An Intrusion Detection Method Based on Federated Learning and Convolutional Neural Network

doi:10.3969/j.issn.1671-1122.2020.04.006

Abstract

Abstract:

At present, intrusion detection based on deep learning is a hot topic in the field of intrusion detection, but most of the research focuses on how to improve the algorithm to improve the accuracy of intrusion detection, while neglecting that the limited label data generated by a single mechanism is not enough to train a depth model with high accuracy. In this paper, an intrusion detection method based on federated learning and convolution neural network is proposed, which can expand the amount of data through the joint training model of multiple participants. In this method, an intrusion detection model of deep learning is designed by using federated learning framework. Firstly, the data dimension is reconstructed to form two-dimensional data through data filling, and then the feature extraction learning is carried out by using DCNN network under the mechanism of federated learning. Finally, the training model of softmax classifier is combined and detected. The experimental results show that the method reduces the training time to a great extent and maintains a high detection rate. In addition, compared with the general intrusion detection model, the model also ensures the security and privacy of the data.

Key words: intrusion detection, federated learning, deep learning, convolution neural network

CLC Number:

TP309

WANG Rong, MA Chunguang, WU Peng. An Intrusion Detection Method Based on Federated Learning and Convolutional Neural Network[J]. Netinfo Security, 2020, 20(4): 47-54.

