Journal of Information Security Reserach ›› 2024, Vol. 10 ›› Issue (7): 642-.

Previous Articles     Next Articles

Model of Intrusion Detection Based on Federated Learning and Convolutional Neural Network

Luo Wenhua and Zhang Xiaolong   

  1. (School of Public Security Information Technology and Intelligence, Criminal Investigation Police University of China, Shenyang 110035)

  • Online:2024-07-14 Published:2024-07-18

基于联邦学习与卷积神经网络的入侵检测模型

罗文华张晓龙   

  1. (中国刑事警察学院公安信息技术与情报学院沈阳110035)
  • 通讯作者: 罗文华 硕士,教授.主要研究方向为网络安全执法技术. luowenhua770404@126.com
  • 作者简介:罗文华 硕士,教授.主要研究方向为网络安全执法技术. luowenhua770404@126.com 张晓龙 硕士研究生.主要研究方向为网络安全执法技术. 1323813426@qq.com

Abstract: The cyber intrusion detection model needs to identify the malicious data timely and accurately among the largescale cyber traffic data. However, due to the insufficient label data of a single institution and the unwillingness of various institutions to share data, the performance of the trained cyber intrusion detection model has low performance. In view of the above problems, this paper proposed an intrusion detection model FL1DCNN, which combined federated learning and onedimensional convolutional neural network. While ensuring high detection accuracy, it allowed more participants to protect their data privacy and security, which solved the problem of insufficiency of the labeled data. The FL1DCNN model first carried on a series of preprocessing operations on the original data set, then used the onedimensional convolutional neural network as the general model of each participant to extract features under the federated learning mechanism and finally performs binary classification using a sigmoid classifier. The experimental results show that the accuracy of the FL1DCNN model on the CICIDS2017 dataset is 96.5% and the F1score of the FL1DCNN model is 97.9%. In addition, compared to the traditional centralized training model 1DCNN, the FL1DCNN model reduces training time by 32.7%.

Key words: intrusion detection, federated learning, deep learning, convolutional neural network, CICIDS2017 dataset

摘要: 网络入侵检测模型需要在大规模的网络流量数据中及时准确地识别出恶意数据,但单一机构的标签数据不足,各机构之间不愿共享数据,导致训练出的入侵检测模型性能不高.针对上述问题,提出一种基于联邦学习和1维卷积神经网络的入侵检测模型FL1DCNN,在保证较高检测精度的同时,允许更多的参与方保护自身数据的隐私和安全,解决了标签数据不足的问题.FL1DCNN模型首先对原始数据集进行一系列预处理操作,然后在联邦学习机制下将1维卷积神经网络作为各参与方的通用模型进行特征提取,最后通过Sigmoid分类器进行二分类.实验结果表明,FL1DCNN模型在CICIDS2017数据集上的准确率达到96.5%,F1分数达到97.9%.此外,相较于传统集中式学习训练出的模型1DCNN,FL1DCNN模型在训练时间上缩短了32.7%.


关键词: 入侵检测, 联邦学习, 深度学习, 卷积神经网络, CICIDS2017数据集

CLC Number: