Stones From Other Hills: Intrusion Detection in Statistical Heterogeneous IoT by Self-Labeled Personalized Federated Learning

With the fast development of the Internet of Things (IoT), the growing amounts of data transmitted through edge devices tempt hackers to attack vulnerabilities. Because of data fragmentation and heterogeneous data distribution of IoT, attack detection models on the edge devices are proficient at detecting only a limited set of specific attacks, causing a high false alarm rate when detecting new traffic data. personalized federated learning (PFL) widely expands the range of detectable attacks and adapts local models to new traffic data by one step of gradient descent. However, it demands a part of the new traffic data (test-support set) with correct labels to realize adaptation, which is labor-consuming when detecting large amounts of traffic data. To solve this issue, our main idea is to find helpful models to prelabel the test-support set, we propose a novel self-labeled PFL called SOH-FL, including an autoencoder based on cosine similarity (CT-AE) to extract features and an aggregation method (BS-Agg) to tailor models for prelabeling test-support sets depending on features extracted from edge devices. SOH-FL is evaluated in three heterogeneous scenarios using the CICIDS2017 dataset, and consistently outperforms the baselines across all metrics, achieving performance comparable to PFL without manual labeling. In the real-world feature heterogeneous scenarios of the IoT-23 and TON-IoT datasets, SOH-FL achieves accuracy improvements of 11.5% and 9.1% over the baseline, respectively. The experimental code is publicly available at https://github.com/deer-echo/SOH-FL.git.