A network traffic anomaly detection method for multi-domain internet of things federal domain adaptation

Abstract

This invention provides a network traffic anomaly detection method adapted to multi-domain IoT federated domains. The method involves acquiring network traffic data from multi-domain IoT and processing it to generate a unified feature vector; establishing a multi-task labeling system for the IoT network traffic data based on attributes; deploying a shared backbone network and a local domain adapter on each federated client and performing local training; calculating a multi-task loss based on the multi-task labeling system; aggregating the parameter differences of the multi-domain IoT clients on the server side based on the multi-task loss and updating the global model; distributing the updated global model to each client of the multi-domain IoT and adjusting sampling, loss weights, and threshold calibration; performing multiple rounds of federated iterations until a termination condition is met, freezing the shared backbone network while retaining the local domain adapter; and performing anomaly detection and output on the real-time acquired multi-domain IoT network traffic data using the acquired shared backbone network and local domain adapter.

Description

Technical Field

[0001] This invention relates to the field of multi-domain Internet of Things (IoT), and in particular to a network traffic anomaly detection method adapted to the federated domain of multi-domain IoT. Background Technology

[0002] With the widespread application of IoT devices across various industries, the volume of network traffic data has increased dramatically. Detecting abnormal traffic from this massive amount of data has become a critical issue for ensuring network security. In the IoT environment, the challenge of abnormal traffic detection lies in the diversity and complexity of the data. IoT devices are typically deployed in different network environments, and the traffic patterns and attack behaviors of different devices may vary significantly.

[0003] Currently, anomaly detection in IoT network traffic mainly relies on centralized methods, but these methods have many problems, especially regarding data privacy and cross-domain adaptation. With increasingly stringent privacy regulations, traditional centralized data processing methods face enormous compliance pressure. Federated learning, by training data locally and only uploading model updates, can achieve effective learning without data leakage.

[0004] However, the non-independent and identically distributed nature of IoT traffic data, especially in cross-domain scenarios, poses significant challenges to federated learning models. Specifically, differences in traffic data distribution across multiple devices and network environments can lead to a significant degrade in model performance in certain domains, thereby affecting the accuracy and reliability of the entire system. Furthermore, the imbalanced labeling of IoT data makes it difficult for traditional detection methods to effectively address this issue, particularly the long-tail effect, which results in fewer samples of certain attack behaviors, making it impossible to fully learn these rare attack patterns.

[0005] While existing multi-domain federated learning methods can address data privacy issues to some extent, they lack effective cross-domain adaptation mechanisms and cannot resolve distribution offsets and label imbalances between different domains. Therefore, how to improve the accuracy and stability of cross-domain anomaly detection using a federated learning framework while ensuring data privacy has become a critical technical challenge that urgently needs to be addressed. Summary of the Invention

[0006] To address the problems existing in the background technology, this invention proposes a network traffic anomaly detection method adapted to multi-domain IoT federated domains.

[0007] A network traffic anomaly detection method adapted to multi-domain IoT federated domains includes the following steps: S100: Acquire network traffic data from multi-domain IoT and process it to generate a unified feature vector; S200: Establish a multi-task tagging system for IoT network traffic data based on attributes; S300: Deploy a shared backbone network and local domain adapter in each federal client and conduct local training. S400. Calculate multi-task loss based on multi-task labeling system, and aggregate the parameter differences of multi-domain IoT clients on the server side according to the multi-task loss and update the global model. S500: Distribute the updated global model to each client of the multi-domain IoT and adjust the sampling, loss weights and threshold calibration. S600: After multiple rounds of federation iterations until the termination conditions are met, freeze the shared backbone network and retain the local domain adapter. S700: The shared backbone network and local domain adapter obtained in step S600 are used to perform anomaly detection and output the network traffic data of the multi-domain IoT obtained in real time.

