Manchester Metropolitan University's Research Repository

    Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT Edge Devices

    Popoola, SI, Ande, R, Adebisi, B ORCID logoORCID: https://orcid.org/0000-0001-9071-9120, Gui, G, Hammoudeh, M and Jogunola, O ORCID logoORCID: https://orcid.org/0000-0002-2701-9524 (2022) Federated Deep Learning for Zero-Day Botnet Attack Detection in IoT Edge Devices. IEEE Internet of Things, 9 (5). pp. 3930-3944. ISSN 2327-4662

    Accepted Version
    Download (1MB) | Preview


    Deep Learning (DL) has been widely proposed for botnet attack detection in Internet of Things (IoT) networks. However, the traditional Centralized DL (CDL) method cannot be used to detect previously unknown (zero-day) botnet attack without breaching the data privacy rights of the users. In this paper, we propose Federated Deep Learning (FDL) method for zero-day botnet attack detection to avoid data privacy leakage in IoT edge devices. In this method, an optimal Deep Neural Network (DNN) architecture is employed for network traffic classification. A model parameter server remotely coordinates the independent training of the DNN models in multiple IoT edge devices, while Federated Averaging (FedAvg) algorithm is used to aggregate local model updates. A global DNN model is produced after a number of communication rounds between the model parameter server and the IoT edge devices. Zero-day botnet attack scenarios in IoT edge devices is simulated with the Bot-IoT and N-BaIoT data sets. Experiment results show that FDL model: (a) detects zero-day botnet attacks with high classification performance; (b) guarantees data privacy and security; (c) has low communication overhead (d) requires low memory space for the storage of training data; and (e) has low network latency. Therefore, FDL method outperformed CDL, Localized DL, and Distributed DL methods in this application scenario.

    Impact and Reach


    Activity Overview
    6 month trend
    6 month trend

    Additional statistics for this dataset are available via IRStats2.


    Repository staff only

    Edit record Edit record