Smart Intrusion Detection in IoT Edge Computing Using Federated Learning

Abstract

With the proliferation of the Internet of Things (IoT) in various domains, concerns over information security and user privacy have exponentially escalated. Numerous smart intrusion detection (SID) strategies, primarily based on machine/deep learning techniques, have been proposed to counter these security challenges. However, these strategies are typically designed with a centralized approach, where IoT devices relay their data to a central server for training, potentially exposing the data to a range of security threats and privacy vulnerabilities. To address these data security and privacy challenges, a federated learning (FL) approach is adopted in this study. In this approach, individual users train their local models and transmit only parameter updates to the server. These parameters are then aggregated to form the global model. In each FL training cycle, IoT users receive an updated global model from the central server, which they further train utilizing their respective local datasets. This methodology allows for the preservation of IoT device privacy while optimizing the global model. In the context of IoT edge computing, where computational load is distributed to network edges for efficient resource utilization, a novel SID approach based on federated learning is proposed. The effectiveness of this approach is evaluated using three popular deep learning models and three well-established IoT field datasets. This thorough evaluation serves to assess the generalizability of the models and validate the reliability of the results. Through extensive experiments and comprehensive comparisons with other methodologies, this study demonstrates superior performance, achieving an impressive 99% accuracy rate. This result underscores the robustness of the proposed approach in accurately detecting intrusions within IoT environments, thereby offering a promising solution for securing IoT edge computing.

Review on Approaches of Federated Modeling in Anomaly-Based Intrusion Detection for IoT Devices

“…The Unisa Malware Dataset (UMD) was utilized by [110], while the CICIDS2017 dataset found attention from [81,111]. Multiple authors were involved in studying the TON_IoT dataset [55,83,84,90,93,94,112], while on N-BaIoT dataset [112], MNIST dataset [91], Edge-IIoTset dataset [77,92], CIC_IoT dataset [80], CSE-CIC-IDS dataset [113]. The SCADA dataset [88,89], NF-BoT-IoT-v2 dataset [114], while BoT-IoT dataset [79,86,95], MQTT dataset [115], and the Power Demand dataset [85].…”

“…The lower-layer neurons within a fully connected DNN have the capability to establish connections with all neurons in the upper layers [124]. To accomplish supervised learning tasks with nonlinear activation functions, a DNN employs the backpropagation technique, due to this property; DNN has received attention at Fed-AIDS modeling for IoT device [80,86,95,96,112]. In CNN, like meticulous detectives examining fingerprints, CNNs scrutinize network data for spatial anomalies.…”

“…Also, they are made to enable the training of a global model while also preserving the privacy of data from individual devices [133]. Notably, Federated Averaging (FedAvg) [77,81,84,87,90,95,112,114], Federated+ (Fed+) [120], and Federated Stochastic Gradient Decent (FedSGD) [78,79,91] are the answer for RQ6, specifically identified three aggregation functions that are commonly employed in Fed-AIDS modeling on IoT devices. Figure 7 depicts these aggregation functions as appeared in the reviewed studies.…”

“…Specifically, Figure 8 provides insights into the most frequently employed evaluation metrics, addressing our RQ7 about their popularity in published studies. Although most of the metrics contributed detection/classification performance of the Fed-AIDS models, this include confusion matrix [80,81,112,114], Matthews Correlation Coefficient (MCC) [78], Area Under Curve (AUC) [90,135], Pearson Correlation Coefficient (PCC) [120], and also combined of Accuracy, Precision (Detection rate), Recall also known as True Positive Rate (TPR) and F-score [79,86,93,115]. Lastly, False Alarm Rate (FAR) also known as False Positive Rate (FPR) [51].…”