Open access

Scenario-Aware Federated Intrusion Detection for V2X-Inspired Edge Security: Calibration, Heterogeneity, and Communication Analysis

M. Reis

Jul 2026 · Electronics · 0 citations · 16 references

TL;DR

The findings support federated learning as a viable and communication-efficient direction for privacy-aware intrusion detection in distributed edge-security settings, while also highlighting the need for cautious interpretation, native V2X validation, and future robustness analysis against compromised federated clients.

Abstract

Vehicle-to-Everything (V2X) communication systems are becoming a foundational component of intelligent transportation systems, but their increasing connectivity also enlarges the cyberattack surface and raises important privacy and deployment challenges for intrusion detection. Conventional centralized intrusion detection systems can achieve strong predictive performance, yet they require aggregation of sensitive traffic data and may be difficult to deploy across distributed edge environments. This study presents a federated learning-based intrusion detection evaluation framework for privacy-aware and deployment-oriented security monitoring in V2X-inspired distributed environments. Rather than proposing a new detection architecture, the work focuses on a more rigorous and realistic assessment protocol for federated intrusion detection under scenario shift, client heterogeneity, threshold-sensitive operation, and communication constraints. The proposed approach combines group-based train/test partitioning to better reflect scenario separation, lightweight multilayer perceptron (MLP) models suitable for edge-side training, and explicit analysis of communication overhead and threshold calibration. Using the CICIDS2017 dataset as a controlled proxy benchmark, the study compares centralized baselines, local-only learning, FedAvg, and FedProx for binary intrusion detection under approximately IID and strongly non-IID client partitions. The experimental protocol uses equal training-set sizes across centralized and federated methods, an independent calibration set for threshold and checkpoint selection, and five independent random seeds, with results reported as mean ± standard deviation. The results show that the stricter group-based evaluation protocol substantially reduces performance compared with optimistic random-split evaluation, confirming the importance of scenario-aware validation for intrusion detection. Under the protocol, the best mean F1-score was obtained by FedAvg in the strong non-IID configuration, with an F1-score of 0.468 ± 0.028, followed closely by FedAvg under approximately IID partitioning with 0.463 ± 0.036. Centralized MLP, logistic regression, and random forest baselines achieved comparable but slightly lower F1-scores, indicating that federated learning remained competitive rather than clearly superior under this challenging setting. The analysis further shows that threshold calibration on an independent calibration set materially changes the operating point of the detectors, while validation-selected federated checkpoints generally occurred in later communication rounds within the tested 15-round budget. Communication analysis showed that the lightweight MLP required only approximately 72 kB per model update, corresponding to about 720 kB per federated round when both uplink and downlink traffic were counted for five clients. Overall, the findings support federated learning as a viable and communication-efficient direction for privacy-aware intrusion detection in distributed edge-security settings, while also highlighting the need for cautious interpretation, native V2X validation, and future robustness analysis against compromised federated clients.

DOI Semantic Scholar

Read PDF

Similar papers

Conference Open access 2026

Enhanced Intrusion Detection in IoT Networks using Federated Learning

The results show a success in implementing a real time, scalable, privacy-preserving, and adaptive IDS in large-scale IoT deployments through intelligent workload distribution between edge and cloud layers.

Chidera Winifred John, Eduediuyai Ekerete Dan, P. Asuquo et al. · E3S Web of Conferences · 0 citations

Open access Aug 2026

A Three-Stage Federated Distillation Framework for Robust Intrusion Detection in Heterogeneous IoT/Edge Networks

The framework is presented as a bounded, server-assisted robustness-oriented training strategy for heterogeneous IoT/edge intrusion detection, and shows competitive primary performance and stronger robustness in several severe label-skew settings.

