Block Hunter: Federated Learning for Cyber Threat Hunting in Blockchain-based IIoT Networks

Abstract

Nowadays, blockchain-based technologies are being developed in various industries to improve data security. In the context of the Industrial Internet of Things (IIoT), a chain-based network is one of the most notable applications of blockchain technology. IIoT devices have become increasingly prevalent in our digital world, especially in support of developing smart factories. Although blockchain is a powerful tool, it is vulnerable to cyber attacks. Detecting anomalies in blockchain-based IIoT networks in smart factories is crucial in protecting networks and systems from unexpected attacks. In this paper, we use Federated Learning (FL) to build a threat hunting framework called Block Hunter to automatically hunt for attacks in blockchain-based IIoT networks. Block Hunter utilizes a cluster-based architecture for anomaly detection combined with several machine learning models in a federated environment. To the best of our knowledge, Block Hunter is the first federated threat hunting model in IIoT networks that identifies anomalous behavior while preserving privacy. Our results prove the efficiency of the Block Hunter in detecting anomalous activities with high accuracy and minimum required bandwidth.

Attack Detection Using a Lightweight Blockchain Based Elliptic Curve Digital Signature Algorithm in Cyber Systems

“…Federated Learning (FL) is used by Yazdinejad, A., and colleagues [32] to create a threat hunting system named Block Hunter, which can autonomously scour blockchain-based IoT networks for signs of intrusion. The anomaly detection in Block Hunter is performed using a federated, multi-machine learning model cluster-based architecture.…”

A Systematic Literature Review: Security Threats and Countermeasure in Smart Farming

“…A number of research projects have been conducted using this architecture, which consists of layers called "Cloud", "Network Communication", "Edge," and "Physical". Through this architecture, IoT devices, such as sensors and actuators, as well as heterogeneous Cyber-Physical Systems (CPS), are connected and integrated with each other and with the internet [14]. In Figure 1, data is collected from IoT devices, processed and controlled, and users have access to a variety of applications.…”