Federated continual learning based generalizable unsupervised network intrusion detection method

Abstract

The application discloses a kind of based on federal continuous learning's generalizable unsupervised network intrusion detection method, system and product, in cross-island federal learning scene, first, the network traffic data of each client is respectively as independent data island, the local network traffic data of each client is divided into training set, verification set and test set after pre-processing;Then locally deploy unsupervised network intrusion detection model in each client, the training set is input into the detection model and is locally trained, to obtain corresponding local model parameters;Then each client updates and aggregates the local model parameters of each client using federal continuous learning method;Finally, each client uses the double-threshold abnormal traffic detection algorithm based on F1-Score maximization to calculate traffic reconstruction loss on local test set, compare the reconstruction loss with the threshold, to realize the accurate identification of abnormal traffic in heterogeneous network.

Description

Technical Field

[0001] This invention belongs to the field of network information security technology, and relates to a generalizable unsupervised network intrusion detection method, system and product, specifically a generalizable unsupervised network intrusion detection method, system and product based on federated continuous learning. Background Technology

[0002] With the rapid development of network interconnection technology, the scope of network security threats has also expanded, attracting widespread attention from network attackers. This trend has led to disruptions in network infrastructure and communications, causing significant economic losses. Therefore, adopting effective systems and strategies to address this problem has become crucial. Network Intrusion Detection Systems (NIDS) are systems specifically designed to analyze network traffic to identify potential intrusions. They are widely used to protect network infrastructure and communications from network attacks.

[0003] Machine Learning (ML)-based Network Detection and Analysis (NIDS) (ML-NIDS) is a current research hotspot. Based on whether or not they rely on label information, machine learning models can be divided into supervised and unsupervised learning models. Therefore, ML-NIDS can be correspondingly divided into supervised and unsupervised ML-NIDS. In supervised ML-NIDS, supervised learning models are trained using labeled data and can effectively identify known attack types. However, the detection performance of this type of method is highly dependent on the quality and completeness of the labeled data, and high-quality labeled data is usually expensive to obtain and difficult to cover all potential attack types. Furthermore, when facing novel or unknown attacks, supervised ML-NIDS has limited generalization ability, easily leading to a decrease in F1-Score and an increase in False Positive Rate (FPR), thus increasing the risk of abnormal traffic bypassing the detection system. In contrast, unsupervised ML-NIDS does not rely on label information; it only uses normal traffic data for training to learn the behavioral patterns of normal network traffic and achieves anomaly detection during the inference phase by identifying traffic that deviates from the normal pattern. Therefore, unsupervised ML-NIDS typically exhibits stronger generalization ability in dealing with unknown attacks. However, existing unsupervised learning models still struggle to maintain stable detection performance when applied across datasets or network environments, exhibiting a decrease in F1-Score and an increase in FPR.

[0004] Currently, ML-NIDS faces two main challenges. First, network traffic data itself involves privacy issues. High-performance ML-NIDS relies on large amounts of high-quality network traffic data, but sharing network traffic may lead to privacy leaks, such as the misuse of trade secrets or network operation information by competitors or malicious actors. Therefore, in situations where multi-source network traffic data cannot be securely shared, data scarcity will limit the development of ML-based intrusion detection technologies. Second, the generalization ability of ML-NIDS in heterogeneous network environments remains limited. Specifically, machine learning models trained on specific NIDS datasets often struggle to maintain their original detection performance when migrated to actual deployment environments, exhibiting a decrease in F1-Score and an increase in FPR.

[0005] Federated Learning (FL) is an efficient distributed machine learning training paradigm. Within the FL framework, each client trains its model locally using its own data, uploading only the model parameters to a central server for aggregation. This allows for the construction of a global model while ensuring that the training data remains on the local device. This mechanism reduces communication costs while effectively protecting data privacy. Therefore, Federated Learning provides a new technical approach to addressing the privacy protection and cross-network environment generalization challenges of ML-NIDS.

[0006] Abou El Houda et al. proposed a framework called MiTFed (Reference 1), which utilizes FL, software-defined networking, and blockchain technologies to enable multiple network domains to collaboratively build intrusion detection models while protecting privacy, thus efficiently detecting network attacks.

[0007] Zhang Xiaolong et al. proposed a network intrusion detection algorithm called DCDP-FedF1 (Reference 2), which combines federated learning and differential privacy technology. Through dynamic gradient pruning and weighted aggregation based on macro-average F1 index, it improves the detection performance of the model while protecting user privacy.

[0008] Li Dongfen et al. proposed FedCQIDS (Reference 3), which integrates quantum convolutional neural networks into the federated learning framework and constructs a lightweight quantum feature extraction module, effectively improving the detection capability of sparse attacks while ensuring data privacy.

[0009] Tian et al. proposed a threat detection method based on federated learning (Reference 4), using a deep autoencoder for anomaly detection. By introducing delayed gradient compensation and pre-warming initialization in a non-independent and identically distributed (Non-IID) data environment, the global model is optimized. Each client updates its parameters using local data and only exchanges necessary information with the central server to protect privacy. This method demonstrates good convergence and efficiency.

[0010] Huong et al. proposed an anomaly detection method (Reference 5) combining variational autoencoders and long short-term memory (LSTM) networks to identify anomalies in time series data. This method is implemented on edge devices using a federated learning framework and employs kernel quantile estimation to optimize threshold settings to distinguish between normal and anomalous data points. However, all of the above schemes lack exploration of the generalization ability of NIDS in heterogeneous network environments.

[0011] The main challenge in evaluating the generalization capability of FL-based NIDS (FL-NIDS) on heterogeneous networks is the need for standardized network intrusion detection features, a problem that Sarhan et al. solved (Reference 6).

[0012] Popoola et al. investigated the problem of improving the generalization ability of NIDS using federated learning (Reference 7). They used a dedicated central server to receive local deep neural network (DNN) parameters from edge nodes and aggregated the local model parameters based on the Fed+ fusion algorithm to generate a global model with stronger generalization ability. Fed+ does not force all local models to converge to the same fixed global centroid, but introduces an adjustable centroid function C(X) to aggregate model parameters. This guides local models to adapt to their respective Non-IID data distributions while achieving convergence towards the global optimum, thus improving the model's generalization ability. Furthermore, this study employed a supervised learning model.

[0013] Sarhan Layeghy et al. employed supervised learning models DNN and LSTM, combined with the FedAvg algorithm in federated learning, to perform shared learning across the NF-UNSW-NB15-v2 and NF-BoT-IoT-v2 datasets (Reference 8). Through federated training, the global model outperformed local independent training in overall detection performance. On the NF-BoT-IoT-v2 test set, the accuracies of DNN and LSTM reached 93.04% and 93.03%, respectively, significantly higher than the 86.21% and 88.52% achieved by local training. This demonstrates that federated learning can effectively integrate multi-source data and improve the generalization ability of NIDS.

