A satellite network intrusion detection method based on adaptive federated knowledge distillation

Abstract

The present application relates to the technical field of satellite network security detection, in particular to a satellite network intrusion detection method based on adaptive federated knowledge distillation. The method obtains local satellite network traffic data of each client and server-side proxy dataset, and performs feature alignment; the server determines the participating clients within the communicable contact window, obtains the client logits based on the proxy samples, determines the sample-level entropy weight according to the prediction entropy of the client soft class distribution, and fuses to obtain the global teacher logits and the global teacher distribution; the client updates the local intrusion detection model in combination with the supervised detection loss and the distillation loss, and the trained model is used for intrusion category determination on the to-be-detected traffic of the satellite node or the on-board gateway.

Description

Technical Field

[0001] This invention relates to the field of satellite network security detection technology, specifically to an adaptive federated knowledge distillation method for satellite network intrusion detection. Background Technology

[0002] Satellite network intrusion detection methods are primarily applied to communication scenarios such as low-Earth orbit satellite constellations, inter-satellite links, satellite-to-ground links, and on-board gateways. These methods are used to identify security threats such as abnormal access, protocol abuse, malicious forwarding, and denial-of-service attacks. Existing methods typically collect network traffic characteristics, protocol fields, and link status information, and then use centralized detection models or distributed machine learning models to determine traffic categories, thereby achieving secure monitoring of the satellite network's operational status.

[0003] However, satellite networks suffer from limitations such as limited link contact windows, tight communication bandwidth, significant differences in onboard computing power, and sensitivity to local traffic data. Centralized models struggle to continuously aggregate raw data; conventional federated learning relies on model parameter aggregation, which can easily lead to knowledge fusion distortion when client data is not independently and identically distributed and detection models are heterogeneous; fixed aggregation methods also fail to differentiate the predictive reliability of different clients for different proxy samples, affecting the collaborative training effect of intrusion detection models. Therefore, an adaptive federated knowledge distillation method for satellite network intrusion detection is needed to address these issues. Summary of the Invention

[0004] To address the above problems, this invention provides the following technical solution: an adaptive federated knowledge distillation method for satellite network intrusion detection, comprising: S1. In a collaborative intrusion detection network consisting of multiple satellite nodes or on-board gateways, acquire local satellite network traffic data and server-side proxy datasets from each client, and perform feature alignment to obtain local training samples and proxy samples with consistent feature dimensions and consistent output category space. S2. The server determines the set of participating clients within the communicable contact window in the current communication round and provides the participating clients with the current proxy sample information. Each participating client determines the proxy sample based on the current proxy sample information, outputs the client logits using the local intrusion detection model, and uploads them to the server. S3. The server generates client soft class distribution and prediction entropy based on the client logits corresponding to the same proxy sample, determines the sample-level entropy weight based on the prediction entropy, and fuses the client logits according to the sample-level entropy weight to obtain global teacher logits and global teacher distribution. S4. The server distributes the global teacher distribution to the participating clients. Each participating client updates its local intrusion detection model based on the supervised detection loss of the local training samples and the distillation loss corresponding to the proxy samples, and iterates the training until the stopping condition is met. S5. Use the trained local intrusion detection model to determine the intrusion category of the satellite network traffic collected by the corresponding satellite node or on-board gateway, and output the intrusion detection results.

[0005] Furthermore, the feature alignment includes: Extract flow-level statistical features, DTN / CCSDS protocol semantic features, and dynamic link state features from the local satellite network traffic data and the proxy dataset; The normal traffic labels and attack traffic labels in the local satellite network traffic data are mapped according to a preset attack category space; The field order, numerical scale, missing value identifier, and model output dimension of the local training samples and the proxy samples are unified; The proxy dataset is either a public sample set or a synthetic sample set that does not contain real labels.

[0006] Furthermore, the semantic features of the DTN / CCSDS protocol include at least one of the following: protocol type field, frame structure field, forwarding status field, and inter-satellite or satellite-to-ground link identifier field; and the dynamic link status features include at least one of the following: link delay, packet loss status, link interruption status, and communicable contact window status.

