Efficient and explainable intrusion detection for the internet of things using modified-LSTM and HTM-inspired sparse CNN with federated learning

Abstract

According to the World Economic Forum, IoT devices have become a main target for Dark Web attacks. There is therefore a pressing need to develop intrusion detection systems suitable for deployment on IoT devices. To this end, we developed an IDS inspired from Hierarchical Temporal Memory (HTM) with Sparse CNN model that uses Federated Learning (FL) and provides explainable inferences. The use of FL enables collaborative model training between IoT devices without compromising data privacy. Moreover, explainable AI (XAI) provides confidence in the model's results and enhances their analysis. To evaluate our model's performance, we used a data set collected from nine IoT devices, where the model had three classification tasks: binary (benign vs. malicious), botnet-type, and attack-type. Moreover, we implemented an IDS based on a Long Short-Term Memory (LSTM) model from the literature, in order to compare both models. We show that our model achieves up to 500x faster inference time, making it highly suitable for resource-constrained IoT edge devices. On the other hand, the LSTM model excels in binary classification with 99.99% accuracy and faithfulness scores: 1.59–4.71. However, our HTM-Inspired Sparse CNN model, named FL-HTM, converges faster during FL rounds and offers superior efficiency for real-time deployment.