Federated Learning for Resource-Aware Intrusion Detection in IoT Networks: An Empirical Study of IID and Device-Level Non-IID Data

Abstract

Official reproducibility package and research paper for:"Federated Learning for Resource-Aware Intrusion Detection in IoT Networks: An Empirical Study of IID and Device-Level Non-IID Data". ABSTRACT:The proliferation of Internet of Things (IoT) devices has expanded the network attack surface, increasing the risk of botnet-driven intrusions such as Mirai and Gafgyt campaigns. Centralizing raw network traffic from IoT devices for intrusion detection raises data locality concerns and imposes bandwidth costs. Federated learning (FL) offers a decentralized training paradigm in which devices contribute model parameter updates rather than raw data; however, the practical utility of FL for IoT intrusion detection under real-world device-level data heterogeneity has not been empirically characterized with transparent methodology and explicit scope documentation. This paper presents a controlled empirical study comparing four training conditions on the N-BaIoT dataset: (1) a Centralized baseline, (2) Local-Only isolated training, (3) Federated Averaging (FedAvg) under a natural device-level Non-IID partition, and (4) FedAvg under a controlled class-stratified IID partition. All experiments use a compact feed-forward neural network (SmallMLP, 9,537 parameters) for binary botnet intrusion detection across 9 commercial IoT device types (7,062,606 total observations, 115 features). HEADLINE RESULTS:- Centralized Baseline: Global Test F1 = 0.997097 (ROC-AUC: 0.996899)- Controlled IID FedAvg (Round 3): Global Test F1 = 0.999430 (ROC-AUC: 0.999859)- Device Non-IID FedAvg (Round 3): Global Test F1 = 0.975696 (ROC-AUC: 0.992387)- Local-Only Baseline: Macro Test F1 = 0.971422 (ROC-AUC: 0.994417)- Parameter Payload: 38,148 bytes per transfer; 2,059,992 bytes (~1.96 MiB) cumulative over 3 rounds. REPOSITORY & CODEBASE:GitHub: https://github.com/Moazzam9/federated-iot-idsLicense: MIT License