PaperlayerView exact revision on arXiv

Source-linked AI summary

Federated Learning for Malware Detection in IoT Devices

Valerian Rey, Pedro Miguel Sánchez Sánchez, Alberto Huertas Celdrán, Gérôme Bovet, Martin Jaggi

arXiv:2104.09994v3cs.CRcs.LG

TL;DR

The paper addresses how IoT malware detection can use federated learning while preserving data privacy and handling realistic decentralized data and adversarial clients. It presents and evaluates supervised and unsupervised federated models with N-BaIoT, comparing them with local and centralized training. Federated training benefits from broader data and preserves performance relative to centralized training, but standard aggregation remains vulnerable and robust aggregation requires further improvement.

  • Problem

    The paper investigates federated IoT malware detection amid privacy-sensitive decentralized data, realistic non-IID settings, adversarial clients, and limited suitable datasets.

  • Method

    The paper develops a privacy-preserving federated framework using supervised multilayer perceptrons and unsupervised autoencoders, evaluated on N-BaIoT against local and centralized approaches.

  • Results

    More diverse and larger data improves supervised and unsupervised performance, while federated models preserve privacy with results similar to centralized models; robust aggregation improves resilience to malicious clients.

  • Takeaways & Limitations

    Federated learning can support privacy-preserving IoT malware detection, but federated approaches still need stronger robustness against adversarial participants.

  • Takeaways & Limitations

    Performance remains substantially reduced under some attacks, and the effect of more sophisticated and stealthy attacks is unknown.

Abstract

from arXiv · show

This work investigates the possibilities enabled by federated learning concerning IoT malware detection and studies security issues inherent to this new learning paradigm. In this context, a framework that uses federated learning to detect malware affecting IoT devices is presented. N-BaIoT, a dataset modeling network traffic of several real IoT devices while affected by malware, has been used to evaluate the proposed framework. Both supervised and unsupervised federated models (multi-layer perceptron and autoencoder) able to detect malware affecting seen and unseen IoT devices of N-BaIoT have been trained and evaluated. Furthermore, their performance has been compared to two traditional approaches. The first one lets each participant locally train a model using only its own data, while the second consists of making the participants share their data with a central entity in charge of training a global model. This comparison has shown that the use of more diverse and large data, as done in the federated and centralized methods, has a considerable positive impact on the model performance. Besides, the federated models, while preserving the participant's privacy, show similar results as the centralized ones. As an additional contribution and to measure the robustness of the federated approach, an adversarial setup with several malicious participants poisoning the federated model has been considered. The baseline model aggregation averaging step used in most federated learning algorithms appears highly vulnerable to different attacks, even with a single adversary. The performance of other model aggregation functions acting as countermeasures is thus evaluated under the same attack scenarios. These functions provide a significant improvement against malicious participants, but more efforts are still needed to make federated approaches robust.

1. Introduction

The paper motivates privacy-preserving federated learning for IoT malware detection amid expanding, heterogeneous attacks and decentralized data. It proposes supervised and unsupervised federated models and evaluates performance, attacks, countermeasures, costs, and deployment issues.

  • IoT and B5G growth expands connected-device applications while increasing the variety of cyberattacks that can outdate existing security approaches.
  • Behavioral fingerprints derived from network communications and other device activity sources can detect deviations caused by cyberattacks or malicious software.
  • Centralized malware-detection solutions collect data from multiple devices, creating privacy concerns when sensitive environmental or human-related data is exposed.
  • Federated learning trains models across decentralized clients by sharing model parameters instead of local data, supporting collaborative learning under privacy requirements.
  • The framework addresses open questions about non-IID IoT data, unseen malware, adversarial clients, countermeasures, and deployment in B5G scenarios.
  • Experiments compare centralized, independent local, and federated training, while adversarial evaluations test malicious updates and aggregation-based resilience mechanisms.

2. Related work

Related work covers AI-based IoT cybersecurity, federated learning, attacks and defenses, and IoT attack datasets. It identifies limited realistic federated malware-detection evidence and insufficiently suitable datasets.

