CryptIF: Towards Cloud-based IoT Anomaly Detection over Encrypted Feature Streams

With the proliferation and extensive use of the Internet of Things (IoT), it is vital to ensure the secure operation of IoT devices. However, due to limited computing power and lightweight system design, IoT devices often remain unprotected and are vulnerable to a myriad of attacks. Directly outsourcing the computationally intensive anomaly detection work to some middleboxes or cloud servers seems to solve this problem, but it can raise severe privacy concerns. To tackle these problems, we propose CryptIF, a scalable, privacy-preserving approach to detecting IoT anomalies from the cloud. By leveraging the Extended isolation forest (EIForest) and ciphertext comparison algorithms, CryptIF inspects features encrypted by fully homomorphic encryption (FHE) to detect various IoT anomalies. Furthermore, CryptIF parallelizes computing tasks by taking advantage of the single instruction, multiple data (SIMD) property of Cheon, Kim, Kim and Song (CKKS) homomorphic encryption to accelerate the detection process, thereby significantly increasing its scalability and operating efficiency. The evaluations demonstrate that CryptIF outperforms the state-of-the-art ciphertext-based anomaly detection approach in both detection accuracy and time efficiency. Additionally, CryptIF achieves comparable detection performance to plaintext-based IForest algorithms.