PRIVACY-PRESERVING FEDERATED DEEP LEARNING FOR ZERO-DAY ATTACK DETECTION USING HYBRID CNN–LSTM NETWORKS

Abstract

The expanding deployment of Internet of Things (IoT) and Industrial Internet of Things (IIoT) devices increases exposure to previously unseen cyberattacks, while centralized intrusion-detection training requires network records from different sites to be pooled. This paper presents a federated convolutional long short-term memory framework (FCLSTM) for zero-day attack detection in distributed IoT/IIoT environments. Each client trains a local hybrid model in which one-dimensional convolutional layers extract local traffic patterns and an LSTM layer captures sequential dependencies. Only model updates are shared with the server; raw traffic records remain at their originating clients. The framework also incorporates an adaptive aggregation rule intended to account for client data volume, local model quality, and training behaviour under heterogeneous data distributions. Experiments on the ToN-IoT and IoT-23 datasets compare centralized and federated training, multiple client configurations, IID and non-IID settings, and standard aggregation baselines. The reported results indicate that the federated hybrid model approaches the predictive performance of centralized CNN-LSTM training while retaining data locality. The revised evaluation further defines the zero-day holdout protocol, convergence criterion, communication-cost calculation, and conditions used for baseline comparison. These findings support federated hybrid representation learning as a promising approach to distributed zero-day intrusion detection; however, formal privacy guarantees and operational attack mitigation remain outside the scope of the present study.