Poisoning Attacks on Federated Learning-based IoT Intrusion Detection System

Abstract

Federated Learning (FL) is an appealing method for applying machine learning to large scale systems due to the privacy and efficiency advantages that its training mechanism provides. One important field for FL deployment is emerging IoT applications. In particular, FL has been recently used for IoT intrusion detection systems where clients, e.g., a home security gateway, monitors traffic data generated by IoT devices in its network, trains a local intrusion detection model, and send this model to a central entity, the aggregator, who then computes a global model (using the models of all gateways) that is distributed back to clients. This approach protects the privacy of users as it does not require local clients to share their potentially private IoT data with any other parties, and it is in general more efficient than a centralized system. However, FL schemes have been subject to poising attacks, in particular to backdoor attacks.In this paper, we show that FL-based IoT intrusion detection systems are vulnerable to backdoor attacks. We present a novel data poisoning attack that allows an adversary to implant a backdoor into the aggregated detection model to incorrectly classify malicious traffic as benign. We show that the adversary can gradually poison the detection model by only using compromised IoT devices (and not gateways/clients) to inject small amounts of malicious data into the training process and remain undetected. Our extensive evaluation on three real-world IoT datasets generated from 46 IoT devices shows the effectiveness of our attack in injecting backdoors and circumventing state of the art defenses against FL poisoning. Finally, we discuss shortly possible mitigation approaches.

Data Poisoning Attacks Against Federated Learning Systems

“…As poisoning attacks against FL systems continue to emerge as important research topics in the security and ML communities [14,4,33,56,21], we plan to continue our work in several ways. First, we will study the impacts of the attack and defense on diverse FL scenarios differing in terms of data size, distribution among FL participants (iid vs non-iid), data type, total number of instances available per class, etc .…”

Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review

“…A jointly learned model can be easily backdoored when a very small number of participants are compromised or controlled by an attacker. Both local data poisoning [70] and model poisoning [11], [71], [72] can be carried out by the attacker to implant backdoor into the joint model. We consider the data encryption such as CryptoNet [73], SecureML [74] and CryptoNN [75] under this backdoor attack surface, which trains the model over encrypted data in order to protect data privacy.…”

“…Federated learning [11], [71], [72], (IoT application [70]); Federated learning with distributed backdoor [119]; Federated meta-learning [120]; feature-partitioned collaborative learning [124] White-Box High Offline Model Inspection 2…”

Decentralized Federated Learning Preserves Model and Data Privacy

“…Application of federated learning in the field of AIOps is mainly focused around anomaly [17,18,19] and intrusion detection [20,21]. Liu et al [19,18] propose a deep time series anomaly detection model which is trained locally on IoT devices via federated learning.…”