With the rapid development of low-cost consumer electronics and cloud computing, Internet-of-Things (IoT) devices are widely adopted for supporting next-generation distributed systems such as smart cities and industrial control systems. IoT devices are often susceptible to cyber attacks due to their open deployment environment and limited computing capabilities for stringent security controls. Hence, Intrusion Detection Systems (IDS) have emerged as one of the effective ways of securing IoT networks by monitoring and detecting abnormal activities. However, existing IDS approaches rely on centralized servers to generate behaviour profiles and detect anomalies, causing high response time and large operational costs due to communication overhead. Besides, sharing of behaviour data in an open and distributed IoT network environment may violate on-device privacy requirements. Additionally, various IoT devices tend to capture heterogeneous data, which complicates the training of behaviour models. In this paper, we introduce Federated Learning (FL) to collaboratively train a decentralized shared model of IDS, without exposing training data to others. Furthermore, we propose an effective method called Federated Learning Ensemble Knowledge Distillation (FLEKD) to mitigate the heterogeneity problems across various clients. FLEKD enables a more flexible aggregation method than conventional model fusion techniques. Experiment results on the public dataset CICIDS2019 demonstrate that the proposed approach outperforms local training and traditional FL in terms of both speed and performance and significantly improves the system's ability to detect unknown attacks. Finally, we evaluate our proposed framework's performance in three potential real-world scenarios and show FLEKD has a clear advantage in experimental results.

翻译：随着低成本消费电子产品和云计算的快速发展，物联网（IoT）设备被广泛用于支持下一代分布式系统，如智慧城市和工业控制系统。由于开放的部署环境和有限的计算能力难以实施严格的安全控制，物联网设备容易受到网络攻击。因此，入侵检测系统（IDS）通过监控和检测异常活动，已成为保护物联网网络的有效手段之一。然而，现有IDS方法依赖集中式服务器生成行为特征并检测异常，导致响应时间长、通信开销大且运营成本高。此外，在开放分布式物联网网络环境中共享行为数据可能违反设备隐私要求。同时，不同物联网设备捕获的异构数据也增加了行为模型训练的复杂性。本文引入联邦学习（FL）来协同训练去中心化的共享IDS模型，无需向他人暴露训练数据。进一步，我们提出一种名为联邦学习集成知识蒸馏（FLEKD）的有效方法，以缓解不同客户端间的异构性问题。FLEKD可实现比传统模型融合技术更灵活的聚合方法。在公开数据集CICIDS2019上的实验结果表明，所提方法在速度和性能上均优于本地训练和传统联邦学习，并显著提升系统检测未知攻击的能力。最后，我们在三种潜在真实场景中评估了所提框架的性能，实验结果显示FLEKD具有明显优势。