  • Prior IoT security research applies machine learning and deep learning to device fingerprinting, malware detection, and intrusion detection.
  • Existing federated IoT-security studies may rely on private datasets or randomly split data that do not represent realistic decentralized client distributions.
  • The paper identifies a lack of solutions combining federated learning, decentralized malware data, and IoT attack detection, as well as a lack of datasets directly suitable for this setting.
  • Federated learning research shows that ordinary model averaging can fail against a single malicious client, motivating robust aggregation functions.
  • Public IoT attack datasets include varied device counts, attack stages, and traffic sources, but are generally generated at a central location.

3. Use Case: IoT Scenario Affected by Malware

The use case models privacy-sensitive, heterogeneous IoT networks where federated clients must detect both known and unseen malware despite potentially malicious participants. N-BaIoT supplies realistic device-separated traffic for evaluation.

  • The scenario assumes non-IID device data, detection of unseen or zero-day malware, classification of known malware, and adversarial federated clients.
  • N-BaIoT was selected because its traffic is separated by device, enabling realistic non-IID federated splits.
  • The dataset's nine-device scope limits the maximum number of federated clients available for experiments.
  • N-BaIoT contains traffic from 9 IoT devices recorded in benign conditions and under Mirai or BASHLITE infection.
  • Each sample is a sniffed network packet represented by 115 numerical features describing packet statistics across multiple time windows.
  • The methodology evaluates both supervised and unsupervised single-sample analysis, using labeled attacks for classification and benign data for anomaly detection.

4. Federated Learning-based Framework and Deployment

The proposed architecture uses device-owning clients and a coordinating server to train and evaluate federated malware-detection models. Deployment places collection and training functions on network infrastructure rather than constrained IoT devices.

  • The architecture defines components and interactions for model training and evaluation and is validated using the N-BaIoT dataset.
  • The framework includes K clients, each owning one device's data, and a server coordinating the federated-learning process.
  • Figure 1 omits normalization-value sharing and collaborative hyper-parameter selection for simplicity.

4.1. Client

Clients collect IoT-device traffic and train either supervised classifiers or unsupervised autoencoders, using device-specific data splits and preprocessing before federated participation.

  • Client role: Clients collect traffic from observed IoT devices, while more capable network entities perform model training rather than the resource-constrained devices themselves.The framework targets cross-silo federated learning with few, powerful clients.
  • Learning settings: The supervised setup uses labeled local data, whereas the unsupervised setup trains only on benign traffic and detects anomalies through reconstruction error.Samples exceeding a threshold are classified as anomalous.
  • Dataset splitting: Supervised datasets are split chronologically into train, unused, and test sets; unsupervised data additionally reserves benign samples for threshold selection.The supervised proportions are 79%, 1%, and 20%; the unsupervised benign proportions are 39.5%, 39.5%, 1%, and 20%.
  • Dataset preparation: Three per-device class balances are evaluated: 7.87% benign/92.13% attack, 50%/50%, and 95% benign/5% attack.The rebalancing creates distinct evaluation scenarios rather than measuring class-imbalance handling.
  • Dataset preparation: Each device contributes 100,000 supervised samples or 10,000 unsupervised samples, reflecting the higher convergence cost and benign-only training of the unsupervised model.The sample count is fixed per device to reduce dependence on training-set size.
  • Model architectures: The supervised alternative uses four MLP architectures, while the unsupervised alternative investigates autoencoders with different hidden-layer configurations.Classifier depth ranges from no hidden layer to three hidden layers; autoencoder designs range from one to seven hidden layers.

4.2. Server

The server initializes and coordinates federated training by aggregating client models into a global model, while the design can alternatively decentralize these functions among clients.

  • Server responsibilities: The server initializes the model, aggregates client models, and coordinates collaborative normalization, grid search, and threshold selection.These responsibilities support both supervised and anomaly-detection workflows.
  • Initialization: All clients receive the same initial model before local training begins.The initial model sharing is performed by the server.
  • Model aggregation: Baseline aggregation averages the updated parameters from all clients to form the next global model.The resulting algorithms are called MINI-BATCH AVG and MULTI-EPOCH AVG according to their communication schedule.
  • Alternative architecture: Model initialization and aggregation could be moved to clients or decentralized across entities using Blockchain as a shared database.This would remove the need for a coordinating server.

