IoTDefender: A Federated Transfer Learning Intrusion Detection Framework for 5G IoT

5G and edge computing promote the development of Internet of Things (IoT). In the near future, 5G will be used as infrastructure to connect all walks of life. At the same time, numerous resource-constrained IoT devices make attacks easier and more frequent, resulting in more and more serious harm. 5G needs to provide security for the IoT it carries. 5G IoT security faces three major challenges. First, due to the heterogeneity, diversity and personalization of IoT networks, it is impossible to use a single unified detection model. Second, data in various industries exists in the form of isolated islands so it is hard to share in the light of privacy protection. Third, data island makes some industries produce too little data to train a powerful intrusion detection model. Therefore, 5G needs a personalized, distributed and effective intrusion detection system that can integrate all IoT information under the premise of protecting the privacy of each IoT data.In this paper, we propose IoTDefender, an intrusion detection framework for 5G IoT based on federated transfer learning. 5G edge computing well supports the layered and distributed structure of IoTDefender. IoTDefender carries out data aggregation by federated learning and builds customized detection models by transfer learning. It enables all IoT networks to share information without leaking privacy. Consequently, IoTDefender owns excellent generalization ability, which can highly improve the detection of unknown attacks. The experimental results demonstrate that IoTDefender is more effective (91.93% detection accuracy on average) than traditional method. Furthermore, IoTDefender produces a lower false positive rate than that of a single unified model, which means it has advantages in personalization.