A novel approach for continual and federated network anomaly detection

A novel approach for continual and federated network anomaly detection Pedro R. Tomas12, Pedro Felix1, Luis Rosa1, Andre S. Gomes1, and Luis Cordeiro1 1One Source Consultoria Inform´atica Lda, Rua D. Jo˜ao de Castro Lote 12, Coimbra, Portugal, {pedro.tomas,pedro.felix,luis.rosa,gomes,cordeiro}@onesource.pt 2Departamento de Engenharia Inform´atica, Universidade de Coimbra, Portugal Abstract. Nowadays, systems present an ever-increasing surface area, decentralised nature of the distributed systems and data privacy concerns, among other characteristics, making security a primary concern. Being able to identify anomalous traffic in such challenging conditions while ensuring the privacy of the analysed data is quite a challenging task. This work presents a combination of a Federated Learning-based approach with continual learning using unsupervised machine learning techniques for network anomaly detection. This also includes the discussion of a Holistic Security and Privacy Framework and its evaluation in a Kubernetes environment. Indeed, the Continual Learning concepts were applied to enable a quick adaptation to the ever-changing network traffic characteristics by performing frequent training sessions with the existent Machine Learning models, which are supported by collected data, whilst simultaneously performing network anomaly detection and never exposing the original network information. For its evaluation, we validated it using a micro-services-oriented application, where the generated normal traffic was used to train the different Machine Learning models, which were trained in several training periods and frequencies. In addition, we considered four different types of attacks: Denial of Service, Port Scan, Brute Force and SQL Injection to further evaluate the capability of the detection module to distinguish normal and anomalous traffic. Throughout the different validation scenarios, the detection module achieved an f1-score of 93.80% for one of the targeted components and a percentage of normal flows correctly identified of 99,13%. Keywords: anomaly detection; unsupervised machine learning; autoencoders; federated learning; continual learning 1 Introduction In an era dominated by interconnected systems and digital dependencies, the security of network infrastructures stands as a paramount concern. The escalating sophistication of cyber threats has reduced the effectiveness of conventional 2 Pedro Tomas et al. security measures such as firewalls and VPNs, prompting a critical reassessment of defensive strategies. Recognising the dynamic nature of contemporary cybersecurity challenges such as phishing, brute force, DDoS attacks (among others) becomes an important factor. To tackle such issues, this paper presents a security framework founded on Federated Learning (FL) principles and Continual Learning (CL) devoted to network traffic anomaly detection. The choice of these techniques comes from the protection of data that is imposed from FL, keeping the communications of whoever is involved clear from passage across network channels, while CL comes as a solution for the ever-evolving nature of network configurations, keeping the model-trained with the latest network information. The proposed Holistic Security and Privacy Framework (HSPF), tailored for Kubernetes [8] environments, can accompany any type of micro-services composing of an application through an injection script which introduces our solution as a sidecar container for the defined services. With its insertion on a micro-service, our multiprocessing execution is able to process the evolution of multiple application models, classifying ongoing service traffic and refining the models, all while using an unsupervised method where patterns are learnt exclusively from unlabelled data. To the best of our knowledge, the combination of CL, FL, and unsupervised ML techniques for network traffic anomaly detection has not been extensively investigated in the literature. This paper discusses their relevance, how they can be combined and presents a novel framework to leverage such techniques. As aforementioned, such a kind of framework is increasingly needed to allow effective network anomaly detection in distributed Cloud Native environments. This paper is structured as follows: Section 2 presents a brief literature review; Section 3 details the proposed approach, describing the internal behaviour of each HSPF component, how these work together and how the concepts of CL, FL and unsupervised ML integrate the framework; Section 4 presents the evaluation scenario and the obtained results; Section 5 presents the discussion on the topic. Finally, Section 6 presents the final remarks. 