CN117811846B - Network security detection method, system, equipment and medium based on distributed system - Google Patents

Abstract

The present invention discloses a network security detection method, system, device and medium based on a distributed system, which relates to the field of network security. In order to solve the problem that the edge computing device adopts a local network security detection model of a fixed size and cannot exert the optimal performance, the method includes training an initial network security detection model based on local security data; after inputting a test security data set into the initial network security detection model, adjusting the neural network depth of the initial network security detection model according to the output values corresponding to two output network blocks to obtain a local network security detection model; when the parameter update condition is met, updating the local network security detection model using the model parameters of the local network security detection model and the model parameters of the associated computing device; and performing local network security detection through the updated local network security detection model. The present invention enables the edge computing device to exert the optimal local network security detection performance and reduces the communication overhead and bandwidth requirements.

Description

Network security detection method, system, equipment and medium based on distributed system

Technical Field

The present invention relates to the field of network security, and in particular to a network security detection method, system, equipment and medium based on a distributed system.

Background Art

In the field of network security, in order to improve the detection capabilities of threats such as malware, network attacks, and data leaks, multiple edge computing devices and edge cloud servers in a distributed system can be used to collaboratively train local network security models, and network security detection can be performed using the trained local network security models. At present, each edge computing device usually uses a fixed-size model for training, and different edge computing devices may have different data volumes and requirements. For example, some edge computing devices have less data and require a small model, while some edge computing devices have more data and require a large model. Models of the same size cannot meet the needs of all devices, causing some edge computing devices to encounter performance bottlenecks when using models that are too large or too small, and fail to achieve optimal network security detection performance.

Therefore, how to provide a solution to the above technical problems is a problem that technical personnel in this field need to solve at present.

Summary of the invention

The purpose of the present invention is to provide a network security detection method, system, device and medium based on a distributed system, which can enable edge computing devices to exert optimal local network security detection performance while reducing communication overhead and bandwidth requirements.

In order to solve the above technical problems, the present invention provides a network security detection method based on a distributed system, which is applied to each edge computing device in the distributed system. Each edge computing device in the distributed system is divided into multiple data homogeneity clusters according to similarity. The network security detection method includes:

Training an initial network security detection model based on local security data, wherein the network of the initial network security detection model includes a plurality of neural network blocks connected in sequence, and the plurality of neural network blocks correspond to different neural network depths;

Selecting two output network blocks from the plurality of neural network blocks, inputting the test security data set into the initial network security detection model, and adjusting the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain a local network security detection model;

When the parameter update condition is met, the local network security detection model is updated using the model parameters of the local network security detection model and the model parameters of the associated computing device; the associated computing device is an edge computing device that is in the same data homogeneity cluster as itself and is connected to itself;

Perform local network security detection through the updated local network security detection model.

The process of adjusting the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain the local network security detection model includes:

Obtaining a first output value corresponding to the first output network block and a second output value corresponding to the second output network block, wherein the neural network depth of the first output network block is less than the neural network depth of the second output network block;

determining a depth adjustment strategy based on the first output value and the second output value;

The neural network depth of the initial network security detection model is adjusted according to the depth adjustment strategy to obtain a local network security detection model.

The process of determining the depth adjustment strategy based on the first output value and the second output value includes:

determining an absolute value of a difference between the first output value and the second output value;

Determine a depth adjustment direction based on a magnitude relationship between the first output value and the second output value; the depth adjustment direction is depth retreat or depth deepening;

Determine the adjustment condition satisfied by the performance gap between the shallow network model and the deep network model based on the size relationship between the absolute value and the preset value; the shallow network model is obtained based on the first output network block, the deep network model is obtained based on the second output network block, and the adjustment condition is an immediate adjustment condition or a step adjustment condition;

A depth adjustment strategy is determined based on the depth adjustment direction and an adjustment condition satisfied by the performance gap.

The process of determining the depth adjustment direction based on the magnitude relationship between the first output value and the second output value includes:

When the first output value is greater than the second output value, the depth adjustment direction is the depth retreat;

When the first output value is less than the second output value, the depth adjustment direction is to increase the depth.

The process of determining the adjustment condition satisfied by the performance gap between the shallow network model and the deep network model based on the magnitude relationship between the absolute value and the preset value includes:

When the absolute value is less than the preset value, it is determined that the performance gap between the shallow network model and the deep network model meets the step adjustment condition;

When the absolute value is greater than or equal to the preset value, it is determined that the performance gap between the shallow network model and the deep network model meets the immediate adjustment condition.

The process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is the depth rollback and the performance gap satisfies the instant adjustment condition, determining that the depth adjustment strategy is the depth rollback instant adjustment strategy;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain a local network security detection model includes:

When the depth adjustment strategy is the depth backoff instant adjustment strategy, the backoff depth is calculated using a first relational expression corresponding to the depth backoff instant adjustment strategy;

Adjusting the neural network depth of the initial network security detection model according to the fallback depth to obtain a local network security detection model;

The first relational expression is f ₁ (k)=η×e ^k , where f ₁ (k) is the backoff depth, η is a hyperparameter, and k is the absolute value.

The process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is the depth rollback and the performance gap satisfies the step adjustment condition, the depth adjustment strategy is determined to be the depth rollback step adjustment strategy, and the step rollback is written into the preset storage space as the current record;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain a local network security detection model includes:

When the depth adjustment strategy is the depth backoff step adjustment strategy, a continuous preset number of records including the current record in the preset storage space are obtained. If the continuous preset number of records including the current record are all the step backoffs, the neural network depth of the initial network security detection model is backed off by one layer to obtain a local network security detection model.

The process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is the depth deepening and the performance gap satisfies the instant adjustment condition, determining that the depth adjustment strategy is the depth deepening instant adjustment strategy;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain a local network security detection model includes:

When the depth adjustment strategy is the depth deepening instant adjustment strategy, the deepening depth is calculated using a second relational expression corresponding to the depth deepening instant adjustment strategy;

Adjusting the neural network depth of the initial network security detection model according to the deepening depth to obtain a local network security detection model;

The second relational expression is f ₂ (k)=η×e ^k , where f ₂ (k) is the deepening depth, η is a hyperparameter, and k is the absolute value.

The process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is the depth deepening and the performance gap satisfies the step adjustment condition, determining that the depth adjustment strategy is the depth deepening step adjustment strategy, and writing the step deepening as the current record into the preset storage space;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain a local network security detection model includes:

When the depth adjustment strategy is the depth deepening step adjustment strategy, a continuous preset number of records including the current record in the preset storage space are obtained. If the continuous preset number of records including the current record are all step deepening, the neural network depth of the initial network security detection model is deepened by one layer to obtain a local network security detection model.

The process of selecting two output network blocks from the plurality of neural network blocks includes:

Two adjacent neural network blocks are selected from the multiple neural network blocks as output network blocks.

The process of updating the local network security detection model by using the model parameters of the local network security detection model and the model parameters of the associated computing device includes:

Acquire model parameters of the local network security detection model, and send the model parameters of the local network security detection model to each of the associated computing devices;

Receiving model parameters sent by each of the associated computing devices;

Calculating neighborhood average values of model parameters of the local network security detection model and model parameters sent by each of the associated computing devices;

The local network security detection model is updated based on the neighborhood average value.

The process of obtaining the model parameters of the local network security detection model and sending the model parameters of the local network security detection model to each of the associated computing devices includes:

The model parameters of the standard depth of the local network security detection model are obtained, and the model parameters of the standard depth are sent to each of the associated computing devices.

After receiving the model parameters sent by each of the associated computing devices, the network security detection method further includes:

For each model parameter sent by the associated computing device, determine whether the neural network depth corresponding to the model parameter sent by the associated computing device is greater than the neural network depth of the local network security detection model; if so, determine the model parameter in the model parameter sent by the associated computing device that is the same as the neural network depth of the local network security detection model as the target model parameter; if not, determine the model parameter sent by the associated computing device as the target model parameter;

The process of calculating the neighborhood average values of the model parameters of the local network security detection model and the model parameters sent by each of the associated computing devices includes:

The neighborhood average values are calculated for the model parameters of the local network security detection model and each of the target model parameters.

