Abstract:Billions of IoT devices lacking proper security mechanisms have been manufactured and deployed for the last years, and more will come with the development of Beyond 5G technologies. Their vulnerability to malware has motivated the need for efficient techniques to detect infected IoT devices inside networks. With data privacy and integrity becoming a major concern in recent years, increasing with the arrival of 5G and Beyond networks, new technologies such as federated learning and blockchain emerged. They allow training machine learning models with decentralized data while preserving its privacy by design. This work investigates the possibilities enabled by federated learning concerning IoT malware detection and studies security issues inherent to this new learning paradigm. In this context, a framework that uses federated learning to detect malware affecting IoT devices is presented. N-BaIoT, a dataset modeling network traffic of several real IoT devices while affected by malware, has been used to evaluate the proposed framework. Both supervised and unsupervised federated models (multi-layer perceptron and autoencoder) able to detect malware affecting seen and unseen IoT devices of N-BaIoT have been trained and evaluated. Furthermore, their performance has been compared to two traditional approaches. The first one lets each participant locally train a model using only its own data, while the second consists of making the participants share their data with a central entity in charge of training a global model. This comparison has shown that the use of more diverse and large data, as done in the federated and centralized methods, has a considerable positive impact on the model performance. Besides, the federated models, while preserving the participant’s privacy, show similar results as the centralized ones. As an additional contribution and to measure the robustness of the federated approach, an adversarial setup with several malicious participants poisoning the federated model has been considered. The baseline model aggregation averaging step used in most federated learning algorithms appears highly vulnerable to different attacks, even with a single adversary. The performance of other model aggregation functions acting as countermeasures is thus evaluated under the same attack scenarios. These functions provide a significant improvement against malicious participants, but more efforts are still needed to make federated approaches robust.

A trusted feature aggregator federated learning for distributed malicious attack detection

A Three-layer Security Assurance Model for a Decentralized Federated Learning System

Chained Anomaly Detection Models for Federated Learning: An Intrusion Detection Case Study

A Federated Learning Architecture for Blockchain DDoS Attacks Detection

Blockchained Federated Learning for Threat Defense

Distributed IIoT anomaly detection scheme based on blockchain and federated learning

An Attack-Resistant Federated Edge Learning Framework for Integrated Sensing, Computing and Communications System

Blockchain-Based Trusted Federated Learning with Pre-Trained Models for COVID-19 Detection

Blockchain‐based object detection scheme using federated learning

Federated learning for malware detection in IoT devices

Data Fusion Approach for Collaborative Anomaly Intrusion Detection in Blockchain-based Systems

Defending Against Poisoning Attacks in Federated Learning with Blockchain

Strengthening network DDOS attack detection in heterogeneous IoT environment with federated XAI learning approach

Blockchain-based Federated Learning for Device Failure Detection in Industrial IoT

Blockchain-Enabled Federated Learning Data Protection Aggregation Scheme With Differential Privacy and Homomorphic Encryption in IIoT

Block Hunter: Federated Learning for Cyber Threat Hunting in Blockchain-based IIoT Networks

Trustworthy and Scalable Federated Edge Learning for Future Integrated Positioning, Communication and Computing System: Attacks and Defenses

A Blockchain-Based Trustworthy Federated Learning Privacy Protection Scheme

A Blockchain-Based Model Migration Approach for Secure and Sustainable Federated Learning in IoT Systems

Effective Intrusion Detection in Heterogeneous Internet-of-Things Networks via Ensemble Knowledge Distillation-based Federated Learning