[0008] Based on the above, in step S200, the multi-task labeling system includes: ① binary classification labels: used to label normal traffic and malicious traffic; ② behavior category labels: used to label the behavior category to which malicious traffic belongs, including C&C, DDoS, PortScan, FileDownload, HeartBeat and Attack; ③ family category labels: used to label several malicious families and unknown family labels, and to mask the family loss item for unknown family label samples.

[0009] Based on the above, in step S300, common features are extracted using the shared backbone network. : ; in, The feature vector of the acquired IoT data. To share the backbone network.

[0010] Based on the above, in step S300, when configuring the local domain adapter, the client participating in federated training selects between Adapter and FedBN based on the degree of domain offset between the local domain data distribution and the global distribution, as well as the local computing resource conditions: when the client's domain offset is higher than a preset threshold and the local computing resources meet the training requirements of the additional adaptation module, Adapter is selected; when the client's computing resources are limited, or the domain offset is mainly reflected in the mean and variance offset of the feature statistics, FedBN is selected; wherein, the degree of domain offset can be determined based on the difference between the local domain sample feature statistics and the global statistics: Firstly, the Adapter: inserts a bottleneck structure into the backbone and performs residual connections. ; in For feature dimension, To maintain the compression ratio, this adapter is only updated within this domain, and the difference is uploaded along with the client's local model; Secondly, FedBN: The client retains the local batch-normalized mean. With variance Only scaling parameters are shared. With bias .

[0011] Based on the above, in step S400, the total loss of multiple tasks is calculated based on the multi-task labeling system. for: ; ; ; ; in, For binary classification label loss, The weights for the binary classification loss terms. For the weights of behavioral loss items, Weights for family-related loss items; This represents the batch sample size. This is a real label; This is a predicted value for the probability of malicious activity. For behavioral label loss, For the number of behavior labels; For the first A behavioral tag, Predict its probability; For focusing parameters; For family-class cross-entropy loss, For real family category The predicted probability.

[0012] Based on the above, the average multi-task loss per domain is: ; in: To share parameters, For the first Number of domain samples For the sample Total loss due to multitasking Total number of domains; This is the loss vector; The optimization problem of determining weights under relative entropy constraints: ; in: For the first The domain weights to be determined in the round. It is a probabilistic simplex. For the loss vector, As a relative entropy constraint, As a prior distribution, The constraint radius.

[0013] Based on the above, in step S400, the aggregation method is weighted aggregation, which performs weighted aggregation on the parameter differences according to the weights and updates the global model: ; ; in, For the first Each client completes the model parameters after the current round of local training. For the server in the The global model parameters issued at the start of each federated iteration. For the first The local parameter differences of each client relative to the current global model. Indicates the first Wheel of Life Domain weight corresponding to each client, For the federated round index, This represents the total number of clients participating in the aggregation.

[0014] Based on the above, in step S400, the aggregation method is robust aggregation, which sorts each parameter coordinate according to the client-updated value based on the weighted pruning mean, and removes the two ends. Calculate a weighted average after considering the extreme quantile values: ; in, In the first The global update value obtained by robust aggregation of the clipped mean on each parameter coordinate is then obtained. For the first Remove the upper and lower parts Client index set after quantile extreme values For the first Client parameter differences The dimensional components, Indicates the first Wheel of Life Domain weight corresponding to each client, .

[0015] Based on the above, in step S500, the sampling quota is: ; in: For the first Domain samples in The proportion of trainees selected to participate in this round of training. For the first Round domain weights; No. Normalized entropy of the wheel: ; ; in: The mixing coefficient, , For boundary hyperparameters; Threshold selection: ; in: For domain The validation set For the first The F1 score of each behavioral label.

[0016] This invention has outstanding substantive features and significant progress compared to the prior art, specifically: 1) Simultaneously implement hierarchical detection of binary labels, behavioral labels, and family labels in the same process, overcoming the information loss and detection blind spots caused by using only a single label or single category model; 2) By combining a shared backbone network structure with local domain adapters or local batch normalized statistics, the model's adaptability and convergence stability are significantly enhanced in multi-domain non-independent and identically distributed environments; 3) By using the exponential or power-skewed closed-form calculation method of domain weights, high-loss domains can receive more reasonable training attention, which is conducive to improving the rationality of domain attention allocation in cross-domain training and reducing the adverse effects of weak domains on the overall model update.

