HBFL: A Hierarchical Blockchain-based Federated Learning Framework for a Collaborative IoT Intrusion Detection

Abstract

The continuous strengthening of the security posture of IoT ecosystems is vital due to the increasing number of interconnected devices and the volume of sensitive data shared. The utilisation of Machine Learning (ML) capabilities in the defence against IoT cyber attacks has many potential benefits. However, the currently proposed frameworks do not consider data privacy, secure architectures, and/or scalable deployments of IoT ecosystems. In this paper, we propose a hierarchical blockchain-based federated learning framework to enable secure and privacy-preserved collaborative IoT intrusion detection. We highlight and demonstrate the importance of sharing cyber threat intelligence among inter-organisational IoT networks to improve the model's detection capabilities. The proposed ML-based intrusion detection framework follows a hierarchical federated learning architecture to ensure the privacy of the learning process and organisational data. The transactions (model updates) and processes will run on a secure immutable ledger, and the conformance of executed tasks will be verified by the smart contract. We have tested our solution and demonstrated its feasibility by implementing it and evaluating the intrusion detection performance using a key IoT data set. The outcome is a securely designed ML-based intrusion detection system capable of detecting a wide range of malicious activities while preserving data privacy.

Comparative Review of the Intrusion Detection Systems Based on Federated Learning: Advantages and Open Challenges

“…In addition, we added to the review several papers from the considered reviews that use IoT datasets for the experiments and are valuable for the FL-based intrusion detection area: [20][21][22][23]57]. The final list of the analyzed papers is [20][21][22][23][24]28,[52][53][54][55][56][57].…”

“…The clients are represented either by an IoT device directly or by a smart router that collects data from a set of IoT devices. The hierarchical architecture is presented in [23,57].…”

“…Scalability is often considered a certain advantage of FL; however, only few research papers focus on this problem [23,52,57], and the number of clients in the experiments rarely exceeds 10.…”