SFMD: A Semi-Supervised Federated Malicious Traffic Detection Approach in IoT

With the increasingly widespread application of Internet of Things (IoT), network attacks has become a main threat of IoT devices' security. Due to the network traffic data is the carrier of information from users and devices, the traffic-based IoT malicious behavior detection has become an effective solution to prevent such threats. In order to identify malicious traffic in IoT while protecting users' personal privacy, researchers introduce Federated Learning (FL) into malicious network traffic detection. However, most of the current FL frameworks need all clients to own labeled data to train a high-performance detection model jointly. In addition, they require different clients must design the same model structure to meet the requirement of parameter sharing, which is unreasonable because each client faces problems such as data heterogeneity. And it will degrade the detection performance of some clients. In this research, Semi-Supervised Federated Learning for Malicious Traffic Detection (SFMD) is proposed, aiming to assist the clients who do not have the ability to label their data to train a high-performance model with other clients together. Besides, another key feature of this framework is that it allows each client to train its personalized model according to their own situation. The experimental results indicate that SFMD can accurately identify the attack types for the unsupervised clients without labeled data. In addition, it has achieved high accuracy compared to other anomaly detection methods.