A Multimodal Swarm Learning Approach for DDoS Detection in Internet of Things Infrastructure

The Internet of Things (IoT) has emerged as a foundational platform for driving intelligent solutions, playing a central role in the Fourth Industrial Revolution. Its potential lies in enabling seamless connectivity and real-time data exchange among diverse devices and systems, thereby powering advanced applications such as intelligent transportation, smart healthcare, precision agriculture, and automated manufacturing. These solutions promise to improve efficiency, optimize resource utilization, and enhance decision-making across various sectors. However, this potential is challenged by some issues, including security vulnerabilities, privacy concerns, and significant heterogeneity arising from the vast diversity of devices, communication protocols, and data formats. In this paper, we develop a multimodal deep learning solution to detect DDoS attacks on IoT infrastructure based on two data types: packet-based data and flow-based data. Firstly, the datasets containing packets labeled as benign or attack are processed into two branches: packet-based and flow-based features. Then, each branch is trained using two independent CNN models. Finally, the feature information extracted from both modalities is fused and fed into a concatenation-based classifier for DDoS attack detection. Experimental results on Edge-IIoTset and CiCIoMT2024 datasets indicate that the multimodal deep learning model within a decentralized machine learning architecture achieves performance comparable to centralized machine learning. In addition, our proposal is also robust to non-independent and identically distributed (non-IID) data in decentralized machine learning architecture.