Federated Defense in the Medical Edge: A Reputation-Aware Secure Aggregation Protocol for IoMT Intrusion Detection

Abstract

Smart hospitals deploy Internet of Medical Things (IoMT) sensors and MQTT brokers to stream clinical telemetry over resource-constrained edge gateways. Centralized network intrusion detection systems (NIDS) expose sensitive traffic traces and create single-point failures; federated learning (FL) avoids raw-data centralization but remains vulnerable to client-side model poisoning and server-side inspection of client updates. This study presents Trust-Weighted Federated Aggregation (TW-Fed), a reputation-aware defense framework for federated learning that integrates 1) cosine similarity-based trust scoring using low-dimensional update sketches and 2) secure aggregation of trust- and data size-weighted model updates through pairwise masking with dropout recovery. TW-Fed has been evaluated on the CICIoMT2024 benchmark (Wi-Fi and MQTT subsets) with a four-class NIDS task (Benign, MQTT-Connect-Flood, TCP-DDoS, ARP-Spoofing) and 20 edge clients emulating IoMT gateways. In the clean setting, TW-Fed achieves 99.21% accuracy and 98.74% macro-F1, exceeding FedAvg by 0.82 macro-F1 points. Under label flipping with 30% malicious clients, TW-Fed sustains 97.06% accuracy versus 82.14% (FedAvg), 85.33% (FedProx), and 92.07% (Krum). Under backdoor injection, TW-Fed reduces attack success rate from 91.5% (FedAvg) to 6.8%. On Raspberry Pi 4 clients, TW-Fed adds 0.09 s local overhead per round while reducing server aggregation time by 34% relative to Krum. Secure aggregation increases uplink volume by 9.7% while preventing per-client update disclosure.