PaperlayerView exact revision on arXiv

Source-linked AI summary

Block Hunter: Federated Learning for Cyber Threat Hunting in Blockchain-based IIoT Networks

Abbas Yazdinejad, Ali Dehghantanha, Reza M. Parizi, Mohammad Hammoudeh, Hadis Karimipour, Gautam Srivastava

arXiv:2204.09829v1cs.CRcs.CY

TL;DR

Blockchain-based IIoT smart factories need anomaly detection because cyber attacks, privacy risks, and centralized-learning constraints affect sensitive industrial systems. The paper introduces Block Hunter, a cluster-based federated framework that trains anomaly-detection models across smart factories while sharing model updates. Evaluations use multiple machine-learning algorithms and report high anomaly-detection accuracy, with AUC values reaching 0.95 on BTD and 0.97 on ETC for NED.

  • Problem

    Blockchain-based IIoT networks remain vulnerable to cyber attacks, while anomaly-detection methods face privacy, training-data scarcity, centralized-training, poisoning, and evasion challenges.

  • Method

    Block Hunter combines cluster-based architecture, federated learning, and multiple machine-learning anomaly-detection models for blockchain-based IIoT smart factories.

  • Results

    AUC values for NED are (0.95, 0.97) based on BTD and ETC datasets, respectively, while NED and IF have the highest and almost similar accuracy.

  • Takeaways & Limitations

    The framework detects anomalous activities in blockchain-based IIoT smart factories while preserving privacy and using a cluster-based design intended to reduce resources and improve throughput.

Abstract

from arXiv · show

Nowadays, blockchain-based technologies are being developed in various industries to improve data security. In the context of the Industrial Internet of Things (IIoT), a chain-based network is one of the most notable applications of blockchain technology. IIoT devices have become increasingly prevalent in our digital world, especially in support of developing smart factories. Although blockchain is a powerful tool, it is vulnerable to cyber attacks. Detecting anomalies in blockchain-based IIoT networks in smart factories is crucial in protecting networks and systems from unexpected attacks. In this paper, we use Federated Learning (FL) to build a threat hunting framework called Block Hunter to automatically hunt for attacks in blockchain-based IIoT networks. Block Hunter utilizes a cluster-based architecture for anomaly detection combined with several machine learning models in a federated environment. To the best of our knowledge, Block Hunter is the first federated threat hunting model in IIoT networks that identifies anomalous behavior while preserving privacy. Our results prove the efficiency of the Block Hunter in detecting anomalous activities with high accuracy and minimum required bandwidth.

I. INTRODUCTION

The paper motivates anomaly detection in blockchain-based IIoT smart factories because cyber attacks, privacy risks, and centralized detection constraints threaten sensitive industrial systems. It proposes Block Hunter, a federated, cluster-based framework intended to detect anomalous behavior while preserving privacy and reducing communication burdens.

  • Motivation: Blockchain-based IIoT smart factories connect many devices and handle sensitive, safety-critical, industrial, and personal data.These networks support systems including temperature monitoring, Internet-enabled lights, IP cameras, and IP phones.
  • Motivation: Cyber attacks and fraudulent activity remain possible despite blockchain’s data-integrity, authentication, and availability advantages.The introduction cites a 51% attack on Ethereum Classic and attacks that caused cryptocurrency theft.
  • Research problem: Anomalous events represent strong deviations from usual behavior, making anomaly detection central to automated threat hunting and protection from unauthorized access.The paper frames detecting out-of-norm events as a way to identify and filter anomalous activities.
  • Research problem: Existing machine-learning anomaly detection faces training-data scarcity and privacy issues, while centralized blockchain detection increases training time and requires new block data during testing.Frequent model updates can also expose systems to poisoning and evasion attacks.
  • Proposed contribution: Block Hunter uses federated learning so edge devices train locally and share model updates rather than raw data to detect attacks in blockchain-based IIoT networks.The paper combines this federated design with a cluster-based architecture and multiple anomaly-detection algorithms.
  • Proposed contribution: The paper evaluates cluster-based anomaly detection, federated design, multiple algorithm families, blockchain parameters, and Accuracy, Precision, Recall, F1-score, and TPR.The stated contributions include examining block generation, block size, miners, bandwidth reduction, and throughput.

