Feature-Attended Federated LSTM for Anomaly Detection in the Financial Internet of Things

Abstract

Recent years have witnessed the fast development of the Financial Internet of Things (FIoT), which integrates the Internet of Things (IoT) into financial activities. At the same time, the FIoT is facing an increasing number of stealthy network attacks. Long short-term memory (LSTM) can be used as an anomaly-detecting method to perceive such attacks since it specializes in discovering anomaly behaviors through the time correlation in FIoT traffic. However, current LSTM-based anomaly detection schemes have not considered the specific correlations among the features of the whole traffic. In addition, current schemes are usually trained based on local traffic with rare cooperation among different detecting nodes, leading to the result that current schemes usually suffer from insufficient adaptability and low coordination. In this paper, we propose a feature-attended federated LSTM (FAF-LSTM) for FIoT to address the above issues. FAF-LSTM combines feature-attended LSTM and federated learning to make full use of the deep correlation in data and enhance the accuracy of the trained model via cooperation among different detecting nodes. In FAF-LSTM, the features are grouped so that the model can learn the time–spatial correlation inner the flows of each group as well as their impact on the output. Meanwhile, the parameter aggregation is optimized based on feature correlation analysis. Simulations are conducted to verify the effect of FAF-LSTM. The results show that FAF-LSTM has good performance in anomaly detection. Compared with independently trained LSTM and traditional federated learning-based LSTM, FAF-LSTM can improve the detection accuracy by up to 39.22% and 334.36%, respectively.