FL-MAAE: An Intrusion Detection Method for the Internet of Vehicles Based on Federated Learning and Memory-Augmented Autoencoder

Abstract

The Internet of Vehicles (IoV) is a network system that enables wireless communication and information exchange between vehicles and other traffic participants. Intrusion detection plays a very important role in the IoV. However, with the development of the IoV, unknown attack behaviors may appear. The lack of analysis and collection of these attack behavior has led to an imbalance in the sample data categories of the IoV intrusion detection, which causes the problem of low detection accuracy. At the same time, the intrusion detection model usually needs to upload data to the cloud for training, which will introduce the privacy risk due to of the leakage of vehicle users’ information. In this paper, we propose an intrusion detection method for the IoV based on federated learning and memory-augmented autoencoder (FL-MAAE). We add a memory module to the autoencoder model to enhance its ability to store the behavior feature patterns of the IoV, make it robust to imbalanced samples, and use the reconstruction error as the evaluation index, so as to detect unknown attacks in the IoV. We propose a federated learning based training method for the IoV intrusion detection model. Local training of intrusion detection models in roadside units can effectively protect the privacy of data resources. We also designed an aggregation method based on the performance contribution of participants to improve the reliability of model aggregation. We conducted experiments on the NSL-KDD intrusion detection dataset to evaluate the performance of the proposed method. Experimental results show that our method has the best intrusion detection performance. In the case of contaminated samples, the accuracy and F1 score of the proposed method are 9.6% and 7.39% higher than those of the comparison methods on average.

Federated Learning for Intrusion Detection Systems in Internet of Vehicles: A General Taxonomy, Applications, and Future Directions

“…Meanwhile, the simulations in [59] were conducted using the authors' proprietary dataset. Although the NSL-KDD and CIC-IDS 2017 datasets are not dedicated to IoVs and are primarily general intrusion detection datasets, the authors of [47,64] conducted their experiments on these datasets to evaluate the performance of their proposed methods. Finally, ref.…”

“…• Attacks detected: Within the domain of FL-based IDSs for IoV, numerous research papers have put forth methodologies to identify a diverse range of cyber threats. DoS attacks [47,52,[57][58][59][60]63] and constant attacks [53,55,61] are the most frequently discussed types of attacks in the literature. In addition, some authors emphasized specific attacks, such as the Sybil assault [56] and the black hole attack [54].…”

“…IDSs based on FL in IoV not only demonstrate the adaptability and robustness of FL techniques but also illustrate the essential role these techniques play in protecting the future of connected vehicular systems against a wide array of cyberattacks. [47,54,58,60,64], among others. In this mode, clients engage in the process of training their models on a local level without sharing raw data.…”

“…Fundamentally, an IDS in an IoV setting entails a multifaceted approach that involves behavioral analysis, signature-based detection, and anomaly-based detection. Behavioral analysis is a fundamental aspect that involves careful observation and a comprehensive understanding of the complex patterns exhibited by vehicle behavior and network connections [47]. By effectively distinguishing between typical and atypical behaviors, the system can immediately detect deviations, therefore flagging possible intrusions or harmful operations.…”

“…This approach is simple yet impactful, particularly in situations involving non-identically and independently distributed (non-IID) data [32]. An alternative methodology uses weighted federated averaging, as described in several papers [47,54,56]. This technique involves assigning varying weights to local models, considering factors such as the quantity of data samples or the quality of the model.…”