[0017] 4) The same domain weight is applied to the client sampling quota, loss weighting, temperature scaling and threshold calibration, forming a closed-loop scheduling mechanism from training to deployment, thereby reducing the fluctuation of false positives and false negatives after deployment.

[0018] 5) Provides optional robust aggregation strategies to enhance the system's resistance to extreme client updates or noisy data, thereby improving overall system stability. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the process of this invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] like Figure 1 As shown, a network traffic anomaly detection method adapted to multi-domain IoT federated domains includes the following steps: S100, acquiring network traffic data of multi-domain IoT and processing it to generate a unified feature vector; S200, establishing a multi-task label system for IoT network traffic data based on attributes; S300, deploying a shared backbone network and a local domain adapter in each federated client and performing local training; S400, calculating multi-task loss based on the multi-task label system, and aggregating the parameter differences of the multi-domain IoT clients on the server side according to the multi-task loss and updating the global model; S500, distributing the updated global model to each client of the multi-domain IoT and adjusting sampling, loss weights, and threshold calibration; S600, performing multiple rounds of federated iterations until the termination condition is met, freezing the shared backbone network and retaining the local domain adapter; S700, performing anomaly detection and output on the real-time acquired network traffic data of the multi-domain IoT using the shared backbone network and local domain adapter obtained in step S600.

[0022] In practice, IoT data acquisition terminals in different regions read the raw traffic logs and tag files collected, performing timestamp alignment, field normalization, and missing data handling. Discrete fields such as protocol, direction, and service port segment are enumerated or target-encoded, while continuous fields such as byte count, packet count, and duration are robustly scaled. This normalizes the samples within the domain into feature vectors of a unified dimension, and caches the domain identifier for subsequent statistical and weighted use. A multi-task tagging system is established for IoT data based on different attributes. In this embodiment, it specifically includes: ① Binary classification tags: used to label normal traffic and malicious traffic; ② Behavioral tags: used to label the behavioral category to which malicious traffic belongs, including C&C, DDoS, PortScan, FileDownload, HeartBeat, and Attack; ③ Family tags: labeling several malicious families and unknown family tags, with family loss items masked for unknown family tag samples.

[0023] Each federated client deploys a shared backbone network and local domain adapter, performs local training, calculates multi-task loss, and generates parameter difference and domain loss statistics. Specifically: Extracting common features from a shared backbone network: ; in, The feature vector of the acquired IoT data. To share the backbone network.

[0024] When configuring the local domain adapter, the client participating in federated training selects between the Adapter and FedBN based on the domain offset between the local and global data distributions and local computing resources: The Adapter is selected when the client's domain offset exceeds a preset threshold and local computing resources meet the training requirements of the additional adaptation module; the FedBN is selected when client computing resources are limited, or when the domain offset is mainly reflected in the mean and variance offset of feature statistics. The degree of domain offset can be determined based on the difference between the local sample feature statistics and the global statistics. Firstly, the Adapter: inserts a bottleneck structure into the backbone and performs residual connections. ; in For feature dimension, To maintain the compression ratio, this adapter is only updated within this domain, and the difference is uploaded along with the client's local model; Secondly, FedBN: The client retains the local batch-normalized mean. With variance Only scaling parameters are shared. With bias No processing during server aggregation .

