A federated learning-based edge node communication anomaly detection method and system
By using a federated learning-based edge node communication anomaly detection method, we have solved the privacy leakage, real-time performance, and anti-interference issues of traditional models, achieving high-precision, low-latency communication anomaly detection that is suitable for industrial control scenarios.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XUZHOU HENGJIA ELECTRONIC TECH CO LTD
- Filing Date
- 2026-05-19
- Publication Date
- 2026-07-10
Smart Images
Figure CN122372318A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the technical field of industrial Internet of Things (IIoT), and in particular to a method and system for detecting communication anomalies in edge nodes based on federated learning. Background Technology
[0002] Edge computing, as a distributed extension of cloud computing, significantly reduces data transmission latency and improves service response speed by pushing computing power to the network edge. However, the heterogeneity of edge nodes (such as differences in computing power and communication protocols) and the openness of the deployment environment lead to the following drawbacks of traditional centralized detection models: 1. Data privacy leakage risk: Traditional centralized detection models require edge nodes to upload raw communication stream data (including sensitive information such as device identifiers and interaction commands), posing a risk of data theft or misuse, violating regulations such as the Personal Information Protection Law. 2. Real-time bottleneck: Concurrent data transmission from massive edge devices can easily lead to network congestion, and the average response latency of centralized detection can reach hundreds of milliseconds, making it difficult to meet the needs of low-latency scenarios such as industrial control. 3. Insufficient model generalization ability: A globally unified model cannot adapt to the communication characteristics of different edge nodes (such as the high reliability requirements of industrial scenarios and the high throughput requirements of consumer electronics), resulting in anomaly detection F1 scores generally below 80%. 4. Weak anti-interference ability: Communication noise in complex electromagnetic environments and attacker evasion techniques (such as feature mutation) can easily lead to a false positive rate of over 15%. Therefore, there is an urgent need to build an edge node communication anomaly detection mechanism that takes into account privacy protection, real-time performance, and detection accuracy. Summary of the Invention
[0003] To address the technical problems mentioned above, this application proposes an edge node communication anomaly detection method based on federated learning, which features high privacy protection, high real-time performance, high detection accuracy, and good compatibility.
[0004] Firstly, this application proposes a method for detecting communication anomalies in edge nodes based on federated learning, comprising the following steps: The initial communication behavior feature model is deployed using a cloud server, and the parameter matrix of the initial communication behavior feature model is distributed to each edge node through a secure channel, and federated learning parameters are configured. Each edge node's device uses locally stored historical communication data to train a model of the received communication behavior characteristics, thereby obtaining updated values for the local model parameters. Each edge node device encrypts the local model parameter update value and sends it to the cloud server. The cloud server uses a federated averaging algorithm to aggregate the received local model parameter update values to obtain the global model parameter update value, and then updates the new global communication behavior feature model. The cloud server sends the new global communication behavior feature model to the devices of each edge node, and the devices of each edge node replace their local model with the new global communication behavior feature model. Each edge node device collects its own communication behavior characteristics in real time, inputs them into the acquired global communication behavior characteristic model to obtain the output results, compares the output results with a preset federated model threshold, and if it deviates from the threshold, it is determined that the edge node device has a communication abnormality. When a device at an edge node is determined to have a communication anomaly, the degree of anomaly is classified into different levels based on how much the anomaly value deviates from the threshold of the federated model, and corresponding measures are set for each level of anomaly.
[0005] Preferably, the devices at each edge node use locally stored historical communication data to train the received communication behavior feature model, obtaining local model parameter update values including: Communication behavior features are extracted from the historical communication data of devices at each edge node. These features are then input into the received communication behavior feature model. The error between the model's predicted value and the actual value is calculated using the cross-entropy loss function. Finally, the model parameters are adjusted using the gradient descent algorithm to obtain the updated local model parameters.
[0006] Preferably, during local model training, dynamic weights are assigned to the communication behavior features based on the communication scenarios and historical anomalies of devices at different edge nodes. The communication behavior features include data packet sending frequency, protocol interaction interval, data conversion time, etc.
[0007] Preferably, assigning dynamic weights to the communication behavior features based on the communication scenarios and historical anomalies of devices at different edge nodes includes: First, basic weighting coefficients are set for communication behavior characteristics based on different communication scenarios; Then, based on the number of anomalous events caused by each feature and the total number of anomalous events, the feature contribution of each feature in historical anomalous events is calculated. Then, the weights are adjusted based on the feature contribution to obtain the feature contribution adjustment ratio; Finally, the final feature weights are calculated using the feature contribution adjustment ratio and the basic weight coefficient.
