Internet of things intrusion detection method and system based on prototype learning and federated learning, and electronic device and storage medium

Abstract

An Internet of Things intrusion detection method and system based on prototype learning and federated learning, which method and system belong to the field of intrusion detection. The method comprises: dividing a local neural network model of each Internet of Things client into an embedding layer and a decision layer, calculating a clustering center corresponding to all potential vectors of each attack class on each client, taking the clustering center as a local prototype of the corresponding attack class on the current client, and uploading the local prototype to a central server; the central server then generating a global prototype and distributing the global prototype back to the corresponding client; and on the basis of the global prototype, performing personalized training on the local neural network model of the client, so as to perform detection on an attack behavior targeting a local Internet of Things network. While aligning local prototypes of different Internet of Things clients, the method maintains a certain degree of personalization of local models of the clients, so as to enhance the intrusion detection capability of each client.

Description

Internet of Things intrusion detection method, system, electronic device and storage medium based on prototype learning and federated learning Technical Field

[0001] The present invention belongs to the field of intrusion detection, and in particular relates to an Internet of Things intrusion detection method, system, electronic device and storage medium based on prototype learning and federated learning. Background Art

[0002] With the rapid expansion of the Internet of Things (IoT), the number and impact of security vulnerabilities and threats associated with IoT devices and systems have increased significantly. Introducing intrusion detection mechanisms is an effective approach to protecting the security of network systems. In recent years, due to the explosive growth of data, intrusion detection has often been combined with data-driven machine learning (ML) algorithms. By centrally modeling and training the network traffic generated by massive devices, these ML-based intrusion detection models can accurately identify malicious behavior within the network. However, sharing raw data from IoT devices with remote servers or cloud platforms for centralized processing can lead to additional privacy issues. For example, interaction data from wearable devices or electronic health systems could be intercepted by attackers while being transmitted over the network, resulting in privacy leaks.

[0003] Federated learning (FL), a promising privacy-preserving technique, has recently been introduced to IoT environments to build privacy-safe intrusion detection frameworks. FL allows multiple clients to collaboratively train and update ML models without sharing their local private data with a central server. After several iterations, each client has an identical global model, which is then used to perform its local intrusion detection task. While these FL-based intrusion detection methods offer the advantages of collaborative and privacy-preserving approaches, their application in IoT environments still faces two key challenges.

[0004] (1) Communication overhead. Federated learning requires the client to maintain communication with the central server throughout the training process, but the high overhead caused by frequent communication is not conducive to bandwidth-constrained IoT devices.

[0005] (2) Non-Independent and Identically Distributed (Non-IID) data. Different IoT clients often have significant differences in their local environments and data usage patterns, which lead to Non-IID data. A single global model is unlikely to perform well on such Non-IID data.

[0006] Therefore, in order to better improve the intrusion detection capabilities of various IoT clients while protecting their data privacy, a federated intrusion detection system with privacy security, low communication overhead and strong robustness is needed.

[0007] Summary of the Invention

[0008] The purpose of this paper is to propose an IoT intrusion detection method based on prototype learning and federated learning, which enhances the intrusion detection capability of each client by aligning the local prototypes of different IoT clients while maintaining a certain degree of personalization of their local models.

[0009] The present invention also provides an Internet of Things intrusion detection system, electronic device, and storage medium based on prototype learning and federated learning.

[0010] The technical solutions adopted by the present invention to achieve the above-mentioned purpose are as follows:

[0011] An IoT intrusion detection method based on prototype learning and federated learning includes the following steps:

[0012] S1: Each IoT client's local neural network model is divided into an embedding layer and a decision layer. The embedding layer is responsible for mapping each raw input into a latent space to form a latent vector as a prototype candidate. The decision layer is used to detect the specific attack category of the latent vector.

