Abstract: To analyze network attack behavior issues efficiently and securely, an adaptive network attack analysis method based on federated learning (NAAFL) is proposed. This approach can fully leverage data for network attack analysis while ensuring privacy protection.. Firstly, a costeffective defense mechanism based on DQN (dynamic participant selection mechanism) is proposed to act in the process of federated learning model parameter sharing and model aggregation. It dynamically selects the best participants for each round of model updates, reducing the impact of poorly performing local models on the global model during training. It also reduces communication overhead time and improving the efficiency of federated learning. Secondly, an adaptive feature learning network intrusion detection model is designed, which is able to intelligently learn and analyze according to changing attack features to cope with complex network environments. It effectively reduces the time and space overhead of feature selection. Finally, comparative experiment is performed on a public data set (NSL KDD). The NAAFL method detects attacks with an accuracy of 98.9%. Dynamically selecting participants increases server accuracy by 4.48%. The experimental results show that the method has excellent robustness and efficiency.

Key words: network security, attack analysis, federated learning, RL, IDS

摘要： 为了高效安全地分析网络攻击行为问题，提出基于联邦学习的自适应网络攻击分析方法(adaptive network attack analysis method based on federated learning, NAAFL)，该方法可以在实现隐私保护的同时充分利用数据进行网络攻击分析.首先，提出一种基于DQN的低成本防御机制(动态选择参与方机制)，作用在联邦学习模型参数共享、模型聚合过程中，为每一轮模型更新动态选择最佳参与方，减少局部模型在训练过程中表现不佳对全局模型的影响，同时降低通信开销时间，提高联邦学习效率.其次，设计一种自适应特征学习的网络入侵检测模型，能够根据不断变化的攻击特征进行智能学习和分析，以应对复杂的网络环境，有效降低特征选择的时空开销.最后，在公开数据集(NSL KDD)上进行对比实验，NAAFL方法对攻击的检测准确率为98.9%，动态选择参与方机制提高服务器准确率4.48%，实验结果表明：该方法具有优良的鲁棒性和高效性.

关键词: 网络安全, 攻击分析, 联邦学习, 强化学习, 入侵检测系统