[0014] In summary, existing FL-NIDS schemes are mostly focused on supervised methods, and research on the generalization ability of unsupervised FL-NIDS in heterogeneous network environments is still insufficient. Related schemes generally suffer from problems such as strong dependence on labeled data and insufficient generalization ability in heterogeneous network environments.

[0015] References: Document 1: Abou El Houda Z, Hafid AS, Khoukhi L. MiTFed: A privacypreserving collaborative network attack mitigation framework based on federated learning using SDN and blockchain[J]. IEEE Transactions on NetworkScience and Engineering, 2023, 10(4): 1985-2001. Reference 2: Zhang Xiaolong, Luo Wenhua. Federated learning intrusion detection using dynamic pruning differential privacy [J]. Small and Microcomputer Systems, 2024, 45(6): 1474-1481. Reference 3: Li Dongfen, Xiang Qiuyu, Hu Zhikang, et al. An intrusion detection model integrating federated learning and quantum convolutional neural networks [J]. Computer Research and Development, 2025, 62(10): 2512-2522. Document 4: Tian P, Chen Z, Yu W, et al. Towards asynchronous federated learning based threat detection: a dc-adam approach[J]. Computers&Security, 2021, 108: 102344. Document 5: Huong TT, Bac TP, Long DM, et al. Detecting cyberattacks using anomaly detection in industrial control systems: a federated learning approach[J]. Computers in Industry, 2021, 132: 103509. Document 6: Sarhan M, Layeghy S, Portmann M. Towards a standard feature set for network intrusion detection system datasets[J]. Mobile Networks andApplications, 2022, 27(1): 357-370. Document 7: Popoola SI, Gui G, Adebisi B, et al. Federated deep learning for collaborative intrusion detection in heterogeneous networks[C] / / 2021 IEEE94th Vehicular Technology Conference (VTC2021-Fall). IEEE, 2021: 1-6. Document 8: Sarhan M, Layeghy S, Moustafa N, et al. Cyber ​​threatintelligence sharing scheme based on federated learning for network intrusiondetection[J]. Journal of Network and Systems Management, 2023, 31(1): 3-25. Summary of the Invention To address the issue of insufficient generalization ability of unsupervised FL-NIDS in heterogeneous networks, this invention provides a generalizable unsupervised network intrusion detection method, system, and product based on federated continuous learning.

[0016] The technical solution adopted by the method of the present invention is: a generalizable unsupervised network intrusion detection method based on federated continuous learning, characterized by comprising the following steps: Step 1: In the cross-island federated learning scenario, the network traffic data of each client is treated as an independent data island. The local network traffic data of each client is preprocessed and divided into training set, validation set and test set. Step 2: Deploy an unsupervised network intrusion detection model locally on each client, and input the training set into the unsupervised network intrusion detection model for local training to obtain the corresponding local model parameters; Step 3: Without sharing the original network traffic data among clients, a federated continuous learning method is used to update and aggregate the local model parameters of each client. In this process, by introducing structural regularization constraints during the local model training, the local models of different clients gradually converge to a common parameter space, thereby obtaining the optimal global model parameters and distributing them to each client. Step 4: Each client determines the abnormal traffic detection threshold based on the verification set, and calculates the traffic reconstruction loss on the local test set using the unsupervised network intrusion detection model with the optimal global model parameters. The reconstruction loss is then compared with the threshold to achieve accurate identification of abnormal traffic in heterogeneous networks.

[0017] Preferably, in step 1, the preprocessing of the local network traffic data for each client includes processing outliers and missing values, removing feature fields that are irrelevant to intrusion detection, and standardizing network traffic features.

[0018] Preferably, in step 2, the unsupervised network intrusion detection model includes an energy flow classifier and a stacked noise-reducing sparse autoencoder. After network traffic samples are input into the pre-trained energy flow classifier, the energy flow classifier generates corresponding energy value features for the network traffic samples. The energy value features are added to the original dataset as additional features and input into the stacked denoising sparse autoencoder to calculate the reconstruction loss of the traffic and compare it with a threshold, thereby realizing the identification of abnormal traffic in heterogeneous networks. The stacked denoising sparse autoencoder is formed by stacking multiple denoising sparse autoencoders as building blocks, and is suitable for traffic data containing energy value features. x Stacked noise-reducing sparse autoencoders reconstruct it into And calculate the reconstruction loss.

[0019] Preferably, the noise-reducing sparse autoencoder first performs noise reduction on the original input. X Add noisy data and select the random mapping function.qD ()Will X Convert to noisy data Then X c As input, encoding and decoding are performed sequentially; The encoding stage will remove the damaged data X c Project onto the hidden layer. ,in, h The activation value of the hidden layer. ReLU For activation function, , and These are the weight matrix and the bias term, respectively. To improve the feature extraction capability of the hidden layer while avoiding overfitting, a sparsity constraint is introduced; it is assumed that there are a total of m One sample, h j (i) Indicates the first i The sample at the th j The activation value of a neuron is then defined as the average activation degree of that neuron across all training samples. Assume the target sparsity of the hidden layer is... In order to make near , definition based on KL The sparsity penalty term for divergence is as follows: ; in, n This represents the number of neurons in the hidden layer. The decoding phase will determine the activation values ​​of the hidden layer. h Reconstructed Samples The definition is as follows: ; in , and These are the decoding weight matrix and the bias term, respectively; The purpose of the model is to optimize the model's parameters. and Therefore, the optimization objective function is adopted as follows: ; in To control the weight of the sparsity penalty factor; Reconstruction loss used for threshold calculation and flow inference It is the mean absolute error (MAE). ,in N The feature dimension of the traffic sample.

[0020] Preferably, in step 2, the training set is input into the unsupervised network intrusion detection model for local training, including a pre-training stage and a fine-tuning stage; In the pre-training phase, the energy flow classifier is first trained using the training set. Then, the network traffic data in the training set is input into the trained energy flow classifier to generate corresponding energy values, and the energy values ​​are fused with the original network traffic features as additional features. After obtaining the training data containing energy value features, a layer-by-layer greedy unsupervised learning approach is used to pre-train the stacked denoising sparse autoencoder: each layer of the denoising sparse autoencoder is trained separately in sequence, with each layer only started after the previous layer has been trained, and the output of the hidden layer of the previous layer is used as the input of the next layer, thereby obtaining the initial weights and bias parameters of each layer of the autoencoder. The fine-tuning stage, used for subsequent federated learning training, involves jointly optimizing all network parameters of the stacked denoising sparse autoencoder based on the initial weights and bias parameters obtained from the pre-training, and further minimizing the reconstruction loss through backpropagation.

