Federated learning framework for IoT intrusion detection using tab transformer and nature-inspired hyperparameter optimization.

The Internet of Things has completely changed the way we interact with our surroundings. The upsurge in the use of IoT devices has helped us to do and monitor our day-to-day tasks with ease. With the increasing use of IoTs, there also comes their own set of security issues that need to be considered. IoT devices generate vast amounts of data, most of which can be shared or connected to social networking sites or online platforms. Due to malicious activity or attacks in the network, the data can be manipulated. Digital deception poses a significant threat in the era of AI-driven social networks, enabling the spread of misinformation and cyber intrusions at an unprecedented scale. Here comes the role of the intrusion detection system, which helps us to detect and prevent security breaches in IoT. In recent years, it has become a critical issue to secure IoT systems as they are more prone to be hacked. So, it has become very important to develop and optimize our traditional intrusion detection systems. Previously used intrusion detection systems suffered from several limitations, such as centralized data storage, privacy, and security concerns. They require a significant amount of processed data to work effectively according to our criteria. This can be challenging to us in case of very few historical attacks that are not enough to train our systems. To overcome these issues, federated learning-based IDS for IoT systems has been proposed. Federated Learning is a machine learning technique that provides a system that can collaboratively learn a model without sharing its data. In federated learning, the machine learning model is trained on the device itself, and only the updates are pushed to the central server for improvement of the central model. It helps us preserve the privacy of the device and, at the same time, enables us to build and train the central model server that can detect any intrusion attacks. This can also reduce the computational cost of machine training by distributing the work across several devices. Federated learning models can adapt to the changes in the environment as they are designed to continuously learn from the recently generated data from servers and devices in the network. This way, the model can progress over time to better detect the changes in the network traffic.

With the rapid growth of the number of connected devices on the internet, a significant increase in internet and network applications in the last decade led to the appearance of function-based networks called the Internet of Things (IoT). Such interest and dependency come with exponentially increasing security threats. Those threats are very dynamic, and change continuously despite the fact that IoT devices may not go through the same speed for security fixes, updates, etc. As a result, research trends focus on utilizing data analytics to build intelligence and autonomous mechanisms to enable IoT systems to respond to threats in real time. To this end, our project goal is to evaluate methods to build fast and efficient intrusion detection systems (IDS) that meet the high scalability and dynamicity of IoT environments.In this research, we studied three different datasets used to represent IoT network traffic and used them as a benchmark to evaluate many IDSs’ performances. Results showed that features’ quality has an impact on classification models and thus IDS performance. Our results showed also that the optimum time-window of an IDS preferred to be long (decay factor 0.01 or 0.1) when evaluating the BotNet_IoT dataset.

Internet of Things (IoT) security dataset evolution: Challenges and future directions

The security of the Industrial Internet of Things (IIoT) is of vital importance, and the Network Intrusion Detection System (NIDS) plays an indispensable role in this. Although there is an increasing number of studies on the use of deep learning technology to achieve network intrusion detection, the limited local data of the device may lead to poor model performance because deep learning requires large-scale datasets for training. Some solutions propose to centralize the local datasets of devices for deep learning training, but this may involve user privacy issues. To address these challenges, this study proposes a novel federated learning (FL)-based approach aimed at improving the accuracy of network intrusion detection while ensuring data privacy protection. This research combines convolutional neural networks with attention mechanisms to develop a new deep learning intrusion detection model specifically designed for the IIoT. Additionally, variational autoencoders are incorporated to enhance data privacy protection. Furthermore, an FL framework enables multiple IIoT clients to jointly train a shared intrusion detection model without sharing their raw data. This strategy significantly improves the model's detection capability while effectively addressing data privacy and security issues. To validate the effectiveness of the proposed method, a series of experiments were conducted on a real-world Internet of Things (IoT) network intrusion dataset. The experimental results demonstrate that our model and FL approach significantly improve key performance metrics such as detection accuracy, precision, and false-positive rate (FPR) compared to traditional local training methods and existing models.

