A federated threat intelligence security aggregation method and system for network information warfare

Abstract

The application relates to the fields of network security and federated learning, and discloses a federated threat intelligence security aggregation method and system for network information warfare. A server receives model updates obtained by training local threat intelligence data of each client, and constructs an auxiliary global model; under the condition of unknown triggers and target labels, the feature mask and trigger mode of each candidate label are optimized, and a suspected target label is determined based on the median absolute deviation; the trust score of each client model is evaluated by reverse reasoning; a game solving process based on dynamic poisoning ratio change and client basic trust score feedback is constructed, the aggregation weight is determined according to the client trust score calculated by reverse reasoning; the global model is updated according to the weight, and the updated global model is fed back to the next round. The application can identify and inhibit dynamic backdoor poisoning without collecting original data, and is suitable for a threat intelligence alliance platform, an information warfare defense command center and a security operation center.

Description

Technical Field

[0001] This invention relates to the fields of cyberspace security, network threat intelligence, federated learning, and machine learning security technology. Specifically, it relates to a method, system, electronic device, and computer-readable storage medium for secure aggregation of federated threat intelligence models in an environment where multi-organizational data is not centralized, some clients may be controlled, and attack strategies are dynamically changing. This method utilizes inverse processing of no prior feature triggers, client risk scoring, and attack-defense game theory. Background Technology

[0002] Cyber ​​threat intelligence (CTI) typically includes data such as network traffic, attack metrics, vulnerability information, malware behavior, alert logs, and attack techniques and tactics. Data held by different organizations varies significantly in terms of source, distribution, sensitivity, and compliance requirements, making centralized sharing of raw data difficult. Federated learning provides a feasible path for cross-organizational collaborative training of threat detection models by training models locally on the client side and only uploading parameters or model updates.

[0003] In the context of cyber warfare, attackers can not only directly attack network infrastructure, but also potentially control intelligence sources, edge gateways, honeypot nodes, compromised organizations, or nodes with forged identities, causing them to submit model updates containing backdoor logic to the federated server. This type of backdoor attack can maintain the accuracy of ordinary threat detection while misclassifying malicious traffic with specific triggering patterns as pre-defined target categories, such as misclassifying botnet, distributed denial-of-service, or advanced persistent threat traffic as normal traffic.

[0004] Existing federated robust aggregation methods mostly rely on update distance, coordinate statistics, or root of trust data to filter out anomalous updates. However, when faced with model replacement, non-independent and identically distributed data, or hidden backdoor updates that deliberately maintain parameter similarity, they may struggle to reliably distinguish between honest and malicious clients. Existing backdoor reverse engineering methods can search for the minimum trigger within the model, but they typically do not form a closed loop with federated client scoring, dynamic poisoning strategies, and aggregation weight adjustments.

[0005] Furthermore, attackers can dynamically adjust the poisoning ratio based on whether the server accepts their model updates, their client ratings, and the overall backdoor effect of the model. Fixed poisoning intensity or fixed aggregation thresholds cannot adequately describe this feedback-driven adversarial process. Therefore, a technical solution is needed that can identify backdoor risks, adjust client weights, and maintain the availability of the main task even when the true triggers and target labels are unknown, and the attack intensity changes dynamically, without centralizing the original data. Summary of the Invention

[0006] I. Technical problems to be solved

[0007] This invention aims to solve the following technical problem: In federal threat intelligence training, the server lacks real backdoor triggers and target label priors. Malicious clients can submit normal updates and poisoned updates in a mixed manner and dynamically adjust the poisoning ratio based on defense feedback. This makes it difficult for aggregation methods that rely solely on update distance or fixed rules to simultaneously reduce the success rate of backdoor attacks and maintain the accuracy of the main task.

[0008] II. Technical Solution

[0009] To address the aforementioned technical issues, this invention first receives model updates trained on local CTI data from each participating client in each federated training round, and performs shape verification, finite value verification, norm pruning, and sample size registration on the updates. Subsequently, it uses initial aggregation rules to construct an auxiliary global model, enabling potential backdoor logic implanted by attackers to manifest in this auxiliary model.

