FLoV2T: A fine-grained malicious traffic classification method based on federated learning for AIoT

Abstract

With the rapid development of Artificial Intelligence of Things (AIoT), the network security risks associated with AIoT have surged, making precise fine-grained malicious traffic classification (MTC) technology essential, but the reliance on large datasets raises privacy concerns. Federated Learning (FL) offers a privacy-preserving alternative, but existing FL-based solutions still suffer from suboptimal classification accuracy, limited terminal resources, and the non-independent and identically distributed (non-IID) IoT data that hinder effective global model aggregation. To address these issues, this paper introduces FLoV2T — a FL-based fine-grained MTC method for AIoT. To improve classification performance, we first employ a pretrained Vision Transformer (ViT) to extract discriminative features by visualizing raw network traffic as images, thereby tackling the problem of inadequate feature representation. To alleviate the burden of resource constraints and high communication costs, we then implement a local parameter fine-tuning mechanism based on Low-Rank Adaptation (LoRA), significantly reducing the parameter for model learning and communication at the edge. Furthermore, to counteract the model bias towards clients’ non-IID data on model aggregation, we design a regularized parameter aggregation strategy to enhance global model robustness. Experimental results show that FLoV2T achieves an average accuracy of 97.26% and an F1 score of 96.99%, surpassing the baseline by 10.94% and 11.47%. Moreover, LoRA reduces parameter count by approximately 64 times while maintaining high classification performance, and under non-IID conditions, overall performance reaches an average accuracy of 96.17% and an average F1 score of 95.81%, underscoring FLoV2T’s potential in future AIoT communication networks.