论文标题
一个可解释的基于联邦学习的网络入侵检测框架
An Interpretable Federated Learning-based Network Intrusion Detection Framework
论文作者
论文摘要
基于学习的网络入侵检测系统（NIDSS）被广泛部署用于捍卫各种网络攻击。现有基于学习的NID主要使用神经网络（NN）作为依赖网络攻击数据质量和数量的分类器。这种基于NN的方法也很难解释以提高效率和可扩展性。在本文中，我们通过将可解释的梯度提升决策树（GBDT）和联合学习（FL）框架组合在一起，设计了一种新的本地全球计算范式，FedForest，这是一种新颖的基于学习的NID。具体而言，FedForest由多个客户端组成，这些客户端为服务器提取本地网络攻击数据功能来训练模型并检测入侵。 FedForest还提出了一种隐私增强技术，以进一步击败FL系统的隐私。对不同任务的4个网络攻击数据集进行了广泛的实验，表明FedForest是有效，有效，可解释和可扩展的。 FedForest在2021年中国大学生的合作学习和网络安全竞赛中排名第一。
Learning-based Network Intrusion Detection Systems (NIDSs) are widely deployed for defending various cyberattacks. Existing learning-based NIDS mainly uses Neural Network (NN) as a classifier that relies on the quality and quantity of cyberattack data. Such NN-based approaches are also hard to interpret for improving efficiency and scalability. In this paper, we design a new local-global computation paradigm, FEDFOREST, a novel learning-based NIDS by combining the interpretable Gradient Boosting Decision Tree (GBDT) and Federated Learning (FL) framework. Specifically, FEDFOREST is composed of multiple clients that extract local cyberattack data features for the server to train models and detect intrusions. A privacy-enhanced technology is also proposed in FEDFOREST to further defeat the privacy of the FL systems. Extensive experiments on 4 cyberattack datasets of different tasks demonstrate that FEDFOREST is effective, efficient, interpretable, and extendable. FEDFOREST ranks first in the collaborative learning and cybersecurity competition 2021 for Chinese college students.
