Deep Learning (DL) has been widely proposed for botnet attack detection in Internet of Things (IoT) networks. However, the traditional Centralized DL (CDL) method cannot be used to detect previously unknown (zero-day) botnet attack without breaching the data privacy rights of the users. In this paper, we propose Federated Deep Learning (FDL) method for zero-day botnet attack detection to avoid data privacy leakage in IoT edge devices. In this method, an optimal Deep Neural Network (DNN) architecture is employed for network traffic classification. A model parameter server remotely coordinates the independent training of the DNN models in multiple IoT edge devices, while Federated Averaging (FedAvg) algorithm is used to aggregate local model updates. A global DNN model is produced after a number of communication rounds between the model parameter server and the IoT edge devices. Zero-day botnet attack scenarios in IoT edge devices is simulated with the Bot-IoT and N-BaIoT data sets. Experiment results show that FDL model: (a) detects zero-day botnet attacks with high classification performance; (b) guarantees data privacy and security; (c) has low communication overhead (d) requires low memory space for the storage of training data; and (e) has low network latency. Therefore, FDL method outperformed CDL, Localized DL, and Distributed DL methods in this application scenario.

/pdf/federated-deep-learning-for-zero-day-botnet-attack-detection-45wlmxt52t.pdf

Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT Edge Devices

Edge computing provides off-load computing and application services close to end-users, greatly reducing cloud pressure and communication overhead. However, wireless edge networks still face the risk of network attacks. To ensure the security of wireless edge networks, we present Federated Learning-based Attention Gated Recurrent Unit (FedAGRU), an intrusion detection algorithm for wireless edge networks. FedAGRU differs from current centralized learning methods by updating universal learning models rather than directly sharing raw data among edge devices and a central server. We also apply the attention mechanism to increase the weight of important devices, by avoiding the upload of unimportant updates to the server, FedAGRU can greatly reduce communication overhead while ensuring learning convergence. Our experimental results show that, compared with other centralized learning algorithms, FedAGRU improves detection accuracy by approximately 8%. In addition, FedAGRU’s communication cost is 70% less than other federated learning algorithms, and it exhibits strong robustness against poisoning attacks.

/pdf/intrusion-detection-for-wireless-edge-networks-based-on-ozki88omjv.pdf

Intrusion Detection for Wireless Edge Networks Based on Federated Learning

In this article, we present a comprehensive study with an experimental analysis of federated deep learning approaches for cyber security in the Internet of Things (IoT) applications. Specifically, we first provide a review of the federated learning-based security and privacy systems for several types of IoT applications, including, Industrial IoT, Edge Computing, Internet of Drones, Internet of Healthcare Things, Internet of Vehicles, etc. Second, the use of federated learning with blockchain and malware/intrusion detection systems for IoT applications is discussed. Then, we review the vulnerabilities in federated learning-based security and privacy systems. Finally, we provide an experimental analysis of federated deep learning with three deep learning approaches, namely, Recurrent Neural Network (RNN), Convolutional Neural Network (CNN), and Deep Neural Network (DNN). For each deep learning model, we study the performance of centralized and federated learning under three new real IoT traffic datasets, namely, the Bot-IoT dataset, the MQTTset dataset, and the TON_IoT dataset. The goal of this article is to provide important information on federated deep learning approaches with emerging technologies for cyber security. In addition, it demonstrates that federated deep learning approaches outperform the classic/centralized versions of machine learning (non-federated learning) in assuring the privacy of IoT device data and provide the higher accuracy in detecting attacks.

/pdf/federated-deep-learning-for-cyber-security-in-the-internet-1bzlkr7brz.pdf

Federated Deep Learning for Cyber Security in the Internet of Things: Concepts, Applications, and Experimental Analysis

Over the last decade, vehicular ad-hoc networks (VANETs) have received a greater attention in academia and industry due to their influence in intelligent transportation systems. Providing reliability and security to the VANET is essential in order to guarantee the efficiency of its applications. Anomaly detection has become a challenging problem due to the unique environment of VANETs with quick movement and short-lived link. In this paper, a method using the spatio-temporal feature of network traffic is proposed to implement network traffic estimation at first, and on this basis, an anomaly detection algorithm is put forward. The convolutional neural network is employed to extract the spatio-temporal features of the traffic matrix. In terms of the extracted features, network traffic is estimated by using a fully connected architecture as the output layer. Then, a threshold-based separation method is used to implement anomaly detection. The preliminary experiments comparing the proposed method with other machine learning-based methods show the effectiveness of the proposed anomaly detection method.

