The findings support federated learning as a viable and communication-efficient direction for privacy-aware intrusion detection in distributed edge-security settings, while also highlighting the need for cautious interpretation, native V2X validation, and future robustness analysis against compromised federated clients.
Abstract
Vehicle-to-Everything (V2X) communication systems are becoming a foundational component of intelligent transportation systems, but their increasing connectivity also enlarges the cyberattack surface and raises important privacy and deployment challenges for intrusion detection. Conventional centralized intrusion detection systems can achieve strong predictive performance, yet they require aggregation of sensitive traffic data and may be difficult to deploy across distributed edge environments. This study presents a federated learning-based intrusion detection evaluation framework for privacy-aware and deployment-oriented security monitoring in V2X-inspired distributed environments. Rather than proposing a new detection architecture, the work focuses on a more rigorous and realistic assessment protocol for federated intrusion detection under scenario shift, client heterogeneity, threshold-sensitive operation, and communication constraints. The proposed approach combines group-based train/test partitioning to better reflect scenario separation, lightweight multilayer perceptron (MLP) models suitable for edge-side training, and explicit analysis of communication overhead and threshold calibration. Using the CICIDS2017 dataset as a controlled proxy benchmark, the study compares centralized baselines, local-only learning, FedAvg, and FedProx for binary intrusion detection under approximately IID and strongly non-IID client partitions. The experimental protocol uses equal training-set sizes across centralized and federated methods, an independent calibration set for threshold and checkpoint selection, and five independent random seeds, with results reported as mean ± standard deviation. The results show that the stricter group-based evaluation protocol substantially reduces performance compared with optimistic random-split evaluation, confirming the importance of scenario-aware validation for intrusion detection. Under the protocol, the best mean F1-score was obtained by FedAvg in the strong non-IID configuration, with an F1-score of 0.468 ± 0.028, followed closely by FedAvg under approximately IID partitioning with 0.463 ± 0.036. Centralized MLP, logistic regression, and random forest baselines achieved comparable but slightly lower F1-scores, indicating that federated learning remained competitive rather than clearly superior under this challenging setting. The analysis further shows that threshold calibration on an independent calibration set materially changes the operating point of the detectors, while validation-selected federated checkpoints generally occurred in later communication rounds within the tested 15-round budget. Communication analysis showed that the lightweight MLP required only approximately 72 kB per model update, corresponding to about 720 kB per federated round when both uplink and downlink traffic were counted for five clients. Overall, the findings support federated learning as a viable and communication-efficient direction for privacy-aware intrusion detection in distributed edge-security settings, while also highlighting the need for cautious interpretation, native V2X validation, and future robustness analysis against compromised federated clients.
The results show a success in implementing a real time, scalable, privacy-preserving, and adaptive IDS in large-scale IoT deployments through intelligent workload distribution between edge and cloud layers.
Chidera Winifred John, Eduediuyai Ekerete Dan, P. Asuquo et al.· E3S Web of Conferences· 0 citations
Internet of Things(IoT)/edge intrusion-detection systems operate on distributed traffic and system-state data whose distributions vary across gateways, services, and attack conditions. We study a server-assisted federated setting in which a teacher reference is fitted from a permitted server-accessible training pool and explicitly distinguish this simulation assumption from fully decentralized deployment. The proposed framework evaluates progressive local training through boundary stabilization, confidence-weighted decision distillation, representation alignment, and validation-quality-aware aggregation. The evaluation uses a leakage-controlled protocol: server and client validation subsets are held out before federated training, update quality and early stopping use validation data only, and the final-test split is evaluated once. Results on NSL-KDD, CIC-IDS2017, Edge-IIoTset, and the ToN-IoT network dataset show competitive primary performance and stronger robustness in several severe label-skew settings. On the Telemetry of Things(ToN-IoT) with Dirichlet alpha = 0.1, the proposed method achieves 91.46 ± 5.54 F1, compared with 53.73 ± 49.00 for FedAvg and 53.77 ± 48.92 for FedProx. The results do not establish universal superiority or a universally optimal stage order: competing methods remain stronger in selected stable and attack-shift settings. The framework is therefore presented as a bounded, server-assisted robustness-oriented training strategy for heterogeneous IoT/edge intrusion detection.
Xudong Yang, Zikui Lin, Qiuyan Li et al.· Electronics· 0 citations
Introduction: The rapid expansion of Internet of Things (IoT) deployments has increased the cyber-attack surface and introduced heterogeneous traffic behaviour across devices, gateways, edge services, and network environments. Although many IoT intrusion detection studies report high performance under independent and identically distributed test conditions, such results often provide limited evidence of real deployment reliability, particularly for unseen hosts, cross-dataset transfers, and calibration drifts.
Methodology: This study presents a deployment-aware evaluation and calibration framework for IoT intrusion detection using a Denoising Autoencoder-Based Deep Feature Extraction (DAE-DFE) backbone. Rather than proposing a new neural architecture, this study focuses on robustness-oriented evaluation protocols and calibration-aware decision-making under domain shifts. The framework was evaluated using conventional IID splits, identifier-removed testing, and source-IP-based GroupSplit evaluation on NF-ToN-IoT-v2 to reduce the memorisation of the host. Cross-dataset robustness was assessed by converting Edge-IIoTset packet/protocol logs into pseudo-flows and testing Edge→NF and NF→Edge transfer using unsupervised threshold adaptation based on positive rate matching.
