Privacy protection network traffic collaborative detection method based on chaotic mapping and federated learning

Abstract

This invention provides a privacy-preserving collaborative network traffic detection method based on chaotic mapping and federated learning, relating to the field of network and information security technology. The method includes: system initialization and key distribution; deployment of a cascaded chaotic mapping system; fractal alignment of heterogeneous features; gradient complex domain rotation mask perturbation; precise gradient denoising and restoration; fractal consistency malicious detection; and weighted secure aggregation and model updating. This invention achieves theoretically fully reversible gradient protection, highly sensitive malicious behavior detection, and alignment of non-independent, identically distributed data to a unified latent space. This allows for near-centralized training detection performance while ensuring that the original data of each participant remains on their local device, and effectively defends against model poisoning attacks.

Description

Technical Field

[0001] This invention relates to the field of network and information security technology, and in particular to a privacy-preserving collaborative detection method for network traffic based on chaotic mapping and federated learning. Background Technology

[0002] Network traffic inspection, especially the malicious identification of encrypted traffic, is a key technical means to maintain network security. To improve the generalization ability and detection accuracy of inspection models, the federated learning paradigm has been introduced into this field, allowing multiple data holders to collaboratively train a shared traffic inspection model without exchanging raw data. Under this paradigm, the core challenge becomes how to simultaneously ensure the privacy of training data, the availability of the global model, and robustness against potential malicious actors during the interaction of intermediate parameters such as local model gradients.

[0003] Existing privacy protection technologies can be mainly divided into three categories: differential privacy protection mechanisms, homomorphic encryption and secure multi-party computation protection mechanisms, and chaotic encryption protection mechanisms.

[0004] For defense against model poisoning attacks, existing measures mostly rely on norm pruning or statistical filtering of gradients, which are simplistic and easily bypassed by well-designed evasion attacks. Regarding the processing of non-independent and identically distributed data, different participants come from different network environments, and the characteristic distribution of their traffic data varies significantly. Directly using a unified global model makes it difficult to achieve balanced detection performance across all participants. Existing federated domain adaptation methods often employ server-generated and distributed random projection matrices, consuming additional communication resources. Summary of the Invention

[0005] This invention provides a privacy-preserving collaborative detection method for network traffic based on chaotic mapping and federated learning. On the basis of an improved cascaded chaotic mapping system, it couples three mechanisms into an organic whole: complex domain rotation mask, fractal consistency verification based on Hearst exponent, and chaotic fractal interpolation alignment. This achieves gradient privacy protection with zero precision loss, high-sensitivity detection of malicious actors' behavior, and latent space feature alignment of non-independent and identically distributed data.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: A privacy-preserving collaborative network traffic detection method based on chaotic mapping and federated learning includes: The aggregation server generates an initial root key vector and distributes it to each participant through a secure channel. The initial root key vector includes a first initial state value parameter, a second initial state value parameter, a third initial state value parameter, a first coupling control parameter, and a second coupling control parameter. Each participant and the aggregation server respectively start the cascaded chaotic mapping system based on the initial root key vector. The master mapping and slave mapping of the cascaded chaotic mapping system achieve bidirectional driving through nonlinear coupling. Before entering the federated learning training, each participant uses the cascaded chaotic mapping system to process the third initial state value parameter and the hash value of their respective participant identifier as the initial state of the main mapping, generate a chaotic sequence and construct a fractal interpolation function, and use the fractal interpolation function to map the original feature vector into a high-dimensional feature vector. During training, each participant uses high-dimensional feature vectors to train a local model to obtain a gradient matrix. The cascaded chaotic mapping system is started with the first initial state value parameter, the second initial state value parameter, the first coupling control parameter, and the second coupling control parameter to generate a chaotic sequence. The amplitude perturbation factor and the angle perturbation factor are extracted. Complex domain rotation mask is performed on each element of the gradient matrix to obtain the perturbed gradient matrix, which is then sent to the aggregation server. The aggregation server synchronously generates amplitude perturbation factor and angle perturbation factor with the same parameters, and performs inverse operation on the perturbated gradient matrix to obtain the restored gradient matrix; The aggregation server uses its own generated and secretly held initial root key vector, which is dedicated to security detection, to start the cascaded chaotic mapping system to generate a pilot sequence for detection. It calculates the amplitude sequence of the gradient matrix after perturbation of each participant and the Hearst exponent of the pilot sequence for detection. The absolute value of the difference between the two is used as the fractal consistency deviation. If the fractal consistency deviation exceeds a preset threshold, it is judged as a malicious participant and excluded. If it does not exceed the threshold, it is judged as a normal participant. The aggregation server weights and aggregates the restored gradient matrices of normal participants according to the number of samples in each participant's local dataset, updates the global model parameters and broadcasts them until the preset convergence condition is met, and then obtains the final global traffic detection model.

[0007] In this specification, a complete iteration of the cascaded chaotic mapping system outputs the updated state value of the main mapping and the updated dynamic control parameters. The main mapping adopts dynamic Tent mapping, and the segment point is determined by a fixed offset factor and the current dynamic control parameters. When the state value of the main mapping is equal to the segment point, the symmetric point of the segment point about 0.5, the zero point, or a point, the system jumps out of the special point by adding or subtracting small amounts.

[0008] In this specification, the slave mapping adopts the cubic logistic mapping; the state value of the slave mapping is used to obtain the dynamic control parameters of the master mapping in the next round through linear mapping; at the end of each iteration, the slave mapping uses the updated state value of the master mapping as the perturbation factor, updates its own state through the coupling function, and uses the modulo operation to ensure that the output falls within the range of zero to one.

[0009] In this specification, the amplitude perturbation factor and the angle perturbation factor are extracted as follows: the chaotic sequence is reshaped into a matrix, the amplitude perturbation factor is obtained by dividing the odd-numbered element of the sequence by ten and adding 0.95, and the angle perturbation factor is obtained by multiplying the even-numbered element by twice pi and then subtracting pi; the complex field rotation mask is obtained by multiplying the gradient element by the amplitude perturbation factor and then by multiplying the imaginary unit of the natural base by the angle perturbation factor to the power of the product.

[0010] In this specification, the reverse operation is as follows: multiply each element of the perturbation gradient matrix by the reciprocal of the amplitude perturbation factor, and then multiply by the product of the negative imaginary unit of the natural base and the angle perturbation factor to obtain the restored gradient matrix.

[0011] In this specification, the calculation process of the Hearst exponent is as follows: after averaging the sequence, a cumulative deviation sequence is generated, the range and standard deviation are obtained, the rescaled range is calculated for different time scales, and the slope of the logarithm of the rescaled range and the logarithm of the time scale are fitted to obtain the exponent.

[0012] In this specification, the preset threshold ranges from 0.1 to 0.5; the preset convergence condition is that the current iteration reaches the preset maximum iteration.

[0013] In this specification, the process of constructing the fractal interpolation function is as follows: the hash value of the third initial state value parameter and the participant identifier is scaled, summed, and moduloed to obtain the actual initial state value of the main mapping. The cascaded chaotic mapping system is started to iteratively generate a one-dimensional chaotic state value sequence and a supplementary one-dimensional chaotic state value sequence. An affine transformation with the same number of dimensions as the new feature space is constructed. The compression factor, translation factor, and bias term of each affine transformation are generated by the corresponding elements of the one-dimensional chaotic state value sequence. The output consists of the compression factor multiplied by the inner product of the random weight matrix and the original feature vector, plus the translation factor multiplied by the hyperbolic tangent of the bias term. The elements of the random weight matrix are filled by the supplementary one-dimensional chaotic state value sequence.

