Timely Anomalous Behavior Detection in Fog-IoT Systems using Unsupervised Federated Learning

Abstract

In an Internet of Things (IoT) system, fog computing can analyze data faster than the cloud because it is closer to the sensors. However, fog nodes can suffer attacks and vulnerabilities, needing to monitor their abnormal behaviors. Machine learning (ML) enables the fog to identify its behaviors, but processing ML can delay its time-sensitive tasks. Federated learning (FL) can provide a fog-based IoT system to learn every fog node behavior faster and accurately. Therefore, we propose an unsupervised FL system to detect fog anomalies, and we simulate different performance behaviors for two fog nodes (A and B) during seven rounds of 4-minutes each. When a round starts, the fog nodes perform k-means and send local centroids to the cloud, which merges them into global new centroids sending them back to the fog. We evaluate the time that Fog B needs to predict a behavior already identified by Fog A correctly and verify that it amounts to 30 milliseconds using our system. In contrast, a non-federated approach must wait for the current round to end, which can take minutes.