A Federated Deep Learning Framework for Precise IoT Intrusion Detection and Reinforcement-based Automated Cyber Response

Abstract

The rapid expansion of IoT deployments has created an attack surface that conventional intrusion detection systems are ill-equipped to defend.Centralized deep learning approaches compromise data privacy, while existing federated methods stop detection without addressing what the network should do next.This paper proposes a twostage framework that closes both gaps.In Stage 1, a federated CNN-BiLSTM-SGB model trained across eight non-IID clients produces a calibrated attack probability per flow, achieving a ROC-AUC of 0.9950 and an attack F1-score of 0.9924 on the CIC IoT Dataset 2023.In Stage 2, a dueling DDQN agent conditioned on that probability selects among six operational responses under the ATSR reward function, which weights penalties by attack severity and detection confidence.The agent reached a primary action accuracy of 97.73% and an attack-ALLOW rate of just 1.04%, with the highest accuracy recorded for the most dangerous threat categories.Together, the two stages demonstrate that federated data-local intrusion detection and severity-aware automated response can operate within a single coherent pipeline.