The Industrial Internet of Things (IIoT) offers the manufacturing sector opportunities for transformation and upgrade but also carries significant security risks. Traditional federated learning (FL) as a potential security solution is challenging in complicated application environments with heterogeneous data, imbalanced data, and poisoning attacks. To address these challenges, we construct a clustered FL Framework for IIoT intrusion detection (CFL-IDS) based on local models’ evaluation metrics (EMs). First, we designed an intrusion detection model with a dynamic focal loss (DFL) for all edge nodes (ENs). This model’s performance is enhanced under various imbalanced data partitions by dynamically altering the focus on samples during the loss minimization training process. Second, the time series of EMs of local models to reflect the data distribution of ENs implicitly, and use clustering algorithms to facilitate knowledge sharing among those ENs with similar data distribution to co-optimize a common model for them. Finally, an intelligent cooperative model aggregation mechanism (ICMAM) adaptively adjusts each local model’s weight distribution, which substantially improves the benefits of FL and alleviates subpar models’ alleviates interference from subpar models to FL. Experiments demonstrate that CFL-IDS has stronger robustness and displays superior performance under data imbalance and non-independent and identically distributed (non-IID) situations while being effective against poisoning attacks.

<span lang="EN-US">With the proliferation of internet of things (IoT) devices, ensuring the security of these interconnected systems has become a critical concern. Cyberattacks targeting IoT devices pose significant threats to individuals and organizations due to the generation of vast amounts of data across many connected devices, which traditional centralized methods cannot solve. Federated learning (FL) could be a promising solution to mitigate privacy concerns associated with centralized approaches and address cybersecurity concerns. This paper uses FL and deep learning (DL) approaches to cybersecurity in IoT applications. The goal of cyber security is achieved by forming a federation of acquired and shared models at the head of the various participants. We use inception time and multi-head attention (CNN) algorithm based on FL to detect cyber-attacks and avoid data privacy leaks under two distribution modes, namely IID and Non-IID. In contrast, the FedAvg and FedMA algorithms aggregate local model updates. A global model is produced after several communication rounds between the IoT devices and the model parameter server. Cyber threats are simulated using edge-IIoT datasets. Experiment results show that the federated inception model's best global accuracy was 93, 91%, and 93, 49% using multi-head attention.</span>

This research introduces a comprehensive collaborative intrusion detection system (CIDS) framework aimed at bolstering the security of Internet of Things (IoT) environments by synergistically integrating lightweight architecture, trust management, and privacy-preserving mechanisms. The proposed hierarchical architecture spans edge, fog, and cloud layers, ensuring efficient and scalable collaborative intrusion detection. Trustworthiness is established through the incorporation of distributed ledger technology (DLT), leveraging blockchain frameworks to enhance the reliability and transparency of communication among IoT devices. Furthermore, the research adopts federated learning (FL) techniques to address privacy concerns, allowing devices to collaboratively learn from decentralized data sources while preserving individual data privacy. Validation of the proposed approach is conducted using the CICIoT2023 dataset, demonstrating its effectiveness in enhancing the security posture of IoT ecosystems. This research contributes to the advancement of secure and resilient IoT infrastructures, addressing the imperative need for lightweight, trust-managing, and privacy-preserving solutions in the face of evolving cybersecurity challenges. According to our experiments, the proposed model achieved an average accuracy of 97.65%, precision of 97.65%, recall of 100%, and F1-score of 98.81% when detecting various attacks on IoT systems with heterogeneous devices and networks. The system is a lightweight system when compared with traditional intrusion detection that uses centralized learning in terms of network latency and memory consumption. The proposed system shows trust and can keep private data in an IoT environment.