[0021] Preferably, in step 3, the method of updating and aggregating the local model parameters of each client using federated continuous learning includes the following sub-steps: Step 3.1: During the local training process, each client updates the parameters of its local unsupervised network intrusion detection model based on the local training set and the local model parameters of other clients; Among them, an optimized loss function is constructed for local model training, including a loss term for learning local data features and a structure regularization loss term for incorporating knowledge from other client models; Client i The optimization loss function is: ; in, D i Indicates the client i The local training set, Indicates the first t Wheel Client i The mean square error, Indicates the first t Wheel Client i The sparsity penalty term, λ It is a regularization factor. Indicates the ( t -1) The first round j The local model's first k The importance factors of each parameter Indicates the first t Wheel Client i The k The local model parameters, that is, the local model parameters for the current round. Indicates the ( t -1) The first round j The local model's first k The parameters are the other local model parameters obtained in the previous round; Step 3.2: After completing local training, each client uploads its local model parameters and the corresponding model parameter importance factor matrix to the central server; Step 3.3: The central server aggregates the local model parameters uploaded by each client to obtain global model parameters, and distributes the global model parameters, model parameters from other clients, and model parameter importance factor matrices to each client to support the next round of federated continuous learning training; finally, a set of optimal global model parameters is obtained through the federated continuous learning method and distributed to each client.

[0022] Preferably, in step 3.1, the importance factor matrix of the other client model parameters is calculated using the synaptic intelligence method; First, in the t During federated training, during the local model training process on the client side, for minor updates to the local model parameters, the change in local training loss caused by the parameter update is estimated based on the gradient information of the corresponding parameter, to characterize the contribution of the parameter update to the change in local training loss; wherein, the local training loss... Change through gradient Estimate, expressed as , Indicates the first t The first round of local training k The amount of update for each model parameter. Indicates the first t During local training, the client i Local model parameter update amount, Indicates the first t During local training, the client i Local model parameters, Indicates the first t The first round of local training k The gradient values ​​of each model parameter. This indicates the contribution of the parameter update to the change in local training loss; Then, the changes in training loss caused by minor parameter updates during each iteration of the local training phase are summed to obtain the cumulative contribution of each model parameter to the overall reduction in local training loss in the current parameter space. ;in, Indicates the first t The first round of local training k The small changes in model parameters during training, This indicates the cumulative contribution of this parameter to the overall change in local training loss; Next, based on the relationship between the cumulative contribution and the corresponding model parameter change magnitude, the model parameter importance factor matrix is ​​calculated. ,in, Indicates the first t The first round of local training k The change of each parameter It is the damping factor, to avoid the denominator being 0.

[0023] Preferably, in step 4, each client adopts a dual-threshold abnormal traffic detection algorithm based on F1-Score maximization to adaptively determine the detection threshold and achieve accurate identification of abnormal traffic in heterogeneous networks. Its specific implementation includes the following sub-steps: Step 4.1: For each client's verification set, the network traffic samples in the verification set are divided into normal traffic samples and abnormal traffic samples, forming normal traffic sample subsets and abnormal traffic sample subsets respectively. The normal traffic sample subsets and abnormal traffic sample subsets are then input into the local unsupervised intrusion detection model for local inference to obtain the reconstruction loss of the corresponding network traffic samples. Step 4.2: Based on the reconstruction loss distribution of the normal traffic sample subset and the abnormal traffic sample subset, determine the range of the benign threshold and the range of the attack threshold respectively, and perform a traversal search on the benign threshold and the attack threshold within the range; Step 4.3: Under each set of benign threshold and attack threshold conditions, calculate the corresponding F1-Score based on the anomaly detection results on the validation set, and select the benign threshold and attack threshold that make the F1-Score reach the maximum value as the best benign threshold and the optimal attack threshold for the current client. Step 4.4: During the inference phase, for network traffic samples in the test set, calculate their reconstruction loss and compare the reconstruction loss with the best-case scenario threshold and the attack threshold; when the difference between the reconstruction loss and the best-case scenario threshold is less than the difference between the reconstruction loss and the best-case scenario threshold, determine that the network traffic sample is abnormal traffic; otherwise, determine that the network traffic sample is normal traffic.

[0024] The technical solution adopted by the system of this invention is: a generalizable unsupervised network intrusion detection system based on federated continuous learning, comprising: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the generalizable unsupervised network intrusion detection method based on federated continuous learning.

[0025] The technical solution adopted by the product of the present invention is: a generalizable unsupervised network intrusion detection product based on federated continuous learning, comprising computer program instructions, which, when the computer program instructions are run on a computer, cause the computer to execute the generalizable unsupervised network intrusion detection method based on federated continuous learning.

[0026] Compared with the prior art, the beneficial effects of the present invention include: 1. This invention preprocesses the client's local network traffic data. First, it uses the mode imputation method to handle outliers and missing values. Second, it removes the quintuple feature to guide the model to focus on the intrinsic behavioral characteristics of the traffic, reducing dependence on specific IPs and ports, thereby improving the model's generalization ability. 2. This invention introduces a local unsupervised detection model based on an energy flow classifier and a stacked denoising sparse autoencoder in each client. The energy value generated by the energy flow classifier enhances the difference between normal and abnormal traffic, thereby improving the generalization ability of the stacked denoising sparse autoencoder in different network environments. 3. In the absence of shared raw network traffic data among clients, this invention employs a federated continuous learning method to update and aggregate the local model parameters of each client. By introducing structural regularization constraints during the local model training process, the local models of different clients gradually converge to a common parameter space, reducing the weight differences of local models caused by non-independent and identically distributed data, thereby obtaining the optimal global model parameters; 4. This invention uses a dual-threshold abnormal traffic detection algorithm based on F1-Score maximization to adaptively determine the detection threshold on each client, thereby achieving accurate identification of abnormal traffic in heterogeneous network environments. Attached Figure Description

[0027] The technical solutions described herein are further illustrated below using examples and specific implementation methods. Additionally, accompanying drawings are used in the description of the technical solutions. Those skilled in the art can, without any creative effort, obtain other drawings and the intent of the present invention based on these drawings.