2 Related Work Viraaji et al. [9] introduce a supervised FL-based approach for time-series anomaly detection using GRUs and a Random Forest ensemble. They compare Gated Recurrent Units (GRU) and Long Short Term Memory (LSTMs), with GRUs outperforming in accuracy and computational efficiency. Their approach is evaluated in a virtual scenario with edge devices and a central aggregator, and the Modbus-based network dataset is used. Results indicate that the FL approach achieves higher accuracy in fewer epochs, sometimes only requiring 50% of training time when compared to the central one. On average, FL achieves 90.26% accuracy vs. 86.13% for non-FL. The authors suggest using pre-trained models with known attacks for real-world scenarios. Brett et al. [14] studied data augmentation’s role in enhancing GAN performance in IoT anomaly detection within an FL approach. They examined A novel approach for continual and federated network anomaly detection 3 four augmentation methods (RAND, STRAT, SMOTE, ADASYN) across three datasets (Modbus, Weather, DS2OS). STRAT consistently outperformed the remaining approaches for the Modbus dataset, achieving a minimum f1-score of 57.31% with 100 clients. STRAT and RAND yielded better results for the Weather and DS2OS datasets (evaluated with 100 clients only). The authors found that FL can be more advantageous for learning from datasets with a lower proportion of anomalies, as partitioning the instances to clients and making smaller incremental updates can lead to accurate models. The authors claim that data augmentation can enhance ML algorithms’ performance. Xiaofeng et al. [13] introduce an innovative anomaly detection method for IoT networks using deep neural networks (DNNs) and federated learning (FL). They enhance their approach by using mutual information (MI) for feature selection while also focusing on the privacy concerns linked to IoT devices that transfer sensitive data over the internet. They evaluated their approach with the BoTIoT dataset and obtained an accuracy of 98.5%, a true positive rate of 99.2%, a true negative rate of 97.8%, and an F1 score of 0.986. The primary outcome of this study is that the proposed approach using DNNs and FL with MI can effectively detect anomalies in IoT networks with high accuracy and without compromising the privacy of individual devices. Meryem et al. [7] introduce Fed-ANIDS, a FL framework for anomaly-based network intrusion detection systems using Autoencoders. It addresses the limitations of centralised ML-based AD methods by preserving data privacy and handling heterogeneous datasets. They evaluated the framework with three datasets (USTC-TFC2016, CIC-IDS2017, CSE-CIC-IDS2018), three Autoencoder variations (AE, VAE, AAE), and two local model aggregation approaches (FedAvg, FedProx). For USTC-TFC2016, AAE with FedProx achieved the best result, with an f1-score of 99.94%. For CIC-IDS2017, a simple AE with FedProx outperformed others, with a 92.73% f1-score, whilst for CSE-CIC-IDS2018, a VAE with FedProx reached 90.65% f1-score. The proposed approach consistently outperforms baseline algorithms, highlighting FedProx’s effectiveness. The authors emphasise the feasibility of using Autoencoders for large-scale intrusion detection systems. Vucovich et al. [12] presented an FL anomaly detection framework, whose detection is assured by the use of an AutoEncoder and of a binary classifier. The authors present a novel aggregation mechanism, FedSam, which corresponds to a combination of Mini-Batch and Multi-Epoch FedAvg strategies. The authors evaluated the performance of their approach with the CIC-IDS2017, CIC-IDS2018, National Collegiate Cyber Defense Competition (NCC-DC), and MAWI-Lab datasets. The authors compared the performance of a centralised with a distributed approach, with the former presenting average classifications of 60% precision, 58% recall and 57% f1-score, and the latter presenting average classifications of 70% precision, 69% recall and 68% f1-score. The use of their min-max scalar improved results in a drastic manner, as precision averaged 87%, recall averaged 86% and f1-score averaged 86%. The best results were achieved when combining their min-max scalar approach and the FedSam aggregation 4 Pedro Tomas et al. strategy, achieving results in the order of 91% precision, 91% recall and 91% f1-score. Amalapuram et al. [1], explored the application of CL to improve the performance of Anomaly-based Network Intrusion Detection Systems (A-NIDS). The authors identify several challenges, namely Catastrophic Forgetting (CF) and Class Imbalance (CI), stating that the most common ML approaches used in NIDS systems suffer from CF and also that the majority of the existing datasets to train NIDS systems present CI, often impacting the ability of the ML models to detect attacks correctly. The authors explore the application of three CL algorithms: