Deep learning (DL) methods have been widely applied to anomaly-based network intrusion detection system (NIDS) to detect malicious traffic. To expand the usage scenarios of DL-based methods, federated learning (FL) allows multiple users to train a global model on the basis of respecting individual data privacy. However, it has not yet been systematically evaluated how robust FL-based NIDSs are against existing privacy attacks under existing defenses. To address this issue, we propose two privacy evaluation metrics designed for FL-based NIDSs, including (1) privacy score that evaluates the similarity between the original and recovered traffic features using reconstruction attacks, and (2) evasion rate against NIDSs using adversarial attack with the recovered traffic. We conduct experiments to illustrate that existing defenses provide little protection and the corresponding adversarial traffic can even evade the SOTA NIDS Kitsune. To defend against such attacks and build a more robust FL-based NIDS, we further propose FedDef, a novel optimization-based input perturbation defense strategy with theoretical guarantee. It achieves both high utility by minimizing the gradient distance and strong privacy protection by maximizing the input distance. We experimentally evaluate four existing defenses on four datasets and show that our defense outperforms all the baselines in terms of privacy protection with up to 7 times higher privacy score, while maintaining model accuracy loss within 3% under optimal parameter combination.
University of Kalyani（卡利亚尼大学）；National Institute of Science, Education and Research Bhubaneswar（布巴内斯瓦尔国家科学教育与研究学院）；Homi Bhaba National Institute（霍米·巴巴国家学院）
The leakage of data might have been an extreme effect on the personal level if it contains sensitive information. Common prevention methods like encryption-decryption, endpoint protection, intrusion detection system are prone to leakage. Differential privacy comes to the rescue with a proper promise of protection against leakage, as it uses a randomized response technique at the time of collection of the data which promises strong privacy with better utility. Differential privacy allows one to access the forest of data by describing their pattern of groups without disclosing any individual tre…
Data Poisoning and Leakage Analysis in Federated Learning
Georgia Institute of Technology（佐治亚理工学院）；Fordham University（福特汉姆大学）；National Institute of Standards and Technology（美国国家标准与技术研究院）；Georgia Tech Research Institute（佐治亚理工研究院）
William & Mary（威廉与玛丽学院）；Old Dominion University（欧道明大学）
As the number of IoT devices has increased rapidly, IoT botnets have exploited the vulnerabilities of IoT devices. However, it is still challenging to detect the initial intrusion on IoT devices prior to massive attacks. Recent studies have utilized power side-channel information to identify this intrusion behavior on IoT devices but still lack accurate models in real-time for ubiquitous botnet detection. We proposed the first online intrusion detection system called DeepAuditor for IoT devices via power auditing. To develop the real-time system, we proposed a lightweight power auditing device…
Ubiquitous anomalies endanger the security of our system constantly. They may bring irreversible damages to the system and cause leakage of privacy. Thus, it is of vital importance to promptly detect these anomalies. Traditional supervised methods such as Decision Trees and Support Vector Machine (SVM) are used to classify normality and abnormality. However, in some case the abnormal status are largely rarer than normal status, which leads to decision bias of these methods. Generative adversarial network (GAN) has been proposed to handle the case. With its strong generative ability, it only ne…
Machine Learning-Based Intrusion Detection: Feature Selection versus Feature Extraction
MobiFone Research and Development Center, MobiFone Corporation（MobiFone公司MobiFone研发中心）；Hanoi University of Science and Technology（河内科技大学）；Phenikaa University（菲尼卡大学）
ProPILE: Probing Privacy Leakage in Large Language Models
NAVER AI Lab（NAVER人工智能实验室）；University of Luxembourg（卢森堡大学）；Parameter Lab（帕拉米特实验室）；Seoul National University（首尔国立大学）；University of Tübingen（图宾根大学）；Tübingen AI Center（图宾根人工智能中心）
Passive Hybrid Network-Based Intrusion Detection System (Hybrid-NIDS) Combining Suricata and Random Forest
Ho Chi Minh City College of Transport（胡志明市交通学院）；Academy of Cryptography Techniques, Ho Chi Minh City Campus（密码技术学院胡志明市校区）；Faculty of Computer Science and Engineering, Ho Chi Minh City University of Technology (HCMUT)（胡志明市理工大学计算机科学与工程系）；Vietnam National University Ho Chi Minh City（越南国家大学胡志明市分校）
Multi-Level Distributional Entropy from Flow Summary Statistics for Explainable Network Intrusion Detection
Centre for Intelligent Cloud Computing, CoE for Advanced Cloud, Faculty of Information Science and Technology, Multimedia University（智能云计算中心、先进云技术中心、信息科学与技术学院、多媒体大学）；Department of Communication Technology and Networking, Faculty of Computer Science and Information Technology, Universiti Putra Malaysia（通信技术与网络系、计算机科学与信息技术学院、马来西亚国立大学）；Laboratory of Computational Science and Mathematical Physics, Institute for Mathematical Research, Universiti Putra Malaysia（计算科学与数学物理实验室、数学研究所、马来西亚国立大学）
PenTiDef: Decentralized Federated Intrusion Detection System with Differential Privacy and Latent-Space Defense via Blockchain Coordination in IIoT
Information Security Lab（信息安全部实验室）；University of Information Technology（信息技术大学）；Vietnam National University（越南国家大学）；VNU-HCM Information Security Center（VNU-HCM信息安全部中心）
Smartphones with the platforms of applications are gaining extensive attention and popularity. The enormous use of different applications has paved the way to numerous security threats. The threats are in the form of attacks such as permission control attacks, phishing attacks, spyware attacks, botnets, malware attacks, privacy leakage attacks. Moreover, other vulnerabilities include invalid authorization of apps, compromise on the confidentiality of data, invalid access control. In this paper, an application-based attack modeling and attack detection is proposed. Due to A novel attack vulnera…
Decentralized Federated Anomaly Detection in Smart Grids: A P2P Gossip Approach
Centre for Cyber Resilience and Trust (CREST), Deakin University（网络弹性与信任中心（CREST），迪肯大学）；Department of Computer Science & IT, Latrobe University（计算机科学与信息技术系，拉筹伯大学）
A Survey on Intelligent Internet of Things: Applications, Security, Privacy, and Future Directions
University of Luxembourg（卢森堡大学）；Nantes University（南特大学）；École Centrale Nantes（南特中央理工学院）；Politecnico di Torino（都灵理工大学）；University of Ulsan（蔚山大学）；University of Alabama in Huntsville（阿拉巴马大学亨茨维尔分校）；Trinity College Dublin, The University of Dublin（都柏林大学圣三一学院）
