The DOI matches its Crossref record; 31 of the 35 references it cites were found in a registry or an index.
Poisoning Attacks on Federated Learning-based IoT Intrusion Detection System
Open accessAbstract
Federated Learning (FL) is an appealing method for applying machine learning to large scale systems due to the privacy and efficiency advantages that its training mechanism provides.One important field for FL deployment is emerging IoT applications.In particular, FL has been recently used for IoT intrusion detection systems where clients, e.g., a home security gateway, monitors traffic data generated by IoT devices in its network, trains a local intrusion detection model, and send this model to a central entity, the aggregator, who then computes a global model (using the models of all gateways) that is distributed back to clients.This approach protects the privacy of users as it does not require local clients to share their potentially private IoT data with any other parties, and it is in general more efficient than a centralized system.However, FL schemes have been subject to poising attacks, in particular to backdoor attacks.In this paper, we show that FL-based IoT intrusion detection systems are vulnerable to backdoor attacks.We present a novel data poisoning attack that allows an adversary to implant a backdoor into the aggregated detection model to incorrectly classify malicious traffic as benign.We show that the adversary can gradually poison the detection model by only using compromised IoT devices (and not gateways/clients) to inject small amounts of malicious data into the training process and remain undetected.Our extensive evaluation on three real-world IoT datasets generated from 46 IoT devices shows the effectiveness of our attack in injecting backdoors and circumventing state of the art defenses against FL poisoning.Finally, we discuss shortly possible mitigation approaches.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Thus, the defense algorithm proposed in [191] can be applied to multiple scenarios.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [191]
In the citing paper
“Furthermore, a turning point exists after which the Clean ACC remains high and the Backdoor ACC reduces rapidly.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [191]
In the citing paper
“The backdoor attack success rate under the defense mechanism reduces to zero, while the stability-based defense can ensure a high success rate for the main task.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [191]
In the citing paper
“This work discusses that the turning points between Clean ACC and Backdoor ACC are similar among different types of backdoor attacks.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [191]
In the citing paper
“It has been discovered that the probability that the trained model correctly classifies the normal inputs (Clean ACC) is proportional to the probability that the trained model misclassifies the backdoored inputs (Backdoor ACC).”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [191]
In the citing paper
“In the experimental setup, the number of participants is set to 10, and the training data are IID.”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [191]
In the citing paper
“Although Thien et al. [80] propose that it can mix a small number of malicious updates with numerous benign updates to avoid server detection, the server can still identify the attack by comparing historical updates from the client.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [80]
In the citing paper
“First, the attacker can learn the characteristics of benign clients, such as controlling the Euclidean distance between the malicious and benign models [28] or controlling the poisoning data rate (PDR) [80] to reduce the risk of detection by the server.”
From Poisoning attacks in federated learning: A survey (2023) · cites this paper as [80]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Communication-Efficient Learning of Deep Networks from Decentralized Data
McMahan, H. B., Moore, E., Ramage, D., Hampson, S., & Arcas, B. A. Y. (2016) · arXiv · doi:10.48550/arxiv.1602.05629 · Cited by 14,215
Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modeling
Chung, J., Gulcehre, C., Cho, K., & Bengio, Y. (2014) · arXiv · doi:10.48550/arxiv.1412.3555 · Cited by 11,008
How to backdoor federated learning
Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., & Shmatikov, V. (2018) · arXiv · doi:10.48550/arxiv.1807.00459 · Cited by 1,495
(2017) · neural information processing systems · Cited by 1,413
Understanding the mirai botnet
Antonakakis, M., April, T., Bailey, M., Bernhard, M., Bursztein, E., Cochran, J., Durumeric, Z., Halderman, J. A., Invernizzi, L., Kallitsis, M., et al. (2017) · USENIX Security Symposium · Cited by 1,362
Machine Learning DDoS Detection for Consumer Internet of Things Devices
Doshi, R., Apthorpe, N., & Feamster, N. (2018) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2018.00013 · Cited by 920
Classifying IoT Devices in Smart Environments Using Network Traffic Characteristics
Sivanathan, A., Gharakheili, H. H., Loi, F., Radford, A., Wijenayake, C. A., Vishwanath, A., & Sivaraman, V. (2018) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2018.2866249 · Cited by 812
Natarajan, N., Dhillon, I. S., Ravikumar, P., & Tewari, A. (2013) · Cited by 740
DÏoT: A Federated Self-learning Anomaly Detection System for IoT
Nguyen, T. D., Marchal, S., Miettinen, M., Fereidooni, H., Asokan, N., & Sadeghi, A.-R. (2019) · 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS) · doi:10.1109/icdcs.2019.00080 · Cited by 663
Self-citationFederated Learning: Collaborative Machine Learning without Centralized Training Data
Abhishek, V. A., Binny, S., Johan, T. R., Raj, N., & Thomas, V. (2022) · International Journal of Engineering Technology and Management Sciences · doi:10.46647/ijetms.2022.v06i05.052 · Cited by 489
Research works printed but not linked: 1
- S. Shen, S. Tople, and P. Saxena, "Auror: Defending against poisoning attacks in collaborative deep learning systems," in Proceedings of the 32Nd Annual Conference on Computer Security Applications, ser. ACSAC '16. ACM, 2016, pp. 508-519.
Cited by
Sorted by citations
Data Poisoning Attacks Against Federated Learning Systems
Tolpegin, V., Truex, S., Gursoy, M. E., & Liu, L. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-58951-6_24 · Cited by 927
Federated Learning for intrusion detection system: Concepts, challenges and future directions
Agrawal, S., Sarkar, S., Aouedi, O., Yenduri, G., Piamrat, K., Alazab, M., Bhattacharya, S., Maddikunta, P. K. R., & Gadekallu, T. R. (2022) · Computer Communications · doi:10.1016/j.comcom.2022.09.012 · Cited by 457
Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT-Edge Devices
Popoola, S. I., Ande, R., Adebisi, B., Gui, G., Hammoudeh, M. A. A., & Jogunola, O. (2021) · IEEE Internet of Things Journal · doi:10.1109/jiot.2021.3100755 · Cited by 375
Federated Learning in Edge Computing: A Systematic Survey
Abreha, H. G., Hayajneh, M., & Serhani, M. A. (2022) · Sensors · doi:10.3390/s22020450 · Cited by 384
SAFELearn: Secure Aggregation for private FEderated Learning
Fereidooni, H., Marchal, S., Miettinen, M., Mirhoseini, A., Möllering, H., Nguyen, T. D., Rieger, P., Sadeghi, A., Schneider, T. H., Yalame, H., et al. (2021) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw53761.2021.00017 · Cited by 298
Self-citation
Metadata
- Authors
- Nguyen, T. D., Rieger, P., Miettinen, M., & Sadeghi, A.-R.
- Affiliations
- Technische Universität Darmstadt (DE)
- Venue
- Proceedings 2020 Workshop on Decentralized IoT Systems and Security
- Publisher
- Internet Society
- Published
- 2020
- OpenAlex
- W3030742901
- Cited by
- 200
- References
- 35
- Citations by year
- 2026: 13 · 2025: 35 · 2024: 54 · 2023: 38 · 2022: 36 · 2021: 19 · 2020: 5
- FWCI
- 9.36
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Workshop on Decentralized IoT Systems and Security (DISS) (publishedVersion)
- TUbilio (Technical University of Darmstadt) (submittedVersion)
- Funders
- Deutsche Forschungsgemeinschaft (SFB 1119, 236615297)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Keywords
- federated learning, data poisoning, backdoor attacks, IoT intrusion detection, privacy-preserving machine learning, malicious traffic classification, attack mitigation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
