Byzantine-resilient federated edge intrusion detection for heterogeneous IoT networks under non-IID conditions

Abstract

Intrusion detection at the edge of the Internet of Things (IoT) runs into two problems at the same time. Traffic is not identically distributed across devices, because a camera, a thermostat and a gateway do not behave alike, and some of the participating nodes cannot be trusted to report honestly. Federated learning fits the setting well, since it keeps raw traffic on the device and shares only model updates. The catch is that its standard averaging rule is fragile. A small group of malicious clients can quietly steer the shared model, and that fragility gets worse once the data is heterogeneous. We study how to keep a federated intrusion detection system accurate when both problems are present at once. We build a compact CNN–BiLSTM detector that is small enough to run on constrained edge hardware, train it federally across twenty non-IID clients, and compare five aggregation rules under three poisoning strategies. The comparison spans 641 completed training runs: five random seeds per configuration for the headline grid and three for the sweep and privacy tiers, with experimental performance results reported as means with 95% confidence intervals and every claim of superiority tested by a paired t-test with Holm correction. On CICIoT2023 every rule reaches an attack-free F1 of 0.989–0.990, and a thirty-percent sign-flipping adversary collapses plain federated averaging to a constant prediction, taking its Matthews correlation from 0.979 to 0.000, while trust-weighted aggregation (FLTrust) and multi-Krum hold 0.981 and 0.980. Sweeping the adversarial fraction from 0.05 to 0.45 locates each rule’s empirical breakdown point: federated averaging fails at 0.05, the coordinate-wise rules at 0.20, and multi-Krum at 0.45, which is exactly the \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$(K-2)/2K$$\end{document} bound its theory predicts. On the harder TON_IoT and Edge-IIoTset benchmarks no rule is uniformly best: unattacked federated averaging is the strongest configuration, so robustness is insurance carrying a measurable clean-data premium rather than a free improvement. A formal Rényi accounting of the client-level differentially private variant reverses a claim made in the original submission: with twenty clients and full participation there is no privacy amplification by subsampling, and no operating point we evaluated maintains useful detection at a meaningful budget, which we explain with a closed-form noise-to-signal argument rather than leave as an empirical curiosity. Finally, the detector was compiled and timed on a physical ESP32, where one inference takes 23.5 ms using 24.7 KB of flash for weights and 5.0 KB of scratch RAM, reproducing the host logits to within \documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$6\times 10^{-8}$$\end{document}. We release the full training and evaluation pipeline, including a checkpoint-and-resume mechanism, so the comparison can be reproduced.