Figures/Tables 12

References 19

[1]	YIN Chuanlong, ZHU Yuefei, FEI Jinlong, et al.A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks[J]. IEEE Access, 2017(5): 21954-21961.
[2]	LI Zhipeng, QIN Zheng, HUANG Kai, et al.Intrusion Detection Using Convolutional Neural Networks for Representation Learning[C]//Springer. International Conference on Neural Information Processing, November 14-18, 2017, Guangzhou, China. Heidelberg: Springer, 2017: 858-866.
[3]	WANG Wei, SHENG Yiqiang, WANG Jinlin, et al.HAST-IDS: Learning Hierarchical Spatial-temporal Features Using Deep Neural Networks to Improve Intrusion Detection[J]. IEEE Access, 2017(6): 1792-1806.
[4]	ZHANG Hongpo, WU C Q, GAO Shan, et al.An Effective Deep Learning Based Scheme for Network Intrusion Detection[C]//IEEE. 24th International Conference on Pattern Recognition(ICPR), Auguest 20-24, 2018, Beijing, China. New Jersey: IEEE, 2018: 682-687.
[5]	AL-QATF M, YU Lasheng, AL-HABIB M, et al.Deep Learning Approach Combining Sparse Autoencoder With SVM for Network Intrusion Detection[J]. IEEE Access, 2018(6): 52843-52856.
[6]	NGUYEN T D, MARCHAL S, MIETTINEN M, et al.DÏoT: A Federated Self-learning Anomaly Detection System for IoT[C]//IEEE. 39th International Conference on Distributed Computing Systems(ICDCS), July 17-10, 2019, Dallas, TX, USA. New Jersey: IEEE, 2019: 756-767.
[7]	AVALLAEE M, BAGHERIE , LU W, et al. NSL-KDD[EB/OL]. , 2018-5-3.
[8]	GAO Yazhi, RONG Wenge, SHEN Yikang, et al.Convolutional Neural Network Based Sentiment Analysis Using Adaboost Combination[C]//IEEE. 2016 International Joint Conference on Neural Networks(IJCNN), July 24-29, 2016, Vancouver, BC, Canada. New Jersey: IEEE, 2016: 1333-1338.
[9]	YU Dingjun, WANG Hanli, CHEN Peiqiu, et al.Mixed Pooling for Convolutional Neural Networks[C]//Springer. International Conference on Rough Sets and Knowledge Technology, October 24-26, 2014, Shanghai, China. Heidelberg: Springer, 2014: 364-375.
[10]	YANG Qiang, LIU Yang, CHEN Tianjian, et al.Federated Machine Learning: Concept and Applications[J]. ACM Transactions on Intelligent Systems and Technology(TIST), 2019, 10(2): 1-19.
[11]	KONEČNÝ J, MCMAHAN H B, YU F X, et al. Federated Learning: Strategies for Improving Communication Efficiency[EB/OL]. , 2019-12-21.
[12]	TAVALLAEE M, BAGHERI E, LU W, et al.A Detailed Analysis of the KDD CUP 99 Data Set[C]//IEEE. 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, July 8-10, 2009, Ottawa, ON, Canada. New Jersey: IEEE, 2009: 1-6.
[13]	ZHANG Sicong, XIE Xiaoyao, XU Yang.Intrusion Detection Method Based on a Deep Convolutional Neural Network[J]. Journal of Tsinghua University(Science and Technology), 2019, 59(1): 46-54.
	张思聪,谢晓尧,徐洋. 基于dCNN的入侵检测方法[J]. 清华大学学报(自然科学版),2019,59(1):46-54.
[14]	LIANG Jie, CHEN Jiahao, ZHANG Xueqin.One-hot Encoding and Convolutional Neural Network Based Anomaly Detection[J]. Journal of Tsinghua University(Science and Technology), 2019, 59(7): 523-529.
	梁杰,陈嘉豪,张雪芹. 基于独热编码和卷积神经网络的异常检测[J]. 清华大学学报(自然科学版),2019,59(7):523-529.
[15]	WU Kehe, CHEN Zuge, LI Wei.A Novel Intrusion Detection Model for a Massive Network Using Convolutional Neural Networks[J]. IEEE Access, 2018(6): 50850-50859.
[16]	VINAYAKUMAR R, SOMAN K P, POORNACHANDRAN P.Applying Convolutional Neural Network for Network Intrusion Detection[C]//IEEE. 2017 International Conference on Advances in Computing, Communications and Informatics, September 13-16, 2017, Udupi, India. New Jersey: IEEE, 2017: 1222-1228.
[17]	KWON D, NATARAJAN K, SUH S C, et al.An Empirical Study on Network Anomaly Detection Using Convolutional Neural Networks[C]//IEEE. 2018 IEEE 38th International Conference on Distributed Computing Systems, July 2-6, Vienna, Austria. New Jersey: IEEE, 2018: 1595-1598.
[18]	CHOONG A C H, LEE N K. Evaluation of Convolutionary Neural Networks Modeling of DNA Sequences Using Ordinal Versus One-hot Encoding Method[C]//IEEE. 2017 International Conference on Computer and Drone Applications, November 9-11, Kuching, Malaysia. New Jersey: IEEE, 2017: 60-65.
[19]	SHONE N, NGOC T N, PHAI V D, et al.A Deep Learning Approach to Network Intrusion Detection[J]. IEEE Transactions on Emerging Topics in Computational Intelligence, 2018, 2(1): 41-50.

数据标签	独热编码后数据标签
Normal	(1,0,0,0,0)
DoS	(0,1,0,0,0)
Probe	(0,0,1,0,0)
U2R	(0,0,0,1,0)
R2L	(0,0,0,0,1)

数据集数据类型	KDDTrain+	KDDTest+	KDDTEST-21
Normal	67345	9711	2152
DoS	45926	7458	4342
Probe	11655	2421	2402
R2L	995	2754	2754
U2R	52	200	200
总量	125973	22544	11850

类型	数量	准确率/%
类型	数量	普通模型	转化模型
训练数据	124966	79.33	80.34
测试数据	22455	78.98	79.58

参数卷积层数	Conv1 核大小	步长	Pool1 核大小	Conv2 核大小	步长	Pool2 核大小
1层卷积	3×3	1	2×2	—	—	—
2层卷积	2×2	1	2×2	2×2	1	2×2

数据隐藏层	KDDTrain+		KDDTest+
数据隐藏层	准确率/%	测试时间/s	准确率/%	测试时间/s
1个隐藏层	97.12	1.24	78.31	0.22
2个隐藏层	98.02	1.22	79.50	0.23