联邦加密流量分类中的细粒度防御方法

doi:10.19665/j.issn1001-2400.20230303

西安电子科技大学学报 ›› 2024, Vol. 51 ›› Issue (1): 157-164.doi: 10.19665/j.issn1001-2400.20230303

联邦加密流量分类中的细粒度防御方法

曾勇¹(), 郭晓亚¹(), 马佰和²(), 刘志宏¹(), 马建峰¹()

1.西安电子科技大学网络与信息安全学院,陕西西安 710071
2.澳大利亚悉尼科技大学全球大数据技术中心,悉尼 2007

收稿日期:2022-10-21 出版日期:2024-01-20 发布日期:2023-08-30
作者简介:曾勇(1978—),男,副教授,E-mail:yzeng@mail.xidian.edu.cn;
郭晓亚(1996—),女,西安电子科技大学硕士研究生,E-mail:18237301531@163.com;
马佰和(1994—),男,悉尼科技大学博士研究生,E-mail:Baihe.Ma@uts.edu.cn;
刘志宏(1968—),男,教授,E-mail:liuzhihong@mail.xidian.edu.cn;
马建峰(1963—),男,教授,E-mail:jfma@mail.xidian.edu.cn
基金资助:
国家自然科学基金(61941105)

Fine-grained defense methods in federated encrypted traffic classification

ZENG Yong¹(), GUO Xiaoya¹(), MA Baihe²(), LIU Zhihong¹(), MA Jianfeng¹()

1. School of Cyber Engineering,Xidian University,Xi’an 710071,China
2. Global Big Data Technologies Centre,Sydney University of Technology,Sydney 2007,Australia

Received:2022-10-21 Online:2024-01-20 Published:2023-08-30

摘要/Abstract

摘要：

为了避免异常流量对联邦加密流量分类模型造成危害,研究者们提出了多种鲁棒算法和防御方案。已有方法通过移除异常模型的所有流量来提高鲁棒性。但这种清除节点所有流量的方法是一种粗粒度的防御方法。粗粒度的防御会造成正常流量损失和防御过当的问题。为避免上述问题,结合协作式联邦加密流量分类框架,提出清除异常流量的一种细粒度防御方法。该方法首先通过高效划分异常节点的本地数据集来缩小异常流量的搜索范围,实现细粒度定位异常节点的流量;然后在模型聚合时通过清除异常流量来降低正常流量损失,实现细粒度防御,解决防御过当问题。实验结果表明,与已有防御方案相比,提出的细粒度防御方法可以在不影响准确率的前提下,显著提高模型检测效率。所提出的细粒度防御方法检测准确率可以达到约91.4%,且检测效率与已有方法相比提高了约32.3%。

关键词: 加密流量分类, 联邦学习, 异常检测, 细粒度防御

Abstract:

In recent years,various robust algorithms and defense schemes have been presented to prevent the harm caused by abnormal traffic to the federal encrypted traffic classification model.The existing defense methods,which improve the robustness of the global model by removing the traffic of abnormal models,are coarse-grained.Nevertheless,the coarse-grained methods can lead to issues of excessive defense and normal traffic loss.To solve the above problems,we propose a fine-grained defense method to avoid abnormal traffic according to the collaborative federated encrypted traffic classification framework.The proposed method narrows the range of the abnormal traffic by dividing the local data set of abnormal nodes,achieving fine-grained localization of abnormal nodes.According to the localization results of abnormal traffic,the method realizes the fine-grained defense by eliminating abnormal traffic during model aggregation,which avoids the excessive defense and normal traffic loss.Experimental results show that the proposed method can significantly improve the efficiency of model detection without affecting accuracy.Compared with the existing coarse-grained methods,the accuracy of the fine-grained defense method can reach 91.4%,and the detection efficiency is improved by 32.3%.

Key words: encrypted traffic classification, federated learning, abnormal detection, fine-grained defense

中图分类号:

TP393

曾勇, 郭晓亚, 马佰和, 刘志宏, 马建峰. 联邦加密流量分类中的细粒度防御方法[J]. 西安电子科技大学学报, 2024, 51(1): 157-164.

