in deployment environments, device performance, and the types of network threats faced by different edge devices, their locally collected traffic data shows significant inconsistencies in quantity, features, and category distribution. This heterogeneity of local data from edge devices severely impacts the performance and convergence speed of the global model.
[0005] Personalized federated learning optimizes global model aggregation to address differences in client data distribution, which can improve model performance to some extent when facing local data heterogeneity issues. However, these algorithms primarily focus on the differences in data distribution between client orders, neglecting the distribution characteristics of local datasets. Local intrusion detection datasets often contain a large proportion of benign data and a small amount of abnormal traffic data; this imbalanced distribution of local data negatively impacts the model's generalization ability.
[0006] Current methods for identifying all types of abnormal traffic rely primarily on the generalization ability of the global model for performance improvements. However, due to the significant non-independent and identically distributed nature of client-side local data in IoT environments, simply relying on the global model has limited transferability across different clients, resulting in poor identification of rare or unknown attack categories. More importantly, existing research generally lacks mechanisms for sharing attack traffic information across all categories, limiting the model's ability to identify and improve robustness against unseen categories across clients. Summary of the Invention
[0007] The main objective of this invention is to provide a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance.
[0008] Another objective of this invention is to propose a personalized federated intrusion detection device based on meta-learning local adaptation and prototype guidance.
[0009] The third objective of this invention is to provide a computer device.
[0010] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.
[0011] To achieve the above objectives, a first aspect of the present invention proposes a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance, comprising: S1, the global model is initialized on the server side, the central server initializes the parameters of the feature extractor and classifier, and sends the initial global model to all edge device clients; S2, through a random subset of clients via the central server, sends the global model and fair global prototype to each edge device client in the client subset; S3 receives the global model and fair global prototype through the selected boundary device client, performs local training that combines meta-learning local adaptation with prototype alignment constraints, obtains the local model and local prototype, and uploads them to the server. S4 generates a global model and a global classifier to optimize the dataset based on the local model and local prototype uploaded by the client on the server side, performs prototype clustering on the local prototype, generates a new round of fair global prototypes, and optimizes the global classifier. S5, repeat S2 to S4 until the predetermined number of global collaboration rounds is reached to obtain the optimized global model; S6 sends the optimized global model to each edge device client via the server, and the client performs a round of local training on the received global model to obtain a local personalized model.
[0012] In one embodiment of the present invention, the client in S2 The local prototype calculation formula is:
[0013] in, It is a category The local prototype It is a client Private data A subset of, by All categories The data composition.
[0014] In one embodiment of the present invention, S3 further includes: S31, receives the global model and fair global prototype through the selected boundary device client; S32, Based on the fair global prototype, construct prototype alignment constraints and combine them with the meta-learning local adaptive method for local training; S33 generates a smoothed local dataset via a client; this client... Local dataset The smooth label is:
[0015] in, Indicates one-hot label Smoothed labels Indicates smooth label Class label value, This represents the smoothing factor used to control the degree of label softening. This represents the smoothed local dataset; S34, Fine-tune the local classifier based on the balanced and smooth labels in the local dataset; S35 generates a local prototype, and uploads the updated local model and local prototype to the server.
[0016] In one embodiment of the present invention, S32 includes: Define client The local fair global prototype alignment constraint loss is:
[0017] in, It is a client The local feature extractor's output for class c local data is defined as follows: ; yes and The Euclidean distance is defined as ; Redefining the client Local loss function for:
[0018] in, It is a loss of local supervision training. ; The overall training objective, redefined by meta-learning local adaptation incorporating fair global prototype alignment constraints, is:
[0019] in, The step size represents the local training learning rate. Indicates the client Relative to model parameters The gradient; Define the local meta function of the border device client for:
[0020] Define local meta function The gradient is calculated as follows:
[0021] During the local training in round e, Stepwise learning of stochastic gradient descent, let For the client Parameters for calculating the gradient of the k-th meta-learning step; definition for:
[0022] in, This indicates that the learning rate is updated locally. The computational overhead is significant. Considering the actual computing resource capabilities of IoT edge devices and based on the unbiasedness of gradients, a batch of data is used. The gradient can be approximated using the following formula:
[0023] Meta gradient estimated value The calculation formula is:
[0024] in, , , These are different batches of local data used for each calculation of the stochastic gradient; during multiple rounds of local training, the client iteratively updates the model parameters as follows:
[0025] in, This represents the model parameters of client i at the start of the (e+1)th round of local training.