4.3. Additional Concerns of the Proposed Framework

Federated training requires adaptations beyond local optimization, including collaborative normalization, hyper-parameter selection, and anomaly-threshold selection.

  • Collaborative normalization: Clients compute local feature minima and maxima, while the server derives global scaling values through element-wise aggregation.The procedure reproduces minima and maxima over the combined training sets but exposes each client’s exact feature extrema.
  • Hyper-parameter selection: Architecture hyper-parameters must be shared across clients, and the framework also standardizes optimization hyper-parameters for simplicity.Architecture choices include layers, neurons, and activations; optimization choices include optimizer, learning rate, batch size, and epochs.
  • Hyper-parameter selection: Collaborative grid search selects common hyper-parameters using validation results shared by clients and averaged across candidate settings.Unsupervised selection minimizes benign-data loss, while supervised selection uses validation accuracy.
  • Threshold selection: For anomaly detection, clients transmit local thresholds and the server returns their average as a global threshold.Because the threshold formula is nonlinear, averaging local thresholds is not equivalent to computing one threshold from pooled threshold-selection data.
  • Threshold selection: The threshold is needed for final testing but is also computed during training to show its evolution.This additional computation is a monitoring choice rather than a final-testing requirement.

5. Adversarial Attacks and Countermeasures

The framework evaluates data and model poisoning attacks against federated malware detection and tests robust aggregation methods as countermeasures to malicious updates.

  • Threat model: The threat model assumes an honest server, a majority of honest clients, and a minority of potentially colluding malicious clients.Malicious clients are treated as Byzantine workers, while privacy issues involving honest-but-curious entities are out of scope.
  • Data poisoning: Data poisoning modifies client datasets, including benign-label, attack-label, and all-label flipping attacks parameterized by the fraction of labels changed.The targeted attacks aim at 0% TNR or 0% TPR, while all-label flipping targets 0% accuracy.
  • Model poisoning: Model poisoning sends corrupted updates to the server, and federated privacy makes it difficult to verify whether received models match local training data.Clients can submit arbitrarily bad models through the update channel.
  • Model poisoning: Gradient-factor attacks multiply malicious gradients by a negative factor to reverse the average update direction.The attack can use any negative factor, although a specific factor yields an average update factor of −1.
  • Model poisoning: Model-cancelling attacks scale malicious models so averaging cancels the honest clients’ contribution and drives global parameters toward zero.Exact malicious-client counts are needed for the prescribed scaling, making collusion necessary; the resulting updates are conspicuous.
  • Robust aggregation: The evaluated countermeasures modify aggregation without requiring prior knowledge of client-data distributions, although convergence proofs do not hold for the non-IID setting.Their simplicity makes them easy to implement, but the distribution mismatch limits direct theoretical guarantees.
  • Robust aggregation: Coordinate-wise median excludes parameter outliers, while coordinate-wise trimmed mean removes extreme values before averaging.The trimmed-mean variant removes an integer number c of largest and smallest values per coordinate.
  • Robust aggregation: s-Resampling is a pre-aggregation step intended to reduce model heterogeneity from non-IID client data before robust aggregation.Combining it with averaging is described as useless; its purpose is to reduce side effects of robust functions on heterogeneous models.

6. Experimental Results

Experiments on N-BaIoT compare centralized, naive decentralized, and federated malware-detection training under supervised and unsupervised settings, then evaluate poisoning attacks and aggregation countermeasures. Federated training approaches centralized performance while preserving privacy, but robustness against malicious clients remains incomplete.

