Ohtani Takahiro, Yamamoto Ryo, Ohzahata Satoshi
Graduate School of Informatics and Engineering, The University of Electro-Communications, Chofu 182-8585, Japan.
Sensors (Basel). 2024 May 18;24(10):3218. doi: 10.3390/s24103218.
The recent rapid growth in Internet of Things (IoT) technologies is enriching our daily lives but significant information security risks in IoT fields have become apparent. In fact, there have been large-scale botnet attacks that exploit undiscovered vulnerabilities, known as zero-day attacks. Several intrusion detection methods based on network traffic monitoring have been proposed to address this issue. These methods employ federated learning to share learned attack information among multiple IoT networks, aiming to improve collective detection capabilities against attacks including zero-day attacks. Although their ability to detect zero-day attacks with high precision has been confirmed, challenges such as autonomous labeling of attacks from traffic information and attack information sharing between different device types still remain. To resolve the issues, this paper proposes IDAC, a novel intrusion detection method with autonomous attack candidate labeling and federated learning-based attack candidate sharing. The labeling of attack candidates in IDAC is executed using information autonomously extracted from traffic information, and the labeling can also be applied to zero-day attacks. The federated learning-based attack candidate sharing enables candidate aggregation from multiple networks, and it executes attack determination based on the aggregated similar candidates. Performance evaluations demonstrated that IDS with IDAC within networks based on attack candidates is feasible and achieved comparable detection performance against multiple attacks including zero-day attacks compared to the existing methods while suppressing false positives in the extraction of attack candidates. In addition, the sharing of autonomously extracted attack candidates from multiple networks improves both detection performance and the required time for attack detection.
物联网（IoT）技术最近的快速发展丰富了我们的日常生活，但物联网领域重大的信息安全风险已变得显而易见。事实上，已经出现了利用未发现漏洞的大规模僵尸网络攻击，即所谓的零日攻击。为解决这一问题，人们提出了几种基于网络流量监测的入侵检测方法。这些方法采用联邦学习在多个物联网网络之间共享所学的攻击信息，旨在提高对包括零日攻击在内的攻击的集体检测能力。尽管它们高精度检测零日攻击的能力已得到证实，但仍存在诸如根据流量信息自动标记攻击以及不同设备类型之间共享攻击信息等挑战。为解决这些问题，本文提出了IDAC，一种具有自动攻击候选标记和基于联邦学习的攻击候选共享的新型入侵检测方法。IDAC中攻击候选的标记使用从流量信息中自动提取的信息来执行，并且该标记也可应用于零日攻击。基于联邦学习的攻击候选共享实现了来自多个网络的候选聚合，并基于聚合的相似候选执行攻击判定。性能评估表明，基于攻击候选在网络内使用IDAC的入侵检测系统是可行的，与现有方法相比，在针对包括零日攻击在内的多种攻击时实现了可比的检测性能，同时抑制了攻击候选提取中的误报。此外，从多个网络共享自动提取的攻击候选提高了检测性能以及攻击检测所需的时间。