[0026] In one embodiment of the present invention, S4 further includes: S41, the server receives the local prototype sent by the client and generates a global model using a weighted average calculation; wherein, the server uses a weighted average aggregation calculation method to generate the global model in round t, and the parameter calculation formula is:
[0027] in, This represents the set of clients participating in the t-th round of global collaborative training. Represents the global model parameters in the t-th round of global collaborative training; S42 aggregates the local prototypes uploaded by the clients participating in the training into a global classifier optimization dataset. ,in Defined as:
[0028] in, It is a collection of local prototypes uploaded by the client, defined as , It is a local prototype Corresponding category tags; S43, perform prototype clustering on the local prototypes to generate a fair global prototype; select a set of local prototype cluster centers for each type of data. The process can be represented as:
[0029] in, It is the set of clients participating in the global collaboration in this round. express The number of clusters of the local prototype; The calculation formula for the global prototype is redefined, based on the set of local prototype cluster centers. The fair global prototype is obtained by calculating the average prototype. The calculation formula is as follows:
[0030] in, The fair global prototype is calculated from the local prototype cluster center of class c; S44, through the aforementioned Optimize the global classifier to obtain the final updated global model and a fair global prototype; the loss function for optimizing the global classifier is:
[0031] in, Optimize the dataset for the global classifier.
[0032] To achieve the above objectives, a second aspect of the present invention provides a personalized federated intrusion detection device based on meta-learning local adaptation and prototype guidance, comprising: The initialization module is used to initialize the global model on the server side, the central server initializes the feature extractor and classifier parameters, and sends the initial global model to all edge device clients; The distribution module is used to randomly select a subset of clients through a central server and send the global model and fair global prototype to each edge device client in the client subset. The training module is used to receive the global model and fair global prototype through the selected boundary device client, perform local training that combines meta-learning local adaptation with prototype alignment constraints, obtain the local model and local prototype, and upload them to the server. The aggregation module is used to generate a global model and a global classifier to optimize the dataset based on the local model and local prototype uploaded by the client on the server side, perform prototype clustering on the local prototype to generate a new round of fair global prototypes, and optimize the global classifier. The loop optimization module is used to repeatedly execute S2 to S4 until the predetermined number of global collaboration rounds is reached, resulting in an optimized global model. The personalization module is used to send the optimized global model to each edge device client via the server, and the client performs a round of local training on the received global model to obtain a local personalized model.
[0033] To achieve the above objectives, a third aspect of this application provides a computer device comprising a processor and a memory; wherein the processor runs a program corresponding to the executable program code stored in the memory, for implementing a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance as described in the first aspect embodiment.
[0034] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program that, when executed by a processor, implements a meta-learning local adaptation and prototype-guided personalized federated intrusion detection method as described in the first aspect embodiment.
[0035] The embodiments of the present invention have the following beneficial effects: This method improves the accuracy of local models under heterogeneous data conditions. The performance of DeepFed, FedProx, and MOON tends to decrease with increasing data heterogeneity, indicating that their traditional global aggregation and regularization mechanisms have significant limitations in handling highly heterogeneous data, making it difficult to achieve an effective balance between global convergence and local adaptation. While FedProto introduces a global prototype to improve class discrimination, its performance is poor in highly heterogeneous scenarios. This is because the global prototype is generated using a simple weighted average method, making it difficult to construct effective embedded feature class centers based on the distribution differences among clients. PerFLID and PFTD are both based on meta-federated learning for collaborative training, showing better performance compared to other baseline algorithms. The table illustrates that the meta-learning strategy can effectively utilize a small amount of local data to achieve rapid personalized adaptation while maintaining a certain global generalization ability. This invention aggregates and generates a globally fair prototype, mitigating the impact of dominant client effects on embedded feature aggregation, and improves the discriminative ability of the global embedded feature space through a prototype-driven global classifier optimization strategy. Combined with a meta-learning local adaptation mechanism with fair global prototype alignment constraints, efficient personalized training is achieved, improving attack detection performance in distributed IoT intrusion detection scenarios.
