Federated Learning for Privacy-Preserving Anomaly Detection in Heterogeneous IoT Networks
The rapid proliferation of Internet of Things (IoT) devices across smart homes, industrial plants, healthcare systems, and wearable platforms has generated an unprecedented volume of distributed, heterogeneous, and privacy-sensitive data. Conventional centralized anomaly detection pipelines require raw sensor and network traffic data to be transmitted to a central server, exposing sensitive information to interception, misuse, and regulatory non-compliance while also incurring substantial communication overhead. This paper proposes a Federated Learning (FL) framework for privacy-preserving anomaly detection tailored to heterogeneous IoT networks characterised by non-independent and identically distributed (non-IID) data, variable computational capacities, and intermittent connectivity. The proposed architecture couples a lightweight convolutional-recurrent local model with a differential-privacy-augmented Federated Averaging (FedAvg) aggregation strategy and an optional secure-aggregation layer to prevent gradient leakage. A dynamic client-selection and adaptive-weighting mechanism mitigates statistical heterogeneity across device clusters, while a local outlier-scoring module enables edge-level anomaly flagging without exposing raw payloads. Extensive simulation on merged benchmark traffic derived from N-BaIoT and CICIDS2017 characteristics, partitioned across simulated smart-home, industrial, and wearable clusters, demonstrates that the proposed framework attains 97.4%–97.7% detection accuracy, within one to two percentage points of a fully centralized, non-private baseline (98.6%), while reducing raw-data transmission to zero and lowering communication overhead relative to naive parameter exchange. Comparative results against local-only training confirm that federated collaboration yields a 9–10 percentage-point accuracy improvement under severe data heterogeneity. These findings indicate that the proposed method offers a practical, scalable, and regulation-compliant pathway toward trustworthy intrusion and anomaly detection in large-scale, heterogeneous IoT deployments.