IoT Malicious Traffic Detection Based on Federated Learning

Nowadays, a large number of IoT devices are manufactured and used in daily life. However, the lack of uniform protocols and standards for IoT devices brings many security risks. Malicious attacks on IoT devices such as Mirai are on the rise, leading to more IoT devices joining botnets and launching DDoS attacks. Therefore, it is necessary to detect malicious traffic of IoT devices. To solve this problem, we propose FLIMT, a federated learning based malicious traffic detection framework for IoT devices. We motivated by the fact that it is not practical to centralize and detect the traffic data sent by IoT devices. Besides, considering the data security and confidentiality standards, it is improper to aggregate data from individual IoT devices into a central computing cluster. FLIMT consists of several GRU-based local detection clients and a central server, where local clients rely on local data for model training and testing, and the central server for model aggregation. The experimental results show that FlIMT achieves high detection accuracy on real data collected from IoT devices, and significantly lessens communication rounds.