A Federated Learning-based IoT Threat Detection System that uses distributed machine learning to detect malware and network attacks in IoT devices while preserving data privacy.
This project implements a federated learning framework for IoT threat detection using the N-BaIoT dataset. The system trains neural network models across multiple IoT devices without centralizing sensitive data, enabling collaborative threat detection while maintaining privacy.
FL-IoT-Threat Detection/
├── Core Components
│ ├── server.py # Federated learning server (Flower)
│ ├── client1.py # FL client for device 1
│ ├── client2.py # FL client for device 2
│ ├── model.py # Neural network architecture
│ └── api_server.py # REST API backend for dashboard
├── Frontend Dashboard
│ └── frontend/ # Vue.js + TypeScript dashboard
│ ├── src/views/ # Dashboard pages
│ ├── src/services/ # API integration
│ └── src/components/ # Reusable UI components
├── Real-time Detection
│ └── RealTimeService/
│ ├── realtime_pipeline.py # Real-time threat detection pipeline
│ ├── threat_predictor.py # ML-based threat prediction
│ ├── feature_extractor.py # Network feature extraction
│ └── monitor.py # Continuous monitoring service
├── Analysis & Training
│ ├── analysis.ipynb # Data analysis and exploration
│ ├── reduucedTrain.ipynb # Training with reduced dataset
│ ├── devicewise_analysis.ipynb # Device-specific analysis
│ └── federated_learning.py # Custom FL implementation
├── Data Simulation
│ └── samplePackets/
│ └── packet_simulator.py # IoT traffic simulation
└── Results & Models
├── SavedGlobalModel/ # Trained federated models
├── Results/ # Performance metrics & plots
└── Logs/ # Training and evaluation logs
- Real-time Monitoring: Live dashboard with system metrics and status
- Model Management: Track training progress and model versions
- Metrics Visualization: Charts and graphs for performance analysis
- Event Timeline: Comprehensive system event tracking
- Logs Viewer: Filterable logs with error/warn/info levels
- Configuration UI: Manage system settings through web interface
- Privacy-Preserving: Train models without sharing raw data
- Distributed Training: Multiple IoT devices collaborate in learning
- Flower Framework: Production-ready federated learning implementation
- Multi-class Classification: Detects various IoT malware types
- Real-time Monitoring: Continuous network traffic analysis
- Attack Types: Gafgyt, Mirai, and other IoT botnets
- Network Feature Extraction: 115+ statistical network features
- Performance Visualization: Confusion matrices, ROC curves
- Device-wise Analysis: Individual device behavior patterns
- PCAP Processing: Live network packet analysis
- Feature Engineering: Automated feature extraction from traffic
- Threat Classification: ML-based real-time threat scoring
# Python 3.8+ required
python --version
# Install dependencies
pip install -r requirements.txtInstall frontend dependencies:
cd frontend
npm installStart the API server:
# From project root
pip install Flask Flask-CORS
python api_server.pyStart the dashboard (development):
cd frontend
npm run dev
# Access at http://localhost:5173Build for production:
cd frontend
npm run build
# Serves at http://localhost:5000 via api_server.pyStart the FL Server:
python server.pyRun FL Clients (in separate terminals):
# Terminal 1
python client1.py
# Terminal 2
python client2.pySetup the pipeline:
cd RealTimeService
python setup.pyStart monitoring:
python monitor.py --pcap-dir /path/to/pcap/filesExplore the Jupyter notebooks:
jupyter notebook
# Open: analysis.ipynb, reduucedTrain.ipynb, devicewise_analysis.ipynbThe project uses the N-BaIoT dataset containing network traffic from 9 IoT devices under various attack scenarios:
- Mirai: ack, scan, syn, udp, udpplain
- Gafgyt: combo, junk, scan, tcp, udp
- Benign: Normal IoT device traffic
- Danmini Doorbell, Ecobee Thermostat, Ennio Doorbell
- Philips Baby Monitor, Provision Security Camera
- Samsung SNH Camera, SimpleHome Security Camera
- And more...
# Neural Network Architecture
- Input Layer: 115 features (network statistics)
- Hidden Layer 1: 128 neurons + ReLU
- Hidden Layer 2: 64 neurons + ReLU
- Output Layer: 10 classes (attack types)# Federated Learning Parameters
- Rounds: 4 (configurable)
- Min Clients: 2
- Strategy: FedAvg (Federated Averaging)
- Evaluation: Accuracy, Loss metricsThe system provides comprehensive evaluation metrics:
- Accuracy: Overall classification performance
- Precision/Recall: Per-class detection quality
- F1-Score: Balanced performance measure
- Confusion Matrix: Detailed classification breakdown
- ROC Curves: True/False positive trade-offs
# Generate synthetic IoT traffic
python test_simulator.py
# Extract features from PCAP files
cd RealTimeService
python feature_extractor.py --input traffic.pcap --output features.csv# Comprehensive model testing
python test.py
# Generate evaluation reports
# Results saved to Results/ directory# Example: Integrate with existing security systems
from RealTimeService.threat_predictor import IoTThreatPredictor
predictor = IoTThreatPredictor("SavedGlobalModel/final_model.pth")
threat_score = predictor.predict_pcap("network_traffic.pcap")This project supports research in:
- Federated Learning for IoT Security
- Privacy-Preserving Machine Learning
- Real-time Network Threat Detection
- IoT Botnet Analysis
- Distributed AI for Edge Computing
New contributions are always welcome feel free to raise a issue or a PR for any bugs or new feature.
- Fork the repository
- Create a feature branch:
git checkout -b feature/new-feature - Commit changes:
git commit -m 'Add new feature' - Push to branch:
git push origin feature/new-feature - Submit a Pull Request
- N-BaIoT Dataset: UCI ML Repository
- Flower Framework: https://flower.dev/
- PyTorch: https://pytorch.org/
For questions, issues, or collaborations, please open an issue or contact the project maintainer.
Star this repository if you find it useful for your IoT security research!