A byzantine robust federated learning defense system and method for traffic flow prediction

Abstract

The Byzantine robust federated learning defense system and method for traffic flow prediction belong to the technical field of federated learning security, and aim to solve the problems of lack of full-link closed-loop system, fixed screening threshold, inability to identify gradual poisoning attacks, and unverifiable election in existing defense schemes. A three-layer progressive architecture is adopted to realize Byzantine fault defense through adaptive gradient screening based on average cosine distance, verifiable random committee election, reward and punishment attenuation dynamic reputation management, and dynamic switching of multiple aggregation algorithms, which can improve the attack robustness of traffic prediction models and provide reliable support for intelligent traffic control.

Description

Technical Field

[0001] This invention relates to the field of federated learning security technology, specifically to a Byzantine robust federated learning defense system and method for traffic flow prediction. Background Technology

[0002] Federated learning, as a distributed machine learning paradigm, enables collaborative training of a global model without requiring local data from any participating party to remain within its domain. This effectively addresses the pain points of fragmented traffic data across multiple intersections and nodes, as well as the high demands for data privacy protection in the field of intelligent transportation. It is widely used in scenarios such as traffic flow prediction and congestion assessment. Urban traffic management centers can leverage data collection equipment such as geomagnetic sensors, microwave radar, and checkpoint cameras deployed at various intersections to collaboratively train high-precision traffic flow prediction models without disclosing raw monitoring data and vehicle trajectory information.

[0003] However, the distributed and open architecture of federated learning makes it highly vulnerable to Byzantine fault attacks. If a malicious node controlled by an attacker or a faulty node exists in the system, it may upload tampered gradient updates, causing a shift in the global model's convergence direction and a significant decrease in prediction accuracy. This ultimately affects the accuracy of business decisions such as traffic signal timing and congestion management. Traffic flow data in intelligent transportation scenarios inherently exhibits strong spatiotemporal correlation and obvious periodic patterns. Attackers can exploit this characteristic to design covert, gradual poisoning attacks, progressively misleading the model by fine-tuning the gradient direction round by round. Traditional defense methods based on single-round gradient detection, lacking modeling of node historical behavior, are completely unable to identify such slow poisoning attacks. Taking a city traffic brain managing traffic signals at twenty key intersections as an example, if an attacker controls three intersection nodes and uploads targeted poisoning gradients, the accuracy of global congestion prediction will significantly decrease. Misjudgments will directly lead the traffic control system to make incorrect phase decisions, causing green wave breaks, exacerbating network delays during peak hours, and significantly extending the average travel time on main roads.

[0004] Current federated learning Byzantine defense schemes mainly fall into two categories: one is an aggregation algorithm centered on distance calculation, which aggregates gradients by selecting the single or multiple gradients closest to the majority gradients; the other is an aggregation method based on statistical robust estimation, which aggregates gradients by sorting and pruning extreme values ​​dimensionally and then taking the mean or median. The former selects only a small number of gradients for aggregation, discarding the effective information of most normal nodes. In attack-free scenarios, the model accuracy suffers significantly, and it requires calculating pairwise distances between all nodes. The computational complexity increases quadratically with the number of clients, making it difficult to adapt to metropolitan-level traffic federated learning scenarios with a large number of intersection nodes. Furthermore, it lacks a pre-selection gradient mechanism, allowing abnormal gradients to directly participate in distance measurement and contaminate the judgment results. The latter uses a fixed-ratio pruning strategy, which cannot dynamically adjust the screening intensity according to the actual failure ratio of the current round. The screening accuracy will decrease when the failure ratio is too high or too low. Moreover, it only processes the gradient dimension by dimension based on the numerical size and does not evaluate the overall quality of the gradient. In scenarios where traffic data has obvious tidal characteristics, it is easy to mis-prune normal gradients or miss abnormal gradients. When multiple malicious nodes collude to upload similar abnormal gradients, such outliers are easy to fall into the retention range and thus bypass the defense.

[0005] Overall, existing defense solutions mostly focus on algorithm improvements for single aggregation stages, failing to form a closed-loop defense system covering gradient screening, robust aggregation, reputation management, and node election. Each defense stage is independent and lacks coordination; there is a lack of verifiable and manipulator-proof participant election mechanisms; communication and computational overhead is high in large-scale node scenarios; and there is no specific adaptation to the spatiotemporal characteristics of traffic flow data and business scenarios, making it difficult to cope with diverse and covert Byzantine attacks in intelligent transportation scenarios, and failing to meet the application requirements of traffic prediction models for high robustness and high reliability. Summary of the Invention

[0006] To address the problems of existing defenses against Byzantine attacks and gradual slow poisoning attacks in federated learning traffic flow prediction scenarios, which suffer from the lack of a complete closed-loop defense, fixed thresholds, and unverifiable committee elections, this invention provides: a Byzantine robust federated learning defense method for traffic flow prediction, comprising:

[0007] S1: System Initialization: The traffic management cloud platform server initializes the global traffic flow prediction model, assigns a unique identifier to each client deployed at the traffic intersection, and sets an initial credit score for each client, thus obtaining the global traffic flow prediction model, the set of identifiers for all clients, and the set of initial credit scores.

[0008] S2: Verifiable Random Committee Election: Based on the identity set and the initial reputation score set, the server elects committee member nodes participating in the gradient screening from all clients using a verifiable random function, thus obtaining the list of committee member nodes for this round;

[0009] S3: Local gradient calculation and upload: The server distributes the global traffic flow prediction model to all clients. Each client calculates its local gradient based on the traffic dataset stored locally and uploads it to the committee member nodes. The committee member nodes summarize all the gradients received to obtain the gradient set uploaded by all clients in this round.