The market for Electric Vehicles (EVs) has expanded tremendously as seen in the recent Conference of the Parties 27 (COP27) held at Sharm El Sheikh, Egypt in November 2022. This needs the creation of an ecosystem that is user-friendly and secure. Internet-connected Electric Vehicle Charging Stations (EVCSs) provide a rich user experience and add-on services. Eventually, the EVCSs are connected to a management system, which is the Electric Vehicle Charging Station Management System (EVCSMS). Attacking the EVCS ecosystem remotely via cyberattacks is rising at the same rate as physical attacks and vandalism happening on the physical EVCSs. The cyberattack is more severe than the physical attack as it may affect thousands of EVCSs at the same time. Intrusion Detection is vital in defending against diverse types of attacks and unauthorized activities. Fundamentally, the Intrusion Detection System’s (IDS) problem is a classification problem. The IDS tries to determine if each traffic stream is legitimate or malicious, that is, binary classification. Furthermore, the IDS can identify the type of malicious traffic, which is called multiclass classification. In this paper, we address IoT security issues in EVCS by using different machine learning techniques and using the native IoT dataset to discover fraudulent traffic in EVCSs, which has not been performed in any previous research. We also compare different machine learning classifier algorithms for detecting Distributed Denial of Service (DDoS) attacks in the EVCS network environment. A typical Internet of Things (IoT) dataset obtained from actual IoT traffic is used in the paper. We compare classification algorithms that are placed in line with the traffic and contain DDoS attacks targeting the EVCS network. The results obtained from this research improve the stability of the EVCS system and significantly reduce the number of cyberattacks that could disrupt the daily life activities associated with the EVCS ecosystem.

The inherent complexity and heterogeneity of the Internet of Things (IoT) ecosystem present significant challenges for developing effective intrusion detection systems. While graph deep-learning-based methods have shown promise in cybersecurity applications, existing approaches primarily construct graphs based on physical network connections, which may not effectively capture node representations. This paper proposes a Top-K Similarity Graph Framework (TKSGF) for IoT network intrusion detection. Instead of relying on physical links, the TKSGF constructs graphs based on Top-K attribute similarity, ensuring a more meaningful representation of node relationships. We employ GraphSAGE as the Graph Neural Network (GNN) model to effectively capture node representations while maintaining scalability. Furthermore, we conducted extensive experiments to analyze the impact of graph directionality (directed vs. undirected), different K values, and various GNN architectures and configurations on detection performance. Evaluations on binary and multi-class classification tasks using the NF-ToN IoT and NF-BoT IoT datasets from the Machine-Learning-Based Network Intrusion Detection System (NIDS) benchmark demonstrated that our proposed framework consistently outperformed traditional machine learning methods and existing graph-based approaches, achieving superior classification accuracy and robustness.

As Smart City (SC) infrastructures evolve rapidly, securing critical systems like smart water management (SWM) becomes paramount to protecting against cyber threats. Enhancing the security, sustainability and execution of conventional schemes is considered significant in developing smart environments. Intrusion detection systems (IDS) can be effectively leveraged to realise this security objective in an Internet of Things (IoT)‐based smart environment. This research addresses this need by proposing a novel IDS model called TabNet architecture optimised using Sailfish Optimisation (SFO). The TabNet‐SFO model was specifically developed for SWM in SC applications. The proposed IDS model includes data collection, preprocessing, feature selection and classification processes. For training the model, this research used the CIC‐DDoS‐2019 dataset, and for evaluation, real‐time data collected using an IoT‐based smart water metre are used. The preprocessing step eliminates unnecessary features, cleans the data, encodes labels and normalises the applied datasets. After preprocessing, the TabNet model selects significant features in the dataset. The TabNet architecture was optimised using the SFO algorithm, which allows hyperparameter tuning and model optimisation. The proposed model demonstrated improved detection accuracy and efficiency on both the simulated and real‐time datasets. The model attained a 98.90% accuracy, a 98.85% recall, a 98.80% precision, a 98.82% specificity and a 98.78% f1 score on the CIC‐DDoS dataset and a 99.21% accuracy, a 99.02% recall, a 99.05% precision, a 99.10% specificity and a 99.18% f1 score on real‐time data. Compared to existing models, the TabNet‐SFO model outperformed all existing models in terms of performance metrics and validated its efficiency in detecting attacks.

