ROCHE: A Robust and End-to-End Privacy-Preserving Federated Learning Framework for Intrusion Detection in Industrial Internet of Things

Abstract

The Industrial Internet of Things (IIoT) has revolutionized industrial automation, enabling real-time monitoring and intelligent decision-making. However, the increasing connectivity of IIoT devices exposes them to cyber threats, necessitating robust intrusion detection systems (IDSs). Traditional centralized IDS solutions face concerns regarding the sharing of sensitive data, high computational costs, and communication overhead. Federated learning (FL) provides a privacy-preserving alternative to such centralized systems. However, existing FL-based IDS frameworks may face challenges such as high resource consumption and privacy threats, such as gradient leakage from shared updates. To address these challenges, we propose robust optimization for encrypted FL (ROCHE), a lightweight FL-based IDS optimized for IIoT, which ensures data privacy and efficiency. ROCHE uses low-degree polynomial approximations to replace complex activation functions (AFs), reducing computational load without significantly impacting accuracy. An adaptive quantization mechanism is utilized to reduce bandwidth consumption while ensuring accurate model convergence. To preserve data privacy during model aggregation, ROCHE integrates symmetric homomorphic encryption (HE), enabling secure model updates while maintaining resilience to user dropout. Comprehensive security analysis and experiments demonstrate that ROCHE outperforms state-of-the-art frameworks. Compared with MiTFed, ROCHE reduces computational overhead by 11% and lowers communication cost by 16%, demonstrating its efficiency in optimizing resource utilization while maintaining robust privacy preservation in FL-based IDS. In addition, ROCHE maintains an average accuracy of over 90% across multiple attack types. Deployment in a cloud-based IIoT environment demonstrates its feasibility, establishing ROCHE as a scalable and efficient IDS for IIoT security.