A Survey on IoT Intrusion Detection: Federated Learning, Game Theory, Social Psychology, and Explainable AI as Future Directions

In the past several years, the world has witnessed an acute surge in the production and usage of smart devices which are referred to as the Internet of Things (IoT). These devices interact with each other as well as with their surrounding environments to sense, gather and process data of various kinds. Such devices are now part of our everyday’s life and are being actively used in several verticals, such as transportation, healthcare, and smart homes. IoT devices, which usually are resource-constrained, often need to communicate with other devices, such as fog nodes and/or cloud computing servers to accomplish certain tasks that demand large resource requirements. These communications entail unprecedented security vulnerabilities, where malicious parties find in this heterogeneous and multiparty architecture a compelling platform to launch their attacks. In this work, we conduct an in-depth survey on the existing intrusion detection solutions proposed for the IoT ecosystem which includes the IoT devices as well as the communications between the IoT, fog computing, and cloud computing layers. Although some survey articles already exist, the originality of this work stems from the three following points: 1) discuss the security issues of the IoT ecosystem not only from the perspective of IoT devices but also taking into account the communications between the IoT, fog, and cloud computing layers; 2) propose a novel two-level classification scheme that first categorizes the literature based on the approach used to detect attacks and then classify each approach into a set of subtechniques; and 3) propose a comprehensive cybersecurity framework that combines the concepts of explainable artificial intelligence (XAI), federated learning, game theory, and social psychology to offer future IoT systems a strong protection against cyberattacks.

I. Introduction

There is no doubt that the Internet of Things (IoT) has been one of the biggest technological advancements in the past few years. Cisco estimates that there will be around 30 billion IoT devices in use around the world by 2030 [1]. One of the main tasks of the IoT technology is that of IoT devices sensing their environments, to gather relevant data and accordingly take actions. These devices often communicate as well with other technological innovations, such as fog computing and cloud computing to facilitate the processes of storing and analyzing the collected data. Despite the many advantages that the IoT has brought to our modern life, this emerging technology is highly challenged by nonconventional security risks. In fact, the heterogeneous nature of the IoT devices, their reliance on various technological stacks (e.g., fog and cloud computing) and communication protocols, and the varying resource capabilities across the IoT devices all together make the IoT quite vulnerable to security attacks. Moreover, since IoT devices are responsible for large amounts of data, they are very likely to be targets for malicious attacks that try to steal, alter or tamper parts or all of this data. In addition, many of the IoT devices are deployed in highly critical environments (e.g., military, manufacturing, and smart grids), giving malicious parties an attack platform through which they can cause massive damages.