DÏoT: A Federated Self-learning Anomaly Detection System for IoT

By T. D. Nguyen, Samuel Marchal, Markus Miettinen, Hossein Fereidooni, N. Asokan, Ahmad-Reza Sadeghi. IEEE International Conference on Distributed Computing Systems, 2018

625 citations recorded by the source corpus.

IoT devices are increasingly deployed in daily life. Many of these devices are, however, vulnerable due to insecure design, implementation, and configuration. As a result, many networks already have vulnerable IoT devices that are easy to compromise. This has led to a new category of malware specifically targeting IoT devices. However, existing intrusion detection techniques are not effective in detecting compromised IoT devices given the massive scale of the problem in terms of the number of different types of devices and manufacturers involved. In this paper, we present DÏoT, an autonomous self-learning distributed system for detecting compromised IoT devices. DÏoT builds effectively on device-type-specific communication profiles without human intervention nor labeled data that are subsequently used to detect anomalous deviations in devices' communication behavior, potentially caused by malicious adversaries. DÏoT utilizes a federated learning approach for aggregating behavior profiles efficiently. To the best of our knowledge, it is the first system to employ a federated learning approach to anomaly-detection-based intrusion detection. Consequently, DÏoT can cope with emerging new and unknown attacks. We systematically and extensively evaluated more than 30 off-the-shelf IoT devices over a long term and show that DÏoT is highly effective (95.6% detection rate) and fast (257 ms) at detecting devices compromised by, for instance, the infamous Mirai malware. DÏoT reported no false alarms when evaluated in a real-world smart home deployment setting.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/383061c39d9835d24d9bddb6bf11f2cdd11a23f2

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

A Survey on Federated Learning for Resource-Constrained IoT Devices (2021, positive): “Anomaly Detection: An autonomous self-learning scheme is proposed in [215] to identify compromised devices within IoT networks.”
End-to-End Evaluation of Federated Learning and Split Learning for Internet of Things (2020, background): “7, similar to [25], which can be a smart home setting.”
A Survey on Federated Learning: The Journey From Centralized to Distributed On-Site Learning and Beyond (2021, methodology): “[72] proposed an intrusion detection system based on anomaly detection for IoT.”
Federated Learning for Vehicular Internet of Things: Recent Advances and Open Issues (2020, background): “[44] propose a FL-based intrusion detection system for IoT.”
Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges (2022, background): “[101], where the authors propose an anomaly based system based on a Gated Recurrent Unit (GRU) and test it on Internet of Things (IoT) specific databases.”
DeepFed: Federated Deep Learning for Intrusion Detection in Industrial Cyber–Physical Systems (2020, background): “[21] designed an autonomous self-learning distributed system for detecting compromised IoT devices, which employed a federated learning approach to achieve intrusion detection.”
Eavesdrop the Composition Proportion of Training Labels in Federated Learning (2019, background): “Multiple applications have benefited from FL, including mobile phones [1, 2, 3], wearable devices [4, 5], autonomous vehicles [6, 7], etc.”
Addressing Class Imbalance in Federated Learning (2020, background): “2018a), and abnormal heart rate monitoring by wearable devices (Nguyen et al. 2019).”
Federated Learning for Internet of Things: A Comprehensive Survey (2021, methodology): “[82] Attack detection HFL Adversarial ML IoT devices Security gateway An FL-based approach for attack detection in IoT.”
Federated Learning for Malware Detection in IoT Devices (2021, background): “In this context, the research proposed in [7] clearly stated the data privacy problem of traditional AI-based solutions, but the evaluation took place on a private dataset.”
FLAME: Taming Backdoors in Federated Learning (2022, methodology): “Following [44], we extracted”
A Survey on Federated Learning Systems: Vision, Hype and Reality for Data Privacy and Protection (2019, background): “FL can be one potential approach in addressing the data privacy issues, while still offering reasonably good machine learning models [105], [126].”
Deep Anomaly Detection for Time-Series Data in Industrial IoT: A Communication-Efficient On-Device Federated Learning Approach (2020, background): “predict frequently updated time-series data [8]; (2) due to”