[0013] S2: Calculate the cluster center of all potential vectors of each attack class on the client, use the cluster center as the local prototype of the corresponding attack class on the current client and upload it to the central server;

[0014] S3: After receiving the local prototypes uploaded by all clients, the central server calculates and generates a global prototype. After the current federation round ends, the global prototype is distributed back to the corresponding clients.

[0015] S4: Perform personalized training and optimization on each client's local neural network model. The optimization goal is to minimize the classification error of local data and make the local prototype as close as possible to the global prototype.

[0016] S5: The client authenticates each input based on the trained neural network model to detect attacks on the local IoT network.

[0017] Furthermore, the original input in step S1 is the statistical features of the network traffic flow data.

[0018] Furthermore, in step S1, the local neural network model of the client is a DNN model.

[0019] Furthermore, the decision layer in step S1 includes a fully connected and a Softmax module.

[0020] Furthermore, in step S2, the k-means clustering algorithm is used to calculate the cluster centers of all potential vectors of the attack class.

[0021] Furthermore, in step S2, the number of cluster centers of the k-means algorithm is set to 3, and each local attack class generates three local prototypes corresponding to the class.

[0022] Furthermore, in step S3, an inverse distance weighting algorithm MIDA based on the coordinate median is used to adaptively weight each local prototype according to the inverse L2 distance between each local prototype and its coordinate median to generate a global prototype.

[0023] Furthermore, when the local neural network model of each client is personalized trained in step S4, the L2 distance constraint is used in the embedding layer to make the generated local prototype as close as possible to the global prototype, and the cross entropy loss function is used in the decision layer to minimize the classification loss of the local data.

[0024] The Internet of Things intrusion detection system based on prototype learning and federated learning of the present invention includes:

[0025] The client includes a local neural network model divided into an embedding layer and a decision layer. The embedding layer is responsible for mapping each raw input into a latent space to form a latent vector as a prototype candidate. The decision layer is used to detect the specific attack class of the latent vector. The cluster center of all latent vectors of each attack class is calculated and used as the local prototype of the corresponding attack class on the current client and uploaded to the central server.

[0026] The central server is responsible for calculating and generating a global prototype after receiving the local prototypes uploaded by all clients, and distributing the global prototype back to the corresponding clients after the current federation round ends;

[0027] Among them, the client performs personalized training and optimization on the local neural network model. The optimization goal is to minimize the classification error of local data and make the local prototype as close as possible to the global prototype; each input is identified according to the trained neural network model to detect attacks on the local IoT network.

[0028] Furthermore, the client's local neural network model uses a DNN model, and the decision layer includes fully connected and softmax modules.

[0029] The electronic device of the present invention comprises:

[0030] processor;

[0031] a memory for storing instructions executable by the processor;

[0032] The processor is used to read the executable instructions from the memory and execute the executable instructions to implement the above-mentioned Internet of Things intrusion detection method.

[0033] The computer-readable storage medium of the present invention stores computer program instructions, which, when executed by a processor, implement the above-mentioned Internet of Things intrusion detection method.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] This paper proposes a federated intrusion detection framework based on multiple prototypes, FedMP, which significantly reduces the communication overhead of traditional FL methods by exchanging carefully selected low-dimensional prototypes between clients.

[0036] The present invention designs a robust prototype aggregation algorithm MIDA. By dynamically adjusting the weight of each local prototype during aggregation, MIDA can ensure that the server generates the most representative global prototype to guide the training of the client's personalized model. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] FIG1 is a diagram illustrating a deployment architecture of an IoT intrusion detection system according to an embodiment of the present invention;

[0038] FIG2 is a flowchart of the overall implementation of the IoT intrusion detection method and system according to this embodiment. DETAILED DESCRIPTION

[0039] In order to make the various technical features and advantages or technical effects of the above technical solutions of the present invention more obvious and easy to understand, they are described in detail below with reference to the accompanying drawings.

