Abstract:Billions of IoT devices lacking proper security mechanisms have been manufactured and deployed for the last years, and more will come with the development of Beyond 5G technologies. Their vulnerability to malware has motivated the need for efficient techniques to detect infected IoT devices inside networks. With data privacy and integrity becoming a major concern in recent years, increasing with the arrival of 5G and Beyond networks, new technologies such as federated learning and blockchain emerged. They allow training machine learning models with decentralized data while preserving its privacy by design. This work investigates the possibilities enabled by federated learning concerning IoT malware detection and studies security issues inherent to this new learning paradigm. In this context, a framework that uses federated learning to detect malware affecting IoT devices is presented. N-BaIoT, a dataset modeling network traffic of several real IoT devices while affected by malware, has been used to evaluate the proposed framework. Both supervised and unsupervised federated models (multi-layer perceptron and autoencoder) able to detect malware affecting seen and unseen IoT devices of N-BaIoT have been trained and evaluated. Furthermore, their performance has been compared to two traditional approaches. The first one lets each participant locally train a model using only its own data, while the second consists of making the participants share their data with a central entity in charge of training a global model. This comparison has shown that the use of more diverse and large data, as done in the federated and centralized methods, has a considerable positive impact on the model performance. Besides, the federated models, while preserving the participant’s privacy, show similar results as the centralized ones. As an additional contribution and to measure the robustness of the federated approach, an adversarial setup with several malicious participants poisoning the federated model has been considered. The baseline model aggregation averaging step used in most federated learning algorithms appears highly vulnerable to different attacks, even with a single adversary. The performance of other model aggregation functions acting as countermeasures is thus evaluated under the same attack scenarios. These functions provide a significant improvement against malicious participants, but more efforts are still needed to make federated approaches robust.

Fed-IIoT: A Robust Federated Malware Detection Architecture in Industrial IoT

Federated learning for malware detection in IoT devices

Semantic-based Federated Defense for Distributed Malicious Attacks

Comprehensive Android Malware Detection Based on Federated Learning Architecture

Enhancing IoT Security Against DDoS Attacks through Federated Learning

Federated Defense for Malware Detection and Resilience Against Adversarial Attacks

A Knowledge Transfer-based Semi-Supervised Federated Learning for IoT Malware Detection

NGMD: next generation malware detection in federated server with deep neural network model for autonomous networks

FedMADE: Robust Federated Learning for Intrusion Detection in IoT Networks Using a Dynamic Aggregation Method

Enhancing Smart IoT Malware Detection: A GhostNet-based Hybrid Approach

Meta-Fed IDS: Meta-Learning and Federated Learning Based Fog-Cloud Approach to Detect Known and Zero-Day Cyber Attacks in IoMT Networks

IoT Malicious Traffic Detection Based on Federated Learning

FOG-Empowered Augmented-Intelligence-Based Proactive Defensive Mechanism for IoT-Enabled Smart Industries

A State-of-the-Art Technique for Malware Detection Based on Deep Learning in IoT Environment

A Federated Learning-Based Approach for Improving Intrusion Detection in Industrial Internet of Things Networks

DeepFed: Federated Deep Learning for Intrusion Detection in Industrial Cyber–Physical Systems

FLEAM: A Federated Learning Empowered Architecture to Mitigate DDoS in Industrial IoT

Malware detection in industrial internet of things based on hybrid image visualization and deep learning model

Deep learning hybridization for improved malware detection in smart Internet of Things

A Stability-Enhanced Dynamic Backdoor Defense in Federated Learning for IIoT

Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis