Scenario-Aware Federated Intrusion Detection for V2X-Inspired Edge Security: Calibration, Heterogeneity, and Communication Analysis

Abstract

Vehicle-to-Everything (V2X) communication systems are becoming a foundational component of intelligent transportation systems, but their increasing connectivity also enlarges the cyberattack surface and raises important privacy and deployment challenges for intrusion detection. Conventional centralized intrusion detection systems can achieve strong predictive performance, yet they require aggregation of sensitive traffic data and may be difficult to deploy across distributed edge environments. This study presents a federated learning-based intrusion detection evaluation framework for privacy-aware and deployment-oriented security monitoring in V2X-inspired distributed environments. Rather than proposing a new detection architecture, the work focuses on a more rigorous and realistic assessment protocol for federated intrusion detection under scenario shift, client heterogeneity, threshold-sensitive operation, and communication constraints. The proposed approach combines group-based train/test partitioning to better reflect scenario separation, lightweight multilayer perceptron (MLP) models suitable for edge-side training, and explicit analysis of communication overhead and threshold calibration. Using the CICIDS2017 dataset as a controlled proxy benchmark, the study compares centralized baselines, local-only learning, FedAvg, and FedProx for binary intrusion detection under approximately IID and strongly non-IID client partitions. The experimental protocol uses equal training-set sizes across centralized and federated methods, an independent calibration set for threshold and checkpoint selection, and five independent random seeds, with results reported as mean ± standard deviation. The results show that the stricter group-based evaluation protocol substantially reduces performance compared with optimistic random-split evaluation, confirming the importance of scenario-aware validation for intrusion detection. Under the protocol, the best mean F1-score was obtained by FedAvg in the strong non-IID configuration, with an F1-score of 0.468 ± 0.028, followed closely by FedAvg under approximately IID partitioning with 0.463 ± 0.036. Centralized MLP, logistic regression, and random forest baselines achieved comparable but slightly lower F1-scores, indicating that federated learning remained competitive rather than clearly superior under this challenging setting. The analysis further shows that threshold calibration on an independent calibration set materially changes the operating point of the detectors, while validation-selected federated checkpoints generally occurred in later communication rounds within the tested 15-round budget. Communication analysis showed that the lightweight MLP required only approximately 72 kB per model update, corresponding to about 720 kB per federated round when both uplink and downlink traffic were counted for five clients. Overall, the findings support federated learning as a viable and communication-efficient direction for privacy-aware intrusion detection in distributed edge-security settings, while also highlighting the need for cautious interpretation, native V2X validation, and future robustness analysis against compromised federated clients.