[0028] Figure 1 This is a schematic diagram of the method according to an embodiment of the present invention; Figure 2 This is a flowchart of the data preprocessing process according to an embodiment of the present invention; Figure 3This is a diagram of an unsupervised network intrusion detection model in an embodiment of the present invention; Figure 4 This is a diagram of a noise reduction sparse autoencoder model in an embodiment of the present invention; Figure 5 This is a flowchart of the federated continuous learning method in an embodiment of the present invention; Figure 6 This is a graph showing the composition of the optimized loss function in an embodiment of the present invention; Figure 7 This is a flowchart illustrating the calculation of the model parameter importance factor matrix in an embodiment of the present invention. Figure 8 This is a schematic diagram illustrating the local model weight differences obtained by the federated continuous learning method in this embodiment of the invention. Figure 9 This is a flowchart of the dual-threshold abnormal traffic detection algorithm based on F1-Score maximization in an embodiment of the present invention; Figure 10 This is a schematic diagram illustrating the relationship between the F1-Score and classification threshold of the global model on four dataset validation sets in an embodiment of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0030] First, the technical terms used in this embodiment will be explained and described: Data silos: In federated learning, data silos refer to isolated data storage states where data from participating parties (such as enterprises, institutions, or devices) cannot be centrally shared due to reasons such as privacy protection, business competition, or regulatory restrictions. This isolation hinders traditional centralized machine learning from utilizing global data, and federated learning is designed to solve this problem by collaboratively training models without exchanging raw data, thus breaking down data silos.

[0031] Non-independent and identically distributed data: In heterogeneous network scenarios, there are significant differences in data types and the ratio of normal to abnormal traffic among the networks, thus forming non-independent and identically distributed data.

[0032] The quintuple: Five key attributes of network traffic, including source IP address, destination IP address, transport layer protocol type, source port, and destination port.

[0033] Energy Flow Classifier: An energy-based traffic classification algorithm that uses inverse statistics to calculate the energy value of each traffic sample based on an inferred statistical model, thereby effectively classifying network traffic.

[0034] Denoising sparse autoencoders: By incorporating noise and sparsity constraints, this not only enhances the model's resistance to noise but also significantly improves its ability to extract key data features. This improvement effectively compensates for the shortcomings of traditional autoencoders, giving them strong robustness and excellent generalization ability in intrusion detection tasks under complex network traffic scenarios.

[0035] Accuracy: Accuracy represents the proportion of correctly classified normal and abnormal samples out of the total number. It is an evaluation metric in classification tasks such as traffic anomaly detection, and its definition is as follows: ; The parameters TP, TN, FP, and FN are explained as follows: TP (True Positive): The true class of the sample is positive, and the prediction result is positive.

[0036] TN (True Negative): The true class of the sample is negative, and the prediction result is negative.

[0037] FP (False Positive): The true class of the sample is negative, but the prediction result is positive.

[0038] FN (False Negative): The true class of the sample is positive, and the prediction result is negative.

[0039] Precision: Precision is the proportion of actual attack records out of all predicted attack records. It is an evaluation metric in classification tasks such as traffic anomaly detection, and its definition is as follows: ; Recall: Recall represents the proportion of actual attack records that are correctly classified. Also known as true positive rate (TPR) or sensitivity, recall is an evaluation metric in traffic anomaly detection classification tasks. Its definition is as follows: ; F1-Score: The F1-Score is a comprehensive evaluation metric that considers both recall and precision. It is used in classification tasks such as traffic anomaly detection and is defined as follows: ; False Alarm Rate (FPR): The false alarm rate (FPR) is the ratio of network traffic that is incorrectly identified as anomalous samples to all actual normal samples. It is defined as follows: ; The present invention will be further described below with reference to the embodiments and accompanying drawings.

[0040] like Figure 1 As shown, this embodiment provides a generalizable unsupervised network intrusion detection method based on federated continuous learning, applied to anomaly traffic detection in a heterogeneous network environment. This scenario includes three entities: a client, a data silo, and a central server. First, each client is associated with a data silo and independently deploys a local unsupervised detection model based on an energy flow classifier and a stacked denoising sparse autoencoder. The energy value generated by the energy flow classifier enhances the difference between normal and abnormal traffic, thereby improving the generalization ability of the stacked denoising sparse autoencoder in different network environments. Subsequently, the central server introduces a federated continuous learning method to effectively reduce parameter differences between local models caused by non-independent and identically distributed data, while protecting the privacy of network traffic data from each client, achieving collaborative sharing of optimal global model parameters. Finally, each client adaptively determines the detection threshold using a dual-threshold anomaly traffic detection algorithm based on F1-Score maximization, achieving accurate identification of anomaly traffic in the heterogeneous network environment.

[0041] In this embodiment, the heterogeneous network environment includes four clients and one central server. Each client uses a network intrusion detection dataset from a different source as its local data. These datasets are independent of each other, forming data silos within the heterogeneous network environment to simulate the differences in network traffic distribution and attack characteristics in different network scenarios. As shown in Table 1, four network intrusion detection datasets based on NetFlow feature standardization are selected as the local datasets for each client, specifically including the UNSW-NB15 dataset, the CSE-CIC-IDS2018 dataset, the BoT-IoT dataset, and the ToN-IoT dataset (https: / / staff.itee.uq.edu.au / marius / NIDS_datasets / ). The datasets mentioned above each contain 43 numerical NetFlow features, which cover network communication features such as source address, destination address, port information, protocol type, and traffic statistics. These features are used to characterize typical application scenarios such as enterprise network environment, general Internet environment, Internet of Things (IoT) environment, and industrial IoT environment. They also include various attack types such as denial-of-service attacks, distributed denial-of-service attacks, scanning attacks, backdoor attacks, and data theft attacks, thereby verifying the ability of this invention to detect abnormal traffic in heterogeneous network environments.

[0042] Table 1. Dataset Sample Distribution

[0043] The generalizable unsupervised network intrusion detection method based on federated continuous learning in this embodiment includes the following steps: Step 1: Treat the network traffic data of each client as independent data islands, preprocess the local network traffic data of each client, and divide the local network traffic data into training set, validation set and test set.

[0044] In one implementation, such as Figure 2 As shown, step 1 specifically includes the following sub-steps: Step 1.1: Preprocess the client's local network traffic data. First, the mode imputation method is used to handle outliers and missing values. Second, the quintuple features are removed to guide the model to focus on the intrinsic behavioral characteristics of the traffic, reducing dependence on specific IPs and ports, thereby improving generalization ability. In addition, since this task is unsupervised binary classification learning, label features are also removed. Finally, scikit-learn's MinMaxScaler is used to scale all features to the [0,1] interval to eliminate the impact of scale differences on model training.

