Chained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study

Abstract

The adoption of machine learning and deep learning is on the rise in the cybersecurity domain where these AI methods help strengthen traditional system monitoring and threat detection solutions. However, adversaries too are becoming more effective in concealing malicious behavior amongst large amounts of benign behavior data. To address the increasing time-to-detection of these stealthy attacks, interconnected and federated learning systems can improve the detection of malicious behavior by joining forces and pooling together monitoring data. The major challenge that we address in this work is that in a federated learning setup, an adversary has many more opportunities to poison one of the local machine learning models with malicious training samples, thereby influencing the outcome of the federated learning and evading detection. We present a solution where contributing parties in federated learning can be held accountable and have their model updates audited. We describe a permissioned blockchain-based federated learning method where incremental updates to an anomaly detection machine learning model are chained together on the distributed ledger. By integrating federated learning with blockchain technology, our solution supports the auditing of machine learning models without the necessity to centralize the training data. Experiments with a realistic intrusion detection use case and an autoencoder for anomaly detection illustrate that the increased complexity caused by blockchain technology has a limited performance impact on the federated learning, varying between 5 and 15%, while providing full transparency over the distributed training process of the neural network. Furthermore, our blockchain-based federated learning solution can be generalized and applied to more sophisticated neural network architectures and other use cases.

Trustworthy artificial intelligence

“…However, there remain several issues that warrant further research before we will be able to deploy DLTbased federated learning in real-world use cases. Most research prototypes, for example, employ DLT-based federated learning to train relatively simple AI models (Pandl et al 2020;Preuveneers et al 2018), while extant research indicates that DLT-based federated learning induces a performance overhead of 5% to 15% (Preuveneers et al 2018). Although this might at first not seem like a large overhead, it could ultimately render DLT-based federated learning prohibitively expensive for more complex AI models.…”

Intrusion Detection for Wireless Edge Networks Based on Federated Learning

“…The authors of [16] applied federated learning technology to intrusion detection, and their training and testing accuracy on the CICIDS2017 data set was approximately 97%, which signifies improved efficiency and confidentiality of training. The authors of [17] proposed an intrusion detection method based on the long and short-term memory framework of federated learning with higher classification accuracy than traditional methods.…”

Blockchain-Enabled Federated Learning With Mechanism Design

“…Preuveneers et al proposed a permissioned blockchainbased FL platform that enables the auditing of trained ML models [12]. Their platform is implemented on Multichain.…”