[0010] S4: Adaptive gradient filtering: Based on the gradient set, the committee member nodes calculate the average cosine distance of each gradient to all other gradients as the outlier score of that gradient. Combined with the proportion of the number of gradients that passed the filtering in the previous training round to the total number of uploaded gradients, a dynamic filtering threshold is calculated. The committee member nodes vote on each gradient and output the gradient filtering results. The gradient filtering results include the candidate gradient set and the status information of each client gradient being adopted or rejected.

[0011] S5: Robust aggregation and model update: The server performs a robust aggregation algorithm on the candidate gradient set to obtain the global model update amount. Based on this update amount, the parameters of the global traffic flow prediction model are adjusted, and the updated global traffic flow prediction model is output.

[0012] S6: Dynamic Reputation Management: Based on the gradient screening results, the initial reputation score set is updated according to the following rules: positive rewards are given when the gradient is adopted and enters the candidate set, negative penalties are given when the gradient is rejected and does not enter the candidate set, and a decay factor is applied to the reputation scores of all clients after each round of screening. The updated reputation score set of each client is then output.

[0013] S7: Iterative training: Repeat S2 to S6. In each iteration, use the updated credit score set from the previous round as the input of S2 and the updated global traffic flow prediction model from the previous round as the input of S3, until the global traffic flow prediction model meets the convergence condition.

[0014] Furthermore, in S1, the global traffic flow prediction model is a spatiotemporal graph convolutional network or a graph attention network, and the model's prediction target is the average speed and congestion level of the road segment in the next 15 minutes.

[0015] Furthermore, in S2, the formula for electing committee members participating in the gradient selection round from all clients using a verifiable random function is as follows:

[0016]

[0017] in, For the verifiable random function value of the k-th client, As a unique identifier for the client, The random seed for the election broadcast by the server in round t. For cryptographically secure hash functions, This is a string concatenation operator.

[0018] Furthermore, in S3, the formula for calculating the local gradient based on the locally stored traffic dataset by each client is as follows:

[0019]

[0020] in, Let the local gradient of the k-th client in round t be... These are the parameters of the global traffic flow prediction model updated in the previous round. For the local traffic dataset of the kth client, For the loss function Find the gradient;

[0021] The local traffic dataset contains a single sample with a 15-dimensional feature vector. The 15-dimensional feature vector is composed of a 6-dimensional time period feature subset, a 5-dimensional spatial correlation feature subset, and a 4-dimensional traffic flow state feature subset. After the model is trained on the traffic dataset, the prediction target is the average speed of the road segment and the congestion level in the next 15 minutes. The congestion level is divided into four levels: smooth, slow, congested, and severe congestion.

[0022] Furthermore, in S4, the average cosine distance of each gradient to all other gradients is calculated as the outlier score of that gradient. Combined with the proportion of gradients that passed the screening in the previous training round to the total number of uploaded gradients, the dynamic screening threshold is calculated using the following three core calculation formulas:

[0023] Calculation of cosine distance between gradients:

[0024]

[0025] in, The cosine distance between gradients. For the gradient vector uploaded by the i-th client, The gradient vector uploaded by the j-th client. Let L2 norm be the gradient vector uploaded by the i-th client. Let L2 norm be the gradient vector uploaded by the j-th client. To prevent regularization terms with a denominator of 0;

[0026] Single-gradient mean cosine distance outlier score:

[0027]

[0028] in, For the outlier score of the i-th gradient mean cosine distance, This represents the total number of clients participating in this round of training.

[0029] Dynamic screening thresholds and adjustment coefficients:

[0030]

[0031]

[0032] in, To adapt to dynamic filtering thresholds, To perform the median calculation, This is a dynamic adjustment coefficient. As the benchmark adjustment coefficient, To adjust the step size, To achieve the preset target effective update ratio, This represents the proportion of gradients that passed the screening in the previous training round out of the total number of uploaded gradients.

[0033] Each member of the committee is satisfied Gradients that receive more than half of the votes from the committee are included in the candidate gradient set.

[0034] Furthermore, in S5, the formula for calculating the global model update amount is:

[0035]

[0036] In the formula, The global model parameters after the t-th update The global learning rate, This represents the global model update amount obtained from robust aggregation;

[0037] The robust aggregation algorithm is selected from at least one of the following: pruned mean aggregation, median aggregation, Krum aggregation, multi-Krum aggregation, Bulyan aggregation, and federated average aggregation; the server dynamically switches the robust aggregation algorithm selected based on the real-time failure rate and peak traffic hours.

[0038] Furthermore, in S6, the formula for updating the initial credit score set is as follows:

[0039] Gradient adopted:

[0040]

[0041] in, Assess the quality of local traffic data;

[0042] Gradient rejected:

[0043]

[0044] Additional benefits for serving as a committee member:

[0045]

[0046] The uniform decay rate for each round is:

[0047]

[0048] Reputation boundary constraints:

[0049]

[0050] in, The current reputation score of the client at the k-th traffic intersection. Score the data quality of the local traffic dataset for the k-th client. This is the reputation decay factor, with a default value of 0.9; This is for calculating the maximum value. This is an operation to find the minimum value;

[0051] Clients whose updated reputation scores are lower than the preset filtering threshold will be directly filtered in the next iteration and will not participate in the gradient upload and screening process.

[0052] Furthermore, in S7, the convergence condition of the global traffic flow prediction model is one of two: either the number of iterations reaches the preset maximum number of training rounds T, or the change in the model loss function between two consecutive iterations is less than the preset loss threshold 1e-4.