[0007] Furthermore, the current proxy sample information includes the current proxy sample or the current proxy sample index, and the server provides the current proxy sample information to the participating clients, including: The server determines the subset of proxy samples to be used in the current communication round from the proxy dataset; When the participating client has not preset the proxy dataset, send the current proxy sample in the proxy sample subset to the participating client; When a participating client has the aforementioned proxy dataset pre-configured, the current proxy sample index corresponding to the proxy sample subset is sent to the participating client. Send preset temperature parameters to participating clients to generate client soft category distributions.

[0008] Furthermore, the local intrusion detection model is a heterogeneous detection model that matches the computing and storage resources of the participating clients. Local intrusion detection models of different participating clients are allowed to have different network structures or parameter scales, but each local intrusion detection model has the same output category space. When each participating client uploads client logits, it carries the proxy sample identifier and communication round identifier, but does not upload local training samples and complete model parameters.

[0009] Furthermore, the client soft category distribution is obtained by scaling the client logits with a preset temperature parameter and then applying the Softmax function. The prediction entropy is the Shannon entropy of the client soft category distribution. The sample-level entropy weight is obtained by normalizing the prediction entropy using a decreasing function, so that participating clients with lower prediction entropy under the same agent sample have higher aggregation weights.

[0010] Furthermore, when the server allocates sample-level entropy weights, it uses the participating clients that are within the communicable contact window and have completed the client logits upload in the current communication round as the weight normalization object; when the number of participating clients corresponding to the same proxy sample is one, the sample-level entropy weight corresponding to that participating client is set to 1.

[0011] Furthermore, the global teacher logits are obtained by weighting and summing the client logits of each participating client under the same agent sample according to the corresponding sample-level entropy weight, and the global teacher distribution is obtained by scaling the global teacher logits with a preset temperature parameter and then passing it through the Softmax function.

[0012] Furthermore, each participating client updates its local intrusion detection model based on the supervised detection loss of the local training samples and the distillation loss corresponding to the proxy samples, including: The supervised detection loss is calculated based on the true labels of the local training samples and the category prediction results output by the local intrusion detection model for the local training samples. The distillation loss is calculated based on the difference between the client soft-class distribution of the participating clients' output of the proxy samples and the corresponding global teacher distribution; The supervised detection loss and the distillation loss are combined into a local training target according to preset distillation weights; Update the parameters of the local intrusion detection model based on the local training objective.

[0013] Furthermore, the stopping condition is that the current communication round reaches a preset number of communication rounds; if the current communication round does not reach the preset number of communication rounds, the updated local intrusion detection model is used as the local intrusion detection model for the next communication round.

[0014] Compared with the prior art, the present invention has the following beneficial effects: An adaptive federated knowledge distillation method for satellite network intrusion detection is proposed. This method utilizes proxy samples to transfer detection knowledge between satellite nodes or onboard gateways, allowing clients to participate in collaborative training without uploading their original local traffic data and complete model parameters. This reduces data transmission pressure under constrained satellite network links and avoids the problem of difficulty in directly aggregating parameters when model structures of different onboard devices are inconsistent. By allocating sample-level entropy weights based on the prediction entropy of each participating client on the same proxy sample, client knowledge with lower prediction uncertainty has a higher proportion in the global teacher logits fusion, thereby reducing the interference of non-independent identically distributed traffic and local class skew on teacher knowledge construction. Furthermore, by distributing the global teacher distribution to clients and updating the local intrusion detection model using local supervised detection loss and proxy sample distillation loss, each client can absorb effective detection knowledge from other nodes while retaining the adaptability of local traffic characteristics. This enhances the collaborative identification capability of the satellite network intrusion detection model for attack traffic such as abnormal access, protocol abuse, malicious forwarding, and denial-of-service attacks. Attached Figure Description