[0045] In one implementation, the raw network traffic sample, whose fields include five-tuple information, traffic behavior characteristics, and label information, can be represented as: (IPV4_SRC_ADDR=192.168.56.1, IPV4_DST_ADDR=10.0.0.5, L4_SRC_PORT=44321, L4_DST_PORT=80, PROTOCOL=TCP, IN_PKTS=12, OUT_PKTS=10, IN_BYTES=8456, OUT_BYTES=7320, DURATION=1). 53, MIN_TTL=64, MAX_TTL=128, RETRANSMISSIONS=0, …, Label=Benign), after deleting the quintuple and label features and normalizing them, their features can be represented as (IN_PKTS=0.32, OUT_PKTS=0.28, IN_BYTES=0.41, OUT_BYTES=0.36, DURATION=0.12, MIN_TTL=0.50, MAX_TTL=0.78, RETRANSMISSIONS=0.00, …).

[0046] Step 1.2: Divide the preprocessed network traffic data into training set, validation set and test set: 70% of the normal traffic data is used as the training set to learn the normal sample distribution; of the remaining normal and abnormal traffic, 20% is used as the validation set to determine the optimal threshold for each client, and 80% is used as the test set to evaluate the model performance.

[0047] In one implementation, taking the four network intrusion detection datasets selected in this embodiment as examples, the number of samples in the training set, validation set, and test set for each dataset is as follows: For the BoT-IoT dataset, the training set contains approximately 900 normal traffic samples, the validation set contains approximately 55,576 traffic samples, and the test set contains approximately 222,305 traffic samples; for the ToN-IoT dataset, the training set contains approximately 53,792 normal traffic samples, the validation set contains approximately 31,934 traffic samples, and the test set contains approximately 127,734 traffic samples; for the UNSW-NB15 dataset, the training set contains approximately 319,026 normal traffic samples, the validation set contains approximately 29,703 traffic samples, and the test set contains approximately 118,811 traffic samples; for the CSE-CIC-IDS-2018 dataset, the training set contains approximately 108,254 normal traffic samples, the validation set contains approximately 13,777 traffic samples, and the test set contains approximately 55,108 traffic samples.

[0048] Step 2: Deploy an unsupervised network intrusion detection model locally on each client, and input the training set into the unsupervised network intrusion detection model for local training to obtain the corresponding local model parameters. The local training includes a pre-training phase and a fine-tuning phase; In one implementation, such as Figure 3 As shown, the unsupervised network intrusion detection model includes an energy flow classifier and a stacked denoising sparse autoencoder. After a network traffic sample is input into the pre-trained energy flow classifier, the classifier generates a corresponding energy value feature for that sample. This energy value characterizes the difference between the network traffic sample and normal traffic patterns. The energy value feature is added as an additional feature to the original dataset and input into the stacked denoising sparse autoencoder to calculate the traffic reconstruction loss, which is then compared with a threshold, thereby achieving accurate identification of abnormal traffic in heterogeneous networks.

[0049] The stacked denoising sparse autoencoder consists of three stacked denoising sparse autoencoders. The denoising sparse autoencoder is as follows: Figure 4 As shown, the first step is to... (The sentence is incomplete and requires more context to translate accurately.) X Add noisy data and select the random mapping function. qD Will X Convert to noisy data X c The noise-adding operation is as follows: ; qD This is a noise-adding process. In this model, Gaussian noise is used to simulate the corruption of network traffic information. After adding noise, it can... X cAs input, the data undergoes encoding and decoding stages sequentially. The encoding stage processes the corrupted data. X c Projecting onto the hidden layer, as follows: ; in, h The activation value of the hidden layer. ReLU For activation function, , and These are the weight matrix and the bias term, respectively. To improve the feature extraction capability of the hidden layer while avoiding overfitting, a sparsity constraint is introduced. Assume there are a total of... m One sample, h j (i) Indicates the first i The sample at the th j The average activation value of a neuron across all training samples is defined as follows: Let the target sparsity of the hidden layer be... In order to make near , definition based on KL The sparsity penalty term for divergence is as follows: ; in, n This represents the number of neurons in the hidden layer. The decoding phase will then convert the activation values ​​of the hidden layer... h Reconstructed Samples The definition is as follows: ; in , and These are the decoded weight matrix and bias term, respectively. The goal of the model is to optimize the model parameters. and Therefore, the optimization objective function is adopted as follows: ; in The weights of the sparsity penalty factor are used to control the sparsity.

[0050] In one implementation, network traffic data containing energy value characteristics will be... x Reconstructed data is obtained from the input stacked denoising sparse autoencoder. The reconstruction loss used for threshold calculation and flow inference. It is the Mean Absolute Error (MAE), and its calculation formula is: ,inN The feature dimension of the traffic samples; given the number of input samples. x = {0.12, 0.35, 0.47, 0.58, 0.41, 0.63, 0.29, 0.54, 0.68, 0.37, 0.45, 0.51, 0.60, 0.33, 0.72, 0.49, 0.56, 0.38, 0.44, 0.61, ..., 0.36, 0.65, 0.39, 0.54, 0.46, 720}, reconstruct the data. = {0.10, 0.33, 0.45, 0.55, 0.39, 0.60, 0.27, 0.52, 0.65, 0.35, 0.43, 0.49, 0.58, 0.31, 0.70, 0.47, 0.54, 0.36, 0.42, 0.59, ..., 0.50, 0.44, 0.57, 0.32, 0.65, 690} N =39, calculate the reconstruction loss value. MAE =18.3.

[0051] In one implementation, during the pre-training phase, each network traffic sample in the training set contains 38 normalized features. First, the energy flow classifier module is trained using the training set. After training, this module generates a corresponding energy value feature for each network traffic sample. Then, the energy value is fused with the original network traffic features as a new one-dimensional feature to form training data containing 39 dimensions. The training set samples can be represented as: (IN_PKTS=0.32, OUT_PKTS=0.28, IN_BYTES=0.41, OUT_BYTES=0.36, DURATION=0.12, MIN_TTL=0.50, MAX_TTL=0.78, RETRANSMISSIONS=0.00, ...). After processing by the pre-trained energy flow classifier, the network traffic sample can be represented as: (IN_PKTS=0.32, OUT_PKTS=0.28, IN_BYTES=0.41, OUT_BYTES=0.36, DURATION=0.12, MIN_TTL=0.50, MAX_TTL=0.78, RETRANSMISSIONS=0.00, …, Energy_Value=720). After obtaining training data containing energy value features, a layer-by-layer greedy unsupervised learning approach is used to pre-train the stacked denoising sparse autoencoder. During pre-training, Gaussian noise is used to perturb the input data, with a noise factor set to 0.2; the target sparsity is... Set to 0.05, sparsity penalty term weight The value is set to 0.04. Each layer is trained sequentially, starting after the previous layer has finished training and using the hidden layer output of the previous layer as the input to the next layer to obtain the initial weights and bias parameters of each autoencoder. During the fine-tuning phase, based on the initial parameters obtained from the pre-training, all network parameters of the stacked denoising sparse autoencoder are jointly optimized, and the reconstruction loss is further minimized through backpropagation to improve the overall detection performance of the unsupervised network intrusion detection model. In subsequent federated learning training, fine-tuning continues based on the already trained model, without repeating the layer-by-layer pre-training process.