Xudong Yang, Zikui Lin, Qiuyan Li et al. · Electronics · 0 citations

Open access Jul 2026

Evaluation and Calibration of Cross-Dataset Robustness in IoT Intrusion Detection Systems: A Deployment-Aware Approach

Introduction: The rapid expansion of Internet of Things (IoT) deployments has increased the cyber-attack surface and introduced heterogeneous traffic behaviour across devices, gateways, edge services, and network environments. Although many IoT intrusion detection studies report high performance under independent and identically distributed test conditions, such results often provide limited evidence of real deployment reliability, particularly for unseen hosts, cross-dataset transfers, and calibration drifts. Methodology: This study presents a deployment-aware evaluation and calibration framework for IoT intrusion detection using a Denoising Autoencoder-Based Deep Feature Extraction (DAE-DFE) backbone. Rather than proposing a new neural architecture, this study focuses on robustness-oriented evaluation protocols and calibration-aware decision-making under domain shifts. The framework was evaluated using conventional IID splits, identifier-removed testing, and source-IP-based GroupSplit evaluation on NF-ToN-IoT-v2 to reduce the memorisation of the host. Cross-dataset robustness was assessed by converting Edge-IIoTset packet/protocol logs into pseudo-flows and testing Edge→NF and NF→Edge transfer using unsupervised threshold adaptation based on positive rate matching. Results: On the NF-ToN-IoT-v2 GroupSplit, the framework achieved an F1 score of 0.9919 and ROC-AUC of 0.9997. In the Edge→NF cross-dataset setting, the model retained a meaningful ranking performance with ROC-AUC = 0.7962, while unsupervised threshold adaptation improved the target-domain accuracy from 0.4959 to 0.8878 and F1 score from 0.6630 to 0.8981. Conclusion: The findings show that calibration-aware thresholding and deployment-realistic evaluation are essential for assessing IoT IDS reliability beyond the conventional IID accuracy.

Ola Madi Mohammed Al Mari · Majestic International Journ... · 0 citations

Open access Jul 2026

FET-FIDS: a federated enhanced transformer-based framework for privacy-preserving network intrusion detection.

It is demonstrated that the proposed method is more effective, in terms of the detection, stability, and convergence behavior, than the existing centralized and federated IDS models, and can effectively deal with non-IID data distribution and the extensibility of the approach to different types of distributed network environment.

Jothi Prabha Appadurai, Revoori Swetha, V. Srinivas et al. · Scientific Reports · 1 citation

Open access Jul 2026

Evaluation Framework for Cross-Layer Intrusion Detection Based on ML Approaches

This work proposed a modular weight-based framework that evaluates cross-layer Machine Learning (ML) IDS across multiple dimensions, namely, detection effectiveness and generalizability, data quality, and attack coverage and practical deployability, and applied this framework to the state-of-the-art cross-layer ML IDS identified through the PRISMA framework.

Dimitrios Tasiopoulos, A. Xenakis, A. Lekidis et al. · Electronics · 0 citations

Conference Jul 2026

CriticIDS: LLM-Augmented Intrusion Detection with AutoML and Explainability for IoT Networks

The rapid growth of Internet of Things (IoT) deployments has intensified the need for accurate and deployable network intrusion detection systems. Although machine learning based IDS models achieve high benchmark accuracy, most prioritize predictive performance without providing transparency or analyst-oriented validation mechanisms, limiting practical deployment in heterogeneous IoT environments. This paper presents CriticIDS, an automated and explanation-aware intrusion detection framework that integrates AutoML-driven model selection, SHapley Additive exPlanations (SHAP)–based feature attribution, and a decoupled large language model critique layer. The AutoML backbone adaptively selects and optimizes the most suitable learner for a given feature regime, while SHAP produces structured feature-level explanations. The language model analyzes prediction-attribution consistency and generates concise natural language rationales without participating in realtime inference, preserving CPU-efficient deployment. Across two public IoT intrusion detection datasets from the Canadian Institute for Cybersecurity, CriticIDS achieves up to 99.97% accuracy and 99.96% macro-averaged F1 under reproducible CPU-only evaluation. Comparative analysis against recent state-of-the-art methods demonstrates competitive or superior performance while uniquely combining automated model selection with semantic validation, indicating a practical pathway toward IDS systems that balance accuracy and interpretability.

Tasnimul Hasan, Samia Tasnim · Annual International Compute... · 0 citations