After the local network security detection model is updated by using the model parameters of the local network security detection model and the model parameters of the associated computing device, the network security detection method further includes:

When the cluster aggregation condition is met and the device itself is not a cluster head device, the model parameters of the local network security detection model are sent to the cluster head device of the data homogeneity cluster in which the device is located, so that the cluster head device obtains the global model parameters in the cluster according to the model parameters of all edge computing devices in the data homogeneity cluster in which the device is located;

When the in-cluster global model parameters are acquired, the local network security detection model is updated using the in-cluster global model parameters, so that the local network security detection is performed using the updated local network security detection model.

The process of obtaining the global model parameters in the cluster according to the model parameters of all edge computing devices in the data homogeneity cluster includes:

The global model parameters in the cluster are calculated using the third relational expression, which is: ;

Among them, α is a hyperparameter, The cluster head device of the cth data homogeneity cluster stores the cluster global model parameters of the tth round, is the global model parameter of the cth data homogeneity cluster in the t+1th round, c is the sequence number of the data homogeneity cluster, is the model parameter of the j-th associated computing device in the device set _Ni of the data homogeneity cluster after the l-th update in the t-th round, _Ni is the device set of associated computing devices that have a connection relationship with the i-th edge computing device in the data homogeneity cluster, i is the sequence number of the edge computing device in the data homogeneity cluster, j is the sequence number of the associated computing device in the device set, and |N _i | is the total number of edge computing devices in the data homogeneity cluster.

Wherein, after the in-cluster global model parameters are acquired and the local network security detection model is updated using the in-cluster global model parameters, the network security detection method further includes:

When the global condition is met and the cluster head device itself is the cluster head device, the cluster global model parameters are sent to the edge cloud server in the distributed system, so that the edge cloud server obtains the global model based on the cluster global model parameters sent by the cluster head devices of all the data homogeneity clusters in the distributed system;

After receiving the global model, the model parameters of the local network security detection model are updated based on the model parameters of the global model, so as to perform local network security detection through the updated local network security detection model.

The process of obtaining the global model based on the intra-cluster global model parameters sent by the cluster head devices of all the data homogeneity clusters in the distributed system includes:

The global model is calculated using the fourth relationship; the fourth relationship is: ;

Wherein, C is the number of cluster head devices, is the global model in round t+1, is the model parameter of the cth data homogeneity cluster with respect to the data sample loss function L in the t+1th round, and c is the sequence number of the data homogeneity cluster.

Before training the initial network security detection model based on the local security data, the network security detection method further includes:

Receive the data homogeneity clusters divided by the edge cloud server in the distributed system based on similarity and the connection relationship between the edge computing devices in the data homogeneity clusters, so as to determine the associated computing device corresponding to itself based on the data homogeneity clusters and the connection relationship.

The process of dividing the edge cloud server in the distributed system into data homogeneous clusters based on similarity includes:

The edge cloud server in the distributed system obtains the test results obtained by each edge computing device in the distributed system based on the test security data set;

Constructing a weighted undirected graph between all the edge computing devices according to the similarity of the test results of all the edge computing devices;

All the edge computing devices are divided using the weighted undirected graph to obtain a plurality of data homogeneity clusters.

In order to solve the above technical problems, the present invention also provides a network security detection system based on a distributed system, which is applied to each edge computing device in the distributed system. Each edge computing device in the distributed system is divided into a plurality of data homogeneity clusters according to similarity. The network security detection system includes:

A training module, used for training an initial network security detection model based on local security data, wherein the network of the initial network security detection model includes a plurality of neural network blocks connected in sequence, and the plurality of neural network blocks correspond to different neural network depths;

A selection module is used to select two output network blocks from the plurality of neural network blocks, and after inputting the test security data set into the initial network security detection model, adjust the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain a local network security detection model;

An updating module, configured to update the local network security detection model using model parameters of the local network security detection model and model parameters of an associated computing device when a parameter update condition is met; the associated computing device is an edge computing device that is in the same data homogeneity cluster as the device and is connected to the device;

The detection module is used to perform local network security detection through an updated local network security detection model.

In order to solve the above technical problems, the present invention further provides an edge computing device, including:

Memory for storing computer programs;

A processor is used to implement the steps of the distributed system-based network security detection method as described in any one of the above when executing the computer program.

In order to solve the above technical problems, the present invention further provides a distributed system, comprising:

A plurality of edge computing devices as described above;

The edge cloud server is used to output a test data set and a clustering result to each of the edge computing devices, wherein the clustering result includes the data homogeneity cluster where the edge computing device is located and the associated computing device connected to the edge computing device.

To solve the above technical problems, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the network security detection method based on a distributed system as described in any one of the above are implemented.

The present invention provides a network security detection method based on a distributed system, in which the neural network depth of the local network security detection model of each edge computing device in the distributed system can be dynamically adjusted to better adapt to the requirements of diversified tasks, so that the edge computing device can play the best local network security detection performance. At the same time, the edge computing device can update the model parameters within the data homogeneity cluster, without uploading the model parameters to the edge cloud server every time communication, reducing communication overhead and bandwidth requirements. The present invention also provides a network security detection system based on a distributed system, an edge computing device, a distributed system and a computer-readable storage medium, which have the same beneficial effects as the above-mentioned network security detection method based on a distributed system.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a flow chart of the steps of a network security detection method based on a distributed system provided by the present invention;

FIG2 is a schematic diagram of the structure of a heterogeneous distributed system provided by the present invention;

FIG3 is a schematic diagram of a neural network model provided by the present invention;

FIG4 is a schematic diagram of the structure of a weighted undirected graph provided by the present invention;

FIG5 is a schematic diagram of clustering provided by the present invention;

FIG6 is a schematic structural diagram of a network security detection system based on a distributed system provided by the present invention;

FIG7 is a schematic diagram of the structure of an edge computing device provided by the present invention;

FIG8 is a schematic diagram of the structure of a distributed system provided by the present invention;

FIG. 9 is a schematic diagram of the structure of a computer-readable storage medium provided by the present invention.

DETAILED DESCRIPTION

The core of the present invention is to provide a network security detection method, system, device and medium based on a distributed system, which can enable edge computing devices to exert optimal local network security detection performance while reducing communication overhead and bandwidth requirements.

In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

In the first aspect, please refer to FIG. 1, which is a flow chart of the steps of a network security detection method based on a distributed system provided by the present invention. The network security detection method is applied to each edge computing device in the distributed system. Each edge computing device in the distributed system is divided into multiple data homogeneity clusters according to similarity. FIG. 2 is a structural schematic diagram of a distributed system provided by this embodiment, including an edge cloud server and multiple edge computing devices. Any two edge computing devices may or may not have data interaction. Each edge computing device interacts with the edge server. The network security detection method is described below using an edge computing device as an example. The network security detection method includes:

S101: training an initial network security detection model based on local security data, where the network of the initial network security detection model includes a plurality of neural network blocks connected in sequence, and the plurality of neural network blocks correspond to different neural network depths;

In this embodiment, the edge computing device uses local security data to perform model training to obtain an initial network security detection model. The initial network security detection model is composed of a plurality of Block modules (neural network blocks) with a fixed layer structure. Each neural network block includes a convolution layer, a batch normalization layer, a pooling layer, and an activation function. The connection of each neural network block should meet the consistency of the overall network structure, ensuring that each neural network block of the network can work together, effectively process input data, and enable the gradient to correctly propagate and update parameters. In this embodiment, each neural network block is assigned a Block number. As shown in FIG3, from shallow to deep layers, they are B1, B2, ..., BT. The initial state of the local network security detection model of each edge computing device is defined as a neural network block connected by numbers B1, B2, ..., BT. The output layer of each neural network block is connected to the model depth switching controller. Specifically, the model depth switching controller can be connected to any two neural network blocks with different neural network depths. The model depth switching controller is connected to the output layer module. The output layer module includes multiple fully connected layers and activation function layers, which convert the backbone network features into output probabilities. In this embodiment, the output layer module includes two branch output layers, which are respectively connected to the model depth switching controller. During initial training, the model depth switching controller is connected to the shallower adjacent 2-layer neural network block. The depth value is determined by the initialization parameter h, which can be set to 5 as an optional embodiment.

