Incremental Federated Host Embeddings for Network Telescopes Traffic Analysis

Network telescopes are ranges of IP addresses with nothing connected. They are contacted by botnets and scanners that look for possible victims. Each telescope exposes a partial view, and merging the information with that coming from other telescopes is fundamental. Machine learning allows us to build models to solve classification tasks automatically. This work explores applying collaborative Artificial Intelligence solutions via Federated Learning (FL) to build a global model without sharing the raw (and sensitive) data. We leverage a two-stage pipeline: (i) a self-supervised upstream task generates and updates an incremental compact representation of the senders hitting the telescope; (ii) such embeddings serve as input for a downstream classification task to identify possible offenders. We show that FL can produce embeddings of better quality than a single network telescope can, increasing the model accuracy (+6%) and coverage (+12%) while limiting the amount of data exchanged (from GBs to MBs).

Presenter: Kai Huang

Biography
Kai Huang is a PhD student at Politecnico di Torino and a member of SmartData@PoliTO. He obtained the M.Sc. in ICT for Smart Societies at Politecnico di Torino. His research interests focus on the intersection of machine learning and network traffic analysis and cybersecurity.

Event organised by SmartData@PoliTO center.