2026· International Conference on Security and Cryptography· pp. 108-120· 0 citations· 21 references
Computer Science
TL;DR
This work presents H OME G UARD, a collaborative IDS specifically designed for the constraints and threat model of practical smart home IoT infrastructures, and rethink FL deployment by of-floading model training to gateways to manage computational heterogeneity of IoT devices and organizing anomaly detection models into device-specific communities based on privacy-preserving traffic fingerprints which do not expose sensitive data.
Abstract
: Federated Learning (FL) has emerged as a promising approach to build collaborative Intrusion Detection Systems (IDSs) in the IoT, e.g., in smart homes. FL allows models to be shared without exposing sensitive training data, thus protecting the privacy of IoT users. However, existing FL-based IDSs rely on assumptions that rarely hold in practice, namely homogeneous devices, synchronous participation, and benign contributors. We argue that, in real-world smart homes, IoT devices are highly heterogeneous, resource-constrained, and attractive targets for adversaries, which makes conventional FL less effective or vulnerable to poisoning attacks. We present H OME G UARD , a collaborative IDS specifically designed for the constraints and threat model of practical smart home IoT infrastructures. In our approach, we rethink FL deployment by (1) of-floading model training to gateways to manage computational heterogeneity of IoT devices and (2) organizing anomaly detection models into device-specific communities based on privacy-preserving traffic fingerprints which do not expose sensitive data. Within communities and across smart homes, H OME G UARD implements an asynchronous, hierarchical FL architecture that tolerates device churn, uneven data availability, and Byzantine participants. Further, H OME G UARD applies Byzantine-robust aggregation at two levels: within local communities, and globally in the cloud to limit the impact of compromised devices. Experimental evaluation shows that H OME G UARD achieves an average true positive rate of 97.86% locally and 97.53% globally with a 0% false positive rate, while maintaining robustness against both targeted and untargeted poisoning attacks.
The rapid expansion of the Internet of Things (IoT) has intensified cybersecurity risks by exposing distributed connected devices to increasingly complex and pervasive threats. Conventional centralized security mechanisms often struggle to accommodate the heterogeneous and decentralized structure of IoT networks. This study investigates Federated Learning (FL) as a decentralized approach to intrusion detection that enables local model training on IoT edge devices while transmitting only encrypted model updates to a central server, thereby preserving data privacy and reducing communication overhead. A novel FL-based Intrusion Detection System (IDS) architecture was developed using Convolutional Neural Networks (CNNs) for anomaly detection and the Federated Averaging (FedAvg) algorithm for aggregating local model updates. The framework was evaluated on standard IoT datasets under non-independent and identically distributed (non-IID) data conditions to simulate heterogeneous real-world environments. Experimental results demonstrate that the proposed system achieved a detection accuracy of 94.6%, an F1-score of 93.8%, and a recall of 92.7%, outperforming centralized and standalone local learning methods. The framework also reduced communication overhead by 35% and achieved convergence 28% faster than conventional approaches. These findings demonstrate that FL can provide a scalable, privacy-preserving, and computationally efficient foundation for strengthening IoT cybersecurity. This study contributes a decentralized machine-learning architecture for real-time, adaptive, and privacy-conscious intrusion detection in large-scale IoT environments.
Mohammed Ajuji, Y. M. Malgwi, A. Ahmadu et al.· International Journal of Edu...· 0 citations
Simulation of a Federated Learning framework for privacy-preserving anomaly detection tailored to heterogeneous IoT networks characterised by non-independent and identically distributed data, variable computational capacities, and intermittent connectivity indicates that the proposed method offers a practical, scalable, and regulation-compliant pathway toward trustworthy intrusion and anomaly detection in large-scale, heterogeneous IoT deployments.
Raushan Raj, B. L. Pal, Saurab Singh· International journal of com...· 0 citations
Healthcare Internet of Things (HIoT) deployments generate sensitive patient telemetry data on resource-constrained edge devices, which are prime targets for network intrusions. Centralizing raw telemetry for training intrusion detection system (IDS) models violates patient privacy and contravenes data-protection regulations such as HIPAA and GDPR. This paper proposes PPFL-IDS, a Privacy-Preserving Federated Learning framework for intrusion detection in HIoT environments. PPFL-IDS combines federated model aggregation with differential privacy noise injection and secure aggregation protocols to train a lightweight gradient-boosted ensemble IDS without exposing local device data. A heterogeneity-aware client selection mechanism addresses the challenge of non-independent and identically distributed (non-IID) data inherent in multi-site HIoT deployments. Evaluated on the UNSW-NB15 and a synthetic HIoT dataset spanning five attack categories, PPFL-IDS achieves a weighted F1-score of 0.938 and a mean detection latency of 20.3 ms, outperforming FedAvg, FedProx, and SCAFFOLD baselines while satisfying an ε-differential privacy budget of 1.2. Results demonstrate that strong privacy guarantees and high detection accuracy can be achieved simultaneously in federated HIoT security architectures.
