基于深度主动学习的联邦半监督入侵检测系统

doi:10.3969/j.issn.1671-1122.2026.06.008

摘要/Abstract

摘要：

随着网络规模的扩大，网络安全问题日益突出，入侵检测系统面临数据标注成本高和数据传输延迟等挑战。联邦学习为分布式入侵检测提供了一种有效解决方案，但仍依赖大量标注数据。为降低标注成本，主动学习常被应用于入侵检测中，但主动学习中用于选择待标注样本的查询策略往往受限于数据分布。文章结合多样性采样与基于深度模型迁移的查询策略，提出一种基于深度主动学习的联邦半监督入侵检测系统。首先，通过K-Means聚类选择多样性样本进行标注。然后，基于迁移学习，利用已标注数据在分类器上的预测结果训练选择器；其中，分类器用于入侵检测，选择器用于筛选有助于提升检测性能的未标注样本进行标注。最后，文章选用NSL-KDD和UNSW-NB15数据集进行实验。实验结果表明，该方案减少了对大量标注数据的需求，并提高了主动学习在不同数据分布与场景下的适应性。

关键词: 网络入侵检测, 联邦学习, 半监督学习, 主动学习

Abstract:

With the expansion of network scale, network security issues have become increasingly prominent. Intrusion detection systems face challenges such as high data annotation costs and data transmission delays. Federated learning provides an effective solution for distributed intrusion detection, but it still suffers from the bottleneck of relying on a large amount of labeled data. To reduce annotation costs, active learning is often applied in intrusion detection; however, the query strategies used to select samples for annotation in active learning are often limited by data distribution. This paper proposed a federated semi-supervised intrusion detection system based on deep active learning, combining diversity sampling with a query strategy based on deep model transfer. First, K-Means clustering was used to select diverse samples for annotation. Then, based on transfer learning, a selector was trained using the prediction results of the classifier on the labeled data. The classifier was used for intrusion detection, while the selector was used to identify unlabeled samples that can help improve detection performance for annotation. Finally, the NSL-KDD and UNSW-NB15 datasets selected for experiments. The experimental results show that the proposed scheme reduces the demand for a large amount of labeled data and improves the adaptability of active learning across different data distributions and scenarios.

Key words: network intrusion detection, federated learning, semi-supervisied learning, active learning

中图分类号:

TP309

张浩, 叶骏威. 基于深度主动学习的联邦半监督入侵检测系统[J]. 信息网络安全, 2026, 26(6): 944-957.

ZHANG Hao, YE Junwei. Deep Active Learning Based Federated Semi-Supervised Intrusion Detection System[J]. Netinfo Security, 2026, 26(6): 944-957.

