A Privacy-Preserving Federated Learning Framework for Intrusion Detection in Healthcare IoT Environments
TL;DR
PPFL-IDS combines federated model aggregation with differential privacy noise injection and secure aggregation protocols to train a lightweight gradient-boosted ensemble IDS without exposing local device data, demonstrating that strong privacy guarantees and high detection accuracy can be achieved simultaneously in federated HIoT security architectures.
Abstract
Healthcare Internet of Things (HIoT) deployments generate sensitive patient telemetry data on resource-constrained edge devices, which are prime targets for network intrusions. Centralizing raw telemetry for training intrusion detection system (IDS) models violates patient privacy and contravenes data-protection regulations such as HIPAA and GDPR. This paper proposes PPFL-IDS, a Privacy-Preserving Federated Learning framework for intrusion detection in HIoT environments. PPFL-IDS combines federated model aggregation with differential privacy noise injection and secure aggregation protocols to train a lightweight gradient-boosted ensemble IDS without exposing local device data. A heterogeneity-aware client selection mechanism addresses the challenge of non-independent and identically distributed (non-IID) data inherent in multi-site HIoT deployments. Evaluated on the UNSW-NB15 and a synthetic HIoT dataset spanning five attack categories, PPFL-IDS achieves a weighted F1-score of 0.938 and a mean detection latency of 20.3 ms, outperforming FedAvg, FedProx, and SCAFFOLD baselines while satisfying an ε-differential privacy budget of 1.2. Results demonstrate that strong privacy guarantees and high detection accuracy can be achieved simultaneously in federated HIoT security architectures.