[0010] The server freezes the auxiliary global model, constructing an optimizable feature mask and triggering pattern for each candidate target label in the label set. By injecting the triggering pattern into clean validation samples and minimizing the sum of the target label classification loss and the mask sparsity regularization, the minimum candidate trigger for each candidate target label is obtained. The median absolute deviation anomaly index is calculated using the mask size distribution of the candidate triggers, thereby identifying suspected backdoor target labels and their inverse triggers in the absence of real triggers and prior knowledge of real target labels.

[0011] The server uses reverse triggers to test the local models on each client, calculating the proportion of triggered samples predicted as suspected backdoor target labels, the main task performance on clean samples, and the deviation of model updates from robust centers. Based on this, a trust score is obtained for each client. The lower the trust score, the more likely the client update is to carry backdoor logic or contain significant anomalies.

[0012] To accommodate attackers dynamically adjusting their poisoning ratios based on defense feedback, this invention incorporates both the attacker's poisoning ratio and the defender's trust score into the policy space. The server analyzes the client model's response to abnormal patterns through reverse reasoning and dynamically updates the client's base trust score. The final aggregated weight is related to the client's local sample size, trust score, and defense strategy parameters.

[0013] The updated global model is distributed to the client for the next round of training; the trust score, reverse reasoning and aggregation results of the previous round are used as historical state feedback, thus forming a closed loop of "auxiliary model construction - trigger reverse reasoning - client scoring - game solving - secure aggregation - feedback update".

[0014] III. Beneficial Effects

[0015] Compared to aggregation methods that only compare the distance between model parameters, this invention directly uses the model's functional response to the reverse trigger to assess the client backdoor risk, and can identify clients whose parameters appear to be normal updates but carry hidden backdoor logic.

[0016] This invention reverses the feature triggers of all candidate tags and uses the median absolute deviation to determine anomalies. It does not require prior knowledge of the trigger position, trigger mode, and target tag, and is applicable to tabular network traffic features, IoT telemetry features, and multi-source CTI features.

[0017] This invention enables the aggregated weight to be dynamically adjusted according to changes in client backdoor risk by using dynamic poisoning behavior to change model function and feedback from client basic trust score. This eliminates the need to set additional manual weight adjustment parameters, avoiding the significant decrease in main task accuracy caused by overly strict fixed thresholds, or the increase in backdoor attack success rate caused by overly lenient fixed thresholds.

[0018] This invention only requires the client to upload the model or model update, without uploading the original CTI data. It can achieve collaborative defense under the privacy and compliance constraints of multiple organizations, and can be deployed in information warfare defense command centers, alliance CTI platforms, security operations centers, edge gateway clusters, or industrial internet security platforms. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0020] Figure 1 This is a schematic diagram of the overall architecture for collaborative defense of federal threat intelligence according to an embodiment of the present invention;

[0021] Figure 2 This is a flowchart of a secure aggregation method according to an embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of the module structure of a federal threat intelligence security aggregation system according to an embodiment of the present invention.

[0023] Figure labeling: 100—Defense Center / Server; 110—Update Receiving Module; 120—Auxiliary Model Construction Module; 130—Trigger Reverse Reasoning Module; 140—Anomaly Tag Identification Module; 150—Client Scoring Module; 160—Game Theory Solving Module; 170—Security Aggregation Module; 180—Global Update Module; 200—Client Group; 210—Honest Client Group; 220—Malicious Client Group; 300—Auxiliary Global Model; 400—Trigger Reverse Unit; 500—Attack and Defense Game Theory Unit; 600—Security Aggregation Unit; 700—Global Model; 800—Electronic Device. Detailed Implementation

[0024] The present invention will be further described below with reference to the accompanying drawings and embodiments. The embodiments are used to illustrate the technical concept of the present invention and do not constitute a limitation on the scope of protection. Those skilled in the art can make equivalent substitutions for the model structure, optimizer, scoring function, game-solving method, and parameter range without departing from the technical concept of the present invention.

[0025] Example 1: System Architecture and Threat Model

[0026] See Figure 1 The defense center / server 100 communicates with multiple clients 200. These clients can consist of sensors, edge gateways, honeypot nodes, intrusion detection systems, threat intelligence gathering nodes, or security operations platforms from different organizations. Honest client group 210 trains on local data and submits normal model updates; suspected malicious client group 220 may be controlled by the attacker, performing hybrid submissions, label flipping, model replacement, or trigger injection, and dynamically changing the poisoning intensity based on server feedback.