图/表 21

图1

图2

图3

图4

表1

表2

表3

表4

表5

表6

表7

表8

表9

图5

图6

表10

表11

图7

图8

表12

表13

参考文献 29

[1]	BAI Hongpeng, DENG Dongxu, XU Guangquan, et al. Research onIntrusion Detection Mechanism Based on Federated Learning[J]. NetinfoSecurity, 2022, 22(1): 46-54.
	白宏鹏, 邓东旭, 许光全, 等. 基于联邦学习的入侵检测机制研究[J]. 信息网络安全, 2022, 22(1): 46-54.
[2]	MCMAHAN B, MOORE E, RAMAGE D, et al. Communication-Efficient Learning of Deep Networks from Decentralized Data[C]// PMLR. Artificial Intelligence and Statistics. Cambridge: PMLR, 2017: 1273-1282.
[3]	XU Jian, XIAO Yongcai, LIN Zejian, et al. Privacy Protection Anomaly Detection in Smart Grids Based on Homomorphic Encryption[J]. Computer Technology and Development, 2025, 35(8): 93-100.
	徐健, 肖勇才, 林泽键, 等. 基于同态加密的智能电网隐私保护异常检测技术[J]. 计算机技术与发展, 2025, 35(8): 93-100.
[4]	WEN Z, PIZARRO O, WILLIAMS S. Training from a Better Start Point: Active Self-Semi-Supervised Learning for Few Labeled Samples[EB/OL]. (2022-03-09)[2025-03-27]. https://arxiv.org/abs/2203.04560
[5]	SHEN Yeming, LI Beibei, LIU xiaojie, et al. Research on Intrusion Detection of Industrial Internet Based on Active Learning[J]. Netinfo Security, 2021, 21(1): 80-87.
	沈也明, 李贝贝, 刘晓洁, 等. 基于主动学习的工业互联网入侵检测研究[J]. 信息网络安全, 2021, 21(1): 80-87.
[6]	NAEEM F, ALI M, KADDOUM G. Federated-Learning-Empowered Semi-Supervised Active Learning Framework for Intrusion Detection in ZSM[J]. IEEE Communications Magazine, 2023, 61(2): 88-94.
[7]	ZHANG Yong, NIU Jie, HE Guojian, et al. Network Intrusion Detection Based on Active Semi-Supervised Learning[C]// IEEE. The 51st Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshops. New York: IEEE, 2021: 129-135.
[8]	LI Beibei, WU Yuhao, SONG Jiarui, et al. DeepFed: Federated Deep Learning for Intrusion Detection in Industrial Cyber-Physical Systems[J]. IEEE Transactions on Industrial Informatics, 2021, 17(8): 5615-5624.
[9]	MOTHUKURI V, KHARE P, PARIZI R M, et al. Federated-Learning-Based Anomaly Detection for IoT Security Attacks[J]. IEEE Internet of Things Journal, 2022, 9(4): 2545-2554.
[10]	HUONG T T, BAC T P, LONG D M, et al. Detecting Cyberattacks Using Anomaly Detection in Industrial Control Systems: A Federated Learning Approach[J]. Computers in Industry, 2021, 132: 509-518.
[11]	ABDEL-BASSET M, MOUSTAFA N, HAWASH H, et al. Federated Intrusion Detection in Blockchain-Based Smart Transportation Systems[J]. IEEE Transactions on Intelligent Transportation Systems, 2022, 23(3): 2523-2537.
[12]	MILLER D J, UYAR H. A Mixture of Experts Classifier with Learning Based on Both Labelled and Unlabelled Data[EB/OL]. (1996-09-05)[2025-03-27]. https://proceedings.neurips.cc/paper/1996/hash/a58149d355f02887dfbe55ebb2b64ba3-Abstract.html.
[13]	LEE D-H. Pseudo-Label: The Simple and Efficient Semi-Supervised Learning Method for Deep Neural Networks[C]// ICML. The Workshop on Challenges in Representation Learning. Cambridge: PMLR, 2013: 896-906.
[14]	RIZVE M N, DUARTE K, RAWAT Y S, et al. In Defense of Pseudo-Labeling: An Uncertainty-Aware Pseudo-Label Selection Framework for Semi-Supervised Learning[EB/OL]. (2021-01-15)[2025-03-27]. https://arxiv.org/abs/2101.06329
[15]	SETTLES B. Active Learning Literature Survey[EB/OL]. (2009-03-16)[2025-03-27]. http://apophenia.wdfiles.com/local-files/start/settles_active_learning.pdf
[16]	NIU Zequn, GUO Wenjie, XUE Jingfeng, et al. A Novel Anomaly Detection Approach Based on Ensemble Semi-Supervised Active Learning (ADESSA)[J]. Computers & Security, 2023, 129: 90-99.
[17]	CONTARDO G, DENOYER L, ARTIERES T. A Meta-Learning Approach to One-Step Active-Learning[EB/OL]. (2017-07-17)[2025-03-27]. https://arxiv.org/abs/1706.08334
[18]	ZHU Jiajie, BENTO J. Generative Adversarial Active Learning[EB/OL]. (2017-02-25)[2025-03-27]. https://arxiv.org/abs/1702.07956
[19]	LIU Peng, WANG Lizhe, RANJAN R, et al. A Survey on Active Deep Learning: from Model Driven to Data Driven[J]. ACM Computing Surveys (CSUR), 2022, 54(10): 1-34.
[20]	ZHAN Xueying, LIU Huan, LI Qing, et al. A Comparative Survey: Benchmarking for Pool-Based Active Learning[C]// IJCAI. The International Joint Conferences on Artificial Intelligence Organization. Amsterdam: IJCAI, 2021: 4679-4686.
[21]	DUCOFFE M, PRECIOSO F. Adversarial Active Learning for Deep Networks: A Margin Based Approach[EB/OL]. (2018-02-27)[2025-03-27]. https://arxiv.org/abs/1802.09841
[22]	MUNJAL P, HAYAT N, HAYAT M, et al. Towards Robust and Reproducible Active Learning Using Neural Networks[C]// IEEE. The IEEE/CVF Conference on Computer Vision and Pattern Recognition. New York: IEEE, 2022: 223-232.
[23]	ZHANG Yu, YANG Qiang. A Survey on Multi-Task Learning[J]. IEEE Transactions on Knowledge and Data Engineering, 2021, 34(12): 5586-5609.
[24]	LECUN Y, BENGIO Y, HINTON G. Deep Learning[J]. Nature, 2015, 521(3): 436-444.
[25]	LIU Ming, BUNTINE W, HAFFARI G. Learning How to Actively Learn: A Deep Imitation Learning Approach[C]//ACL. The 56th Annual Meeting of the Association for Computational Linguistics. Cambridge: MIT Press, 2018: 1874-1883.
[26]	REVATHI S, MALATHI A. A Detailed Analysis on NSL-KDD Dataset Using Various Machine Learning Techniques for Intrusion Detection[J]. International Journal of Engineering Research & Technology (IJERT), 2013, 2(12): 1848-1853.
[27]	MOUSTAFA N, SLAY J. UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 Network Data Set)[C]//IEEE. The Military Communications and Information Systems Conference. New York: IEEE, 2015: 1-6.
[28]	AHN J H, KIM K, KOH J, et al. Federated Active Learning (F-AL): An Efficient Annotation Strategy for Federated Learning[J]. IEEE Access, 2024(12): 39261-39269.
[29]	HSU T-M H, QI H, BROWN M. Measuring the Effects of Non-Identical Data Distribution for Federated Visual Classification[EB/OL]. (2019-09-13)[2025-03-27]. https://arxiv.org/abs/1909.06335

类型	参数设置
1D-CNN	卷积核大小为3，卷积核数量为64
LSTM	隐藏层单元数为64，层数为1
Dropout	比率为0.1

参数名称	描述	默认值
参数名称	描述	NSL-KDD	UNSW-NB15
CommunicationRound	联邦学习通信轮次	20	20
Epoch	本地迭代次数	5	10
BatchSize/bit	批量大小	2048	512
Lr	学习率	0.0001	0.0001

有标签数据量	1%	5%	10%	20%
伪标签	70.81%	71.42%	72.87%	74.30%
有监督	69.90%	70.76%	71.77%	72.77%

有标签数据量	1%	5%	10%	20%
伪标签	68.48%	70.79%	72.55%	73.16%
有监督	67.93%	70.34%	71.66%	72.78%

有标签数据量	1%	5%	10%	20%
伪标签	58.08%	58.82%	61.84%	63.04%
有监督	57.63%	58.10%	61.42%	62.81%