[0053] It also provides a Byzantine robust federated learning defense system for traffic flow prediction, including:

[0054] System initialization module: Used for the server of the traffic management cloud platform to initialize the global traffic flow prediction model, assign a unique identity to each client deployed at the traffic intersection, and set an initial reputation score for each client, thus obtaining the global traffic flow prediction model, the set of identity identifiers of all clients, and the set of initial reputation scores;

[0055] Verifiable Random Committee Election Module: The server uses a verifiable random function to elect committee member nodes participating in the gradient screening round from all clients based on the identity set and the initial reputation score set, thus obtaining the list of committee member nodes for this round.

[0056] Local gradient calculation and upload module: The server distributes the global traffic flow prediction model to all clients. Each client calculates its local gradient based on the traffic dataset stored locally and uploads it to the committee member nodes. The committee member nodes summarize all the gradients received to obtain the gradient set uploaded by all clients in this round.

[0057] Adaptive gradient filtering module: This module is used by committee member nodes to calculate the average cosine distance of each gradient to all other gradients based on the gradient set, as the outlier score of that gradient. It also calculates a dynamic filtering threshold by combining the proportion of the number of gradients that passed the filtering in the previous training round to the total number of uploaded gradients. Committee member nodes vote on each gradient and output the gradient filtering results. The gradient filtering results include the candidate gradient set and the status information of each client gradient being adopted or rejected.

[0058] Robust aggregation and model update module: The server performs a robust aggregation algorithm on the candidate gradient set to obtain the global model update amount, adjusts the parameters of the global traffic flow prediction model based on the update amount, and outputs the updated global traffic flow prediction model.

[0059] Dynamic Reputation Management Module: Based on the gradient screening results, it updates the initial reputation score set according to the rules of giving positive rewards when the gradient is adopted and enters the candidate set, giving negative penalties when the gradient is rejected and does not enter the candidate set, and applying a decay factor to the reputation scores of all clients after each round of screening, and outputs the updated reputation score set of each client.

[0060] Iterative training module: used to repeatedly execute the verifiable random committee election module to the dynamic reputation management module. In each iteration, the updated reputation score set output from the previous round is used as the input of the verifiable random committee election module in this round, and the updated global traffic flow prediction model output from the previous round is used as the input of the local gradient calculation and uploading module in this round, until the global traffic flow prediction model meets the convergence condition.

[0061] The beneficial effects of this invention are:

[0062] 1. A three-tiered closed-loop defense architecture consisting of a client layer, a committee layer, and a server layer was constructed, organically combining multiple links such as gradient filtering, robust aggregation, reputation management, and committee election to form a complete defense chain, thereby improving the systematicness and synergy of Byzantine fault defense in federated learning scenarios.

[0063] 2. It adopts a gradient outlier scoring mechanism based on average cosine distance, combined with an adaptive threshold adjustment method driven by historical effective update rate. The filtering intensity can be dynamically adjusted according to the actual attack situation, which improves the adaptability and rationality of gradient filtering and has a good defense effect against gradient scaling attacks.

[0064] 3. The election of committee nodes is achieved through a verifiable random function. The election results are unpredictable and publicly verifiable. This not only filters out nodes that participate in gradient screening to reduce system overhead, but also ensures the fairness and transparency of the election process and reduces the risk of malicious manipulation of the election process.

[0065] 4. A dynamic reputation management system integrating reward, punishment, and decay mechanisms has been established. By continuously recording the historical behavior of nodes, it can effectively identify gradual slow poisoning attacks and filter low-reputation nodes, reducing the continuous impact of malicious nodes on global model training and improving the long-term stability of the training process.

[0066] 5. It integrates multiple robust aggregation algorithms and supports dynamic switching of aggregation strategies based on scenarios such as failure ratio and business time period. It can adapt to different levels of Byzantine fault scenarios, improving the applicability and scenario flexibility of the solution.

[0067] 6. Adapted to intelligent traffic flow prediction scenarios, and in line with the spatiotemporal characteristics of traffic flow data, it can maintain the effective performance of traffic prediction models in environments with Byzantine faults, ensuring the reliability of traffic flow prediction and congestion level assessment results, and providing stable support for traffic management operations. Attached Figure Description

[0068] Figure 1 This is a flowchart of the present invention;

[0069] Figure 2 A flowchart of the VRF committee election process;

[0070] Figure 3 Flowchart of the adaptive gradient screening process;

[0071] Figure 4 This is a flowchart of the dynamic credit management process. Detailed Implementation

[0072] The technical solution of the present invention will be further described below with reference to embodiments, but it is not limited thereto. Any modifications or equivalent substitutions to the technical solution of the present invention without departing from the spirit and scope of the technical solution of the present invention should be covered within the protection scope of the present invention. In the following embodiments, process equipment or devices not specifically specified are all conventional equipment or devices in the art. Unless specifically specified, the technical means used in the embodiments of the present invention are all conventional means well known to those skilled in the art.

[0073] Example 1, combined with Figure 1 This embodiment illustrates a Byzantine robust federated learning defense method for traffic flow prediction, comprising:

[0074] S1: System Initialization: The traffic management cloud platform server initializes the global traffic flow prediction model, assigns a unique identifier to each client deployed at the traffic intersection, and sets an initial credit score for each client, thus obtaining the global traffic flow prediction model, the set of identifiers for all clients, and the set of initial credit scores.

[0075] S2: Verifiable Random Committee Election: Based on the identity set and the initial reputation score set, the server elects committee member nodes participating in the gradient screening from all clients using a verifiable random function, thus obtaining the list of committee member nodes for this round;

[0076] S3: Local gradient calculation and upload: The server distributes the global traffic flow prediction model to all clients. Each client calculates its local gradient based on the traffic dataset stored locally and uploads it to the committee member nodes. The committee member nodes summarize all the gradients received to obtain the gradient set uploaded by all clients in this round.