[0014] In this specification, during the detection phase, each participant obtains the final global traffic detection model, extracts the original feature vector from the real-time traffic, and if feature alignment is enabled, it is mapped by a fractal interpolation function and then input into the model; otherwise, it is directly input into the model. The model outputs a probability value and compares it with a preset detection threshold to obtain a binary classification result.

[0015] In this specification, the secure channel adopts the Transport Layer Security Protocol TLS 1.3; the initial root key vector dedicated to security detection is generated and secretly held by the aggregation server; each participating party performs at least one security response operation based on the detection results, such as blocking the connection, adding to the blacklist, sending an alarm, or logging.

[0016] In summary, the present invention has at least the following beneficial effects: This invention employs complex-domain rotation mask perturbation instead of traditional differential privacy noise injection. Due to the complete reversibility of the chaotic perturbation, the aggregation server can accurately reconstruct the true gradient before aggregation, fundamentally eliminating the permanent loss of model accuracy caused by privacy protection. Under the same level of privacy protection, this invention achieves higher model detection accuracy.

[0017] This invention enhances the period length and complexity of chaotic sequences by introducing dynamic feedback updates of control parameters and bidirectional nonlinear coupling between the master and slave maps in an improved cascaded chaotic mapping system. It overcomes the security defects such as the "stability window" in the classical Logistic mapping and provides a safer synchronous pseudo-random source for the entire system.

[0018] This invention proposes a fractal consistency-based malicious participant detection mechanism based on the Hearst exponent. It leverages the inherent consistency in long-range correlation between chaotic pilot sequences and normal gradient magnitude sequences, identifying malicious gradients by detecting deviations from the Hearst exponent. This method requires no additional information from participating parties, incurs no communication overhead, and makes it difficult for malicious participants to forge gradients with a consistent fractal structure with the chaotic pilot sequences. It achieves high detection accuracy and effectively defends against model poisoning attacks.

[0019] This invention proposes a chaotic fractal interpolation alignment method. Each participant uses a fractal interpolation function generated from the same chaotic system but with its own participant identifier as a differentiation factor to map heterogeneous features to a unified latent space with a homeomorphic fractal structure. Feature alignment is completed without increasing communication overhead, thus alleviating the problem of model performance degradation caused by non-independent and identically distributed data.

[0020] This invention reuses a single-deployment cascaded chaotic mapping system for three different tasks: gradient perturbation, malicious detection, and feature alignment. The three functions share the same initial root key vector and underlying chaotic dynamics system, creating mutual synergy and constraints between the functions. The system design is compact, and key management is convenient. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating the privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning involved in this invention.

[0023] Figure 2This is a schematic diagram of the coupled iteration process of the cascaded chaotic mapping system involved in this invention.

[0024] Figure 3 This is a schematic diagram of the gradient complex domain rotation mask perturbation and restoration process involved in this invention.

[0025] Figure 4 This is a schematic diagram of the fractal consistency detection process based on the Hearst exponent involved in this invention. Detailed Implementation

[0026] In the following description, only certain exemplary embodiments are briefly described. As those skilled in the art will recognize, the described embodiments can be modified in various ways without departing from the spirit or scope of the embodiments of the invention. Therefore, the drawings and description are considered to be exemplary in nature and not restrictive.

[0027] The following disclosure provides many different implementations or examples for carrying out different structures of the embodiments of the present invention. To simplify the disclosure of the embodiments of the present invention, specific examples of components and arrangements are described below. Of course, these are merely examples and are not intended to limit the embodiments of the present invention. Furthermore, reference numerals and / or reference letters may be repeated in different examples of the embodiments of the present invention; such repetition is for simplification and clarity and does not in itself indicate a relationship between the various implementations and / or arrangements discussed.

[0028] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0029] like Figure 1 As shown, this embodiment provides a privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning, including: S1. Construct a cascaded chaotic mapping system with fractal feature generation capability as a synchronous pseudo-random source for the system; independently deploy an improved cascaded chaotic mapping system on the local devices and aggregation server of each participant, serving as a synchronous pseudo-random sequence generator for the entire distributed collaborative detection system. The cascaded chaotic mapping system is a composite chaotic system composed of a master map and a slave map through nonlinear coupling, with bidirectional coupling driven between the master and slave maps via state feedback. The composite system composed of the coupled master and slave maps will be collectively referred to as the cascaded chaotic mapping system below.

[0030] The system pre-defines the fixed offset factor γ and the mapping control parameter λ as globally public constants that are jointly observed by all participants and the aggregation server. During system initialization, the aggregation server generates two types of initial root key vectors: the first type is the master key vector. The first type is distributed to all participants via a secure channel; the second type is a key vector specifically used for security detection. This is secretly held by the aggregation server and not distributed to any participating party. The first type of master key vector contains the first initial state value parameter. Second initial state value parameters Third initial state value parameters First coupling control parameters Second coupling control parameters The first coupling control parameter The range of values ​​is The second coupling control parameter The range of values ​​is The secure channel is established using the Transport Layer Security (TLS) 1.3 protocol to ensure that the initial root key vector is not eavesdropped on or tampered with during transmission. The second type of security detection key vector includes... , , and The four parameters do not include a third initial state value parameter related to feature alignment. The main mapping of the cascaded chaotic mapping system adopts an improved dynamic Tent mapping, the mathematical expression of which is formula (1): ; In formula (1): Indicates the main mapping at the 1st The state value of the next iteration. , It is a non-negative integer; Indicates the main mapping at the 1st Dynamic control parameters for each iteration; Indicates the segmentation point. The calculation formula is: ,in Indicates a fixed offset factor. The range of values ​​is ; This indicates the preset number of segments. and It is a positive integer. In formula (1), when At that time, the main mapping state value increases by a tiny amount. To break out of special points; when At that time, the master mapping state value increases by a tiny amount. To break out of special points; when At that time, the main mapping state value increases by a tiny amount. To jump out Point; when At that time, the main mapping state value decreases by a tiny amount. To jump out This ensures that the state value remains constant. Within the interval. Because... The above special point handling will not cause the state value to exceed the limit. Interval.

[0031] Dynamic control parameters of the master mapping Dynamic updates are driven by the slave mapping. The slave mapping adopts the cubic logistic mapping, and its mathematical expression is formula (2): ; In formula (2): Indicates the mapping from the first The state value of the next iteration. , It is a non-negative integer; This indicates the control parameters from the mapping. The range of values ​​is .

[0032] The coupling between the master and slave mappings and a complete iteration process are as follows: In the first iteration... In this iteration, first, based on the current state value from the mapping... The dynamic control parameters required for the next round of the main mapping are calculated using a mapping function. The mapping formula is formula (3): ; In formula (3): and These represent the values ​​derived from the mapped state values. The actual distribution range is subject to a pre-set normalization constant. , , used to from Range linear mapping to scope; Indicates the main mapping at the 1st Dynamic control parameters for each iteration. .

[0033] get Afterwards, With the current master mapping state value Input the mathematical expression of the dynamic Tent mapping shown in formula (1) to calculate the next master mapping state value. Finally, utilize the newly generated... As a perturbation factor, the current state of the map is updated through a nonlinear coupling function to obtain... For use in the next round, the coupling formula is formula (4): ; In formula (4): Indicates the mapping from the first The state value of the next iteration; and These represent the first coupling control parameter and the second coupling control parameter in the initial root key vector, respectively. , ; Indicates the main mapping at the 1st The state value of the next iteration; Represents the sine function; Inscribed angle in radians; Indicates modulo operation, ensuring Mapped back Interval.

