DeepShield: Lightweight Privacy-Preserving Inference for Real-Time IoT Botnet Detection

This paper presents a secure convolutional neural network (CNN) based IoT botnet detection system by leveraging the fact that malware execution during various operational phases of botnet attack shows distinctive power consumption patterns. A key challenge is how to effectively unfold the details of malicious activities executed on IoT devices to enable real-time detection of botnet infection, minimizing the loss of botnet attacks. We therefore propose DeepShield, a novel lightweight online CNN model for real-time privacy-preserving feature extraction and classification based on edge computing. The approach lies in the key novelty of a hybrid cryptographic protocol that offloads the majority of online computation to the edge and enables secret-sharing collaborative computation between the smart auditor and edge server. It takes the most expensive computation of homomorphic operations offline, lightening online secure interaction. Through theoretical analysis and empirical experiments, we demonstrate that DeepShield enables secure, high-accuracy, real-time, and scalable botnet infection detection.