Nutan Gusain, J. Alzubi· International Journal on Com...· 0 citations
The proliferation of Internet of Things (IoT) devices in smart home environments has dramatically expanded the attack surface for cyber threats, particularly botnet-driven Distributed Denial of Service (DDoS) attacks. Centralized Intrusion Detection Systems (IDS) are ill-suited to this domain because they violate user privacy, introduce single points of failure, and incur prohibitive communication overhead. Federated Learning (FL) offers a compelling privacy-preserving alternative, yet existing FL-based IDS solutions either deploy convolutional or recurrent models in isolation, lack human-interpretable outputs, or neglect real-world deployability constraints. This paper proposes FedShield-IDS, a novel federated intrusion detection framework that integrates a hybrid one-dimensional Convolutional Neural Network with Long Short-Term Memory units to simultaneously capture spatial traffic fingerprints and long-range temporal attack dynamics across IoT edge devices. Model interpretability is addressed through the integration of SHapley Additive exPlanations (SHAP), enabling administrators to receive human-readable justifications for every detected anomaly. The system is trained and evaluated on the large-scale CICIoT2023 dataset, comprising 712,311 flow records spanning eight attack families including DDoS, DoS, Mirai, Reconnaissance, Spoofing, Injection, and Malware. A multi-stage preprocessing pipeline combining infinite-value imputation, logarithmic feature scaling, Min-Max normalization, temporal windowing, and localized SMOTE oversampling is applied within each federated client to address non-IID data and extreme class imbalance. Federated Averaging aggregates encrypted model updates across seven virtual IoT client nodes over five communication rounds without exchanging raw traffic data, under a formal threat model characterizing the system’s adversarial assumptions and data-confidentiality guarantees. Experimental results demonstrate a Mirai F1-score of 0.99, a DDoS precision of 0.97, and a global weighted F1-score of 0.76 across all eight classes. Comprehensive kernel-size, architecture, and preprocessing ablations confirm the necessity of each design choice, and independent cross-dataset evaluation on the Edge-IIoTset benchmark achieves 98.58% accuracy, demonstrating strong generalization beyond CICIoT2023. The framework achieves sub-500 ms threat mitigation, empirically confirmed via a mitigation-gate threshold sensitivity analysis, and generates SHAP-gated explanations for every alert, bridging the gap between high-accuracy detection and the transparency required for trustworthy smart-home security.
Ghada Abdelhady, Karim Wael Hussein, Islam Anwar Ali Gad· Scientific Reports· 0 citations
Federated Bandit Intrusion Detection (FBID), a novel adaptive PFL framework to address this limitation through server-side personalization control, employs a contextual multi-armed bandit at the server to dynamically regulate each client's local training intensity according to its observed behavior and update quality.
A. Bui, C. T. Nguyen, Hoang-Anh Pham et al.· 0 citations
With the increasing presence of IoT devices in the real world, this widespread presence leads to serious security challenges related to the privacy of these devices' data. Despite the important role of intrusion detection system (IDS) and its ability to identify malicious security activities in traditional centralized learning solutions that rely on collecting raw data from devices and sharing it directly to a central server, these solutions may raise concerns regarding data privacy and an increase in communication overhead. To address these challenges, this study proposes a privacy-preserving intrusion detection system using federated learning (FL) that enables distributed IoT devices to engage in collaborative learning, without share the raw data, only updates, with taking into account the preservation of data privacy, all existing IoT clients independently train the Multilayer Perceptron (MLP) models on their own data only, and then share only the models updates with the central server, the Federated Averaging (FedAvg) algorithm is used within the central server to aggregate the updates and create a global model. The proposed framework was evaluated using the NF-BoT-IoT dataset. The experimental results demonstrate that the proposed lightweight IDS achieves an accuracy of 83.21% and an F1-score of 81.78 %, with performance comparable to the centralized learning approach while preserving client data privacy. In addition, the proposed hybrid feature selection approach reduces the feature space from eight to five features, resulting in measurable computational benefits. In particular, leading to a 15.21% reduction in inference time, a 4.59% reduction in training time, and a 2.78% reduction in memory usage. These results demonstrate that the proposed framework not only maintains competitive detection performance and data privacy but also reduces computational and memory requirements, supporting its suitability as an effective and lightweight IDS for resource-constrained IoT environments.
Ali Abd Alraheem, Ali Obeid, Bassam Noori Shaker· Wasit Journal of Engineering...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