[0008] Preferably, during the local model training process, simulated malicious interference data of the communication behavior features is generated based on the feature distribution of historical real attack data. The simulated malicious interference data is injected into the local communication behavior feature training data according to a preset ratio. The injected samples of simulated malicious interference data are randomly adjusted during each iteration of the communication behavior feature model, and the anti-interference training target of the communication behavior feature model is set.
[0009] Preferably, during the local model training process, each edge node device only uses recent historical communication data to train the local model, and adds noise perturbation to the local model parameter update values during the model training process.
[0010] Preferably, the cloud server uses a federated averaging algorithm to aggregate the received local model parameter update values to obtain the global model parameter update values, including: The cloud server evaluates the credibility of the local model parameter update values and aggregates the local model parameter update values with a credibility greater than a preset threshold to obtain the global model parameter update values.
[0011] Preferably, the cloud server performs a reliability assessment on the local model parameter update values and aggregates local model parameter update values with a reliability greater than a preset threshold to obtain global model parameter update values, including: When aggregating the update values of local model parameters, the cloud server performs a reliability assessment on the update values of local model parameters of the devices at each edge node: ; Where T is the credibility, H is the contribution of the device's historical model, and S is the stability of the current parameter update value; The historical model contribution is obtained as follows: after each model aggregation, the accuracy difference of the global model before and after adding the updated values of the current device's local model parameters is calculated, and the accuracy difference is accumulated each time to obtain the historical model contribution. ; in, To determine the global model accuracy after incorporating the parameters of device i, The global model accuracy is defined without the parameters of device i. The stability of the current parameter update value is obtained by recording the local model parameter update values of the current device for n consecutive times, calculating the absolute difference between two adjacent update values, and then calculating the average of the absolute differences between the two adjacent update values. ; in, This is the value updated for the nth time. This is the value updated in the (n-1)th iteration. This is the value updated for the (n-2)th time.
[0012] Preferably, when an edge node's device is determined to have a communication anomaly, the degree of anomaly is divided into different levels based on the extent to which the anomaly value deviates from the federated model threshold, and corresponding measures are set for different levels of anomaly, including: If the abnormal value deviates from the threshold by less than 5%, it is judged as a minor abnormality. At this time, only a warning message is sent through a temporary encrypted channel. Regular data transmission permissions are not frozen, but the communication characteristics of the device are collected every 5 seconds for key monitoring. The warning message includes the name of the abnormal feature and the deviation value. If the abnormal value deviates from the threshold by 5%-20%, it is judged as a moderate abnormality. At this time, the device's non-critical business regular data transmission permissions are frozen, and only the critical business regular data transmission permissions are retained. At the same time, communication characteristics are collected every 2 seconds and uploaded to the cloud server through a temporary encrypted channel. If the abnormal value deviates from the threshold by more than 20%, it is judged as a severe anomaly. At this time, the normal data transmission permissions are completely frozen, the device isolation procedure is initiated, and the abnormal device is physically isolated from other devices in the edge network. It is only allowed to receive anomaly repair instructions issued by the cloud server through a temporary encrypted channel.
[0013] Secondly, this application also proposes an edge node communication anomaly detection system based on federated learning, the system comprising: The initialization module is configured to deploy the initial communication behavior feature model using the cloud server, distribute the parameter matrix of the initial communication behavior feature model to each edge node through a secure channel, and configure the federated learning parameters. The local training module is configured to use the locally stored historical communication data to train the received communication behavior feature model and obtain the local model parameter update values. The federated model aggregation module is configured to send the local model parameter update values to the cloud server after the devices of each edge node are encrypted. The cloud server uses a federated averaging algorithm to aggregate the received local model parameter update values to obtain the global model parameter update values and update the new global communication behavior feature model. The model distribution module is configured to allow the cloud server to send the new global communication behavior feature model to the devices of each edge node, and the devices of each edge node to replace their local models with the new global communication behavior feature model. An anomaly detection module is configured to collect the communication behavior characteristics of each edge node device in real time, input them into the acquired global communication behavior characteristic model to obtain the output results, compare the output results with a preset federated model threshold, and if the deviation from the threshold is found, it is determined that the device of the edge node has a communication anomaly. The anomaly response module is configured to classify the degree of anomaly into different levels based on the extent to which the anomaly value deviates from the threshold of the federated model when the device of the edge node is determined to have a communication anomaly, and to set corresponding measures for different levels of anomaly.