S102: selecting two output network blocks from a plurality of neural network blocks, inputting the test security data set into the initial network security detection model, and adjusting the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain a local network security detection model;

In order to obtain a more accurate neural network depth, this embodiment tests the local network security detection model based on the test data set after the model training cycle is fixed. The test data set is issued by the edge cloud server, and each edge computing device tests the initial network security detection model based on the same test data set. This embodiment can choose to test after the local network security detection model is trained C times, where C is a hyperparameter.

First, two output network blocks are selected from multiple neural network blocks, the output layer of the first output network block is connected to the first access terminal of the model depth switching controller, the output layer of the second output network module is connected to the second access terminal of the model depth switching controller, the output layer of the first branch of the output layer module is connected to the first output terminal of the model depth switching controller, and the output layer of the second branch of the output layer module is connected to the second output terminal of the model depth switching controller. After the test data set is input into the initial network security detection model, the test results of all test samples are obtained, and the test results are output in the output layer module. The output value of the output layer of the first branch in the output layer module is the test result of the first output network block, and the output value of the output layer of the second branch in the output layer module is the test result of the second output network block. Exemplarily, for the classification task, the classification task results of all test samples are obtained and judged, and the average accuracy rate is calculated.

The output layer module sends the output results of the test data sets of the two branches corresponding to different neural network depths to the decision maker, which determines whether to change the neural network depth of the initial network security detection model. If the decision is adjusted, the current neural network depth of the initial network security detection model is retracted or deepened according to the corresponding adjustment strategy to obtain the local network security detection model, so that the edge computing device can achieve the best network security detection performance.

S103: When the parameter update condition is met, the local network security detection model is updated using the model parameters of the local network security detection model and the model parameters of the associated computing device; the associated computing device is an edge computing device that is in the same data homogeneity cluster as the device and is connected to the device;

S104: Perform local network security detection using the updated local network security detection model.

It is understandable that the distributed system includes an edge cloud server and multiple edge computing devices. In the existing federated learning solution, all edge computing devices need to send local network security detection models to the edge cloud server for aggregation. The edge cloud server has limited bandwidth, and the transmission of a large number of model parameters will affect the efficiency of model replacement in federated learning. In addition, the data sets stored by the edge computing devices have problems such as data heterogeneity. Simply aggregating many models will cause the federated aggregated model to have offset errors in different federated computing devices, because the federated aggregated model is a comprehensive model that integrates the data characteristics of all federated devices, and may even cause model degradation. Based on this, this embodiment first clusters each edge computing device in a heterogeneous distributed system based on the data heterogeneity of each edge computing device.

In an exemplary embodiment, before training the initial network security detection model based on local security data, the network security detection method based on the distributed system further includes:

The edge cloud server in the distributed system receives data homogeneity clusters divided based on similarity and connection relationships between edge computing devices in the data homogeneity clusters, so as to determine the associated computing device corresponding to itself based on the data homogeneity clusters and the connection relationships.

In an exemplary embodiment, the process of dividing the edge cloud server in the distributed system into data homogeneous clusters based on similarity includes:

The edge cloud server in the distributed system obtains the test results obtained by each edge computing device in the distributed system based on the test security data set;

Construct a weighted undirected graph between all edge computing devices based on the similarity of the test results of all edge computing devices;

All edge computing devices are divided into multiple data homogeneous clusters using a weighted undirected graph.

Assuming that there are N edge computing devices in total, this embodiment first needs to build a weighted undirected graph between all devices. First, all edge computing devices perform one local data model training, that is, the edge computing devices use the local security data set for training to obtain a local network security detection model. The edge cloud server searches for public data from the public network, builds a test data set for this federated learning task, and sends the test data set to each edge computing device. The edge computing device stores the test data set and uses the local network security detection model to test the public data set to obtain the test results. The test results are uploaded to the edge cloud server. Because the own data used by the edge computing device has data heterogeneity, that is, the data of each edge computing device is limited, and most of them only contain samples of limited categories. Therefore, the structure of the test using the test data set is also different and there are deviations. All edge computing devices upload the test results of the public test data set to the edge cloud server, and the edge cloud server uses the test results of all devices to establish a weighted undirected graph.

Specifically, the edge cloud server uses a vector similarity calculation method, such as the Jaccard similarity coefficient calculation method, to calculate the similarity of the test results of all edge computing devices and perform neighbor sorting. The Jaccard similarity coefficient is often used to calculate the similarity between sets, and can also be used to calculate the similarity of binary vectors. For two binary vectors A and B, the calculation formula of the Jaccard similarity coefficient is: similarity=|A∩B|/|A∪B|, where A∩B represents the intersection of vectors A and B, and A∪B represents the union of vectors A and B. For example, the test result of device A is a binary vector [1,0,0,0,...1,1,1,0], and the classification result of device B is also a binary vector [0,1,1,0,...1,1,1,0]. The Jaccard similarity coefficient can be used to calculate the similarity of the results of devices A and B. This is just an example to illustrate a special case of the similarity of the results of edge computing devices, and it does not protect only this calculation method.

The edge cloud server traverses the test results of all edge computing devices, calculates the result similarity of each edge computing device with other edge computing devices, and constructs the edge between the edge computing device and other edge computing devices according to the value of the result similarity. That is, when the value of the result similarity is greater than P, a connecting edge is constructed between the two similar edge computing devices. The value of the edge is the calculation result of the result similarity. P is an artificially set threshold. When the value of the result similarity is less than P, the relationship between the connecting edges of the two edge computing devices is not established. The weighted undirected graph constructed between all edge computing devices can be shown in Figure 4, which shows 6 edge computing devices, namely device 1 to device 6.

Each edge computing device in the weighted undirected graph is initialized as a separate homogeneous cluster, that is, the label of each edge computing device is initially the identifier of the edge computing device itself. For each edge computing device, consider the labels of its neighbor edge computing devices, traverse each edge computing device, and perform iterative updates in a fixed order or random order. For the current edge computing device, collect the labels of its neighbor edge computing devices, count the number of occurrences of each label in the neighbor edge computing devices, select the label with the most occurrences in the neighbor edge computing devices as the new label of the current edge computing device, and update the label of the current edge computing device to the new label. After each iteration, check the change of the label. The change amount can be judged by comparing the labels of the current iteration and the previous iteration. If the change amount of the label is less than the set threshold, that is, the label is basically stable and no longer changes, the algorithm is considered to have converged. If the label is still changing, continue to iterate the label propagation step. If the algorithm converges, that is, the label no longer changes significantly, the iteration is terminated. If the label is still changing, continue to iterate the label propagation.

When the algorithm converges, the final label propagation result is obtained, and the edge computing devices with the same label are divided into the same data homogeneity cluster to obtain the final division result. Each data homogeneity cluster is a set of edge computing devices with the same label. The edge cloud server sends the divided data homogeneity cluster and the connection relationship within the cluster to all edge computing devices. Each edge computing device will obtain the device number of the edge computing device connected to its own data homogeneity. In the future, the device number will be used to update the model parameters with the edge computing devices of the same cluster neighbors. A divided data homogeneity cluster is shown in Figure 5. According to the divided data homogeneity cluster, such as label A represents a data homogeneity cluster, label B represents a data homogeneity cluster, label A includes device 1 and device 2, and label B includes device 3 to device 6. The present invention performs federated learning and needs to select a cluster head. The selection principle is communication efficiency or proximity selection: select the edge computing device that is closer to other edge computing devices or has the fastest communication with the other edge computing devices in the data homogeneity cluster as the cluster head. This can reduce the communication distance and delay and improve communication efficiency. The edge cloud server selects the cluster head of each data homogeneity cluster through the communication rate for data exchange with all edge computing devices, and sends the edge computing device number of the cluster head to the edge computing device of the cluster.

When the parameter update conditions are met, the local network security detection model is updated using the model parameters of the local network security detection model and the model parameters of the associated computing device. The associated computing device is an edge computing device that is in the same data homogeneity cluster as the edge computing device and has a connection edge with the edge computing device. In the process of updating the model within the cluster, each edge computing device first performs a model parameter aggregation process with the associated edge computing devices connected to its cluster. This can accelerate model convergence and make the classification of homogeneous devices within the cluster more accurate, so that the models between devices with the most similar data types can be aggregated and updated to obtain more information.

