FedPot: A Quality-Aware Collaborative and Incentivized Honeypot-Based Detector for Smart Grid Networks

TL;DR

This paper introduces FedPot, a federated learning-based honeypot detection system for smart grid networks that improves security and incentivizes small-scale power suppliers through a novel data quality measure and fair rewards.

Contribution

It proposes FedPot, a novel FL-based security and incentive framework for IIoT honeypots, incorporating a data quality measure and fair reward distribution mechanism.

Findings

Outperforms existing techniques in security enhancement.

Ensures fair reward distribution among participants.

Demonstrates effectiveness using realistic microgrid datasets.

Abstract

Honeypot technologies provide an effective defense strategy for the Industrial Internet of Things (IIoT), particularly in enhancing the Advanced Metering Infrastructure's (AMI) security by bolstering the network intrusion detection system. For this security paradigm to be fully realized, it necessitates the active participation of small-scale power suppliers (SPSs) in implementing honeypots and engaging in collaborative data sharing with traditional power retailers (TPRs). To motivate this interaction, TPRs incentivize data sharing with tangible rewards. However, without access to an SPS's confidential data, it is daunting for TPRs to validate shared data, thereby risking SPSs' privacy and increasing sharing costs due to voluminous honeypot logs. These challenges can be resolved by utilizing Federated Learning (FL), a distributed machine learning (ML) technique that allows for model training without data relocation. However, the conventional FL algorithm lacks the requisite functionality for both the security defense model and the rewards system of the AMI network. This work presents two solutions: first, an enhanced and cost-efficient FedAvg algorithm incorporating a novel data quality measure, and second, FedPot, the development of an effective security model with a fair incentives mechanism under an FL architecture. Accordingly, SPSs are limited to sharing the ML model they learn after efficiently measuring their local data quality, whereas TPRs can verify the participants' uploaded models and fairly compensate each participant for their contributions through rewards. Simulation results, drawn from realistic mircorgrid network log datasets, demonstrate that the proposed solutions outperform state-of-the-art techniques by enhancing the security model and guaranteeing fair reward distributions.