[0036] This method exhibits relatively stable generalization performance under varying degrees of data heterogeneity, with minimal variation in recognition ability due to data heterogeneity, demonstrating good robustness. Particularly in highly heterogeneous data distribution environments, PFID-MP shows a more significant improvement in performance for detecting all types of attacks. Traditional methods, in scenarios with high data heterogeneity, suffer from insufficient generalization ability, and their performance decreases significantly with increasing heterogeneity. As the distribution differences of client-side local data gradually widen, the performance of various methods for identifying all types of attacks generally shows a downward trend. This invention effectively preserves the diversity of client-side local embedded features through a fair global prototype strategy; simultaneously, through a prototype-driven global classifier optimization mechanism and spatial alignment constraints of local embedded features, it further improves the model's recognition accuracy for all attack categories, achieving efficient synergy between global embedded feature sharing and local personalized adaptation.
[0037] This method improves the generalization performance for identifying unknown attacks under varying data heterogeneity. Local training on the client side alone is insufficient for effectively identifying unseen attack types. Traditional federated methods, while improving accuracy through global collaboration, still suffer from significantly limited generalization performance under highly heterogeneous conditions. The prototype-driven global classifier optimization mechanism proposed in this invention significantly improves the generalization ability for identifying unknown attack categories by optimizing the global classifier. Secondly, it combines a meta-learning local adaptation strategy with fair global prototype alignment constraints, achieving efficient synergy between global generalization and local personalized adaptation by more effectively utilizing local data. This combined strategy not only makes PFID-MP perform exceptionally well in unknown attack identification tasks but also maintains good classification performance for locally known categories, demonstrating more comprehensive model generalization ability and robustness. Attached Figure Description
[0038] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart of a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance provided in an embodiment of the present invention; Figure 2 A diagram illustrating a PFID-MP-based IoT federated intrusion detection method, which is a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance, provided in an embodiment of the present invention. Figure 3 This is a comparison chart of algorithm performance under different data heterogeneity conditions provided in the embodiments of the present invention; Figure 4 This is a structural diagram of the personalized federated intrusion detection device based on meta-learning local adaptation and prototype guidance provided in an embodiment of the present invention. Detailed Implementation
[0039] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.
[0040] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.
[0041] The following description, with reference to the accompanying drawings, describes a personalized federated intrusion detection method and apparatus based on meta-learning local adaptation and prototype guidance, according to an embodiment of the present invention.
[0042] Example 1 This embodiment provides a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance. For example... Figure 1 and Figure 2 As shown, the method includes the following steps: S1 initializes the global model on the server side, the central server initializes the parameter extractor and classifier, and sends the initial global model to all edge device clients.
[0043] S2, through a random subset of clients via a central server, sends the global model and fair global prototype to each edge device client in the client subset.
[0044] It should be noted that the global model is a shared model initialized by the central server and iteratively optimized after local training and feedback from each edge device client. It includes core modules such as feature extractors and classifiers. Through multiple rounds of collaborative training between clients and the server, it can achieve cross-device data feature sharing and model performance improvement. The fair global prototype, on the other hand, is a global benchmark prototype generated by the central server after clustering the local prototypes uploaded by each client. Its role is to reduce model bias caused by differences in the distribution of local data on clients and ensure the fairness and consistency of the global model on different clients.
[0045] S3 receives the global model and fair global prototype through the selected boundary device client, performs local training combining meta-learning local adaptation and prototype alignment constraints, obtains the local model and local prototype, and uploads them to the server.
[0046] Specifically, step S3 is performed through the following steps: S31 receives the global model and fair global prototype through the selected boundary device client.
[0047] S32, Based on the fair global prototype, construct prototype alignment constraints and combine them with a meta-learning local adaptive method for local training.
[0048] Specifically, S32 is executed through the following steps: Define client The local fair global prototype alignment constraint loss is:
[0049] in, It is a client The local feature extractor's output for class c local data is defined as follows: ; yes and The Euclidean distance is defined as .
[0050] Furthermore, By leveraging the positive-negative sample comparison approach in contrastive learning, the embedded feature vectors of class c local data on the client are made possible during the local training phase. As close as possible to the global prototype By moving away from global prototypes of other categories, the discriminative power of embedded features is enhanced, improving model classification performance. This is achieved through the client-side. Local features With global prototype By aligning the models, the client-side models can maintain the personalization of local data during the optimization process while keeping consistent with the global prototype, thereby improving the overall performance of the model and reducing the negative impact of class imbalance and data heterogeneity.
[0051] Redefining the client Local loss function for:
[0052] in, It is a loss of local supervision training. .
