## 4 Man-in-the-Middle (MITM) Attacks
### Federating Learning to Mitigate MITM Attacks: An IoT Case  
In response to the significant threat of MITM and the related risk of exposing transmitted data to malicious users, we propose a privacy-preserving federated learning (FL)-based solution with ETD as a use case. FL is an emerging distributed AI paradigm where several clients work together to build a global model federated by a federated server (FS) while keeping their datasets local (see Figure 2). In ETD's case, the EC data of each residential home are processed locally at the _distribution substation_, which acts as a client in an FL system. As such, each _distribution substation_ trains an individual AI model using the local data, whilst a global model is federated at the FS. This is conducted by exchanging the model parameters instead of the data. Hence, it mitigates the MITM attacks on EC data and alleviates the burden on the network by avoiding the overload of transmitting extensive data from the edge to the cloud (where the FS is located). An FL-based ETD method (FedDetect) is presented in [29] with encouraging accuracy results; however, when examined under the energy-aware framework in [2], it was revealed that the effective ETD rate is unacceptable and that the reported results may be misleading due to the highly imbalanced data (see Table 2). In contrast, the proposed FL ETD method (FL-CNN) is energy-aware; it effectively reduced the revenue loss attributed to energy theft by 41% for ten clients (see Table 2). \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & **Clients** & **Accuracy** & **Precision** & **Recall** & **F1 Score** & **TPR** & **FPR** & **Cost (K/G)** \\ \hline \multirow{2}{*}{Central} & CNN-B [2] & 89.60 & 72.19 & 89.93 & 30.20 & 65.58 & 17.73 & 2890 \\  & CNN-B \({}^{\dagger}\) & 91.82 & 94.19 & 91.83 & 63.10 & **81.75** & 7.23 & **1415** \\ \hline \multirow{3}{*}{FL-CNN} & 2 & 87.75 & 91.90 & 87.75 & 49.29 & 69.64 & 10.55 & 2277 \\  & 5 & 80.53 & 90.34 & 80.53 & 37.11 & 67.22 & 18.23 & 2818 \\ \cline{1-1}  & 10 & 72.47 & 88.09 & 72.47 & 24.39 & 64.43 & 27.44 & 3460 \\ \hline \multirow{2}{*}{Fed Detect} & Fed & 2 & 91.98 & 91.00 & 91.98 & 40.18 & 34.77 & 3.21 & 3871 \\  & 5 & 92.58 & 91.03 & 92.58 & 36.07 & 27.03 & 1.91 & 4242 \\ \cline{1-1}  & 10 & 92.55 & 90.53 & 92.55 & 25.39 & 16.37 & 1.0 & 4799 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: The results of the proposed FL-CNN method in comparison with the state-of-the-art FL result [29] and centralised methods showing both conventional and ETD-specific metrics (%) for different numbers of clients, \(C\). (\({}^{\dagger}\) The FedDetect [29] results are reproduced using the pre-processed data in Table 3 and the authors’ public GitHub code). Figure 2: Overview of the system model with smart electricity distribution. Although FL mitigates the data leakage between IoT devices and FS, information may still be inferred by sniffing the model parameters using back-engineering, as discussed in [30]. To this end, differential privacy [28; 31] is integrated with FL in [29] to further protect the model parameters and reduce the possibility of back-engineering the actual data. In this work, we propose FL-CNN, which adopts the federated averaging (FedAvg) methodology of the Flower framework ([[https://flower.dev/docs/framework/tutorial-series-use-a-federated-learning-strategy-pytorch.html](https://flower.dev/docs/framework/tutorial-series-use-a-federated-learning-strategy-pytorch.html)]([https://flower.dev/docs/framework/tutorial-series-use-a-federated-learning-strategy-pytorch.html](https://flower.dev/docs/framework/tutorial-series-use-a-federated-learning-strategy-pytorch.html)), accessed on 28 December 2023) using PyTorch [28]. The process is adapted wherein _distribution substations_ are clients that undergo model training on their local data and transmit the model parameters to the FS, where these parameters are aggregated and averaged to facilitate the update of the global model.