[0052] Step 3: Without sharing raw network traffic data among clients, a federated continuous learning method is used to update and aggregate the local model parameters of each client. By introducing structural regularization constraints during the local model training process, the local models of different clients gradually converge to a common parameter space, thereby reducing the weight differences of local models caused by non-independent and identically distributed data, thus obtaining the optimal global model parameters and distributing them to each client.

[0053] In one implementation, such as Figure 5 As shown, step 3 specifically includes the following sub-steps: Step 3.1: During local training, each client updates the parameters of its local unsupervised network intrusion detection model based on the local training set and the local model parameters of other clients, and constructs an optimized loss function for local model training. The optimized loss function includes a loss term for learning local data features and a structure regularization loss term for incorporating knowledge from other client models.

[0054] In one implementation, such as Figure 6 As shown, each client i The optimization loss function is shown below: ; in, D i Indicates the client i The local training set, Indicates the first t Wheel Client i The mean square error, Indicates the first t Wheel Client i The sparsity penalty term, λ It is a regularization factor. Indicates the ( t -1) The first round j The local model's first k The importance factors of each parameter Indicates the first t Wheel Client i The k The local model parameters, that is, the local model parameters for the current round. Indicates the ( t -1) The first round j The local model's first k The parameters are the other local model parameters obtained in the previous round.

[0055] The loss term used to learn local data features is used to ensure that the local model continues to learn the local data distribution during federated training; the structure regularization loss term is used to measure the difference between the current client's local model parameters and the historical model parameters of other clients, and to restrict the update of the local model parameters based on the importance factor matrix of the other client model parameters, thereby guiding the local models of different clients to gradually converge to a common parameter space.

[0056] In one implementation, such as Figure 7 As shown, the calculation of the model parameter importance factor matrix specifically includes the following sub-steps: Step 3.1.1: In the first... t During the federated training process, during the local model training on the client side, for a small update of the local model parameters, the change in local training loss caused by the parameter update is estimated based on the gradient information of the corresponding parameter, so as to characterize the contribution of the parameter update to the change in local training loss.

[0057] In one implementation, in the first t During each round of local training, the change in local training loss caused by small updates to the model parameters is considered. Local training loss. Changes can be achieved through gradients Estimation, expressed as: ; in, Indicates the first t The first round of local training k The amount of update for each model parameter. Indicates the first t During local training, the client i Local model parameter update amount, Indicates the first t During local training, the client i Local model parameters, This represents the gradient value of the corresponding parameter. This indicates the contribution of the parameter update to the change in local training loss.

[0058] Step 3.1.2: Accumulate the changes in training loss caused by minor parameter updates during each iteration of the local training phase on the client side, in order to obtain the cumulative contribution of each model parameter to the overall reduction of local training loss in the current parameter space.

[0059] In one implementation, by accumulating the small loss changes generated by all iterations during local training, the total local training loss change in the entire parameter space can be obtained as follows: ; in, Indicates the first k The small changes in model parameters during training, This represents the cumulative contribution of this parameter to the overall change in local training loss. Since this paper focuses on the reduction of training loss, therefore... A negative sign is introduced before it.

[0060] Step 3.1.3: Based on the relationship between the cumulative contribution and the corresponding model parameter change magnitude, calculate the model parameter importance factor matrix, wherein the model parameter importance factor matrix is ​​used to characterize the importance of each model parameter to the improvement of model performance in the current federated training round.

[0061] In one implementation, considering that the importance of each parameter in the local model depends on its contribution to the reduction of the local training loss, It can be regarded as an estimate of the local model parameter importance factor matrix.

[0062] Step 3.1.4: When calculating the model parameter importance factor matrix, a damping factor is introduced to avoid numerical instability, and negative values ​​in the model parameter importance factor matrix are forced to be 0 to ensure that the structure regularization loss term is positive.

[0063] In one implementation, the local model parameter importance factor matrix is ​​defined as follows: ; in, Indicates the first k The change of each parameter It's a damping factor to avoid a denominator of 0. (This is similar to the original synaptic intelligence.) The calculation method is different; it forces all negative values ​​to be set to zero to ensure that the structure regularization loss term is positive.

[0064] Step 3.2: Each client i After completing local training, the local model parameters and the corresponding model parameter importance factor matrix are stored. Uploaded to the central server.

[0065] Step 3.3: The central server aggregates the local model parameters uploaded by each client to obtain global model parameters, and then sets the global model parameters... And model parameters and model parameter importance factor matrices for other clients. The parameters are then distributed to each client to support the next round of federated continuous learning training. Ultimately, a set of global model parameters can be obtained through the federated continuous learning method and distributed to each client. For example... Figure 8 As shown, compared to FedAvg, the global model obtained by the federated continuous learning method is closest to the global optimum.

[0066] Step 4: Based on the verification set, each client adaptively determines the abnormal traffic detection threshold using a dual-threshold abnormal traffic detection algorithm based on F1-Score maximization, and calculates the traffic reconstruction loss on the local test set using an unsupervised network intrusion detection model with the optimal global model parameters. The reconstruction loss is then compared with the threshold to achieve accurate identification of abnormal traffic in heterogeneous networks.

[0067] In one implementation, such as Figure 9 As shown, step 4 specifically includes the following sub-steps: Step 4.1: For each client's verification set, divide the network traffic samples in the verification set into normal traffic samples and abnormal traffic samples, forming a normal traffic sample subset and an abnormal traffic sample subset respectively. and ,in This indicates the number of normal traffic items in the verification set. This indicates the number of abnormal traffic instances in the verification set. B and A Inputting the unsupervised intrusion detection model for local inference, we obtain the following results: and Finally passed Calculate the reconstruction loss for all normal and abnormal traffic in each client's verification set.

[0068] Step 4.2: Through statistics The range of benign thresholds is determined by the normal traffic reconstruction loss, and similarly, the range of attack thresholds is determined. Within the range, the benign thresholds and attack thresholds are traversed and searched.

[0069] In one implementation, the benign threshold and the attack threshold are iterated in steps of 0.2 within two threshold ranges.

[0070] Step 4.3: Under each set of benign threshold and attack threshold conditions, calculate the corresponding F1-Score based on the anomaly detection results on the validation set, and select the benign threshold that maximizes the F1-Score. and attack threshold This serves as the optimal threshold for both the current client's performance and the best attack threshold.