[0053] To enhance the personalization performance of the global model in a Non-IID environment, Model-Agnostic Meta-Learning (MAML) is introduced during the local training phase on edge devices. After each round of global collaborative communication, each client performs a small number of local updates using MAML, enabling it to quickly obtain a personalized model adapted to its local data distribution.
[0054] The overall training objective, redefined by meta-learning local adaptation incorporating fair global prototype alignment constraints, is:
[0055] in, The step size represents the local training learning rate. Indicates client Relative to model parameters The gradient.
[0056] Define the local meta function of the border device client for:
[0057] Define local meta function The gradient is calculated as follows:
[0058] During the local training in round e, Stepwise learning of stochastic gradient descent, let For the client Parameters for calculating the gradient of the k-th meta-learning step; definition for:
[0059] in, This indicates that the learning rate is updated locally. The computational overhead is significant. Considering the actual computing resource capabilities of IoT edge devices and based on the unbiasedness of gradients, a batch of data is used. The gradient can be approximated using the following formula:
[0060] Meta gradient estimated value The calculation formula is:
[0061] in, , , These are different batches of local data used for each calculation of the stochastic gradient; during multiple rounds of local training, the client iteratively updates the model parameters as follows:
[0062] in, This represents the model parameters of client i at the start of the (e+1)th round of local training.
[0063] In this embodiment of the invention, meta-learning local adaptation combined with fair global prototype alignment constraints enables clients to quickly adapt to local data with a small number of local updates in a Non-IID environment, maintaining alignment with the global embedding space distribution, enhancing feature discrimination, and improving the classification performance of the model. In intrusion detection tasks in the Internet of Things environment, it can effectively improve the robustness and generalization ability of the system.
[0064] S33 generates a smoothed local dataset via a client; this client... Local dataset The smooth label is:
[0065] in, Indicates one-hot label Smoothed labels Indicates smooth label Class label value, This represents the smoothing factor used to control the degree of label softening. This represents the smoothed local dataset.
[0066] S34, Fine-tune the local classifier based on the balanced and smooth labels in the local dataset.
[0067] Specifically, after meta-learning local adaptation training combined with fair global prototype alignment constraints, this embodiment of the invention freezes the local feature extractor. Using balanced smoothing labels only for the head of the local personalized model To fine-tune the loss function, we define it as follows:
[0068] S35 generates a local prototype, and uploads the updated local model and local prototype to the server.
[0069] S4 generates a global model and a global classifier to optimize the dataset based on the local model and local prototype uploaded by the client on the server side. It then performs prototype clustering on the local prototype to generate a new round of fair global prototypes and optimizes the global classifier.
[0070] Specifically, step S4 is performed through the following steps: S41, the server receives the local prototype sent by the client and generates a global model using a weighted average calculation; wherein, the server uses a weighted average aggregation calculation method to generate the global model in round t, and the parameter calculation formula is:
[0071] in, This represents the set of clients participating in the t-th round of global collaborative training. Represents the global model parameters in the t-th round of global collaborative training; S42, aggregates the local prototypes uploaded by the clients participating in the training into a global classifier optimization dataset. ,in Defined as:
[0072] in, It is a collection of local prototypes uploaded by the client, defined as , It is a local prototype Corresponding category tags; S43, perform prototype clustering on the local prototypes to generate a fair global prototype; select a set of local prototype cluster centers for each type of data. The process can be represented as:
[0073] in, It is the set of clients participating in the global collaboration in this round. express The number of clusters of the local prototype class; The calculation formula for the global prototype is redefined, based on the set of local prototype cluster centers. The fair global prototype is obtained by calculating the average prototype. The calculation formula is as follows:
[0074] in, The fair global prototype is calculated from the local prototype cluster center of class c.
[0075] A fair global prototype is generated by first clustering the local prototype and then averaging it. The absence of local data during the computation process reduces the dominant client effect, improves the fairness of the global prototype construction process, and preserves the diversity of embedded features among clients to some extent.
[0076] S44, through the aforementioned Optimize the global classifier to obtain the final updated global model and a fair global prototype; the loss function for optimizing the global classifier is:
[0077] in, Optimize the dataset for the global classifier.
[0078] S5, repeat S2 to S4 until the predetermined number of global collaboration rounds is reached, and the optimized global model is obtained.
[0079] Specifically, this iterative mechanism plays a key role in two aspects: First, through multiple rounds of knowledge exchange and fusion, the global model gradually learns the common intrusion features distributed across different clients, thereby improving the model's generalization ability; Second, the fair global prototype is dynamically updated in each iteration, continuously optimizing the estimation of feature centers for each category, providing clients with more accurate alignment targets, thus effectively alleviating the client drift problem caused by data heterogeneity.