After the local network security detection model is updated using the model parameters of the local network security detection model and the model parameters of the associated computing device, local network security detection is performed using the local network security detection model, so that the edge computing device can exert the optimal local network security detection performance.

It can be seen that in this embodiment, the neural network depth of the local network security detection model of each edge computing device in the distributed system can be dynamically adjusted to better adapt to the requirements of diversified tasks and enable the edge computing device to exert the best local network security detection performance. At the same time, the edge computing device can update the model parameters within the data homogeneity cluster, without uploading the model parameters to the edge cloud server during each communication, reducing communication overhead and bandwidth requirements.

Based on the above embodiments:

In an exemplary embodiment, the process of adjusting the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain the local network security detection model includes:

Obtain a first output value corresponding to a first output network block and a second output value corresponding to a second output network block, wherein the neural network depth of the first output network block is less than the neural network depth of the second output network block;

determining a depth adjustment strategy based on the first output value and the second output value;

The neural network depth of the initial network security detection model is adjusted according to the depth adjustment strategy to obtain a local network security detection model.

In this embodiment, the first output network block is shallower than the second output network block. The output value of the output branch corresponding to the shallow output network block is recorded as q, and the output value of the output branch corresponding to the deep output network block is recorded as d. The absolute value of the difference between the shallow and deep data output values is obtained, k=|q-d|. It can be understood that the depth adjustment direction can be determined according to the size relationship between q and d, and the performance gap between the deep network model and the shallow network model can be determined according to the size relationship between k and the preset value beta.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the first output value and the second output value includes:

determining an absolute value of a difference between the first output value and the second output value;

Determine the depth adjustment direction based on the magnitude relationship between the first output value and the second output value; the depth adjustment direction is depth retreat or depth deepening;

Determine the adjustment condition satisfied by the performance gap between the shallow network model and the deep network model based on the size relationship between the absolute value and the preset value; the shallow network model is obtained based on the first output network block, the deep network model is obtained based on the second output network block, and the adjustment condition is an immediate adjustment condition or a step adjustment condition;

The depth adjustment strategy is determined based on the depth adjustment direction and the adjustment conditions satisfied by the performance gap.

In an exemplary embodiment, the process of determining the depth adjustment direction based on the magnitude relationship between the first output value and the second output value includes:

When the first output value is greater than the second output value, the depth adjustment direction is depth retreat;

When the first output value is less than the second output value, the depth adjustment direction is increasing the depth.

In an exemplary embodiment, the process of determining the adjustment condition satisfied by the performance gap between the shallow network model and the deep network model based on the magnitude relationship between the absolute value and the preset value includes:

When the absolute value is less than the preset value, it is determined that the performance gap between the shallow network model and the deep network model meets the step adjustment condition;

When the absolute value is greater than or equal to the preset value, it is determined that the performance gap between the shallow network model and the deep network model meets the immediate adjustment condition.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is depth rollback and the performance gap meets the immediate adjustment condition, the depth adjustment strategy is determined to be the depth rollback immediate adjustment strategy;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain the local network security detection model includes:

When the depth adjustment strategy is a depth backoff instant adjustment strategy, the backoff depth is calculated using a first relational expression corresponding to the depth backoff instant adjustment strategy;

The neural network depth of the initial network security detection model is adjusted according to the backoff depth to obtain a local network security detection model;

The first relation is f ₁ (k) = η×e ^k , where f ₁ (k) is the backoff depth, η is a hyperparameter, and k is an absolute value.

In this embodiment, if q>d, and k>beta, it means that the output result of the shallow network model is better than the output result of the deep network model, and the performance gap is large. Then the decision maker outputs a deep backoff decision, and the backoff depth is obtained by the first relational expression.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is depth rollback and the performance gap meets the step adjustment condition, the depth adjustment strategy is determined to be the depth rollback step adjustment strategy, and the step rollback is written into the preset storage space as the current record;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain the local network security detection model includes:

When the depth adjustment strategy is a depth backoff step adjustment strategy, a preset number of consecutive records including the current record are obtained in the preset storage space. If the preset number of consecutive records including the current record are all step backoff, the neural network depth of the initial network security detection model is backed off by one layer to obtain a local network security detection model.

In this embodiment, if q>d, and k<beta, it means that the output result of the shallow network model is better than the output result of the deep network model, and the performance improvement is small. The model depth may need to be adjusted step by step, but it will not be adjusted immediately. The decision maker records the result in the memory unit of the decision maker. The decision maker reads the latest three recorded results of the memory unit for judgment. If it is found that step back is needed for three consecutive times, the decision maker outputs a deep backoff decision and backs off by 1 layer.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is depth deepening and the performance gap meets the immediate adjustment condition, the depth adjustment strategy is determined to be the depth deepening immediate adjustment strategy;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain the local network security detection model includes:

When the depth adjustment strategy is a depth deepening instant adjustment strategy, the deepening depth is calculated using a second relational expression corresponding to the depth deepening instant adjustment strategy;

Adjusting the neural network depth of the initial network security detection model according to the deepening depth to obtain a local network security detection model;

The second relation is f ₂ (k) = η × e ^k , where f ₂ (k) is the deepening depth, η is a hyperparameter, and k is an absolute value.

In this embodiment, if q<d, and k>beta, it means that the output result of the deep network model is better than the output result of the shallow network model, and the performance gap is large. Then the decision maker outputs a deepening decision, and the second relational expression of the deepening depth is obtained.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is depth deepening and the performance gap meets the step adjustment condition, the depth adjustment strategy is determined to be the depth deepening step adjustment strategy, and the step deepening is written into the preset storage space as the current record;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain the local network security detection model includes:

When the depth adjustment strategy is a depth deepening step adjustment strategy, a continuous preset number of records including the current record in the preset storage space are obtained. If the continuous preset number of records including the current record are all step-deepening, the neural network depth of the initial network security detection model is deepened by one layer to obtain a local network security detection model.

In this embodiment, if q<d, and k<beta, it means that the output result of the deep network model is better than the output result of the shallow network model, and the performance improvement is small. The model depth may need to be stepped up, but it will not be adjusted immediately. The decision maker records the result in the memory unit of the decision maker. The decision maker reads the latest three recorded results of the memory unit for judgment. If it is found that step-up is required for three consecutive times, the decision maker outputs a depth deepening decision and deepens by 1 layer.

The depth adjustment mechanism in this embodiment can not only deepen but also shallow, can not only adjust quickly but also control slowly, and is more flexible. The decision maker feeds back the output decision to the model depth switching controller, and the depth model controller executes the depth switching and performs corresponding deepening or fallback switching according to the existing model depth reference layer.

In an exemplary embodiment, the process of selecting two output network blocks from a plurality of neural network blocks includes:

Two adjacent neural network blocks are selected from multiple neural network blocks as output network blocks.

The model adaptive growth provided in this embodiment solves the limitations of traditional fixed-size models by gradually increasing the model capacity and complexity on edge computing devices, and can handle diversified tasks: as federated learning involves more different types of tasks and data, model adaptive growth allows the capacity of the model to be increased on local devices according to the complexity of the task, thereby better adapting to the requirements of diversified tasks; it can improve model performance: by gradually increasing the model capacity, model adaptive growth can overcome the capacity limitations that fixed-size models may encounter, thereby improving the performance and representation capabilities of the model, and helping to better capture the characteristics and patterns of the data; it can reduce communication overhead: in traditional federated learning, each communication requires uploading the complete model parameters, while model adaptive growth allows more local training and updates on local devices, reducing communication overhead and bandwidth requirements; it can improve data privacy: in model adaptive growth, the training data on the device can be kept more locally, and only the incremental parameters of the model need to be uploaded, which helps to improve data privacy protection.

In an exemplary embodiment, the process of updating the local network security detection model using the model parameters of the local network security detection model and the model parameters of the associated computing device includes:

Obtain model parameters of a local network security detection model, and send the model parameters of the local network security detection model to each associated computing device;

Receiving model parameters sent by each associated computing device;

Calculate neighborhood average values of model parameters of the local network security detection model and model parameters sent by each associated computing device;

Update the local network security detection model based on the neighborhood average.