[0034] like Figure 2 As shown, a complete iteration of the cascaded chaotic mapping system is as follows: First, the current state value of the slave mapping is read and linearly mapped to a preset interval through a mapping function, calculating the dynamic control parameters required for the next round of the master mapping. Based on the dynamic control parameters and a fixed offset factor, the dynamic segmentation point is calculated. The current state value of the master mapping and the dynamic control parameters are substituted into the improved dynamic Tent mapping to calculate the next master mapping state value. Simultaneously, the current state value of the slave mapping is substituted into the cubic Logistic mapping to calculate the next slave mapping state value. Finally, using the newly generated master mapping state value as a perturbation factor, the slave mapping state value is updated for the next iteration through nonlinear coupling of the sine function term and the linear term, and modulo operation. The output of one iteration is the updated state value and updated dynamic control parameters of the master mapping. The output of a complete iteration of the cascaded chaotic mapping system is... ,in This represents the updated state value of the primary mapping. This represents the dynamic control parameters after the main mapping is updated. Stored as internal state variables for use in the next iteration. use.

[0035] Each participant and the aggregation server hold the exact same initial root key vector. Since the cascaded chaotic mapping system is a deterministic chaotic system, each participant and the aggregation server can independently and synchronously generate identical two-dimensional pseudo-random sequences without transmitting keys or the sequences themselves over the network, thereby reducing communication overhead and avoiding the risk of leakage during key transmission.

[0036] The core role of the cascaded chaotic mapping system in this method includes: providing a synchronous amplitude perturbation factor for the complex field rotation mask of S2. and angle perturbation factor Provides pilot sequences for calculating the Hearst exponent in S3 for malicious actor detection. Provides fractal interpolation functions for heterogeneous feature alignment of S4. affine transformation construction parameters , , and random weight matrix .

[0037] Before entering the federated learning iterative training, step S4 is executed first as a feature preprocessing step to complete the mapping of local heterogeneous traffic features of each participant to a unified latent space. Then, steps S2 and S3 are executed repeatedly for multiple rounds of federated learning iterative training. Step S5 is the convergence judgment step, which is executed after each round of S2 and S3 until the convergence condition is met, at which point the final model is output.

[0038] S2. Each participant applies a reversible perturbation to the gradient of its local traffic detection model based on a complex-domain rotation mask; this step is performed independently on each participant's device. If the feature alignment function in S4 is enabled before proceeding to this step of training, each participant... The original feature vectors in the local traffic dataset have been mapped to high-dimensional feature vectors using a fractal interpolation function. If S4 feature alignment is enabled, each participant uses the mapped high-dimensional feature vectors. Perform local model training; if S4 is not enabled, use the original feature vectors. Perform local model training. For the sake of brevity, the term will be used consistently below. This represents the feature vectors used in the training process.

[0039] The system has a total of One participant participates in collaborative training, the first... Each participating party is recorded as ,in ,and All participating parties The local traffic detection model is trained using a private network traffic dataset stored locally. The gradient of the trained local model is then subjected to a reversible perturbation based on complex domain rotation using a one-dimensional chaotic state value sequence generated by the cascaded chaotic mapping system deployed in S1. The perturbed gradient is then uploaded to the aggregation server.

[0040] All participating parties The local traffic dataset is denoted as ,in: Indicates the first The first participating party The feature vector of each traffic sample , express 3D real vector space, The dimension of the feature vector; The label representing the sample. , This represents normal encrypted traffic. This represents malicious encrypted traffic; Indicates the first The total number of local samples from each participant. It is a positive integer. Each participant's local data must strictly remain on its local device.

[0041] All participating parties The deployed local traffic detection model is a deep neural network with a total number of parameters. , It is a positive integer. In the... In the global iteration round, The integers are non-negative, representing each participating party. Using local traffic datasets The local traffic detection model is trained, and the gradient matrix of the local model is calculated. The local model gradient matrix The dimension is .

[0042] All participating parties A perturbation sequence is generated using the cascaded chaotic mapping system deployed in S1. The first initial state value parameters are derived from the shared initial root key vector. The second initial state value parameter serves as the initial state value for the main mapping. As the initial state value from the mapping, and with the first coupling control parameter Second coupling control parameters Coupled, the cascaded chaotic mapping system is continuously iterated. This time, we obtain a length of... One-dimensional chaotic state value sequence Each element takes the output state value of the autonomous mapping. .

[0043] All participating parties The length is A one-dimensional chaotic state value sequence is reshaped into a The matrix. For the first... dimensional gradient parameters, Define its corresponding amplitude perturbation factor. and angle perturbation factor The generating formula is formula (5): , ; In formula (5): The length is indicated as The first one in the one-dimensional chaotic state value sequence One element; The length is indicated as The first one in the one-dimensional chaotic state value sequence One element; Indicates the first The participating party in the first In the first iteration The magnitude perturbation factor corresponding to the gradient parameter in dimension 1. The range of values ​​is ; Indicates the first The participating party in the first In the first iteration The angle perturbation factor corresponding to the gradient parameter in dimension 1. The range of values ​​is .

[0044] For the local model gradient matrix Each element in All participating parties Compare it with the corresponding amplitude disturbance factor and angle perturbation factor Combined, perform a complex field rotation masking operation to generate perturbed gradient elements. The mathematical expression for the perturbation operation is formula (6): ; In formula (6): Indicates the first The participating party in the first In the first iteration The perturbated gradient elements corresponding to the gradient parameters in dimension 1; Indicates the first The participating party in the first In the first iteration The original values ​​of the gradient parameters; Represents the imaginary unit, satisfying ; The base of the natural logarithm; , represents a unit rotation in the complex plane, where Represents the cosine function. This represents the sine function.

[0045] This operation applies a combined perturbation of magnitude scaling and phase rotation to each gradient element, mapping real-valued gradient elements to complex-valued ones.

[0046] All perturbated gradient elements according to Combining the results, we obtain the perturbation gradient matrix. Each of its elements is a complex number, where The dimension is The complex matrix space.

[0047] All participating parties The perturbated gradient matrix The real and virtual parts are separated and packaged together, along with the identifiers of the participating parties. and the current iteration round Uploaded to the aggregation server.

[0048] like Figure 3 As shown, the gradient perturbation and restoration process is as follows: Each participant initiates a cascaded chaotic mapping to generate a chaotic sequence, extracts the amplitude perturbation factor and the angle perturbation factor, performs a complex domain rotation mask on the gradient elements, and then separates the real and imaginary parts before uploading. The aggregation server reassembles the complex matrix, synchronously generates the same amplitude and angle factors, performs the reverse operation to restore the gradient, and the restored gradient is completely consistent with the original gradient, achieving zero-precision restoration.

[0049] S3. The aggregation server performs precise denoising, fractal consistency checks, and secure aggregation on the complex gradients uploaded by each participant; this step is performed on the aggregation server. The aggregation server receives the perturbed gradient matrices uploaded by each participant. The real and imaginary parts of the data are reconstructed into a complex matrix. The aggregation server utilizes the cascaded chaotic mapping system deployed in S1 to synchronously generate a perturbation sequence that is completely consistent with all participants, accurately reconstructs the received complex gradients, and filters out malicious gradients using a fractal consistency detection mechanism based on the Hearst exponent. Finally, it performs weighted and secure aggregation on the retained true gradients.

[0050] The aggregation server uses the exact same initial root key vector as all participants. The first initial state value parameter in Second initial state value parameters and the first coupling control parameter Second coupling control parameters As input, the cascaded chaotic mapping system described in S1 is initiated, and iterative processes are performed continuously. This generates the same length once. The one-dimensional chaotic state value sequence is obtained, and the amplitude perturbation factor sequence corresponding to each participant is obtained according to the same calculation method as formula (5) in S2. and angle perturbation factor sequence Based on the determinism of the cascaded chaotic mapping system, the amplitude perturbation factor sequence and angle perturbation factor sequence generated by the aggregation server are compared with the first... Each participating party The generated amplitude perturbation factor sequence and angle perturbation factor sequence are completely identical.