Elastic Weight Consolidation (EWC), Gradient Episodic Memory (GEM) and a Na¨ıve CL algorithm in conjunction with two NN architectures: Multi-Layer Perceptron (MLP) and a Convolutional Neural Network (CNN) and seek to evaluate the performance of such combinations, for different tasks, using CIC-IDS2017 and CSE-IDS-2018 datasets. The authors define several set of tasks presenting scenarios of Class Incremental Learning (CIL) and Domain Incremental Learning (DIL). Beyond the usual four evaluation metrics (accuracy, precision, recall, f1-score), the authors also consider Relative Experience Forgetting (REF) and recurrently calculate its value to understand which combination presents a better resilience to CF and how that effect resembles with the final classification performance when such combinations are initially trained with a set of tasks, then continue to train with another set of tasks for several training iterations and are then faced with the initial set of tasks. The authors find that CIL is more susceptible to Task Execution Order Sensitivity (TEOS) than DIL, with DIL resembling real-world traffic patterns and, when combined with advanced memory population strategies, presenting as the most suitable approach for network traffic anomaly detection. Wiewel et al. [15], explored the problem of catastrophic forgetting when training a Variational Autoencoders (VAE) on continually growing data. being that they propose an extension for CL to this anomaly detection problem. For evaluation purposes they utilise MNIST and KDDCup99. In order to verify the patterns which characterise anomalies deviation from normal data, they have a focus on temporal changes of the definition of normal data as in normal approaches utilise a certain dataset Difor the i-th round which, in the long term, leads to this catastrophic forgetting. To deal with this they built a generator called R which is trained with all the previous retrieved data in a form of generating a normal data distribution for the old information. This generated data is then used with the current data in use to form an expanded training dataset which contains data from the current and all previous tasks. In order to evaluate the previously mentioned datasets they used differently size layered VAEs. Across their evaluation they concluded that this solution brought better overall results for the KDDCup99 dataset. On the one hand, the majority of the existing approaches used for network anomaly detection rely on supervised ML techniques, that usually present good classification performances when facing known anomalies, however, these present a considerable handicap when it comes to training such models on the fly due A novel approach for continual and federated network anomaly detection 5 to the need for considerably large datasets for the process. On the other hand, and although unsupervised ML-based approaches have given proof of detecting anomalies that fall outside the normal patterns, the existing literature usually does not use or combine such approaches with CL and/or FL techniques, which we do. In addition, unlike normal Federated-based ones, our approach utilises real-time retrieved data for training purposes to maintain toe-to-toe with the extensiveness and continuous changes in the network communications. As demonstrated later in this paper, our solution can be said to run as if in a real-world environment. 3 Continual and Federated Network Anomaly Detection FL enables multiple actors to build a common robust Machine Learning (ML) model without needing to share private data. The normal participants in this approach are a central server unit and various client units. The Client units are responsible for carrying out local training on local information and then, in each trained round, share the trained model weights with the Server. The central Server then takes the job of aggregating the information which is passed from the federated clients and then redistributes the updated model. In our approach, we leverage the functionalities provided by the Flower FL framework [4] and the NFStream network data collection [11]. Our solution is composed of three main components: Collector, Agent and Aggregator. Integrated with existing applications, the Collector, and Agent collaboratively gather and classify network traffic while continually refining their understanding through unsupervised ML, being that the pair of them represent the client unit. Meanwhile, the Aggregator, positioned as the framework central server, takes charge of managing and coordinating the evolving multiple application models. This behaviour is shown in Figure 3. In this section we further describe the different components of the framework along with their main functions, starting from the federated training to the classification of the analysed network information, and finally going through the framework implementation on cloud environments. 