Federated Threat-Hunting Approach for Microservice-Based Industrial Cyber-Physical System
Abstract
The lightning convergence of industry 4.0 and the intelligent Internet of Things (IoT) technologies has significantly increased the vulnerability of industrial cyber-physical systems (ICPSs) to a large population of cyber threats. Intelligent threat detection for discovering cyber threats is a challenging task as it essentially deals with wide-scale, complicated, and heterogeneous ICPSs. This article presents a novel federated deep learning (DL) model (Fed-TH) for hunting cyber threats against ICPSs that captures the temporal and spatial representations of network data. Then, a container-based industrial edge computing framework is designed to deploy the Fed-TH as a threat-hunting microservice on suitable edge servers while maintaining decent resource orchestration. To tackle the latency issue of an ICSP, an exploratory microservice placement method is introduced to enable better microservice deployment based on the computational resources of the participants. The simulation results obtained from two public benchmarks validate the effectiveness of these approaches in terms of accuracy (92.97%, 92.84%) and f1-scores (91.61%, 90.49%).
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
IIoT architecture is exposed to cyber-physical threats at every layer when IT interacts with OT environments in sectors like manufacturing.
“When IT interacts with OT environments, forming a “Cyber-Physical System” (CPS) in sectors like manufacturing, it exposes IIoT architecture to cyber-physical threats at every layer [10], [11].”
From A Critical Overview of Industrial Internet of Things Security and Privacy Issues Using a Layer-Based Hacking Scenario (2023) · cites this paper as [11]
Cites
Deep Learning with Differential Privacy
Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578 · see citing works
ADASYN: Adaptive synthetic sampling approach for imbalanced learning
He, H., Bai, Y., Garcia, E. A., & Shutao Li, A. (2008) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn.2008.4633969 · Cited by 4,945 · see citing works
Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A. N., & Anwar, A. (2020) · IEEE Access · doi:10.1109/access.2020.3022862 · Cited by 983 · see citing works
Privacy-Preserving Traffic Flow Prediction: A Federated Learning Approach
Liu, Y., Yu, J. J. Q., Kang, J., Niyato, D., & Zhang, S. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2991401 · Cited by 712 · see citing works
DeepFed: Federated Deep Learning for Intrusion Detection in Industrial Cyber–Physical Systems
Li, B., Wu, Y., Song, J., Lu, R., Li, T., & Zhao, L. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3023430 · Cited by 623 · see citing works
Liu, Y., Garg, S., Nie, J., Zhang, Y., Xiong, Z., Kang, J., & Hossain, M. S. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3011726 · Cited by 595 · see citing works
Optimus: an efficient dynamic resource scheduler for deep learning clusters
Peng, Y.-H., Bao, Y., Chen, Y.-R., Wu, C., & Guo, C.-X. (2018) · European Conference on Computer Systems · doi:10.1145/3190508.3190517 · Cited by 544 · see citing works
Anomaly Detection Based on Convolutional Recurrent Autoencoder for IoT Time Series
Yin, C., Zhang, S., Wang, J., & Xiong, N. N. (2020) · IEEE Transactions on Systems Man and Cybernetics Systems · doi:10.1109/tsmc.2020.2968516 · Cited by 417 · see citing works
Variational LSTM Enhanced Anomaly Detection for Industrial Big Data
Zhou, X., Hu, Y., Liang, W., Ma, J., & Jin, Q. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3022432 · Cited by 403 · see citing works
Zhou, X., Liang, W., Shimizu, S., Ma, J., & Jin, Q. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3047675 · Cited by 349 · see citing works
Farivar, F., Haghighi, M. S., Jolfaei, A., & Alazab, M. (2019) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2019.2956474 · Cited by 295 · see citing works