[0077] S4: Adaptive gradient filtering: Based on the gradient set, the committee member nodes calculate the average cosine distance of each gradient to all other gradients as the outlier score of that gradient. Combined with the proportion of the number of gradients that passed the filtering in the previous training round to the total number of uploaded gradients, a dynamic filtering threshold is calculated. The committee member nodes vote on each gradient and output the gradient filtering results. The gradient filtering results include the candidate gradient set and the status information of each client gradient being adopted or rejected.

[0078] S5: Robust aggregation and model update: The server performs a robust aggregation algorithm on the candidate gradient set to obtain the global model update amount. Based on this update amount, the parameters of the global traffic flow prediction model are adjusted, and the updated global traffic flow prediction model is output.

[0079] S6: Dynamic Reputation Management: Based on the gradient screening results, the initial reputation score set is updated according to the following rules: positive rewards are given when the gradient is adopted and enters the candidate set, negative penalties are given when the gradient is rejected and does not enter the candidate set, and a decay factor is applied to the reputation scores of all clients after each round of screening. The updated reputation score set of each client is then output.

[0080] S7: Iterative training: Repeat S2 to S6. In each iteration, use the updated credit score set from the previous round as the input of S2 and the updated global traffic flow prediction model from the previous round as the input of S3, until the global traffic flow prediction model meets the convergence condition.

[0081] Furthermore, in S1, the global traffic flow prediction model is a spatiotemporal graph convolutional network or a graph attention network, and the model's prediction target is the average speed and congestion level of the road segment in the next 15 minutes.

[0082] Specifically, this step is the system startup phase, which completes the initialization of the global traffic flow prediction model, intersection node registration, and parameter configuration.

[0083] S1.1: Global model initialization. The server initializes global model parameters. This model is a neural network model suitable for short-term traffic flow speed prediction. Preferably, it uses a graph attention network or a spatiotemporal graph convolutional network to capture the spatial dependencies in the road network topology.

[0084] S1.2: Client Registration. Each traffic monitoring node participating in federated learning registers with the server. Each node corresponds to an intersection or key road segment and is equipped with at least one traffic flow detection device, such as a geomagnetic coil, microwave radar, or checkpoint camera. Each client obtains a unique identifier id_k, where k = 1, 2, ..., N, and N is the total number of clients.

[0085] S1.3: Reputation Score Initialization. Initialize a reputation score r_k∈[0,1] for each client k. The initial reputation score for nodes at normal intersections is set to 0.7, and the initial reputation score for nodes with known safety hazards or historical failure rates higher than a preset threshold is set to 0.3.

[0086] S1.4: System Parameter Configuration. Configure the following system parameters: Committee size K, default K=8, approximately 10% to 40% of the total number of clients; Reputation decay factor γ, default γ=0.9; Reputation filtering threshold r_low, default 0.2; Default aggregation algorithm, default Trimmed Mean, pruning ratio α=0.25; Cosine distance regularization term. ; benchmark adjustment coefficient The default value is 1.0; the target effective update rate p_target is 0.75; the adjustment step size α is 0.5.

[0087] Furthermore, in S2, the formula for electing committee members participating in the gradient selection round from all clients using a verifiable random function is as follows:

[0088]

[0089] in, For the verifiable random function value of the k-th client, As a unique identifier for the client, The random seed for the election broadcast by the server in round t. For cryptographically secure hash functions, This is a string concatenation operator.

[0090] Specifically, in combination Figure 2 As can be seen, the input to this step is the current training round t and all client IDs and reputation scores, and the output is the set of committee members participating in gradient selection in this round. .

[0091] The specific implementation steps are as follows:

[0092] S2.1: Seed Generation and Broadcasting. The server generates a random seed for this round of election. And broadcast to all clients via a trusted channel.

[0093] S2.2: VRF value calculation. Each client k generates a corresponding proof of correctness based on its unique identifier id_k and the current seed. .

[0094] S2.3: VRF value and proof upload. Each client will upload the triple. Uploaded to the server.

[0095] S2.4: VRF Verification and Election. The server verifies the validity of each client's VRF proof, confirming that vrf_k is indeed calculated from id_k; among all clients that pass verification, the K clients with the highest VRF values ​​are selected to form a committee. .

[0096] S2.5: Public Disclosure of Election Results. The server will publicly disclose the committee's election results and all VRF proofs, allowing any third party to verify the fairness and correctness of the election.

[0097] Furthermore, in S3, the formula for calculating the local gradient based on the locally stored traffic dataset by each client is as follows:

[0098]

[0099] in, For the local gradient of the k-th client in round t, These are the parameters of the global traffic flow prediction model updated in the previous round. For the local traffic dataset of the kth client, For the loss function Find the gradient;

[0100] The local traffic dataset contains a single sample with a 15-dimensional feature vector. The 15-dimensional feature vector is composed of a 6-dimensional time period feature subset, a 5-dimensional spatial correlation feature subset, and a 4-dimensional traffic flow state feature subset. After the model is trained on the traffic dataset, the prediction target is the average speed of the road segment and the congestion level in the next 15 minutes. The congestion level is divided into four levels: smooth, slow, congested, and severe congestion.

[0101] Specifically, the input for this step is the global traffic flow prediction model issued by the server. The output is the local gradient for each client. .

[0102] The specific implementation steps are as follows:

[0103] S3.1: Model Distribution. The server distributes the current global traffic flow prediction model. Distribute to all clients.

[0104] S3.2: Local Traffic Feature Reading. Each client reads the local traffic dataset. The local traffic dataset Each sample contains a 15-dimensional feature vector, which is composed of a subset of time-period features, a subset of spatial correlation features, and a subset of traffic flow state features.

