TY - JOUR
T1 - Radio fingerprinting for anomaly detection using federated learning in LoRa-enabled Industrial Internet of Things
AU - Halder, Subir
AU - Newe, Thomas
N1 - Publisher Copyright:
© 2023 The Author(s)
PY - 2023/6
Y1 - 2023/6
N2 - Long Range (LoRa) communications are gaining popularity in the Industrial Internet of Things (IIoT) domain due to their large coverage and high energy efficiency. However, LoRa-enabled IIoT networks are susceptible to cyberattacks mainly due to their wide transmission window and freely operated frequency band. This has led to several categories of cyberattacks. However, existing anomaly detection systems are inefficient in detecting particularly impersonation attacks due to the dense deployment, heterogeneous IIoT devices and manufacturers involved. In this work, we introduce Hawk, a distributed anomaly detection system for detecting compromised devices in LoRa-enabled IIoT. Hawk first measures a device-type specific physical layer feature, Carrier Frequency Offset (CFO) and then leverages the CFO for fingerprinting the device, and consequently detecting anomalous deviations in the device's CFO behavior, potentially caused by adversaries. To aggregate the device-type specific CFO behavior profile efficiently, Hawk uses federated learning, a distributed machine learning approach. To the best of our knowledge, Hawk is the first to utilise a federated learning method for anomaly-based intrusion detection in LoRa-enabled IIoT. We perform extensive experiments on a real-world dataset collected using 60 LoRa devices, primarily to assess the effectiveness of Hawk against emerging new and unknown attacks. The results show that Hawk improves the detection accuracy by more than 8% compared to the state-of-the-art solutions. Additionally, Hawk reduces the storage overhead by more than 40%, and exhibits significant robustness against cyberattack.
AB - Long Range (LoRa) communications are gaining popularity in the Industrial Internet of Things (IIoT) domain due to their large coverage and high energy efficiency. However, LoRa-enabled IIoT networks are susceptible to cyberattacks mainly due to their wide transmission window and freely operated frequency band. This has led to several categories of cyberattacks. However, existing anomaly detection systems are inefficient in detecting particularly impersonation attacks due to the dense deployment, heterogeneous IIoT devices and manufacturers involved. In this work, we introduce Hawk, a distributed anomaly detection system for detecting compromised devices in LoRa-enabled IIoT. Hawk first measures a device-type specific physical layer feature, Carrier Frequency Offset (CFO) and then leverages the CFO for fingerprinting the device, and consequently detecting anomalous deviations in the device's CFO behavior, potentially caused by adversaries. To aggregate the device-type specific CFO behavior profile efficiently, Hawk uses federated learning, a distributed machine learning approach. To the best of our knowledge, Hawk is the first to utilise a federated learning method for anomaly-based intrusion detection in LoRa-enabled IIoT. We perform extensive experiments on a real-world dataset collected using 60 LoRa devices, primarily to assess the effectiveness of Hawk against emerging new and unknown attacks. The results show that Hawk improves the detection accuracy by more than 8% compared to the state-of-the-art solutions. Additionally, Hawk reduces the storage overhead by more than 40%, and exhibits significant robustness against cyberattack.
KW - Anomaly detection
KW - Carrier frequency offset
KW - Federated learning
KW - Industrial IoT
KW - LoRa communication
UR - http://www.scopus.com/inward/record.url?scp=85148325907&partnerID=8YFLogxK
U2 - 10.1016/j.future.2023.01.021
DO - 10.1016/j.future.2023.01.021
M3 - Article
AN - SCOPUS:85148325907
SN - 0167-739X
VL - 143
SP - 322
EP - 336
JO - Future Generation Computer Systems
JF - Future Generation Computer Systems
ER -