A novel FedLLM intrusion detection framework for privacy-preserving security in IoT enabled smart city network

Abstract

The proliferation of Internet of Things (IoT) devices in Smart City infrastructures has introduced unprecedented opportunities for automation, healthcare, and transportation, while simultaneously exposing the ecosystem to complex and multi-dimensional cyberattacks. Conventional intrusion detection systems (IDS) either lack semantic reasoning, ignore topological dependencies, or fail to preserve data privacy across heterogeneous networks. To address these challenges, we pro-pose a novel FedLLM-based hybrid IDS framework that integrates large language model (LLM)-driven semantic encoding, feature-based traffic representation, and graph neural network (GNN) embeddings to capture diverse attack patterns. The proposed architecture leverages a lightweight Transformer-based fusion detector for resource-efficient anomaly detection, while employing federated learning with differential privacy to enable secure collaborative training without raw data exchange. Experimental evaluation on benchmark IoT datasets, including CIC-IDS2017, demonstrates that the framework achieves superior accuracy (98.5%), macro F1-score (97.0%), and AUROC (99.9%) compared to state-of-the-art baselines. Furthermore, the model exhibits lightweight capacity with only 0.61 MB size and 158k parameters, enabling deployment on edge devices with minimal latency. By providing human-interpretable alerts through LLM explanations, the framework ensures both operational reliability and transparency in Smart City environments. The proposed framework establishes state-of-the-art