Federated deep learning for intrusion detection in IoT networks

Belarbi, Othmane ORCID: https://orcid.org/0000-0002-6106-7669, Spyridopoulos, Theodoros ORCID: https://orcid.org/0000-0001-7575-9909, Anthi, Eirini, Mavromatis, Ioannis, Carnelli, Pietro and Khan, Aftab 2023. Federated deep learning for intrusion detection in IoT networks. Presented at: GLOBECOM 2023 - 2023 IEEE Global Communications Conference, Kuala Lumpur, Malaysia, 04-08 December 2023. 2023 IEEE Global Communications Conference Proceedings. IEEE, pp. 237-242. 10.1109/GLOBECOM54140.2023.10437860

Preview

PDF - Published Version Download (365kB) | Preview

Abstract

The vast increase of Internet of Things (IoT) technologies and the ever-evolving attack vectors have increased cyber-security risks dramatically. A common approach to implementing AI-based Intrusion Detection Systems (IDSs) in distributed IoT systems is in a centralised manner. However, this approach may violate data privacy and prohibit IDS scalability. Therefore, intrusion detection solutions in IoT ecosystems need to move towards a decentralised direction. Federated Learning (FL) has attracted significant interest in recent years due to its ability to perform collaborative learning while preserving data confidentiality and locality. Nevertheless, most FL-based IDS for IoT systems are designed under unrealistic data distribution conditions. To that end, we design an experiment representative of the real-world and evaluate the performance of an FL-based IDS. For our experiments, we rely on TON-IoT, a realistic IoT network traffic dataset, associating each IP address with a single FL client. Additionally, we explore pre-training and investigate various aggregation methods to mitigate the impact of data heterogeneity. Lastly, we benchmark our approach against a centralised solution. The comparison shows that the heterogeneous nature of the data has a considerable negative impact on the model's performance when trained in a distributed manner. However, in the case of a pre-trained initial global FL model, we demonstrate a performance improvement of over 20% (F1-score) compared to a randomly initiated global model.

Item Type:	Conference or Workshop Item (Paper)
Date Type:	Published Online
Status:	Published
Schools:	Computer Science & Informatics
Publisher:	IEEE
ISBN:	979-8-3503-1090-0
Date of First Compliant Deposit:	6 March 2024
Date of Acceptance:	4 August 2023
Last Modified:	08 Apr 2024 01:30
URI:	https://orca.cardiff.ac.uk/id/eprint/166936

Actions (repository staff only)

Edit Item