[0015] Figure 1 A schematic diagram of the overall process of an adaptive federated knowledge distillation satellite network intrusion detection method provided by the present invention; Figure 2 This is a schematic diagram of the satellite network composition and link types provided by the present invention; Figure 3 This is a schematic diagram of the heterogeneous satellite network protocol domain and satellite-ground cooperative communication provided by the present invention; Figure 4 This is a schematic diagram of the satellite-ground collaborative distributed intrusion detection process provided by the present invention; Figure 5 This is a schematic diagram of a satellite network intrusion attack scenario and detection topology provided by the present invention; Figure 6 The accuracy convergence curves of different federated detection methods on the CIC-IDS-2017 dataset provided by this invention are shown. Figure 7 This is a comparison chart of the detection performance of different federated detection methods on the CIC-IDS-2017 dataset provided by this invention. Figure 8 The accuracy convergence curves of different federated detection methods on the SatNIDS dataset provided by this invention are shown. Figure 9 This is a comparison chart of the detection performance of different federated detection methods on the SatNIDS dataset provided by this invention; Figure 10 This invention provides a comparison chart of Macro-F1 sensitivity under different Non-IID intensities. Figure 11 A comparative ablation experiment of the adaptive federated knowledge distillation method provided by this invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0018] Please see Figure 1 This invention provides an adaptive federated knowledge distillation method for satellite network intrusion detection, comprising: S1. In a collaborative intrusion detection network consisting of multiple satellite nodes or on-board gateways, acquire local satellite network traffic data and server-side proxy datasets from each client, and perform feature alignment to obtain local training samples and proxy samples with consistent feature dimensions and consistent output category space. Specifically, this step is used to generate a unified input object required for subsequent federated knowledge distillation. For example... Figure 2 As shown, a collaborative intrusion detection network can be deployed in a satellite network environment consisting of GEO, MEO, LEO satellite links, satellite-to-ground links, gateway ground stations, and user terminals; such as Figure 3 As shown, different satellite nodes or on-board gateways can correspond to different protocol domains such as CCSDS, TCP / IP, and DTN. Each client collects satellite network traffic data from its assigned satellite node or on-board gateway. This local satellite network traffic data includes traffic statistics fields, protocol encapsulation fields, link status fields, and corresponding local detection tags. The server-side proxy dataset is maintained by the server and serves as a common or synthetic sample set for each client to express detection knowledge in the same input space. During feature alignment, the local satellite network traffic data and proxy dataset are converted into data representations with the same field order, the same feature dimensions, and the same output category space. This ensures that even if different clients use different local intrusion detection models, they can still output comparable client logits around the same type of proxy samples.

[0019] Furthermore, in one embodiment provided in this application, the feature alignment includes: Extract flow-level statistical features, DTN / CCSDS protocol semantic features, and dynamic link state features from the local satellite network traffic data and the proxy dataset; The normal traffic labels and attack traffic labels in the local satellite network traffic data are mapped according to a preset attack category space; The field order, numerical scale, missing value identifier, and model output dimension of the local training samples and the proxy samples are unified; The proxy dataset is either a public sample set or a synthetic sample set that does not contain real labels.

[0020] Specifically, flow-level statistical features are used to describe the number of packets, bytes, duration, directional statistics, and rate changes in a unit communication session or traffic segment; DTN / CCSDS protocol semantic features are used to describe the meaning of forwarding, encapsulation, and frame structure in space network protocols; dynamic link state features are used to describe the communication state of satellite networks under visible window, link interruption, and link damage conditions. The server-side proxy dataset does not rely on real labels; its role is not to directly supervise training, but to provide consistent knowledge representation input to each client. The preset attack category space can include normal categories and several attack categories. After the client maps its local labels to this category space, local training samples are used to calculate the supervised detection loss, and proxy samples are used to output client logits. Unified field order avoids model input misalignment due to different field arrangements at different nodes; unified numerical scale ensures that features such as latency, packet count, and byte count from different sources are within the trainable range; unified missing value identification provides clear encoding when the link is invisible or the field has not been collected; and unified model output dimension ensures that the logits output by each client correspond to the same attack category position.

[0021] Furthermore, in one embodiment provided in this application, the semantic features of the DTN / CCSDS protocol include at least one of a protocol type field, a frame structure field, a forwarding status field, and an inter-satellite or satellite-to-ground link identifier field, and the dynamic link status features include at least one of a link delay, packet loss status, link interruption status, and communicable contact window status.

[0022] Specifically, the protocol type field distinguishes whether the current traffic belongs to DTN, CCSDS, or other satellite network bearer protocols; the frame structure field describes the encoding of space link frame headers, payload lengths, control fields, or security-related fields in the sample; the forwarding status field reflects states such as store-and-forward, retransmission, routing wait, or forwarding failure; and the inter-satellite or satellite-to-ground link identifier field distinguishes the link source corresponding to the sample. Link latency, packet loss status, link interruption status, and communicable contact window status collectively reflect the dynamic availability of satellite network links, enabling the local intrusion detection model to interpret the source of abnormal traffic not only based on general network statistics but also by combining space network protocols and link environment. For example, in Figure 3 Under different protocol domains, the same type of attack may manifest as anomalies in different protocol fields; Figure 2 As shown in the multi-layer satellite link diagram, similar services may have different latency and interruption characteristics at different orbital layers and different link types.

