EEFED: Personalized Federated Learning of Execution&Evaluation Dual Network for CPS Intrusion Detection

In the modern interconnected world, intelligent networks and computing technologies are increasingly being incorporated in industrial systems. However, this adoption of advanced technology has resulted in increased cyber threats to cyber-physical systems. Existing intrusion detection systems are continually challenged by constantly evolving cyber threats. Machine learning algorithms have been applied for intrusion detection. In these techniques, a classification model is trained by learning cyber behavior patterns. However, these models typically require considerable high-quality datasets. Limited attack samples are available because of the unpredictability and constant evolution of cyber threats. To address these problems, we propose a novel federated Execution & Evaluation dual network framework (EEFED), which allows multiple federal participants to personalize their local detection models undermining the original purpose of Federated Learning. Thus, a general global detection model was developed for collaboratively improving the performance of a single local model against cyberattacks. The proposed personalized update algorithm and the optimizing backtracking parameters replacement policy effectively reduced the negative influence of federated learning in imbalanced and non-i.i.d distribution of data. The proposed method improved model stability. Furthermore, extensive experiments conducted on a network dataset in various cyber scenarios revealed that the proposed method outperformed single model and state-of-the-art methods.

Cyber-physical systems (CPSs), a type of computing system integrated with physical devices, are widely used in many key areas such as manufacturing, traffic control, energy, and safety management. As one of the major enablers for intelligence industry, the combination of cloud computing and CPSs has been the general trend with several practical cases, e.g. cloud manufacturing service platform, support small and medium enterprises (SMEs) with close business cooperation and SMEs supporting industrial cluster collaboration [1], [2], [3], [4]. With the aid of cloud computing, more optimization methods can be created to enhance the reliability and robustness of system, collaboration to expand limited information and efficiency of functions for CPSs.