In this embodiment, it is assumed that all edge computing devices are divided into C clusters, represented by the set {s ₁ , …, _sc }, and the kth cluster _sk contains n _k = |s _k | edge devices. In the federated learning system, each edge computing device i trains a personalized local network security detection model for the device based on its own data set D _i according to the adaptive model growth algorithm. The local empirical loss function of the data distribution at the edge computing device i is

;

In the formula, for The loss function is The parameters of the two exports of the local network security detection model, is the parameter set of the entire local network security detection model, _Di is the local data set, | _Di | is the total amount of data samples, is the data sample loss function, is the data sample participating in iterative training in the local dataset, It is the sample loss function of the two exports of the local network security detection model, quantifying the data samples The prediction error on .

The main goal of the hierarchical aggregation federated learning algorithm is to optimize the global model parameters to minimize the global loss function associated with all devices: .

in, are the model parameters of the global network model, is the loss value of the model parameter of the global network model, N is the total number of edge computing devices in the distributed system, are the model parameters of the i-th edge computing device in cluster S _k , i∈(1,2,3... _nk -1, _nk ), _nk is the total number of edge computing devices in cluster S _k , k is the sequence number of the data homogeneity cluster, k∈(1,2,3...C-1,C), and C is the total number of clusters in the distributed system.

In hierarchical aggregation federated learning, the training process is divided into three steps: local network security detection model update, intra-cluster aggregation, and global aggregation. The combination of these steps is called a training round.

Local network security detection model update: Each edge computing device uses the Stochastic gradient descent algorithm to update the local network security detection model. The iterative update process is

;

In the formula, is the model parameter of the local network security detection model of the ith edge computing device after the lth iteration update in the tth round, i is the serial number of the edge computing device in the data homogeneity cluster, is the model parameter of the i-th edge computing device before the l- th iteration update in the t-th round, is the learning rate updated in the lth iteration of the tth round, is the Hamiltonian operator, is the data sample in the local dataset that participates in the lth iteration update in the tth round, It is the sample loss function updated at the lth iteration of the tth round.

Edge computing devices in the same data homogeneity cluster perform After the iteration update, the cluster model aggregation is performed. Device i∈s _k numbers the local network security detection model Connect the neural network block as a parameter for updating the local network security detection model And send it to the associated computing devices j∈N _i adjacent to it in the data homogeneity cluster in a broadcast manner, and at the same time receive the model parameters from N _i to calculate the neighborhood average value to update the local network security detection model in this edge computing device.

In an exemplary embodiment, the process of obtaining model parameters of a local network security detection model and sending the model parameters of the local network security detection model to each associated computing device includes:

Obtain model parameters of the standard depth of the local network security detection model, and send the model parameters of the standard depth to each associated computing device.

In an exemplary embodiment, after receiving the model parameters sent by each associated computing device, the network security detection method further includes:

For each model parameter sent by the associated computing device, determine whether the neural network depth corresponding to the model parameter sent by the associated computing device is greater than the neural network depth of the local network security detection model; if so, determine the model parameter in the model parameter sent by the associated computing device that is the same as the neural network depth of the local network security detection model as the target model parameter; if not, determine the model parameter sent by the associated computing device as the target model parameter;

The process of calculating the neighborhood average values of the model parameters of the local network security detection model and the model parameters sent by each associated computing device includes:

The neighborhood average values of the model parameters of the local network security detection model and each target model parameter are calculated.

In the cluster aggregation process of adjacent edge computing devices, since the neural network depth of each edge computing device is different, each edge computing device only sends the model block parameters of its standard depth, and its output layer module is sent and does not participate in aggregation. If the receiving device receives a model parameter deeper than itself, it only takes the model parameter of the corresponding depth for aggregation. On the contrary, if the edge computing device receives a model parameter shallower than itself, it can directly aggregate. In the process of updating the model within the cluster, first, each edge computing device aggregates the model parameters with the neighboring edge computing devices connected to its cluster, which can accelerate the convergence of the model and make the classification of the same type of devices in the cluster more accurate, so that the model aggregation and update between devices with the most similar data types can obtain more information.

In an exemplary embodiment, after updating the local network security detection model using the model parameters of the local network security detection model and the model parameters of the associated computing device, the network security detection method further includes:

When the cluster aggregation conditions are met and the device itself is not a cluster head device, the model parameters of the local network security detection model are sent to the cluster head device of the data homogeneity cluster in which the device is located, so that the cluster head device can obtain the global model parameters in the cluster according to the model parameters of all edge computing devices in the data homogeneity cluster in which the device is located;

When the cluster global model parameters are obtained, the local network security detection model is updated using the cluster global model parameters, so that the local network security detection is performed through the updated local network security detection model.

In an exemplary embodiment, the process of obtaining the global model parameters in the cluster according to the model parameters of all edge computing devices in the data homogeneity cluster includes:

The global model parameters in the cluster are calculated using the third relational expression, which is: ;

Among them, α is a hyperparameter, The cluster head device of the cth data homogeneity cluster stores the cluster global model parameters of the tth round, The cluster head device of the c-th data homogeneity cluster stores the in-cluster global model parameters of the c-th data homogeneity cluster in the t+1-th round, where c is the sequence number of the data homogeneity cluster. is the model parameter of the j-th associated computing device in the device set _Ni of the data homogeneity cluster after the l-th update in the t-th round, _Ni is the device set of associated computing devices that have a connection relationship with the i-th edge computing device in the data homogeneity cluster, i is the sequence number of the edge computing device in the data homogeneity cluster, j is the sequence number of the associated computing device in the device set, and |N _i | is the total number of edge computing devices in the data homogeneity cluster.

In this embodiment, when the number of iterations l is When the value is an integer multiple of , all edge computing devices in the data homogeneity cluster will set the model parameters of their local network security detection model to , sent to the cluster head, and the global model parameters are aggregated within the cluster to obtain ;

Among them, the constant α is a hyperparameter. is the cluster model parameter of the tth round stored in the cluster head, Represents the aggregation parameters of the cluster model in round t+1 after the update is completed.

In an exemplary embodiment, after obtaining the in-cluster global model parameters and updating the local network security detection model using the in-cluster global model parameters, the network security detection method based on the distributed system further includes:

When the global conditions are met and the cluster head device itself is a cluster head device, the cluster global model parameters are sent to the edge cloud server in the distributed system, so that the edge cloud server obtains the global model based on the cluster global model parameters sent by the cluster head devices of all data homogeneity clusters in the distributed system;

After receiving the global model, the model parameters of the local network security detection model are updated based on the model parameters of the global model, so that the local network security detection is performed through the updated local network security detection model.

In an exemplary embodiment, the process of obtaining the global model based on the global model parameters in the cluster sent by the cluster head devices of all data homogeneity clusters in the distributed system includes:

The global model is calculated using the fourth relationship; the fourth relationship is: ;

Wherein, C is the number of cluster head devices, is the global model in round t+1, is the model parameter of the cth data homogeneity cluster with respect to the data sample loss function L in the t+1th round, and c is the sequence number of the data homogeneity cluster.

In this embodiment, when all clusters perform τ times of intra-cluster global aggregation, the edge cloud server performs global aggregation in a synchronous manner. The cluster head device uploads the parameters of the model at this time to the server. The server receives the model parameters of the local network security detection model of C cluster head devices, and updates the global model by averaging the parameters: ; The edge cloud server broadcasts the global model to all devices.

In this embodiment, after the edge cloud server broadcasts the global model to all edge computing devices, each edge computing device uses the corresponding part of the global model Block to update the local network security detection model Block, and uses local data for training. After completing h rounds of training, the edge cloud server sends instructions to require the device to test the public test data set and upload the test structure. The edge cloud server obtains the test structure, re-executes data homogeneity clustering and data homogeneity cluster dynamic division, and sends the division results to all edge computing devices again, and performs hierarchical clustering model update again, repeating the above steps until the global model converges.

In the second aspect, referring to FIG. 6 , the present invention further provides a network security detection system based on a distributed system, which is applied to each edge computing device in the distributed system. Each edge computing device in the distributed system is divided into a plurality of data homogeneity clusters according to similarity. The network security detection system includes:

A training module 11 is used to train an initial network security detection model based on local security data, where the network of the initial network security detection model includes a plurality of neural network blocks connected in sequence, and the plurality of neural network blocks correspond to different neural network depths;

A selection module 12 is used to select two output network blocks from a plurality of neural network blocks, and after inputting the test security data set into the initial network security detection model, adjust the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain a local network security detection model;

An updating module 13 is used to update the local network security detection model using the model parameters of the local network security detection model and the model parameters of the associated computing device when the parameter update condition is met; the associated computing device is an edge computing device that is in the same data homogeneity cluster as itself and is connected to itself;

The detection module 14 is used to perform local network security detection by using the updated local network security detection model.

