Intelligent intrusion detection based on federated learning aided long short-term memory

Zhao, Ruijie; Yin, Yue; Shi, Yong; Zhi, Xue

doi:10.1016/j.phycom.2020.101157

Cited by 68 publications

(27 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The performance evaluation shows that the DIOT scheme is able to detect 95.6% of attacks in an average of 257 milliseconds. Zhao et al [60] developed a federated learningbased intrusion detection system, which can be used for detecting compromised IoT devices. The proposed system proposes that the global initial long short-term memory model is distributed among all user servers.…”

Section: A Detecting Compromised Iot Devicesmentioning

confidence: 99%

Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis

Ferrag¹,

et al. 2021

View full text Add to dashboard Cite

In this article, we present a comprehensive study with an experimental analysis of federated deep learning approaches for cyber security in the Internet of Things (IoT) applications. Specifically, we first provide a review of the federated learning-based security and privacy systems for several types of IoT applications, including, Industrial IoT, Edge Computing, Internet of Drones, Internet of Healthcare Things, Internet of Vehicles, etc. Second, the use of federated learning with blockchain and malware/intrusion detection systems for IoT applications is discussed. Then, we review the vulnerabilities in federated learning-based security and privacy systems. Finally, we provide an experimental analysis of federated deep learning with three deep learning approaches, namely, Recurrent Neural Network (RNN), Convolutional Neural Network (CNN), and Deep Neural Network (DNN). For each deep learning model, we study the performance of centralized and federated learning under three new real IoT traffic datasets, namely, the Bot-IoT dataset, the MQTTset dataset, and the TON_IoT dataset. The goal of this article is to provide important information on federated deep learning approaches with emerging technologies for cyber security. In addition, it demonstrates that federated deep learning approaches outperform the classic/centralized versions of machine learning (non-federated learning) in assuring the privacy of IoT device data and provide the higher accuracy in detecting attacks.

show abstract

Section: A Detecting Compromised Iot Devicesmentioning

confidence: 99%

Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis

Ferrag¹,

et al. 2021

View full text Add to dashboard Cite

show abstract

“…Researchers in [27] presented an Intelligent Intrusion detection using FL approach and Long Short Term Memory (LSTM) recurrent neural network. LSTM networks have cell state and memory state within to hold required information on long inputs of data.…”

Section: Related Workmentioning

confidence: 99%

An Ensemble Multi-View Federated Learning Intrusion Detection for IoT

et al. 2021

View full text Add to dashboard Cite

The rise in popularity of Internet of Things (IoT) devices has attracted hackers to develop IoT-specific attacks. The microservice architecture of IoT devices relies on the Internet to provide their intended services. An unguarded IoT network makes inter-connected devices vulnerable to attacks. It will be a tedious and ineffective process to manually detect the attacks in the network, as the attackers frequently upgrade their attack strategies. Machine learning (ML)-assisted approaches have been proposed to build intrusion detection for cybersecurity automation in IoT networks. However, most such approaches focus on training an ML model using a single view of the dataset, which often fails to build insightful knowledge and understand each feature's impact on the ML model's decision-making ability. As such, the model training with a single view may result in an incomplete understanding of patterns in large feature-set datasets. Moreover, the current approaches are mainly designed in a centralized manner in which the raw data is transferred from the edge devices to the central server for training. This, in turn, may expose the data to all kinds of attacks without adhering to the privacy-preserving of data security. Multi-view learning has gained popularity for its ability to learn from different data views and deliver efficient performance with more distinguished predictions. This paper proposes a federated learning-based intrusion detection approach, called MV-FLID, that trains on multiple views of IoT network data in a decentralized format to detect, classify, and defend against attacks. The multi-view ensemble learning aspect helps in maximizing the learning efficiency of different classes of attacks. The Federated Learning (FL) aspect, wherein the device's data is not shared to the server, performs profile aggregation efficiently with the benefit of peer learning. Our evaluation results show that our proposed approach has higher accuracy compared to the traditional non-FL centralized approach.INDEX TERMS Internet of Things, IoT security, federated learning, neural networks, multi-view classification, intrusion detection system.

show abstract

“…Reference [12] employs a real-world dataset, the pollution records in CityPulse Smart City Datasets. Reference [13] proposed an effective IID method based on federated learning aided long short-term memory framework. It solved the problem of training a powerful deep learning model with small-scale dataset in a single center.…”

Section: Related Workmentioning

confidence: 99%

LSTM-CGAN: Towards Generating Low-Rate DDoS Adversarial Samples for Blockchain-Based Wireless Network Detection Models

Liu

Yin

2021

IEEE Access

View full text Add to dashboard Cite

Low-rate Distributed DoS (LDDoS) attack is a complex large-scale attack behavior with strong time-domain characteristics in blockchain-based wireless network. Blockchain with Machine learning-based models, as promising ways, are taken to detect them and secure wireless network. However, researchers focused on how to improve models' detection performance and work out new blockchain-based protection technologies during the past decades. Due to lack of evolving data, these models and technologies may have poor stability in the face of confrontational samples. To cope with the problem, this paper proposes a novel LSTM-CGAN method to generate high-quality LDDoS adversarial samples for blockchain-based wireless network detection models. In this method, we give a brief feature analysis about LDDoS attack in blockchainbased wireless network and work out its corresponding time series model firstly. And then, we take use of Long Short-Term Memory Networks (LSTM) to learn relationships among sequenced network packages in the same flow. At last, we establish a Condition Generative Adversarial Networks (CGAN) model to use above relationships as specific conditions for generating mimicking behaviors of LDDoS attacks in blockchain-based wireless network. The experimental results show that these generated adversarial samples based on both public and private datasets can cheat the machine learning detection models, and have the similar attack characteristics with the real samples. Consequently, they can be used as blockchain-based wireless network dataset of machine learning classifiers for training to enhance models' stability.

show abstract

Intelligent intrusion detection based on federated learning aided long short-term memory

Cited by 68 publications

References 35 publications

Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis

Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis

An Ensemble Multi-View Federated Learning Intrusion Detection for IoT

LSTM-CGAN: Towards Generating Low-Rate DDoS Adversarial Samples for Blockchain-Based Wireless Network Detection Models

Contact Info

Product

Resources

About