[0025] The total loss is calculated based on the three outputs of binary classification labels, behavior labels, and family labels, and local training is completed. The multi-task loss calculation specifically includes: ① Calculate the binary classification loss : ; in: This represents the batch sample size. This is a real label; This is a predicted value for the probability of malicious activity. ② Domain-conditional asymmetric loss (DCASL) is used to suppress long tails and amplify the learning intensity of uncertain samples, and the behavioral class label loss is calculated: ; in: For the number of behavior labels; For the first A behavioral tag, Predict its probability; For focusing parameters; Computational domain class joint recalibration weights : ; in: For domain The effective sample balance coefficient, For domain Inner label The number of samples, This is the uncertainty adjustment coefficient; Used to correct based on the number of valid samples, used to suppress the dominance of head labels in long-tail data and boost tail labels; The uncertainty of the model output is amplified to prioritize the learning of boundary samples and error-prone samples; ③ Calculate the family class cross-entropy loss: ; in: For real family category The predicted probability; In this embodiment, the total multi-task loss is: ; in, The weights for the binary classification loss terms. For the weights of behavioral loss items, Weights for family-related loss items.

[0026] On the server side, based on the average total multi-task loss statistics for each domain uploaded by each client, the parameter differences of each client are aggregated and the global model is updated. To unify the common quantities required by the subsequent weighted aggregation and robust aggregation aggregators, the average total multi-task loss for each client is first calculated and the domain weights are determined accordingly. Then, the specific aggregation implementation is selected based on the degree of anomaly in the parameter differences, specifically including: Construct the average multi-task loss and loss vector for each domain: ; in: To share parameters, For the first Number of domain samples For the sample Total loss due to multitasking Total number of domains; The optimization problem of determining weights under relative entropy constraints: ; in: For the first The domain weights to be determined are in turn. It is a probabilistic simplex. For the loss vector, As a relative entropy constraint, As a prior distribution, The constraint radius.

[0027] The calculation method for domain weights is selected based on the dispersion of the average total multi-task loss per domain for each client: when the variance of the average total multi-task loss per domain for each client is not higher than a preset threshold, the exponential skew method is used to obtain a smooth and controllable weight distribution; when the variance of the average total multi-task loss per domain for each client is higher than a preset threshold, indicating the existence of high-loss, difficult domains or obvious long-tailed domains, the power skew method is used to enhance the ability to distinguish high-loss domains. When the domain weight calculation method is the exponential skew method, the focus is on obtaining a smooth and controllable weight distribution under the constraint of relative entropy. The closed-form approximation of the exponential skew method is as follows: ; in: For temperature parameters, and Monotonic correlation; When the domain weight calculation method is the power-tilt method, the sensitivity to the high-loss domain is controlled by both adjustable linear stretching and the power exponent. This suppresses excessive amplification of extreme domains while retaining the necessary tilt for difficult domains. The closed-form approximation of the power-tilt method is as follows: ; in: , The linear stretching factor is... As a power-law exponent, the power-tilt method exhibits polynomial growth in the weight gain over high loss domains, with an upper bound that can be obtained through... , control.

[0028] The aggregation method is selected based on the degree of anomaly in the parameter differences of each client: when the dispersion of the parameter differences of each client is not higher than a preset threshold and no outlier clients are detected, weighted aggregation is used; when there are outlier parameters in the parameter differences of each client, the dispersion is higher than the preset threshold, or the proportion of outlier clients exceeds a safety threshold, a robust aggregation algorithm is used. When the aggregation method is weighted aggregation, the parameter differences are weighted according to weights and the global model is updated. ; in, For the first Each client completes the model parameters after the current round of local training. For the server in the The global model parameters issued at the start of each federated iteration. For the first The local parameter differences of each client relative to the current global model. Indicates the first Wheel of Life Domain weight corresponding to each client, For the federated round index, The total number of clients participating in the aggregation; When the aggregation method is robust aggregation, the weighted average is used to sort each parameter coordinate according to the client-updated value, removing the two ends. Calculate a weighted average after considering the extreme quantile values: ; in, In the first The global update value obtained by robust aggregation of the clipped mean on each parameter coordinate is then obtained. For the first Remove the upper and lower parts Client index set after quantile extreme values For the first Client parameter differences The dimensional components, Indicates the first Wheel of Life Domain weight corresponding to each client, .

