ICACT20230276 Slide.19
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Thank you everyone for listening. My presentation ends here.
If you have any questions, please ask questions, I would like to listen and answer.
|
|
ICACT20230276 Slide.18
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
And finally, I would like to present some conclusions of this study.
The study suggests using the Federated-Learning approach for IoT malware abnormal traffic detection and protecting user privacy
The effectiveness of two different approaches using the N-BaIoT dataset: (i) federated learning and (ii) a centralized approach
The results show that although the centralized approach still gives higher accuracy than Federated Learning in detecting abnormal IoT traffic, this difference is not much. However, the centralized approach model will not guarantee the security and integrity of private information as in the FL model.
In future works, we plan to optimize the FL-model, especially the global parameter and improve the processing time to get better results.
|
|
ICACT20230276 Slide.17
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
In Figure 10, compares the training times of the centralized and FL-based approaches.
The results show that the training time of the model when the data is concentrated is much better.
|
|
ICACT20230276 Slide.16
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
This is the loss value of the training model when experimenting with the FEDERATED LEARING MODEL
Figure 9 shows the loss value when training distributed data. The CNN model gives the smallest loss value, and the performance of this model is better than the rest.
For using the CNN model as a training model, the loss_value converges very quickly and reaches a value of loss_val = 1.63.
|
|
ICACT20230276 Slide.15
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
This is the accuracy of the training model when experimenting with the FEDERATED LEARING MODEL
In Figure 8, we see that the accuracy when using CNN as a training model is relatively high, with accuracy = 90.41%. This result converges very early from around round = 5.
With GRU and LSTM models, until round = 25, these models are converged, and the accuracy result of LSTM is 88.71%, and for the GRU model is 85.67%.
|
|
ICACT20230276 Slide.14
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
This is the loss value of the training model when experimenting with the centralized model
Figure 7 shows the loss value when training the model with centralized data corresponding to CNN, GRU, and LSTM algorithms.
Figure 7 shows the loss value when applying CNN, GRU, LSTM algorithms with corresponding values of 0.14, 0.2, 0.22 respectively.
|
|
ICACT20230276 Slide.13
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
This is the accuracy of the training model when experimenting with the centralized model
For CNN, in Fig. 6a, show that from epoch = 5, this algorithm starts to converge and achieves accuracy = 90.72%.
With N-BaIoT dataset, the CNN algorithm has the best results compared to the rest of the algorithms
|
|
ICACT20230276 Slide.12
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
To evaluate how well our approach discovers abnormal IoT traffic caused by malware
We conduct experiments and compare according to the following components:
First, For a centralized model: the training data is on the server. The server then conducts the training and testing of the model with that centralized dataset. It does not preserve privacy.
Second, For Federated Learning model with Multi-epoch aggregation: we also apply three models, CNN, LSTM, and GRU.
|
|
ICACT20230276 Slide.11
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
In this part, I will introduce CENTRALIZED MODEL
From the initial data of all devices will be collected centrally, then through preprocessing data and feature selection to make the data cleaner. Then divide the data into training set, validation set and testing set data.
Finally, use test models of deep learning such as CNN, LSTM, GRU to evaluate the results and compare the performance of each model.
|
|
ICACT20230276 Slide.10
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Figure 4 shows the details of the communication process between the client and the server.
Each client will automatically train its data according to a specific deep learning model (CNN, LSTM and GRU), then send the weights learned from data of each client to the server.
The server will have the task of aggregating the weights in each client and calculating to update the common weights for all clients and send them back to the clients.
|
|
ICACT20230276 Slide.09
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
In this section, I will demonstrate the federated learning model.
Each device can be thought of as a client and it will communicate directly with the server.
From the initial data in each device, through data preprocessing and feature selection, the model will then begin training.
The communication process between the client and the server will be clearly shown in the following slide.
|
|
ICACT20230276 Slide.08
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Regarding feature selection.
We will use the mutual information measure to select the best feature.
The general idea of mutual information to measure the dependence between two variables. Then use this measure to determine the relevance of each feature in a dataset
|
|
ICACT20230276 Slide.07
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Regarding preprocessing data.
We use 3 techniques for processing:
first, use one-hot encoding for encoding categorical values.
second, use the data normalization formula to normalize the data.
third, use the z-score function to rescale dataset features and reflect the characteristics of a normal distribution.
|
|
ICACT20230276 Slide.06
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
The N-BaIoT dataset implies actual traffic data, collected from 9 commercial IoT devices that were actually infected with Bashlite and Mirai malwares.
Each data line consists of 115 attributes.
And includes 11 output labels.
In which, there is 1 label showing normal traffic and 10 labels showing abnormal traffic with 2 types of malware, Bashlite and Mirai.
|
|
ICACT20230276 Slide.05
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
This is the main work flow of this study. Using the input data set is the N-BaIoT dataset. This dataset is collected from real device data.
The implementation process, from the initial data, we will conduct preprocessing of the data, then use techniques to select the best attributes, then use as input for classification.
And lastly, we will use centralized classification and federated learning classification.
Details of each part, I will present in the following slides.
|
|
ICACT20230276 Slide.04
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Some of our main contributions in this study.
First, using feature selection and feature engineering techniques to choose best features for training the model.
Second, compare the effectiveness of the federated learning (FL) model with traditional deep learning model with the goal of identifying abnormal traffics in IoT networks;
Third, deploying and comparing deep learning models such as CNN (convolutional neural network), LSTM (Long short-term memory), and GRU (Gated recurrent unit) in the FL model to assess compatibility and select the suitable model for the FL approach .
|
|
ICACT20230276 Slide.03
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
The rapid development of IoT technology. And IoT devices are increasingly expanding and developing.
And IoT devices are also targets for malicious attacks like malware attacks.
Figure 1 shows the attacker attacking IoT devices, and they can take control of the devices, and also take data in the IoT network.
Therefore, we need some methods to detect abnormals traffic generated by malware to protect IoT devices in the network.
However, data privacy protection is essential
Therefore, it is necessary to implement a model that can detect abnormals traffic generated by malware and data privacy protection. And federated learning would be the most effective solution.
|
|
ICACT20230276 Slide.02
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Here is my outline for this presentation.
Firstly, I will introduce the motivation for doing this article.
Next, I will cover the main contributions of our research.
The following sections will present the main flow of the paper and evaluate the results.
Finally, I will present the conclusion of the paper.
|
|
ICACT20230276 Slide.01
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Good afternoon everyone,
My name is Phuc Hao Do
I am a first year PhD student at Bonch-Bruevich Saint Petersburg State University of Telecommunications.
I am very happy to participate in the ICACT conference in 2023.
The article that I will present today is called: A Horizontal Federated-Learning Model for Detecting Abnormal Traffic Generated by Malware in IoT Networks
Let me get started
|
|
ICACT20230276 Slide.00
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
![[Big slide for presentation]](/upload/2023/0276/Presentation/00/1.jpg){kind=link}