相关实验视频
缓解联合学习中的语义标签分歧:用于安全监控的模糊编码和警报过
Yoonho Lee1, Joonghyuk Im1, Jisu Kim1
1Department of Computer Science, Kookmin University, Seoul, South Korea.
PloS one
|December 29, 2025
概括
联合学习 (FL) 在安全操作中扎着不一致的警报标签. 我们的新关键特征哈希 (KFH) 和过方法可以在不共享原始数据的情况下提高入侵检测模型的准确性.
科学领域:
- 网络安全 网络安全
- 机器学习 机器学习
- 分布式系统 分布式系统
背景情况:
- 联合学习 (FL) 能够在没有直接数据共享的情况下实现协作机器学习 (ML),这对于安全操作中心 (SOC) 等敏感环境至关重要.
- 对SOCs来说,对网络入侵检测系统 (IDS) 警报的分类至关重要,但跨组织事件数据标签中的语义不一致性阻碍了FL模型的准确性.
- 现有的FL方法在处理异质数据和标签差异方面面临挑战,这影响了基于ML的决策支持的可靠性.
研究的目的:
- 在联合学习环境中解决标记的IDS警报中的语义不一致问题.
- 开发用于统一数据向量化和过错误分类警报的方法,而无需交换原始数据.
- 提高FL模型在安全操作中的可信度和通用性.
主要方法:
- 拟议的Keyed Feature Hashing (KFH) 是一个关键依赖的模糊编码方案,用于对异构的IDS警报进行一致的矢量化.
- 引入了使用KFH表示的过机制,以识别和排除可能存在实体间标签差异的警报.
- 在来自14个组织的大规模现实世界数据集上验证了方法.
主要成果:
- 通过KFH和过机制,通过KFH和过机制获得了高达13.36%的F1评分.
- 保持了99%以上的警报覆盖率,证明了拟议方法的有效性和可扩展性.
- 成功地减轻了标签分歧对FL模型性能的影响.
结论:
- 拟议的KFH和过机制有效地解决了联合IDS警报分类中的语义不一致.
- 这些贡献提高了FL模型在分布式环境中的可靠性和可信度,标签标准不同.
- 这些方法可以实现强大的网络安全协作ML,而不会损害数据隐私或要求共享原始数据.
相关概念视频
Censoring Survival Data
498
Survival analysis is a statistical method used to analyze time-to-event data, often employed in fields such as medicine, engineering, and social sciences. One of the key challenges in survival analysis is dealing with incomplete data, a phenomenon known as "censoring." Censoring occurs when the event of interest (such as death, relapse, or system failure) has not occurred for some individuals by the end of the study period or is otherwise unobservable, and it might have many different...
498
Masking and Demasking Agents
3.4K
EDTA titrations may necessitate masking and demasking agents to temporarily protect a particular metal ion in a mixture from the EDTA reaction. These agents facilitate the sequential analysis of the metal ions by forming stable complexes with some—but not all—metal ions during certain steps.
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
3.4K
Force Classification
2.2K
Forces play a crucial role in the study of physics and engineering. They are essential in describing the motion, behavior, and equilibrium of objects in the physical world. Forces can be classified based on their origin, type, and direction of action.
Contact and non-contact forces are two of the most widely used categories of forces. As the name suggests, contact forces require physical contact between two objects to act upon each other. Examples of contact forces include frictional,...
Contact and non-contact forces are two of the most widely used categories of forces. As the name suggests, contact forces require physical contact between two objects to act upon each other. Examples of contact forces include frictional,...
2.2K
Strategies for Assessing and Addressing Confounding
334
Confounding is a critical issue in epidemiological studies, often leading to misleading conclusions about associations between exposures and outcomes. It occurs when the relationship between the exposure and the outcome is mixed with the effects of other factors that influence the outcome. Given that, addressing confounding is of high importance for drawing accurate inferences in research.
Confounding can be addressed at both the design phase of a study and through analytical methods after data...
Confounding can be addressed at both the design phase of a study and through analytical methods after data...
334
Aggregates Classification
947
Aggregate classification is generally based on its size, petrographic characteristics, weight, and source. Size classification ranges from coarse to fine aggregates, defined by the size of the particles. Coarse aggregates are particles that do not pass through ASTM sieve No. 4, and aggregates that pass through the sieve are fine aggregates.
Petrographic classification groups aggregates based on common mineralogical characteristics. Some of the common mineral groups found in aggregates are...
Petrographic classification groups aggregates based on common mineralogical characteristics. Some of the common mineral groups found in aggregates are...
947
Difference from Background: Limit of Detection
8.0K
The limit of detection (LOD) is the smallest amount of analyte that can be distinguished from the background noise. The LOD value corresponds to the concentration at which the analyte signal is three times larger than the standard deviation of the blank signal. Below this value, the analyte signal cannot be differentiated from the background noise. It is calculated by dividing the calibration slope by 3 times the standard deviation of the blank signals.
The LOD indicates the presence or absence...
The LOD indicates the presence or absence...
8.0K