Lynx-Net: Privacy-Preserving Neural Network Training and Malware Detection at IoT-Edge

Cyberattacks on IoT devices are accelerating at an unprecedented rate, largely driven by IoT malware activities. The IoT malware attacks are typically composed of three stages: intrusion, infection, and execution. It is essential to instantaneously detect malware at the early stage of intrusion on IoT devices before massive attacks. To build an efficient and scalable instruction detection system, a multi-client single-server privacy-preserved neural network model is proposed. Further, it is important to train the neural network model on the fly to cope with the fast-evolving malware variations. For online training and detection, we propose Lynx-Net, a distributed deep learning online training model for inferring malicious activities by analyzing power side-channel signals. To protect user private data and model parameters, and reduce prediction latency, we implement a novel privacy-preserved protocol via secret sharing and packed hybrid homomorphic encryption. Through theoretical analysis and empirical experiments, we demonstrate that Lynx-Net can detect infection activities of different IoT malware with high accuracy. Our extensive experiments demonstrate not only stable training but also a 1.13 to 2.67 times speedup compared to the state-of-the-art training model and an 8 to 500 times improvement in Lynx-Net’s inference prediction latency compared to the state-of-the-art inference model.