Customised Intrusion Detection for an Industrial IoT Heterogeneous Network Based on Machine Learning Algorithms Called FTL-CID

Abstract

Technological breakthroughs in the Internet of Things (IoT) easily promote smart lives for humans by connecting everything through the Internet. The de facto standardised IoT routing strategy is the routing protocol for low-power and lossy networks (RPL), which is applied in various heterogeneous IoT applications. Hence, the increase in reliance on the IoT requires focus on the security of the RPL protocol. The top defence layer is an intrusion detection system (IDS), and the heterogeneous characteristics of the IoT and variety of novel intrusions make the design of the RPL IDS significantly complex. Most existing IDS solutions are unified models and cannot detect novel RPL intrusions. Therefore, the RPL requires a customised global attack knowledge-based IDS model to identify both existing and novel intrusions in order to enhance its security. Federated transfer learning (FTL) is a trending topic that paves the way to designing a customised RPL-IoT IDS security model in a heterogeneous IoT environment. In this paper, we propose a federated-transfer-learning-assisted customised distributed IDS (FT-CID) model to detect RPL intrusion in a heterogeneous IoT. The design process of FT-CID includes three steps: dataset collection, FTL-assisted edge IDS learning, and intrusion detection. Initially, the central server initialises the FT-CID with a predefined learning model and observes the unique features of different RPL-IoTs to construct a local model. The experimental model generates an RPL-IIoT dataset with normal and abnormal traffic through simulation on the Contiki-NG OS. Secondly, the edge IDSs are trained using the local parameters and the globally shared parameters generated by the central server through federation and aggregation of different local parameters of various edges. Hence, transfer learning is exploited to update the server’s and edges’ local and global parameters based on relational knowledge. It also builds and customised IDS model with partial retraining through local learning based on globally shared server knowledge. Finally, the customised IDS in the FT-CID model enforces the detection of intrusions in heterogeneous IoT networks. Moreover, the FT-CID model accomplishes high RPL security by implicitly utilising the local and global parameters of different IoTs with the assistance of FTL. The FT-CID detects RPL intrusions with an accuracy of 85.52% in tests on a heterogeneous IoT network.

Firefly algorithm based WSN-IoT security enhancement with machine learning for intrusion detection

“…In 22 , the authors proposed a novel approach called Federated-Transfer-Learning-Based Customized Distributed system (FTLCD) for identifying routing protocol intrusions in a heterogeneous IoT environment. The FTLCD approach involved a central server that initiated the process by using a predefined learning approach to construct a local model and detected unique features of several routing protocol-based IoT devices.…”

Federated Learning-based Routing Vulnerability Analysis and Attack Detection for Healthcare 4.0

“…The FT-CID design process is decomposed into three steps: dataset collection and preprocessing, FTL-assisted edge-enabled IDS learning, and final intrusion detection. In [21], a federated learning architecture was introduced to detect intruders. Similarly, FLbased learning for detecting zero-day botnet attacks [21] was proposed to enhance the data privacy concept in IoT edge devices.…”

“…In [21], a federated learning architecture was introduced to detect intruders. Similarly, FLbased learning for detecting zero-day botnet attacks [21] was proposed to enhance the data privacy concept in IoT edge devices. It did not investigate advanced FL algorithms' potential to enhance attack detection.…”

Mitigating Denial of Service Attacks in RPL-Based IoT Environments: Trust-Based Approach

“…Federated-transfer-learning assisted customized distributed (FT-CID) IDS model is proposed in [71] to identify RPL intrusion in IoT environments. The design process of FT-CID includes three steps: dataset collection, FTL-assisted edge IDS learning, and intrusion detection.…”