MPdetector: A Multi-Party Collaborative Federated Transfer Learning Approach for IoT Intrusion Detection

The pervasive adoption of the Internet of Things (IoT) is accompanied by numerous network security threats, making the timely detection of anomalies in traffic data through intrusion detection increasingly critical. The existing intrusion detection methods based on federated learning can achieve good results under the condition of sufficient labeled data. However, the traffic data of participants in real IoT environments have various characteristics and there are a large amount of unlabeled data, which easily leads to the performance degradation of the intrusion detection model. To address this challenge, this paper proposes a novel federated transfer learning approach for IoT intrusion detection based on multi-party collaboration called MPdetector. MPdetector uses an encoder to extract the feature representation of diverse traffic data from heterogeneous clients, and maps the feature representation of each client to a unified feature space. In addition, a label transfer strategy is introduced to make full use of unlabeled data, and a new mapping function is used to reconstruct the traffic data of each client to expand client's local data set, which can further improve the detection performance of the model in varied and complex IoT environments. Theoretical analysis proves that the entire transfer learning process of MPdetector is conducted within a secure context. Experiments on four widely used intrusion detection datasets show that MPdetector can detect known and unknown abnormal traffic more accurately than the existing three classical intrusion detection algorithms, and has strong generalization. Meanwhile, the detection effect of MPdetector will be further improved with the increase of the volume of labeled traffic.