II. RELATED WORK

Related work spans anomaly detection for blockchain, IoT, and federated systems, including methods based on metadata, regression, clustering, autoencoders, recurrent networks, and blockchain-supported federated learning. These studies establish relevant privacy and distributed-learning approaches across several application settings.

  • Blockchain anomaly detection: Prior blockchain anomaly-detection work uses metadata collection, distributed designs, and trust- and privacy-related features to identify malicious activity.One cited framework, BAD, collects potential malicious activities using blockchain metadata.
  • Blockchain anomaly detection: Other studies detect tampered IoT meter data with polynomial regression, DBSCAN, autoencoders, and LSTM methods.The cited approach targets fraud recognition when meter data are altered.
  • Blockchain anomaly detection: Bitcoin transaction research applies OCSVM and K-means to group outliers by statistical significance and type, reporting high-performing accuracy results.Another blockchain-IoT approach uses anomaly semantics and metadata to detect anomalous behavior.
  • Blockchain applications: Blockchain Edge of Things research emphasizes decentralization, immutability, and traceability for distributed edge services and applications.The cited work examines blockchain’s expansion beyond cryptocurrency in Edge of Things systems.
  • Federated anomaly detection: Federated-learning studies address anomaly detection in smart buildings, IoT device communications, and abnormal client behavior while supporting privacy-preserving distributed learning.Reported examples include recurrent neural networks, self-learning communication profiles, and low-dimensional model-weight surrogates.
  • Blockchain-supported federated learning: Blockchain-based federated learning has also been used to authenticate data and train global models collaboratively for COVID-19 detection.The cited system combines blockchain authentication with federated training across multiple data sources.
  • Blockchain-supported federated learning: A hierarchical blockchain and federated-learning framework for vehicular networks models sharing behavior as a multi-leader, multi-player trading process.Its stated goals include efficiency, distributed-pattern compatibility, privacy requirements, and knowledge sharing.

III. PROPOSED BLOCK HUNTER FRAMEWORK IN BLOCKCHAIN-BASED IIOT NETWORKS

Block Hunter models blockchain-based smart-factory IIoT networks as clusters of connected devices and participants, then performs federated anomaly detection across smart factories. Local models train on cluster data, while a parameter server aggregates updates into a global model without centralizing the training data.

  • Network model: The proposed network is a cluster-based architecture connecting users, base stations, WiFi, service providers, smart factories, and the blockchain network.Smart factories contain connected devices, and service providers collect sensor data for applications and services.
  • Network model: Transactions exchange sensitive factory information, while blocks contain transaction lists, a previous-block reference, and a hash.The framework assumes smart factories within each cluster have the same functionality.
  • Federated framework: Block Hunter updates anomaly-detection models through federated learning, sending model parameters to a parameter server for aggregation rather than sending every block to a central server.The stated design targets frequent updates while addressing efficiency and privacy concerns.
  • Federated framework: K smart-factory local models share the same structure but train with different datasets from their connected clients.The framework distributes local models across blockchain-based IIoT nodes instead of evaluating one model on a single node.
  • Federated framework: The federated procedure constructs a cluster federation, trains models on local data, accumulates model updates, and aggregates them without individually sending data to the server.The algorithm includes a pre-trained model, local models, client updates, and a global model output.
  • Federated framework: FedAvg aggregates local model weights at the parameter server to compute an enhanced global anomaly-detection model.The global model is sent back to clusters as a pre-trained model, including when a new cluster joins.
  • Federated framework: Algorithm 1 describes parameter-server initialization, client model updates, local epochs and batches, encrypted processing, and repeated FedAvg aggregation.The listed procedure includes homomorphic encryption and iterative server updates.