[0023] S2. The server determines the set of participating clients within the communicable contact window in the current communication round and provides the participating clients with the current proxy sample information. Each participating client determines the proxy sample based on the current proxy sample information, outputs the client logits using the local intrusion detection model, and uploads them to the server. Specifically, this step is used to complete the distribution of proxy samples and the uploading of client knowledge within the current communication round. For example... Figure 4 As shown, during the onboard detection phase, satellite nodes detect local links and protocol traffic. The ground side or server updates its global teacher knowledge after receiving client logits corresponding to proxy samples. The server determines clients within the communicable contact window based on ephemeris, link visibility, or gateway scheduling results, forming a set of participating clients. Each participating client uses its current local intrusion detection model to perform forward inference on the current proxy sample, outputting client logits corresponding to a preset attack category space. Client logits represent the unnormalized response strength of the local model to each category within the same proxy sample; they include attack identification knowledge learned by the local model but do not include raw local traffic data. After receiving client logits uploaded by each participating client, the server can construct global teacher knowledge without requiring each client to upload model parameters.

[0024] Furthermore, in one embodiment provided in this application, the current proxy sample information includes a current proxy sample or a current proxy sample index, and the server provides the current proxy sample information to the participating clients, including: The server determines the subset of proxy samples to be used in the current communication round from the proxy dataset; When the participating client has not preset the proxy dataset, send the current proxy sample in the proxy sample subset to the participating client; When a participating client has the aforementioned proxy dataset pre-configured, the current proxy sample index corresponding to the proxy sample subset is sent to the participating client. Send preset temperature parameters to participating clients to generate client soft category distributions.

[0025] Specifically, the surrogate sample subset can be extracted sequentially from the surrogate dataset according to the communication rounds, or the extraction scale can be determined based on the current available communication window length, the number of participating clients, and the available bandwidth of the satellite link. When a participating client does not have a pre-set surrogate dataset, the server directly sends the current surrogate sample, enabling the client to immediately perform forward inference. When a participating client has a pre-set surrogate dataset, the server only sends the current surrogate sample index, and the client reads the corresponding surrogate sample from its local pre-set surrogate dataset based on the index, reducing the amount of data transmitted via satellite-to-ground or inter-satellite links. A preset temperature parameter is used to subsequently convert client logits into a client soft-class distribution. This parameter can be uniformly distributed by the server in each communication round, ensuring that participating clients and the server use a consistent calculation scale when softening the prediction distribution.

[0026] Furthermore, in one embodiment provided in this application, the local intrusion detection model is a heterogeneous detection model that matches the computing and storage resources of the participating clients. Local intrusion detection models of different participating clients are allowed to have different network structures or parameter scales, but each local intrusion detection model has the same output category space. When each participating client uploads client logits, it carries the proxy sample identifier and communication round identifier, but does not upload local training samples and complete model parameters.

[0027] Specifically, low-computing-power satellite nodes can employ lightweight multilayer perceptrons or one-dimensional convolutional models, while on-board gateways or nodes with sufficient resources can use larger-scale temporal detection models. Different local intrusion detection models do not need to have the same number of layers, parameter shapes, or parameter quantities. As long as the final output dimension is consistent with the preset attack category space, aggregateable client logits can be generated on the same proxy sample. The proxy sample identifier is used by the server to merge multiple client logits corresponding to the same proxy sample into the same aggregation object, and the communication round identifier is used to distinguish the knowledge upload results in different training rounds. The client does not upload local training samples and complete model parameters, keeping local sensitive traffic data within the satellite node or on-board gateway, while avoiding the problem of heterogeneous models being unable to be directly aggregated due to inconsistent parameter structures.