ZENG Yong, GUO Xiaoya, MA Baihe, LIU Zhihong, MA Jianfeng. Fine-grained defense methods in federated encrypted traffic classification[J]. Journal of Xidian University, 2024, 51(1): 157-164.

图/表 6

图1

图2

图3

图4

图5

表1

参考文献 20

[1]	ZHOU Y, SHI H, ZHAO Y, et al. Encrypted Network Traffic Identification Based on 2D-CNN Model[C]//2021 22nd Asia-Pacific Network Operations and Management Symposium(APNOMS). Piscataway: IEEE, 2021:238-241.
[2]	曾勇, 吴正远, 董丽华, 等. 加密流量中的恶意流量识别技术[J]. 西安电子科技大学学报, 2021, 48(3):170-187.
	ZENG Yong, WU Zhengyuan, DONG Lihua, et al. Research on Malicious Traffic Identification Technology in Encrypted Traffic[J]. Journal of XIDIAN University, 2021, 48(3):170-187.
[3]	ZHU X F, SHU N, WANG H X, et al. A Distributed Traffic Classification Model Based on Federated Learning[C]//2021 7th International Conference on Big Data Computing and Communications(BigCom). Piscataway: IEEE, 2021:75-81.
[4]	YANG Z, CHEN M, WONG KK, et al. Federated Learning for 6G:Applications,Challenges,and Opportunities[J]. Engineering, 2022, 8(1):33-41. doi: 10.1016/j.eng.2021.12.002
[5]	王坤庆, 刘婧, 李晨, 等. 联邦学习安全威胁综述[J]. 信息安全研究, 2022, 8(3):223-234.
	WANG Kunqing, LI Jing, LI Chen, et al. A Survey on Threats to Federated Learning[J]. Journal of Information Securyity Research, 2022, 8(3):223-234.
[6]	CHEN Y, SU L, XU J. Distributed Statistical Machine Learning in Adversarial Settings:Byzantine Gradient Descent[J]. Proc.ACM Meas.Anal.Comput.Syst., 2017, 1(2):44.1-44.25.
[7]	YIN D, CHEN Y, RAMCHANDRAN K, et al. Defending Against Saddle Point Attack in Byzantine-Robust DistributedLearning.[C]// Proceedings of the 36th International Conference on Machine Learning. San Diego: ICML, 2019:7074-7084.
[8]	NGUYEN T D, RIEGER P, YALAME H, et al. Flguard:Secure and Private Federated Learning[J/OL].[2022-01-01].https://arxiv.org/abs/2101.02281v5.
[9]	CAO X, JIA J, GONG N Z. ProvablySecure Federated Learning Against Malicious Clients[J]. Proceedings of the AAAI Conference on Artificial Intelligence. 2021, 35(8):6885-6893. doi: 10.1609/aaai.v35i8.16849
[10]	TSAI JJ P, YU P S. Machine Learning in Cyber Trust[M]. Berlin:Springer, 2009:17-51.
[11]	BARACALDO N, CHEN B, LUDWIG H, et al. MitigatingPoisoning Attacks on Machine Learning Models:A Data Provenance Based Approach[C]// Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security. New York: ACM, 2017:103-110.
[12]	RAJPUT S, WANG H, CHARLES Z, et al. DETOX:ARedundancy-Based Framework for Faster and More Robust Gradient Aggregation[C]// Proceedings of the 33rd International Conference on Neural Information Processing Systems. New York: ACM, 2019:10320-10330.
[13]	FANG M, CAO X, JIA J, et al. LocalModel Poisoning Attacks to Byzantine-Robust Federated Learning[C]//29th USENIX Security Symposium. Berkeley: USENIX, 2020:1623-1640.
[14]	MCMAHAN H, MOORE E, RAMAGE D, et al. Communication-Efficient Learning of Deep Networks from Decentralized Data[J/OL].[2022-01-01].https://arxiv.org/abs/1602.05629v3.
[15]	LECUN Y, BOTTOU L, BENGIO Y, et al. Gradient-Based Learning Applied to Document Recognition[J]. Proceedings of the IEEE, 1998, 86(11):2278-2324. doi: 10.1109/5.726791
[16]	RUBINSTEIN R. TheCross-Entropy Method for Combinatorial and Continuous Optimization[J]. Methodology and Computing in Applied Probability, 1999, 1(2):127-190. doi: 10.1023/A:1010091220143
[17]	MONTAVON G, ORR G B, MüLLER K R. Neural Networks:Tricks of the Trade[M].Second Edition. Berlin: Springer, 2012:421-436.
[18]	LI S, CHENG Y, LIU Y, et al. AbnormalClient Behavior Detection in Federated Learning[J/OL].[2022-01-01].https://arxiv.org/abs/1910.09933.
[19]	XIAO H, XIAO H, ECKERT C. Adversarial Label Flips Attack on Support Vector Machines[C]//Proceedings of the 20th European Conference on Artificial Intelligence. New York: ACM, 2012:870-875.
[20]	LASHKARI A H, KAUR G, RAHALI A. DIDarknet:A Contemporary Approach to Detect and Characterize the Darknet Traffic Using Deep Image Learning[C]//Proceedings of the 2020 10th International Conference on Communication and Network Security. New York: ACM, 2020:1-13.

