A privacy-preserving federated graph learning framework for threat detection in IoT trigger-action programming

Trigger-Action Programming (TAP) is a common user-programming paradigm in Internet of Things (IoT) smart home platforms, allowing users to create customized automation rules to match IoT devices and network services. However, the potential security threats associated with TAP rules are often overlooked or underestimated by users. To address this issue, we propose PFTAP, a novel federated graph learning framework for threat detection of TAP rules while simultaneously protecting user data and privacy. First, we propose a hierarchical graph attention network. This network comprises intra-rule attention and inter-rule attention modules, which enable the learning of comprehensive feature representations for triggers and actions. By capturing the intricate relationships between different rules, the network enhances the detection accuracy of risky TAP rules. Moreover, our framework is based on federated learning and integrates symmetric encryption and local differential privacy techniques, aiming to safeguard user privacy from unauthorized access or tampering. To evaluate the effectiveness of our framework, we conduct experiments using an extensive dataset of IFTTT rules. The experimental results convincingly demonstrate that PFTAP outperforms state-of-the-art methods in terms of threat detection performance.