基于投票机制的联邦学习恶意代码检测:以电网为例

Federated Learning Malware Detection Method Based on Voting Mechanism:Taking Power Grid as An Example

为了保护电网企业二级单位的用户隐私,增加分布式终端的病毒检测能力,将联邦学习框架应用于恶意代码检测任务中。在该框架中,通过使用局部模型来计算全局模型参数。提出了基于投票机制的联邦学习恶意代码检测方法。在设备的通信过程中,不发送节点的原始数据,而是发送模型参数,有效保护了各设备的数据隐私。通过随机选择用户参与投票,控制中心可依据投票结果调整本地和全局模型的超参数。最后,通过加权聚合来汇聚本地模型参数,以获得一个高精度的全局恶意代码分类模型。该模型将在提供隐私保护的同时,维持了较高的恶意代码检测精度。实验证明该方法在多个恶意代码数据集上的分类精度均有提高,且使模型的损失函数值降低。

To protect user privacy of the secondary units in power grid enterprises and increase the virus detection capability of distributed clients,the federated learning mechanism was applied to the malicious code detection task.In this framework,the global model parameters were calculated by using the local model.A federal learning malicious code detection method based on voting mechanism was proposed.In the communication process of the device,the original data of the node was not sent,but the model parameters were sent,which effectively protected the data privacy of each device.By randomly selecting users to participate in the voting,the control center can adjust the hyperparameters of the local and global models based on the voting results.Finally,the local model parameters were aggregated by weighted aggregation to obtain a high-precision global malicious code classification model.The model provided privacy protection while maintaining a high malicious code detection accuracy.Experiments show that the classification accuracy of this method on multiple malicious code datasets is improved,and the loss function value of the model is reduced.