[0028] S3. The server generates client soft class distribution and prediction entropy based on the client logits corresponding to the same proxy sample, determines the sample-level entropy weight based on the prediction entropy, and fuses the client logits according to the sample-level entropy weight to obtain global teacher logits and global teacher distribution. Specifically, the server uses the proxy sample identifier as an index to group client logits from different participating clients for the same proxy sample. For participating clients... In proxy samples Client logits output above The server uses preset temperature parameters. Generate client-side soft category distribution:

[0029] in, Indicates participation from the client For proxy samples Belongs to the The soft-class probability of each attack category. This represents the client logits component of the corresponding category. Indicates the number of output categories. This represents the preset temperature parameter. Temperature scaling allows the model's responses to non-maximum class responses to participate in knowledge representation, avoiding the loss of similarity relationships between attack classes caused by using only hard-class results.

[0030] The server calculates the prediction entropy based on the client's soft category distribution:

[0031] in, Indicates participation from the client For proxy samples The prediction entropy. A lower prediction entropy indicates a more concentrated class judgment by the participating client regarding the proxy sample; a higher prediction entropy indicates a less certain judgment by the participating client regarding the proxy sample. Based on this, the server determines a sample-level entropy weight for each proxy sample individually, for example:

[0032] in, Indicates participation from the client In proxy samples On the sample-level entropy weight, Represents the weighted smoothing parameter. Indicates the proxy sample in the current communication round The set of participating clients that have completed client-side logits upload. Through this calculation method, the client-side logits of low-entropy clients on their corresponding proxy samples contribute more to the global teacher logits, while the low-confidence knowledge of high-entropy clients is relatively suppressed.

[0033] Furthermore, in one embodiment provided in this application, the client soft category distribution is obtained by scaling the client logits with a preset temperature parameter and then applying the Softmax function. The prediction entropy is the Shannon entropy of the client soft category distribution. The sample-level entropy weight is obtained by normalizing the prediction entropy using a decreasing function, so that participating clients with lower prediction entropy under the same proxy sample have higher aggregation weights.

[0034] Specifically, the client-side soft-category distribution preserves the local intrusion detection model's judgment on the similarity between multiple attack categories. When a satellite node has long-term coverage of a specific area, specific protocol service, or specific link environment, its local model may have lower prediction entropy for the corresponding type of proxy samples; conversely, when another satellite node lacks corresponding attack samples or is under a strong Non-IID data distribution, its prediction entropy may be higher. The server uses a decreasing function of prediction entropy to allocate sample-level entropy weights, ensuring that each proxy sample receives greater knowledge contribution from participating clients who are more proficient in the semantics of that sample, rather than using a fixed equal-weight fusion for all clients.

[0035] Furthermore, in one embodiment provided in this application, when the server allocates sample-level entropy weights, it uses the participating clients that are within the communicable contact window and have completed the client logits upload in the current communication round as the weight normalization object; when the number of participating clients corresponding to the same proxy sample is one, the sample-level entropy weight corresponding to that participating client is set to 1.

[0036] Specifically, satellite links exhibit periodic visibility and interruption characteristics. The server does not include clients not within the communicable contact window in the current communication round in the weight normalization object, nor does it wait for clients that have not completed their logits uploads. For the same proxy sample, weights are calculated only using the set of participating clients that have already received client logits, which can adapt to... Figure 2 The multi-layer satellite link shown Figure 4 The diagram illustrates the changes in the contact window during the satellite-ground collaborative detection process. When a proxy sample receives client logits from only one participating client in the current communication round, the entropy weight of that participating client sample is set to 1. The server can still generate the corresponding global teacher logits, thus avoiding training round interruptions due to insufficient participating clients.

[0037] Furthermore, in one embodiment provided in this application, the global teacher logits are obtained by weighting and summing the client logits of each participating client under the same agent sample according to the corresponding sample-level entropy weight, and the global teacher distribution is obtained by scaling the global teacher logits with a preset temperature parameter and then passing it through the Softmax function.

[0038] Specifically, the server for the same proxy sample The global teacher logits are calculated as follows:

[0039] in, Indicates proxy sample The corresponding global teacher logits. Then, the server converts the global teacher logits into a global teacher distribution:

[0040] in, Represents the distribution of teachers in the global teacher distribution. The global teacher logits preserve the relative class responses of each participating client in the logits space. Weighted fusion of logits before generating the global teacher distribution avoids excessive attenuation of inter-class response amplitudes for high-confidence clients caused by directly averaging the probability distribution. The global teacher distribution, as teacher knowledge aggregated on the server side, is distributed to participating clients in the next step for calculating the distillation loss.