[0105] The time period feature subset includes the following 6-dimensional features:

[0106] The current time period code uses a one-hot encoding method to classify the morning peak period, off-peak period, evening peak period, and nighttime period into four categories; a binary identifier for holidays or weekends; the traffic flow change rate with the current time as the endpoint and the previous 5 minutes as the time window; the time average speed with the current time as the endpoint and the previous 15 minutes as the time window; the speed mean and speed variance of the current time within the historical time window, where the historical time window is the interval of 30 minutes before and after the same time in the previous 7 days; and the remaining phase time in the current intersection signal cycle, where the remaining phase time is normalized to the [0,1] interval by the maximum cycle length.

[0107] The spatial correlation feature subset includes the following 5-dimensional features:

[0108] The vehicle arrival rate at this intersection at the current moment, in vehicles / minute; the vehicle departure rate at this intersection at the current moment, in vehicles / minute; the average vehicle arrival rate of the checkpoint 200 meters upstream of this intersection over the most recent three consecutive time slices, each time slice being 5 minutes; the average vehicle departure rate of the checkpoint 200 meters downstream of this intersection over the most recent three consecutive time slices; and the speed correlation coefficients between this intersection and the upstream intersection, and between this intersection and the downstream intersection, wherein the speed correlation coefficients are used to characterize the direction of traffic flow propagation and the strength of upstream and downstream correlation.

[0109] The traffic flow state feature subset includes the following four-dimensional features:

[0110] Lane time occupancy rate detected by geomagnetic coils or microwave radar, in percentage; the ratio of time-averaged vehicle speed to spatial-averaged vehicle speed, which is used to determine whether the traffic flow is in a steady state and whether an abnormal event has occurred; the estimated queue length calculated based on the input-output method, in meters; and the speed standard deviation with the current time as the endpoint and the past 5 minutes as the time window, which is used to characterize the degree of traffic flow fluctuation.

[0111] The prediction targets are the average speed and congestion level of the road segment in the next 15 minutes, and the congestion level is divided into four levels: smooth, slow, congested, and severe congestion.

[0112] S3.3: Local gradient calculation. Each client uses the mini-batch stochastic gradient descent algorithm to calculate gradients on the local traffic dataset. The default batch size is 200, and the default learning rate is 0.05.

[0113] S3.4: Gradient Upload. Each client uploads the calculated gradients. Upload to the committee instead of directly to the server. If a client is a malicious node controlled by an attacker, the gradient is modified according to a preset Byzantine fault mode in this step before uploading. The Byzantine fault mode includes, but is not limited to, any one or more of the following: random noise injection, gradient reversal, gradient amplification, sign flipping, targeted poisoning based on traffic features, collusion attack, and slow poisoning attack.

[0114] Furthermore, in S4, the average cosine distance of each gradient to all other gradients is calculated as the outlier score of that gradient. Combined with the proportion of gradients that passed the screening in the previous training round to the total number of uploaded gradients, the dynamic screening threshold is calculated using the following three core calculation formulas:

[0115] Calculation of cosine distance between gradients:

[0116]

[0117] in, The cosine distance between gradients. For the gradient vector uploaded by the i-th client, The gradient vector uploaded by the j-th client. Let L2 norm be the gradient vector uploaded by the i-th client. Let L2 norm be the gradient vector uploaded by the j-th client. To prevent regularization terms with a denominator of 0;

[0118] Single-gradient mean cosine distance outlier score:

[0119]

[0120] in, For the outlier score of the i-th gradient mean cosine distance, This represents the total number of clients participating in this round of training.

[0121] Dynamic screening thresholds and adjustment coefficients:

[0122]

[0123]

[0124] in, To adapt to dynamic filtering thresholds, To perform the median calculation, This is a dynamic adjustment coefficient. As the benchmark adjustment coefficient, To adjust the step size, To achieve the preset target effective update ratio, This represents the proportion of gradients that passed the screening in the previous training round out of the total number of uploaded gradients.

[0125] Each member of the committee is satisfied Gradients that receive more than half of the votes from the committee are included in the candidate gradient set.

[0126] Specifically, in combination Figure 3 As can be seen, the input for this step is the gradient uploaded by all clients. The output is a set of candidate gradients that have passed the selection process. .

[0127] The specific implementation steps are as follows: S4.1: Calculation of cosine distance matrix.

[0128] S4.2: Calculation of average outlier distance.

[0129] S4.3: Adaptive threshold calculation. When the effective proportion is lower than the preset lower limit, λ increases to relax the screening conditions; when the effective proportion is higher than the preset upper limit, λ decreases to tighten the screening conditions.

[0130] S4.4: Committee Voting. Each committee member votes on each gradient g_i: if If yes, then vote in favor; otherwise, vote against.

[0131] S4.5: Candidate gradient output. Count the number of votes for each gradient; gradients that receive more than half of the votes are added to the candidate set. The majority refers to votes in favor that are greater than K / 2, and the remaining gradients are filtered out.

[0132] Furthermore, in S5, the formula for calculating the global model update amount is:

[0133]

[0134] In the formula, The global model parameters after the t-th update The global learning rate, This represents the global model update amount obtained from robust aggregation;

[0135] The robust aggregation algorithm is selected from at least one of the following: pruned mean aggregation, median aggregation, Krum aggregation, multi-Krum aggregation, Bulyan aggregation, and federated average aggregation; the server dynamically switches the robust aggregation algorithm selected based on the real-time failure rate and peak traffic hours.

[0136] Specifically, the input to this step is the set of candidate gradients output from step 4. The output is the aggregated global model update. .

[0137] This invention integrates six aggregation algorithms and supports dynamic switching based on traffic fault scenarios, with the TrimmedMean algorithm being used by default.

