Source-linked AI summary
Federated Learning for Internet of Things: A Federated Learning Framework for On-device Anomaly Data Detection
Tuo Zhang, Chaoyang He, Tianhao Ma, Lei Gao, Mark Ma, Salman Avestimehr
TL;DR
IoT anomaly detection needs alternatives to centralized cloud processing because privacy, communication, and storage constraints grow with high-frequency edge data. The paper builds FedIoT and FedDetect for federated detection on realistic IoT devices, finding broad attack-type detection and feasible training and memory costs on Raspberry Pi. Its scope is bounded by the need for practical deployment analysis and assumptions about uncompromised gateways and initially uncompromised devices.
Problem
Centralized IoT anomaly detection faces data-privacy and high communication/storage overhead, while prior FL studies lack sufficient evidence across large attack and device scales and realistic platforms.
Method
FedIoT combines a modular FL platform for realistic IoT devices with FedDetect, which uses an adaptive optimizer and cross-round learning-rate scheduler for local training.
Results
The evaluation reports that federated learning detects a large range of attack types, with end-to-end training under 1 hour and memory using only a small fraction of Raspberry Pi host memory.
Takeaways & Limitations
FedIoT provides an open, generic, flexible basis for studying FL-based IoT cybersecurity while supporting lightweight additions of data, models, and algorithms.
Takeaways & Limitations
The practical-deployment evidence is bounded by assumptions that IoT devices are initially uncompromised and the Internet gateway is not compromised.
Abstract
from arXiv · showhide
Federated learning can be a promising solution for enabling IoT cybersecurity (i.e., anomaly detection in the IoT environment) while preserving data privacy and mitigating the high communication/storage overhead (e.g., high-frequency data from time-series sensors) of centralized over-the-cloud approaches. In this paper, to further push forward this direction with a comprehensive study in both algorithm and system design, we build FedIoT platform that contains FedDetect algorithm for on-device anomaly data detection and a system design for realistic evaluation of federated learning on IoT devices. Furthermore, the proposed FedDetect learning framework improves the performance by utilizing a local adaptive optimizer (e.g., Adam) and a cross-round learning rate scheduler. In a network of realistic IoT devices (Raspberry PI), we evaluate FedIoT platform and FedDetect algorithm in both model and system performance. Our results demonstrate the efficacy of federated learning in detecting a wider range of attack types occurred at multiple devices. The system efficiency analysis indicates that both end-to-end training time and memory cost are affordable and promising for resource-constrained IoT devices. The source code is publicly available at https://github.com/FedML-AI/FedIoT.
1 Introduction
The paper addresses privacy and communication/storage challenges in centralized IoT anomaly detection by developing FedIoT, an FL platform with the FedDetect algorithm and realistic device support. Evaluations report broad attack-type detection and feasible resource use on Raspberry Pi devices.
- Centralized over-the-cloud anomaly detection may not fit large-scale IoT because it centralizes privacy-sensitive, high-frequency sensor data and incurs high communication and storage overhead.
- Prior FL-based IoT intrusion-detection studies do not establish efficacy across large attack and device scales or provide an open, generic, flexible platform evaluated on real IoT hardware.
- FedIoT combines dataset, model, algorithm, and system design, including FedDetect with adaptive local optimization and a cross-round learning-rate scheduler instead of naive FedAvg.
- The platform supports modular additions of data, models, and algorithms, as well as edge training on Raspberry Pi and CPU/GPU distributed training through MQTT and MPI.
- On the N-BaIoT dataset, federated learning detected a large range of attack types, while end-to-end training took less than 1 hour and memory used only a small fraction of Raspberry Pi host memory.
2 Algorithm and System Design
FedIoT combines a modular FL-enabled IoT platform with FedDetect, an anomaly-detection framework using adaptive local optimization and cross-round learning-rate scheduling. Its design supports realistic deployment and evaluation across distributed IoT devices, including global thresholding for broader attack detection.
- Platform Architecture: FedIoT organizes the software architecture into application, algorithm, and infrastructure layers for modular FL-enabled IoT experimentation.
- Dataset Design: The platform uses N-BaIoT to synthesize evaluation data spanning multiple device types, benign traffic, and a broader range of attacks.
- Anomaly Detection: Deep Autoencoder anomaly detection learns normal behavior from benign traffic and flags samples whose reconstruction error exceeds a threshold.
- FedDetect: FedDetect replaces naive FedAvg local training with adaptive optimization such as Adam and a cross-round learning-rate scheduler.
- FedDetect: Global Threshold aggregates reconstruction-error sequences from devices to generate a unified threshold for the federated global model.
- System Design: FedIoT supports realistic IoT evaluation through layered infrastructure and lightweight extensibility for adding new data, models, and algorithms.
3 Experiments
The experiments evaluate FedIoT and FedDetect on global anomaly-detection performance and Raspberry Pi system efficiency. Results compare centralized and federated baselines, verify edge-training consistency, and assess training time, memory, and communication costs.
- FedIoT evaluates global-model performance and system efficiency, including computational speed, communication cost, and memory cost.
- Experimental setup: Experiments implement IoT edge training with nine Raspberry Pi 4B clients and a GPU server for federated aggregation and MQTT service.
- Experimental setup: The study compares local-only CL-Single, centralized CL-Combined, and federated FL-FedDect detection models across the experimental scenarios.
- Learning performance: Under global evaluation, federated training achieves nearly the same performance as centralized training and outperforms CL-Single, while FPR and TNR are slightly worse than centralized learning.
- System performance: Raspberry Pi results are nearly the same as CPU/GPU distributed-training results, with slight differences attributed to different random initialization across runs.
- System performance: Training takes less than 1 minute per round and less than 1 hour end-to-end, while memory uses a small fraction of Raspberry Pi’s 4G host memory and communication takes nearly half the total time.
4 Related Works
Prior work applies federated learning to IoT anomaly detection through general, personalized, multimodal, compressed, and adversarial-client settings. The paper distinguishes FedIoT by jointly analyzing algorithmic and system performance on a real IoT platform.
- Existing systems address IoT anomaly detection with federated learning, including personalized models, varied learning tasks, attention-based CNN-LSTMs, gradient compression, and malicious-client analysis.
- FedIoT is presented as the first compared work to analyze both algorithmic and system performance on a real IoT platform.
5 Conclusion
The paper presents FedIoT as a modular platform for evaluating federated learning in IoT cybersecurity. It combines FedDetect, real-device and distributed-training support, global-model evaluation, and system-efficiency analysis.
- FedIoT uses a Deep Autoencoder for anomaly detection and FedDetect with an adaptive optimizer and cross-round learning-rate scheduler instead of naive FedAvg local training.
- The platform supports IoT edge training and CPU/GPU distributed training through MQTT and MPI communication backends.
- Evaluation finds federated learning effective across a large range of attack types, with affordable end-to-end training time and memory cost for resource-constrained IoT devices.