In an exemplary embodiment, the process of adjusting the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain the local network security detection model includes:

Obtain a first output value corresponding to a first output network block and a second output value corresponding to a second output network block, wherein the neural network depth of the first output network block is less than the neural network depth of the second output network block;

determining a depth adjustment strategy based on the first output value and the second output value;

The neural network depth of the initial network security detection model is adjusted according to the depth adjustment strategy to obtain a local network security detection model.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the first output value and the second output value includes:

determining an absolute value of a difference between the first output value and the second output value;

Determine the depth adjustment direction based on the magnitude relationship between the first output value and the second output value; the depth adjustment direction is depth retreat or depth deepening;

Determine the adjustment condition satisfied by the performance gap between the shallow network model and the deep network model based on the size relationship between the absolute value and the preset value; the shallow network model is obtained based on the first output network block, the deep network model is obtained based on the second output network block, and the adjustment condition is an immediate adjustment condition or a step adjustment condition;

The depth adjustment strategy is determined based on the depth adjustment direction and the adjustment conditions satisfied by the performance gap.

In an exemplary embodiment, the process of determining the depth adjustment direction based on the magnitude relationship between the first output value and the second output value includes:

When the first output value is greater than the second output value, the depth adjustment direction is depth retreat;

When the first output value is less than the second output value, the depth adjustment direction is increasing the depth.

In an exemplary embodiment, the process of determining the adjustment condition satisfied by the performance gap between the shallow network model and the deep network model based on the magnitude relationship between the absolute value and the preset value includes:

When the absolute value is less than the preset value, it is determined that the performance gap between the shallow network model and the deep network model meets the step adjustment condition;

When the absolute value is greater than or equal to the preset value, it is determined that the performance gap between the shallow network model and the deep network model meets the immediate adjustment condition.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is depth rollback and the performance gap meets the immediate adjustment condition, the depth adjustment strategy is determined to be the depth rollback immediate adjustment strategy;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain the local network security detection model includes:

When the depth adjustment strategy is a depth backoff instant adjustment strategy, the backoff depth is calculated using a first relational expression corresponding to the depth backoff instant adjustment strategy;

The neural network depth of the initial network security detection model is adjusted according to the backoff depth to obtain a local network security detection model;

The first relation is f ₁ (k) = η×e ^k , where f ₁ (k) is the backoff depth, η is a hyperparameter, and k is an absolute value.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is depth rollback and the performance gap meets the step adjustment condition, the depth adjustment strategy is determined to be the depth rollback step adjustment strategy, and the step rollback is written into the preset storage space as the current record;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain the local network security detection model includes:

When the depth adjustment strategy is a depth backoff step adjustment strategy, a preset number of consecutive records including the current record are obtained in the preset storage space. If the preset number of consecutive records including the current record are all step backoff, the neural network depth of the initial network security detection model is backed off by one layer to obtain a local network security detection model.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is depth deepening and the performance gap meets the immediate adjustment condition, the depth adjustment strategy is determined to be the depth deepening immediate adjustment strategy;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain the local network security detection model includes:

When the depth adjustment strategy is a depth deepening instant adjustment strategy, the deepening depth is calculated using a second relational expression corresponding to the depth deepening instant adjustment strategy;

Adjusting the neural network depth of the initial network security detection model according to the deepening depth to obtain a local network security detection model;

The second relation is f ₂ (k) = η × e ^k , where f ₂ (k) is the deepening depth, η is a hyperparameter, and k is an absolute value.

In an exemplary embodiment, the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap includes:

When the depth adjustment direction is depth deepening and the performance gap meets the step adjustment condition, the depth adjustment strategy is determined to be the depth deepening step adjustment strategy, and the step deepening is written into the preset storage space as the current record;

The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain the local network security detection model includes:

When the depth adjustment strategy is a depth deepening step adjustment strategy, a continuous preset number of records including the current record in the preset storage space are obtained. If the continuous preset number of records including the current record are all step-deepening, the neural network depth of the initial network security detection model is deepened by one layer to obtain a local network security detection model.

In an exemplary embodiment, the process of selecting two output network blocks from a plurality of neural network blocks includes:

Two adjacent neural network blocks are selected from multiple neural network blocks as output network blocks.

In an exemplary embodiment, the process of updating the local network security detection model using the model parameters of the local network security detection model and the model parameters of the associated computing device includes:

Obtain model parameters of a local network security detection model, and send the model parameters of the local network security detection model to each associated computing device;

Receiving model parameters sent by each associated computing device;

Calculate neighborhood average values of model parameters of the local network security detection model and model parameters sent by each associated computing device;

Update the local network security detection model based on the neighborhood average.

In an exemplary embodiment, the process of obtaining model parameters of a local network security detection model and sending the model parameters of the local network security detection model to each associated computing device includes:

The model parameters of the standard depth of the local network security detection model are obtained, and the model parameters of the standard depth are sent to each associated computing device.

In an exemplary embodiment, the network security detection system further includes:

A first determination module is used to, after receiving the model parameters sent by each associated computing device, determine, for each model parameter sent by the associated computing device, whether the neural network depth corresponding to the model parameter sent by the associated computing device is greater than the neural network depth of the local network security detection model; if so, determine the model parameter in the model parameter sent by the associated computing device that is the same as the neural network depth of the local network security detection model as the target model parameter; if not, determine the model parameter sent by the associated computing device as the target model parameter;

The process of calculating the neighborhood average values of the model parameters of the local network security detection model and the model parameters sent by each associated computing device includes:

The neighborhood average values of the model parameters of the local network security detection model and each target model parameter are calculated.

In an exemplary embodiment, the network security detection system further includes:

The first sending module is used to send the model parameters of the local network security detection model to the cluster head device of the data homogeneity cluster in which it is located when the cluster aggregation condition is met and the cluster head device is not a cluster head device, so that the cluster head device obtains the global model parameters in the cluster according to the model parameters of all edge computing devices in the data homogeneity cluster in which it is located;

The updating module 13 is further configured to update the local network security detection model using the global model parameters within the cluster when the global model parameters within the cluster are acquired, so as to perform local network security detection through the updated local network security detection model.

In an exemplary embodiment, the process of obtaining the global model parameters in the cluster according to the model parameters of all edge computing devices in the data homogeneity cluster includes:

The global model parameters in the cluster are calculated using the third relational expression, which is: ;

Among them, α is a hyperparameter, The cluster head device of the cth data homogeneity cluster stores the cluster global model parameters of the tth round, is the global model parameter of the cth data homogeneity cluster in the t+1th round, c is the sequence number of the data homogeneity cluster, is the model parameter of the j-th associated computing device in the device set _Ni of the data homogeneity cluster after the l-th update in the t-th round, _Ni is the device set of associated computing devices that have a connection relationship with the i-th edge computing device in the data homogeneity cluster, i is the sequence number of the edge computing device in the data homogeneity cluster, j is the sequence number of the associated computing device in the device set, and |N _i | is the total number of edge computing devices in the data homogeneity cluster.

In an exemplary embodiment, the network security detection system based on the distributed system further includes:

The second sending module is used to, after obtaining the in-cluster global model parameters and updating the local network security detection model with the in-cluster global model parameters, send the in-cluster global model parameters to the edge cloud server in the distributed system when the global conditions are met and the device itself is a cluster head device, so that the edge cloud server obtains the global model based on the in-cluster global model parameters sent by the cluster head devices of all data homogeneity clusters in the distributed system;

The updating module 13 is further configured to update the model parameters of the local network security detection model based on the model parameters of the global model after receiving the global model, so as to perform local network security detection through the updated local network security detection model.

In an exemplary embodiment, the process of obtaining the global model based on the global model parameters in the cluster sent by the cluster head devices of all data homogeneity clusters in the distributed system includes:

The global model is calculated using the fourth relationship; the fourth relationship is: ;

Wherein, C is the number of cluster head devices, is the global model in round t+1, is the model parameter of the cth data homogeneity cluster with respect to the data sample loss function L in the t+1th round, and c is the sequence number of the data homogeneity cluster.

