Federated Deep Learning for Intrusion Detection in Internet of Things Networks Using Software-Defined Networking

The Intrusion Detection Systems (IDS), commonly known by their acronym, are the initial defense line against malicious incursions in the cybersecurity domain. Such systems utilize advanced analytical tools to identify and report abnormal behavior that exists in network traffic [1]. Recent progress in the field of Machine Learning (ML) and Deep Learning (DL) has significantly increased the effectiveness of the IDS, which makes it possible to implement them in an ever-growing range of application areas to respond to the emergence of threats. However, traditional ML-based and DL-based IDS systems are characterized by the reliance on centralized servers to accumulate and analyse network traffic. The main drawbacks of such a centralized paradigm are tougher data-privacy laws that limit central accumulation of raw information and the increasing amount of network traffic that overloads current infrastructure. As an alternative, Federated Learning (FL) [2] is a privacy-preserving, decentralized model that allows a localisation [4] of data and allows collaborative training of a model across distributed devices. The paradigm has been developed to deal with the above challenges, and when compared to centralized solutions, the benefits are realized in terms of protecting the privacy of users by eliminating raw data sharing and minimizing operational expenses due to the reduction of bandwidth usage and storage overheads [5].

The Internet of Things (IoT) is a multi-purpose network that connects a large number of resource-restricted devices. As a result, a massive amount of data is produced, which creates a new system of security vulnerabilities [6]. The traditional IDS is often inapplicable to the IoT setting because it has inherent hardware constraints in terms of its computational and memory capabilities. Additionally, the methods of the adversary are getting more advanced. Therefore, there is a dire need to come up with a thoroughly effective IDS that would be able to protect against a wide variety of IoT threats. In the past few years, researchers have discussed numerous ways of enhancing the security of IoT [7, 8]. These, however, have not been successful in overcoming the wide threat terrain, hence the need for a centralized architecture. Software-Defined Networking (SDN) provides a revolutionary response to the requirements of programmable network management and proactive threat detection by real-time traffic monitoring in large heterogeneous IoT networks. SDN gives unmatched flexibility by separating the control plane and the data plane. Its inherent properties make it particularly suitable to deploy IDS that are able to scale to defend large-scale Internet of Things deployments without compromising the low-latency and high-efficiency operation required by devices with limited resources [9].

In this work, a federated deep learning model has been developed for different clients with a global model within an SDN environment for an IoT system to detect different cyberattacks. The proposed system utilized the UNSW-NB15 dataset to assess the IDS system accuracy. Loss, precision, and recall metrics have been used to measure the training performance of the federated deep neural network system.

The rest of sections is organized as follows: in Section 2 a description of related work. Section 3 provides the theortical background used in this work, while section 4 demonstrates the proposed IDS design. Section 5 presents the results and their analysis. Finally, section 6 provides the paper's conclusion and shows some suggestions for future work.

Attacks are one of the things that need to be thought about because they can have a big effect on both the network's infrastructure and the people who use it. So, figuring out what kind of attacks are happening and what they are is very important for keeping the network safe and avoiding any problems or dangers that could make it less safe. So, the suggested model is mostly about using DL-based methods to find different types of assaults that can happen on the IoT network.

3.1 Intrusion Detection System

Intrusion detections are typically categorised into two types: signature detection and anomaly detection. The initial approach, known as "misuse intrusion detection," depends on established network patterns and is hence incapable of recognising novel attacks. Anomaly detection, frequently referred to as "behaviour-based IDS," involves constructing a model of typical or normal behaviour to autonomously recognise any departures from it [19]. The principal benefit of anomaly detection systems is their capacity to recognise unforeseen hazards. Nonetheless, they may detect novel or atypical non-intrusive network activity pertinent to a network administrator, which could potentially elevate the false alarm rate [20].

Table 2. Intrusion detection systems types comparative [22]

IDS are classified into two principal categories: Network-based IDS (NIDS) and Host-based IDS (HIDS). A Network Intrusion Detection System (NIDS) is implemented at key locations within the network infrastructure to scrutinise and assess traffic for harmful patterns or anomalies. Conversely, a HIDS functions on discrete endpoints to analyse system logs, file integrity, and process behaviour for indications of compromise. Although hybrid IDS architectures, which integrate NIDS and HIDS, have been developed to capitalise on the advantages of both methodologies, their implementation and validation in research are still constrained. Table 2 presents an examination of different types of IDSs [22].