[0014] The beneficial effects of this invention are: 1. High level of privacy protection: It adopts a local training + encrypted aggregation mode, with zero uploading of raw data, reducing the risk of privacy leakage to meet the requirements of GDPR and domestic data security regulations.
[0015] 2. High real-time performance: Local detection has reduced average latency, which is an improvement over centralized architecture and meets the needs of low-latency scenarios such as industrial control.
[0016] 3. High detection accuracy: The dynamic weighting mechanism improves the F1 score and reduces the false alarm rate. Anti-interference training improves the model's recognition rate against mutation attacks.
[0017] 4. Good compatibility: Supports heterogeneous edge devices (ARM / x86 architecture) and mainstream communication protocols (Modbus, MQTT, ZigBee), reducing deployment costs. Attached Figure Description
[0018] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of this application. Other embodiments and many anticipated advantages of these embodiments will be readily recognized as they become better understood through reference to the following detailed description. Elements in the drawings are not necessarily to scale. The same reference numerals refer to corresponding similar parts.
[0019] Figure 1 This is a flowchart of an edge node communication anomaly detection method based on federated learning proposed in this application.
[0020] Figure 2 This is a schematic diagram of a specific embodiment of the edge node communication anomaly detection method based on federated learning that can be applied to this application.
[0021] Figure 3 This is a flowchart illustrating the process of assigning dynamic weights to communication behavior features in one embodiment of this application.
[0022] Figure 4 This is a schematic diagram of the key parameter configuration in one embodiment of this application.
[0023] Figure 5 This is a schematic diagram of the module structure of an edge node communication anomaly detection system based on federated learning in one embodiment of this application. Detailed Implementation
[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to represent selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0025] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.
[0026] Figure 1 The flowchart of an edge node communication anomaly detection method based on federated learning according to this application is shown. Figure 2 This diagram illustrates a specific embodiment of the federated learning-based edge node communication anomaly detection method applicable to this application, in conjunction with reference to... Figure 1 and Figure 2 The method specifically includes the following steps: S1: Deploy the initial communication behavior feature model using a cloud server, distribute the parameter matrix of the initial communication behavior feature model to each edge node through a secure channel, and configure the federated learning parameters. In a specific embodiment, step S1 is the initialization phase: the cloud server selects the initial communication behavior feature model structure and sends the initial values of the model parameters to each edge device. The communication behavior features include data packet sending frequency, protocol interaction interval, and data conversion time.
[0027] S2: Each edge node's device uses locally stored historical communication data to train the received communication behavior feature model and obtains local model parameter update values; In a specific embodiment, step S2 is the local training stage: each edge device uses locally stored historical communication data to train the received communication behavior feature model without uploading the original data, and obtains the local model parameter update value. The specific process of local training in step S2 is as follows: input the communication behavior features in the historical communication data into the model, calculate the error between the model's predicted value and the actual value through a preset loss function, adjust the model parameters using the gradient descent algorithm, and obtain the updated local model parameters.
[0028] In one specific embodiment, refer to Figure 3 During model training, dynamic weights are assigned to communication behavior features such as packet sending frequency, protocol interaction interval, and data conversion time based on the communication scenarios and historical anomalies of different edge devices. Specifically: For communication scenarios, a basic weight coefficient matrix is pre-set for different scenarios (such as industrial control scenarios and smart home scenarios). The basic weight coefficient of the protocol interaction interval is higher in the industrial control scenario than in the smart home scenario, and the basic weight coefficient of the data packet sending frequency is higher in the smart home scenario than in the industrial control scenario. For historical anomalies, the contribution of each feature to the historical anomaly events is statistically analyzed. The contribution calculation formula is as follows: in For feature contribution, This represents the number of abnormal events caused by this characteristic anomaly. The total number of abnormal events is used as the reference, and the weights are dynamically adjusted based on the contribution. For every 10% increase in contribution, the weight of the corresponding feature increases by 5%-15%. Final feature weights: in, Based on the weighting coefficient, Adjust the proportion of feature contribution.
