The outcomes of these experiments prove that, in the context of federated IDS for a heterogeneous IoT network, the integration of trust-aware aggregation with contrastive representation learning and imbalance-aware optimization can enhance performance.
Abstract
The Internet of Things (IoT) has increased the cyber-attack surface by bringing together a variety of different devices, sensors, and services in critical digital infrastructure. Federated learning (FL) is a solution that enables local devices to train together without sharing raw traffic data; thus, it can be used for intrusion detection without compromising privacy. Nevertheless, traditional FL aggregation techniques are still susceptible to non-IID client distributions, data imbalance, unreliable local updates, and poor representation learning approaches. This study introduces a novel method, called Trust-Aware Contrastive Federated Learning for IoT intrusion detection, TACMA Fed. The framework extends AMAFed and combines trust-aware client scoring, aggregation based on similarity of updates, supervised contrastive representation learning, adaptive focal–Dice loss, and rare-class-aware weighting into a lightweight 1D convolutional model. The ten simulated IoT clients and the non-IID Dirichlet partition are used in experiments with the ToN-IoT train_test_network dataset. TACMA Fed achieves an accuracy of 0.9957, an F1 score of 0.9937, an ROC-AUC of 0.9991, a PR-AUC of 0.9997, and a false-positive rate of 0.0087. Robustness analysis also shows stability parameters in the presence of Gaussian noise and feature masking, as well as varying levels of client heterogeneity. The outcomes of these experiments prove that, in the context of federated IDS (FIDS) for a heterogeneous IoT network, the integration of trust-aware aggregation with contrastive representation learning and imbalance-aware optimization can enhance performance.
Federated learning (FL) is a promising paradigm for privacy-preserving IoT intrusion detection, but its effectiveness can be substantially degraded by the combination of heterogeneous non-IID client distributions and severe multi-class imbalance. Under such conditions, conventional size-based aggregation may overemphasize large yet highly skewed clients, limiting the representation of minority attack classes in the global model. To address this issue, we propose Mean/Std, a lightweight distribution-aware aggregation strategy that combines a client-size proxy with two complementary statistics of local label distributions, namely the standard deviation and the dominance gap of class proportions, while preserving a communication footprint comparable to FedAvg. Experiments on the N-BaIoT benchmark, comprising seven heterogeneous IoT clients and eleven traffic classes, are conducted under a privacy-oriented update-perturbation setting inspired by secure aggregation workflows. The results show that Mean/Std consistently provides the strongest imbalance-aware performance among the evaluated FL baselines, achieving a Macro-F1 score of 0.8418 and a Balanced Accuracy of 0.8722 while improving the representation of minority attack classes. Additional experiments across five independent random seeds and a comprehensive hyperparameter sensitivity analysis further confirm the robustness and stability of the proposed aggregation mechanism. Overall, the results demonstrate that lightweight distribution-aware aggregation offers an effective, robust, and practically deployable solution for mitigating aggregation bias under simultaneous non-IID heterogeneity and severe multi-class imbalance in FL-based IoT botnet detection.
Yassine El Yamani, Youssef Baddi, Najib El Kamoun· IoT· 0 citations
The results show a success in implementing a real time, scalable, privacy-preserving, and adaptive IDS in large-scale IoT deployments through intelligent workload distribution between edge and cloud layers.
Chidera Winifred John, Eduediuyai Ekerete Dan, P. Asuquo et al.· E3S Web of Conferences· 0 citations
Federated Bandit Intrusion Detection (FBID), a novel adaptive PFL framework to address this limitation through server-side personalization control, employs a contextual multi-armed bandit at the server to dynamically regulate each client's local training intensity according to its observed behavior and update quality.
A. Bui, Cong T. Nguyen, Hoang-Anh Pham et al.· 0 citations
The Internet of Things (IoT) plays a vital role in the digital age by interconnecting numerous heterogeneous devices. This complexity and ubiquity expose IoT networks to diverse and sophisticated cyber threats. IoT environments require rigorous collaborative intrusion detection system (IDS) that operates in distributed environments and heterogeneous data traffic. While federated learning offers a promising, privacy-conscious training model, most traditional approaches to IDS fail to detect the structural relationships between connected entities. On the other hand, Graph Neural Networks (GNNs) have attracted significant attention in Network Intrusion Detection Systems (NIDS) for their effectiveness in modeling complex network traffic flows in real-world environments. However, existing GAD methods are generally designed for centralized training, thereby posing privacy leakage risks. Despite progress, current mainstream Federated Graph anomaly detection (FGAD) methods still face challenges. A key limitation is that most existing approaches focus on node-level analysis while disregarding inter-node relationships making them ineffective against sophisticated attacks. To tackle this problem, this paper presents an Edge Federated Graph Anomaly Detection (E-FGAD) framework for IoT environments that combines centralized self-supervised pre-training with distributed supervised learning over edge embeddings. During the supervised phase, parameters are optimized in a federated manner using FedAvg with FedProx and server momentum. Our framework operates on graphs, where nodes represent IP endpoints and edges represent NetFlow records with traffic statistics as features, aiming to capture the flow of interactions between entities. We evaluate experiments on two real-world datasets, NF-BoT-IoT-v3 and NF-ToN-IoT-v3, in both binary and multi-class settings. E-FGAD achieves a maximum detection accuracy of 99.32%, a Macro-F1 of 89.73%, and a Weighted-F1 of 99.2%. Our framework outperforms centralized and federated baselines, demonstrating its effectiveness in detecting attacks while preserving privacy.
Nuha A. Hamad, Khairul Azmi Abu Bakar, Faizan Qamar et al.· IEEE Access· 0 citations
—The proposed study suggests a to help cope with issues related to cybersecurity in Internet of Things and Industrial Internet of Things environments without compromising privacy. The proposed framework introduces several innovative features, such as federated learning with momentum-based optimization, adaptive differential privacy, trust verification via blockchain, and Byzantine-resilient aggregation, to enhance the security, scalability, and robustness of the system compared with traditional intrusion detection systems. It also integrates supervised classification with autoencoder-based anomaly detection to detect existing and emerging cyberattacks. The proposed system was assessed with respect to the extended Industrial Internet of Things Intrusion Dataset (X-IIoT) and Network-Based Botnet Attack detection for IoT (N-BaIoT) benchmark datasets, where the environments were simulated as federated ones. The accuracy of the Hybrid Robust Federated Intrusion Detection System increased to 97.15% on X-IIoT and 97.64% on N-BaIoT with only 41 communication rounds and was resilient against up to 20% of Byzantine clients. These results showcase its efficacy to secure, private and communication-efficient intrusion detection for next generation Internet of Things and Hybrid Robust Federated Intrusion Detection System networks.
AF-BKM is presented, an Adaptive Federated Baseline K-Means that repairs the federated mechanism with two label-free, statistics-only enhancements, and identifies merge-induced precision decay under non-IID workers as an open gap.
Mohammed I. Al-Saleh, Joseph Azar· IoT· 0 citations