In an exemplary embodiment, the network security detection system based on the distributed system further includes:

The receiving module is used to receive the data homogeneity clusters divided by similarity and the connection relationship between each edge computing device in the data homogeneity cluster from the edge cloud server in the distributed system before training the initial network security detection model based on local security data, so as to determine the corresponding associated computing device based on the data homogeneity cluster and the connection relationship.

In an exemplary embodiment, the process of dividing the edge cloud server in the distributed system into data homogeneous clusters based on similarity includes:

The edge cloud server in the distributed system obtains the test results obtained by each edge computing device in the distributed system based on the test security data set;

Construct a weighted undirected graph between all edge computing devices based on the similarity of the test results of all edge computing devices;

All edge computing devices are divided into multiple data homogeneous clusters using a weighted undirected graph.

In the third aspect, please refer to FIG. 7, which is a schematic diagram of the structure of an edge computing device provided by the present invention, including:

A memory 21, used for storing computer programs;

The processor 22 is used to implement the steps of the distributed system-based network security detection method described in any one of the above embodiments when executing the computer program.

The edge computing device also includes:

The input interface 23 is connected to the processor 22 via the communication bus 26, and is used to obtain the computer programs, parameters and instructions imported from the outside, and save them in the memory 21 under the control of the processor 22. The input interface can be connected to an input device to receive parameters or instructions manually input by the user. The input device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the terminal housing.

The display unit 24 is connected to the processor 22 via the communication bus 26 and is used to display the data sent by the processor 22. The display unit can be a liquid crystal display or an electronic ink display.

The network port 25 is connected to the processor 22 via the communication bus 26, and is used to communicate with various external terminal devices. The communication technology used in the communication connection can be a wired communication technology or a wireless communication technology, such as mobile high-definition link technology, universal serial bus, high-definition multimedia interface, wireless fidelity technology, Bluetooth communication technology, low-power Bluetooth communication technology, communication technology based on IEEE802.11s, etc.

For an introduction to an edge computing device provided by the present invention, please refer to the above embodiment, and the present invention will not be repeated here.

The edge computing device provided by the present invention has the same beneficial effects as the above-mentioned network security detection method based on distributed system.

In the fourth aspect, please refer to FIG. 8 , which is a schematic diagram of the structure of a distributed system provided by the present invention, including:

Multiple edge computing devices as above;

The edge cloud server is used to output the test data set and clustering results to each edge computing device. The clustering results include the data homogeneity cluster where the edge computing device is located and the associated computing devices connected to the edge computing device.

In FIG8 , the edge computing devices in a dotted box belong to the same cluster. For example, the five edge computing devices in the dotted box on the left side of the edge cloud server belong to cluster s ₁ , and the five edge computing devices in the dotted box on the right side of the edge cloud server belong to cluster _sc . The distributed system may specifically be a heterogeneous distributed system.

For an introduction to a distributed system provided by the present invention, please refer to the above embodiments, and the present invention will not be described in detail here.

The distributed system provided by the present invention has the same beneficial effects as the above-mentioned network security detection method based on the distributed system.

In the fifth aspect, please refer to Figure 9, which is a structural diagram of a computer-readable storage medium provided by the present invention. A computer program 31 is stored on the computer-readable storage medium 30. When the computer program 31 is executed by the processor, the steps of the network security detection method based on the distributed system as described in any of the embodiments above are implemented.

The computer-readable storage medium 30 may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

For an introduction to a computer-readable storage medium provided by the present invention, please refer to the above embodiments, and the present invention will not be described in detail here.

The computer-readable storage medium provided by the present invention has the same beneficial effects as the above-mentioned network security detection method based on the distributed system.

It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims (22)