[0041] S4. The server distributes the global teacher distribution to the participating clients. Each participating client updates its local intrusion detection model based on the supervised detection loss of the local training samples and the distillation loss corresponding to the proxy samples, and iterates the training until the stopping condition is met. Specifically, the server associates the global teacher distribution with the corresponding proxy sample identifier and distributes it to the participating clients. Upon receiving this information, the participating clients use their local training samples for supervised training and the proxy samples and their corresponding global teacher distributions for distillation training. The supervised detection loss constrains the local intrusion detection model to maintain its ability to identify local satellite network traffic categories; the distillation loss constrains the local intrusion detection model's output on proxy samples to approximate the global teacher distribution, enabling the client to absorb effective detection knowledge from other satellite nodes or on-board gateways. This update process allows... Figure 5 When an attacker affects a satellite network via ground stations, firewalls, satellite-to-ground links, or inter-satellite links, the attack identification experience learned by nodes at different locations can be collaboratively transmitted through proxy sample knowledge exchange.

[0042] Furthermore, in one embodiment provided in this application, each participating client updates its local intrusion detection model based on the supervised detection loss of the local training samples and the distillation loss corresponding to the proxy samples, including: The supervised detection loss is calculated based on the true labels of the local training samples and the category prediction results output by the local intrusion detection model for the local training samples. The distillation loss is calculated based on the difference between the client soft-class distribution of the participating clients' output of the proxy samples and the corresponding global teacher distribution; The supervised detection loss and the distillation loss are combined into a local training target according to preset distillation weights; Update the parameters of the local intrusion detection model based on the local training objective.

[0043] Specifically, participating clients will form supervised training batches from their local training samples and distilled training batches from the proxy samples corresponding to the current communication round. For local training samples... The local intrusion detection model outputs category prediction results. The monitoring and detection loss can be expressed as:

[0044] in, Indicates the local training batch size. Indicates when the real label For the first Set to 1 if the condition is met, otherwise set to 0. (For proxy samples) Participating in client-side calculations of their own client-side soft category distribution and the global teacher distribution issued by the server. In comparison, the distillation loss can be expressed as:

[0045] in, Indicates the batch size of the agent sample. This indicates the current batch of agent samples. Participating clients are selected according to preset distillation weights. Combining two types of losses:

[0046] in, Indicates participation from the client The local training objective, The range of values ​​is Local model parameters are based on The gradient is updated. Supervised detection loss allows the local model to continue to adapt to the local traffic distribution, while distillation loss aligns the local model with the global teacher distribution on surrogate samples. Together, they limit model drift caused by local class skew.

[0047] Furthermore, in one embodiment provided in this application, the stopping condition is that the current communication round reaches a preset number of communication rounds; when the current communication round does not reach the preset number of communication rounds, the updated local intrusion detection model is used as the local intrusion detection model for the next communication round.

[0048] Specifically, the server is pre-configured with a preset number of communication rounds. And maintain a round identifier for each communication round. .when When participating clients complete their local intrusion detection model updates, the updated model becomes the local intrusion detection model for the next communication round. In the next communication round, the server re-determines the set of participating clients within the communicable contact window and continues to perform proxy sample information provision, client logits uploading, entropy weight fusion, and distillation updates. At this point, the server stops federated knowledge distillation training, and each client retains the local intrusion detection model obtained from the last update. This stopping condition does not depend on the server receiving complete model parameters and is suitable for training scenarios where the satellite link contact window is limited and the client's online status changes.

[0049] S5. Use the trained local intrusion detection model to determine the intrusion category of the satellite network traffic collected by the corresponding satellite node or on-board gateway, and output the intrusion detection results.

[0050] Specifically, after training, each satellite node or on-board gateway deploys its corresponding trained local intrusion detection model. When traffic from the satellite network to be detected enters the detection process, the client extracts flow-level statistical features, DTN / CCSDS protocol semantic features, and dynamic link state features according to the feature alignment rules in S1, and inputs these into the trained local intrusion detection model. The model outputs category prediction results corresponding to a preset attack category space. These prediction results can include normal traffic categories, abnormal access categories, protocol abuse categories, malicious forwarding categories, or denial-of-service categories. The client can generate intrusion alarms, attack category identifiers, and corresponding proxy sample knowledge source records based on the category prediction results, enabling the satellite node or on-board gateway to... Figure 5 Localized intrusion identification is performed in the attack scenarios of satellite-to-ground links, inter-satellite links, and relay links shown.

