FL-CTIF: A federated learning based CTI framework based on information fusion for secure IIoT

Abstract

Industrial Internet of Things (IIoT) are evolving and transitioning into virtual entities supported by digital twin technology to optimize existing processes further and improve their efficiency. The virtual representation of the several IIoT departments, such as manufacturing process, packaging, warehousing, and logistics enables predictive maintenance for optimizing local material resources for manufacturing and packaging, improved warehouse space allocation, and delivery schedule optimization. The high volume of data generated from IoT devices are exposed to cyber-attacks using modern attack vectors and thus threaten both physical IIoT environment and its digital twins. Existing intrusion detection systems focus on identifying anomalous traffic using obsolete knowledge of cyber-attack patterns for several attacks, such as ARP poisoning man-in-the-middle attacks, SSL-based attacks using encrypted traffic, and DNS flood-based DDoS traffic. A lack of focus on security using updated and comprehensive Cyber Threat Intelligence (CTI) threatens the security of the IIoT environment. In this paper, we present a Federated Learning based CTI framework based on Information Fusion (FL-CTIF) for securing IIoT environments. We design a comprehensive cyberattack dataset with updated feature selection using Information Fusion to improve the accuracy in identifying cyber-attacks. A federated learning-based ANN model is designed to reduce the model training rounds based on satisfaction level and measure the absence of improvement in each attack vector's average accuracy. The model is evaluated based on model aggregation performance and demonstrates an improved F1 score based on reduced training rounds and reduced CPU consumption. The federated learning model improves accuracy and reduces the false positive rate using the newly merged dataset compared to existing research.