作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2023, Vol. 49 ›› Issue (3): 168-176. doi: 10.19678/j.issn.1000-3428.0064310

• 网络空间安全 • 上一篇    下一篇

基于联邦学习的SDN异常流量协同检测技术

陈何雄1, 罗宇薇2,3, 韦云凯2,3, 郭威1, 杭菲璐1, 何映军1, 杨宁3   

  1. 1. 云南电网有限责任公司 信息中心, 昆明 650011;
    2. 电子科技大学 长三角研究院(衢州), 浙江 衢州 324000;
    3. 电子科技大学 信息与通信工程学院, 成都 611731
  • 收稿日期:2022-03-28 修回日期:2022-05-18 发布日期:2022-08-09
  • 作者简介:陈何雄(1984—),男,工程师、硕士,主研方向为网络安全运维;罗宇薇,硕士研究生;韦云凯,副教授、博士;郭威,工程师;杭菲璐,工程师、硕士;何映军,工程师;杨宁,副教授、硕士。
  • 基金资助:
    衢州市科技专项(2021D013);云南电网有限责任公司科技项目(YNKJXM20200172)。

Collaborative Detection Technology of SDN Abnormal Traffic Based on Federated Learning

CHEN Hexiong1, LUO Yuwei2,3, WEI Yunkai2,3, GUO Wei1, HANG Feilu1, HE Yingjun1, YANG Ning3   

  1. 1. Information Center, Yunnan Power Grid Co., Ltd., Kunming 650011, China;
    2. Yangtze Delta Region Institute(Quzhou), University of Electronic Science and Technology of China, Quzhou 324000, Zhejiang, China;
    3. School of Information and Communication Engineering, University of Electronic Science and Technology of China, Chengdu 611731, China
  • Received:2022-03-28 Revised:2022-05-18 Published:2022-08-09

摘要: 网络流量异常状态检测是发现潜在安全威胁的重要手段,但是现有异常流量检测方法普遍存在环境适应性不强、协同能力较弱等问题。结合SDN网络的拓扑结构与流量特征,提出基于联邦学习的异常流量协同检测技术。利用SDN网络中的检测节点,构建基于联邦学习的多检测节点协同检测架构。通过信息熵计算提取流量特征,从相对熵的角度分析检测节点的流量关联度,并根据该关联度设计模型训练过程中的参数聚合权重优化算法,提高检测模型的适应能力。应用参数聚合权重优化算法进行多检测节点异常流量检测模型的协同训练,提升检测模型对异常流量的识别准确率。仿真结果表明,与本地独立训练和传统联邦学习算法相比,基于参数聚合权重优化算法的识别准确率分别提升了31.69%和7.92%,具有更好的异常流量检测效果及更强的环境适应能力。

关键词: 软件定义网络, 联邦学习, 异常流量, 协同检测, 信息熵

Abstract: Anomaly detection is an effective method for discovering potential security threats.However, current anomaly detection methods used in the Software-Defined Network(SDN) exhibit commom problems such as weak adaptability, poor coordination.This study proposes a collaborative anomaly detection technology based on federated learning, which fully utilizes the characteristics of the topology and traffic in the network.First, a collaborative detection architecture based on multiple detection nodes is developed via federated learning.This study extracts features with the information entropy, analyzes the traffic correlation with the relative entropy, and formulates the parameter aggregation weight optimization algorithm to train an efficient and adaptive anomaly detection model.Finally, the parameter aggregation weight optimization algorithm is applied for collaborative training and optimizing of the anomaly detection model with multiple detection nodes to improve the detection accuracy in anomaly detection.The simulation results show that compared with the independent training and traditional federated learning algorithm, the detection accuracy of the proposed algorithm is improved by 31.69% and 7.92%, respectively.Thus, the proposed algorithm has a better abnormal traffic detection effect and stronger environmental adaptability.

Key words: Software-Defined Network(SDN), federated learning, abnormal traffic, collaborative detection, information entropy

中图分类号: