Privacy-Preserving Intrusion Detection in Smart Traffic Networks

Abstract

Smart transportation and associated systems are becoming more susceptible as they also apply to cyber threats such as Distributed Denial-of-Service (DDoS), model poisoning, node impersonation, and ransomware lateral movement using more interconnected IoT products (traffic controllers, sensors, cameras, etc.). The current centralized Intrusion Detection Systems (IDS) have structural disadvantages, namely, high latency, bandwidth overhead, privacy exposure, and single-point collision, which limit their applicability in real and safety-critical urban settings. In order to handle these gaps, this research will suggest a Federated Learning Multi-layer Intrusion Detection System (FL-IDS) that is specifically crafted to intelligent traffic infrastructures. The architecture incorporates edge-based anomaly detection, federated collaborative learning, secure aggregation, differential privacy, encrypted communication (TLS 1.3, MQTT-S, SNMPv3), and devices-integrity (Secure Boot and firmware signing). Every intersection does its local detection and transmits the encrypted model updates, which allows them to learn globally and capture the local traffic features. Detection performance, latency, and bandwidth consumption coupled with resistance to poisoning attacks were tested within a conceptual experimental framework comprising of the CICIoT2023 dataset and trafficking simulated variations in the real world. Findings indicate that FL-IDS is better at performance compared to Cloud-IDS and traditional ML-IDS, with a high detection rate of 95% and a false-positive rate of 1.8 percent along with a detection latency of 80 ms and bandwidth consumption of 2.3 MB. With the conditions of model-poisoning, the reduction in accuracy is only as high as 8 percent, proving to be highly resilient with secure aggregation and differential privacy.