3.1 Continual Federated Training The HSPF Collector component continuously collects network traffic, which is then shared with the HSPF Agent. The HSPF Agent trains the local ML model every time the Aggregator initiates a federated training round. On completion of the training round, the Agent evaluates the performance of the aggregated model, shares it with the Aggregator and finally updates its model with the newest one (in case it presents better performance). To continuously train the ML model, several steps need to be taken, namely the standardisation of the collected data and the classification of the network traffic based on the reconstruction error provided by the algorithm. The standardisation is conducted with the application of the usual standardisation for- 6 Pedro Tomas et al. mula, where each value (part of each flow), has the mean (of all the values of that feature) subtracted, and then divided by the respective standard deviation. The threshold applied when classifying the network traffic was calculated based on the upper fence of values distribution and the mean value of the whole data, in order to take into account values which would deviate from the normal information. Being the formula used threshold =µ+ (x∗σ), where µand x correspond to the arithmetic average of the reconstruction errors obtained during the first training iteration and σto the standard deviation of the reconstruction errors. Due to the high variance of reconstruction errors, a Range-based outlier approach has been applied, corresponding to the difference between the 75% percentile and the 25% percentile of the data, with the values outside of this interval being removed. 3.2 Continual Analysis of Network Traffic The HSPF Collector component continually collects network traffic, which is shared with the co-located HSPF Agent, in charge of performing the analysis of the network traffic. Such analysis starts immediately after the first trained model (for the micro-service in question) being available, which may take place after the first local training or after the reception of an already trained model from the HSPF Aggregator, should it exist. To distinguish between normal and anomalous flows, the HSPF Agent, considers the reconstruction error provided by the Autoencoder model, which is then compared to a threshold whose definition has been previously explained. If the reconstruction error is lower or greater than this threshold, the flow is classified as normal or anomalous, respectively. 3.3 From anomalies to attack classification To reinforce the trust level in the HSPF detection module, a classification process was developed to classify the detected anomalies into attacks, while diminishing the potential effects that a misclassification might have. This process is carried out by the Agent, which contains two lists: a greyed list, which is used as a grey zone for IPs that have already been in the origin of anomalous traffic but have not yet been blocked, and a blocked list, where the blocked IPs are registered. Upon identifying an anomaly, which happens when a flow (or set of flows) is classified as anomalous traffic, the Agent will verify if the Source IP of the identified flow is already marked as greyed in the internal list. In cases where the IP is not in the greyed list, it is added, and the respective counter of occurrences is set to 1. On the other hand, if the IP is already in the list, the respective entry is incremented by 1, and the counter value is compared with a threshold. Whenever the counter exceeds the threshold, a message is sent reporting the incident. This process is presented in Figure 1. There is also a periodic task in charge of cleaning both internal lists, which is illustrated in Figure 2. IPs are removed from the blocked list if the last detected anomalous flow happened Nhours ago (configurable value). For the greyed list, A novel approach for continual and federated network anomaly detection 7 Fig. 1. HSPF: From anomalies to attacks counters associated with each IP are decreased on each execution of this task. It must be noted that all thresholds, periodicity intervals and increase/decrease values may be defined while deploying the framework, thus allowing this process to be tailored to the needs of the infrastructure where this framework will be deployed. Fig. 2. HSPF: From anomalies to attacks (cleaning strategy) 3.4 Cloud-Native Implementation The HSPF is composed of three main components: (i) Aggregator, (ii) Collector, and (iii) Agent. The Aggregator corresponds to the main framework Unit, being responsible for coordinating the Federated Training procedure, as well as for performing the management and distribution of the different ML models used for