Securing the edge: privacy-preserving federated learning for insider threats in IoT networks

Insider threats in Internet of Things (IoT) networks pose significant risks, as compromised devices can misuse their privileges to cause substantial harm. Centralized methods for insider threat detection in IoT devices are critical for identifying and mitigating insider risks. User behavior, such as access patterns, login times and data transmission, is profiled using machine learning algorithms to detect deviations that may indicate insider risks. However, training a model that generalizes across different data sources is challenging due to data heterogeneity, which can lead to a drift in performance. This paper introduces a decentralized approach called federated learning (FL) to address these challenges. An advanced privacy-preserving method is proposed for detecting and reducing insider threats in IoT devices. The process begins with a trust authority generating a random digital certificate using the hybrid Rivest-Shamir-Adleman and elliptic curve digital signature algorithm for IoT user registration. Node clustering is performed using the ordering points to identify the clustering structure with centroid refinement algorithm, ensuring data privacy by transmitting only cluster heads to local models. Additionally, the federated automatic weight optimization hash-based message authentication code with secure hash algorithm is introduced to further strengthen protection. The experimental results show accuracy rates of 98.85% on the simulated dataset and 83.74% on the X-IIoTID test dataset. These finding facilitates the effectiveness of the proposed solution in terms of accuracy, time, throughput, node scalability and overall performance. The results indicate that the proposed model outperforms other prominent approaches in the field.