[0051] Combination Figures 5 to 11 In one verification embodiment, the detection effect of the present invention is explained. Figure 5 This paper illustrates an attack scenario where attackers influence a target satellite via ground stations, firewalls, satellite-to-ground links, and relay satellites, demonstrating that the present invention can be used for intrusion detection under mixed attack conditions involving ground entry points, satellite-to-ground links, and inter-satellite links in satellite networks. In this scenario, the attack characteristics observed by different clients are not entirely identical. Ground stations are better able to observe anomalies in external access and boundary forwarding, while satellite nodes are better able to observe anomalies in protocol encapsulation, link forwarding, and space link status. Therefore, employing sample-level entropy weight fusion can leverage the local detection advantages of different nodes.

[0052] Figure 6 This shows the variation in accuracy of different federated detection methods with training epochs on the CIC-IDS-2017 dataset. Figure 6 It can be seen that the EW-FedKD curve corresponding to this invention achieves a high accuracy rate in fewer training rounds, and is generally higher than the comparison methods such as FedAvg, FedProx, SCAFFOLD, FedNova, FedAdam and FedDistill. This shows that the knowledge fusion mechanism based on client-side logits and sample-level entropy weights can form effective teacher knowledge without transmitting complete model parameters. Figure 7The results show a comparison of accuracy, precision, recall, and F1 score on the same dataset. The present invention maintains a high level in multiple detection metrics, indicating that global teacher distribution not only improves a single accuracy metric, but also improves the balance between precision and recall in attack category identification.

[0053] Figure 8 The accuracy convergence curves of different federated detection methods are shown on the SatNIDS dataset. The SatNIDS dataset contains satellite network topology, DTN / CCSDS protocol semantics, and dynamic link states, making it more accurate to understand the network. Figures 2 to 5 The image shows a satellite network intrusion detection scenario. (The image is created by...) Figure 8 It can be seen that the present invention can still maintain faster convergence and higher accuracy in satellite network scenario data, indicating that feature alignment, proxy sample knowledge exchange and entropy weight teacher fusion are applicable to satellite protocol domain and dynamic link conditions. Figure 9 The results show a comparison of the detection performance of different methods on the SatNIDS dataset. The present invention is superior in terms of accuracy, precision, recall and F1 score, indicating that the client heterogeneous model, after global teacher distribution distillation, can absorb cross-node attack identification knowledge while maintaining local adaptability.

[0054] Figure 10 The results show the comparison of Non-IID sensitivity under different Dirichlet parameters. As the Dirichlet parameter decreases, the differences in the distribution of local data categories among clients increase, and the Macro-F1 of conventional parameter averaging or ordinary distillation methods decreases more significantly. The Macro-F1 curve of this invention decreases less, indicating that the sample-level entropy weight can suppress the interference of highly uncertain client knowledge on the global teacher distribution under local data skew, allowing more reliable local knowledge to obtain higher weights on the corresponding proxy samples.

[0055] Figure 11 The ablation experiment comparison results of the present invention are shown. The complete EW-FedKD demonstrates superior performance in accuracy, recall, weighted F1, and macro-average F1 compared to variants that remove entropy weighting, remove temperature scaling, or retain only knowledge distillation, with fewer convergence rounds. These results indicate that using prediction entropy for sample-level entropy weighting improves the quality of teacher logits fusion, temperature scaling preserves soft information between categories, and joint training of supervised detection loss and distillation loss simultaneously maintains local detection capability and cross-node knowledge absorption capability. These experimental results correspond to the processing chain from S1 to S5, demonstrating that the present invention has implementable collaborative intrusion detection capabilities under heterogeneous satellite network models, constrained links, and Non-IID traffic conditions.