[0080] S6 sends the optimized global model to each edge device client via the server, and the client performs a round of local training on the received global model to obtain a local personalized model.
[0081] Specifically, after N rounds of global collaboration, the server distributes the final global model to all clients. Each client uses this model as a starting point to perform a round of supervised fine-tuning using all its local data. This process continues the prototype alignment constraint, enabling the model to quickly adapt to local data distribution while inheriting global knowledge, ultimately generating a highly personalized intrusion detection model for low-latency, high-precision real-time threat classification at the edge.
[0082] This invention addresses the client-side bias problem caused by data heterogeneity in federated learning through prototype-guided learning and enables rapid personalization of the model through a meta-learning local adaptive mechanism. The final deployment steps ensure efficient conversion of general knowledge to individual scenarios, allowing IoT edge devices to acquire global consensus security knowledge while maintaining high detection sensitivity against local specific threats, significantly improving the overall performance and practicality of intrusion detection systems in complex and heterogeneous environments.
[0083] Example 2 This invention also provides an experimental verification of a personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance, specifically including: In this embodiment of the invention, in order to comprehensively evaluate the performance of PFID-MP and various baseline methods, experiments were conducted on multiple datasets under three data heterogeneity scenarios, using Dirichlet distribution parameters. The values were set to 1, 0.5, and 0.1 respectively. This is specifically for the CIC-IDS2017 dataset. Set to 0.2; for the NF-CSE-CIC-IDS2018-v2 and NF-ToN-IoT-v2 datasets, The value was set to 0.6. All datasets were divided into training and test sets at 80% and 20% respectively. Comparisons were also made with other methods, such as... Figure 3 The figure shows the algorithm performance under different data heterogeneity.
[0084] Example 3 This invention also provides a personalized federated intrusion detection device based on meta-learning local adaptation and prototype guidance, such as... Figure 4 As shown, the device 10 includes: The initialization module 100 is used to initialize the global model through the server, the central server initializes the parameters of the feature extractor and classifier, and sends the initial global model to all edge device clients; The distribution module 200 is used to randomly select a subset of clients through the central server and send the global model and fair global prototype to each edge device client in the client subset. The training module 300 is used to receive the global model and fair global prototype through the selected boundary device client, perform local training that combines meta-learning local adaptation with prototype alignment constraints, obtain the local model and local prototype, and upload them to the server. The aggregation module 400 is used to generate a global model and a global classifier to optimize the dataset based on the local model and local prototype uploaded by the client on the server side, perform prototype clustering on the local prototype to generate a new round of fair global prototypes, and optimize the global classifier. The loop optimization module 500 is used to repeatedly execute S2 to S4 until the predetermined number of global collaboration rounds is reached, thereby obtaining the optimized global model; The personalization module 600 is used to send the optimized global model to each edge device client via the server, and the client performs a round of local training on the received global model to obtain a local personalized model.
[0085] Example 4 To implement the methods of the above embodiments, the present invention also provides a computer device, which includes a memory and a processor; wherein the processor runs a program corresponding to the executable program code by reading executable program code stored in the memory, so as to implement the various steps of the methods described above.
[0086] Example 5 To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.
[0087] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.
[0088] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.
[0089] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.
Claims
1. A personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance, characterized in that, Includes the following steps: S1, the global model is initialized on the server side, the central server initializes the parameters of the feature extractor and classifier, and sends the initial global model to all edge device clients; S2, through a random subset of clients via the central server, sends the global model and fair global prototype to each edge device client in the client subset; S3 receives the global model and fair global prototype through the selected boundary device client, performs local training that combines meta-learning local adaptation with prototype alignment constraints, obtains the local model and local prototype, and uploads them to the server. S4 generates a global model and a global classifier to optimize the dataset based on the local model and local prototype uploaded by the client on the server side, performs prototype clustering on the local prototype, generates a new round of fair global prototypes, and optimizes the global classifier. S5, repeat S2 to S4 until the predetermined number of global collaboration rounds is reached to obtain the optimized global model; S6 sends the optimized global model to each edge device client via the server, and the client performs a round of local training on the received global model to obtain a local personalized model.
2. The method according to claim 1, characterized in that, S2 client The local prototype calculation formula is: in, It is a category The local prototype It is a client Private data A subset of, by All categories The data composition.