3.2 Software-defined network

The software defiend network architecture consists of three layers that enable centralised, reprogrammable network management and dynamic traffic control. The SDN architecture consists of the following:

• Infrastructure layer: consists of SDN virtual switches, such as Open Virtual Switch (OVS) [23], that relay traffic to the control plane without examination.

• Control plane: consists of an SDN controller that control switches by establishing forwarding rules and maintaining an extensive network overview. Its essential functions include topology identification and dynamic flow configuration.

Application plane: accommodates network management applications that configure the SDN controller to implement dynamic rules, including firewalling and network address translation (NAT) across switches, therefore abstracting policy logic from the underlying infrastructure.

3.3 Federated learning

Figure 1 illustrates the FL training process. In this framework, several edge devices function as autonomous clients connected to a central server that has a global model. A set of clients who have indicated that they are prepared to take part in the training procedure forms the basis for the selection of the number of FL clients (D), which is then picked at random. At the moment t, every client that has been selected (d) downloads the global model weight parameters (θ_t) from the server. Then, using its own dataset to train the local model [24].

Figure 1. Traditional federated learning [24]

$\min f(\theta)$

$f(\theta)=\sum_{d=1}^D \frac{m_d}{M} F_{d(\theta)}$    (1)

$F_d(\theta)=\frac{1}{m_d} \sum_{i \in m_d} f^i(\theta)$

During the local training, every client strives to optimise the global model by reducing the value of its loss function $f^i(\theta)$, which is associated with the i_th sample in its dataset. For this, we use optimization methods like Adam or stochastic gradient descent (SGD). When the client's local training is finished, it sends the global server its updated model, which is represented as $\theta_{t+1}^d$.

$\theta_{i+1}^d=\theta_i-\alpha_d \lambda_d$    (2)

In this case, $\alpha_d$ stands for the learning rate and λ_d for the gradient that client d computes with its local dataset and the parameters $\theta_t$. The following is how the global server computes the upgraded global model θ_t+1 by combining the local models that have been collected.

$\theta_{i+1}=\sum_{d=1}^D \frac{m_d}{M} \theta_{i+1}^d$    (3)

Until the model converges, FL iteratively downloads the trained global model for the following rounds. Multiple users work together to train the global model, where the FedAvg aggregation method is used to obtain the global model weight parameters in each round. The centralized learning method, while maintaining the privacy of their raw data. Instead of sending the raw data to a central server, each client trains locally using its dataset and then provides just the changed model parameters. To compile all of these changes, the server takes an average of the model weights, where the weights are based on the size of the client's dataset. Improved privacy and security, less bandwidth utilization, and scalability across many clients are all benefits of this method. But it has problems with communication efficiency and data heterogeneity. The FedAvg formula is:

$w_{r+1}=\sum_{c=1}^c \frac{n_c}{n} w_{r+1}^c$    (4)

where $n_k$ is the overall number of samples collected by all clients in round r+1, and $w_{r+1}^c$ is the weight matrix of the local model that client c updated. As shown in Algorithm 1, which shows the global and local model update and the FedAvg aggregation method. The loss function η and a gradient $\nabla \mathrm{L}\left(w_r^c ; \mathrm{b}\right)$ are calculated according to the model's weights $w_t^k$ and input data b.

3.4 Dataset benchmark

In this work, two types of public datasets have been utilized to evaluate the proposed FL framework IDS, which are UNSW-NB15 and Bot-IoT. The nine attack types included in the UNSW-NB15 dataset, which aims to simulate modern network traffic, include fuzzers, worms, and reconnaissance, among others. For all-encompassing analysis, it combines basic, content-based, and time-based attributes with 40 features. Produced using the IXIA PerfectStorm program, it presents class imbalance scenarios that are both realistic and challenging. Researchers interested in network intrusion detection can use this dataset for both supervised and unsupervised learning. Modern intrusion detection systems rely on it for testing purposes. Here is the attack distribution for this dataset, as seen in Figure 2(a). The CSE-CIC-IDS2018, capturing 10 days of normal and malicious network traffic. Its features include attacks like DDoS, brute force, and web infiltration, with labeled network flows for anomaly detection. The dataset provides a wide range of features, including flow duration and protocol type, for developing intrusion detection models. It simulates realistic network environments with rich diversity. Researchers commonly use it for benchmarking flow-based IDS models. Figure 2(b) shows the attack distribution for this dataset.

