Enhanced Intrusion Detection in IoT Networks using Federated Learning

Enhancing IoT network security with explainable deep learning-based intrusion detection systems.

Deploying effective intrusion detection systems on low-power IoT devices requires a careful balance of performance, efficiency, and transparency. Current neural-network-based solutions are often too resource-intensive and opaque for practical edge use. We introduce a lightweight, explainable IDS that combines a 1D-CNN for spatial feature analysis with SHAP for model interpretation. To the best of our knowledge, this work presents the first comparative analysis of a SHAP-augmented 1D-CNN against traditional CNN and LSTM models for IoT intrusion detection. Our method outperforms these benchmarks on real-world datasets (UNSW-NB15 and WUSTL-IIoT-2021). Crucially, SHAP analysis enables feature reduction, yielding streamlined models that preserve over 93% F1-score and reduce computational overhead by more than 38%, facilitating millisecond-level inference on edge hardware. These results demonstrate a viable path for reconciling high detection accuracy with the stringent resource limitations of IoT environments.

Edge- Federated Graph Anomaly Detection With Self-Supervised Representation Learning for IoT Networks

The Internet of Things (IoT) plays a vital role in the digital age by interconnecting numerous heterogeneous devices. This complexity and ubiquity expose IoT networks to diverse and sophisticated cyber threats. IoT environments require rigorous collaborative intrusion detection system (IDS) that operates in distributed environments and heterogeneous data traffic. While federated learning offers a promising, privacy-conscious training model, most traditional approaches to IDS fail to detect the structural relationships between connected entities. On the other hand, Graph Neural Networks (GNNs) have attracted significant attention in Network Intrusion Detection Systems (NIDS) for their effectiveness in modeling complex network traffic flows in real-world environments. However, existing GAD methods are generally designed for centralized training, thereby posing privacy leakage risks. Despite progress, current mainstream Federated Graph anomaly detection (FGAD) methods still face challenges. A key limitation is that most existing approaches focus on node-level analysis while disregarding inter-node relationships making them ineffective against sophisticated attacks. To tackle this problem, this paper presents an Edge Federated Graph Anomaly Detection (E-FGAD) framework for IoT environments that combines centralized self-supervised pre-training with distributed supervised learning over edge embeddings. During the supervised phase, parameters are optimized in a federated manner using FedAvg with FedProx and server momentum. Our framework operates on graphs, where nodes represent IP endpoints and edges represent NetFlow records with traffic statistics as features, aiming to capture the flow of interactions between entities. We evaluate experiments on two real-world datasets, NF-BoT-IoT-v3 and NF-ToN-IoT-v3, in both binary and multi-class settings. E-FGAD achieves a maximum detection accuracy of 99.32%, a Macro-F1 of 89.73%, and a Weighted-F1 of 99.2%. Our framework outperforms centralized and federated baselines, demonstrating its effectiveness in detecting attacks while preserving privacy.

A Three-Stage Federated Distillation Framework for Robust Intrusion Detection in Heterogeneous IoT/Edge Networks

Internet of Things(IoT)/edge intrusion-detection systems operate on distributed traffic and system-state data whose distributions vary across gateways, services, and attack conditions. We study a server-assisted federated setting in which a teacher reference is fitted from a permitted server-accessible training pool and explicitly distinguish this simulation assumption from fully decentralized deployment. The proposed framework evaluates progressive local training through boundary stabilization, confidence-weighted decision distillation, representation alignment, and validation-quality-aware aggregation. The evaluation uses a leakage-controlled protocol: server and client validation subsets are held out before federated training, update quality and early stopping use validation data only, and the final-test split is evaluated once. Results on NSL-KDD, CIC-IDS2017, Edge-IIoTset, and the ToN-IoT network dataset show competitive primary performance and stronger robustness in several severe label-skew settings. On the Telemetry of Things(ToN-IoT) with Dirichlet alpha = 0.1, the proposed method achieves 91.46 ± 5.54 F1, compared with 53.73 ± 49.00 for FedAvg and 53.77 ± 48.92 for FedProx. The results do not establish universal superiority or a universally optimal stage order: competing methods remain stronger in selected stable and attack-shift settings. The framework is therefore presented as a bounded, server-assisted robustness-oriented training strategy for heterogeneous IoT/edge intrusion detection.

Enhancing Scalability and Communication Efficiency in Sub-Network Based Federated Deep Learning for Multiclass Intrusion Detection in IoT Networks

Trust-Aware Contrastive Meta-Aggregation Federated Learning for Intrusion Detection in the Internet of Things

The Internet of Things (IoT) has increased the cyber-attack surface by bringing together a variety of different devices, sensors, and services in critical digital infrastructure. Federated learning (FL) is a solution that enables local devices to train together without sharing raw traffic data; thus, it can be used for intrusion detection without compromising privacy. Nevertheless, traditional FL aggregation techniques are still susceptible to non-IID client distributions, data imbalance, unreliable local updates, and poor representation learning approaches. This study introduces a novel method, called Trust-Aware Contrastive Federated Learning for IoT intrusion detection, TACMA Fed. The framework extends AMAFed and combines trust-aware client scoring, aggregation based on similarity of updates, supervised contrastive representation learning, adaptive focal–Dice loss, and rare-class-aware weighting into a lightweight 1D convolutional model. The ten simulated IoT clients and the non-IID Dirichlet partition are used in experiments with the ToN-IoT train_test_network dataset. TACMA Fed achieves an accuracy of 0.9957, an F1 score of 0.9937, an ROC-AUC of 0.9991, a PR-AUC of 0.9997, and a false-positive rate of 0.0087. Robustness analysis also shows stability parameters in the presence of Gaussian noise and feature masking, as well as varying levels of client heterogeneity. The outcomes of these experiments prove that, in the context of federated IDS (FIDS) for a heterogeneous IoT network, the integration of trust-aware aggregation with contrastive representation learning and imbalance-aware optimization can enhance performance.

A Two-Tier Hybrid Intrusion Detection System for IoT Networks

The rapid growth of Internet of Things (IoT) devices has made modern attacks more vulnerable to cyberattacks. Traditional signature-based Intrusion Detection Systems (IDS) are no longer enough to keep up with new and evolving threats. Although machine learning and deep learning have improved detection accuracy, many AI-driven IDS models still face major issues. They often struggle to detect zero-day attacks, produce high false-positive rates and perform poorly with imbalanced datasets. Some models are also too computationally heavy to run efficiently in real time. To address these weaknesses, this research proposes a two-tier hybrid IDS that uses a Random Forest model for quick initial detection and a Neural Network for deeper analysis of suspicious traffic. A confidence threshold of 0.8 is used to decide whether traffic should be accepted or sent for further inspection. Using the NSL-KDD dataset, the system includes preprocessing steps such as binary mapping and structured feature extraction to support both detection stages. Our comparative analysis shows that this hybrid approach can achieve better accuracy, fewer false alarms, and stronger detection of unknown attacks compared to existing Machine Learning / Deep Learning IDS methods. It is more practical for large, diverse IoT environments because it reduces computational load while maintaining strong detection capability. Overall, the proposed architecture provides a balanced and efficient solution that overcomes key limitations of existing IDS models and offers a pathway towards a more robust real-time IoT intrusion detection.