  • Experimental setup: The experiments compare centralized training, independent local models, and federated models using two communication-efficient FL algorithms.The federation uses eight clients, holds one of nine devices out for unseen-device testing, and repeats experiments across device combinations.
  • Supervised and unsupervised detection: Centralized performance exceeds the naive decentralized baseline, especially for unseen devices, while MINI-BATCH AVG converges near centralized performance and can sometimes exceed it.Figure 4 illustrates convergence toward the centralized accuracy.
  • Supervised and unsupervised detection: MULTI-EPOCH AVG has an insignificant known-device accuracy decrease but consistently exceeds centralized accuracy on the new device, potentially improving generalization.The authors also attribute this behavior to parameter averaging under a nonconvex loss and possible protection against overfitting.
  • Supervised and unsupervised detection: Both federated algorithms nearly reach centralized performance for unsupervised fingerprinting, with MULTI-EPOCH AVG showing marginally better new-device TNR than MINI-BATCH AVG.Its global threshold also converges to a larger value than the centralized threshold because collaborative threshold selection differs from centralized selection.
  • Supervised and unsupervised detection: Using more diverse training data substantially improves malware-detection performance, especially on previously unseen devices.The paper reports this pattern across the supervised and unsupervised experiments.
  • Adversarial attacks and countermeasures: AVG performs best when clients are honest but is highly vulnerable to gradient-factor and model-cancelling attacks, where one malicious client can create a constant predictor.A constant positive predictor has approximately 10% F1-Score, while a constant negative predictor has 0%.
  • Adversarial attacks and countermeasures: Even after MED improves resilience to model-poisoning attacks, performance remains substantially reduced and further research on adversarially robust aggregation is required.Under all-label flipping, AVG can still outperform aggregation functions designed for robustness.

7. Discussion

The discussion examines deployment trade-offs for the federated IoT malware-detection framework, including adversarial resilience, communication and computation costs, scalability, and server centralization. It identifies practical constraints in B5G environments and possible mitigation strategies.

  • Scalability and adversarial setting: The experiments used only 8 training clients, limiting direct evaluation of scalability in real B5G deployments.This limitation arose from the availability of datasets suitable for federated learning.
  • Scalability and adversarial setting: Robust aggregation algorithms should be tested because current methods provide insufficient attack resilience when malicious clients exceed 25%.The paper identifies Krum, Bulyan, and AUROR as promising future candidates.
  • Communication and computation costs: Communication and computation costs remain important because they can affect the regular operation of IoT wireless interfaces and access-network elements.The framework targets B5G base stations and access points, which are assumed to have relatively high computational power.
  • Communication and computation costs: MINI-BATCH AGGREGATION requires E·n_k/B model transmissions per client, whereas MULTI-EPOCH AGGREGATION requires T transmissions per client.Multi-epoch aggregation performs more local model updates, while mini-batch aggregation incurs higher communication costs.
  • Communication and computation costs: MULTI-EPOCH AVG uses approximately 1300 times less communication than MINI-BATCH AVG supervised and 2000 times less unsupervised.The selected multi-epoch configuration performs 3.75 times more local training iterations.
  • Centralization and synchronization: Server aggregation provides coordination and control but creates a central point of failure vulnerable to bottlenecks or attacks.The paper suggests scaling server functionality, strengthening security, or moving toward a purely decentralized design.
  • Centralization and synchronization: Client synchronization can delay training when clients are slow or fail, so the framework uses a timeout and skips nonresponsive clients.Blockchain is discussed as a possible aid, but its use introduces threats including majority and block-validation attacks.

8. Conclusions and Future Work

The paper concludes that federated learning can support privacy-preserving IoT malware detection with supervised and unsupervised models. Its results show performance benefits from diverse data and serious vulnerability to malicious clients, while future work targets stronger defenses and larger-scale evaluation.

  • Conclusions: The proposed framework uses federated learning to train supervised and unsupervised IoT malware-detection models without sharing sensitive data.It is designed for deployment on network nodes providing access to IoT devices.
  • Conclusions: Federated and centralized training benefited from more diverse and larger data, while federated training preserved privacy without losing model performance.The comparison included federated, centralized, and isolated local models.
  • Conclusions: A single malicious client can ruin the federated model without robust aggregation, while median aggregation provides promising but insufficient improvement.The evaluated attacks included label flipping, gradient-factor poisoning, and model cancelling.
  • Future work: Future work includes evaluating unsupervised adversarial attacks, evasion attacks, and additional countermeasures such as Krum, Bulyan, and AUROR.These directions aim to further assess attack impact and aggregation robustness.
  • Future work: Scalability in real B5G scenarios remains unstudied because available datasets lack the necessary scale and diversity.The paper proposes generating a much larger and more diverse dataset.
Loading 2104.09994v3…