[0051] The aggregation server uses the generated amplitude perturbation factor and angle perturbation factor to perform the following calculations: The perturbation gradient matrix uploaded by each participant Perform the inverse operation to obtain the restored gradient matrix. The restoration operation is performed independently for each element, and the mathematical expression is formula (7): ; In formula (7): Represents the reduced gradient matrix The One element, ; Indicates the first The participating party in the first In the first iteration The amplitude perturbation factor corresponding to the gradient parameter; Indicates the first The participating party in the first In the first iteration The perturbated gradient elements corresponding to the gradient parameters in dimension 1; , representing the reverse unit rotation in the complex plane. Due to the complete invertibility of the complex field rotation mask perturbation, the restored gradient matrix Gradient matrix of the original local model They are completely identical in numerical value, that is This achieves a theoretically completely reversible recovery.

[0052] While performing the restoration operation, the aggregation server performs malicious participant detection based on Hearst exponential consistency on all received gradients. The aggregation server first starts the cascaded chaotic mapping system described in S1, but uses a separate initial root key vector specifically for security detection. As input. The initial root key vector specifically used for security detection. This is randomly generated by the aggregation server during the system initialization phase and is secretly held by the aggregation server, not distributed to any participating party. Start the cascaded chaotic mapping system and iterate continuously. Next, generate a length of One-dimensional chaotic state value sequence as a pilot sequence for detection The detection pilot sequence Only the aggregation server knows about it; it is used as an internal statistical benchmark.

[0053] The aggregation server aggregates the perturbed gradient matrices uploaded by each participant. Calculate its amplitude sequence With the pilot sequence for detection The similarity to the Hearst exponent. Among them... Represents the gradient matrix after perturbation The sequence of real magnitudes obtained by taking the modulo of each element, its i-th... The elements are The calculation process is as follows: calculate the amplitude sequence separately. and detection pilot sequence The cumulative deviation series. Rescaled range analysis was used to analyze a set of different time scales. Calculate the rescaled range of the two sequences respectively. , fitting and The slope is used to obtain the Hearst exponent corresponding to the amplitude sequence. The Hearst exponent corresponding to the pilot sequence used for detection .

[0054] Aggregator server calculates the first Fractal consistency deviation of individual participants The formula is formula (8): ;In formula (8): Indicates the first The participating party in the first Fractal consistency deviation in round iteration; Indicates the first The participating party in the first The Hurst exponent of the gradient magnitude sequence after perturbation in each iteration; Indicates that the aggregation server is in the 1st month. The Hearst exponent of the pilot sequence is detected during round iteration; This represents absolute value operations.

[0055] like Figure 4 As shown, the fractal consistency detection process is as follows: The aggregation server initiates chaotic mapping with a key dedicated to security detection, generating a pilot sequence for detection. The amplitude sequences of the perturbation gradients of each participant are extracted, and the Hearst exponent of the amplitude sequence and the pilot sequence are calculated using rescaled range analysis to obtain the fractal consistency deviation. If the deviation exceeds a preset threshold, the participant is determined to be malicious and excluded; if it does not exceed the threshold, it is determined to be a normal participant, and its gradient participates in subsequent secure aggregation.

[0056] The gradient magnitude sequence of normal participants and the pilot sequence used for detection have inherent consistency in statistical characteristics because their long-range correlation originates from the same cascaded chaotic mapping system; while malicious gradients, due to their construction method, will destroy the long-range correlation of the sequence, causing their Hearst exponent to deviate significantly.

[0057] If a certain participant fractal consistency deviation Exceeding the preset abnormal threshold If the aggregation server determines that the participant is a malicious participant, then the abnormal threshold is set. The range of values ​​is The aggregation server resets the aggregation weight of malicious participants to zero in subsequent aggregation operations, excluding their gradients from affecting the global model update. For malicious participants, the aggregation server records their participant identifier and triggers an alarm. In subsequent federated learning iterations, the aggregation server still receives the perturbed gradients uploaded by the participant, but recalculates its fractal consistency bias in each round; if it fails the detection for three consecutive rounds, its aggregation eligibility is permanently terminated and it is removed from the participant set. For normal participants that pass the detection, their aggregation weight is proportional to their local sample size. .

[0058] The aggregation server performs a weighted average aggregation of the restored gradient matrices of all normal participants that passed the detection, and calculates the global model gradient update. Its mathematical expression is formula (9): ; In formula (9): This represents an index of all legitimate participants that pass the malicious participant detection. A set; Indicates the first The total number of local samples from each participant; Represents the set of indices The Middle The total number of local samples from each participant; Indicates the first The participating party in the first The restored gradient matrix in each iteration ; Indicates the first The global model gradient update amount in each iteration.

[0059] The aggregation server utilizes global model gradient update amounts Update global model parameters The updated formula is formula (10): ; In formula (10): Indicates the first Global model parameters before each iteration. ; Indicates the first The global model parameters are updated after each iteration. ; Indicates the first Learning rate for each iteration It is a positive real number.

[0060] The aggregation server will update the global model parameters. The broadcast is sent to all participants. Each participant then updates its local model parameters accordingly and proceeds to the next iteration.

[0061] The restored gradient matrix in S3 The calculation depends on the perturbed gradient matrix uploaded in S2. The amplitude perturbation factor sequence and angle perturbation factor sequence generated by S1; global model gradient update amount. The calculation relies on the restored gradient matrix of all legitimate participants detected by malicious participants in S3. Global model parameters The update depends on the global model gradient update amount .

[0062] S4. Each participant uses chaotic fractal interpolation to align heterogeneous traffic feature distributions. This step is executed on each participant's device to address the feature space offset problem caused by the non-independent and identically distributed nature of network traffic data among participants. S4 is executed once before each participant first enters federated learning training to complete the alignment of heterogeneous traffic features to a unified latent space. In subsequent training, each participant directly uses the mapped high-dimensional feature vectors for local model training.

[0063] All participating parties From its local traffic dataset Extract the original network traffic feature vector from each sample. ,in For the original feature dimension, express A real vector space of dimension 3. Let be... Original feature vector The dimensional components, where , .

[0064] All participating parties Using the cascaded chaotic mapping system deployed in S1, with the third initial state value parameter in the shared initial root key vector in S1 Identification of each participating party The fractional part of the sum of the hash values ​​is used as the actual initial state value of the main mapping. Its calculation formula is formula (11): ; In formula (11): Indicates the first The actual initial state values ​​of the master mapping used by the participants in constructing the fractal interpolation function; This represents the third initial state value parameter in the initial root key vector; Indicates the identifier of the participating party The hash value is then represented as a decimal number after being calculated using the SHA-256 hash function. ; This represents a preset scaling factor used to control the extent to which the participant identifier affects the initial state; This indicates the modulo operation. Indicates the identification of participating parties. After the SHA-256 hash function is used to calculate the hash value, the 256-bit binary hash value output by the SHA-256 hash function is converted into a decimal fraction, and the first 16 significant digits of the fraction are taken as the decimal part of the decimal. The value of , .

[0065] by As the initial state value of the main mapping, with the second initial state value parameter As the initial state value from the mapping, and with the first coupling control parameter Second coupling control parameters Coupled, the cascaded chaotic mapping system is continuously iterated. Next, generate a length of One-dimensional chaotic state value sequence ,in For the dimension of the new feature space, and It is a positive integer. The integers are positive. The elements of the one-dimensional chaotic state value sequence are used as affine transformation parameters of the iterative function system. Each participating party... Independently construct a fractal interpolation function that maps to a new feature space. ,in express A real vector space.

[0066] All participating parties Let the cascaded chaotic mapping system in the iterative Iterate on this basis. Next, generate a supplementary one-dimensional chaotic state value sequence. Used to fill the random weight matrix Element.

