Clustered federated learning architecture for network anomaly detection in large scale heterogeneous IoT networks

Sáez-de-Cámara, Xabier; Flores, José Luis Martínez; Arellano, Cristóbal; Urbieta, Aitor; Zurutuza, Urko

doi:10.1016/j.cose.2023.103299

Cited by 38 publications

(8 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The mention of FedML [77] in the context of Fed-AIDS model indicates the implementation of FL model within these widely used DL frameworks. Sherpa.AI has developed an opensource FL&DP [78]. The objective is to encourage the advancement of research and development in edge AI services while prioritizing the protection of data privacy.…”

Section: A Process Flow and Toolsmentioning

confidence: 99%

“…Their encoding equation, h = f(Wx + b), reflects their ability to compress data into a "normal" representation, and then VOLUME XX, 2017 reconstruct it, flagging anomalies as distortions [129]. They excel in identifying novel attacks without prior knowledge of attack patterns and learning efficient representations of network traffic [78,87,88,113].…”

Section: Classification Modelsmentioning

confidence: 99%

“…Also, they are made to enable the training of a global model while also preserving the privacy of data from individual devices [133]. Notably, Federated Averaging (FedAvg) [77,81,84,87,90,95,112,114], Federated+ (Fed+) [120], and Federated Stochastic Gradient Decent (FedSGD) [78,79,91] are the answer for RQ6, specifically identified three aggregation functions that are commonly employed in Fed-AIDS modeling on IoT devices. Figure 7 depicts these aggregation functions as appeared in the reviewed studies.…”

Section: E Aggregation Functionsmentioning

confidence: 99%

“…Specifically, Figure 8 provides insights into the most frequently employed evaluation metrics, addressing our RQ7 about their popularity in published studies. Although most of the metrics contributed detection/classification performance of the Fed-AIDS models, this include confusion matrix [80,81,112,114], Matthews Correlation Coefficient (MCC) [78], Area Under Curve (AUC) [90,135], Pearson Correlation Coefficient (PCC) [120], and also combined of Accuracy, Precision (Detection rate), Recall also known as True Positive Rate (TPR) and F-score [79,86,93,115]. Lastly, False Alarm Rate (FAR) also known as False Positive Rate (FPR) [51].…”

Section: F Evaluation Metricsmentioning

confidence: 99%

See 3 more Smart Citations

Review on Approaches of Federated Modeling in Anomaly-Based Intrusion Detection for IoT Devices

Isma’ila,

Danyaro,

Muazu

et al. 2024

IEEE Access

View full text Add to dashboard Cite

The novelty of Federated Learning (FL) has emerged as a promising alternative to centralized machine learning systems in the context of Anomaly-Based Intrusion Detection Systems (AIDS) deployed on Internet of Things (IoT) devices. Unlike traditional centralized models, FL allows on-device model training and updates, reducing privacy concerns and issues like single points of failure and high false alarm rates (FAR). This approach, termed 'Fed-AIDS,' offers a more secure and efficient solution. However, the development of Fed-AIDS models faces challenges related to limited training data and the diverse nature of IoT datasets. Additionally, FL's decentralized nature introduces weight divergence issues arising from non-Independently and Identically Distributed (non-IID) clients. To address these challenges and optimize Fed-AIDS modeling, interdisciplinary research efforts are vital. The primary objective of this study is to conduct an up-to-date review by adopting a Systematic Literature Review (SLR) approach to analyze existing studies of Fed-AIDS modeling procedures for IoT devices. Data from the published studies were retrieved from Scopus database, which covered major publishers like IEEE, Elsevier and others. Specifically, our review conducted from the following Fed-AIDS perspectives: workflow and tools, training dataset, complexities of non-IID data in Fed-AIDS models, classification tasks, aggregation tasks, and model validation metrics. Based on the research findings, the study highlights a series of challenges and proposes potential solutions to stand in future research in Fed-AIDS modeling, aiming to advance the field of IoT device security.

show abstract

Section: A Process Flow and Toolsmentioning

confidence: 99%

Section: Classification Modelsmentioning

confidence: 99%

Section: E Aggregation Functionsmentioning

confidence: 99%

Section: F Evaluation Metricsmentioning

confidence: 99%

See 2 more Smart Citations

Review on Approaches of Federated Modeling in Anomaly-Based Intrusion Detection for IoT Devices

