Cardiff University | Prifysgol Caerdydd ORCA
Online Research @ Cardiff 
WelshClear Cookie - decide language by browser settings

Federated deep learning for intrusion detection in IoT networks

Belarbi, Othmane ORCID: https://orcid.org/0000-0002-6106-7669, Spyridopoulos, Theodoros ORCID: https://orcid.org/0000-0001-7575-9909, Anthi, Eirini, Mavromatis, Ioannis, Carnelli, Pietro and Khan, Aftab 2023. Federated deep learning for intrusion detection in IoT networks. Presented at: GLOBECOM 2023 - 2023 IEEE Global Communications Conference, Kuala Lumpur, Malaysia, 04-08 December 2023. 2023 IEEE Global Communications Conference Proceedings. IEEE, pp. 237-242. 10.1109/GLOBECOM54140.2023.10437860

[thumbnail of Federated_Deep_Learning_for_Intrusion_Detection_in_IoT_Networks.pdf]
Preview
PDF - Published Version
Download (365kB) | Preview

Abstract

The vast increase of Internet of Things (IoT) technologies and the ever-evolving attack vectors have increased cyber-security risks dramatically. A common approach to implementing AI-based Intrusion Detection Systems (IDSs) in distributed IoT systems is in a centralised manner. However, this approach may violate data privacy and prohibit IDS scalability. Therefore, intrusion detection solutions in IoT ecosystems need to move towards a decentralised direction. Federated Learning (FL) has attracted significant interest in recent years due to its ability to perform collaborative learning while preserving data confidentiality and locality. Nevertheless, most FL-based IDS for IoT systems are designed under unrealistic data distribution conditions. To that end, we design an experiment representative of the real-world and evaluate the performance of an FL-based IDS. For our experiments, we rely on TON-IoT, a realistic IoT network traffic dataset, associating each IP address with a single FL client. Additionally, we explore pre-training and investigate various aggregation methods to mitigate the impact of data heterogeneity. Lastly, we benchmark our approach against a centralised solution. The comparison shows that the heterogeneous nature of the data has a considerable negative impact on the model's performance when trained in a distributed manner. However, in the case of a pre-trained initial global FL model, we demonstrate a performance improvement of over 20% (F1-score) compared to a randomly initiated global model.

Item Type: Conference or Workshop Item (Paper)
Date Type: Published Online
Status: Published
Schools: Computer Science & Informatics
Publisher: IEEE
ISBN: 979-8-3503-1090-0
Date of First Compliant Deposit: 6 March 2024
Date of Acceptance: 4 August 2023
Last Modified: 08 Apr 2024 01:30
URI: https://orca.cardiff.ac.uk/id/eprint/166936

Actions (repository staff only)

Edit Item Edit Item

Downloads

Downloads per month over past year

View more statistics