IDAC: Federated Learning-Based Intrusion Detection Using Autonomously Extracted Anomalies in IoT

Area of Science:

• Cybersecurity
• Network Security
• Machine Learning

Background:

• The proliferation of Internet of Things (IoT) devices introduces significant security vulnerabilities.
• Large-scale botnet attacks exploit zero-day vulnerabilities, necessitating advanced intrusion detection systems (IDS).
• Existing federated learning methods for IoT intrusion detection face challenges in autonomous attack labeling and cross-device information sharing.

Purpose of the Study:

• To propose IDAC, a novel intrusion detection method for IoT environments.
• To address the limitations of autonomous attack labeling and federated learning in existing IoT security solutions.
• To enhance the collective detection capabilities against diverse cyber threats, including zero-day attacks.

Main Methods:

• Development of IDAC, featuring autonomous attack candidate labeling using traffic information.
• Implementation of federated learning for sharing attack candidate information across multiple IoT networks.
• Aggregation and determination of attacks based on shared, similar attack candidates.

Main Results:

• IDAC demonstrates feasible and comparable detection performance against multiple attacks, including zero-day attacks.
• The method effectively suppresses false positives during the extraction of attack candidates.
• Sharing autonomously extracted attack candidates across networks improves detection performance and reduces detection time.

Conclusions:

• IDAC offers a viable solution for enhancing intrusion detection in IoT networks.
• The autonomous labeling and federated sharing mechanisms improve the accuracy and efficiency of detecting sophisticated cyber threats.
• IDAC contributes to more robust and responsive IoT security frameworks.