As the core technology of intrusion detection system, network abnormal traffic detection has always been an important research direction in academia and industry. Related studies show that the failure to find the abnormal situation in the network in time will cause incalculable damage to the computer system and even the whole network. With the emergence of large-scale lightweight terminal nodes, whose characteristics of low computing power and continuous data collection, a distributed abnormal traffic detection technology has emerged. As a kind of distributed structure with decentralized data, federated learning can not only protect local data privacy, reduce communication overhead, but also achieve the effect of centralized training, However, in the era of the Internet of Things with heterogeneous network integration and regular access of massive terminals, the network traffic distribution of different devices is differentiated due to the different security needs of diversified terminals. This will lead to the traditional federated learning-based network anomaly traffic detection facing two major challenges, the uneven data distribution leads to the model training cannot be optimized, and the distributed training global model is not suitable for local network anomaly traffic detection. The scheme of this paper showed significant advantages in the performance evaluation of backbone and mission UAVs, achieving an accuracy of 92.47% and 93.01%, respectively. In contrast, the accuracy of the traditional federated learning method is 89.87% and 89.11%, respectively, which is slightly lower than the present scheme. We propose a framework and algorithm for network anomalous traffic detection based on cluster federated learning. Taking the Internet of Vehicles as the background, the security requirements of the devices connected to the Internet of Vehicles are analyzed, and a set of federated learning data sets meeting the distribution of network traffic in practical applications are constructed with the field recognized data set KDDCup99. This paper verifies the excellent performance of the network anomaly traffic detection mechanism based on cluster federated learning in the case of heterogeneous data distribution.
Read full abstract