[0029] In one specific embodiment, an anti-interference mechanism is introduced during local training and global aggregation. By adding simulated malicious interference data to the training data, the model has stronger anti-interference capabilities in complex network environments. Specifically, this includes: The rules for generating simulated malicious interference data are as follows: Based on the characteristic distribution of historical real attack data, data such as sudden changes in packet sending frequency (e.g., the sending frequency suddenly changes from 10 times / second to 100 times / second within 1 second), random fluctuations in protocol interaction intervals (e.g., the interval jumps irregularly between 10ms and 1000ms), and abnormal increases in data conversion time (e.g., the time increases from 50ms to 500ms). The proportion of interference data injected: simulated malicious interference data is injected into the local training data at a ratio of 10%-20%, and the injected interference data samples are randomly adjusted in each model iteration; Anti-interference training objective: To maintain the model's prediction accuracy above 90% on a training set containing interfering data, and to have a misclassification rate of less than 5% for interfering data.
[0030] S3: Each edge node device encrypts its local model parameter update value and sends it to the cloud server. The cloud server uses a federated averaging algorithm to aggregate the received local model parameter update values to obtain the global model parameter update value, and then updates the new global communication behavior feature model. In a specific embodiment, step S3 is the federated model aggregation stage: each edge device encrypts the local model parameter update value and sends it to the cloud server. The cloud server uses a federated averaging algorithm to aggregate these parameter update values to obtain the global model parameter update value, and updates the new global communication behavior feature model. In one specific embodiment, federated learning allows each edge device to train a communication behavior feature model locally without uploading raw data. Simultaneously, a global model is obtained by aggregating the updated parameters of the local models from each device via a cloud server. The specific implementation includes: During local training, the edge device only uses the communication data stored in its own storage for the past 3 months to train the model. During the training process, differential privacy technology is used to add noise perturbation to the local model parameter update values (the noise intensity is dynamically adjusted according to the data sensitivity, and the noise intensity of sensitive data is higher than that of non-sensitive data). When cloud servers are aggregated, the reliability of the updated local model parameters on each edge device is assessed. ; Where T is the credibility, H is the contribution of the device's historical model, and S is the stability of the current parameter update value; The historical model contribution is obtained as follows: After each model aggregation, the difference in accuracy of the global model before and after incorporating the updated parameters of the local model for that device is calculated. The historical model contribution is then obtained by summing these accuracy differences. ; in, To improve the global model accuracy after incorporating the device i parameter, This represents the global model accuracy without the device i parameter, where i is the iteration number. Method for obtaining parameter update value stability: Record the local model parameter update values of the device for three consecutive times, calculate the absolute difference between two adjacent update values, and then calculate the average of these two absolute differences, i.e.: ; in, This is the value updated for the nth time. This is the value updated for the (n-1)th time. This is the value updated in the (n-2)th iteration, where n is the current iteration number. Parameter update values with a confidence level below 60% will be removed, and only parameter update values with a confidence level of ≥60% will be aggregated.
[0031] S4: The cloud server sends the new global communication behavior feature model to the devices at each edge node, and the devices at each edge node replace their local models with the new global communication behavior feature model. In one specific embodiment, step S4 is the model distribution stage: the cloud server sends the new global communication behavior feature model to each edge device, and each edge device replaces its original local model with the new global model.
[0032] S5: Each edge node device collects its own communication behavior characteristics in real time, inputs them into the acquired global communication behavior characteristic model to obtain the output results, compares the output results with the preset federated model threshold, and if it deviates from the threshold, it is determined that the edge node device has a communication abnormality. In a specific embodiment, step S5 is the anomaly detection stage: each edge device collects its own communication behavior characteristics in real time, inputs them into the local global communication behavior characteristic model to obtain the output result, compares the output result with the preset federated model threshold, and if it deviates from the threshold, it is determined that the edge device has a communication anomaly. S6: When an edge node device is determined to have a communication anomaly, the degree of anomaly is divided into different levels according to the extent to which the anomaly value deviates from the threshold of the federated model, and corresponding measures are set for different levels of anomaly.
[0033] In a specific embodiment, step S6 is the abnormal response stage: when an edge device is determined to be in communication abnormality, a "temporary encrypted channel" is automatically triggered, and an abnormal warning information is sent to the cloud server through the channel. At the same time, the device's normal data transmission permission is frozen, and only necessary abnormal handling-related communication is allowed through the temporary encrypted channel. In a specific embodiment, the "temporary encrypted channel" in step S6 is an encrypted communication channel that is automatically triggered when the edge device is determined to be in communication abnormality. It is used to send abnormality warning information to the cloud server and to perform necessary abnormality handling related communications.
