FedMP: Robust and Communication-Efficient Federated Multi-Prototype Intrusion Detection Framework in IoT

Due to its excellent performance in privacy protection, federated learning (FL) technology is gradually introduced into the IoT environment to build a distributed intrusion detection framework. However, the previous frameworks have two limitations: 1) high communication overhead caused by the frequent exchange of model parameters is not friendly for resource-constrained IoT devices; 2) single global model hardly handles not independent and identically distributed (Non-IID) intrusion data on different IoT clients. In this paper, we propose a Federated Multi-Prototype intrusion detection framework (FedMP) to address the above limitations. Specifically, FedMP includes a k-means clustering module that extracts low-dimensional local prototypes for IoT clients and a novel aggregation algorithm that fairly aggregates all local prototypes on the central server to generate global prototypes. By exchanging prototypes instead of model parameters between IoT clients and the central server, FedMP aims to train a unique personalized model for each IoT client to adapt to its local intrusion detection tasks. Experimental results on real-world intrusion detection datasets show that FedMP achieves the best detection performance in Non-IID scenarios while significantly reducing communication overhead compared to other state-of-the-art methods.