# D"IoT: A Federated Self-learning Anomaly Detection System for IoT

arXiv: https://arxiv.org/abs/1804.07474 · HTML: https://mlsanity.com/paper/1804.07474/

## Key facts

- Cited by 89 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Apr 2018.

## Built on by (most cited first, 30 of 89)

- [Survey on Federated Learning Threats: concepts, taxonomy on attacks and defences, experimental study and challenges](https://mlsanity.com/paper/2201.08135/) (2022)
- [DeepSight: Mitigating Backdoor Attacks in Federated Learning Through Deep Model Inspection](https://mlsanity.com/paper/2201.00763/) (2022)
- [Federated Learning for Internet of Things: Applications, Challenges, and Opportunities](https://mlsanity.com/paper/2111.07494/) (2021)
- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Backdoor Attacks and Defenses in Federated Learning: Survey, Challenges and Future Research Directions](https://mlsanity.com/paper/2303.02213/) (2023)
- [Machine Learning for Microcontroller-Class Hardware: A Review](https://mlsanity.com/paper/2205.14550/) (2022)
- [CrowdGuard: Federated Backdoor Detection in Federated Learning](https://mlsanity.com/paper/2210.07714/) (2022)
- [FreqFed: A Frequency Analysis-Based Approach for Mitigating Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2312.04432/) (2023)
- [FedAdapt: Adaptive Offloading for IoT Devices in Federated Learning](https://mlsanity.com/paper/2107.04271/) (2021)
- [BayBFed: Bayesian Backdoor Defense for Federated Learning](https://mlsanity.com/paper/2301.09508/) (2023)
- [Federated Learning for Intrusion Detection System: Concepts, Challenges and Future Directions](https://mlsanity.com/paper/2106.09527/) (2021)
- [Evaluation and Optimization of Distributed Machine Learning Techniques for Internet of Things](https://mlsanity.com/paper/2103.02762/) (2021)
- [Federated Learning for Internet of Things: A Federated Learning Framework for On-device Anomaly Data Detection](https://mlsanity.com/paper/2106.07976/) (2021)
- [A Survey of Graph-based Deep Learning for Anomaly Detection in Distributed Systems](https://mlsanity.com/paper/2206.04149/) (2022)
- [Evaluating Federated Learning for Intrusion Detection in Internet of Things: Review and Challenges](https://mlsanity.com/paper/2108.00974/) (2021)
- [ADMoE: Anomaly Detection with Mixture-of-Experts from Noisy Labels](https://mlsanity.com/paper/2208.11290/) (2022)
- [Federated Intrusion Detection for IoT with Heterogeneous Cohort Privacy](https://mlsanity.com/paper/2101.09878/) (2021)
- [Federated Variational Learning for Anomaly Detection in Multivariate Time Series](https://mlsanity.com/paper/2108.08404/) (2021)
- [Failure Prediction in Production Line Based on Federated Learning: An Empirical Study](https://mlsanity.com/paper/2101.11715/) (2021)
- [A Survey on Federated Learning and its Applications for Accelerating Industrial Internet of Things](https://mlsanity.com/paper/2104.10501/) (2021)
- [Fast Deep Autoencoder for Federated learning](https://mlsanity.com/paper/2206.05136/) (2022)
- [Efficient Federated Learning against Heterogeneous and Non-stationary Client Unavailability](https://mlsanity.com/paper/2409.17446/) (2024)
- [Decentralized Federated Learning Preserves Model and Data Privacy](https://mlsanity.com/paper/2102.00880/) (2021)
- [BELT: Old-School Backdoor Attacks can Evade the State-of-the-Art Defense with Backdoor Exclusivity Lifting](https://mlsanity.com/paper/2312.04902/) (2023)
- [Revisiting IoT Device Identification](https://mlsanity.com/paper/2107.07818/) (2021)
- [Towards More Efficient Data Valuation in Healthcare Federated Learning using Ensembling](https://mlsanity.com/paper/2209.05424/) (2022)
- [FedDef: Defense Against Gradient Leakage in Federated Learning-based Network Intrusion Detection Systems](https://mlsanity.com/paper/2210.04052/) (2022)
- [ARGUS: Context-Based Detection of Stealthy IoT Infiltration Attacks](https://mlsanity.com/paper/2302.07589/) (2023)
- [Active Learning for Network Traffic Classification: A Technical Study](https://mlsanity.com/paper/2106.06933/) (2021)
- [Studying the Robustness of Anti-adversarial Federated Learning Models Detecting Cyberattacks in IoT Spectrum Sensors](https://mlsanity.com/paper/2202.00137/) (2022)

## Abstract (arXiv)

IoT devices are increasingly deployed in daily life. Many of these devices are, however, vulnerable due to insecure design, implementation, and configuration. As a result, many networks already have vulnerable IoT devices that are easy to compromise. This has led to a new category of malware specifically targeting IoT devices. However, existing intrusion detection techniques are not effective in detecting compromised IoT devices given the massive scale of the problem in terms of the number of different types of devices and manufacturers involved. In this paper, we present D"IoT, an autonomous self-learning distributed system for detecting compromised IoT devices effectively. In contrast to prior work, D"IoT uses a novel self-learning approach to classify devices into device types and build normal communication profiles for each of these that can subsequently be used to detect anomalous deviations in communication patterns. D"IoT utilizes a federated learning approach for aggregating behavior profiles efficiently. To the best of our knowledge, it is the first system to employ a federated learning approach to anomaly-detection-based intrusion detection. Consequently, D"IoT can cope with emerging new and unknown attacks. We systematically and extensively evaluated more than 30 off-the-shelf IoT devices over a long term and show that D"IoT is highly effective (95.6% detection rate) and fast (~257 ms) at detecting devices compromised by, for instance, the infamous Mirai malware. D"IoT reported no false alarms when evaluated in a real-world smart home deployment setting.