HomeGuard: Community-Driven Hierarchical Federated Learning for Robust Smart-Home Intrusion Detection
: Federated Learning (FL) has emerged as a promising approach to build collaborative Intrusion Detection Systems (IDSs) in the IoT, e.g., in smart homes. FL allows models to be shared without exposing sensitive training data, thus protecting the privacy of IoT users. However, existing FL-based IDSs rely on assumptions that rarely hold in practice, namely homogeneous devices, synchronous participation, and benign contributors. We argue that, in real-world smart homes, IoT devices are highly heterogeneous, resource-constrained, and attractive targets for adversaries, which makes conventional FL less effective or vulnerable to poisoning attacks. We present H OME G UARD , a collaborative IDS specifically designed for the constraints and threat model of practical smart home IoT infrastructures. In our approach, we rethink FL deployment by (1) of-floading model training to gateways to manage computational heterogeneity of IoT devices and (2) organizing anomaly detection models into device-specific communities based on privacy-preserving traffic fingerprints which do not expose sensitive data. Within communities and across smart homes, H OME G UARD implements an asynchronous, hierarchical FL architecture that tolerates device churn, uneven data availability, and Byzantine participants. Further, H OME G UARD applies Byzantine-robust aggregation at two levels: within local communities, and globally in the cloud to limit the impact of compromised devices. Experimental evaluation shows that H OME G UARD achieves an average true positive rate of 97.86% locally and 97.53% globally with a 0% false positive rate, while maintaining robustness against both targeted and untargeted poisoning attacks.