anomaly detection by the different federated agents. The Agent component, where the federated agent resides, is responsible for inferring the inbound and outbound traffic and training accordingly, being the network traffic collected by the Collector. Both components, the Agent and the Collector, are injected as sidecars next to any existing container where the to-besecured application is executing. Figure 3 presents the HSPF functional architecture. The figure highlights the more relevant interactions between the HSPF 8 Pedro Tomas et al. Fig. 3. HSPF Architecture components, which take place in the following order (although they are not consecutive): –Retrieve of network information –Handling local data –Perform inference over local data –Train local ML model –Exchange weights with central federated unit –Receive updated ML model 4 Evaluation and Results 4.1 Scenario description In order to validate the correct behaviour of the HSPF framework, the microservices oriented Mobitrust [5] application was used. Ten simulated devices were employed in the experiment, with each device producing data from six distinct IoT sensors: a geo-location sensor, gas sensor, internal controller, wearable Tshirt sensor, camera sensor, and critical organs sensor. The geo-location sensor transmitted coordinate updates every 60 seconds, while the gas sensor provided data on gas and temperature measurements every second. The smart T-shirt sensor emulated data collected by a Hexoskin T-shirt [6], offering information on temperature, heart rate, respiratory rate, and battery levels. The camera sensor replicated real video transmission by simulating the video stream using a dummy file. The critical organs sensor conveyed data concerning heart rate, body temperature, respiratory rate, carbon dioxide levels, and battery status, which in a practical setting would be gathered by a Bitalino device [2]. These generated messages were published to the internal Mobitrust message broker and subsequently reached the Mobitrust Portal after undergoing through preprocessing and storage in a database. To evaluate the performance of the HSPF detection module, different training periods were considered, as present in Table 1. Beyond the single train followed A novel approach for continual and federated network anomaly detection 9 by the injection of simulated attacks, experiments were also conducted to try to understand the cumulative effect of training (i.e., two rounds of training with normal data followed by the injection of attacks) on the performance of the detection module. Table 1. Training intervals Single Cumulative 2h 2h+2h 4h 4h+4h 6h 6h+6h 8h 8h+8h Three types of attacks were simulated against the Mobitrust services: DDOS, Brute Force and SQL Injection. The first was conducted with the mqtt-stresser [10] tool and targeted the message-broker component, whilst the second and the third both targeted the mt-gateway component and were conducted with curl[3], recurring to a set of most common usernames and passwords, as well as to recurring commands attempted during SQL Injection. 4.2 Results The results from the different experimentation scenarios are presented in this section. The results have been grouped with each table presenting the results for the single and cumulative scenarios for a specific number of hours, with the amount of True Positives (TP), True Negatives (TN), False Positives (FP) and False Negatives (FN) being detailed in each table, for a sub-set of Mobitrust micro-services. Table 2 presents the results for the scenarios with two hours. For the single scenario, the detection module correctly identified 91,43% of the malicious flows targeting the message-broker and the gateway components. Despite this and impulsed with a high number of FP, the achieved f1-score values for the mentioned components were of 86.50% and 55,00%, respectively. As for the cumulative scenario, the detection module correctly identified 99,39% of the malicious flows and the achieved f1-scores were of 63.10% and 58,50%, respectively. For the monitor, orchestrator and postgresql micro-services, the detection module misclassified 3.55%, 5,04% and 20,41% normal flows for the single scenario and 7,44%, 9,82% and 18,96% normal flows for the cumulative scenario, respectively. Table 3 presents the results for the scenarios with four hours. For the single scenario, the detection module identified 35.25% of the malicious flows, a considerable low percentage, caused by the mis-classification of the malicious flows targeting the message-broker component. Such classification rate improved during the cumulative scenario, with 91.66% of the malicious flows being correctly identified. The normal flows incorrectly classified as attacks for the monitor, orchestrator and postgresql micro-services were of 2.27%, 3.46% and 14.90% for