Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT

Takayuki Nishio; Masataka Nakahara; Norihiro Okui; Ayumu Kubota; Yasuaki Kobayashi; Keizo Sugiyama; Ryoichi Shinkuma

doi:10.1109/GLOBECOM48099.2022.10000633

Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT

Takayuki Nishio, Masataka Nakahara, Norihiro Okui, Ayumu Kubota, Yasuaki Kobayashi, Keizo Sugiyama, Ryoichi Shinkuma

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Abstract

To mitigate cyberattacks, detecting anomalies in network traffic is of key importance. In this paper, we propose a model training method for detection of Internet of Things (IoT) anomalous traffic that is robust against the contamination of anomalous samples in the training set. The key idea is to focus on the nature of IoT malware infections (i.e., only a limited number of IoT networks contain infected devices) and employ federated learning (FL) to mitigate the impact of anomalous samples on model training. The simulation evaluation using IoT traffic data obtained from residences and malware traffic data collected from sandbox experiments demonstrates that the proposed method does not cause accuracy degradation even when the anomalous samples are contaminated, in contrast with the detection accuracy of baseline methods, which does degrade.

Original language	English
Title of host publication	2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	299-304
Number of pages	6
ISBN (Electronic)	9781665435406
DOIs	https://doi.org/10.1109/GLOBECOM48099.2022.10000633
Publication status	Published - 2022
Event	2022 IEEE Global Communications Conference, GLOBECOM 2022 - Virtual, Online, Brazil Duration: 2022 Dec 4 → 2022 Dec 8

Publication series

Name	2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings

Conference

Conference	2022 IEEE Global Communications Conference, GLOBECOM 2022
Country/Territory	Brazil
City	Virtual, Online
Period	22/12/4 → 22/12/8

Keywords

Anomaly Detection
Federated Learning
IoT
Malware Detection
Traffic Monitoring

ASJC Scopus subject areas

Artificial Intelligence
Computer Networks and Communications
Hardware and Architecture
Signal Processing
Renewable Energy, Sustainability and the Environment
Safety, Risk, Reliability and Quality

Access to Document

10.1109/GLOBECOM48099.2022.10000633

Cite this

Nishio, T., Nakahara, M., Okui, N., Kubota, A., Kobayashi, Y., Sugiyama, K., & Shinkuma, R. (2022). Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT. In 2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings (pp. 299-304). (2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/GLOBECOM48099.2022.10000633

Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT. / Nishio, Takayuki; Nakahara, Masataka; Okui, Norihiro et al.

2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings. Institute of Electrical and Electronics Engineers Inc., 2022. p. 299-304 (2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Nishio, T, Nakahara, M, Okui, N, Kubota, A, Kobayashi, Y, Sugiyama, K & Shinkuma, R 2022, Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT. in 2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings. 2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings, Institute of Electrical and Electronics Engineers Inc., pp. 299-304, 2022 IEEE Global Communications Conference, GLOBECOM 2022, Virtual, Online, Brazil, 22/12/4. https://doi.org/10.1109/GLOBECOM48099.2022.10000633

Nishio T, Nakahara M, Okui N, Kubota A, Kobayashi Y, Sugiyama K et al. Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT. In 2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings. Institute of Electrical and Electronics Engineers Inc. 2022. p. 299-304. (2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings). doi: 10.1109/GLOBECOM48099.2022.10000633

Nishio, Takayuki ; Nakahara, Masataka ; Okui, Norihiro et al. / Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT. 2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings. Institute of Electrical and Electronics Engineers Inc., 2022. pp. 299-304 (2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings).

@inproceedings{ccff16c623824e1fbe2396337c5af3b0,

title = "Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT",

abstract = "To mitigate cyberattacks, detecting anomalies in network traffic is of key importance. In this paper, we propose a model training method for detection of Internet of Things (IoT) anomalous traffic that is robust against the contamination of anomalous samples in the training set. The key idea is to focus on the nature of IoT malware infections (i.e., only a limited number of IoT networks contain infected devices) and employ federated learning (FL) to mitigate the impact of anomalous samples on model training. The simulation evaluation using IoT traffic data obtained from residences and malware traffic data collected from sandbox experiments demonstrates that the proposed method does not cause accuracy degradation even when the anomalous samples are contaminated, in contrast with the detection accuracy of baseline methods, which does degrade.",