[0138] Method 1: Trimmed Mean aggregation, which is the default method. For each dimension j of the model parameters, collect the values ​​of all clients in that dimension from the candidate gradient set. ,in Sort the values ​​for this dimension in ascending order; remove the extreme values ​​of the largest and smallest α proportions after sorting, α=0.25; average the remaining values ​​and calculate the aggregate result for this dimension according to the following formula. :

[0139] Method 2: Median aggregation. After sorting the values ​​for each dimension, the median is directly used as the aggregation result.

[0140] Method 3: Krum aggregation. Select the single gradient that has the smallest sum of distances to all other gradients as the aggregation result.

[0141] Method 4: Multi-Krum aggregation. Select the gradients with the smallest sum of distances and take the average as the aggregation result.

[0142] Method 5: Bulyan aggregation. Cascade Krum and Trimmed Mean. First, use Krum to filter out a subset of candidate gradients, and then perform Trimmed Mean aggregation on the subset.

[0143] Method 6: FedAvg aggregation. The average of all gradients is taken directly as the defenseless baseline.

[0144] The aggregation algorithm selection strategy is as follows: FedAvg is used when there are no faults or a low fault rate (fault rate below 10%); Trimmed Mean or Median is used when the fault rate is between 10% and 30%; Krum or Multi-Krum is used when the fault rate is between 30% and 50%; and Bulyan is used when ultra-high robustness requirements are needed and the fault rate is below 25%. During peak traffic periods, namely 7:00-9:00 and 17:00-19:00, the system automatically switches to Multi-Krum or Bulyan mode.

[0145] Furthermore, in S6, the formula for updating the initial credit score set is as follows:

[0146] Gradient adopted:

[0147]

[0148] in, Assess the quality of local traffic data;

[0149] Gradient rejected:

[0150]

[0151] Additional benefits for serving as a committee member:

[0152]

[0153] The uniform decay rate for each round is:

[0154]

[0155] Reputation boundary constraints:

[0156]

[0157] in, The current reputation score of the client at the k-th traffic intersection. Score the data quality of the local traffic dataset for the k-th client. This is the reputation decay factor, with a default value of 0.9; This is for calculating the maximum value. This is for calculating the minimum value;

[0158] Clients whose updated reputation scores are lower than the preset filtering threshold will be directly filtered in the next iteration and will not participate in the gradient upload and screening process.

[0159] Specifically, in combination Figure 4As can be seen, this step outputs the updated reputation score for each client based on whether the gradient of each client is adopted.

[0160] The specific implementation steps are as follows:

[0161] S6.1: Basic Rewards and Penalties. After each training round, the reputation is updated based on whether the client's gradient is adopted: if the gradient is adopted, it enters the candidate set; if the gradient is rejected, it is filtered out.

[0162] S6.2: Data Quality Bonus. An additional data quality bonus is awarded to clients whose gradients are adopted.

[0163] S6.3: Committee Member Reward. Client k receives an additional reward if it serves as a committee member in this round; S6.4: Reputation Decay. At the end of each round, all reputation scores are updated using a decay factor γ, where γ∈(0,1), with a default γ=0.9;

[0164] S6.5: Reputation Boundary Constraints. Ensure that the reputation score remains within a valid range;

[0165] S6.6: Low Reputation Filtering. Clients with reputation scores below a threshold are directly filtered out during subsequent training and do not enter the gradient selection process. The default threshold is 0.2.

[0166] Furthermore, in S7, the convergence condition of the global traffic flow prediction model is one of two: either the number of iterations reaches the preset maximum number of training rounds T, or the change in the model loss function between two consecutive iterations is less than the preset loss threshold 1e-4.

[0167] It also provides a Byzantine robust federated learning defense system for traffic flow prediction, including:

[0168] System initialization module: Used for the server of the traffic management cloud platform to initialize the global traffic flow prediction model, assign a unique identity to each client deployed at the traffic intersection, and set an initial reputation score for each client, thus obtaining the global traffic flow prediction model, the set of identity identifiers of all clients, and the set of initial reputation scores;

[0169] Verifiable Random Committee Election Module: The server uses a verifiable random function to elect committee member nodes participating in the gradient screening round from all clients based on the identity set and the initial reputation score set, thus obtaining the list of committee member nodes for this round.

[0170] Local gradient calculation and upload module: The server distributes the global traffic flow prediction model to all clients. Each client calculates its local gradient based on the traffic dataset stored locally and uploads it to the committee member nodes. The committee member nodes summarize all the gradients received to obtain the gradient set uploaded by all clients in this round.

[0171] Adaptive gradient filtering module: This module is used by committee member nodes to calculate the average cosine distance of each gradient to all other gradients based on the gradient set, as the outlier score of that gradient. It also calculates a dynamic filtering threshold by combining the proportion of the number of gradients that passed the filtering in the previous training round to the total number of uploaded gradients. Committee member nodes vote on each gradient and output the gradient filtering results. The gradient filtering results include the candidate gradient set and the status information of each client gradient being adopted or rejected.

[0172] Robust aggregation and model update module: The server performs a robust aggregation algorithm on the candidate gradient set to obtain the global model update amount, adjusts the parameters of the global traffic flow prediction model based on the update amount, and outputs the updated global traffic flow prediction model.

[0173] Dynamic Reputation Management Module: Based on the gradient screening results, it updates the initial reputation score set according to the rules of giving positive rewards when the gradient is adopted and enters the candidate set, giving negative penalties when the gradient is rejected and does not enter the candidate set, and applying a decay factor to the reputation scores of all clients after each round of screening, and outputs the updated reputation score set of each client.

