Jul 2026· International Conference on Computer Communications and Networks· pp. 1-6· 0 citations· 19 references
Abstract
The proliferation of Internet of Things (IoT) devices has amplified the attack surface for large-scale cyber threats, with rapidly evolving malware families such as Mirai posing significant detection challenges. Existing side-channel and host-based approaches are limited by poor generalization to unseen variants and the absence of robust privacy protections during training. In this paper, we propose SecShield, a federated deep learning framework for privacy-preserving malware detection in resource-constrained IoT environments. SecShield employs a three-party secure computation model, where clients locally train a shared deep neural network on power side-channel traces and transmit only noisy parameter updates to a central server via an aggregator, preventing raw data exposure. Differential privacy is incorporated by injecting calibrated noise into gradients, mitigating inference risks such as data reconstruction and poisoning attacks. This decentralized architecture enables continuous adaptation to zero-day malware, reduces communication overhead, and ensures robustness against adversarial manipulation. Experimental evaluations on IoT power trace datasets demonstrate that SecShield achieves high detection accuracy over 98% while preserving client data confidentiality and maintaining computational efficiency.
Deep learning is becoming popular in cloud applications and serves to provide intelligent services; data aggregation in a central location makes sensitive information vulnerable to privacy breaches, regulatory infractions, and adversarial manipulation. All modern privacy mechanisms offer partial protection and frequently lack accuracy, scalability, or practicality in their operations. To overcome these limitations, a federated deep learning model is formulated so that secure joint learning can occur without transferring raw data across the domains of ownership. The framework incorporates training that is decentralized, training that uses differential privacy, training that uses secure aggregation, training that uses encrypted communication, and training that uses trust-based anomaly defense to defend against leakage, poisoning, and inference attacks. It also supports heterogeneous and highly non-IID datasets using adaptive coordination and stability-relevant participation regulation and meets emerging data protection requirements. The methods of resource-conscious orchestration and the optimization of communication eliminate overhead without obstructing the effectiveness of learning. The paradigm has therefore formed a privacy-by-design intelligent cloud ecosystem which ensures confidentiality, maintains performance, enhances robustness, and ensures responsible AI implementation in privacy-related sectors of healthcare, finance, governance, and smart infrastructure.
Sribidhya Mohanty, Pallavi Gupta, Anil Pratap Singh et al.· 2026 International Conferenc...· 0 citations
The rapid adoption of Internet of Things (IoT) devices has accelerated the need for privacy-preserving machine learning techniques, such as federated learning (FL). However, the decentralized and collaborative nature of FL makes it vulnerable to backdoor attacks, where adversaries locally update their malicious models before contributing to the global aggregation, subtly injecting backdoors without degrading the normal performance. An affected model behaves as expected during regular operations but exhibits malicious behavior when an embedded trigger is presented. In this article, we propose a novel self-supervised contrastive-learning-based approach to detect and mitigate backdoor attacks in FL within IoT environments. Unlike conventional reverse-engineering methods that iterate through each class in the dataset to reconstruct triggers, our approach directly regenerates triggers from compromised global models without class iteration. This is achieved by comparing last-layer feature representations of a potentially compromised model with those of a relatively clean model under the guidance of contrastive loss. The reverse-engineered trigger is then leveraged to patch the global model and remove the backdoors. We evaluate our method on three benchmark datasets under two federated backdoor attack scenarios, simulating IoT device collaborations. Extended experiments are also conducted on a transformer-based model and two mitigation methods to assess the robustness of our approach. Our results demonstrate that while traditional reverse-engineering techniques are effective in centralized settings, they struggle to detect backdoors in FL. Comparatively, our method is resilient against backdoor attacks across various settings. In addition, our method is more time-efficient because of its capability of generating the backdoor trigger directly without iterating through all classes.
Hal Ferguson, Rui Ning, Hongyi Wu et al.· IEEE Internet of Things Jour...· 0 citations
This work employs the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods and demonstrates that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.
The deepening cyber-physical integration of smart grids has expanded the attack surface of power networks, while centralised intrusion detection schemes struggle with data silos, privacy exposure, and prohibitive communication costs across geographically dispersed substations. This paper proposes a federated deep learning framework that addresses these constraints jointly. A three-tier cloud-edge-terminal architecture confines raw measurements to local devices and exchanges only model parameters across tiers. At each edge node, a hybrid CNN-BiLSTM detector trained under focal loss captures both spatial protocol motifs and temporal attack signatures, including stealthy false data injection and APT traces. Privacy is preserved through a layer-selective mechanism that combines Paillier homomorphic encryption on sensitive gradient slices with calibrated differential privacy on the residual components, pushing the privacy-utility frontier outward without saturating cryptographic cost. An adaptive aggregation rule weights client updates by data quality, drift severity, and marginal validation contribution, mitigating the convergence pathologies that vanilla FedAvg exhibits under sharp non-IID partitioning. Experiments on NSL-KDD, CICIDS2017, and an ICS power-system corpus show that the proposed scheme recovers within 0.7 F1 points of the centralised upper bound, suppresses membership inference advantage to below 0.08, holds detection quality against up to 20% Byzantine clients, and converges in roughly half the rounds required by FedAvg. The framework offers a deployable path toward collaborative intrusion detection across regional grid operators without compromising data sovereignty.
Lin Chen, Zhuo Tang, Yiwei Yang et al.· Scientific Reports· 0 citations
Mal-Fedchain is presented, a secure and privacy-preserving framework for image-based IoT malware detection and prevention that couples federated learning with blockchain and honeypot-assisted behavioral monitoring, targeting Linux-capable IoT gateway devices.
Najem N. Sirhan, Riyad Alrousan, H. Fakhouri· IoT· 0 citations
Federated Learning-Adaptive Gated Recurrent Unit is suggested, a Federated approach that combines a lightweight Gated Recurrent Unit (GRU) classifier with alternating adversarial fine-tuning on each client using FGSM and PGD, without any communication overhead, guaranteeing data-locality privacy through exchange of only model weights.
Syed Sadiqur Rahman· Computers· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
