Nowadays, cooperation between different organizations to form a cross-industry anti-fraud alliance by using federated learning (FL) is promising for transaction fraud detection. However, there are two challenges when building the federated learning-based fraud detection method. First, existing FL-based fraud detection methods cannot fully use participants' local data to better distinguish unknown types of abnormal fraud transactions. A lot of local data would be discarded due to the private set intersection process under the federated learning framework. Second, they mainly focus on the fraud detection performance but ignore the privacy and communication costs during the training of the fraud detection model. In response to the above challenges, we propose a privacy-aware (P) transaction fraud detection model with low (L) communication costs (C) under a vertical and horizontal joint federated learning framework in this paper, named PLC. Specifically, we merge horizontal federated learning and vertical federated learning to build a normal behavior model to improve the fraud detection performance for solving the first challenge. Meanwhile, we design a sparse factor-based SMC aggregation method to reduce communication costs without sacrificing detection performance for solving the second challenge. The experimental results show that the communication costs can be reduced by 46.7% and 55.4% under the ECC dataset and the Vesta dataset, respectively. The ablation experiment results show that our proposed method can provide good privacy protection performance with a small sparse factor. Our proposed fraud detection model can significantly improve the fraud detection performance under the joint federated learning framework.

Internet of Vehicles (IoV) improves traffic safety and efficiency by wireless communications among vehicles and infrastructures. To ensure secure communications in IoV, the problem of vehicle identity security must be solved before deployment. In this article, we propose a quick-response behavior-based vehicle identity verification method, called VLOG, for solving identity theft in IoV. This method is based on the idea of a vehicle usually having relatively stable traveling habit/behaivor. If we detect unusual behavior, the vehicle's identity may be stolen. VLOG captures vehicles’ latent behavior models from local and global two aspects, and further merges local and global models into a comprehensive behavior-based identity verification model. In the local part, we give a 2-D Gaussian model to fit the behavior data. In the global part, we learn vehicles’ traveling preferences under secure multiparty computation framework with considering the behavior volatility. The results of experiments based on a real-world vehicular trace dataset show the best performance of VLOG in terms of accuracy, F1 score, and cost. Meanwhile, VLOG also performs well in the area under the curve and precision-recall curve. Besides, since our model is preprepared, when a vehicle is required to be detected, the verification response time is short.

Federated learning is usually utilized as a fraud detection framework in the domain of financial risk management, which promotes the model accuracy without training data exchange. One of the challenges in federated learning is the GAN-based poisoning attack. The GAN-based poisoning attack is a type of intractable poisoning attack that causes global model accuracy degradation and privacy leak. Most of the existing defenses for GAN-based poisoning attack have the three problems: 1) dependence on validation datasets; 2) incompetence of dealing with incremental poisoning attack; and 3) privacy leak. To address the above problems, we present a privacy-aware and incremental defense (PID) method to detect malicious participants and protect privacy. In PID, we design a method to accumulate the offset of model parameters from participants in all current epochs to represent the moving tendency for model parameters. Thus, we can distinguish the adversaries from normal participants based on the accumulations in this incremental poisoning attack. We also use multiple trust domains to reduce the rate of misjudging benign participants as adversaries. Moreover, a differentiated differential privacy is utilized before the global model sending to protect the privacy of participants’ training datasets in PID. The experiments conducted on two real-world datasets under financial fraud detection scenario demonstrate that the PID reduces the fallout of adversaries detection (the rate of misjudging benign participants as adversaries) by at least 51.1% and improve the speed of detecting all malicious participants by at least 33.4% compared with two popular defense methods. Besides, the privacy preserving of PID is also effective.

Nowadays, a lot of studies unite multiple organizations to form an anti-fraud alliance to detect fraudulent transactions better using federated boosting tree algorithms. However, there are two challenges when building the federated boosting tree-based fraud detection model. First, the vertical federated learning (VFL) framework is not enough for the transaction fraud detection task because there are various participants in the same field (e.g., different banks) who cannot share data with others freely. And a lot of local data would be discarded due to the private set intersection process under the VFL framework. Second, there are still many privacy threats that can infer the data sequence information of the participants. Once the attackers illegally obtain the data sequence information, they can infer the raw data of the victims based on the data distribution. Specially, the instance spaces and score lists would also be maliciously exploited to launch a new data sequence inference attack that is currently indefensible. In response to the above challenges, we first propose a sequence inference attack that is the first work showing the vulnerabilities regarding the instance spaces and score lists. Then, we propose a federated boosting tree-based fraud detection method against (A) sequence (S) inference (I) attacks (A), named ASIA. ASIA method can combine the horizontal federated learning (HFL) framework with the VFL framework to better detect fraudulent transactions while defending against sequence inference attacks. Finally, we evaluate SIS attack and ASIA method in experiments based on two public fraud detection datasets: European Credit Card (ECC) and IEEE-CIS Fraud Detection (Vesta). The experimental results show that the sequences of the participants are at a high risk of being leaked when suffering SIS attack. Moreover, compared with several widely used federated boosting tree methods, ASIA method can significantly improve privacy-preserving performance without sacrificing fraud detection accuracy.

With the development of 5G technology, mobile edge computing (MEC) is introduced into the construction of internet of vehicles (IoV). However, the distributed denial of services (DDoS) attacks become a serious problem in IoV under MEC. Although numbers of studies have been done on DDoS detection in common wired or wireless networks, they cannot satisfy the high dynamic requirement and cannot cope with the complex and diverse DDoS attacks in IoV. Fortunately, the data traffic flows in IoV exist potential and predictable space-time regularities. By employing reinforcement learning, we propose a feature adaption reinforcement learning approach based on the space-time flow regularities in IoV for DDoS mitigation, named FAST. In FAST, we elaborately design a combinational action space, and a reward function based on Kalman filter method and historical data traffic flows, which can make FAST to recognize DDoS attacks more quickly and accurately. Then through combining Q-learning and DDQN, FAST can select features and disconnect DDoS attacks adaptively according to the changes of the environment. In experiments, we evaluate the performance of FAST based on Shenzhen taxicab dataset. We simulate and inject DDoS attacks into Shenzhen taxicabs through two DDoS simulation tools named ‘ddosflowgen’ and ‘hping3’. The experimental results show that FAST has a high quality in detecting multiple types of DDoS attacks compared with other detection methods.