[0067] All participating parties Build Each of the affine transformations constitutes an iterative unit of the fractal interpolation function. For the ... An affine transformation, Its compressibility factor Translation factor and bias terms The length is The corresponding index in the one-dimensional chaotic state value sequence The values ​​are generated using formulas (12), (13), and (14).

[0068] Formula (12): ; Indicates the first The compression factor of an affine transformation. ; The length is indicated as The first one in the one-dimensional chaotic state value sequence Each element.

[0069] Formula (13): ; Indicates the first A translation factor of an affine transformation; The length is indicated as The first one in the one-dimensional chaotic state value sequence Each element.

[0070] Formula (14): ; Indicates the first Bias terms of an affine transformation; The dimension index of the original feature vector. ; The length is indicated as The first one in the one-dimensional chaotic state value sequence One element; Represents the original feature vector The Dimensional components.

[0071] fractal interpolation function Defined as The weighted iterative effect of an affine transformation. For the input original feature vector... Its mapping output The Dimensional components The calculation formula is formula (15): ; Represents the high-dimensional feature vector after mapping The Dimensional components; Indicates the first The compression factor of each affine transformation is calculated by formula (12); Represent a The random weight matrix, express The Line number Column elements, The value of is the first in the supplementary one-dimensional chaotic state value sequence. Each element, namely ; Represents the original feature vector The Dimensional components; Indicates the first The translation factor of each affine transformation is calculated by formula (13); Represents the hyperbolic tangent function; Indicates the first The bias term of each affine transformation is calculated by formula (14).

[0072] Through the above process, each original feature vector Using fractal interpolation functions It is mapped to a high-dimensional feature vector containing more detailed structure. The mapping process is represented as The fractal interpolation functions of all participants originate from the same cascaded chaotic mapping system, but each participant introduces its own participant identifier. As a differentiating factor, it causes the chaotic trajectories of various participants to diverge, thereby generating fractal interpolation functions. The forms vary. The target space to which each participant maps the original features is homeomorphic in fractal geometry, that is, the heterogeneous features of different participants are aligned to a latent space with an inherently consistent geometric structure.

[0073] All participating parties The mapped high-dimensional feature vector The local traffic detection model is used for training. The fractal interpolation function alignment process serves as a feature preprocessing step, mitigating the accuracy loss caused by data heterogeneity.

[0074] Since the aggregation server also holds the third initial state value parameter in the initial root key vector And know the participant identifiers of all participants. Therefore, the fractal interpolation function of all participants can be reproduced. It is used to verify the consistency of feature alignment on the aggregation server side.

[0075] S5. Iterate through S2 to S3 until the global model converges, and deploy the final model for testing; the aggregation server repeatedly executes S2 to S3, performing multiple iterations of federated learning. At the end of each iteration, the aggregation server determines whether the global model meets the preset convergence condition, which is: the current iteration round... Reaching the preset maximum number of iterations ,in It is a positive integer.

[0076] If the convergence condition is not met, i.e., the current iteration round... Less than The aggregation server will update the global model parameters in S3. The broadcast is sent to all participants. Each participant, upon receiving the broadcast, updates its local model parameters accordingly. Then return to S2 to begin the next round of local training and gradient upload.

[0077] If the convergence condition is met, i.e., the current iteration round... equal The aggregation server stops iterative training and sets the global model parameters at this point. This serves as the final output of the global traffic detection model.

[0078] During the testing phase, all participating parties Download the final global traffic detection model and deploy it in the local network traffic monitoring system. (All participating parties) For each network traffic session captured in real time, the original feature vector is first extracted using the same feature extraction method as in S2. If the feature alignment function of S4 is enabled during the training phase, the fractal interpolation function built in S4 will be used to... Mapped to Then Input the final global traffic detection model. If S4 is not enabled, directly input the original feature vector. Input the final global traffic detection model.

[0079] The final global traffic detection model outputs a value between... and Probability values ​​between By matching the preset detection threshold Compare and give the binary classification detection results: If If so, the network traffic session is determined to be malicious encrypted traffic; if If the network traffic session is deemed to be normal encrypted traffic, then the preset detection threshold is used. The range of values ​​is .

[0080] All participating parties Based on the detection results, corresponding security response operations are performed, including but not limited to: blocking the network connection of malicious encrypted traffic; adding the source Internet Protocol address of the malicious encrypted traffic to a blacklist; sending an alarm message containing the detection results of malicious traffic to the network administrator; and recording the event log of malicious encrypted traffic for security auditing.

[0081] Example 1: Construction and operation process of the cascaded chaotic mapping system in S1.

[0082] This embodiment describes the construction and operation process of the cascaded chaotic mapping system in S1.

[0083] Set the initial state value of the primary mapping. From the initial state value of the mapping First coupling control parameter Second coupling control parameter Fixed offset factor From the mapping control parameters Number of segments parameter .

[0084] In the In this iteration, the current state value is read from the mapping. Calculate the dynamic control parameters required for the next round of the master mapping according to formula (3). .set up ,but: ; Calculate the breakpoints: ; Set the current main mapping state value and Substitute into formula (1). Because Therefore: ; Perform mapping updates and coupling. Update the mapping state value. Substitute into formula (2) and calculate: ; Taking the decimal part, we get Utilizing the newly generated master mapping state values As a perturbation, the mapped state is updated according to formula (4) for the next round: ; calculate: ; but: ; The output of this iteration is the master mapping state value. and dynamic control parameters .

[0085] By repeating the above process, a one-dimensional chaotic state value sequence with the required length can be generated.

[0086] Example 2: Gradient perturbation and accurate restoration process based on complex domain rotation mask in S2 and S3.

[0087] This embodiment describes the gradient perturbation and accurate restoration process based on the complex field rotation mask in S2 and S3.

[0088] Set the total number of parameters for the local traffic detection model. Current training round Participants Calculated dimensional local model gradient matrix Initiate the cascaded chaotic mapping system described in S1 to share the initial root key vector. and and and As input, continuous iteration This yields a one-dimensional chaotic state value sequence. .

[0089] For the first gradient element The corresponding amplitude disturbance factor is: ; set up ,but: ; The angle disturbance factor is: ; set up ,but: ; Calculate the perturbation gradient elements according to formula (6): ; calculate: ; but: ; For all Perform this operation on each gradient element to obtain the perturbed gradient matrix. .

[0090] Aggregation server with participants The cascaded chaotic mapping system is started with identical initial root key vectors, synchronously generating the same amplitude perturbation factor sequence and angle perturbation factor sequence. For the received perturbed gradient elements... Perform the restoration operation according to formula (7): ; calculate: ; First, calculate the complex multiplication: ; The real part is: ; The imaginary part is: ; Multiply by ,get: ; With the original gradient elements They are completely identical, achieving a theoretically completely reversible restoration.

[0091] Example 3: The specific process of fractal consistency detection based on the Hearst exponent in S3.

[0092] This implementation describes the specific process of fractal consistency detection based on the Hurst exponent in S3. Setting an anomaly threshold... .

[0093] The aggregation server uses an initial root key vector specifically for security detection. Start the cascaded chaotic mapping system described in S1, and generate a length of Pilot sequence for detection .

[0094] For the participating parties Uploaded perturbation gradient matrix Take its amplitude sequence , denoted as sequence The pilot sequence used for detection Denoted as a sequence .

[0095] Calculate sequence The Hearst exponent. Calculate. Mean: ; Generate cumulative deviation sequence: ; Calculate the range: ; Calculate the standard deviation: ; For a set of different subsequence lengths For each subsequence length , with a length of The sequence is divided into Divide the data into non-overlapping continuous segments and calculate the value of each segment. The values ​​are averaged. (Fit) and The slope of the curve is called the Hearst exponent. The estimated value. Assume the calculated value is... For the pilot sequence used in detection Performing the same calculation yields... .

