A cutting-edge framework for industrial intrusion detection: Privacy-preserving, cost-friendly, and powered by federated learning

With the networking of industrially deployed facilities in distributed environments, industrial control systems (ICS) are facing an escalating number of attacks, emphasizing the criticality of intrusion detection systems. Currently, machine learning-based intrusion detection systems have been extensively researched. However, the sensitivity of ICS data poses a challenge of scarce labeled data for these systems. Additionally, distributed ICS necessitate privacy-preserving collaborative detection. To address these challenges, some solutions combining federated learning and transfer learning have been proposed. Nonetheless, these solutions often overlook the clustering characteristics of factory equipment and the constraints posed by limited computational and communication resources. Therefore, we propose GC-FADA, a chained cross-domain collaborative intrusion detection framework, to effectively address the interplay between labeled data scarcity, privacy protection, and resource constraints in ICS intrusion detection techniques. Firstly, GC-FADA used the adversarial domain adaptation scheme to train the local model to alleviate the performance limitation of intrusion detection model caused by labeled data scarcity. Then, to reduce the communication overhead between the nodes in the factory communication network and protect client privacy, GC-FADA utilizes the geographical clustering characteristics of the factory devices and proposes a FL-based grouped chain learning structure to achieve collaborative training. Finally, GC-FADA achieves privacy protection with low computational overhead by utilizing patterns from lightweight pseudo-random generators instead of complex cryptographic primitives. Extensive experiments conducted on real industrial SCADA datasets validate the effectiveness and rationality of the proposed approach, proving that GC-FADA outperforms major domain adaptation methods in terms of accuracy while reducing computation and communication costs. In the cross-domain learning task on the two data sets, the detection accuracy of our GC-FADA reaches 88.7% and 98.29% respectively, and the detection accuracy of various network attacks is mostly more than 90%.