Similarity-Based Selective Federated Learning for Distributed Device-Specific Anomaly Detection

Resource constraints and heterogeneity make securing the IoT a challenge. Device-specific AD can address these challenges. Depending on the algorithm used, training device-specific models takes time. This makes it difficult to bootstrap new devices. Transfer learning via federated learning and model aggregation can speed up the creation of AD models. The novel approach implements an automatic selection of similar devices and creates an aggregated model for new devices. The evaluation uses the UNSW NB 15 dataset. The results show good performance and >90% reduction in bootstrapping time. The approach also satisfies security concerns as it mitigates injection attacks by not using too different models for aggregation.