When Majority Rule Fails: Pheromone-Guided Trust Adaptation for Byzantine-Resilient Intrusion Detection.

This paper proposed ACO-Voter, a pheromone-based adaptive trust-weighting mechanism for NVP-based Intrusion Detection Systems at the IoT edge layer. Three independently implemented classifier variants - Random Forest, Linear SVC, and MLP - are each assigned a pheromone trust value that is reinforced on agreement and evaporated on disagreement with the ensemble consensus, enabling autonomous fault isolation without prior knowledge of which variant will fail. Under a coordinated permanent Byzantine fault scenario on the DNN-EdgeIIoT dataset, ACO-Voter isolated the faulty variant within 95 packets and improved attack recall from 0.464 to 0.634, a 36.6% relative gain over SMV, while matching the performance of an oracle-informed fixed-weight baseline without requiring any prior knowledge of which variant would fail. This paper forms the basis of an extended study, currently in preparation, which evaluates ACO-Voter under intermittent and recovery-type Byzantine fault conditions, formally validates the improvement using 10-fold cross-validation and non-parametric significance testing, and reports a sensitivity analysis of the pheromone evaporation rate ρ. Future work will also extend the architecture to N > 3 variants and incorporate contextual trust factors such as node mobility in dynamic IoT topologies.

[1] A. Al-Fuqaha, M. Guizani, M. Mohammadi, M. Aledhari, and M. Ayyash, "Internet of things: A survey on enabling technologies, protocols, and applications," IEEE Communications Surveys & Tutorials, vol. 17, no. 4, pp. 2347-2376, 2015. [2] M. A. Ferrag, O. Friha, D. Hamouda, L. Maglaras, and H. Janicke, "EdgeIIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications," IEEE Access, 2022. [3] M. L. Shooman, "Validating software reliability models," IFAC Proceedings Volumes, vol. 21, no. 15, pp. 115-121, 1988. [4] A. Avizienis, J.-C. Laprie, B. Randell, and C. Landwehr, "Basic concepts and taxonomy of dependable and secure computing," IEEE Trans. Dependable and Secure Computing, vol. 1, pp. 11-33, 2004. [5] S. Mukkamala, G. Janoski, and A. Sung, "Intrusion detection using neural networks and support vector machines," in Proc. IEEE IJCNN, vol. 2, pp. 1702-1707, 2002. [6] C.-F. Tsai, Y.-F. Hsu, C.-Y. Lin, and W.-Y. Lin, "Intrusion detection by machine learning: A review," Expert Systems with Applications, vol. 36, no. 10, pp. 11994-12000, 2009. [7] J. Gu and S. Lu, "An effective intrusion detection approach using SVM with Naïve Bayes feature embedding," Computers & Security, vol. 103, p. 102158, 2020. [8] R. Reischuk, "A new solution for the Byzantine generals problem," Information and Control, vol. 64, no. 1, pp. 23-42, 1985. [9] M. Castro and B. Liskov, "Practical Byzantine fault tolerance," in Proc. OSDI ’99, New Orleans, LA, pp. 173-186, 1999. [10] M. M. Aung and Y. S. Zaw, "N-version intrusion detection system with decision fusion," in Proc. ICICT, pp. 1-6, 2019.