keywords = "Anomaly Detection, Federated Learning, IoT, Malware Detection, Traffic Monitoring",

author = "Takayuki Nishio and Masataka Nakahara and Norihiro Okui and Ayumu Kubota and Yasuaki Kobayashi and Keizo Sugiyama and Ryoichi Shinkuma",

note = "Funding Information: This work is supported in part by JST, PRESTO Grant Number JP-MJPR2035, Japan. These research results were partly obtained from the commissioned research (No.05201) by National Institute of Information and Communications Technology (NICT), Japan. Funding Information: This work is supported in part by JST, PRESTO Grant Number JPMJPR2035, Japan. These research results were partly obtained from the commissioned research (No.05201) by National Institute of Information and Communications Technology (NICT), Japan. Publisher Copyright: {\textcopyright} 2022 IEEE.; 2022 IEEE Global Communications Conference, GLOBECOM 2022 ; Conference date: 04-12-2022 Through 08-12-2022",

year = "2022",

doi = "10.1109/GLOBECOM48099.2022.10000633",

language = "English",

series = "2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "299--304",

booktitle = "2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings",

}

TY - GEN

T1 - Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT

AU - Nishio, Takayuki

AU - Nakahara, Masataka

AU - Okui, Norihiro

AU - Kubota, Ayumu

AU - Kobayashi, Yasuaki

AU - Sugiyama, Keizo

AU - Shinkuma, Ryoichi

N1 - Funding Information: This work is supported in part by JST, PRESTO Grant Number JP-MJPR2035, Japan. These research results were partly obtained from the commissioned research (No.05201) by National Institute of Information and Communications Technology (NICT), Japan. Funding Information: This work is supported in part by JST, PRESTO Grant Number JPMJPR2035, Japan. These research results were partly obtained from the commissioned research (No.05201) by National Institute of Information and Communications Technology (NICT), Japan. Publisher Copyright: © 2022 IEEE.

PY - 2022

Y1 - 2022

N2 - To mitigate cyberattacks, detecting anomalies in network traffic is of key importance. In this paper, we propose a model training method for detection of Internet of Things (IoT) anomalous traffic that is robust against the contamination of anomalous samples in the training set. The key idea is to focus on the nature of IoT malware infections (i.e., only a limited number of IoT networks contain infected devices) and employ federated learning (FL) to mitigate the impact of anomalous samples on model training. The simulation evaluation using IoT traffic data obtained from residences and malware traffic data collected from sandbox experiments demonstrates that the proposed method does not cause accuracy degradation even when the anomalous samples are contaminated, in contrast with the detection accuracy of baseline methods, which does degrade.

AB - To mitigate cyberattacks, detecting anomalies in network traffic is of key importance. In this paper, we propose a model training method for detection of Internet of Things (IoT) anomalous traffic that is robust against the contamination of anomalous samples in the training set. The key idea is to focus on the nature of IoT malware infections (i.e., only a limited number of IoT networks contain infected devices) and employ federated learning (FL) to mitigate the impact of anomalous samples on model training. The simulation evaluation using IoT traffic data obtained from residences and malware traffic data collected from sandbox experiments demonstrates that the proposed method does not cause accuracy degradation even when the anomalous samples are contaminated, in contrast with the detection accuracy of baseline methods, which does degrade.

KW - Anomaly Detection

KW - Federated Learning

KW - IoT

KW - Malware Detection

KW - Traffic Monitoring

UR - http://www.scopus.com/inward/record.url?scp=85146959077&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85146959077&partnerID=8YFLogxK

U2 - 10.1109/GLOBECOM48099.2022.10000633

DO - 10.1109/GLOBECOM48099.2022.10000633

M3 - Conference contribution

AN - SCOPUS:85146959077

T3 - 2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings

SP - 299

EP - 304

BT - 2022 IEEE Global Communications Conference, GLOBECOM 2022 - Proceedings

PB - Institute of Electrical and Electronics Engineers Inc.

T2 - 2022 IEEE Global Communications Conference, GLOBECOM 2022

Y2 - 4 December 2022 through 8 December 2022

ER -

Anomaly Traffic Detection with Federated Learning toward Network-based Malware Detection in IoT

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this