Technical Summary: PenTiDef

Problem Statement

The transition to Industry 4.0 has expanded the connectivity of Industrial Internet of Things (IIoT) systems, creating complex environments where Intrusion Detection Systems (IDS) are critical. While Federated Learning (FL) offers a solution for collaborative model training without sharing raw data, existing approaches face three significant challenges in decentralized IIoT settings:

1. Privacy Leakage: Model updates (gradients) can leak sensitive information about local traffic and device behavior through gradient inversion or membership inference attacks.
2. Poisoning Vulnerabilities: Malicious participants can degrade global model performance by uploading manipulated updates (e.g., label-flipping, weight scaling, backdoors, or GAN-based attacks).
3. Centralized Single Points of Failure: Most existing defenses rely on centralized aggregators or semi-centralized architectures, which create trust bottlenecks and single points of failure. Furthermore, many state-of-the-art defenses (e.g., FLARE, FedCC) either require auxiliary datasets (violating privacy constraints) or suffer from instability under the non-Independent and Identically Distributed (non-IID) data distributions typical of industrial environments.

Existing solutions often address these issues in isolation. Cryptographic methods like Homomorphic Encryption (HE) and Secure Multi-Party Computation (SMPC) incur prohibitive computational overhead for resource-constrained IIoT devices. Differential Privacy (DP) offers scalability but often lacks robust poisoning defenses. Conversely, latent-space defenses often lack formal privacy guarantees or fully decentralized coordination.

Methodology

The paper proposes PenTiDef, a fully decentralized, privacy-preserving, and poisoning-resilient framework for Decentralized Federated Learning-based IDS (DFL-IDS). The architecture synergistically integrates three core components without a central server or auxiliary datasets:

1. Client-Side Distributed Differential Privacy (DDP)

To protect against gradient leakage, PenTiDef implements a DDP mechanism using stochastic Gaussian noise.

• Mechanism: Before transmission, each client $c_i$ perturbs their local model update $w_i^t$ by adding noise drawn from a Gaussian distribution: $\tilde{w}_i^t = w_i^t + \mathcal{N}(0, \sigma_i^2 I)$.
• Parameters: The noise scale $\sigma_i$ is stochastically sampled from the range $[0, 0.2]$ for each round and client to enhance robustness against adaptive adversaries. This provides formal $(\epsilon, \delta)$-privacy guarantees while maintaining model utility.

2. Latent-Space Defense Module

To detect poisoning attacks without auxiliary data, the framework employs a lightweight latent-space analysis pipeline:

• Representation Extraction: The system extracts Penultimate Layer Representations (PLRs) from both the global model and the DDP-perturbed local updates.
• Compression: An AutoEncoder (AE) compresses these PLRs into stable Latent Semantic Representations (LSRs). This compression mitigates the instability of PLRs often observed in non-IID scenarios.
• Detection: The system computes the Centered Kernel Alignment (CKA) between the global LSR and each local LSR. These similarity scores are then clustered using unsupervised K-Means (with $k=2$) to distinguish between benign and malicious updates. This approach operates without prior knowledge of the number of attackers.

3. Blockchain-Orchestrated Coordination

PenTiDef replaces the central aggregator with a permissioned blockchain layer (implemented using Hyperledger Fabric).

• Smart Contracts: Chaincode executes the entire validation logic (PLR extraction $\to$ AE compression $\to$ CKA calculation $\to$ K-Means filtering).
• Process: Clients submit DDP-perturbed updates (stored off-chain via IPFS, referenced on-chain via hash). Smart contracts verify signatures, validate the latent-space trust scores, and record metadata (including noise parameters and trust scores) on an immutable ledger.
• Aggregation: Only updates identified as "benign" by the latent-space module are selected for secure FedAvg aggregation. The resulting global model is distributed back to clients via the blockchain.