Results: On the NF-ToN-IoT-v2 GroupSplit, the framework achieved an F1 score of 0.9919 and ROC-AUC of 0.9997. In the Edge→NF cross-dataset setting, the model retained a meaningful ranking performance with ROC-AUC = 0.7962, while unsupervised threshold adaptation improved the target-domain accuracy from 0.4959 to 0.8878 and F1 score from 0.6630 to 0.8981.
Conclusion: The findings show that calibration-aware thresholding and deployment-realistic evaluation are essential for assessing IoT IDS reliability beyond the conventional IID accuracy.
Ola Madi Mohammed Al Mari· Majestic International Journ...· 0 citations
The rising rate of interconnected systems, cloud infrastructures, edge environments, and distributed network architectures have greatly exposed the vulnerability of the current digital infrastructures. This has exposed them to more advanced cybercrimes like denial-of-service attacks, malware injections, and data leaks. Also, there are sophisticated persistent threats that add more security burdens to such systems. The traditional Intrusion Detection Systems (IDS) are conventionally designed around central data collection and model training which result in the loss of privacy, a severely limited scale, a huge load on communications and a single point of failure. These constraints are even more deplorable in large and heterogeneous networks. To solve these issues, federated learning-based IDS models are suggested, but the existing practices fail to converge quickly, do not scale to non-IID data distributions and have an increased computation and communication cost which restricts its application. To overcome these issues, this paper proposes a Federated Enhanced Transformer-based Intrusion Detection System (FET-FIDS), a privacy-preserving and decentralized system of security, where federated learning is combined with Transformer-based self-attention. In the proposed architecture, a group of clients are introduced, each client is responsible for being trained on local network traffic data using FET-FIDS model. This method will help the system to learn intrusion patterns that are usually complicated to be learnt only in collaborative training. The locally trained model updates are then securely combined in a centralized server using adaptive federated averaging without having access to the raw data and, therefore, preserving their confidentiality of the data. The proposed architecture is effective in distributed and heterogeneous environments where under the experimental conditions taken into account in this study, its scalability, robustness and communication performance are improved. Using the provided means of wide-scale experimental analysis, the proposed FET-FIDS gives accuracy of 97.82%. It demonstrated that the proposed method is more effective, in terms of the detection, stability, and convergence behavior, than the existing centralized and federated IDS models. Further, it is shown that the framework can effectively deal with non-IID data distribution and the extensibility of the approach to different types of distributed network environment.
Jothi Prabha Appadurai, Revoori Swetha, V. Srinivas et al.· Scientific Reports· 1 citation
Internet of Things networks evolve as a rapidly growing field for security threats, such as Denial-of-Service cross-layer attacks, due to their heterogeneous and resource-constrained environment. Intrusion detection systems (IDSs) serve as a vital defense mechanism in modern cybersecurity. However, the adoption of such a system, especially one that adopts a cross-layer strategy, requires a standardized, multifaceted evaluation framework that accounts for both detection capability and operational overhead. To address these challenges, we proposed a modular weight-based framework that evaluates cross-layer Machine Learning (ML) IDS across multiple dimensions, namely, detection effectiveness and generalizability, data quality, and attack coverage and practical deployability. We then applied this framework to the state-of-the-art cross-layer ML IDSs identified through the PRISMA framework. This proof-of-concept application illustrates how current evaluation practices generate disparate, fragmented results, while also highlighting the limitations inherent in retrospective literature-based scoring.
Dimitrios Tasiopoulos, A. Xenakis, A. Lekidis et al.· Electronics· 0 citations
The rapid growth of Internet of Things (IoT) deployments has intensified the need for accurate and deployable network intrusion detection systems. Although machine learning based IDS models achieve high benchmark accuracy, most prioritize predictive performance without providing transparency or analyst-oriented validation mechanisms, limiting practical deployment in heterogeneous IoT environments. This paper presents CriticIDS, an automated and explanation-aware intrusion detection framework that integrates AutoML-driven model selection, SHapley Additive exPlanations (SHAP)–based feature attribution, and a decoupled large language model critique layer. The AutoML backbone adaptively selects and optimizes the most suitable learner for a given feature regime, while SHAP produces structured feature-level explanations. The language model analyzes prediction-attribution consistency and generates concise natural language rationales without participating in realtime inference, preserving CPU-efficient deployment. Across two public IoT intrusion detection datasets from the Canadian Institute for Cybersecurity, CriticIDS achieves up to 99.97% accuracy and 99.96% macro-averaged F1 under reproducible CPU-only evaluation. Comparative analysis against recent state-of-the-art methods demonstrates competitive or superior performance while uniquely combining automated model selection with semantic validation, indicating a practical pathway toward IDS systems that balance accuracy and interpretability.
Tasnimul Hasan, Samia Tasnim· Annual International Compute...· 0 citations