The advancement of big data has paved the way for the development of intelligent and smart applications; however, privacy concerns often hinder fully realizing their benefits. Federated Learning (FL) has emerged as a promising framework for enhancing privacy while training models collaboratively across decentralized data sources. However, it remains susceptible to poisoning attacks, severely undermining its effectiveness. Existing robust aggregation techniques often struggle with the sensitivity of data distributions, and cluster-based strategies often fail to cluster poisoned model updates correctly. The direction obtained from the signs of the gradient mostly solves these problems but remains vulnerable to dying ReLU problems and usually becomes sensitive to outliers. In this paper, we introduce SignDefence, a sign direction and LeakyReLU-based aggregation technique, which considers the direction of the gradients and overcomes the performance issues related to the dying ReLU problem. Moreover, the proposed SignDefence computes Jaccard Similarity over binary encoded model weights and remains robust across sparse data. The experimental results suggest that the proposed technique shows consistently better accuracy and F1 score than the state-of-the-art techniques, without attack and under different attack scenarios.

Federated Learning (FL) is an emerging paradigm that enables multiple clients to train a global model collaboratively without sharing their privacy-sensitive data. However, one of the significant challenges in FL is the aggregation of the model updates from different client devices, as malicious participants acting as Byzantine attackers can craft the model update and poison the global model. The state-of-the-art defence mechanisms mostly rely on aggregation-based security defences to improve the degraded accuracy. However, preventing attacker's participation in the training can have an impact on improving the global model's accuracy. Therefore, in this paper, FedChallenger, a dual-layer defence mechanism, is proposed, which attempts to detect and prevent malicious participation in the FL training process in its first layer. The other layer incorporates a trimmed-mean aggregation strategy, where pairwise cosine similarity identifies malicious updates and removes entire client updates from federated averaging. Extensive experiments using the BloodMNIST dataset validate that the FedChallenger gains nearly 85%, 80%, 15%, and 4% accuracy with more than 1.2 times faster convergence rate over the state-of-the-art Byzantine resilient aggregation strategies called FedAvg, Fang, Krum, and Trimmed-Mean approach, respectively, on 40% compromised devices. Above all, it shows consistently better results than them in both attack and non-attack scenarios.

Cyber-security experts often require the help of an automated process that filters and classifies network attacks. To apply specific preventive measures for securing networks, the classification of the attack type is the key. Many Machine Learning (ML) models have been proposed as a base for Network Intrusion Detection (NID) systems. However, their performance varies based on multiple factors. For instance, an ML model fitted on a highly imbalanced dataset can be biased toward over-represented attack types. On the other hand, paying attention only to the ML model’s performance in the minority classes can negatively affect its performance in the majority classes. This paper proposes an NID system that addresses the issue of imbalanced datasets and uses Convolutional Neural Networks (CNN) to classify the different attack types. We compare the performance of our proposed system to other systems that use: Random Over-Sampling (ROS), Synthetic Minority Oversampling TEchnique (SMOTE), Adaptive Synthetic Sampling (ADASYN), and Generative Adversarial Networks (GAN). Using the NSL-KDD and the BoT-IoT datasets for benchmarking, we show that our proposed system performs well in the minority classes: recall scores of 70.50% and 72.08% on the User to Root (U2R) and Remote to Local (R2L) attack classes of the NSL-KDD dataset, respectively, while maintaining an overall False Alarm Rate (FAR) of 6.50% and a recall of 90.46% on the binary classification task. Our proposed system scores a weighted average F1-Score of 99.45% on the multi-class classification task using the BoT-IoT dataset.

The problem of extracting insights from signals is a very interesting and challenging task. This problem finds its way into the task of detecting malware in wireless devices by considering their power consumption signals. Relying on the fact that every single action on-board (whether hardware or software driven actions) will be reflected as a change in the device's power consumption; consequently, leaving a trace (by malware) in the power consumed by the device is something inevitable. Motivated by the powerful capabilities of deep learning in extracting features unsupervisedly, this paper proposes deep learning based detection methodology. The methodology makes use of time-frequency representation (TFR) of signals to resemble informative visual textures. The assumption is that TFRs (2-D images) construct textures that capture valuable information out of 1-D signals. Following that, Histograms of Oriented Gradients (HOG) of TFR images are computed. The HOG information is treated as images that contain better discriminative features. Finally, a convolutional neural network (CNN) model is trained to accurately classify these signals and detect the anomalous behavior. We have validated the effectiveness of the proposed methodology on a cybersecurity application in the domain of wireless devices. The experimental results confirm that proposed methods can be used to detect the presence of malwares in smartphones with high accuracy, and can also outperform previously reported methods with ~9% to 17% detection performance gain.