Key Contributions

The paper claims the following contributions:

1. Fully Decentralized Architecture: The first framework to eliminate central aggregation servers entirely, utilizing a permissioned blockchain for transparent model validation, immutable auditability, and incentive-compatible reward/punishment mechanisms across untrusted domains.
2. Integrated DDP for DFL-IDS: The first integration of Distributed Differential Privacy into a latent-space poisoning defense pipeline, providing formal privacy guarantees on local updates while mitigating gradient-based inference attacks in resource-constrained settings.
3. Robust Latent-Space Defense: A novel defense module tailored for severe non-IID industrial traffic. By combining AutoEncoder-compressed LSRs with CKA and unsupervised clustering, it detects malicious updates without auxiliary data or adversary knowledge, addressing the PLR instability issues found in prior works like FedCC.
4. Synergistic Pipeline: A unified protocol where DDP-perturbed updates are validated in the latent space on-chain before aggregation. This design achieves robustness against both targeted (backdoor, GAN) and untargeted (label-flipping, weight scaling, Krum/Med) attacks.
5. Empirical Validation: Extensive experiments on two large-scale benchmarks (CIC-IDS2018 and Edge-IIoTSet) under IID and non-IID settings with adversary ratios up to 40%.

Experimental Results

The authors evaluated PenTiDef against state-of-the-art baselines (FLARE and FedCC) and a "No-Defense" scenario.

• Performance under DDP: The application of DDP resulted in a marginal convergence delay and a slight accuracy drop (approx. 0.01) compared to non-DDP settings, demonstrating a viable balance between privacy and utility.
• Detection Accuracy: PenTiDef consistently outperformed FLARE and FedCC in both IID and non-IID settings across all attack types (Label-Flipping, Weight Scaling, Untargeted-Krum, Untargeted-Med, Backdoor, and GAN-based).
  • In non-IID settings with 40% adversaries, PenTiDef maintained high F1-scores (e.g., 0.93–0.95 on CIC-IDS2018 for untargeted attacks), whereas baselines showed significant performance degradation or instability in distinguishing malicious models.
  • CKA score analysis revealed that PenTiDef maintained a clear separation between benign (scores > 0.8) and malicious (scores < 0.6) models, whereas FedCC struggled to maintain this distinction in non-IID environments.
• Efficiency: PenTiDef demonstrated lower training overhead than FLARE and FedCC. Specifically, PenTiDef required approximately 33 minutes for training on CIC-IDS2018, compared to 41 minutes for FedCC and over 1 hour for FLARE. This efficiency is attributed to the lightweight nature of the AE-compressed LSRs compared to the raw PLR distance calculations used by FLARE.
• Model Agnosticism: The framework demonstrated stability across different neural network architectures (CNN and SqueezeNet), maintaining consistent detection capabilities.
• Blockchain Performance: Benchmarks on the Hyperledger Fabric network (3 organizations, 6 peers) showed high throughput (up to ~177 TPS for query operations) and low latency, confirming the feasibility of the coordination layer for IIoT deployments.

Significance and Claims

The paper positions PenTiDef as a significant advancement in establishing trustworthy collaborative intrusion detection for heterogeneous IIO environments. Its primary significance lies in its holistic approach, simultaneously addressing the triad of privacy, robustness, and decentralization in a single secure aggregation protocol.

The authors claim that PenTiDef sets a new benchmark by:

• Eliminating the need for trusted central aggregators and auxiliary datasets, which are common limitations in prior works.
• Providing formal privacy guarantees while effectively countering sophisticated poisoning attacks, even under severe data heterogeneity (non-IID) and high adversary ratios (up to 40%).
• Offering a practical, scalable solution that incurs lower computational overhead than existing defenses, making it suitable for resource-constrained industrial edge devices.

The paper concludes that while challenges remain regarding multi-class classification, highly adaptive attacks, and scaling to hundreds of nodes, PenTiDef provides a foundational step toward secure, decentralized, and privacy-preserving federated learning for critical cyber-physical systems.