1. A network security detection method based on a distributed system, characterized in that it is applied to each edge computing device in the distributed system, and each edge computing device in the distributed system is divided into multiple data homogeneity clusters according to similarity. The network security detection method includes: Training an initial network security detection model based on local security data, wherein the network of the initial network security detection model includes a plurality of neural network blocks connected in sequence, and the plurality of neural network blocks correspond to different neural network depths; Selecting two output network blocks from the plurality of neural network blocks, inputting the test security data set into the initial network security detection model, and adjusting the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain a local network security detection model; When the parameter update condition is met, the local network security detection model is updated using the model parameters of the local network security detection model and the model parameters of the associated computing device; the associated computing device is an edge computing device that is in the same data homogeneity cluster as itself and is connected to itself; Perform local network security detection through the updated local network security detection model; The process of adjusting the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain the local network security detection model includes: Obtaining a first output value corresponding to the first output network block and a second output value corresponding to the second output network block, wherein the neural network depth of the first output network block is less than the neural network depth of the second output network block; determining a depth adjustment strategy based on the first output value and the second output value; The neural network depth of the initial network security detection model is adjusted according to the depth adjustment strategy to obtain a local network security detection model. 2. The network security detection method based on a distributed system according to claim 1, characterized in that the process of determining the depth adjustment strategy based on the first output value and the second output value comprises: determining an absolute value of a difference between the first output value and the second output value; Determine a depth adjustment direction based on a magnitude relationship between the first output value and the second output value; the depth adjustment direction is depth retreat or depth deepening; Determine the adjustment condition satisfied by the performance gap between the shallow network model and the deep network model based on the size relationship between the absolute value and the preset value; the shallow network model is obtained based on the first output network block, the deep network model is obtained based on the second output network block, and the adjustment condition is an immediate adjustment condition or a step adjustment condition; A depth adjustment strategy is determined based on the depth adjustment direction and an adjustment condition satisfied by the performance gap. 3. The network security detection method based on a distributed system according to claim 2, characterized in that the process of determining the depth adjustment direction based on the magnitude relationship between the first output value and the second output value comprises: When the first output value is greater than the second output value, the depth adjustment direction is the depth retreat; When the first output value is less than the second output value, the depth adjustment direction is to increase the depth. 4. The network security detection method based on a distributed system according to claim 2 is characterized in that the process of determining the adjustment condition satisfied by the performance gap between the shallow network model and the deep network model based on the size relationship between the absolute value and the preset value comprises: When the absolute value is less than the preset value, it is determined that the performance gap between the shallow network model and the deep network model meets the step adjustment condition; When the absolute value is greater than or equal to the preset value, it is determined that the performance gap between the shallow network model and the deep network model meets the immediate adjustment condition. 5. The network security detection method based on a distributed system according to claim 2, characterized in that the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap comprises: When the depth adjustment direction is the depth rollback and the performance gap satisfies the instant adjustment condition, determining that the depth adjustment strategy is the depth rollback instant adjustment strategy; The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain a local network security detection model includes: When the depth adjustment strategy is the depth backoff instant adjustment strategy, the backoff depth is calculated using a first relational expression corresponding to the depth backoff instant adjustment strategy; Adjusting the neural network depth of the initial network security detection model according to the fallback depth to obtain a local network security detection model; The first relational expression is f ₁ (k)=η×e ^k , where f ₁ (k) is the backoff depth, η is a hyperparameter, and k is the absolute value. 6. The network security detection method based on a distributed system according to claim 2, characterized in that the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap comprises: When the depth adjustment direction is the depth rollback and the performance gap satisfies the step adjustment condition, the depth adjustment strategy is determined to be the depth rollback step adjustment strategy, and the step rollback is written into the preset storage space as the current record; The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain a local network security detection model includes: When the depth adjustment strategy is the depth backoff step adjustment strategy, a continuous preset number of records including the current record in the preset storage space are obtained. If the continuous preset number of records including the current record are all the step backoffs, the neural network depth of the initial network security detection model is backed off by one layer to obtain a local network security detection model. 7. The network security detection method based on a distributed system according to claim 2, characterized in that the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap comprises: When the depth adjustment direction is the depth deepening and the performance gap satisfies the instant adjustment condition, determining that the depth adjustment strategy is the depth deepening instant adjustment strategy; The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain a local network security detection model includes: When the depth adjustment strategy is the depth deepening instant adjustment strategy, the deepening depth is calculated using a second relational expression corresponding to the depth deepening instant adjustment strategy; Adjusting the neural network depth of the initial network security detection model according to the deepening depth to obtain a local network security detection model; The second relational expression is f ₂ (k)=η×e ^k , where f ₂ (k) is the deepening depth, η is a hyperparameter, and k is the absolute value. 8. The network security detection method based on a distributed system according to claim 2, characterized in that the process of determining the depth adjustment strategy based on the depth adjustment direction and the adjustment condition satisfied by the performance gap comprises: When the depth adjustment direction is the depth deepening and the performance gap satisfies the step adjustment condition, determining that the depth adjustment strategy is the depth deepening step adjustment strategy, and writing the step deepening as the current record into the preset storage space; The process of adjusting the neural network depth of the initial network security detection model according to the depth adjustment strategy to obtain a local network security detection model includes: When the depth adjustment strategy is the depth deepening step adjustment strategy, a continuous preset number of records including the current record in the preset storage space are obtained. If the continuous preset number of records including the current record are all step deepening, the neural network depth of the initial network security detection model is deepened by one layer to obtain a local network security detection model. 9. The network security detection method based on a distributed system according to claim 1, characterized in that the process of selecting two output network blocks from the plurality of neural network blocks comprises: Two adjacent neural network blocks are selected from the multiple neural network blocks as output network blocks. 10. The network security detection method based on a distributed system according to claim 1, characterized in that the process of updating the local network security detection model by using the model parameters of the local network security detection model and the model parameters of the associated computing device comprises: Acquire model parameters of the local network security detection model, and send the model parameters of the local network security detection model to each of the associated computing devices; Receiving model parameters sent by each of the associated computing devices; Calculating neighborhood average values of model parameters of the local network security detection model and model parameters sent by each of the associated computing devices; The local network security detection model is updated based on the neighborhood average value. 11. The network security detection method based on a distributed system according to claim 10, characterized in that the process of obtaining the model parameters of the local network security detection model and sending the model parameters of the local network security detection model to each of the associated computing devices comprises: The model parameters of the standard depth of the local network security detection model are obtained, and the model parameters of the standard depth are sent to each of the associated computing devices. 12. The network security detection method based on a distributed system according to claim 11, characterized in that after receiving the model parameters sent by each of the associated computing devices, the network security detection method further comprises: For each model parameter sent by the associated computing device, determine whether the neural network depth corresponding to the model parameter sent by the associated computing device is greater than the neural network depth of the local network security detection model; if so, determine the model parameter in the model parameter sent by the associated computing device that is the same as the neural network depth of the local network security detection model as the target model parameter; if not, determine the model parameter sent by the associated computing device as the target model parameter; The process of calculating the neighborhood average values of the model parameters of the local network security detection model and the model parameters sent by each of the associated computing devices includes: The neighborhood average values are calculated for the model parameters of the local network security detection model and each of the target model parameters. 13. The network security detection method based on a distributed system according to claim 1, characterized in that after updating the local network security detection model using the model parameters of the local network security detection model and the model parameters of the associated computing device, the network security detection method further comprises: When the cluster aggregation condition is met and the device itself is not a cluster head device, the model parameters of the local network security detection model are sent to the cluster head device of the data homogeneity cluster in which the device is located, so that the cluster head device obtains the global model parameters in the cluster according to the model parameters of all edge computing devices in the data homogeneity cluster in which the device is located; When the in-cluster global model parameters are acquired, the local network security detection model is updated using the in-cluster global model parameters, so that the local network security detection is performed using the updated local network security detection model. 14. The network security detection method based on a distributed system according to claim 13, characterized in that the process of obtaining the global model parameters in the cluster according to the model parameters of all edge computing devices in the data homogeneity cluster comprises: The global model parameters in the cluster are calculated using the third relational expression, which is: ; Among them, α is a hyperparameter, The cluster head device of the cth data homogeneity cluster stores the cluster global model parameters of the tth round, is the global model parameter of the cth data homogeneity cluster in the t+1th round, c is the sequence number of the data homogeneity cluster, is the model parameter of the j-th associated computing device in the device set _Ni of the data homogeneity cluster after the l-th update in the t-th round, _Ni is the device set of associated computing devices that have a connection relationship with the i-th edge computing device in the data homogeneity cluster, i is the sequence number of the edge computing device in the data homogeneity cluster, j is the sequence number of the associated computing device in the device set, and |N _i | is the total number of edge computing devices in the data homogeneity cluster. 15. The distributed system-based network security detection method according to claim 13, characterized in that after obtaining the cluster global model parameters and updating the local network security detection model using the cluster global model parameters, the network security detection method further comprises: When the global condition is met and the cluster head device itself is the cluster head device, the cluster global model parameters are sent to the edge cloud server in the distributed system, so that the edge cloud server obtains the global model based on the cluster global model parameters sent by the cluster head devices of all the data homogeneity clusters in the distributed system; After receiving the global model, the model parameters of the local network security detection model are updated based on the model parameters of the global model, so as to perform local network security detection through the updated local network security detection model. 16. The network security detection method based on a distributed system according to claim 15, characterized in that the process of obtaining the global model based on the cluster global model parameters sent by the cluster head devices of all the data homogeneity clusters in the distributed system comprises: The global model is calculated using the fourth relationship; the fourth relationship is: ; Wherein, C is the number of cluster head devices, is the global model in round t+1, is the model parameter of the cth data homogeneity cluster with respect to the data sample loss function L in the t+1th round, and c is the sequence number of the data homogeneity cluster. 17. The distributed system-based network security detection method according to any one of claims 1 to 16, characterized in that before training the initial network security detection model based on local security data, the network security detection method further comprises: Receive the data homogeneity clusters divided by the edge cloud server in the distributed system based on similarity and the connection relationship between the edge computing devices in the data homogeneity clusters, so as to determine the associated computing device corresponding to itself based on the data homogeneity clusters and the connection relationship. 18. The network security detection method based on a distributed system according to claim 17, characterized in that the process of dividing the edge cloud server in the distributed system into data homogeneous clusters based on similarity comprises: The edge cloud server in the distributed system obtains the test results obtained by each edge computing device in the distributed system based on the test security data set; Constructing a weighted undirected graph between all the edge computing devices according to the similarity of the test results of all the edge computing devices; All the edge computing devices are divided using the weighted undirected graph to obtain a plurality of data homogeneity clusters. 19. A network security detection system based on a distributed system, characterized in that it is applied to each edge computing device in the distributed system, and each edge computing device in the distributed system is divided into multiple data homogeneity clusters according to similarity, and the network security detection system includes: A training module, used for training an initial network security detection model based on local security data, wherein the network of the initial network security detection model includes a plurality of neural network blocks connected in sequence, and the plurality of neural network blocks correspond to different neural network depths; A selection module is used to select two output network blocks from the plurality of neural network blocks, and after inputting the test security data set into the initial network security detection model, adjust the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain a local network security detection model; An updating module, configured to update the local network security detection model using model parameters of the local network security detection model and model parameters of an associated computing device when a parameter update condition is met; the associated computing device is an edge computing device that is in the same data homogeneity cluster as the device and is connected to the device; A detection module, used for performing local network security detection through an updated local network security detection model; The process of adjusting the neural network depth of the initial network security detection model according to the output values corresponding to the two output network blocks to obtain the local network security detection model includes: Obtaining a first output value corresponding to the first output network block and a second output value corresponding to the second output network block, wherein the neural network depth of the first output network block is less than the neural network depth of the second output network block; determining a depth adjustment strategy based on the first output value and the second output value; The neural network depth of the initial network security detection model is adjusted according to the depth adjustment strategy to obtain a local network security detection model. 20. An edge computing device, comprising: Memory for storing computer programs; A processor, used to implement the steps of the distributed system-based network security detection method as described in any one of claims 1 to 18 when executing the computer program. 21. A distributed system, comprising: A plurality of edge computing devices as claimed in claim 20; The edge cloud server is used to output a test data set and a clustering result to each of the edge computing devices, wherein the clustering result includes the data homogeneity cluster where the edge computing device is located and the associated computing device connected to the edge computing device. 22. A computer-readable storage medium, characterized in that a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the network security detection method based on a distributed system as described in any one of claims 1 to 18 are implemented.