[0040] The embodiment of the present invention specifically provides an Internet of Things intrusion detection method and system based on prototype learning and federated learning. The system deployment architecture is shown in Figure 1, and the overall implementation process details are shown in Figure 2. The specific description is as follows.

[0041] S1: Client model layering:

[0042] The local DNN model of each IoT client participating in federated learning (FL) is structurally divided into two parts: an embedding layer and a decision layer. The embedding layer is designed to map input data (typically the statistical features of network traffic flow data) into a latent space. The decision layer mainly includes fully connected and softmax modules to determine the corresponding attack category of the latent vector.

[0043] S2: Local class prototype extraction:

[0044] This method considers each attack class on a client separately. For each attack class, a k-means clustering algorithm is used to calculate cluster centers for all potential vectors of that class. These cluster centers serve as the local prototypes (also known as local prototypes) of that class on that client and are uploaded to a central server. To ensure that the clustering algorithm can effectively extract features of the local attack class, this method sets the number of cluster centers in the k-means algorithm to three, meaning that each local attack class generates three local prototypes corresponding to that class.

[0045] S3: Global prototype calculation:

[0046] After the central server receives the local prototypes uploaded by all clients, it uses the MIDA (weighted inverse distance based on the median of the coordinates) algorithm to generate global prototypes for all classes. Compared with simply using the average or weighted average, MIDA is more robust to outliers and noise values ​​and does not require prior knowledge. Specifically, when aggregating all local prototypes of a specific class, the central server adaptively weights each local prototype based on the inverse L2 distance between it and the median of its coordinates. The farther away from the median of the coordinates, the smaller the weight, and the closer to the median of the coordinates, the larger the weight. By dynamically adjusting the weight of each local prototype, MIDA can effectively capture important information in the central area and useful information in the edge areas. The calculated global prototype is distributed back to the corresponding client after the end of this federation round.

[0047] S4: Personalized training client local model:

[0048] This method trains a personalized intrusion detection model for each IoT client through global prototype distribution, rather than requiring them to share a single global prototype. This minimizes the impact of data non-IID. The optimization objectives for the local model on the IoT client consist of two parts: 1) minimizing the classification error of the local data; and 2) ensuring that the local prototype is as close as possible to the global prototype. These two components are constrained by the cross-entropy loss function and the L2 distance function, respectively. In other words, each client completes personalized training of its local DNN model. In the embedding layer, the L2 distance constraint ensures that the generated local prototype is as close as possible to the global prototype, ensuring the absorption of global knowledge. In the decision layer, the cross-entropy loss function minimizes the classification loss of the local data, ensuring that the model fits the local data distribution as closely as possible, thereby alleviating the impact of the non-IID problem that is prevalent in the FL framework.

[0049] S5: Client independently detects intrusion behavior:

[0050] The client authenticates each input based on the trained personalized DNN model (output of the decision layer) to detect attacks on the local IoT network.

[0051] This example uses a publicly available online real-world attack dataset during the training phase, with a training set to test set ratio of 8:2. Accuracy and F1 score are used as evaluation indicators. The method of the present invention is also compared with several other advanced methods, including:

[0052] Local: All customers train models locally and do not participate in collaboration.

[0053] FedAvg: Shares model parameters among all clients and is the most classic FL algorithm.

[0054] FedPer: Splits the model into a presentation layer and a header, where the presentation layer is shared among multiple clients and the header remains private for personalization.

[0055] LG-FedAvg: The client keeps the representation layer private to extract local data features, and collaborative training aims to learn a classifier applied to the output of the local representation layer.

[0056] FedBABU: fixes the heads of all client models during FL training to help learn powerful representation layers;

[0057] The comparative experimental results are shown in the following table:

[0058] Table 1 Performance comparison of the present invention and other advanced methods in different Non-IID scenarios (T g =30, T l =10)

[0059] Experiments show that our method significantly outperforms state-of-the-art methods used for comparison, achieving the best accuracy and F1 score in a variety of intrusion detection scenarios. Furthermore, compared to other FL methods, our method has the lowest communication overhead.