[0096] Calculate the fractal consistency deviation according to formula (8): ; because Determine the participants As a normal participant, its restored gradient matrix participates in the aggregation.

[0097] For the participating parties Perform the same operation, if its perturbed gradient magnitude sequence The Hearst exponent is Then the fractal consistency deviation is: ; Determine the participants For malicious participants, their aggregate weights are set to zero to exclude the influence of their gradients on the global model update.

[0098] Example 4: Fractal interpolation function in S4 The construction process.

[0099] This implementation method addresses the fractal interpolation function in S4. The construction process will be explained in detail.

[0100] Let the original feature dimension be... New feature space dimension .choose Because It needs to be greater than the original feature dimension. And it is a multiple of 2 to facilitate the symmetric construction of the subsequent affine transformation of the fractal interpolation function. Participants Calculate the actual initial state value of the principal mapping according to formula (11): ; set up , ,but: ; Participants by As the initial state value of the main mapping, with the second initial state value parameter As the initial state value from the mapping, and with the first coupling control parameter Second coupling control parameters Coupled, the cascaded chaotic mapping system is continuously iterated. Next, generate a one-dimensional chaotic state value sequence. .

[0101] Participants Let the cascaded chaotic mapping system in the iterative Iterate on this basis. Next, generate a supplementary one-dimensional chaotic state value sequence. Used to fill the random weight matrix Element.

[0102] Participants Build Each of the affine transformations forms an iterative unit for the fractal interpolation function. For the ... An affine transformation, Its parameters are determined by the corresponding index in the one-dimensional chaotic state value sequence. Values ​​are generated.

[0103] The first affine transformation is For example, the compression factor is calculated according to formula (12): ; set up ,but: ; Calculate the translation factor according to formula (13): ; set up ,but: ; Calculate the bias term according to formula (14): ; From a one-dimensional chaotic state value sequence to common The element and the original feature vector to Dimensional components to The weighted sum is calculated from the random weight matrix. The Line 1 Column elements The value of is the first in the supplementary one-dimensional chaotic state value sequence. Each element, namely .

[0104] Calculate the output of the first affine transformation according to formula (15): ; Expand it as follows: ; the remaining Affine transformation is In exactly the same way, each of them constructs its own compression factor using its corresponding chaotic sequence elements. Translation factor Bias terms and random weight matrix The Row elements, and so on.

[0105] Through the above process, the participating parties Fractal interpolation functions were constructed independently. can Mapping the original feature vector to A new feature space is created to achieve heterogeneous feature alignment. This is due to the different participant identifiers... The actual initial state values ​​of its main mapping are different. Each is different, resulting in different chaotic sequences and fractal interpolation functions, but they all originate from the same cascaded chaotic mapping system. The target space is homeomorphic in fractal geometry, thus achieving unified alignment of the feature space while maintaining individual differences.

[0106] Example 5: Overall system operation flow.

[0107] During the system initialization phase, the aggregation server generates the initial root key vector. and the initial root key vector specifically used for security detection The aggregation server transmits the initial root key vector via a secure channel. Distribute to all participants. Initial root key vector specifically for security testing. It is held secretly by the aggregation server and is not distributed to any participating party.

[0108] Before entering the federated learning iteration, each participant first executes S4, which uses a fractal interpolation function to map local heterogeneous traffic features to a unified latent space, completing feature alignment preprocessing. Then, the federated learning iteration loop begins.

[0109] In each global iteration, each participant performs local training and complex domain rotation mask perturbation in S2 in parallel, and then uploads the real and imaginary parts of the perturbed gradient matrix to the aggregation server. The aggregation server sequentially performs gradient restoration, fractal consistency malicious participant detection based on the Hearst exponent, and security aggregation in S3, and then broadcasts the updated global model. After receiving the global model, each participant updates its local model and enters the next iteration.

[0110] The entire training process continues until S5 determines that the maximum number of iterations has been reached. The process stops at a certain point, and the final global traffic detection model is output. Each participating party downloads the final model and deploys it locally for detecting malicious encrypted traffic in real-time captured network traffic.

[0111] In some embodiments, the aggregation server obtains the basic global model gradient update by performing weighted average aggregation. Subsequently, gradient quality adaptive enhancement aggregation based on fractal interpolation residual analysis is further performed. This mechanism utilizes the fractal interpolation function constructed in S4. The restored gradient matrix of each normal participant Fractal reconstruction is performed, and the residual anomalies between the measured gradient and the fractal reconstruction gradient are compared. The contribution weights of each participant in the aggregation are dynamically adjusted, thereby suppressing the negative impact of low-quality gradients on the global model update.

[0112] The aggregation server serves as a platform for all normal participants. The restored gradient matrix As input. Due to the fractal interpolation function. Since there is no strictly inverse mapping in analytical form for the embedding mapping from the low-dimensional original space to the high-dimensional latent space, the aggregation server uses a gradient reconstruction method in the least squares sense to replace the inverse mapping operation. Specifically, the aggregation server first... According to the model structure, it is divided into There are parameter groups, and the dimension of each parameter group is... ,get ,in , For each parameter group The aggregation server treats it as a point in the original space and uses gradient descent to solve the following optimization problem to obtain the reconstructed gradient. : ; That is, finding the gradient in the original space. This allows the latent space features after fractal interpolation mapping to be compared with the original high-dimensional gradient. The latent space feature differences are minimized. This optimization problem can be solved quickly using finite-step gradient descent, yielding the desired result. That is, in the original space and The most consistent reconstruction gradient on the fractal structure. Through the above optimized reconstruction, the aggregation server can obtain the reconstruction gradient of the original space without relying on a non-existent inverse mapping, where... Indicates the first The participating party in the first In the first iteration The original spatial gradient is obtained after optimizing and reconstructing the parameter set.

[0113] Aggregator server calculates the first The participating party in the first Fractal reconstruction residuals in round iteration The calculation formula is as follows: ; in Denotes the Euclidean norm. Use extremely small positive numbers to prevent the denominator from being zero. For the first The participating party in the first In the first iteration The reconstructed gradient of a parameter set after forward and inverse mapping This represents the grouping of the corresponding original, restored gradient matrices. Let be the square norm of the reconstruction error. Fractal reconstruction residuals. The smaller the value, the more consistent the gradient of the participant is with the global fractal structure characterized by the fractal interpolation function, and the higher the gradient quality.

[0114] Aggregation server based on fractal reconstruction residual Calculate the first Quality enhancement weight of each participant The calculation formula is as follows: ; in The preset quality enhancement factor, This is used to control the strength of the influence of the residual on the weight. The larger the value of , the greater the weight difference between high-quality gradients and low-quality gradients. It is a natural exponential function; This is the set of indices j of all legitimate participants that pass the malicious participant detection. Quality enhancement weights. With fractal reconstruction residual There is an exponential negative correlation, meaning that the participants with smaller residuals and higher gradient quality receive greater aggregation weights.

[0115] Aggregation servers utilize quality enhancement weights The weighted average aggregation result in formula (9) is modified, and the enhanced global model gradient update amount is calculated. The calculation formula is as follows: ; in For the first The participating party in the first The restored gradient matrix in each iteration. The enhanced global model gradient update. In the substitution formula (10) Used to update global model parameters, i.e. .

[0116] The core contribution of this gradient quality adaptive enhancement aggregation mechanism based on fractal interpolation residual analysis lies in the fact that traditional federated learning aggregation relies solely on the local data volume of participating parties for weighting, ignoring the quality differences of the gradients themselves. This mechanism utilizes fractal interpolation functions to reconstruct the gradients and quantifies the consistency between the gradients and the global fractal structure through residual analysis. This achieves automatic suppression of low-quality gradients and adaptive enhancement of high-fidelity gradients, improving the convergence quality and final detection accuracy of the global model without introducing additional communication overhead.