[0034] In one specific implementation, anomalies are categorized into three levels—mild, moderate, and severe—based on the degree to which they deviate from the federated model threshold, with different response measures corresponding to each level: Mild anomaly: The anomaly value deviates from the threshold by less than 5%. In this case, only a warning message is sent through a temporary encrypted channel. The warning message includes the name of the anomaly feature and the deviation value. Regular data transmission permissions are not frozen, but the communication characteristics of the device are collected every 5 seconds for key monitoring. Moderate anomaly: The anomaly value deviates from the threshold by 5%-20%. Freeze the device's non-critical business (such as log backup, software update) regular data transmission permissions, and only retain the critical business (such as real-time control command transmission) regular data transmission permissions. At the same time, collect communication characteristics every 2 seconds and upload them to the cloud server through a temporary encrypted channel. Severe anomaly: When the anomaly value deviates from the threshold by more than 20%, normal data transmission permissions are completely frozen, the device isolation procedure is initiated, and the device is physically isolated from other devices in the edge network. It is only allowed to receive anomaly repair instructions issued by the cloud server through a temporary encrypted channel.
[0035] In a specific embodiment, the method further includes step S7: model iterative optimization stage: in this stage, steps S2 to S6 are repeated to iteratively optimize the global communication behavior feature model.
[0036] In a specific embodiment, the following will disclose a specific embodiment of the edge node communication anomaly detection method based on federated learning of this application: System initialization (S101) Initial Communication Behavior Feature Model for Cloud Server Deployment The model input is a three-dimensional feature vector. (in For data packet transmission frequency, For protocol interaction interval, (Data conversion time), output is the probability of anomalies. .
[0037] Cloud servers distribute data to edge nodes via secure channels. parameter matrix Configure federated learning parameters (such as aggregation period) Learning rate ).
[0038] 2. Local model training (S102) Edge node k utilizes a local sliding window (window size) Historical communication data within (records) The model is optimized using Mini-Batch Gradient Descent (Mini-Batch SGD). in, For batch size, Let cross-entropy be the loss function. For the label (1 indicates an exception).
[0039] Differential privacy is used during training: gradients are... Add Laplace noise noise intensity The data sensitivity S is dynamically adjusted (S is the maximum rate of change of the feature).
[0040] In this step, a two-factor weight adjustment strategy based on scenario adaptation and historical contribution is introduced: Scenario-based weights: Industrial control scenarios =[0.2, 0.5, 0.3] (focusing on protocol interaction interval), smart home scenario =[0.4, 0.2, 0.4] (Focusing on transmission frequency and conversion time).
[0041] Contribution adjustment: Weight correction coefficient for feature f ,in Contribution to characteristic anomalies.
[0042] Final weights: ( (For Hadamah accumulation).
[0043] In this step, the robustness of the model is enhanced by injecting simulated attack samples: Interference sample generation: Generating three types of adversarial samples based on GAN network: frequency mutation samples ( ), (Normal standard deviation), interval jump samples ( Random fluctuations), time-dilated samples ( (mean).
[0044] Injection strategy: In each round of training, 15% of the samples are randomly injected as interference samples, and the FGSM algorithm is used to generate targeted adversarial samples.
[0045] Optimization objective: Accuracy of interference sample detection 90%, false alarm rate 5%.
[0046] 3. Federated Model Aggregation (S103) Edge node k updates local parameters After being homomorphically encrypted (such as by the Paillier algorithm), it is uploaded to the cloud server.
[0047] After the cloud server decrypts the encrypted parameters, it aggregates them according to their trustworthiness: in , Score the credibility of node k.
[0048] Update the global model: .
[0049] In this step, the cloud server evaluates the node's trustworthiness using a two-dimensional approach: historical contribution and parameter stability. Historical contribution ,in To improve the model accuracy after incorporating node parameters, This is the precision after elimination.
[0050] Parameter stability U represents the parameter update amount.
[0051] Credibility rating Aggregation only The node parameters.
[0052] 4. Model Distribution and Synchronization (S104) cloud servers will Distributed to each edge node, node k updates its local model. .
[0053] 5. Real-time anomaly detection (S105) Real-time acquisition of feature vectors at edge nodes Input the local model to obtain the anomaly probability. .