[0027] The attack objective is to predict an input containing a specific triggering pattern as the target category without significantly degrading the classification performance of clean samples. The target category can be a normal category or any threat category that the attacker wishes to induce. The defense objective is to reduce the attack success rate of triggered samples while maintaining the main task performance of clean samples, without knowing the true trigger, the true target label, or the identity of the malicious client.

[0028] Server 100 holds a small number of verified, clean verification sets. The validation set does not need to cover the entire data distribution of each client, but should include samples used to evaluate the performance of the main task, and preferably cover multiple labels. The server does not receive the client's raw training data; the client only submits local model parameters, model updates, sample size, and necessary training epoch metadata.

[0029] Example 2: Data Preprocessing and Local Training

[0030] CTI input can be represented as a d-dimensional feature vector x∈ And the label y∈Y. For network traffic table data, numerical features can be quantized and then min-max normalized or standardized; categorical features can be one-hot encoded, target encoded, or embedded encoded; missing values ​​can be filled using training set statistics. To ensure the semantic validity of the triggering pattern, discrete constraints, upper and lower bound constraints, or monotonic constraints are set for features such as protocol type, port, count, duration, number of bytes, and ratio.

[0031] Each client receives the global model for round t from the server. Local data Perform E local training cycles to obtain the local model. or model update The model can employ a multilayer perceptron, a one-dimensional convolutional network, a recurrent neural network, a Transformer encoder, or a combination thereof. Taking a multilayer perceptron as an example, the input layer dimension is d, the hidden layers can be set to 128 and 64 neurons respectively and activated using ReLU, and the output layer dimension is the number of labels C.

[0032] To suppress abnormal updates of model replacement classes, the server performs checks on each... Perform norm clipping: If Then replace it with ,in To update the norm upper limit, the server also checks the updated dimension, NaN value, infinity value, and model version identifier; updates that do not meet the requirements are not included in subsequent aggregations.

[0033] Example 3: Assisting in Global Model Construction

[0034] See Figure 2 In step S2, the server uses the current global model Based on this, perform initial aggregation on the K client updates that pass the verification. The auxiliary global model parameters can be calculated using the following formula: , ≥ 0, = 1.

[0035] in, It can be set to 1 / K. The role of the auxiliary global model is not to serve as the final model directly, but to aggregate normal functions and potential backdoor functions in this round of updates, providing detectable objects for subsequent trigger reverse engineering. To reduce the impact of a single extreme update, the initial aggregation can also use the median of coordinates, the truncated mean, or a pruned-then-averaged approach.

[0036] Example 4: Reverse Reasoning of CTI Feature Triggers Without Prior Knowledge

[0037] For each candidate target label y in the label set Y, initialize the feature mask parameters. and trigger mode parameters .pass =sigmoid( Constrain the mask to {0,1}, and then project it using the projection function corresponding to the feature type. Mapped to valid triggering modes. After injecting candidate triggers into the validation sample x, the following is obtained: .

[0038] Freeze the auxiliary global model Using a small batch of validation samples as input, optimize the following objective function for the candidate target label y: .

[0039] The first term makes the sample after the injection trigger predicted as the candidate target label y; the second term makes the mask sparse, thereby searching for triggers with fewer modified features. It is a non-negative hyperparameter.

[0040] The optimizer can be Adam. Each iteration includes: from Sample mini-batch samples, inject candidate triggers, perform model inference, calculate loss, backpropagation, and update. and Perform boundary projection. Iteration continues until the maximum number of iterations is reached. The target label prediction ratio has reached the threshold. And stop when the mask size no longer decreases, or when the loss changes are less than the threshold for several consecutive times.

[0041] For each label y, record the optimal mask. Triggering mode and normalized mask size To avoid misjudgment based solely on a single optimization result, multiple random initializations can be used for repeated optimization, and the result that simultaneously meets the trigger success rate threshold and has the smallest mask size can be selected.

[0042] Example 5: Target Label Anomaly Detection

[0043] After all candidate labels have been reverse-engineered, calculate the mask size set. the median of And the absolute deviation of the median (MAD): , .

