Rapid APT Detection in Resource-Constrained IoT Devices Using Global Vision Federated Learning (GV-FL)

Security and privacy are critical concerns in cyberspace due to the inherent vulnerability of Internet of Things (IoT) systems. In particular, Advanced Persistent Threat (APT) has become one of the most severe security threats in cyberspace. Therefore, how to breach the limitation of traditional network security detection techniques focusing on specific attack patterns has attracted widespread attention. To cope with APT attacks, this article proposes a new approach, Global Vision Federated Learning (GV-FL), which utilizes FL for accurate and efficient APT detection in resource-constrained IoT devices. Specifically, the proposed method implements the identification of APT attacks based on the FL framework, which leverages FL for distributed, privacy-preserving learning of the network. Considering the advanced and persistent nature of APT, the local model of each IoT device is aggregated into a global model for fast detection of APT in resource-limited devices. In addition, the proposed GV-FL approach is comprehensively compared with existing detection methods. Experimental results show that the GV-FL approach not only outperforms existing detection methods in terms of detection accuracy and speed but also significantly reduces resource consumption, thus the GV-FL approach is a promising APT detection approach in the IoT domain.