[0029] The updated global model is distributed to each client, and sampling, loss weights, and threshold calibration are adjusted, with sampling quotas using an adaptive hybrid strategy: ; in: For the first Domain samples in The proportion of trainees selected to participate in this round of training. For the first Round domain weights; Calculate the first The normalized entropy of the round measures uncertainty. High entropy indicates that the difficulty levels of each domain are similar, so the uniform sampling ratio is increased to ensure coverage; low entropy indicates that the difficult domains are relatively concentrated, so the weight-driven sampling ratio is increased to enhance targeted learning. ; Calculate the mixing coefficient: ; in: , For boundary hyperparameters; Loss weighted: ; in: For domain The local multi-task training loss.

[0030] Temperature scaling is applied to the original confidence vector of the current sample to obtain the probability vector: ; in: For the unscaled log-odds, logit For domain Temperature parameters, The reference temperature hyperparameter; Threshold selection: ; in: For domain The validation set For the first The F1 score of each behavioral label.

[0031] Multiple rounds of federated iterations are performed until the termination condition is met, freezing the shared backbone network while retaining local domain adapter or BN statistics to support lightweight adaptation of new domains. Output hierarchical results use temperature-calibrated probabilities, specifically including: Output hierarchical results: binary classification To determine malice, behavioral tags are used. If it exists, the family class is determined to be... determination; New Domain Lightweight Adaptive: Freeze the shared backbone, only fine-tune local domain adapter parameters or update target domain local batch normalization statistics, preferably fine-tuning for 1-2 rounds and learning rate. .

[0032] The method flow of the present invention will be further illustrated below with an example. It should be noted that the data in the following example is only used to illustrate the calculation process of the present invention and does not constitute a limitation on the scope of protection of the present invention.

[0033] In the example, suppose there are 3 clients in the t-th round of federated training, and the average total multi-task loss per domain is as follows: Prior distribution Temperature parameters are taken After calculation using the exponential tilt method, the weights of the t-round domain can be obtained. Approximately This indicates that the second client, with a higher average loss, receives a larger aggregation weight in this round of aggregation.

[0034] Furthermore, let the client parameter differences on a certain parameter coordinate be respectively If ordinary weighted aggregation is used, the updated value of this coordinate is approximately 0.528; if robust aggregation with trimmed mean is used, and extreme values ​​at both ends are removed before weighted averaging by domain weights, the updated value of this coordinate is 0.24. This demonstrates that robust aggregation can suppress the adverse effects of outlier updates on the global model.

[0035] During the detection phase, assuming a real-time traffic sample, after being output by the model, has a binary classification probability of 0.87 for malicious activity, a prediction probability of 0.78 for DDoS in the behavior category, and the highest prediction probability of malicious family B in the family category at 0.71; if a binary classification threshold is preset... Behavioral threshold If the sample is identified as malicious traffic, its behavior category is determined to be DDoS, and its family category is determined to be malicious family B.

[0036] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A network traffic anomaly detection method adapted to multi-domain IoT federated domains, characterized in that, Including the following steps: S100: Acquire network traffic data from multi-domain IoT and process it to generate a unified feature vector; S200: Establish a multi-task tagging system for IoT network traffic data based on attributes; S300: Deploy a shared backbone network and local domain adapter in each federal client and conduct local training. S400. Calculate multi-task loss based on multi-task labeling system, and aggregate the parameter differences of multi-domain IoT clients on the server side according to the multi-task loss and update the global model. S500: Distribute the updated global model to each client of the multi-domain IoT and adjust the sampling, loss weights and threshold calibration. S600: After multiple rounds of federation iterations until the termination conditions are met, freeze the shared backbone network and retain the local domain adapter. S700: The shared backbone network and local domain adapter obtained in step S600 are used to perform anomaly detection and output the network traffic data of the multi-domain IoT obtained in real time.

2. The network traffic anomaly detection method adapted to multi-domain IoT federated domains according to claim 1, characterized in that, In step S200, the multi-task labeling system includes: ① binary classification labels: used to label normal traffic and malicious traffic; ② behavior category labels: used to label the behavior category to which malicious traffic belongs, including C&C, DDoS, PortScan, FileDownload, HeartBeat and Attack; ③ family category labels: used to label several malicious families and unknown family labels, and to mask the family loss item for unknown family label samples.