PoisonGAN: Generative Poisoning Attacks Against Federated Learning in Edge Computing Systems
Zhang, J., Chen, B., Cheng, X., Binh, H. T. T., & Yu, S. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3023126 · Cited by 291 · see citing works
Privacy-Preserving Federated Learning in Fog Computing
Zhou, C., Fu, A., Yu, S., Yang, W. Y., Wang, H., & Zhang, Y. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2987958 · Cited by 255 · see citing works
Spinelli, F., & Mancuso, V. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3037674 · Cited by 251 · see citing works
Deep Learning-Based DDoS-Attack Detection for Cyber–Physical System Over 5G Network
Hussain, B., Du, Q., Sun, B., & Han, Z. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.2974520 · Cited by 238 · see citing works
3GPP Standardized 5G Channel Model for IIoT Scenarios: A Survey
Jiang, T., Zhang, J., Tang, P., Tian, L., Zheng, Y., Dou, J., Asplund, H., Raschkowski, L., D’Errico, R., & Jämsä, T. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3048992 · Cited by 171 · see citing works
Rodríguez-Barroso, N., Stipcich, G., Jiménez-López, D., Ruiz-Millán, J. A., Martínez-Cámara, E., González-Seco, G., Luzón, M. V., Veganzones, M. A., & Herrera, F. (2020) · Information Fusion · doi:10.1016/j.inffus.2020.07.009 · Cited by 148 · see citing works
Dyme: Dynamic Microservice Scheduling in Edge Computing Enabled IoT
Samanta, A., & Tang, J. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2981958 · Cited by 134 · see citing works
LITNET-2020: An Annotated Real-World Network Flow Dataset for Network Intrusion Detection
Damasevicius, R., Venckauskas, A., Grigaliunas, S., Toldinas, J., Morkevicius, N., Aleliunas, T., & Smuikys, P. (2020) · Electronics · doi:10.3390/electronics9050800 · Cited by 132 · see citing works
IoT Microservice Deployment in Edge-Cloud Hybrid Environment Using Reinforcement Learning
Chen, L., Xu, Y., Lu, Z., Wu, J., Gai, K., Hung, P. C. K., & Meikang Qiu, A. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3014970 · Cited by 124 · see citing works
Rathore, S., & Park, J. H. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3040968 · Cited by 113 · see citing works
Elastic Scheduling for Microservice Applications in Clouds
Wang, S., Ding, Z., & Jiang, C. (2020) · IEEE Transactions on Parallel and Distributed Systems · doi:10.1109/tpds.2020.3011979 · Cited by 107 · see citing works
Yu, G., Chen, P., & Zheng, Z. (2020) · IEEE Transactions on Cloud Computing · doi:10.1109/tcc.2020.2985352 · Cited by 87 · see citing works
MPCSM: Microservice Placement for Edge-Cloud Collaborative Smart Manufacturing
Wang, Y., Zhao, C., Yang, S., Ren, X., Wang, L., Zhao, P. F., & Yang, X. (2020) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2020.3036406 · Cited by 67 · see citing works
Slamnik–Kriještorac, N., Kremo, H., Ruffini, M., & Márquez-Barja, J. M. (2020) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2020.3003818 · Cited by 66 · see citing works
A Blockchain-Based Containerized Edge Computing Platform for the Internet of Vehicles
Cui, L., Chen, Z., Yang, S., Ming, Z., Li, Q. L., Zhou, Y., Chen, S., & Lu, Q. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.3027700 · Cited by 64 · see citing works
Adaptive Microservice Scaling for Elastic Applications
Coulson, N. C., Sotiriadis, S., & Bessis, N. (2020) · IEEE Internet of Things Journal · doi:10.1109/jiot.2020.2964405 · Cited by 53 · see citing works
Distributed Redundancy Scheduling for Microservice-based Applications at the Edge
Zhao, H., Deng, S., Liu, Z., Yin, J., & Dustdar, S. (2021) · IEEE World Congress on Services (SERVICES) · doi:10.1109/services51467.2021.00012 · Cited by 31 · see citing works
Diminishing Returns and Deep Learning for Adaptive CPU Resource Allocation of Containers