[0054] Set threshold (Dynamically updated, initial value) =0.7), if > If the condition is not met, it is considered a communication error.
[0055] 6. Graded Anomaly Response (S106) In this step, a three-level anomaly response mechanism is introduced, based on a response strategy that quantifies and grades anomaly probabilities: Dynamic adjustment of tiered thresholds: ,in This is a node trust level correction value (if the trust level is high). (Increase).
[0056] The response measures include three levels: communication access control, feature sampling frequency adjustment, and physical isolation, to achieve a balance between risk and business availability.
[0057] Mild abnormality (0.7 < ): Initiate 5-second feature resampling, send the alert to the cloud server through the TLS1.3 encrypted channel, and retain normal communication permissions.
[0058] Moderately abnormal (0.85 < ): Freeze non-critical ports (such as 80 / 443), retain only industrial control ports (such as 502) for communication, and upload features in 2 seconds.
[0059] Severe abnormality ( > 0.95): Triggers physical isolation (severing the link via an optical switch), allowing only OTA repair commands from the cloud server to be received.
[0060] 7. Model Iterative Optimization (S107) Every T=30 minutes, repeat steps S102-S106 to continuously optimize the model's generalization ability through federated learning.
[0061] The following discloses a hardware environment for implementing the above method: Cloud server: 2-way Intel Xeon Platinum 8380 processors, 512GB DDR4 memory, equipped with NVIDIA A100 GPU (for model aggregation acceleration).
[0062] Edge node: Utilizes ARM Cortex-A53 architecture (such as Raspberry Pi 4B), 2GB memory, 100Mbps Ethernet interface, and runs Ubuntu 20.04.
[0063] Communication link: Edge nodes communicate with cloud servers via 5G NR (Sub-6GHz band), with end-to-end latency <20ms.
[0064] The following is a software implementation for implementing the above method: Model architecture: A 3-layer MLP network is used, with 3 neurons in the input layer, 64 / 32 neurons in the hidden layer (ReLU activation), and 1 neuron in the output layer (Sigmoid activation).
[0065] Federated Learning Framework: Based on the FedML open-source framework, it integrates the Paillier homomorphic encryption module (key length 2048 bits).
[0066] Anomaly response module: Port management is implemented through the Linux netfilter mechanism, and physical isolation is achieved using an optical module control chip (such as MAX32660).
[0067] Based on the above hardware and software configurations, the key parameter configurations in this embodiment can be referenced. Figure 4 As shown.
[0068] Through the above implementation methods, accurate and real-time detection of communication anomalies at edge nodes can be achieved while ensuring data privacy, providing key technical support for edge network security.
[0069] Further reference Figure 5 As an implementation of the above method, this application provides an embodiment of an edge node communication anomaly detection system based on federated learning. This system embodiment is similar to... Figure 1 Corresponding to the method embodiments shown, this device can be specifically applied to various electronic devices.
[0070] refer to Figure 5 An edge node communication anomaly detection system based on federated learning includes: Initialization module 201 is configured to deploy the initial communication behavior feature model using the cloud server, distribute the parameter matrix of the initial communication behavior feature model to each edge node through a secure channel, and configure federated learning parameters. The local training module 202 is configured to train the received communication behavior feature model using locally stored historical communication data for each edge node, and obtain the local model parameter update value. The federated model aggregation module 203 is configured to encrypt the local model parameter update values of each edge node and send them to the cloud server. The cloud server uses a federated averaging algorithm to aggregate the received local model parameter update values to obtain global model parameter update values and update the new global communication behavior feature model. Model distribution module 204 is configured to send the new global communication behavior feature model to the devices of each edge node, and the devices of each edge node replace their local models with the new global communication behavior feature model; The anomaly detection module 205 is configured to collect the communication behavior characteristics of each edge node device in real time, input them into the acquired global communication behavior characteristic model to obtain the output result, compare the output result with a preset federated model threshold, and if it deviates from the threshold, it is determined that the device of the edge node has a communication anomaly. The anomaly response module 206 is configured to classify the degree of anomaly into different levels based on the degree to which the anomaly value deviates from the threshold of the federated model when the device of the edge node is determined to be in communication anomaly, and to set corresponding measures for different levels of anomaly.
