臺灣博碩士論文加值系統

The increasing diversification of network attacks has posed many security threats. Even within a local area network, different hosts may encounter distinct attacks. Leveraging the intrusion data dispersed across various hosts is crucial to achieving more comprehensive intrusion detection. Decentralized learning has emerged as a promising solution by enabling hosts to share information in a peer-to-peer manner. However, the imbalanced nature of intrusion data and varying data distributions between hosts can significantly impact model performance. To address the challenges of imbalanced and non-IID data, we propose a Decentralized Learning-based Intrusion Detection System (DLIDS). It rebalances training data to mitigate the model’s bias towards the majority class and periodically substitutes the training model to facilitate knowledge acquisition. Moreover, the stacking ensemble method is incorporated to integrate diverse perspectives and generate unbiased predictions. Finally, the experiment results on the CIC-IDS2017 and CSE-CIC- IDS2018 datasets show that the proposed method performs well even under imbalanced and non-IID data conditions.

Abstract i
1 Introduction 1
2 Related Works 4
3 Decentralized Learning-based Intrusion Detection System (DLIDS) 7
3.1 Workflow.................................. 7
3.2 Data Preprocessing Phase(DPP) ...................... 9
3.3 Data Re-balancing Phase(DRP) ...................... 10
3.4 Model SubstitutionPhase(MSP)...................... 11
3.5 Ensemble Distillation Phase(EDP)..................... 12
4 Experiments 13
4.1 Experiment Setup.............................. 13
4.1.1 Dataset ............................... 13
4.1.2 Model................................ 15
4.1.3 Simulation scenario......................... 16
4.1.4 Evaluation metrics ......................... 17
4.1.5 Parameter settings ......................... 18
4.2 Ablation study................................ 20
4.3 Performance of proposed method...................... 23
5 Conclusion 26
Reference 27