Abdullah, M., Iqbal, W., Bukhari, F., & Erradi, A. (2020) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2020.3033025 · Cited by 24 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
An ensemble deep learning model for cyber threat hunting in industrial internet of things
Yazdinejad, A., Kazemi, M., Parizi, R. M., Dehghantanha, A., & Karimipour, H. (2022) · Digital Communications and Networks · doi:10.1016/j.dcan.2022.09.008 · Cited by 176 · see citing works
Jiang, B., Li, J., Wang, H. H., & Song, H. H. (2021) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2021.3131175 · Cited by 123 · see citing works
Evolving techniques in cyber threat hunting: A systematic review
Mahboubi, A., Luong, K., Aboutorab, H., Bui, H. T., Jarrad, G., Bahutair, M., Camtepe, S., Pogrebna, G., Ahmed, E., Barry, B., et al. (2024) · Journal of Network and Computer Applications · doi:10.1016/j.jnca.2024.104004 · Cited by 94 · see citing works
A Survey on Threat Hunting in Enterprise Networks
Nour, B., Pourzandi, M., & Debbabi, M. (2023) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2023.3299519 · Cited by 87 · see citing works
Efficient intrusion detection toward IoT networks using cloud–edge collaboration
Yang, R., He, H. X., Xu, Y., Xin, B., Wang, Y., Qu, Y., & Zhang, W. (2023) · Computer Networks · doi:10.1016/j.comnet.2023.109724 · Cited by 79 · see citing works
Dependable federated learning for IoT intrusion detection against poisoning attacks
Yang, R., He, H. X., Wang, Y., Qu, Y., & Zhang, W. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103381 · Cited by 58 · see citing works
Federated learning: A cutting-edge survey of the latest advancements and applications
Akhtarshenas, A., Vahedifar, M. A., Ayoobi, N., Maham, B., Alizadeh, T., Ebrahimi, S., & López-Pérez, D. (2024) · Computer Communications · doi:10.1016/j.comcom.2024.107964 · Cited by 53 · see citing works
Container security: Precaution levels, mitigation strategies, and research perspectives
S, D. P. V., Sethuraman, S. C., & Khan, M. K. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103490 · Cited by 46 · see citing works
Eyeleko, A. H., & Feng, T. (2023) · IEEE Internet of Things Journal · doi:10.1109/jiot.2023.3308195 · Cited by 38 · see citing works
“When IT interacts with OT environments, forming a “cyber-physical system” (CPS) in sectors like manufacturing, it exposes IIoT architecture to cyber-physical threats at every layer [10], [11].”
BackgroundFedMicro-IDA: A federated learning and microservices-based framework for IoT data analytics
Atitallah, S. B., Driss, M., & Ghézala, H. B. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100845 · Cited by 35 · see citing works
Shao, J., Zeng, G., Lu, K., Geng, G., & Weng, J. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103910 · Cited by 33 · see citing works
ACTA: Autonomy and Coordination Task Assignment in Spatial Crowdsourcing Platforms
Li, B., Cheng, Y., Yuan, Y., Yang, Y., Jin, Q., & Wang, G. (2023) · Proceedings of the VLDB Endowment · doi:10.14778/3579075.3579082 · Cited by 27 · see citing works
DetectPMFL: Privacy-Preserving Momentum Federated Learning Considering Unreliable Industrial Agents
Zhang, Z., He, N., Li, Q., Wang, K., Gao, H., & Gao, T. (2022) · IEEE Transactions on Industrial Informatics · doi:10.1109/tii.2022.3140806 · Cited by 24 · see citing works
Atitallah, S. B., Driss, M., & Ghzela, H. B. (2022) · Procedia Computer Science · doi:10.1016/j.procs.2022.09.456 · Cited by 22 · see citing works
IIoT: Traffic Data Flow Analysis and Modeling Experiment for Smart IoT Devices
Bhardwaj, A., Kaushik, K., Bharany, S., Rehman, A. U., Hu, Y., Eldin, S. M., & Ghamry, N. A. (2022) · Sustainability · doi:10.3390/su142114645 · Cited by 20 · see citing works
Federated Learning-Based Cyber Threat Hunting for APT Attack Detection in SDN-Enabled Networks
Thi, H. T., Son, N. D. H., Duy, P. T., & Pham, V.-H. (2022) · International Symposium on Communications and Information Technologies · doi:10.1109/iscit55906.2022.9931222 · Cited by 20 · see citing works
