TL;DR
Experimental results demonstrate that the federated LLM-based models consistently outperform a multilayer perceptron baseline, with the LLaMA model achieving up to 99.9% accuracy and F1-score while generalising effectively to previously unseen device types.
Federated learning (FL) is a promising paradigm for privacy-preserving IoT intrusion detection, but its effectiveness can be substantially degraded by the combination of heterogeneous non-IID client distributions and severe multi-class imbalance. Under such conditions, conventional size-based aggregation may overemphasize large yet highly skewed clients, limiting the representation of minority attack classes in the global model. To address this issue, we propose Mean/Std, a lightweight distribution-aware aggregation strategy that combines a client-size proxy with two complementary statistics of local label distributions, namely the standard deviation and the dominance gap of class proportions, while preserving a communication footprint comparable to FedAvg. Experiments on the N-BaIoT benchmark, comprising seven heterogeneous IoT clients and eleven traffic classes, are conducted under a privacy-oriented update-perturbation setting inspired by secure aggregation workflows. The results show that Mean/Std consistently provides the strongest imbalance-aware performance among the evaluated FL baselines, achieving a Macro-F1 score of 0.8418 and a Balanced Accuracy of 0.8722 while improving the representation of minority attack classes. Additional experiments across five independent random seeds and a comprehensive hyperparameter sensitivity analysis further confirm the robustness and stability of the proposed aggregation mechanism. Overall, the results demonstrate that lightweight distribution-aware aggregation offers an effective, robust, and practically deployable solution for mitigating aggregation bias under simultaneous non-IID heterogeneity and severe multi-class imbalance in FL-based IoT botnet detection.
The rapid development of IoT devices has significantly contributed to digital transformation across organizations, enterprises, and institutions. The risk of malware infection on IoT devices has become increasingly prevalent and dangerous, with new attack methods and infection techniques. IoT devices, with their numerous, diverse types, configurations and resource usage characteristics, have raised new requirements for more efficient, accurate IoT malware detection methods and solutions that ensure privacy during model training in real-world applications. In this paper, we propose a more efficient IoT malware detection model based on an improved Federated Learning method. Specifically, our key contributions include a dynamic aggregation mechanism designed for clients with heterogeneous feature spaces, allowing resource-constrained IoT devices to adaptively adjust their feature dimensionality according to hardware capacity. The proposed malware detection model has been tested with an IoT dataset on the MIPS architecture platform. Experimental results show that the proposed malware detection model achieves good accuracy while strongly leveraging the advantages of Federated Learning in ensuring data privacy and minimizing computational resource usage during model training.
The results show a success in implementing a real time, scalable, privacy-preserving, and adaptive IDS in large-scale IoT deployments through intelligent workload distribution between edge and cloud layers.
The rapid integration of Internet of Things (IoT) in the healthcare domain has led to the emergence of the Internet of Medical Things (IoMT), which introduces significant benefits in patient monitoring and real‐time medical services. However, IoMT networks are inherently vulnerable due to resource constraints, heterogeneous devices, and sensitivity of medical data. In this paper, we propose a novel federated learning‐based anomaly detection system (Fed‐ADS) designed specifically for IoMT networks. Our system leverages local training of lightweight ML models on resource‐constrained IoMT devices and employs secure model aggregation at the gateway to preserve privacy and avoid centralized data collection. To address real‐world challenges, we implement and evaluate our system on a real IoMT testbed using Raspberry Pi devices under various attack scenarios. Furthermore, we examine the impact of privacy‐preserving techniques such as differential privacy on detection accuracy and system overhead. The runtime evaluation shows that our approach achieves high detection accuracy (over 94%) with minimal CPU and memory usage (under 3%), making it suitable for practical deployment in medical environments.
Internet of Things (IoT) devices are increasingly targeted by rapidly evolving malware, yet collaborative detection remains challenged by privacy leakage, noisy and imbalanced training data, and weak integrity guarantees when sharing model updates. This paper presents Mal-Fedchain, a secure and privacy-preserving framework for image-based IoT malware detection and prevention that couples federated learning with blockchain and honeypot-assisted behavioral monitoring, targeting Linux-capable IoT gateway devices. Portable Executable (PE) binaries are transformed into grayscale images using a corrected fixed-width byte-mapping pipeline stabilized by an information-maximizing GAN (IMGAN). A bi-level preprocessing pipeline applies two-sided weighted sparse representation (T-WSR) denoising—designed to selectively suppress zero-padding artifacts, high-entropy packed regions, and sparse opcode noise while preserving discriminative section-boundary texture—followed by geometric augmentation to mitigate class imbalance. Malware detection and family attribution are performed using a residual capsule-based network (RBCN) that fuses discriminative visual representations with PE-header features via concatenation, improving robustness against polymorphism and obfuscation. A formal threat model governs three adversary classes: a semi-honest aggregation server, a bounded fraction of malicious clients (up to 30%), and a passive eavesdropper. To enable collaboration without exposing raw data, clients train locally and share only MemCbar-encrypted updates; a permissioned Hyperledger Fabric blockchain ledger records hashed updates and security events to provide integrity, traceability, and tamper resistance. A file-system-integrated honeypot captures evasive behaviors and logs auditable evidence to strengthen prevention. Experiments on the Malimg dataset across five ablation configurations demonstrate that the corrected RBCN pipeline achieves 93.52% accuracy, 92.40% precision, 93.52% recall, 92.52% F-measure, MCC of 0.9245, and AUC of 0.9976 in its centralized configuration, and 65.62% accuracy with AUC of 0.9840 in the full federated configuration with five clients and eight communication rounds, substantially outperforming all baselines across all reported metrics.