An Easily Scalable Docker-Based Privacy-Preserving Malicious Traffic Detection Architecture for IoT Environments

As the Internet of Things (IoT) continues to evolve, its inherent diversity and rapid iteration pose challenges for the development and deployment of malicious traffic detection systems. This study aims to develop a scalable detection architecture that can accurately identify malicious traffic in IoT environments, while protecting user privacy. We propose a deep-learning-based model that is capable of training and updating within an IoT setting. The payload of the data packets is encoded to enhance the feature extraction capability of the model. The model is then trained using federated learning/edge computing to ensure data privacy. The final model parameters are stored in an IPFS file storage system with the corresponding hash value stored in the blockchain, ensuring the correctness of the model parameters during expansion. Experiments were conducted in a Docker environment using the CIC IoT Dataset 2022 and CIC IoT Dataset 2023. The results demonstrate that the proposed architecture achieves a pre-training accuracy of 98.6% for known abnormal traffic and 79% for unknown malicious traffic. After a few rounds of training, the accuracies improved to 99.5% and 89.4%. The model also exhibited robust performance during expansion.