| Intrusion detection technology is considered a crucial protective tool.The amount of data is crucial for training intrusion detection models,but due to the responsibility of various network security companies for user privacy information,data cannot be freely shared.Therefore,it is very important to build an intrusion detection model that can both protect data privacy and have good detection performance.The main research work of this thesis is as follows.Firstly,an intrusion detection model based on PC A dimensionality reduction CNN-GRU is constructed as a local training model.In order to deal with a large amount of data and multiple data features,the principal component analysis(PCA)is used to reduce the dimensionality of the data.The experimental results show that the best detection performance is achieved when the features are reduced to 24 dimensions.Then,compare the performance of the intrusion detection model used in this thesis with the models constructed using other methods.The experimental results show that the model used in this thesis performs better.Secondly,to address the issue of data not being freely shared among various network security companies,federated learning is introduced to protect user data privacy.Randomly select the number of clients in each round of federated learning.The experiment shows that the training efficiency of the model is higher when 10-20 clients are selected.Comparing the performance of the intrusion detection models obtained by federated learning,centralized learning,and local training by each client.The experimental results show that the intrusion detection model constructed by federated learning has better detection performance than that of each client trained locally.Compared with centralized learning,the detection performance of the model constructed by federated learning has decreased.However,in federated learning,data privacy is protected,so a slight performance loss is allowed.Optimize the federated average algorithm for uneven data quality across clients.The determination of aggregation weights is changed from being based on the amount of data to being based on the accuracy of each participant.The experimental results show that the improved federated averaging algorithm can construct a better intrusion detection model.Finally,aiming at the problem of privacy leakage during model aggregation,a differential privacy technique based on Gaussian mechanism is introduced to protect privacy.ε is the privacy budget,and it can be used to balance the availability and privacy of the intrusion detection model.As the privacy budget ε increases,the classification accuracy improves,but the possibility of data privacy disclosure increases.The experimental results show that,in the NB15 dataset,adding random noise with Gaussian distribution obeying N(0,0.52)to N(0,0.62)can improve the overall performance of the intrusion detection model.In the NSL-KDD dataset,adding random noise with Gaussian distribution obeying N(0,0.52)to N(0,0.72)can improve the overall performance of the intrusion detection model. |