[0117] In some embodiments, before the aggregation server completes the global model parameter update and broadcasts it to all participants, it also executes a global model adaptive rollback and dynamic parameter adjustment mechanism based on chaos state awareness. This mechanism dynamically adjusts hyperparameters such as the learning rate by comparing the rate of change of chaotic state characteristics of the global model parameters before and after the update, and triggers model rollback when abnormal fluctuations are detected, preventing irreversible damage to the global model caused by a single round of low-quality gradients.

[0118] In each iteration, the aggregation server updates the global model parameters. In addition, a chaotic state feature vector is maintained. The aggregation server uses the current round. and global model parameters The combination of these elements is used as input to initiate the cascaded chaotic mapping system deployed in S1, in order to share the initial root key vector. Based on this, the current global model parameters are introduced. The L2 norm is used as an additional perturbation factor for continuous iteration. Secondary generated chaotic state sequence , of which chaotic state values The recursive relationship is as follows: the aggregation server causes the cascaded chaotic mapping system to... As the primary mapping state value, and the secondary mapping state value maintained internally by the system. As an iteration from the mapped state values, where Reuse the second initial state value parameter in S1 , Reuse the first initial state value parameters in S1 Dynamic control parameters From the mapped state value Calculated according to formula (3). The iterative formula is: ;in This represents a complete iterative operation of the cascaded chaotic mapping system defined in S1 (i.e., the operation defined by formulas (1) to (4) from...). arrive (the complete iterative process), and the additional normalization factor introduced. As an additional perturbation to the master mapping state values, it is used to couple changes in global model parameters into the chaotic state generation process. For the first The L2 norm of the global model parameters after rounds of iteration. Represents the initial global model parameters, i.e. The initial parameter values ​​of the global model at that time. The L2 norm of the initial global model parameters. Use extremely small positive numbers to prevent the denominator from being zero. For the first The chaotic state sequence generated in the round of iterations is the first... The aggregation server will generate a sequence of chaotic states. Arranged in order, they constitute the feature vector of the chaotic state. .

[0119] Aggregator server calculates the first Round iteration and the first The relative rate of change of the chaotic state eigenvectors between iterations The calculation formula is as follows: ; in The distance is the Euclidean distance between the feature vectors of two adjacent chaotic states. Let L2 be the feature vector of the previous chaotic state. The value is a very small positive number to prevent the denominator from being zero. Relative rate of change. It reflects the degree to which changes in global model parameters disturb the state of the chaotic system, and indirectly characterizes the intensity of model updates.

[0120] The aggregation server is based on the relative rate of change of the chaotic state. Dynamically adjust the learning rate for the next iteration. Its adjustment formula is: ; in The learning rate for the current round. The preset minimum learning rate threshold, The range of values ​​is ,in The initial learning rate, The preset learning rate decay factor, This is the natural exponential function. The meaning of this adjustment formula is: when the chaotic state eigenvector undergoes a drastic change (… When the learning rate is relatively high, it indicates that the model update has significantly perturbed the chaotic system, and the learning rate should be automatically reduced to slow down the update speed and prevent overfitting; when A smaller value indicates that the model updates smoothly and the learning rate can be maintained at a high level to accelerate convergence.

[0121] If the relative rate of change of the chaotic state Exceeding the preset abnormal threshold ,Right now ,in If the aggregation server determines that the current global model update is abnormal, it will trigger a model rollback operation. This means abandoning the current update, keeping the global model parameters unchanged from the previous round, and adjusting the learning rate to... And record the exception event log. If consecutively exceeding achieve Second-rate( If this occurs, the aggregation server will trigger a global alert, notifying all participants to suspend training until administrators intervene and investigate. The preset threshold for the number of consecutive anomalies is used to determine whether there are persistent training anomalies.

[0122] The core contribution of this global model adaptive rollback and dynamic parameter adjustment mechanism based on chaos state awareness lies in the fact that traditional federated learning uses a fixed or preset decaying learning rate, which cannot perceive the actual quality of model updates. This mechanism maps global model parameters to a chaotic state space and indirectly evaluates the rationality of model updates by monitoring the rate of change of chaotic state feature vectors. This achieves adaptive adjustment of the learning rate and automatic rollback of abnormal updates, effectively preventing the destructive impact of low-quality or malicious gradients in a single round on the global model, and enhancing the robustness and self-healing ability of the system.

[0123] In some embodiments, before each federated learning iteration begins local model training, each participant also performs a mechanism for proactive detection of local data distribution drift and triggering local model updates based on chaotic probe sequences. This mechanism utilizes chaotic probe sequences generated by a cascaded chaotic mapping system to proactively detect changes in the local data distribution of each participant. It triggers full training of the local model only when a significant data distribution drift is detected; otherwise, it reuses the gradients of the local model from the previous iteration, thereby significantly reducing communication and computational overhead.

[0124] All participating parties In each iteration Before starting, a set of chaotic detection sequences is generated using the cascaded chaotic mapping system deployed in S1. Specifically, the third initial state value parameter in the shared initial root key vector. With participant identification The fractional part of the sum of the hash values ​​is used as the initial state value of the main mapping. The calculation formula is as follows: ; in For the current iteration round and It is a non-negative integer. The maximum number of iterations is preset and It is a positive integer. The round perturbation factor is used to ensure that the probe sequences generated in different rounds are different. Indicates the identifier of the participating party hash value, This represents the modulo operation. As the initial state value of the main mapping, with the second initial state value parameter As the initial state value from the mapping, with the first coupling control parameter Second coupling control parameters Couple the systems together to allow the cascaded chaotic mapping system to iterate continuously. Second-rate( (Based on the original feature dimensions), generating chaotic detection sequences. ,in For the first The probe sequence generated in the round of iteration One element, .

[0125] All participating parties From its local traffic dataset Randomly selected from One sample ( The preset number of detection samples and ,in For the first (Total number of local samples from each participant), calculate this The mean of the feature vectors of each sample Covariance Matrix The calculation formula is as follows: ; ; in For the first The participating party in the first The first one randomly selected in the round of iteration The original feature vector of each sample, , This represents the matrix transpose operation. The sample mean vector Let be the sample covariance matrix.

[0126] All participating parties Using chaotic detection sequences For covariance matrix Perform projection and calculate the detected projection value. : ; in The column vector formed by the chaotic detection sequence (i.e. ), This is the sample covariance matrix. The probe projection values. It is a scalar that comprehensively reflects the degree of dispersion of the current local data distribution in the direction of chaotic detection.

[0127] All participating parties Maintain the probe projection values ​​from the previous iteration (for ,definition ), calculate the change in the probe projection ,in This represents absolute value operations. If... Exceeding the preset detection threshold ,Right now If this occurs, it is determined that a significant shift has occurred in the local data distribution, triggering the complete training of the local model—that is, performing subsequent local gradient calculations and perturbation upload operations. If the local data distribution has not changed significantly, then the participating party is deemed to be... Directly reuse the local model gradient matrix from the previous iteration The gradient matrix for the current round The local training process is skipped, but the perturbation upload operation in S2 still needs to be performed to maintain the synchronization of the system.

[0128] Among them, the preset detection threshold The value is uniformly configured by the aggregation server and distributed to each participant through a secure channel. The basis for setting this value range is: when the change in the detected projection value is less than... When the data distribution change is negligible, retraining is not required; when the change is greater than... When the data distribution has shifted significantly, full training must be triggered to ensure model adaptability; when it falls between these two extremes, whether to trigger training depends on the specific application scenario and accuracy requirements.