[0056] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0057] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An adaptive federated knowledge distillation method for satellite network intrusion detection, characterized in that, include: S1. In a collaborative intrusion detection network consisting of multiple satellite nodes or on-board gateways, acquire local satellite network traffic data and server-side proxy datasets from each client, and perform feature alignment to obtain local training samples and proxy samples with consistent feature dimensions and consistent output category space. S2. The server determines the set of participating clients within the communicable contact window in the current communication round and provides the participating clients with the current proxy sample information. Each participating client determines the proxy sample based on the current proxy sample information, outputs the client logits using the local intrusion detection model, and uploads them to the server. S3. The server generates client soft class distribution and prediction entropy based on the client logits corresponding to the same proxy sample, determines the sample-level entropy weight based on the prediction entropy, and fuses the client logits according to the sample-level entropy weight to obtain global teacher logits and global teacher distribution. S4. The server distributes the global teacher distribution to the participating clients. Each participating client updates its local intrusion detection model based on the supervised detection loss of the local training samples and the distillation loss corresponding to the proxy samples, and iterates the training until the stopping condition is met. S5. Use the trained local intrusion detection model to determine the intrusion category of the satellite network traffic collected by the corresponding satellite node or on-board gateway, and output the intrusion detection results.

2. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 1, characterized in that, The feature alignment includes: Extract flow-level statistical features, DTN / CCSDS protocol semantic features, and dynamic link state features from the local satellite network traffic data and the proxy dataset; The normal traffic labels and attack traffic labels in the local satellite network traffic data are mapped according to a preset attack category space; The field order, numerical scale, missing value identifier, and model output dimension of the local training samples and the proxy samples are unified; The proxy dataset is either a public sample set or a synthetic sample set that does not contain real labels.

3. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 2, characterized in that, The semantic features of the DTN / CCSDS protocol include at least one of the following: protocol type field, frame structure field, forwarding status field, and inter-satellite or satellite-to-ground link identifier field. The dynamic link status features include at least one of the following: link delay, packet loss status, link interruption status, and communicable contact window status.

4. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 1, characterized in that, The current proxy sample information includes the current proxy sample or the current proxy sample index. The server provides the current proxy sample information to the participating clients, including: The server determines the subset of proxy samples to be used in the current communication round from the proxy dataset; When the participating client has not preset the proxy dataset, send the current proxy sample in the proxy sample subset to the participating client; When a participating client has the aforementioned proxy dataset pre-configured, the current proxy sample index corresponding to the proxy sample subset is sent to the participating client. Send preset temperature parameters to participating clients to generate client soft category distributions.

5. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 1, characterized in that, The local intrusion detection model is a heterogeneous detection model that matches the computing and storage resources of the participating clients. Different participating clients' local intrusion detection models are allowed to have different network structures or parameter scales, but each local intrusion detection model has the same output category space. When each participating client uploads its client logits, it includes the proxy sample identifier and the communication round identifier, but does not upload local training samples and complete model parameters.

6. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 1, characterized in that, The client soft category distribution is obtained by scaling the client logits with a preset temperature parameter and then applying the Softmax function. The prediction entropy is the Shannon entropy of the client soft category distribution. The sample-level entropy weight is obtained by normalizing the prediction entropy using a decreasing function, so that participating clients with lower prediction entropy under the same agent sample have higher aggregation weights.

7. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 6, characterized in that, When the server allocates sample-level entropy weights, it uses the participating clients that are within the communicable contact window and have completed the client logits upload in the current communication round as the weight normalization object; when the number of participating clients corresponding to the same proxy sample is one, the sample-level entropy weight corresponding to that participating client is set to 1.

8. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 1, characterized in that, The global teacher logits are obtained by summing the client logits of each participating client under the same agent sample according to the corresponding sample-level entropy weight. The global teacher distribution is obtained by scaling the global teacher logits with a preset temperature parameter and then applying the Softmax function.

9. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 1, characterized in that, Each participating client updates its local intrusion detection model based on the supervised detection loss of the local training samples and the distillation loss corresponding to the proxy samples, including: The supervised detection loss is calculated based on the true labels of the local training samples and the category prediction results output by the local intrusion detection model for the local training samples. The distillation loss is calculated based on the difference between the client soft-class distribution of the participating clients' output of the proxy samples and the corresponding global teacher distribution; The supervised detection loss and the distillation loss are combined into a local training target according to preset distillation weights; Update the parameters of the local intrusion detection model based on the local training objective.

10. The satellite network intrusion detection method based on adaptive federated knowledge distillation according to claim 1, characterized in that, The stopping condition is that the current communication round reaches the preset number of communication rounds; if the current communication round does not reach the preset number of communication rounds, the updated local intrusion detection model will be used as the local intrusion detection model for the next communication round.

Images