[0174] Iterative training module: used to repeatedly execute the verifiable random committee election module to the dynamic reputation management module. In each iteration, the updated reputation score set output from the previous round is used as the input of the verifiable random committee election module in this round, and the updated global traffic flow prediction model output from the previous round is used as the input of the local gradient calculation and uploading module in this round, until the global traffic flow prediction model meets the convergence condition.

[0175] Example 2: This example is based on real traffic flow data from 20 key intersections in the core area of ​​a city for verification. The specific parameter settings are as follows:

[0176] Step S1: System Initialization. The Traffic Brain Cloud Platform server initializes the ST-GCN traffic flow prediction model. 20 intersection nodes complete registration and reputation initialization, of which 16 normal nodes are initialized with a reputation of 0.7 and 4 malicious nodes are initialized with a reputation of 0.3, simulating a 30% attack ratio.

[0177] Step S2: The server elects a committee through VRF, K=8, to select the high-reputation intersection nodes that will participate in the gradient screening in this round.

[0178] Step S3: Each intersection node calculates and uploads the gradient based on local 5-minute granularity traffic flow data. The traffic flow data includes 15-dimensional features such as flow rate, speed, and occupancy. Four malicious nodes tamper with the gradient according to preset fault modes, including gradient inversion and random noise injection.

[0179] Step S4: The committee performs adaptive gradient screening based on cosine distance and calculates the average outlier distance for each gradient. The adaptive threshold τ is calculated based on the effective update ratio from the previous round, and a candidate gradient set is selected through voting. Taking a malicious node as an example, its... The value far exceeded the threshold τ=0.32, and was unanimously rejected by the committee, thus successfully filtering out the data.

[0180] Step S5: The server performs Trimmed Mean aggregation on the candidate gradients, with a pruning ratio of 0.25, and updates the global traffic flow prediction model.

[0181] Step S6: The server updates the reputation score based on whether the gradient of each intersection node is adopted. All four malicious nodes are rejected, each with a deduction of 0.10 and multiplied by a decay factor of 0.9. The reputation drops from 0.3 to 0.18, triggering low reputation filtering with a threshold of 0.2. These four nodes are excluded in subsequent rounds.

[0182] Step S7: Repeat steps S2 to S6 for a total of 100 rounds, and record the prediction accuracy, MAE loss value and effective update rate for each round.

[0183] Experimental results: Under the condition of 30% malicious intersection nodes, the accuracy of the present invention in predicting traffic congestion level reached 86.7%, which is 25.4 percentage points higher than the 61.3% of the undefended FedAvg; the average speed prediction MAE was controlled within ±3.2km / h; the slow poisoning attack was successfully identified and isolated by the reputation system in the 8th round.

Claims

1. A Byzantine robust federated learning defense method for traffic flow prediction, characterized in that, include: S1: System Initialization: The traffic management cloud platform server initializes the global traffic flow prediction model, assigns a unique identifier to each client deployed at the traffic intersection, and sets an initial credit score for each client, thus obtaining the global traffic flow prediction model, the set of identifiers for all clients, and the set of initial credit scores. S2: Verifiable Random Committee Election: Based on the identity set and the initial reputation score set, the server elects committee member nodes participating in the gradient screening from all clients using a verifiable random function, thus obtaining the list of committee member nodes for this round; S3: Local gradient calculation and upload: The server distributes the global traffic flow prediction model to all clients. Each client calculates its local gradient based on the traffic dataset stored locally and uploads it to the committee member nodes. The committee member nodes summarize all the gradients received to obtain the gradient set uploaded by all clients in this round. S4: Adaptive gradient filtering: Based on the gradient set, the committee member nodes calculate the average cosine distance of each gradient to all other gradients as the outlier score of that gradient. Combined with the proportion of the number of gradients that passed the filtering in the previous training round to the total number of uploaded gradients, a dynamic filtering threshold is calculated. The committee member nodes vote on each gradient and output the gradient filtering results. The gradient filtering results include the candidate gradient set and the status information of each client gradient being adopted or rejected. S5: Robust aggregation and model update: The server performs a robust aggregation algorithm on the candidate gradient set to obtain the global model update amount. Based on this update amount, the parameters of the global traffic flow prediction model are adjusted, and the updated global traffic flow prediction model is output. S6: Dynamic Reputation Management: Based on the gradient screening results, the initial reputation score set is updated according to the following rules: positive rewards are given when the gradient is adopted and enters the candidate set, negative penalties are given when the gradient is rejected and does not enter the candidate set, and a decay factor is applied to the reputation scores of all clients after each round of screening. The updated reputation score set of each client is then output. S7: Iterative training: Repeat S2 to S6. In each iteration, use the updated credit score set from the previous round as the input of S2 and the updated global traffic flow prediction model from the previous round as the input of S3, until the global traffic flow prediction model meets the convergence condition.

2. The Byzantine robust federated learning defense method for traffic flow prediction according to claim 1, characterized in that, In S1, the global traffic flow prediction model is a spatiotemporal graph convolutional network or a graph attention network. The model's prediction objective is the average speed and congestion level of the road segment in the next 15 minutes.

3. The Byzantine robust federated learning defense method for traffic flow prediction according to claim 1, characterized in that, In S2, the formula for electing committee members participating in the gradient selection round from all clients using a verifiable random function is as follows: ； in, For the verifiable random function value of the k-th client, As a unique identifier for the client, The random seed for the election broadcast by the server in round t. For cryptographically secure hash functions, This is a string concatenation operator.