[0071] In one implementation, such as Figure 10 As shown, in the 10th round of FL evaluation, the aggregated global model's F1-Score varies with the classification threshold on the validation sets of four datasets. Specifically, on the Bot-IoT dataset, the highest F1-Score is 0.9998, corresponding to a benign threshold. and attack threshold The scores are 18.43 and 21.17 respectively. On the CSE-CIC-IDS-2018 dataset, the highest F1-Score is 0.9621, corresponding to the benign threshold. and attack threshold The scores are 19.09 and 28.64 respectively. On the UNSW-NB15 dataset, the highest F1-Score is 0.9597, corresponding to the benign threshold. and attack threshold The scores are 18.55 and 34.57 respectively. On the TON-IoT dataset, the highest F1-Score is 0.9954, corresponding to a benign threshold. and attack threshold They are 15.60 and 16.11 respectively.

[0072] Step 4.4: During the inference phase, for network traffic samples in the test set... x Calculate its reconstruction loss ,if satisfy If the traffic is abnormal, the sample is considered abnormal traffic; otherwise, it is considered normal traffic, as shown below: ; In one implementation, client 1 is associated with the data silo Bot-IoT. =18.43, =21.17, test sample on client 1 x= {0.12, 0.35, 0.47, 0.58, 0.41, 0.63, 0.29, 0.54, 0.68,0.37,0.45, 0.51, 0.60, 0.33, 0.72, 0.49, 0.56, 0.38, 0.44,0.61,….., 0.36,0.65, 0.39, 0.54, 0.46,720}, reconstruct the data. = {0.10, 0.33, 0.45, 0.55, 0.39, 0.60, 0.27, 0.52, 0.65, 0.35, 0.43, 0.49, 0.58, 0.31, 0.70, 0.47, 0.54, 0.36, 0.42, 0.59, ..., 0.50, 0.44, 0.57, 0.32, 0.65, 690} N =39, calculate the reconstruction loss value. =18.3, Then the sample x These are normal samples. Table 2 shows the performance of the aggregated global model on each data silo test set. Therefore, the generalizable unsupervised network intrusion detection system based on federated continuous learning in this embodiment achieves accurate identification of abnormal traffic in heterogeneous networks.

[0073] Table 2 Performance of the global model on each data silo

[0074] This invention implements a federated continuous learning-based generalizable unsupervised network intrusion detection system. First, a local unsupervised detection model based on an energy flow classifier and a stacked denoising sparse autoencoder is introduced on each client. The energy value generated by the energy flow classifier enhances the difference between normal and abnormal traffic, thereby improving the generalization ability of the stacked denoising sparse autoencoder in different network environments. Then, by introducing a federated continuous learning method, the parameter differences between local models caused by non-independent and identically distributed data are effectively reduced while protecting the privacy of network traffic data from each client, achieving collaborative sharing of optimal global model parameters. Finally, each client uses a dual-threshold abnormal traffic detection algorithm based on F1-Score maximization to adaptively determine the detection threshold, achieving accurate identification of abnormal traffic in heterogeneous network environments.

[0075] It should be understood that the embodiments described above are only some, not all, of the embodiments of the present invention. Furthermore, the technical features of the various embodiments or individual embodiments provided by the present invention can be arbitrarily combined to form feasible technical solutions. Such combinations are not constrained by the order of steps and / or structural composition patterns, but must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0076] It should be understood that the above description of the preferred embodiments is quite detailed, but it should not be considered as a limitation on the scope of protection of this invention. Those skilled in the art, under the guidance of this invention, can make substitutions or modifications without departing from the scope of protection of the claims of this invention, and all such substitutions or modifications fall within the scope of protection of this invention. The scope of protection of this invention should be determined by the appended claims.

Claims

1. A generalizable unsupervised network intrusion detection method based on federated continuous learning, characterized in that, Includes the following steps: Step 1: In the cross-island federated learning scenario, the network traffic data of each client is treated as an independent data island. The local network traffic data of each client is preprocessed and divided into training set, validation set and test set. Step 2: Deploy an unsupervised network intrusion detection model locally on each client, and input the training set into the unsupervised network intrusion detection model for local training to obtain the corresponding local model parameters; Step 3: Without sharing the original network traffic data among clients, a federated continuous learning method is used to update and aggregate the local model parameters of each client. In this process, by introducing structural regularization constraints during the local model training, the local models of different clients gradually converge to a common parameter space, thereby obtaining the optimal global model parameters and distributing them to each client. Step 4: Each client determines the abnormal traffic detection threshold based on the verification set, and calculates the traffic reconstruction loss on the local test set using the unsupervised network intrusion detection model with the optimal global model parameters. The reconstruction loss is then compared with the threshold to achieve accurate identification of abnormal traffic in heterogeneous networks.

2. The generalizable unsupervised network intrusion detection method based on federated continuous learning according to claim 1, characterized in that: In step 1, the local network traffic data of each client is preprocessed, including handling outliers and missing values, removing feature fields that are irrelevant to intrusion detection, and standardizing network traffic features.

3. The generalizable unsupervised network intrusion detection method based on federated continuous learning according to claim 1, characterized in that: In step 2, the unsupervised network intrusion detection model includes an energy flow classifier and a stacked denoising sparse autoencoder; After network traffic samples are input into the pre-trained energy flow classifier, the energy flow classifier generates corresponding energy value features for the network traffic samples. The energy value features are added to the original dataset as additional features and input into the stacked denoising sparse autoencoder to calculate the reconstruction loss of the traffic and compare it with a threshold, thereby realizing the identification of abnormal traffic in heterogeneous networks. The stacked denoising sparse autoencoder is formed by stacking multiple denoising sparse autoencoders as building blocks, and is suitable for traffic data containing energy value features. x Stacked noise-reducing sparse autoencoders reconstruct it into And calculate the reconstruction loss.

4. The generalizable unsupervised network intrusion detection method based on federated continuous learning according to claim 2, characterized in that: The noise-reducing sparse autoencoder first, on the original input... X Add noisy data and select the random mapping function. qD ()Will X Convert to noisy data Then X c As input, encoding and decoding are performed sequentially; The encoding stage will remove the damaged data X c Project onto the hidden layer. ,in, h The activation value of the hidden layer. ReLU For activation function, , and These are the weight matrix and the bias term, respectively. To improve the feature extraction capability of the hidden layer while avoiding overfitting, a sparsity constraint is introduced; it is assumed that there are a total of m One sample, h j (i) Indicates the first i The sample at the th j The activation value of a neuron is then defined as the average activation degree of that neuron across all training samples. Assume the target sparsity of the hidden layer is... In order to make near , definition based on KL The sparsity penalty term for divergence is as follows: ； in, n This represents the number of neurons in the hidden layer. The decoding phase will determine the activation values ​​of the hidden layer. h Reconstructed Samples The definition is as follows: ； in , and These are the decoding weight matrix and the bias term, respectively; The purpose of the model is to optimize the model's parameters. and Therefore, the optimization objective function is adopted as follows: ； in To control the weight of the sparsity penalty factor; Reconstruction loss used for threshold calculation and flow inference It is the mean absolute error (MAE). ,in N The feature dimension of the traffic sample.