B. Anomaly Detection in blockchain-based IIoT network

The paper frames anomaly detection in blockchain-based smart factories as a privacy-sensitive threat-hunting problem involving local data, chain forks, and malicious transactions. Block Hunter addresses it by sharing trained model parameters across local models rather than sharing sensitive factory or blockchain data.

  • Smart factory data are kept locally because storing sensitive device and sensor data directly on the blockchain is costly.
  • Chain forks arise when devices or nodes disagree about the blockchain state during anomaly detection.
  • Block Hunter uses smart-factory data, previous fork features, and malicious-transaction information to train local anomaly-detection models.
  • The framework protects privacy by sharing trained model parameters instead of original smart-factory and blockchain data.
  • The threat model targets attacks in which a malicious entity can append to the blockchain system.

C. Network model and topology design

Block Hunter organizes smart factories and IIoT devices into clusters to improve network efficiency and support federated model training. Its topology uses distance-based grouping and cluster heads that coordinate device activities and blockchain-related duties.

  • The proposed cluster-based architecture is intended to improve resource use, throughput, bandwidth reduction, and hunting efficiency in blockchain-based IIoT networks.
  • Each cluster has a smart factory acting as Cluster Head, coordinating IIoT devices and potentially participating in blockchain mining.
  • Block Hunter represents the network as a directed graph whose nodes include smart factories and IIoT devices.
  • The distance function groups smart factories and devices according to centrality derived from shared neighboring devices.
  • Cluster formation collects factory and device locations, measures distances, and assigns nearest smart factories to each device.
  • The clustering procedure initializes cluster values and locations, iterates over clusters, computes distances, updates client distances, and merges neighbors before returning the clusters.
  • During initialization, a parameter server sends pretrained models to clusters, which train local models and aggregate them to update global parameters.

IV. METHODOLOGY

The methodology section examines multiple machine-learning techniques for identifying and detecting anomalies within the Block Hunter framework.

  • The methodology studies several machine-learning techniques for identifying and detecting anomalies in Block Hunter.

A. Neural Encoder-Decoder (NED) model

The neural encoder-decoder summarizes blockchain status and transaction information, then reconstructs the input to identify inconsistencies. Reconstruction differences indicate anomalous behavior.

  • The neural encoder-decoder summarizes blockchain status and transaction information before rebuilding the initial data.
  • When the current status is consistent, encoding and decoding preserve the data’s basic properties.
  • Anomalous values cause reconstruction failure, so differences between initial and reconstructed values highlight anomalies.

B. Isolation Forest

The section presents Isolation Forest as an unsupervised tree-based anomaly detector and describes cluster-based scoring through CBLOF.

  • Isolation Forest: Isolation Forest recursively and randomly partitions data to isolate anomalous points rather than generalizing normal behavior.It belongs to the tree-based anomaly-detection category and uses a tree structure to represent the recursive partitioning process.
  • Cluster-Based Local Outlier Factor: CBLOF assigns anomaly scores after observations are organized into clusters and Small Clusters are separated from Large Clusters.The method requires non-overlapping clusters whose union represents all observations in Dataset D.
  • Cluster-Based Local Outlier Factor: The CBLOF scores are calculated for each observation after identifying the boundary index between Small Clusters and Large Clusters.

D. Principal Component Analysis (PCA)

This section describes PCA-based anomaly detection, K-means clustering, and the experimental and federated setup used to evaluate Block Hunter.

