Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT-Edge Devices

Abstract

Deep Learning (DL) has been widely proposed for botnet attack detection in Internet of Things (IoT) networks. However, the traditional Centralized DL (CDL) method cannot be used to detect previously unknown (zero-day) botnet attack without breaching the data privacy rights of the users. In this paper, we propose Federated Deep Learning (FDL) method for zero-day botnet attack detection to avoid data privacy leakage in IoT edge devices. In this method, an optimal Deep Neural Network (DNN) architecture is employed for network traffic classification. A model parameter server remotely coordinates the independent training of the DNN models in multiple IoT edge devices, while Federated Averaging (FedAvg) algorithm is used to aggregate local model updates. A global DNN model is produced after a number of communication rounds between the model parameter server and the IoT edge devices. Zero-day botnet attack scenarios in IoT edge devices is simulated with the Bot-IoT and N-BaIoT data sets. Experiment results show that FDL model: (a) detects zero-day botnet attacks with high classification performance; (b) guarantees data privacy and security; (c) has low communication overhead (d) requires low memory space for the storage of training data; and (e) has low network latency. Therefore, FDL method outperformed CDL, Localized DL, and Distributed DL methods in this application scenario. Index Terms-Cybersecurity, botnet detection, federated learning, deep learning, deep neural network, Internet of Things. I. INTRODUCTION B OTNET attack is a serious cyber security challenge facing the Internet of Things (IoT) [1]-[3]. In our context, a botnet is a network of compromised devices that is used to launch cyber attack against critical infrastructures [4]. This cyber attack may be in form of Denial of Service (DoS), Distributed DoS (DDoS), reconnaissance, or data theft [5].

The Evolution of Federated Learning-Based Intrusion Detection and Mitigation: A Survey

“…Conferences are often favored for the presentation of technical results, and are therefore well represented in the reviewed papers (11), alongside with journals (10), and books (1). Only three venues are represented twice in our selection: IEEE Internet of Things Journal [20], [30], IEEE Access [13], [28], and the IEEE BigDataSE conference [17], [21]. Figure 6 shows the relevant venues in the literature with their types and the number of concerned papers.…”

“…[28] Most papers [9], [12], [13], [18], [19], [22], [23], [27], [30] use similar network features, such as source and destination, local and remote ports, TCP flags, protocol, and packet length. The authors of [26] also target network features but at packet-level, all translated to 1D vectors: IP addresses, layer-4 protocol, ports, and IP packet length as a 120-bit input vector.…”

HBFL: A Hierarchical Blockchain-based Federated Learning Framework for a Collaborative IoT Intrusion Detection

“…Moreover, the resource requirements such as storage, computational power, and network bandwidth are reduced as there is no transfer or collection of training data sets centrally. Therefore, the application of federated learning in IoT networks is highly motivated, and many use cases have been proposed in the literature that adopt this architecture, including the design of IoT IDSs [30].…”

FLAD: Adaptive Federated Learning for DDoS Attack Detection

“…This technique requires sharing a representation of clients' data with the central server. In a recent paper, Popoola et al [10] show the benefits of FL in detecting zero-day botnet attacks in Internet of Things (IoT) environments. The whole study is focused on the application of FEDAVG on traffic generated by infected IoT devices (including the Mirai [11] botnet) and compares FEDAVG against other training approaches, either centralised or distributed.…”

“…This is a common limitation of the works above, related to constraint C2 formulated in Section II-B, in which it is not clear how the central server verifies the performance of the global model with respect to recent attacks. On the other hand, some works rely on the vanilla FEDAVG algorithm [9], [10], [12], which aggregates the local models using weighted averaging. We will demonstrate in Section VIII-A that such an approach can greatly increase the convergence time on unbalanced non-i.i.d.…”