Figures 4 and 5 show the training and validation curves; the comparison is based on the different behavior of the following datasets in the training of the DNN, the accuracy, loss, precision, and recall of the UNSW-NB15 and Bot-IoT datasets, respectively. The convergence rate of Bot -IoT is often rapid. Due to the extremely specialized nature of Bot-IoT on IoT-specific attacks, including those of DDoS and DoS, which have highly distinctive, repetitive characteristics, the DNN can acquire the ability to differentiate normal and malicious traffic extremely rapidly. Conversely, the convergence in UNSW-NB15 is normally more gradual. The dataset includes a larger range of weak fuzzing and backdoors that are more modern attacks, and which look more like regular traffic. The loss curve of UNSW-NB15, therefore, tends to oscillate initially and level off as compared to Bot-IoT.

Bot-IoT can then note that the difference between the training and validation accuracy is very low. This is due to the fact that the dataset is huge and its trends are very uniform. The specificity of the data, however, presents an opportunity that threatens that instead of learning generalized behavioral knowledge, the model is basically learning botnet signatures. UNSW-NB15, in turn, has a slightly broader gap between the training and validation metrics, showing that the model is more challenging to extrapolate the training information to the unseen validation information, as the categories of attacks are too complex and diverse.

Figure 4. UNSW-NB15 baseline model training performance

Figure 5. CSE-CIC-IDS2018 baseline model training performance

The loss curve of UNSW-NB15 can be seen to stay high longer; the jaggedness is caused by the difficulty that the model has in classes that are difficult to detect but underrepresented in the data, like Analysis or Worms. The loss curve of Bot-IoT is usually steeper and lower, illustrating the high separability of the classes; the DNN gives a definite mathematical distinction between a DDoS attack and an ordinary temperature sensor measurement. In spite of the fact that both of these datasets are used by network intrusion detection systems, Bot-IoT tends to give smoother curves with high accuracy due to the more aggressive and clear patterns of attacks. UNSW-NB15 is considered a more difficult real-world task, where the DNN must work harder in order to identify some hidden anomalies among normal background noise.

Figure 6 outlines the performance of a federated deep neural network trained on the UNSW-NB15 dataset and highlights an effective convergence of the global model in addition to the significant local variance between the involved clients, which is due to the non-IID characteristics of network intrusion data. The international paradigm shows a steep learning curve with the first ten rounds, and reaches the desired stability of an excellent accuracy of around 85% timer centered on the exemplary generalization as shown by the very similar training and evaluation statistics. However, a client-level analysis reveals a heterogeneous topography where some nodes, like Client 5, hit local stability early on, and others, like Client 2 and 4, experience local overfitting and increased volatility. Specifically, the trend in training loss observed to increase in Client 4 and the oscillations in Client 2 point to the effects that these nodes are facing complex and minority attack classes of fuzzers or backdoors, which are difficult to balance in the global weight paradigm. Finally, the fact that the global model is resilient despite these local anomalies shows that the federated aggregation process is an effective method of scaling out the noise in individual nodes, thus providing a generalized intrusion-detection signature.

Figure 6. UNSW-NB15 federated learning client model training performance

The results of the work, obtained by using a DNN on the Bot-IoT corpus as in Figure 7, show that the IDS has an impressive level of efficiency, and its learning curve reaches an almost perfect accuracy level of approximately 99.9% in the first few training epochs. The agreement between the training and validation accuracy curves indicates that the model extrapolates very well to unexamined network traffic, hence averting the fear of significant overfitting. In terms of the loss function, categorical cross- entropy decreases exponentially and plateaus at zero, indicating that the DNN has learnt the distinguishing patterns required to distinguish between benign and hostile IoT traffic, with high confidence, a range of hostile signatures such as DDoS, DoS, and reconnaissance attacks. In comparison between different clients, usually in a federated or distributed implementation, the performance is significantly stable; small fluctuations in validation loss can be explained by the sample bias of the Bot-IoT dataset, where the cases of the attack are overrepresented. Taken together, the ability of the DNN to reduce complex features of the network flows without grooming makes the framework a robust tool to protect the IoTs with limited resources against advanced botnet attacks.

Figure 7. CSE-CIC-IDS2018 federated learning client training performance