Explainable artificial intelligence envisioned security mechanism for cyber threat hunting
Kumar, P., Wazid, M., Singh, D. P., Singh, J., Das, A. K., Park, Y., & Rodrigues, J. J. P. C. (2023) · Security and Privacy · doi:10.1002/spy2.312 · Cited by 20 · see citing works
Alnfiai, M. M. (2025) · EURASIP Journal on Wireless Communications and Networking · doi:10.1186/s13638-025-02497-2 · Cited by 19 · see citing works
Duy, P. T., Quyen, N. H., Khoa, N. H., Tran, T.-D., & Pham, V.-H. (2023) · Internet of Things · doi:10.1016/j.iot.2023.100966 · Cited by 19 · see citing works
Vy, N. C., Quyen, N. H., Duy, P. T., & Pham, V.-H. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-92708-0_8 · Cited by 18 · see citing works
Cyber threat hunting using unsupervised federated learning and adversary emulation
Sheikhi, S., & Kostakos, P. (2023) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr57506.2023.10224990 · Cited by 13 · see citing works
A Secure and Privacy Preserving Federated Learning Approach for IoT Intrusion Detection System
Duy, P. T., Hao, H. N., Chu, H. M., & Pham, V.-H. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-92708-0_23 · Cited by 13 · see citing works
Rousta, M. M., Arani, P. F., Kazemi, R., & Shoorehdeli, M. A. (2024) · CAAI Transactions on Intelligence Technology · doi:10.1049/cit2.12359 · Cited by 12 · see citing works
Quyen, N. H., Duy, P. T., Vy, N. C., Hien, D. T. T., & Pham, V.-H. (2022) · Lecture notes in computer science · doi:10.1007/978-3-031-21280-2_20 · Cited by 11 · see citing works
Liu, Z., & He, X. Y. (2025) · IEEE Transactions on Cybernetics · doi:10.1109/tcyb.2025.3557269 · Cited by 9 · see citing works
Federated Learning for 6G Security: A Survey on Threats, Solutions, and Research Directions
de Alwis, C., Aouedi, O., Xu, J., Wang, S., Siriwardhana, Y., Hewa, T. M., Zeydan, E., Sandeepa, C., & Liyanage, M. (2026) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2026.3663434 · Cited by 13 · see citing works
Aflaki, A., Karimipour, H., & Gadekallu, T. R. (2024) · IEEE Transactions on Industrial Cyber-Physical Systems · doi:10.1109/ticps.2024.3419751 · Cited by 9 · see citing works
Challenges and Opportunities in Mobile Network Security for Vertical Applications: A Survey
Sobrinho, Á., Vilarim, M., Barbosa, A., Gurjão, E. C., Santos, D. F. S., Valadares, D. C. G., & da Silva, L. D. (2024) · ACM Computing Surveys · doi:10.1145/3696446 · Cited by 8 · see citing works
Liu, X., Zhao, J., Li, J., Xu, D., Tian, S., & Cao, B. (2022) · IEEE Internet of Things Magazine · doi:10.1109/iotm.001.2100179 · Cited by 6 · see citing works
Imbalanced classification in faulty turbine data: New proximal policy optimisation
Rousta, M. M., Shoorehdeli, M. A., & Yari, M. (2024) · IET Collaborative Intelligent Manufacturing · doi:10.1049/cim2.12114 · Cited by 6 · see citing works
A federated threat hunting system with big data analysis for SDN-enabled networks
Trong, N. T., Hoang, H. D., Trung, D. M., Duy, P. T., & Pham, V.-H. (2022) · RIVF International Conference on Computing and Communication Technologies (RIVF) · doi:10.1109/rivf55975.2022.10013833 · Cited by 4 · see citing works
A systematic literature mapping on the security of 5G and vertical applications
Sobrinho, Á., dos Santos, M. V. P., Silva, A. B., Santos, D. F. S., & Gurjão, E. C. (2024) · Revista Brasileira de Computação Aplicada · doi:10.5335/rbca.v16i3.16005 · Cited by 2 · see citing works
A Comprehensive Survey of Threat Intelligence Research: A Measurement-Based Study
Furumoto, K., Morikawa, T., Kolehmainen, A., Silverajan, B., Takahashi, T., & Inoue, D. (2025) · ACM Computing Surveys · doi:10.1145/3772280 · Cited by 2 · see citing works
Sakthivel, V., & Sudha, I. (2025) · International Conference on Science Technology Engineering and Mathematics (ICONSTEM) · doi:10.1109/iconstem65670.2025.11374307 · Cited by 2 · see citing works
