| Network intrusion detection aims to detect unauthorized attack activities on a network to protect its network and data.Currently,with the increase and diversification of cyber attacks,deep learning has shown its effectiveness and superiority in implementing intrusion detection.However,in reality,due to the lack of high-quality,labeled and diversified attack instance data,it is difficult for a single security organization to train a deep model with good detection effect,which has limitations for the detection of complex network threats.And because the training instance data is more sensitive,it is not possible to directly fuse multiple parties’ data to jointly train and build models.Therefore,this paper addresses the above situation by introducing federated learning to build a deep model for network intrusion detection.The main research is as follows:(1)A federated learning-based network intrusion detection model is proposed.First,a CNN-LSTM deep learning model is constructed to learn the spatio-temporal characteristics of network traffic data to achieve the network attack classification.Then,Fedavg federated learning algorithm is combined to enable the model to be trained locally to ensure that the source data does not leave the local area to solve the problem of insufficient data and sensitive data.The local models are transferred and aggregated through multiple communications between the central server and the local,and finally a good global deep model is created collaboratively.Experiments show that the CNN-LSTM classification capability is stronger compared to some machine learning and deep learning models.Compared to deep models trained on a single client data,the federated learning training is more accurate.(2)A federated learning network intrusion detection model based on similarity calculation is designed.In order to solve the problems such as negative contribution to the global model when partial models are aggregated and cause high communication overhead in federated learning.The Fedavg algorithm is improved to calculate the similarity between local and global updates from the perspective of model update similarity,based on which model screening and dynamic weighting are used to reduce the negative impact of partial models and reduce network resource consumption.Experiments show that our approach outperforms the traditional Fedavg algorithm as well as several advanced studies,with closer to centralized detection performance and lower communication overhead.(3)A secure federated learning network intrusion detection model is designed.To avoid the problem of attacker back-propagation of source data triggered by parameter information leakage during the federated learning training process.Combined with Paillier homomorphic encryption technology,the uploaded and downlinked gradient parameters are encrypted and transmitted,encrypted and aggregated on the server side and encrypted and decrypted on the client side.The model not only ensures that the model detection capability is not compromised,but also more secure.This research work can help security personnel to expand sample data with low overhead and more security,and build high-performance network intrusion detection models to deal with diverse attacks. |
