Modern information and communication technologies have propelled transformative modernization of Industrial Control Systems (ICSs) while exacerbating cybersecurity risks. Federated Learning (FL) offers a privacy-preserving framework for collaborative development of intrusion detection models among distributed participants. However, its effectiveness is significantly limited by inherent model divergence caused by non-independent and identically distributed (Non-IID) data characteristics. Moreover, direct implementation of FL in ICS environments faces critical challenges due to insufficient capabilities in network traffic feature representation and device concealment. To address these challenges, we propose CoperFed, a covert personalized FL framework that generates unique intrusion detection models for individual participants. First, we developed Gicsmeter, a multi-dimensional ICS traffic representation tool for all participants, to enhance model performance at the data level. Second, we designed a personalized update algorithm based on key model parameters to improve collaboration among similar participants. By integrating global knowledge during model aggregation, this algorithm equips the model with local and global scenario detection capabilities. Finally, we designed a covert federated communication scheme for ICS that can effectively conceal the federated training process within regular ICS traffic and reduce the exposure risk of FL participants. Experiments show that CoperFed outperforms baseline methods in intrusion detection and robustness and can effectively divert attackers’ attention from FL participants.
扫码关注我们
求助内容:
应助结果提醒方式:
