基于联邦学习的网络异常检测

Network anomaly detection based on federated learning

作为一类网络安全的基础研究,网络异常检测技术目前还存在检测准确率低、误报率高以及缺乏标签数据等问题。为此提出一种融合联邦学习和卷积神经网络的网络入侵检测分类模型(CNN-FL),可有效解决多个参与者在不共享隐私数据的情况下进行一个全局模型的协作训练时所带来的问题。该模型无需汇集模型训练所需要的数据进行集中计算,只是传递加密的梯度相关数据,即可利用多源数据协同训练同一模型,并解决缺乏标签数据的问题。随后将该模型应用于二分类和多分类方法中,并在同一基准数据集NSL-KDD上进行了实验比较与分析,实验结果表明,与其他研究方法相比,所提CNN-FL分类模型在二分类以及多分类中具有较高的识别性能和分类精度。

With the rapid development of information technology,network security has become a hot issue in current research.As the basis of network security,current network anomaly detection technology has problems such as low detection accuracy,high false alarm rate and lack of label data.This paper proposes a network intrusion detection classification model(CNN-FL)that combines federated learning and convolutional neural networks,which effectively solves the problems caused by multiple participants training a global model without sharing private data.The model does not need to collect the data required for model training for centralized calculation,since it only transmits encrypted gradient-related data,thereby realizing the use of multi-source data to collaboratively train the same model and solve the problem of lack of label data.We applied the model to both binary classification and multiple methods,and conducted experiments,comparisons and analyses on the same benchmark data set(NSLKDD).The experimental results show that compared with other methods,our CNN-FL classification model has higher performance and classification accuracy in both binary classifications and multiple classifications.