通信轮数	ERR	文中方案
0	0/0	0/0
5	0.63/0.34	0.67/0.35
10	0.78/0.75	0.80/0.79
15	0.80/0.78	0.82/0.83
20	0.84/0.81	0.87/0.86
25	0.88/0.84	0.90/0.88
30	0.89/0.86	0.91/0.90

联邦加密流量分类中的细粒度防御方法

Fine-grained defense methods in federated encrypted traffic classification

RichHTML

PDF (PC)

赞

可视化

摘要/Abstract

引用本文

使用本文

图/表 6

参考文献 20

相关文章 12

Metrics

本文评价

推荐阅读 0

[1]	宋成,程道晨,彭维平. 一种高效的联邦学习隐私保护方案[J]. 西安电子科技大学学报, 2023, 50(5): 178-187.
[2]	王波,李洪涛,王洁,郭一娜. 面向医疗数据的隐私保护联邦学习架构[J]. 西安电子科技大学学报, 2023, 50(5): 166-177.
[3]	朱光明,卢梓杰,冯家伟,张向东,张锋军,牛作元,张亮. 因果图增强的APT攻击检测算法[J]. 西安电子科技大学学报, 2023, 50(5): 107-117.
[4]	许勐璠,李兴华. 反迁移学习的隐私保护联邦学习[J]. 西安电子科技大学学报, 2023, 50(4): 89-99.
[5]	李海洋,郭晶晶,刘玖樽,刘志全. 隐私保护的拜占庭鲁棒联邦学习算法[J]. 西安电子科技大学学报, 2023, 50(4): 121-131.
[6]	王方伟,谢美云,李青茹,王长广. 自适应裁剪的差分隐私联邦学习框架[J]. 西安电子科技大学学报, 2023, 50(4): 111-120.
[7]	顾兆军,刘婷婷,隋翯. 一种ICS异常检测的优化GAN模型[J]. 西安电子科技大学学报, 2022, 49(2): 173-181.
[8]	姜少彬,杜春,陈浩,李军,伍江江. 一种硬盘故障预测的非监督对抗学习方法[J]. 西安电子科技大学学报, 2020, 47(2): 118-125.
[9]	胡盟霄,卢旺,徐灿,来嘉哲. 采用GRU模型的卫星RCS异常检测[J]. 西安电子科技大学学报, 2019, 46(6): 125-130.
[10]	左青云;陈鸣;王秀磊;刘波. 一种基于SDN的在线流量异常检测方法[J]. J4, 2015, 42(1): 155-160.
[11]	田玉玲. 面向异常检测的时间序列树突状细胞算法[J]. J4, 2014, 41(4): 144-150.
[12]	暂时无作者信息. 异常检测技术的研究与发展[J]. J4, 2002, 29(1): 128-133.