  • Principal Component Analysis (PCA): PCA reduces dimensionality by constructing uncorrelated principal components as linear combinations of the original variables.The components are derived from the variance-covariance structure of dataset characteristics.
  • Principal Component Analysis (PCA): PCA detects anomalies by repeatedly removing observations with high Mahalanobis distance values.The distance uses the covariance matrix, an observation’s feature value, and the mean of all observations.
  • K-means: K-means divides data into k clusters by assigning each sample to the cluster with the closest mean value.Each cluster centroid is the mean of its observations.
  • Experimental Setup: The evaluation uses a Bitcoin Simulator with NS-3 and LENA on an Ubuntu 20.04 system equipped with an Intel i7-10700KF CPU and 16 GB DDR4 memory.
  • Federated Setup: The federated setup uses PySyft and PyTorch, with FedAvg configured for E = 4 local epochs and fraction c = 6e −3.PySyft provides VirtualWorkers for private and secure machine-learning model training.

B. Datasets

Block Hunter is evaluated with blockchain transaction datasets and two publicly available IIoT datasets representing smart-factory environments.

  • Datasets: The evaluation uses two blockchain-side datasets and two IIoT-related datasets for assessing Block Hunter in smart factories.The blockchain datasets provide conditions for blockchain adoption in smart manufacturing systems.
  • Blockchain Datasets: The Bitcoin Transaction Dataset contains roughly 30 million imbalanced transactions, creating a challenge for anomaly detection.It was designed for research on blockchain anomaly and fraud detection.
  • Blockchain Datasets: The Ethereum Classic dataset provides access to transactions and block history, including blocks, contracts, logs, tokens, traces, and transactions.
  • IIoT Datasets: The IIoT evaluation uses the publicly available Gas Pipeline and Secure Water Treatment datasets.Both datasets are described as well suited to IIoT environments.

C. Experimental Analysis

Block Hunter was evaluated with a cluster-based blockchain architecture and multiple anomaly-detection models across blockchain and IIoT datasets. The experiments assess resource use, throughput, anomaly-detection accuracy, ROC AUC, and anomaly hunting as transaction and cluster conditions vary.

  • Architecture evaluation: The cluster-based architecture was compared with a non-cluster model over 20 simulation runs to evaluate architecture performance.The evaluation focused on resource use and throughput during blockchain operation in smart-factory applications.
  • Architecture evaluation: Bandwidth consumption and throughput increased as block size rose from 0.5 MB to 8 MB, with Block Hunter showing higher performance.The reported advantage is attributed to network communication, topology management, and minimized delay.
  • Architecture evaluation: Increasing miners from 16 to 256 with a 1 MB block size increased model throughput.The passage links this increase to easier consensus and the cluster architecture handling more transactions per block.
  • Anomaly detection performance: NED and IF achieved the highest and nearly similar anomaly-detection accuracy in the reported comparisons.ROC curves were also reported for CBLOF, K-means, PCA, IF, and NED in the federated setting.
  • Anomaly detection performance: AUC values for CBLOF, K-means, PCA, IF, and NED were respectively (0.80, 0.84), (0.82, 0.85), (0.86, 0.89), (0.90, 0.93), and (0.95, 0.97) on BTD and ETC datasets.The global model parameters were frequently updated through FedAvg while the models ran in Block Hunter.
  • IIoT dataset evaluation: NED achieved the highest accuracy on the GP and SWaT IIoT datasets among the evaluated machine-learning models.The passage attributes this result to preserving data encoding and decoding.

VI. CONCLUSION & FUTURE WORKS

Block Hunter applies federated learning and a cluster-based architecture to anomaly hunting in blockchain-based IIoT smart factories, evaluating multiple machine-learning detectors and blockchain configuration factors.

  • Block Hunter hunts anomalies in blockchain-based IIoT smart factories through a federated learning approach.
  • Its cluster-based architecture is intended to reduce resource use and improve blockchain-network throughput during threat hunting.
  • The framework evaluates NED, IF, CBLOF, K-means, and PCA for anomaly detection.
  • The study examines how block-generation interval, block size, and miner selection affect Block Hunter’s performance.
  • Future work includes GAN-based block-hunter designs and IIoT blockchain networks using different consensus algorithms.
Loading 2204.09829v1…