3. The network traffic anomaly detection method adapted to multi-domain IoT federated domains according to claim 1, characterized in that, In step S300, common features are extracted using a shared backbone network. : ； in, The feature vector of the acquired IoT data. To share the backbone network.

4. The network traffic anomaly detection method adapted to multi-domain IoT federated domains according to claim 1, characterized in that, In step S300, when configuring the local domain adapter, the client participating in federated training selects between the Adapter and FedBN based on the degree of domain offset between the local domain data distribution and the global distribution, as well as local computing resource conditions: The Adapter is selected when the client's domain offset is higher than a preset threshold and the local computing resources meet the training requirements of the additional adaptation module; the FedBN is selected when the client's computing resources are limited, or when the domain offset is mainly reflected in the mean and variance offset of feature statistics; wherein, the degree of domain offset can be determined based on the difference between the local domain sample feature statistics and the global statistics. Firstly, the Adapter: inserts a bottleneck structure into the backbone and performs residual connections. ； in For feature dimension, To maintain the compression ratio, this adapter is only updated within this domain, and the difference is uploaded along with the client's local model; Secondly, FedBN: The client retains the local batch-normalized mean. With variance Only scaling parameters are shared. With bias .

5. The network traffic anomaly detection method adapted to multi-domain IoT federated domains according to claim 1, characterized in that: In step S400, the total loss of multiple tasks is calculated based on the multi-task labeling system. for: ； ； ； ； in, For binary classification label loss, The weights for the binary classification loss terms. For the weights of behavioral loss items, Weights for family-related loss items; This represents the batch sample size. This is a real label; This is a predicted value for the probability of malicious activity. For behavioral label loss, For the number of behavior labels; For the first A behavior tag, Predict its probability; For focusing parameters; For family-class cross-entropy loss, For real family category The predicted probability.

6. The network traffic anomaly detection method adapted to multi-domain IoT federated domains according to claim 1, characterized in that: The average multi-task loss per domain is: ； in: To share parameters, For the first Number of domain samples For the sample Total loss due to multitasking Total number of domains; This is the loss vector; The optimization problem of determining weights under relative entropy constraints: ； in: For the first The domain weights to be determined in the round. It is a probabilistic simplex. For the loss vector, As a relative entropy constraint, As a prior distribution, The constraint radius.

7. The network traffic anomaly detection method adapted to multi-domain IoT federated domains according to claim 6, characterized in that: In step S400, the aggregation method is weighted aggregation, which performs weighted aggregation on the parameter differences according to the weights and updates the global model: ； ； in, For the first Each client completes the model parameters after the current round of local training. For the server in the The global model parameters issued at the start of each federated iteration. For the first The local parameter differences of each client relative to the current global model. Indicates the first Wheel of Life Domain weight corresponding to each client, For the federated round index, This represents the total number of clients participating in the aggregation.

8. The network traffic anomaly detection method adapted to multi-domain IoT federated domains according to claim 6, characterized in that: In step S400, the aggregation method is robust aggregation, which sorts each parameter coordinate according to the client-updated value based on the weighted pruning mean, and removes the two ends. Calculate a weighted average after considering the extreme quantile values: ； in, In the first The global update value obtained by robust aggregation of the clipped mean on each parameter coordinate is For the first Remove the upper and lower parts Client index set after quantile extreme values For the first Client parameter differences The dimensional components, Indicates the first Wheel of Life Domain weight corresponding to each client, .

9. The network traffic anomaly detection method adapted to multi-domain IoT federated domains according to claim 1, characterized in that: In step S500, the sampling quota is: ； in: For the first Domain samples in The proportion of trainees selected to participate in this round of training. For the first The domain weight of the wheel; No. Normalized entropy of the wheel: ； ； in: The mixing coefficient, , For boundary hyperparameters; Threshold selection: ； in: For domain The validation set For the first The F1 score of each behavioral label.

Images