Reconnaissance Detection in Decentralised IoT System using Model-Contrastive Federated Learning

The detection of reconnaissance attacks is crucial for safeguarding Internet of Things (IoT) environments, which are inherently more vulnerable and resource-constrained compared to traditional computing systems. Traditional centralised detection methods face significant challenges, such as privacy concerns and limited scalability due to the need to aggregate raw data on a central server. These issues become particularly pronounced in IoT environments where devices are diverse and geographically distributed. To address these challenges, we propose ReconGuard, a novel approach leveraging Model Contrastive Federated Learning (MCFL). ReconGuard enables collaborative training across multiple IoT devices without the necessity of sharing raw data, thereby preserving user privacy and enhancing data security. The approach integrates contrastive learning techniques, which improve the model’s ability to discriminate between benign and malicious activities by contrasting positive (similar) and negative (dissimilar) data pairs. Our experimental results demonstrate that the ReconGuard-based detection system provides a scalable and privacy-preserving solution for identifying reconnaissance activities. These activities are often the initial step in more severe cyber threats, such as botnet attacks, which can lead to significant disruption and damage. By effectively detecting reconnaissance activities, ReconGuard enhances the overall cybersecurity framework of IoT environments. This research presents a viable and innovative method for improving cybersecurity in IoT systems, addressing the critical need for scalable, efficient, and privacy-preserving intrusion detection solutions. The use of MCFL in ReconGuard not only mitigates the challenges of data centralisation but also leverages the distributed nature of IoT networks to enhance robustness against cyber threats.