Isma’ila,

Danyaro,

Muazu

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The literature presents various ML and DL techniques for IoT malware detection. Several studies have focused on the use of federated learning [95], [129], [130] to ensure privacy and lower communication costs despite potential data bias and resource challenges. For example, Shukla et al [129] proposed a federated learning approach that uses heterogeneous models for on-device malware detection in IoT networks.…”

Section: E: Malware Detection Approaches In Iot Devicesmentioning

confidence: 99%

A Review of State-of-the-Art Malware Attack Trends and Defense Mechanisms

Ferdous,

Islam,

Mahboubi

et al. 2023

IEEE Access

View full text Add to dashboard Cite

The increasing sophistication of malware threats has led to growing concerns in the antimalware community, as malware poses a significant danger to online users despite the availability of numerous defense solutions. This study aims to comprehensively review malware evolution and current attack trends to identify effective defense mechanisms. It reviews the most recent journal articles, conference proceedings, reports, and online resources published during the last five years. We extensively review the malware landscape from 1970 to the present and analyze malware types, operational mechanisms, attack vectors, and vulnerabilities. Furthermore, we explore different defensive strategies developed in response to these evolving threats. Our findings highlight the increasing sophistication of malware attack trends, including a surge in cryptojacking, attacks on mobile devices, Internet of Things devices, ransomware, advanced persistent threats, supply chain attacks, fileless malware, cloud-based attacks, exploitation of remote employees, and attack trends on edge networks. Defense strategies have also evolved in parallel, emphasizing multilayered security measures to counter these dynamic threats. This study highlights the critical need for robust, multilayered security measures to combat dynamic malware. Despite these advancements, some open challenges and significant research gaps remain, which require further innovation. This review serves as a valuable guide for cybersecurity professionals by identifying the key trends, challenges, limitations, and future cybersecurity research opportunities.INDEX TERMS Malware evolution, malware attack trends, defense mechanisms, malware detection, machine learning, deep learning. D. INCREASED NUMBER OF TARGETED RANSOMWARE ATTACKSRecent malware trends have highlighted increased targeted ransomware attacks, in which hackers access a network or system, encrypt data, and demand a ransom to restore access. This increase in ransomware attacks is driven by several factors, including potential financial gains, easy operation, the rise of ransomware-as-a-service platforms, and the popularity of cryptocurrencies like Bitcoin [97]. Ransomware attacks are wide-ranging, targeting everything from desktops and mobile devices and increasingly involving IoT devices.

show abstract

A hybrid intrusion detection approach based on message queuing telemetry transport (MQTT) protocol in industrial internet of things

Francis,

Souri,

İnanç

2024

Trans Emerging Tel Tech

View full text Add to dashboard Cite

The number of attacks against Industrial Internet of Things (IIoT) devices has increased over the past years, particularly on widely used communication protocols like Message Queuing Telemetry Transfer (MQTT). The fast increase in IIoT applications brings both critical challenges and technical gaps in cybersecurity. On the other hand, traditional cyber‐attack detection approaches scrap to address and support the run‐time responsibilities of IIoT environments. This study presents a hybrid Genetic Algorithm and Random Forest (GA_RF) method for detecting cyber‐attacks in Industrial Control Machines (ICS) that use MQTT protocol in the IIoT environment. This architecture integrates ICS with edge devices and cloud servers, using a GA_RF algorithm to detect anomalies in data collected by sensors. Normal data is processed locally and then sent to the cloud for storage and return, ensuring continuous monitoring and security. Also, the MQTT‐IOT‐IDS2020 dataset as a real test case was applied for prediction of the proposed GA_RF method with compare to some other powerful machine and deep learning models. The experimental results show that the proposed GA_RF method has an optimum accuracy of 99.87%–100% for detecting cyber‐attacks. This hybrid algorithm also achieved 0–0.0015 in Mean Absolute Error (MAE) and 100% in Precision, Recall, and F‐score factors. This result led to the proposed architecture, which connects the ICS to a server while running GA_RF on the IIoT environment. In conclusion, this study indicates the effectiveness of GA_RF and aims to improve security by using the MQTT protocol in IIoT.

show abstract

Clustered federated learning architecture for network anomaly detection in large scale heterogeneous IoT networks

Cited by 38 publications

References 26 publications

Review on Approaches of Federated Modeling in Anomaly-Based Intrusion Detection for IoT Devices

Review on Approaches of Federated Modeling in Anomaly-Based Intrusion Detection for IoT Devices

A Review of State-of-the-Art Malware Attack Trends and Defense Mechanisms

A hybrid intrusion detection approach based on message queuing telemetry transport (MQTT) protocol in industrial internet of things

Contact Info

Product

Resources

About