4. The Byzantine robust federated learning defense method for traffic flow prediction according to claim 1, characterized in that, In S3, the formula for calculating the local gradient based on the locally stored traffic dataset by each client is as follows: ； in, For the local gradient of the k-th client in round t, These are the parameters of the global traffic flow prediction model updated in the previous round. For the local traffic dataset of the kth client, For the loss function Find the gradient; The local traffic dataset contains a single sample with a 15-dimensional feature vector. The 15-dimensional feature vector is composed of a 6-dimensional time period feature subset, a 5-dimensional spatial correlation feature subset, and a 4-dimensional traffic flow state feature subset. After the model is trained on the traffic dataset, the prediction target is the average speed of the road segment and the congestion level in the next 15 minutes. The congestion level is divided into four levels: smooth, slow, congested, and severe congestion.

5. The Byzantine robust federated learning defense method for traffic flow prediction according to claim 1, characterized in that, In S4, the average cosine distance of each gradient to all other gradients is calculated as the outlier score of that gradient. The dynamic filtering threshold is calculated by combining the proportion of gradients that passed the screening in the previous training round to the total number of uploaded gradients, using the following three sets of core calculation formulas: Calculation of cosine distance between gradients: ； in, The cosine distance between gradients. For the gradient vector uploaded by the i-th client, The gradient vector uploaded by the j-th client. Let L2 norm be the gradient vector uploaded by the i-th client. Let L2 norm be the gradient vector uploaded by the j-th client. To prevent regularization terms with a denominator of 0; Single-gradient mean cosine distance outlier score: ； in, For the outlier score of the i-th gradient mean cosine distance, This represents the total number of clients participating in this round of training. Dynamic screening thresholds and adjustment coefficients: ； ； in, To adapt to dynamic filtering thresholds, To perform the median calculation, This is a dynamic adjustment coefficient. As the benchmark adjustment coefficient, To adjust the step size, To achieve the preset target effective update ratio, This represents the proportion of gradients that passed the screening in the previous training round out of the total number of uploaded gradients. Each member of the committee is satisfied ≤ Gradients that receive more than half of the votes from the committee are included in the candidate gradient set.

6. The Byzantine robust federated learning defense method for traffic flow prediction according to claim 1, characterized in that, In S5, the formula for calculating the global model update amount is: ； In the formula, The global model parameters after the t-th update The global learning rate, This represents the global model update amount obtained from robust aggregation; The robust aggregation algorithm is selected from at least one of the following: pruned mean aggregation, median aggregation, Krum aggregation, multi-Krum aggregation, Bulyan aggregation, and federated average aggregation; the server dynamically switches the robust aggregation algorithm selected based on the real-time failure rate and peak traffic hours.

7. The Byzantine robust federated learning defense method for traffic flow prediction according to claim 1, characterized in that, In S6, the formula for updating the initial credit score set is as follows: Gradient adopted: ； in, Assess the quality of local traffic data; Gradient rejected: ； Additional benefits for serving as a committee member: ； The uniform decay rate for each round is: ； Reputation boundary constraints: ； in, The current reputation score of the client at the k-th traffic intersection. Score the data quality of the local traffic dataset for the k-th client. This is the reputation decay factor, with a default value of 0.9; This is for calculating the maximum value. This is an operation to find the minimum value; Clients whose updated reputation scores are lower than the preset filtering threshold will be directly filtered in the next iteration and will not participate in the gradient upload and screening process.

8. The Byzantine robust federated learning defense method for traffic flow prediction according to claim 1, characterized in that, In S7, the convergence condition of the global traffic flow prediction model is one of two: either the number of iterations reaches the preset maximum number of training rounds T, or the change in the model loss function between two consecutive iterations is less than the preset loss threshold 1e-4.

9. A Byzantine robust federated learning defense system for traffic flow prediction, characterized in that, include: System initialization module: Used for the server of the traffic management cloud platform to initialize the global traffic flow prediction model, assign a unique identity to each client deployed at the traffic intersection, and set an initial reputation score for each client, thus obtaining the global traffic flow prediction model, the set of identity identifiers of all clients, and the set of initial reputation scores; Verifiable Random Committee Election Module: The server uses a verifiable random function to elect committee member nodes participating in the gradient screening round from all clients based on the identity set and the initial reputation score set, thus obtaining the list of committee member nodes for this round. Local gradient calculation and upload module: The server distributes the global traffic flow prediction model to all clients. Each client calculates its local gradient based on the traffic dataset stored locally and uploads it to the committee member nodes. The committee member nodes summarize all the gradients received to obtain the gradient set uploaded by all clients in this round. Adaptive gradient filtering module: This module is used by committee member nodes to calculate the average cosine distance of each gradient to all other gradients based on the gradient set, as the outlier score of that gradient. It also calculates a dynamic filtering threshold by combining the proportion of the number of gradients that passed the filtering in the previous training round to the total number of uploaded gradients. Committee member nodes vote on each gradient and output the gradient filtering results. The gradient filtering results include the candidate gradient set and the status information of each client gradient being adopted or rejected. Robust aggregation and model update module: The server performs a robust aggregation algorithm on the candidate gradient set to obtain the global model update amount, adjusts the parameters of the global traffic flow prediction model based on the update amount, and outputs the updated global traffic flow prediction model. Dynamic Reputation Management Module: Based on the gradient screening results, it updates the initial reputation score set according to the rules of giving positive rewards when the gradient is adopted and enters the candidate set, giving negative penalties when the gradient is rejected and does not enter the candidate set, and applying a decay factor to the reputation scores of all clients after each round of screening, and outputs the updated reputation score set of each client. Iterative training module: used to repeatedly execute the verifiable random committee election module to the dynamic reputation management module. In each iteration, the updated reputation score set output from the previous round is used as the input of the verifiable random committee election module in this round, and the updated global traffic flow prediction model output from the previous round is used as the input of the local gradient calculation and uploading module in this round, until the global traffic flow prediction model meets the convergence condition.

Images