[1] B. McMahan et al., “Communication-efficient learning of deep networks from decentralized data,” in Proc. PMLR AISTATS, 2017.
[2] S.Agrawaletal., “Federatedlearningforintrusiondetectionsystem: Concepts, challenges and future directions,” Comput. Commun., 2022.
[3] X.Yin, Y.Zhu, and J.Hu, “A comprehensive survey of privacy-preserving federated learning: A taxonomy, review, and future directions,” ACM Comput. Surv., vol. 54, pp. 1–36, 2021.
[4] S. Huang and K. Lei, “IGAN-IDS: An imbalanced generative adversarial network towards intrusion detection system in ad-hoc networks,” Ad Hoc Netw., vol. 105, p. 102177, 2020.
[5] D. Devi et al., “A review on solution to class imbalance problem: undersampling approaches,” in Proc. IEEE ComPE, 2020.
[6] V. Ganganwar, “An overview of classification algorithms for imbalanced datasets,” Int. J. Emerg. Technol. Adv. Eng., vol. 2, pp. 42–47, 2012.
[7] X. Lian et al., “Can decentralized algorithms outperform centralized algorithms? a case study for decentralized parallel stochastic gradient descent,” in Proc. NeurIPS, 2017.
[8] T. Lin et al., “Quasi-global momentum: Accelerating decentralized deep learning on heterogeneous data,” in Proc. PMLR ICML, 2021.
[9] G.Douzas, F.Bacao, and F.Last, “Improvingimbalancedlearningthroughaheuris- tic oversampling method based on k-means and SMOTE,” Inf. Sci., vol. 465, pp. 1–20, 2018.
[10] T.-C. Chiu et al., “Semisupervised distributed learning with non-IID data for AIoT service platform,” IEEE Internet Things J., vol. 7, pp. 9266–9277, 2020.
[11] J. M. Johnson and T. M. Khoshgoftaar, “Survey on deep learning with class imbalance,” J. Big Data, vol. 6, pp. 1–54, 2019.
[12] N.V.Chawlaetal., “SMOTE: synthetic minority over-sampling technique,”J.Artif. Int. Res., vol. 16, pp. 321–357, 2002.
[13] H. He et al., “ADASYN: Adaptive synthetic sampling approach for imbalanced learning,” in Proc. IEEE IJCNN, 2008.
[14] J. Li, Q. Zhu, Q. Wu, and Z. Fan, “A novel oversampling technique for class- imbalanced learning based on SMOTE and natural neighbors,” Inf. Sci., vol. 565, pp. 438–455, 2021.
[15] Q. Chen et al., “PF-SMOTE: A novel parameter-free SMOTE for imbalanced datasets,” Neurocomputing, vol. 498, pp. 75–88, 2022.
[16] X. Liang, A. Jiang, T. Li, Y. Xue, and G. Wang, “LR-SMOTE—an improved unbalanced data set oversampling based on k-means and SVM,” Knowl. Based Syst., vol. 196, p. 105845, 2020.
[17] M. K. Hooshmand and D. Hosahalli, “Network anomaly detection using deep learn- ing techniques,” CAAI Transactions on Intelligence Technology, vol. 7, no. 2, pp. 228–243, 2022.
[18] Y. Fu, Y. Du, Z. Cao, Q. Li, and W. Xiang, “A deep learning model for network intrusion detection with imbalanced data,” Electronics, vol. 11, no. 6, p. 898, 2022.
[19] C. Liu, Z. Gu, and J. Wang, “A hybrid intrusion detection system based on scalable k-means+ random forest and deep learning,” Ieee Access, vol. 9, pp. 75 729–75 740, 2021.
[20] K. Hsieh et al., “The non-IID data quagmire of decentralized machine learning,” in Proc. PMLR ICML, 2020.
[21] T. Vogels et al., “Relaysum for decentralized deep learning on heterogeneous data,” Proc. NeurIPS, 2021.
[22] Y.Esfandiarietal., “Cross-gradient aggregation for decentralized learning from non-IID data,” in Proc. PMLR ICML, 2021.
[23] Z. Chen, W. Liao, P. Tian, Q. Wang, and W. Yu, “A fairness-aware peer-to-peer decentralized learning framework with heterogeneous devices,” Future Internet, vol. 14, p. 138, 2022.
[24] H. Wang et al., “Non-IID data re-balancing at IoT edge with peer-to-peer federated learning for anomaly detection,” in Proc. ACM WiSec, 2021.
[25] T. Zhang, C. He, T. Ma, L. Gao, M. Ma, and S. Avestimehr, “Federated learning for internet of things,” in Proceedings of the 19th ACM Conference on Embedded Networked Sensor Systems, 2021, pp. 413–419.
[26] V. Rey, P. M. S. Sánchez, A. H. Celdrán, and G. Bovet, “Federated learning for malware detection in iot devices,” Computer Networks, vol. 204, p. 108693, 2022.
[27] B. Weinger, J.Kim, A.Sim, M. Nakashima, N.Moustafa, andK.J. Wu, “Enhancing iot anomaly detection performance for federated learning,” Digital Communications and Networks, vol. 8, no. 3, pp. 314–323, 2022.
[28] Z. Lian and C. Su, “Decentralized federated learning for internet of things anomaly detection,” in Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, 2022, pp. 1249–1251.
[29] H. Tang et al., “d2: Decentralized training over decentralized data,” in Proc. PMLR ICML, 2018.
[30] G. Karatas, O. Demir, and O. K. Sahingoz, “Increasing the performance of machine learning-based IDSs on an imbalanced and up-to-date dataset,” IEEE Access, vol. 8, pp. 32 150–32 162, 2020.
[31] J. Liu, Y. Gao, and F. Hu, “A fast network intrusion detection system using adaptive synthetic oversampling and LightGBM,” Comput. Secur., vol. 106, p. 102289, 2021.
[32] G. Hinton et al., “Distilling the knowledge in a neural network,” in NeurIPS Deep Learning and Representation Learning Workshop, 2014.
[33] R.-H. Hwang, M.-C. Peng, C.-W. Huang, P.-C. Lin, and V.-L. Nguyen, “An unsupervised deep learning model for early network traffic anomaly detection,” IEEE Access, vol. 8, pp. 30 387–30 399, 2020.
[34] S. Patro and K. K. Sahu, “Normalization: A preprocessing stage,” arXiv preprint arXiv:1503.06462, 2015.
[35] D. H. Wolpert, “Stacked generalization,” Neural Netw., vol. 5, pp. 241–259, 1992.
[36] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization.” ICISSp, vol. 1, pp. 108–116, 2018.
[37] “A realistic cyber defense dataset (cse-cic-ids2018).” [Online]. Available: https: //registry.opendata.aws/cse-cic-ids2018/
[38] L. Mohammadpour et al., “A survey of cnn-based network intrusion detection,” Appl. Sci., vol. 12, p. 8162, 2022.
[39] D.F. Nettleton, S. Nettleton, and M.C.i.Farriol, “MEDICI: A simple to use synthetic social network data generator,” in Proc. MDAI, 2021.