SHFL-EI: Secure Hierarchical Federated Learning with Edge Intelligence for Robust IoT Security

Abstract

The rapid proliferation of Internet of Things (IoT) systems has significantly increased the attack surface of modern cyber-physical infrastructures, creating the need for scalable, intelligent, and privacy-preserving security solutions. Traditional centralized intrusion detection approaches are limited by high communication overhead, latency, and privacy concerns, particularly in large-scale and resource-constrained environments. This paper proposes SHFL-EI, a secure hierarchical federated learning framework enhanced with edge intelligence for robust anomaly detection in IoT systems. The proposed approach organizes collaborative learning across a three-tier architecture composed of IoT devices, edge nodes, and cloud servers, enabling scalable and distributed model training while preserving data locality. To address key challenges in federated learning, the framework introduces three novel mechanisms. First, a dynamic model segmentation strategy adapts training workloads to heterogeneous device capabilities while reducing communication overhead. Second, an edge-level adversarial update filtering mechanism detects and excludes malicious or anomalous model updates using trust-aware evaluation metrics. Third, an adaptive hierarchical aggregation scheme improves the robustness and efficiency of global model convergence across distributed edge clusters. The proposed framework is evaluated on benchmark IoT intrusion detection datasets, including TON IoT, N-BaIoT, and UNSW-NB15, under adversarial conditions such as model poisoning and gradient manipulation attacks. Experimental results demonstrate that SHFL-EI achieves superior anomaly detection performance, reduces communication overhead, and significantly improves robustness against adversarial participants compared to conventional federated and hierarchical learning approaches. These results highlight the effectiveness of combining hierarchical federated learning, edge intelligence, and security-aware aggregation to enable scalable and trustworthy AI-driven cybersecurity solutions for next-generation IoT environments.