[0129] The core contribution of this mechanism for proactively detecting local data distribution drift and triggering local model updates based on chaotic probe sequences lies in the fact that traditional federated learning assumes that the local data distribution of each participant remains stable during training. However, in real-world network environments, the traffic data distribution of each participant may dynamically change over time (e.g., the evolution of network attack patterns, seasonal changes in user behavior). This mechanism proactively senses changes in local data distribution through chaotic probe sequences, triggering full training only when necessary. This ensures the model's adaptability to data distribution drift while significantly reducing redundant computation and communication overhead, making it particularly suitable for resource-constrained edge device deployment scenarios.

[0130] The embodiments described above are for illustrative purposes only and are not intended to limit the invention. Therefore, any changes in numerical values ​​or substitutions of equivalent elements should still fall within the scope of this invention.

[0131] The above detailed description will enable those skilled in the art to understand that the present invention can indeed achieve the aforementioned objectives and has complied with the provisions of the Patent Law.

[0132] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention. The above descriptions are merely preferred embodiments of the invention and are not intended to limit the invention. It should be noted that any modifications, equivalent substitutions, and improvements made within the spirit and principles of the invention should be included within the scope of protection of the invention.

[0133] It should be noted that the above description of the process is for illustrative purposes only and does not limit the scope of this specification. Those skilled in the art can make various modifications and changes to the process under the guidance of this specification. However, these modifications and changes remain within the scope of this specification.

[0134] The basic concepts have been described above. Obviously, for those skilled in the art who have read this application, the above disclosure is merely illustrative and does not constitute a limitation of this application. Although not explicitly stated herein, those skilled in the art may make various modifications, improvements, and corrections to this application. Such modifications, improvements, and corrections are suggested in this application, and therefore, such modifications, improvements, and corrections still fall within the spirit and scope of the exemplary embodiments of this application.

Claims

1. A privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning, characterized in that, include: The aggregation server generates an initial root key vector and distributes it to each participant through a secure channel. The initial root key vector includes a first initial state value parameter, a second initial state value parameter, a third initial state value parameter, a first coupling control parameter, and a second coupling control parameter. Each participant and the aggregation server respectively start the cascaded chaotic mapping system based on the initial root key vector. The master mapping and slave mapping of the cascaded chaotic mapping system achieve bidirectional driving through nonlinear coupling. Before entering the federated learning training, each participant uses the cascaded chaotic mapping system to process the third initial state value parameter and the hash value of their respective participant identifier as the initial state of the main mapping, generate a chaotic sequence and construct a fractal interpolation function, and use the fractal interpolation function to map the original feature vector into a high-dimensional feature vector. During training, each participant uses high-dimensional feature vectors to train a local model to obtain a gradient matrix. The cascaded chaotic mapping system is started with the first initial state value parameter, the second initial state value parameter, the first coupling control parameter, and the second coupling control parameter to generate a chaotic sequence. The amplitude perturbation factor and the angle perturbation factor are extracted. Complex domain rotation mask is performed on each element of the gradient matrix to obtain the perturbed gradient matrix, which is then sent to the aggregation server. The aggregation server synchronously generates amplitude perturbation factor and angle perturbation factor with the same parameters, and performs inverse operation on the perturbated gradient matrix to obtain the restored gradient matrix; The aggregation server uses its own generated and secretly held initial root key vector, which is dedicated to security detection, to start the cascaded chaotic mapping system to generate a pilot sequence for detection. It calculates the amplitude sequence of the gradient matrix after perturbation of each participant and the Hearst exponent of the pilot sequence for detection. The absolute value of the difference between the two is used as the fractal consistency deviation. If the fractal consistency deviation exceeds a preset threshold, it is judged as a malicious participant and excluded. If it does not exceed the threshold, it is judged as a normal participant. The aggregation server weights and aggregates the restored gradient matrices of normal participants according to the number of samples in each participant's local dataset, updates the global model parameters and broadcasts them until the preset convergence condition is met, and then obtains the final global traffic detection model.

2. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to claim 1, characterized in that, A complete iteration of the cascaded chaotic mapping system outputs the updated state value of the main mapping and the updated dynamic control parameters. The main mapping adopts dynamic Tent mapping, and the segment point is determined by a fixed offset factor and the current dynamic control parameters. When the state value of the main mapping is equal to the segment point, the symmetric point of the segment point about 0.5, the zero point, or a point, the system jumps out of the special point by adding or subtracting small amounts.

3. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to claim 2, characterized in that, The slave mapping uses a cubic logistic mapping; the state values ​​of the slave mapping are linearly mapped to obtain the dynamic control parameters of the master mapping for the next round; at the end of each iteration, the slave mapping uses the updated state values ​​of the master mapping as perturbation factors, updates its own state through a coupling function, and uses modulo operations to ensure that the output falls within the range of zero to one.

4. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to claim 1, characterized in that, The amplitude perturbation factor and angle perturbation factor are extracted as follows: the chaotic sequence is reshaped into a matrix, the amplitude perturbation factor is obtained by dividing the odd-numbered element of the sequence by ten and adding 0.95, and the angle perturbation factor is obtained by multiplying the even-numbered element by twice pi and then subtracting pi. The complex field rotation mask is obtained by multiplying the gradient element by the amplitude perturbation factor and then by multiplying the imaginary unit of the natural base by the angle perturbation factor to the power of the product.

5. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to claim 1, characterized in that, The reverse operation is as follows: multiply each element of the perturbation gradient matrix by the reciprocal of the amplitude perturbation factor, and then multiply by the product of the negative imaginary unit of the natural base and the angle perturbation factor to obtain the restored gradient matrix.

6. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to claim 1, characterized in that, The calculation process of the Hearst exponent is as follows: after averaging the sequence, a cumulative deviation sequence is generated, the range and standard deviation are obtained, the rescaled range is calculated for different time scales, and the slope of the logarithm of the rescaled range and the logarithm of the time scale is fitted to obtain the exponent.

7. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to claim 1, characterized in that, The preset threshold value ranges from 0.1 to 0.5; the preset convergence condition is that the current iteration reaches the preset maximum iteration.

8. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to claim 1, characterized in that, The process of constructing the fractal interpolation function is as follows: the hash value of the third initial state value parameter and the participant identifier is scaled, summed and moduloed to take the actual initial state value of the main mapping, and the cascaded chaotic mapping system is started to iteratively generate a one-dimensional chaotic state value sequence and a supplementary one-dimensional chaotic state value sequence. Construct an affine transformation with the same number of dimensions as the new feature space. The compression factor, translation factor, and bias term of each affine transformation are generated by the corresponding elements of the one-dimensional chaotic state value sequence. The output consists of the compression factor multiplied by the inner product of the random weight matrix and the original feature vector, plus the translation factor multiplied by the hyperbolic tangent of the bias term. The elements of the random weight matrix are filled by the supplementary one-dimensional chaotic state value sequence.

9. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to claim 1, characterized in that, During the detection phase, each participant obtains the final global traffic detection model, extracts the original feature vector from the real-time traffic, and if feature alignment is enabled, it is mapped by a fractal interpolation function and then input into the model; otherwise, it is directly input into the model. The model outputs a probability value and compares it with a preset detection threshold to obtain a binary classification result.

10. The privacy-preserving network traffic collaborative detection method based on chaotic mapping and federated learning according to any one of claims 1 to 9, characterized in that, The secure channel adopts the Transport Layer Security Protocol TLS 1.3; the initial root key vector dedicated to security detection is generated and secretly held by the aggregation server; each participant performs at least one security response operation based on the detection results, such as blocking the connection, adding to the blacklist, sending an alarm, or logging.

Images