Research On Network Intrusion Detection Method Based On Federated Learning

In the era of big data,network technology is widely used in military,medical,economic,transportation,Internet of Things and industrial control and other fields,and the auxiliary equipment of the Internet is also very common.These auxiliary devices have brought infinite convenience to people,but at the same time,they have also caused a lot of information security problems.Attackers use various and complex means to intrude on the network,which makes the intrusion detection system(IDS)face a huge challenge in detection performance.Although the intrusion detection system can quickly detect anomalies and respond when faced with malicious attacks,it still needs to overcome the problems of large amount of intrusion detection data,imbalanced data categories,limited known attack types,and differences with network real-time attacks.To solve the above problems,this thesis proposes three network intrusion detection models to reduce the computational complexity and improve the detection rate.The main research contents are as follows:(1)A network intrusion detection model based on PSO-GWO hybrid optimization support vector machine is proposed.The model combines the particle swarm optimization algorithm and the gray wolf optimization algorithm to optimize the support vector machine,and selects an autoencoder to perform feature selection on the data set,and trains the optimized support vector machine according to the selected optimal feature subset.Experimental results show that the model has good performance in detecting known attack types,with high accuracy and low false positive rate.(2)A Fed Prox-based federated deep learning network intrusion detection model is proposed.The model firstly divides the original data set into several local data sets based on the federated learning framework,each device corresponds to a local data set,and then performs local model training.In the process of local training,the dynamic iteration method is used to determine when the iteration ends,and the method of adding near-end items is used to judge the difference between the local model and the global model,and finally the trained local model is transmitted to the central server for aggregation to obtain the final intrusion detection model.The experimental results show that the model not only has a good effect in detection performance,but also improves the convergence speed of the model and reduces the computational complexity.(3)A segmented federated learning network intrusion detection model based on Non-IID data is proposed.The model first sorts and partitions the preprocessed data set according to the labels,and then selects the data partition,divides the data set into several non-IID data subsets,and corresponds to the equipment one by one,and then trains the local model.In the process of local training,periodic evaluation is set to verify the performance of the model,and the local model that conforms to the global model is selected according to the threshold.Finally,the selected local models are uploaded to the central server for aggregation,and the optimal intrusion detection model is obtained.The experimental results show that the model has good detection results in dealing with network real-time data.