基于投票机制的联邦学习恶意代码检测:以电网为例  

Federated Learning Malware Detection Method Based on Voting Mechanism:Taking Power Grid as An Example

作　　者：王琼赟 王萌 张亚昊 史睿 郭琪 吴京航 WANG Qiongyun;WANG Meng;ZHANG Yahao;SHI Rui;GUO Qi;WU Jinghang(Beijing Information Science and Technology University,Beijing 100192,China;不详)

机构地区：[1]北京信息科技大学理学院,北京100192 [2]国家电网有限公司信息通信分公司网络安全监控中心,北京100761

出　　处：《武汉理工大学学报（信息与管理工程版）》2024年第4期644-650,657,共8页Journal of Wuhan University of Technology：Information & Management Engineering

基　　金：国家电网有限公司总部科技项目(5700-202358388A-2-3-XG);未来区块链与隐私计算高精尖中心项目(5026023401).

摘　　要：为了保护电网企业二级单位的用户隐私,增加分布式终端的病毒检测能力,将联邦学习框架应用于恶意代码检测任务中。在该框架中,通过使用局部模型来计算全局模型参数。提出了基于投票机制的联邦学习恶意代码检测方法。在设备的通信过程中,不发送节点的原始数据,而是发送模型参数,有效保护了各设备的数据隐私。通过随机选择用户参与投票,控制中心可依据投票结果调整本地和全局模型的超参数。最后,通过加权聚合来汇聚本地模型参数,以获得一个高精度的全局恶意代码分类模型。该模型将在提供隐私保护的同时,维持了较高的恶意代码检测精度。实验证明该方法在多个恶意代码数据集上的分类精度均有提高,且使模型的损失函数值降低。To protect user privacy of the secondary units in power grid enterprises and increase the virus detection capability of distributed clients,the federated learning mechanism was applied to the malicious code detection task.In this framework,the global model parameters were calculated by using the local model.A federal learning malicious code detection method based on voting mechanism was proposed.In the communication process of the device,the original data of the node was not sent,but the model parameters were sent,which effectively protected the data privacy of each device.By randomly selecting users to participate in the voting,the control center can adjust the hyperparameters of the local and global models based on the voting results.Finally,the local model parameters were aggregated by weighted aggregation to obtain a high-precision global malicious code classification model.The model provided privacy protection while maintaining a high malicious code detection accuracy.Experiments show that the classification accuracy of this method on multiple malicious code datasets is improved,and the loss function value of the model is reduced.

关 键 词：联邦学习 恶意代码 神经网络 投票集成 代码可视化 

分 类 号：TP319[自动化与计算机技术—计算机软件与理论] TP181[自动化与计算机技术—计算机科学与技术]