[0060] Although the present invention has been disclosed as above by way of embodiments, they are not intended to limit the present invention. Any appropriate modification or equivalent substitution of the technical solution of the present invention by a person skilled in the art should be included in the protection scope of the present invention. The protection scope of the present invention shall be based on that defined in the claims.

Claims

1. An IoT intrusion detection method based on prototype learning and federated learning, characterized in that: The following steps are involved: S1: Each IoT client's local neural network model is divided into an embedding layer and a decision layer. The embedding layer is responsible for mapping each raw input into a latent space to form a latent vector as a prototype candidate. The decision layer is used to detect the specific attack category of the latent vector. S2: Calculate the cluster center of all potential vectors of each attack class on the client, use the cluster center as the local prototype of the corresponding attack class on the current client and upload it to the central server; S3: After receiving the local prototypes uploaded by all clients, the central server calculates and generates a global prototype. After the current federation round ends, the global prototype is distributed back to the corresponding clients. S4: Perform personalized training and optimization on each client's local neural network model. The optimization goal is to minimize the classification error of local data and make the local prototype as close as possible to the global prototype. S5: The client authenticates each input based on the trained neural network model to detect attacks on the local IoT network.

2. The Internet of Things intrusion detection method according to claim 1, wherein: The original input in step S1 is the statistical features of network traffic flow data.

3. The Internet of Things intrusion detection method according to claim 1, wherein: In step S1, the local neural network model of the client is a DNN model.

4. The Internet of Things intrusion detection method according to claim 2, wherein: The decision layer in step S1 includes fully connected and Softmax modules.

5. The Internet of Things intrusion detection method according to claim 1, wherein: In step S2, the k-means clustering algorithm is used to calculate the cluster centers of all potential vectors of the attack class.

6. The Internet of Things intrusion detection method according to claim 5, characterized in that: In step S2, the number of cluster centers of the k-means algorithm is set to 3, and each local attack class generates three local prototypes corresponding to the class.

7. The Internet of Things intrusion detection method according to claim 1, wherein: In step S3, the inverse distance weighted algorithm MIDA based on the coordinate median is used to adaptively weight each local prototype according to the inverse L2 distance between each local prototype and its coordinate median to generate a global prototype.

8. The Internet of Things intrusion detection method according to claim 1, wherein: When performing personalized training on the local neural network model of each client in step S4, the L2 distance constraint is used in the embedding layer to make the generated local prototype as close as possible to the global prototype, and the cross entropy loss function is used in the decision layer to minimize the classification loss of local data.

9. An IoT intrusion detection system based on prototype learning and federated learning, characterized in that: include: The client includes a local neural network model divided into an embedding layer and a decision layer. The embedding layer is responsible for mapping each raw input into a latent space to form a latent vector as a prototype candidate. The decision layer is used to detect the specific attack class of the latent vector. The cluster center of all latent vectors of each attack class is calculated and used as the local prototype of the corresponding attack class on the current client and uploaded to the central server. The central server is responsible for calculating and generating a global prototype after receiving the local prototypes uploaded by all clients, and distributing the global prototype back to the corresponding clients after the current federation round ends; Among them, the client performs personalized training and optimization on the local neural network model. The optimization goal is to minimize the classification error of local data and make the local prototype as close as possible to the global prototype; each input is identified according to the trained neural network model to detect attacks on the local IoT network.

10. The Internet of Things intrusion detection system according to claim 9, wherein: The client's local neural network model uses the DNN model, and the decision layer includes fully connected and Softmax modules.

11. An electronic device comprising: processor; a memory for storing instructions executable by the processor; The processor is configured to read the executable instructions from the memory and execute the executable instructions to implement the Internet of Things intrusion detection method described in any one of claims 1-8.

12. A computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the Internet of Things intrusion detection method described in any one of claims 1 to 8 is implemented.

Images