Graph-based federated learning approach for intrusion detection in IoT networks.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Internet of Things (IoT) networks are increasingly vulnerable to sophisticated cyber threats.
• Existing federated learning methods for intrusion detection fail to capture both structural and temporal patterns, limiting their effectiveness against coordinated attacks like DDoS.
• Detecting coordinated attacks necessitates understanding network topology and temporal sequences simultaneously.

Purpose of the Study:

• To propose FedGATSage, a federated learning architecture designed to overcome the limitations of current intrusion detection systems in IoT environments.
• To enhance the detection of coordinated cyberattacks by preserving both structural and temporal patterns.
• To reduce communication overhead in federated learning while maintaining privacy.

Main Methods:

• Integration of client-side Graph Attention Networks (GAT) with server-side GraphSAGE through community abstraction.
• Utilizing specialized detector variants for different attack types.
• Employing community-based embeddings to aggregate node information at the client level, reducing communication overhead by 85%.

Main Results:

• FedGATSage achieves performance comparable to centralized intrusion detection approaches while preserving user privacy.
• The proposed method significantly outperforms existing federated intrusion detection solutions.
• Successfully detects challenging coordinated attacks that current federated methods cannot handle.

Conclusions:

• FedGATSage offers a robust solution for privacy-preserving, collaborative intrusion detection in IoT networks.
• The architecture effectively addresses the limitations of traditional and GNN-based federated learning for complex cyber threats.
• This approach represents a significant advancement in detecting sophisticated, coordinated attacks in distributed environments.