FL-SERENADE: Federated Learning for SEmi-supeRvisEd Network Anomaly DEtection. A Case Study

Abstract

The use of connected devices in the industry represents a necessity and, at the same time, a challenge. Building a network of interconnected industry assets can improve performance and scale but can lead to dangerous security risks and attacks. However, the amount of data shared, and the widespread distribution of devices make the protection of industrial resources cumbersome. One problem is to know the type of information flowing and check for anomalies, making the job of anomaly-based Intrusion Detection Systems (IDSs) arduous. In this direction, we explore a semi-supervised approach, 'Deep-SAD,' to overcome the partial knowledge of the data. Due to the size of the data, and the need for privacy measures, we combine this model with a federated learning (FL) framework 'Flower,' distributing the learning phase through five industrial areas. We evaluate our implementation over the WUSTL-IIoT-2021 dataset, a testbed simulation of an actual plant where threats have been injected. This work presents and evaluates a framework for semi-supervised anomaly detection, starting with feature engineering. The results reveal that the difference in the performance of the federated and centralized settings is minimal, denoting the promising application of the federated approach. Combined with the security and privacy-preserving characteristics of FL, this demonstrates the value of the federated approach to the semi-supervised anomaly-based IDS in the IIoT networks.