GraphWatch: A Novel Threat Hunting Approach for APT Activities based on Anomaly Detection
Buchta, R., Kleiner, C., Heine, F., Mahrenholz, D., Mönks, U., & Trsek, H. (2024) · IEEE International Conference on Emerging Technologies and Factory Automation (ETFA) · doi:10.1109/etfa61755.2024.10711127 · Cited by 2 · see citing works
Gyawali, Y. P., & Karyakarte, M. S. (2023) · Research Journal of Computer Systems and Engineering · doi:10.52710/rjcse.64 · Cited by 2 · see citing works
Kumari, G. R. P., Shalini, D., Chandrika, R., DivyaSri, P., Srija, K. A., & Alapati, N. (2025) · International Conference on Trends in Electronics and Informatics (ICOEI) · doi:10.1109/icoei65986.2025.11013568 · Cited by 1 · see citing works
Threat Hunting in System Using Log Analysis
A, P. J., Chaithanya, Shankar, A., Narayan, J. A., Anurag, A., & Kumar, S. S. (2024) · International Conference on Knowledge Engineering and Communication Systems (ICKECS) · doi:10.1109/ickecs61492.2024.10616474 · Cited by 1 · see citing works
Blockchain-Based Federated Learning for Enhanced Cyber-Threats Detection in Connected Vehicles
Amari, H., Houda, Z. A. E., Moudoud, H., Khoukhi, L., & Belguith, L. H. (2025) · International Conference on Communications · doi:10.1109/icc52391.2025.11161266 · Cited by 1 · see citing works
An Integrated Service Bus Based on Microservice
Zhang, J., Shu, M., Sun, C., & Huang, Y. (2022) · International Conference on Frontiers of Electronics, Information and Computation Technologies · doi:10.1109/icfeict57213.2022.00101
Parameter Tuned Extreme Gradient Boosting Model for Industrial Threat Detection
Issa, S. S., Alkhayyat, A. H., Abosinnee, A. S., Kadeem, S. R. A., Jaffer, Z., & Hussein, A. H. A. (2023) · International Conference on Engineering Technology and its Applications (IICETA) · doi:10.1109/iiceta57613.2023.10351446
IIoT: Traffic Data Flow Analysis and Modeling Experiment for Smart IoT Devices
Bhardwaj, A. (2024) · BENTHAM SCIENCE PUBLISHERS eBooks · doi:10.2174/9789815256710124010008
Spatial Federated Learning Based Blockchain Mechanism for Smart Contract Vulnerability Detection
Raparthi, M. (2025) · Lecture notes in networks and systems · doi:10.1007/978-981-97-8631-2_10
Machine Learning for Industrial Iot Cybersecurity: A Systematic ReviewPreprint
Dohin, A., Zkik, K., Akilal, A., Omar, M., & Akli, H. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5388573
Technical Overview of Container Vulnerabilities
Zhang, X., Zhang, W., Jiang, Q., Lin, Z., Lai, B., & Lu, H. D. (2025) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc67331.2025.00063
Secure and Cost-Efficient Microservice Placement in MEC Through Network-Aware Adaptation
He, F., Bujari, A., Bellavista, P., Li, P., Xiao, Z., Romandini, N., & Qiu, Y. F. (2026) · ACM Transactions on Internet Technology · doi:10.1145/3815782
- Authors
- Abdel-Basset, M., Hawash, H., & Sallam, K.
- Affiliations
- Zagazig University (EG)
- Venue
- IEEE Transactions on Industrial Informatics
- Published
- 2022-03
- Volume
- 18
- Issue
- 3
- Pages
- 1905-1917
- ISSN
- 1551-3203 (ISSN-L)
- 1941-0050
- OpenAlex
- W3176372534
- Cited by
- 47
- References
- 29
- Citations by year
- 2026: 2 · 2025: 9 · 2024: 11 · 2023: 13 · 2022: 9 · 2021: 3
- FWCI
- 4.04
- Type
- journal article
- Language
- en
- Open access
- closed
- Licence
- Locations
- IEEE Transactions on Industrial Informatics (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Computer Networks and Communications › IoT and Edge/Fog Computing
- Physical Sciences › Computer Science › Information Systems › Internet of Things and AI
- Keywords
- federated learning, threat hunting, industrial cyber-physical systems, microservices, industrial edge computing, containerization, microservice placement, network traffic anomaly detection, Industrial Internet of Things, resource orchestration
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review