The proliferating popularity of Internet of Things (IoT) devices has led to wide‐scale networked system implementations across multiple disciplines, including transportation, medicine, smart homes, and many others. This unprecedented level of interconnectivity has introduced new security vulnerabilities and threats. Ensuring security in these IoT settings is crucial for protecting against malicious activities and safeguarding data. Real‐time identification and response to potential intrusions and attacks are essential, and intrusion detection systems (IDS) are pivotal in this process. However, the dynamic and diverse nature of the IoT environment presents significant challenges to existing IDS solutions, which are often based on rule‐based or statistical approaches. Deep learning, a subset of artificial intelligence, has shown great potential to enhance IDS in IoT. Deep learning models can identify complex patterns and characteristics by utilizing artificial neural networks, automatically building hierarchical representations from data. This capability results in more precise and efficient intrusion detection in IoT‐based systems. The primary aim of this survey is to present an extensive overview of the current research on deep learning and IDS in the IoT domain. By examining existing literature, discussing mainstream datasets, and highlighting current challenges and potential prospects, this survey provides valuable insights into the prevailing scenario and future directions for using deep learning in IDS for IoT. The findings from this research aim to enhance intrusion detection techniques in IoT environments and promote the development of more effective antimalware solutions against cyber threats targeting IoT device systems.

The Internet of Things (IoT) represents a paradigm shift in which the Internet is connected to real objects in a range of areas, including home automation, industrial processes, human health, and environmental monitoring. The global market for IoT devices is booming, and it is estimated that there will be 50 billion connected devices by the end of 2025. This explosion of IoT devices, which can be expanded more easily than desktop PCs, has led to an increase in cyber-attacks involving IoT devices. To address this issue, it is necessary to create novel approaches for identifying attacks launched by hacked IoT devices. Due to the possibility that these attacks would succeed, Intrusion Detection Systems (IDS) are required. IDS' feature selection stage is widely regarded as the most essential stage. This stage is extremely time-consuming and labor-intensive. However, numerous machine learning (ML) algorithms have been proposed to enhance this stage to boost an IDS's performance. These approaches, however, did not produce desirable results in terms of accuracy and detection rate (DR). In this paper, we propose a novel hybrid Autoencoder and Modified Particle Swarm Optimization (HAEMPSO) for feature selection and deep neural network (DNN) for classification. The PSO with modification of inertia weight was utilized to optimize the parameters of DNN. The experimental analysis was performed on two realistic UNSW-NB15 and BoT-IoT datasets that are suitable for IoT environment. The findings obtained by analyzing the proposed HAEMPSO against the Generic attack in the UNSW-NB15 dataset gave an accuracy of 98.8%, and a DR of 99.9%. While the benign class revealed an accuracy of 99.9% and DR of 99.7%. In the BoT-IoT dataset, the DDoS HTTP attack revealed an accuracy of 99.22% and DR of 97.79%. While the benign class gave an accuracy of 97.54% and DR of 97.92%. In comparison with the state-of-the-art machine learning schemes, our proposed HAEMPSO-DNN achieved a competitive feat in terms of DR and accuracy.

