  There is a growing trend of cyberattacks against Internet of Things (IoT)
devices; moreover, the sophistication and motivation of those attacks is
increasing. The vast scale of IoT, diverse hardware and software, and being
typically placed in uncontrolled environments make traditional IT security
mechanisms such as signature-based intrusion detection and prevention systems
challenging to integrate. They also struggle to cope with the rapidly evolving
IoT threat landscape due to long delays between the analysis and publication of
the detection rules. Machine learning methods have shown faster response to
emerging threats; however, model training architectures like cloud or edge
computing face multiple drawbacks in IoT settings, including network overhead
and data isolation arising from the large scale and heterogeneity that
characterizes these networks.
  This work presents an architecture for training unsupervised models for
network intrusion detection in large, distributed IoT and Industrial IoT (IIoT)
deployments. We leverage Federated Learning (FL) to collaboratively train
between peers and reduce isolation and network overhead problems. We build upon
it to include an unsupervised device clustering algorithm fully integrated into
the FL pipeline to address the heterogeneity issues that arise in FL settings.
The architecture is implemented and evaluated using a testbed that includes
various emulated IoT/IIoT devices and attackers interacting in a complex
network topology comprising 100 emulated devices, 30 switches and 10 routers.
The anomaly detection models are evaluated on real attacks performed by the
testbed's threat actors, including the entire Mirai malware lifecycle, an
additional botnet based on the Merlin command and control server and other
red-teaming tools performing scanning activities and multiple attacks targeting
the emulated devices.