3. The method according to claim 1, characterized in that, The S3 further includes: S31, receives the global model and fair global prototype through the selected boundary device client; S32, Based on the fair global prototype, construct prototype alignment constraints and combine them with the meta-learning local adaptive method for local training; S33 generates a smoothed local dataset via a client; this client... Local dataset The smooth label is: in, Indicates one-hot label Smoothed labels Indicates smooth label Class label value, This represents the smoothing factor used to control the degree of label softening. This represents the smoothed local dataset; S34, Fine-tune the local classifier based on the balanced and smooth labels in the local dataset; S35 generates a local prototype, and uploads the updated local model and local prototype to the server.
4. The method according to claim 3, characterized in that, S32 includes: Define client The local fair global prototype alignment constraint loss is: in, It is a client The local feature extractor's output for class c local data is defined as follows: ; yes and The Euclidean distance is defined as ; Redefining the client Local loss function for: in, It is a loss of local supervision training. ; The overall training objective, redefined by meta-learning local adaptation incorporating fair global prototype alignment constraints, is: in, The step size represents the local training learning rate. Indicates the client Relative to model parameters The gradient; Define the local meta function of the border device client for: Define local meta function The gradient is calculated as follows: During the local training in round e, Stepwise learning of stochastic gradient descent, let For the client Parameters for calculating the gradient of the k-th meta-learning step; definition for: in, This indicates that the learning rate is updated locally. The computational overhead is significant. Considering the actual computing resource capabilities of IoT edge devices and based on the unbiasedness of gradients, a batch of data is used. The gradient can be approximated using the following formula: Meta gradient estimated value The calculation formula is: in, , , These are different batches of local data used for each calculation of the stochastic gradient; during multiple rounds of local training, the client iteratively updates the model parameters as follows: in, This represents the model parameters of client i at the start of the (e+1)th round of local training.
5. The method according to claim 1, characterized in that, The S4 further includes: S41, the server receives the local prototype sent by the client and generates a global model using a weighted average calculation; wherein, the server uses a weighted average aggregation calculation method to generate the global model in round t, and the parameter calculation formula is: in, This represents the set of clients participating in the t-th round of global collaborative training. Represents the global model parameters in the t-th round of global collaborative training; S42 aggregates the local prototypes uploaded by the clients participating in the training into a global classifier optimization dataset. ,in Defined as: in, It is a collection of local prototypes uploaded by the client, defined as , It is a local prototype Corresponding category tags; S43, perform prototype clustering on the local prototypes to generate a fair global prototype; select a set of local prototype cluster centers for each type of data. The process can be represented as: in, It is the set of clients participating in the global collaboration in this round. express The number of clusters of the local prototype; The calculation formula for the global prototype is redefined, based on the set of local prototype cluster centers. The fair global prototype is obtained by calculating the average prototype. The calculation formula is as follows: in, The fair global prototype is calculated from the local prototype cluster centers of class c; S44, through the aforementioned Optimize the global classifier to obtain the final updated global model and a fair global prototype; the loss function for optimizing the global classifier is: in, Optimize the dataset for the global classifier.
6. A personalized federated intrusion detection device based on meta-learning local adaptation and prototype guidance, characterized in that, include: The initialization module is used to initialize the global model on the server side, the central server initializes the feature extractor and classifier parameters, and sends the initial global model to all edge device clients; The distribution module is used to randomly select a subset of clients through a central server and send the global model and fair global prototype to each edge device client in the client subset. The training module is used to receive the global model and fair global prototype through the selected boundary device client, perform local training that combines meta-learning local adaptation with prototype alignment constraints, obtain the local model and local prototype, and upload them to the server. The aggregation module is used to generate a global model and a global classifier to optimize the dataset based on the local model and local prototype uploaded by the client on the server side, perform prototype clustering on the local prototype to generate a new round of fair global prototypes, and optimize the global classifier. The loop optimization module is used to repeatedly execute S2 to S4 until the predetermined number of global collaboration rounds is reached, resulting in an optimized global model. The personalization module is used to send the optimized global model to each edge device client via the server, and the client performs a round of local training on the received global model to obtain a local personalized model.
7. A computer device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement the personalized federated intrusion detection method of meta-learning local adaptation and prototype guidance as described in any one of claims 1-5.
8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the personalized federated intrusion detection method based on meta-learning local adaptation and prototype guidance as described in any one of claims 1-5.