[0071] In summary, the edge node communication anomaly detection method and system based on federated learning disclosed in this application has the following beneficial effects: 1. Strong privacy protection: Adopting a local training + encrypted aggregation mode, with zero uploading of raw data, the risk of privacy leakage is reduced to meet GDPR and domestic data security regulations. 2. Real-time performance: The average latency of local detection is reduced, which is improved compared to centralized architecture, meeting the needs of low-latency scenarios such as industrial control. 3. Detection accuracy: The dynamic weight mechanism improves the F1 score and reduces the false positive rate, and anti-interference training improves the model's recognition rate against mutation attacks. 4. Compatibility: Supports heterogeneous edge devices (ARM / x86 architecture) and mainstream communication protocols (Modbus, MQTT, ZigBee), reducing deployment costs.
[0072] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the following... Figure 1 The method shown.
[0073] It should be noted that the computer-readable storage medium described in this application can be a computer-readable signal medium, a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable storage medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable storage medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.
[0074] Computer program code for performing the operations of this application can be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, and C++, and conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0075] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0076] The specific embodiments of this application have been described above, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
[0077] In the description of this application, it should be understood that the terms "upper," "lower," "inner," "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are used only for the convenience of describing this application and for simplification, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The simple fact that certain measures are recited in mutually different dependent claims does not indicate that combinations of these measures cannot be used for improvement. Any reference signs in the claims should not be construed as limiting the scope.
Claims
1. A method for detecting communication anomalies in edge nodes based on federated learning, characterized in that, The method includes the following steps: The initial communication behavior feature model is deployed using a cloud server, and the parameter matrix of the initial communication behavior feature model is distributed to each edge node through a secure channel, and federated learning parameters are configured. Each edge node's device uses locally stored historical communication data to train a model of the received communication behavior characteristics, thereby obtaining updated values for the local model parameters. Each edge node device encrypts the local model parameter update value and sends it to the cloud server. The cloud server uses a federated averaging algorithm to aggregate the received local model parameter update values to obtain the global model parameter update value, and then updates the new global communication behavior feature model. The cloud server sends the new global communication behavior feature model to the devices of each edge node, and the devices of each edge node replace their local model with the new global communication behavior feature model. Each edge node device collects its own communication behavior characteristics in real time, inputs them into the acquired global communication behavior characteristic model to obtain the output results, compares the output results with a preset federated model threshold, and if it deviates from the threshold, it is determined that the edge node device has a communication abnormality. When a device at an edge node is determined to have a communication anomaly, the degree of anomaly is classified into different levels based on how much the anomaly value deviates from the threshold of the federated model, and corresponding measures are set for each level of anomaly.
2. The edge node communication anomaly detection method based on federated learning according to claim 1, characterized in that: The devices at each edge node use locally stored historical communication data to train a received communication behavior feature model, obtaining updated local model parameter values including: Communication behavior features are extracted from the historical communication data of devices at each edge node. These features are then input into the received communication behavior feature model. The error between the model's predicted value and the actual value is calculated using the cross-entropy loss function. Finally, the model parameters are adjusted using the gradient descent algorithm to obtain the updated local model parameters.
3. The edge node communication anomaly detection method based on federated learning according to claim 2, characterized in that, It also includes the following steps: During local model training, dynamic weights are assigned to the communication behavior features based on the communication scenarios and historical anomalies of devices at different edge nodes. These communication behavior features include data packet sending frequency, protocol interaction interval, and data conversion time.
4. The edge node communication anomaly detection method based on federated learning according to claim 3, characterized in that: The step of assigning dynamic weights to the communication behavior features based on the communication scenarios and historical anomalies of devices at different edge nodes includes: First, basic weighting coefficients are set for communication behavior characteristics based on different communication scenarios; Then, based on the number of anomalous events caused by each feature and the total number of anomalous events, the feature contribution of each feature in historical anomalous events is calculated. Then, the weights are adjusted based on the feature contribution to obtain the feature contribution adjustment ratio; Finally, the final feature weights are calculated using the feature contribution adjustment ratio and the basic weight coefficient.
5. A method for detecting communication anomalies in edge nodes based on federated learning according to any one of claims 1-4, characterized in that, It also includes the following steps: During the local model training process, simulated malicious interference data of the communication behavior features is generated based on the feature distribution of historical real attack data. The simulated malicious interference data is injected into the local communication behavior feature training data according to a preset ratio. The injected samples of simulated malicious interference data are randomly adjusted during each iteration of the communication behavior feature model, and the anti-interference training target of the communication behavior feature model is set.
