Attention-based intrusion detection in MQTT-IoT network: a federated learning and deep reinforcement learning approach
摘要
In IoT networks, heterogeneous smart devices communicate through different messaging protocols, among which MQTT is prominently used due to its publish-subscribe architecture and efficiency in data transmission. However, its lightweight design, low bandwidth usage, and reliable message delivery make it an attractive target for intruders. As a result, various novel attacks on IoT devices have been extensively exploited, posing significant challenges in safeguarding them from cyber threats. To detect these threats, an effective, adaptive, and robust intrusion detection system (IDS) is essential. Traditional IDSs rely on centralized data collection and analysis, raising concerns about security, privacy, and the ability to detect novel attack patterns. To overcome these limitations, we propose an IDS that integrates federated learning with Double Deep Q-Network (DDQN), a deep reinforcement learning algorithm. Our approach enables multiple clients to collaborate without sharing sensitive data. In our model, each client runs a DDQN, enabling local learning while benefiting from the collective knowledge of the network. An attention mechanism has been developed that dynamically calculates the attention value of each client using a mathematical model, which is subsequently used during model aggregation to improve convergence and fairness. The proposed approach is designed for large-scale MQTT-based IoT networks and is further validated for robustness against adversarial attacks and adaptability to evolving attack patterns. We evaluated our model using the MQTTSET, MQTT-IoT-IDS2020, and recently published MQTTEEB-D datasets. The experimental results demonstrate its adaptability, scalability, robustness, and superior performance in terms of accuracy, recall, false positive rate (FPR), and precision.