Federated Deep Learning for Intrusion Detection in IoT Networks

TL;DR

This paper evaluates federated learning for IoT intrusion detection using realistic data distributions, showing that pre-training significantly improves model performance over random initialization.

Contribution

It presents a realistic experimental setup for FL-based IoT intrusion detection and demonstrates the effectiveness of pre-training and aggregation methods in handling data heterogeneity.

Findings

Pre-training improves F1-score by over 20% compared to random initialization.

Data heterogeneity negatively impacts distributed model performance.

Benchmark against centralized solutions shows trade-offs in accuracy.

Abstract

The vast increase of Internet of Things (IoT) technologies and the ever-evolving attack vectors have increased cyber-security risks dramatically. A common approach to implementing AI-based Intrusion Detection systems (IDSs) in distributed IoT systems is in a centralised manner. However, this approach may violate data privacy and prohibit IDS scalability. Therefore, intrusion detection solutions in IoT ecosystems need to move towards a decentralised direction. Federated Learning (FL) has attracted significant interest in recent years due to its ability to perform collaborative learning while preserving data confidentiality and locality. Nevertheless, most FL-based IDS for IoT systems are designed under unrealistic data distribution conditions. To that end, we design an experiment representative of the real world and evaluate the performance of an FL-based IDS. For our experiments, we rely on TON-IoT, a realistic IoT network traffic dataset, associating each IP address with a single FL client. Additionally, we explore pre-training and investigate various aggregation methods to mitigate the impact of data heterogeneity. Lastly, we benchmark our approach against a centralised solution. The comparison shows that the heterogeneous nature of the data has a considerable negative impact on the model's performance when trained in a distributed manner. However, in the case of a pre-trained initial global FL model, we demonstrate a performance improvement of over 20% (F1-score) compared to a randomly initiated global model.