[0044] Since backdoor target tags can typically be driven by smaller triggers, an anomaly index is defined for small mask anomalies: .

[0045] Where b can take the value 1.4826 or other scale correction constants. If Then The tag was identified as a suspected backdoor target and will be... If the label is determined to be a reverse trigger, and there is no label exceeding the threshold, the backdoor target label will not be directly determined in the current round, and the trigger risk component will be set to zero or the consistent result of multiple rounds in the past will be used.

[0046] Example 6: Client Trust Scoring

[0047] For the i-th client model The server selects M clean validation samples. And generate using a reverse trigger Each client's trust score is , of which Clean validation set on the server side For the prediction function, The trigger was obtained through reverse reasoning. The target label is obtained through reverse reasoning.

[0048] Example 7: Solving a Dynamic Attack-Defense Game

[0049] The attack strategy is to select from the candidate set Optimal poisoning ratio in medium grid search For each proportion in the set In the local training set, A provisional local model is trained on a dataset by adding triggers to a proportion of samples and modifying the labels to the target category. This provisional model is then tested on a locally retained validation set using real triggers, and the trust score is simulated. Calculate the current Total revenue below Compare all candidates Choose the one with the highest total return. The poisoning ratio was ultimately selected for this round. The defense strategy, without knowing who the malicious client is, is to find a "feature modification" and target category, perform a simple average aggregation of all received updates to obtain an auxiliary global model containing malicious intent, then perform reverse reasoning, and finally perform a trust score.

[0050] The server reverse-engineers the triggers and target categories, assigns low scores to malicious clients, and the attacker performs a grid search for the optimal poisoning ratio, injects a backdoor while maintaining a high score, thus constructing an attack-defense game: ,in The trigger was obtained through reverse reasoning. The target label is obtained through reverse reasoning. For the candidate set of poisoning ratios, The trigger was selected by the attacker.

[0051] Example 8: Trusted Weighted Aggregation and Feedback

[0052] No. The final aggregate weight for each client is Then perform safe average aggregation to ,in This is the final global model for this round. This is the initial global model for this round.

[0053] The server saves the current round. Aggregate the results and distribute them to the client. The same method will be used for defense and training in the next round. This will prevent malicious clients from evading single-round detection by switching between normal updates and poisoned updates.

[0054] Example 9: System, Device, and Storage Medium

[0055] See Figure 3 The Federal Threat Intelligence Security Aggregation System includes an update receiving module 110, an auxiliary model building module 120, a trigger reverse reasoning module 130, an anomaly label identification module 140, a client scoring module 150, a game-theoretic solving module 160, a security aggregation module 170, and a global update module 180. Each module can be implemented as an independent software service or as a functional component within the same federated learning server process.

[0056] The electronic device 800 includes at least one processor, memory, communication interface, and system bus. The memory stores program instructions implementing the above methods, a global model, a validation set index, historical scores, and policy parameters. The processor executes program instructions to complete model update reception, trigger reversal, scoring, game solving, and aggregation. The communication interface is used for securely transmitting model parameters or model updates to the client.

[0057] The computer-readable storage medium may be a read-only memory, random access memory, solid-state drive, magnetic disk, optical disk, or a network-accessible storage medium. When a program stored on the medium is executed by a processor, it implements the method steps of any of the foregoing embodiments.

Claims

1. A method for the secure aggregation of federal threat intelligence for cyber information warfare, characterized in that, Executed by the federated learning server in the t-th round of federated training, including: S1: Receive local models or model updates trained by K participating clients based on their respective local threat intelligence data, and perform dimensional consistency verification, norm pruning and sample size registration on the model updates; S2: Aggregate the model updates according to the preset initial aggregation rules to construct an auxiliary global model containing the client update information of the current round; S3: Freeze the auxiliary global model, and for each candidate target label in the label set, use the server-side clean verification samples to jointly optimize the feature mask and triggering mode to obtain the candidate trigger corresponding to each candidate target label; S4: Calculate the median absolute deviation anomaly index based on the mask size of each candidate trigger to determine the suspected backdoor target label and the inverse trigger corresponding to the suspected backdoor target label; S5: Inject the reverse trigger into the clean verification sample on the server side, input it into the local model corresponding to each client, and calculate the trust score of each local model. S6: Based on the changes in model behavior caused by the attacker's dynamic adjustment of the poisoning ratio, and combined with reverse reasoning, perform functional response analysis on each client model to obtain the client's basic trust score, and establish a dynamic game solution process based on the attack behavior changes and trust score feedback. S7: Determine the aggregation weight of each client based on the client sample size, the trust score, and the defense strategy parameters, complete the trust-weighted aggregation to update the global model, and feed back the updated global model and score for the next round of federated training.