Spatio-Temporal Network Traffic Estimation and Anomaly Detection Based on Convolutional Neural Network in Vehicular Ad-Hoc Networks

Secure key distribution schemes for group communications allow to establish a secure multicast communication between a group manager and group members through an unreliable broadcast channel. The article classifies, analyzes and compares the most significant key distribution schemes, by looking at the selective key distribution algorithms, at the predistributed secret data management, and at the self-healing mechanisms. It reviews polynomial-based algorithms, exponential arithmetic based algorithms, hash-based techniques, and others. Attention is paid to the self-healing property, which permits group members to recover missing session keys from the recent key distribution broadcast message, without any additional interaction with the group manager.

A Survey of Group Key Distribution Schemes With Self-Healing Property

Intelligent intrusion detection based on federated learning aided long short-term memory

The proliferation of wireless sensor networks (WSNs) and their applications has attracted remarkable growth in unsolicited intrusions and security threats, which disrupt the normal operations of the WSNs. Deep learning (DL)-based network intrusion detection (NID) methods have been widely investigated and developed. However, the high computational complexity of DL seriously hinders the actual deployment of the DL-based model, particularly in the devices of WSNs that do not have powerful processing performance due to power limitation. In this letter, we propose a lightweight dynamic autoencoder network (LDAN) method for NID, which realizes efficient feature extraction through lightweight structure design. Experimental results show that our proposed model achieves high accuracy and robustness while greatly reducing computational cost and model size.

An Efficient Intrusion Detection Method Based on Dynamic Autoencoder

The main property of the self-healing key distribution scheme is that even if during a certain session some broadcast messages are lost due to network faults, the users are still capable of recovering lost session keys on their own, without requesting additional transmission from the group manager. In this paper, we propose and analyze an efficient self-healing key distribution scheme based on vector space secret sharing and one way hash function. We prove that our scheme achieves both forward and backward secrecy and resists to a collusion attack.

An Efficient Self-Healing Key Distribution with Resistance to the Collusion Attack for Wireless Sensor Networks

In vehicular ad hoc network, wireless jamming attacks are easy to be launched in the control channel and can cause serious influence on the network performance which may cause further safety accide...

https://journals.sagepub.com/doi/pdf/10.1177/1550147717725698

Localization of multiple jamming attackers in vehicular ad hoc network

With the ubiquitous network applications and the continuous development of network attack technology, all social circles have paid close attention to the cyberspace security. Intrusion detection systems (IDS) plays a very important role in ensuring computer and communication systems security. Recently, deep learning has achieved a great success in the field of intrusion detection. However, the high computational complexity poses a major hurdle for the practical deployment of DL-based models. In this paper, we propose a novel approach based on a lightweight deep neural network (LNN) for IDS. We design a lightweight unit that can fully extract data features while reducing the computational burden by expanding and compressing feature maps. In addition, we use inverse residual structure and channel shuffle operation to achieve more effective training. Experiment results show that our proposed model for intrusion detection not only reduces the computational cost by 61.99% and the model size by 58.84%, but also achieves satisfactory accuracy and detection rate.

Zhi Xue

Papers

Intelligent intrusion detection based on federated learning aided long short-term memory

An Efficient Intrusion Detection Method Based on Dynamic Autoencoder

An Efficient Self-Healing Key Distribution with Resistance to the Collusion Attack for Wireless Sensor Networks

Localization of multiple jamming attackers in vehicular ad hoc network

A Novel Approach based on Lightweight Deep Neural Network for Network Intrusion Detection