# Feature-Attended Federated LSTM for Anomaly Detection in the Financial Internet of Things +
## 1 Introduction  
In recent years, financial products have made a closed loop involving multiple market entities and are usually based on the information of practical objects, such as a car, a house or a famous painting in a mortgage loan. Financial institutions generally need more information about the objects to reduce risks and improve efficiency. The Internet of Things (IoT) can provide full-process and full-time information about the objects. The combination of finance and IoT leads to a new pattern, i.e., the Financial Internet of Things (FloT), which has great potential in the information era [1, 2]. However, potential attacks may seriously threaten the security and efficiency of the FloT. The detection of potential attacks has become a vital issue in FloT. Actually, the anomalies in the network provide us witha way to detect potential threats in a timely manner, thus making anomaly detection an important method of identifying network attacks [3]. At present, there are many studies on anomaly detection in IoT, but barely specialized for FIoT. The literature [4] proposes an anomaly detection scheme based on fuzzy theory. In [5], principal component analysis (PCA) is used to detect abnormal behaviors in aging Industrial IoT. A Squeezed Convolutional Variational Auto Encoder (SCVAE) for anomaly detection in Industrial IoT is proposed in [6]. Based on an adaptive learning rate and momentum, a method for trustworthy network anomaly detection is proposed in [7], whereas these methods ignore the time correlation of the network traffic and have limitations in the anomaly detection performance. Motivated by the excellent performance of long short-term memory recurrent neural network (LSTM-RNN) in natural language processing and speech recognition, [PERSON] et al. [8] proposed an anomaly detection method with the LSTM network, and [PERSON] et al. [9] trained the model based on kernel PCA and LSTM-RNN to detect anomalies. Nevertheless, these methods leave the time correlation of each feature itself out of consideration, which is a significant characteristic of the FIoT traffic. At the same time, financial entities, such as persons, banks, or related companies, have stricter rules on using the data generated from their FIoTs. They cannot freely exchange data to train more powerful anomaly-detecting models. The anomaly detection in FIoT faces problems such as data isolation and data shortage during independent training. This may lead to impaired accuracy of the obtained models. Thus, federated learning as a new technology was applied in anomaly detection. [PERSON] et al. [10] proposed a federated learning-based anomaly detection framework called Deepfed, for identifying threats in cyber-physical systems. [PERSON] et al. [11] presented federated learning-based attention gated recurrent unit (FedAGRU), an anomaly detection algorithm for wireless edge networks. However, the environmental difference of different nodes exists objectively, and the traditional federated learning model is not highly adaptable to the different environments. To solve the problems above, this paper combines the LSTM network and federated learning based on the correlation of data features. We propose multi-channel LSTM based on data association, apply federated learning architecture as the solution to the lack of data and optimize parameter aggregation strategy based on the data correlation. Therefore, the adaptability and performance of the model are improved in different environments. Our contributions are summarized as follows:  
* We propose the architecture of FAF-LSTM, so as to improve the utilization of the time correlations, the coordination among detection nodes, and the adaptability to a dynamic changing environment. FAF-LSTM is composed of the feature-attended LSTM and the correlation-based federated learning.