2. The method according to claim 1, characterized in that, The local threat intelligence data includes at least one of the following: network traffic statistics features, router or firewall log features, IoT device telemetry features, intrusion detection alarm features, and vulnerability and attack indicator features; the client only uploads the local model or model update, and does not upload the original threat intelligence data.

3. The method according to claim 1, characterized in that, The auxiliary global model in step S2 is obtained by the following formula: ,in, These are the global model parameters at the start of round t. For the model update of the i-th client, To meet and The initial aggregation coefficients; the initial aggregation coefficients are coefficients normalized according to the client sample size or equal coefficients.

4. The method according to claim 1, characterized in that, In step S3, for candidate target labels Clean verification samples Transform into and minimize the objective function ,in, For a feature mask with values ​​in the range {0,1}, This is a trigger mode constrained by the valid value range of each feature. To assist the global model, The weights are non-negative; gradient optimization algorithm is used for iterative updates. and And perform boundary projection after each update.

5. The method according to claim 4, characterized in that, Step S4 includes: calculating the normalized mask size. ,calculate and And calculate the anomaly index. ,in The input feature dimension, is a scale constant; when Greater than the abnormal threshold At that time, Identified as a suspected backdoor target tag, and ( *, *) is determined to be a reverse trigger.

6. The method according to claim 1, characterized in that, In step S5 Trust rating for each client Depend on Obtained, of which Clean validation set on the server side For the prediction function, The trigger was obtained through reverse reasoning. The target label is obtained through reverse reasoning.

7. The method according to claim 1, characterized in that, The attack strategy in step S6 is to select from the candidate set. Optimal poisoning ratio in medium grid search For each proportion in the set In the local training set, A provisional local model is trained on a dataset by adding triggers to a proportion of samples and modifying the labels to the target category. This provisional model is then tested on a locally retained validation set using real triggers, and the trust score is simulated. Calculate the current Total revenue below Compare all candidates Choose the one with the highest total return. The poisoning ratio is selected as the final poisoning ratio in this round. The defense strategy is to find a "feature modification" and target category without knowing who the malicious client is, perform a simple average aggregation of all received updates to obtain an auxiliary global model containing malicious intent, then use claims 4 and 5 for reverse reasoning, and finally use claim 6 for trust scoring. The server reverse-reasons the trigger and target category, assigns a low score to the malicious client, and the attacker performs a grid search for the optimal poisoning ratio, injects a backdoor, and maintains a high score, thus constructing an attack-defense game: ,in The trigger was obtained through reverse reasoning. The target label is obtained through reverse reasoning. For the candidate set of poisoning ratios, The trigger was selected by the attacker.

8. The method according to claim 7, characterized in that, No. The final aggregate weight of each client is The safe average aggregation in step S7 is ,in This is the final global model for this round. This is the initial global model for this round.

9. A federal threat intelligence security aggregation system for cyber information warfare, characterized in that, include: The update receiving module is used to receive client models or model updates; the auxiliary model building module is used to perform initial aggregation and build an auxiliary global model. The trigger inversion module is used to optimize feature masks and trigger modes for candidate target labels; the abnormal label identification module is used to determine suspected backdoor target labels based on the median absolute deviation. The client rating module is used to calculate the trust score for each client. The game theory module is used to construct and solve the offensive and defensive game between the poisoning ratio and the trust score. The security aggregation module is used to determine the aggregation weight based on the client sample size, trust score, and defense strategy parameters. And a global update module, used to update and distribute the global model.

10. An electronic device, comprising a processor, a memory, and a communication interface, characterized in that, The memory stores a program that, when executed by the processor, causes the electronic device to perform the method described in any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 8.

Images