Recently, the Internet of Things (IoT) has been used in various applications such as manufacturing, transportation, agriculture, and healthcare that can enhance efficiency and productivity via an intelligent management console remotely. With the increased use of Industrial IoT (IIoT) applications, the risk of brutal cyber-attacks also increased. This leads researchers worldwide to work on developing effective Intrusion Detection Systems (IDS) for IoT infrastructure against any malicious activities. Therefore, this paper provides effective IDS to detect and classify unpredicted and unpredictable severe attacks in contradiction to the IoT infrastructure. A comprehensive evaluation examined on a new available benchmark TON_IoT dataset is introduced. The data-driven IoT/IIoT dataset incorporates a label feature indicating classes of normal and attack-targeting IoT/IIoT applications. Correspondingly, this data involves IoT/IIoT services-based telemetry data that involves operating systems logs and IoT-based traffic networks collected from a realistic medium-scale IoT network. This is to classify and recognize the intrusion activity and provide the intrusion detection objectives in IoT environments in an efficient fashion. Therefore, several machine learning algorithms such as Logistic Regression (LR), Linear Discriminant Analysis (LDA), K-Nearest Neighbors (KNN), Gaussian Naive Bayes (NB), Classification and Regression Tree (CART), Random Forest (RF), and AdaBoost (AB) are used for the detection intent on thirteen different intrusion datasets. Several performance metrics like accuracy, precision, recall, and F1-score are used to estimate the proposed framework. The experimental results show that the CART surpasses the other algorithms with the highest accuracy values like 0.97, 1.00, 0.99, 0.99, 1.00, 1.00, and 1.00 for effectively detecting the intrusion activities on the IoT/IIoT infrastructure on most of the employed datasets. In addition, the proposed work accomplishes high performance compared to other recent related works in terms of different security and detection evaluation parameters.

The swift advancement of the Internet of Things (IoT) has significantly transformed contemporary communication frameworks by facilitating effortless data transmission among a diverse network of interconnected smart devices. Nevertheless, the increased connectivity and resource-constrained nature of IoT nodes have made them prime targets for cyber-attacks, necessitating the development of intelligent and privacy-aware Intrusion Detection Systems (IDS). Traditional IDS approaches often fall short in addressing the dual challenges of real-time threat detection and preserving user data confidentiality. This research represents a Privacy-Preserving Model for Efficient Designing of IDS in IoT Environments by integrating a deep learning-driven detection framework with advanced optimization techniques. The core detection engine is built upon a Gated Recurrent Unit (GRU) network, chosen for its lightweight structure and strong temporal pattern recognition capabilities. To enhance model performance, hyperparameters are tuned using the novel Ladybug Beetle Optimization (LBO) algorithm, which mimics the intelligent foraging behaviour of ladybugs to achieve global optima efficiently. To ensure data privacy and reduce communication overhead, the model is integrated with federated learning, allowing distributed training across IoT devices without centralized data aggregation. Additionally, lightweight encryption techniques are employed to secure data transmission during training and inference phases. The proposed system was evaluated using standard benchmark datasets, achieving a detection accuracy of 98.9%, and the results demonstrate significant improvements in recall, precision and computational efficiency when examined to traditional approaches. This work contributes a scalable, intelligent, and privacy-respecting intrusion detection architecture suitable for real-world IoT scenarios, comprising smart homes, healthcare systems, and industrial automation.

Internet of Things (IoT) has been thriving in recent years, playing an important role in a multitude of various domains, including industry 4.0, smart transportation, home automation, and healthcare. As a result, a massive number of IoT devices are deployed to collect data from our surrounding environment and transfer these data to other systems over the Internet. This may lead to cybersecurity threats, such as denial of service attacks, brute‐force attacks, and unauthorized accesses. Unfortunately, many IoT devices lack solid security mechanisms and hardware security supports because of their limitations in computational capability. In addition, the heterogeneity of devices in IoT networks causes nontrivial challenges in detecting security threats. In this article, we present a collaborative intrusion detection system (IDS), namely, MidSiot, deployed at both Internet gateways and IoT local gateways. Our proposed IDS consists of three stages: (1) classifying the type of each IoT device in the IoT network; (2) differentiating between benign and malicious network traffic; and (3) identifying the type of attacks targeting IoT devices. The last two stages are handled by the Internet gateways, whereas the first stage is on the local gateway to leverage the computational resources from edge devices. The evaluation results on three popular IDS datasets (IoTID20, CIC‐IDS‐2017, and BOT‐IoT) indicate our proposal could detect seven common cyberattacks targeting IoT devices with an average accuracy of 99.68% and outperforms state‐of‐the‐art IDSs. This demonstrates that MidSiot could be an effective and practical IDS to protect IoT networks.