Addressing Cybersecurity Challenges with Federated Learning

In today's technology-driven world, smart devices and systems such as the Internet of Things (IoT) and Artificial Intelligence (AI) are transforming how we interact with technology. However, with these advancements come new risks and challenges, particularly in the area of cybersecurity. Attackers have become more sophisticated, launching coordinated multi-step attacks on various systems. Traditional Intrusion Detection Systems (IDS) often rely on set rules to identify threats, but newer methods using Machine Learning (ML) and Deep Learning (DL) are showing more promise.

Unfortunately, building effective models can be tricky due to issues such as data availability and privacy concerns. Federated Learning (FL) is a growing approach that allows devices to work together to improve models while keeping their data safe. Instead of sending raw data to a central system, devices send their model updates based on local data, minimizing privacy risks. However, challenges arise when the data across devices is not the same, leading to what is called Data Heterogeneity. This paper introduces a method called Statistical Averaging (StatAvg) to help address this issue in FL for IDS.

#The Need for Effective Intrusion Detection

With the rise of smart technologies, the avenues for attacks against systems have increased. Cyber attackers can now exploit weaknesses in multiple systems simultaneously. Famous examples include the Ukraine Electric Power Attack and Operation Dream Job, where attackers executed well-planned strikes. Even though AI has the potential to bolster defenses, it can also be used to create more advanced threats.

Cybersecurity needs reliable intrusion detection mechanisms more than ever. Traditional IDS methods use known attack patterns, called signatures, to identify threats. This method can miss new or unknown attacks. Recently, ML and DL models have gained attention for their ability to learn from data and detect attacks without relying solely on predefined patterns. However, ML and DL methods require sufficient data for training, which can be hard to obtain, especially for sensitive systems.

#Limitations of Centralized Learning

Traditional ML/DL models require a central system to collect data from various endpoints to build a single training dataset. While this can lead to accurate models, it raises privacy concerns since sensitive information is shared with third parties. To alleviate these issues, Federated Learning (FL) has emerged.

#What is Federated Learning?

Federated Learning is a decentralized method that enables devices to work together to build better ML models without sharing their raw data. Instead of sending data to a central server, devices send their model updates. The server then aggregates these updates to create a global model. The process repeats until the model is effective. This approach keeps the data secure and reduces communication overhead.

#The Challenge of Data Heterogeneity

While FL has its advantages, it also faces challenges related to data heterogeneity. In many real-world scenarios, the data among devices is not the same, which can affect the performance of the global model. If one device has a different set of data than another, the aggregated model may not perform well across all scenarios. This issue is known as non-independently and identically distributed (non-iid) data, which can greatly influence the effectiveness of FL-based IDS.

#Introducing Statistical Averaging (StatAvg)

To address the challenges posed by non-iid data, we propose a method called Statistical Averaging (StatAvg). This approach allows devices to calculate and share summary statistics, like means and variances, rather than their full datasets. By collecting and aggregating these statistics, we produce global statistics that can be shared with all clients. This method provides a consistent way to normalize local data, helping improve the overall performance of the FL model.

#How StatAvg Works

StatAvg focuses on producing global statistics from local client statistics during the early stages of the FL process. Each client computes its local statistics and sends them to the server. The server aggregates these local statistics to create global statistics and shares them back to the clients. The clients then normalize their data using these global statistics, forming a common baseline for training.

With StatAvg, each client can adapt to global statistics without needing access to raw data from other clients. This method can be used alongside any FL aggregation method, making it versatile. The overall goal is to ensure that the model performs well across different scenarios, even when data varies among clients.

#Performance Evaluation of StatAvg

To test the effectiveness of StatAvg, we conducted experiments on well-known public datasets for intrusion detection. We compared StatAvg against traditional approaches like FedAvg, FedLN, and FedBN.

#Evaluation Datasets

1. TON-IoT Dataset: This dataset consists of data related to various operating systems. It includes records of memory activities, making it suitable for training IDS focused on host systems.

2. CIC-IoT-2023 Dataset: This dataset features realistic data from multiple IoT devices created for intrusion detection. It categorizes attacks into different classes based on patterns detected in the data.

#Results of the Experiments

We used standard metrics like accuracy, F1 score, and confusion matrices to evaluate each method. The results showed that StatAvg significantly outperformed the baseline methods.

• TON-IoT Dataset Results: StatAvg showed an improvement of over 19% in accuracy and 21% in F1 score compared to the second-best method, FedLN.

• CIC-IoT-2023 Dataset Results: StatAvg led to over 4% in accuracy and 2% in F1 score improvement compared to FedLN.

Graphs depicting the accuracy of different methods over the rounds demonstrate StatAvg's steadiness in performance, even when compared to baseline strategies that showed higher variability.

#Understanding Non-iid Features

Non-iid features in a dataset can complicate the performance of FL models. When we examined the datasets in more detail, we found differences in distributions among clients. For example, a specific attack type may not have the same characteristics across all clients, leading to challenges in building a unified model that works effectively in every scenario.

#Examples of Non-iid Features

In one example, we looked at the "Flow Duration" feature in the CIC-IoT-2023 dataset. Even when clients have similar amounts of data, the distribution for certain features can vary widely. Another example illustrates how a specific feature had consistent means and variances across clients, whereas others showed high discrepancies. These inconsistencies can complicate the normalization processes and affect the model’s training.

#Conclusion

The introduction of the StatAvg method aims to mitigate the challenges brought by non-iid data in FL settings, particularly for intrusion detection systems. By creating global statistics from local data statistics, we enable a universal normalization process that can significantly enhance the performance of FL models. The results from our experiments validate the effectiveness of StatAvg in providing more robust results compared to traditional methods.

As this method is implemented before the main FL process, it can be paired with various aggregation strategies, allowing for further exploration and application in other areas. Overall, the need for reliable intrusion detection mechanisms is more critical now than ever, and methods like StatAvg represent promising solutions to help address these evolving challenges in cybersecurity.

In summary, as attackers continue to develop more sophisticated strategies, the importance of innovative detection methods, such as those developed through federated learning and statistical averaging, will be vital in protecting systems and data in an increasingly connected world.