Distributed Federated Split Learning Based Intrusion Detection System  

作　　者：Rasha Almarshdi Etimad Fadel Nahed Alowidi Laila Nassef 

机构地区：[1]Department of Computer Science,Faculty of Computing and Information Technology,King Abdulaziz University,Jeddah,21589,Saudi Arabia [2]Department of Computer Science,Faculty of Computer Science and Engineering,University of Hail,Hail,55476,Saudi Arabia

出　　处：《Intelligent Automation & Soft Computing》2024年第5期949-983,共35页智能自动化与软计算（英文）

摘　　要：The Internet of Medical Things(IoMT)is one of the critical emerging applications of the Internet of Things(IoT).The huge increases in data generation and transmission across distributed networks make security one of the most important challenges facing IoMT networks.Distributed Denial of Service(DDoS)attacks impact the availability of services of legitimate users.Intrusion Detection Systems(IDSs)that are based on Centralized Learning(CL)suffer from high training time and communication overhead.IDS that are based on distributed learning,such as Federated Learning(FL)or Split Learning(SL),are recently used for intrusion detection.FL preserves data privacy while enabling collaborative model development.However,FL suffers from high training time and communication overhead.On the other hand,SL offers advantages in terms of computational resources,but it faces challenges such as communication overhead and potential security vulnerabilities at the split point.Federated Split Learning(FSL)has proposed overcoming the problems of both FL and SL and offering more secure,efficient,and scalable distribution systems.This paper proposes a novel distributed FSL(DFSL)system to detect DDoS attacks.The proposed DFSL enhances detection accuracy and reduces training time by designing an adaptive aggregation method based on the early stopping strategy.However,the increased number of clients leads to increasing communication overheads.We further propose a Multi-Node Selection(MNS)based Best ChannelBest l2-Norm(BC-BN2)selection scheme to reduce communication overhead.Two DL models are used to test the effectiveness of the proposed system,including a Convolutional Neural Network(CNN)and CNN with Long Short-Term Memory(LSTM)on two modern datasets.The performance of the proposed system is compared with three baseline distributed approaches such as FedAvg,Vanilla SL,and SplitFed algorithms.The proposed system outperforms the baseline algorithms with an accuracy of 99.70%and 99.87%in CICDDoS2019 and LITNET-2020 datasets,respectively.The prop

关 键 词：IDS DFSL DDoS attacks CNN CNN+LSTM 

分 类 号：TP39[自动化与计算机技术—计算机应用技术]