5. The generalizable unsupervised network intrusion detection method based on federated continuous learning according to claim 1, characterized in that: In step 2, the training set is input into the unsupervised network intrusion detection model for local training, including a pre-training stage and a fine-tuning stage; In the pre-training phase, the energy flow classifier is first trained using the training set. Subsequently, the network traffic data in the training set is input into the trained energy flow classifier to generate the corresponding energy value, and the energy value is fused with the original network traffic feature as an additional feature. After obtaining training data containing energy value features, a layer-by-layer greedy unsupervised learning approach is used to pre-train the stacked denoising sparse autoencoder: each layer of the denoising sparse autoencoder is trained separately in sequence, each layer is only started after the previous layer is trained, and the hidden layer output of the previous layer is used as the input of the next layer, thereby obtaining the initial weights and bias parameters of each autoencoder layer. The fine-tuning stage, used for subsequent federated learning training, involves jointly optimizing all network parameters of the stacked denoising sparse autoencoder based on the initial weights and bias parameters obtained from the pre-training, and further minimizing the reconstruction loss through backpropagation.

6. The generalizable unsupervised network intrusion detection method based on federated continuous learning according to claim 1, characterized in that: In step 3, the federated continuous learning method is used to update and aggregate the local model parameters of each client. This is specifically implemented through the following sub-steps: Step 3.1: During local training, each client updates the parameters of its local model based on the local training set and the local model parameters of other clients; Among them, an optimized loss function is constructed for local model training, including a loss term for learning local data features and a structure regularization loss term for incorporating knowledge from other client models; Client i The optimization loss function is: ； in, D i Indicates the client i The local training set, Indicates the first t Wheel Client i The mean square error, Indicates the first t Wheel Client i The sparsity penalty term, λ It is a regularization factor. Indicates the ( t -1) The first round j The local model's first k The importance factors of each parameter Indicates the first t Wheel Client i The k The local model parameters, that is, the local model parameters for the current round. Indicates the ( t -1) The first round j The local model's first k The parameters are the other local model parameters obtained in the previous round; Step 3.2: After completing local training, each client uploads its local model parameters and the model parameters and importance factor matrix of the model parameters from other clients to the central server; Step 3.3: The central server aggregates the local model parameters uploaded by each client to obtain global model parameters, and distributes the global model parameters, model parameters from other clients, and model parameter importance factor matrices to each client to support the next round of federated continuous learning training; finally, a set of optimal global model parameters is obtained through the federated continuous learning method and distributed to each client.

7. The generalizable unsupervised network intrusion detection method based on federated continuous learning according to claim 5, characterized in that: In step 3.1, the importance factor matrix of the other client model parameters is calculated using the synaptic intelligence method; First, in the t During federated training, during the local model training process on the client side, for minor updates to the local model parameters, the change in local training loss caused by the parameter update is estimated based on the gradient information of the corresponding parameter, to characterize the contribution of the parameter update to the change in local training loss; wherein, the local training loss... Change through gradient Estimate, expressed as , Indicates the first t During local training, the client i The k The amount of update for each model parameter. Indicates the first t During local training, the client i Local model parameter update amount, Indicates the first t During local training, the client i Local model parameters, Indicates the first t The first round of local training k The gradient values ​​of each model parameter. This indicates the contribution of the parameter update to the change in local training loss; Then, the changes in training loss caused by minor parameter updates during each iteration of the local training phase are summed to obtain the cumulative contribution of each model parameter to the overall reduction in local training loss in the current parameter space. ;in, Indicates the first t The first round of local training k The small changes in model parameters during training, This indicates the cumulative contribution of this parameter to the overall change in local training loss; Next, based on the relationship between the cumulative contribution and the corresponding model parameter change magnitude, the model parameter importance factor matrix is ​​calculated. ,in, Indicates the first t The first round of local training k The change of each parameter It is the damping factor, to avoid the denominator being 0.

8. The generalizable unsupervised network intrusion detection method based on federated continuous learning according to any one of claims 1-7, characterized in that: In step 4, each client adopts a dual-threshold abnormal traffic detection algorithm based on F1-Score maximization to adaptively determine the detection threshold and achieve accurate identification of abnormal traffic in heterogeneous networks. Its specific implementation includes the following sub-steps: Step 4.1: For each client's verification set, the network traffic samples in the verification set are divided into normal traffic samples and abnormal traffic samples, forming normal traffic sample subsets and abnormal traffic sample subsets respectively. The normal traffic sample subsets and abnormal traffic sample subsets are then input into the local unsupervised intrusion detection model for local inference to obtain the reconstruction loss of the corresponding network traffic samples. Step 4.2: Based on the reconstruction loss distribution of the normal traffic sample subset and the abnormal traffic sample subset, determine the range of the benign threshold and the range of the attack threshold respectively, and perform a traversal search on the benign threshold and the attack threshold within the range; Step 4.3: Under each set of benign threshold and attack threshold conditions, calculate the corresponding F1-Score based on the anomaly detection results on the validation set, and select the benign threshold and attack threshold that make the F1-Score reach the maximum value as the best benign threshold and the optimal attack threshold for the current client. Step 4.4: During the inference phase, for network traffic samples in the test set, calculate their reconstruction loss and compare the reconstruction loss with the best-case scenario threshold and the attack threshold; when the difference between the reconstruction loss and the best-case scenario threshold is less than the difference between the reconstruction loss and the best-case scenario threshold, determine that the network traffic sample is abnormal traffic; otherwise, determine that the network traffic sample is normal traffic.

9. A generalizable unsupervised network intrusion detection system based on federated continuous learning, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the generalizable unsupervised network intrusion detection method based on federated continuous learning as described in any one of claims 1 to 8.

10. A generalizable unsupervised network intrusion detection product based on federated continuous learning, comprising computer program instructions, characterized in that: When the computer program instructions are executed on a computer, the computer performs the generalizable unsupervised network intrusion detection method based on federated continuous learning as described in any one of claims 1 to 8.

Images