Intelligent intrusion detection based on federated learning aided long short-term memory

Abstract

Deep learning based intelligent intrusion detection (IID) methods have been received strongly attention for computer security protection in cybersecurity. All these learning models are trained at either a single user server or centralized server. For one thing, it is almost impossible to train a powerful deep learning model at a single user. For other, it will encounter intrusion risks at centre server and violate user privacy if collecting dataset from all of user servers. In order to solve these problems, this paper proposes an effective IID method based on federated learning (FL) aided long short-term memory (FL-LSTM) framework. First, the initial LSTM global model is deployed at all of user servers. Second, each user trains its single model and then uploads its model parameters to central server. Finally, the central server performs model parameters aggregation to form a new global model and distributes it to user servers. Use this step as a loop for communication to complete the training of the intrusion detection model. Simulation results show that our proposed method achieves a higher accuracy and better consistency than conventional methods.

Introduction

With the wide spread of network application and the continuous development of network attack technology, all social circles have paid close attention to the cyberspace security technology [1], [2], [3]. Intrusion detection problem is urgently to solve in the field of cyberspace security. In recent years, the detection of abnormal behaviours of users has become an important branch of intrusion detection. Because each user has different work tasks and personal habits, user commands input has the characteristics of serialization and diversification [4]. Shell commands are stored in bash_history in the system main folder, if the intrusion occurs, the intruder’s input command will be different from the normal user. Hence, it is necessary to design a detection system to audit shell commands entered by users to detect and prevent malicious actions such as directory traversal attacks, reading and deleting files in bulk, and uninstalling software in bulk.

In recent years, deep learning has been considered as one of the most effective tools to solve various problems in cyberspace security technology [5], [6], [7], due to its powerful feature extraction capability. However, the user’s input of shell commands involves operational privacy, many users cannot share personal datasets for algorithm model training. Recent studies show that there is a positive correlation between the performance of machine learning models and the amount of training dataset. The larger the amount of training dataset usually means the higher the performance of the model [8]. Most of the existing intrusion detection models are built based on traditional machine learning algorithms, and it is difficult to use the user’s local dataset for training without involving user privacy. This paper solves these problems by establishing a federated learning (FL) model. FL coordinates multiple sub-servers through a central server and unites user datasets to establish a common model and to jointly benefit. The original data of each user in the model is stored locally and is not exchanged or transmitted, which does not cause risk to user data privacy.

Due to the complexity of user input and the contextual relevance of shell commands, this paper proposes a federated learning-aided long-time short time (FL-LSTM) framework for intelligent intrusion detection (IID) method [9], [10], [11]. The model focuses on the detection of high-risk malicious behaviours, such as directory traversal attacks, reading and deleting files in bulk, uninstalling software in bulk, etc. The dataset is adjusted based on the open source SEA dataset. Set attack scenarios by adding attack commands and reset the label on the dataset. Finally, we used independent validation datasets for model performance testing. Simulation results show that the proposed method can comprehensively learn the features of the sub-end user server dataset while ensuring user privacy and has a high classification accuracy and strong practicality.