Scalable and Efficient Security Solutions for IoT Networks: An Adaptive Machine Learning Approach

Abstract

The number of Internet of Things (IoT) devices has grown at a rapid pace and has created a larger attack surface for modern networks, making them an appealing target for botnets, ransomware, and distributed denial-of-service (DDoS) attacks. While traditional IDSs are typically built with a centralized machine learning model, they are grappling with crucial issues such as: scalability, data privacy, and limited adaptability to heterogeneous traffic. To overcome these challenges, this paper presents Federated XGBoost (Fed-XGB), an IoT environment-specific, scalable and privacy-preserving intrusion detection framework. In Fed-XGB, each IoT device builds their own XGBoost model based on the local flows observed by them, while only the model updates are shared with a central aggregator using federated averaging. It is designed to remove the need for raw data collection in a central location, maintain confidentiality and reduce the cost of communication. Results from experimental testing with the IoT-23 dataset show that Fed-XGB performs well on various attack families and has a negligible difference (less than 2%) from centralized training. Besides, Fed-XGB shows excellent scalability with the growth of federated nodes with a low communication overhead (<10 MB per round), efficient memory and CPU usage, and millisecond-level inference latency. The results of statistical validation show that there are no significant differences in the accuracy between the centralized and federated models (p > 0.05). The results demonstrate that Fed-XGB is an effective, lightweight and deployable intrusion detection solution for large scale IoT systems.