Posted by Admin: System Admin
Nowadays, blockchain-based technologies are being developed in various industries to improve data security. In the context of the Industrial Internet of Things (IIoT), a chain-based network is one of the most notable applications of blockchain technology. IIoT devices have become increasingly prevalent in our digital world, especially in support of developing smart factories. Although blockchain is a powerful tool, it is vulnerable to cyber attacks. Detecting anomalies in blockchain-based IIoT networks in smart factories is crucial in protecting networks and systems from unexpected attacks. In this paper, we use Federated Learning (FL) to build a threat hunting framework called Block Hunter to automatically hunt for attacks in blockchain-based IIoT networks. Block Hunter utilizes a cluster-based architecture for anomaly detection combined with several machine learning models in a federated environment. To the best of our knowledge, Block Hunter is the first federated threat hunting model in IIoT networks that identifies anomalous behavior while preserving privacy. Our results prove the efficiency of the Block Hunter in detecting anomalous activities with high accuracy and minimum required bandwidth. Machine learning is an important component of the growing field of data science. Through the use of statistical methods, different type of algorithms is trained to make classifications or predictions, and to uncover key insights in this project. These insights subsequently drive decision making within applications and businesses, ideally impacting key growth metrics. Machine learning algorithms build a model based on this project data, known as training data, in order to make predictions or decisions without being explicitly programmed to do so. Machine learning algorithms are used in a wide variety of datasets, where it is difficult or unfeasible to develop conventional algorithms to perform the needed tasks.
The research by Sayadi et al. [15] proposes an algorithm for anomaly detection over bitcoin electronic transactions. They examined the One-Class Support Vector Machines (OCSVM) and the K-means algorithms to group outliers similar in both statistical significance and type. They analyzed their work by generating detection results and found that we could obtain high-performing results on accuracy. In [16], the authors suggested an approach based on the semantics of anomalies in blockchain-based IoT Networks. A method was presented to detect anomalous behavior in blockchain that gathers metadata in forks to determine mutual informational recognition of anomalous activity. They developed a tool that improves blockchain security and connected devices. Also, in [17], has introduced encoder-decoder deep learning regression for detecting blockchain security. This work developed an anomaly detection framework that relies on aggregate information derived from bitcoin blockchain monitoring. Their experiments have demonstrated that their model can detect publicly reported attacks using the historical logs of the Ethereum network. Chai et al. [22] proposed a hierarchical blockchain framework and FL to learn and share environmental data. This framework is functional and efficient for large-scale vehicular networks. FL-based learning meets the Internet of Vehicles’ distributed pattern and privacy requirements. Sharing behavior is modeled as a multi-leader, multi-player trading market process to stimulate knowledge sharing. Simulated results indicate that an algorithm based on hierarchical structures can enhance sharing, learning, and managing specific malicious attacks. Furthermore, the authors in [23] deliver a comprehensive investigation on how FL could supply better cybersecurity and prevent various cyberattacks in real-time. This work highlights some main challenges and future directions on which the researchers can focus for adopting FL in real-time scenarios. Disadvantages ? The system is not implemented the Isolation Forest (IF) model which falls under the Tree-based anomaly detection algorithms category. ? The system is not implemented Cluster-Based Local Outlier Factor.
Detecting anomalous activities is a significant contributor to automatically protecting a system from unexpected attacks. Anomalies in blockchain must be detected by sending each block of data to a central server for each block update. This is not efficient and also imposes privacy concerns. FL solutions are promising in tackling this issue. We use FL to update the model frequently and to obtain a global model for detecting an anomaly. After learning about each smart factory’s data, devices, and service provider, the model’s parameters will be sent to the parameter server for aggregation and to update our general model. Cluster based architecture provides more efficient use of resources and throughput during the blockchain run in each smart factory. Clustering reduces the computational complexity in the creation of the underlying network through a hierarchical approach. Advantages Federation Construction: The subset of smart factory members, cluster, selected to receive the model locally. Decentralized Training: When a cluster of smart factories is selected, it updates its model using its local data. Model Accumulation: Responsible for accumulating and merging the data models. Data is not sent and integrated from the federation to the server individually. Model Aggregation (FedAvg): Parameter server aggregates model weights to compute an enhanced global model.