6. A method for detecting communication anomalies in edge nodes based on federated learning according to any one of claims 1-4, characterized in that, It also includes the following steps: During local model training, each edge node device uses only recent historical communication data to train the local model and adds noise perturbation to the updated values of the local model parameters during the training process.
7. A method for detecting communication anomalies in edge nodes based on federated learning according to any one of claims 1-4, characterized in that, The cloud server uses a federated averaging algorithm to aggregate the received local model parameter update values to obtain global model parameter update values, including: The cloud server evaluates the credibility of the local model parameter update values and aggregates the local model parameter update values with a credibility greater than a preset threshold to obtain the global model parameter update values.
8. The edge node communication anomaly detection method based on federated learning according to claim 7, characterized in that: The cloud server performs a reliability assessment on the local model parameter update values and aggregates local model parameter update values with a reliability greater than a preset threshold to obtain global model parameter update values, including: When aggregating the update values of local model parameters, the cloud server performs a reliability assessment on the update values of local model parameters of the devices at each edge node: ； Where T is the credibility, H is the contribution of the device's historical model, and S is the stability of the current parameter update value; The historical model contribution is obtained as follows: after each model aggregation, the accuracy difference of the global model before and after adding the updated values of the current device's local model parameters is calculated, and the accuracy difference is accumulated each time to obtain the historical model contribution. ； in, To determine the global model accuracy after incorporating the parameters of device i, The global model accuracy is defined without the parameters of device i. The stability of the current parameter update value is obtained by recording the local model parameter update values of the current device for n consecutive times, calculating the absolute difference between two adjacent update values, and then calculating the average of the absolute differences between the two adjacent update values. ； in, This is the value updated for the nth time. This is the value updated for the (n-1)th time. This is the value updated for the (n-2)th time.
9. A method for detecting communication anomalies in edge nodes based on federated learning according to any one of claims 1-4, characterized in that: When an edge node's device is determined to have a communication anomaly, the anomaly level is divided into different grades based on the degree to which the anomaly value deviates from the federated model threshold, and corresponding measures are set for different grades of anomaly, including: If the abnormal value deviates from the threshold by less than 5%, it is judged as a minor abnormality. At this time, only a warning message is sent through a temporary encrypted channel. Regular data transmission permissions are not frozen, but the communication characteristics of the device are collected every 5 seconds for key monitoring. The warning message includes the name of the abnormal feature and the deviation value. If the abnormal value deviates from the threshold by 5%-20%, it is judged as a moderate abnormality. At this time, the device's non-critical business regular data transmission permissions are frozen, and only the critical business regular data transmission permissions are retained. At the same time, communication characteristics are collected every 2 seconds and uploaded to the cloud server through a temporary encrypted channel. If the abnormal value deviates from the threshold by more than 20%, it is judged as a severe anomaly. At this time, the normal data transmission permissions are completely frozen, the device isolation procedure is initiated, and the abnormal device is physically isolated from other devices in the edge network. It is only allowed to receive anomaly repair instructions issued by the cloud server through a temporary encrypted channel.
10. An edge node communication anomaly detection system based on federated learning, characterized in that, The system includes: The initialization module is configured to deploy the initial communication behavior feature model using the cloud server, distribute the parameter matrix of the initial communication behavior feature model to each edge node through a secure channel, and configure the federated learning parameters. The local training module is configured to use the locally stored historical communication data to train the received communication behavior feature model and obtain the local model parameter update values. The federated model aggregation module is configured to send the local model parameter update values to the cloud server after the devices of each edge node are encrypted. The cloud server uses a federated averaging algorithm to aggregate the received local model parameter update values to obtain the global model parameter update values and update the new global communication behavior feature model. The model distribution module is configured to allow the cloud server to send the new global communication behavior feature model to the devices of each edge node, and the devices of each edge node to replace their local models with the new global communication behavior feature model. An anomaly detection module is configured to collect the communication behavior characteristics of each edge node device in real time, input them into the acquired global communication behavior characteristic model to obtain the output results, compare the output results with a preset federated model threshold, and if the deviation from the threshold is found, it is determined that the device of the edge node has a communication anomaly. The anomaly response module is configured to classify the degree of anomaly into different levels based on the extent to which the anomaly value deviates from the threshold of the federated model when the device of the edge node is determined to have a communication anomaly, and to set corresponding measures for different levels of anomaly.