Enhanced Intrusion Detection in IoT Networks using Federated Learning

Abstract

Existing Federated intrusion detection system (IDS) solutions unfittingly deploy homogeneous models across all devices regardless of resource constraints, lack real-time detection capabilities due to synchronous federated rounds, and fail to balance the trade-off between lightweight edge processing and deep analytical accuracy. This paper addresses these through intelligent workload distribution between edge and cloud layers. The system uses a dual-detection mechanism where lightweight Decision Tree (DT) models on IoT devices provide immediate threat classification with confidence scoring. High-confidence predictions enable instant response to attacks without waiting for the server, while uncertain cases are sent to a CNN-LSTM model for deep analysis. In the federated learning component, edge devices share only model corrections from server feedback rather than continuous parameter updates. The central server aggregates these learning experiences to refine a global model and redistributes the updates back to edge devices. This selective knowledge sharing reduces communication overhead while enabling continuous improvement of local models and ensuring privacy. The performance of the system was evaluated using the IoT-23 dataset. Our approach achieved an accuracy of 98.08% on edge detection and 95.27% in the overall asynchronous setup. These results show a success in implementing a real time, scalable, privacy-preserving, and adaptive IDS in large-scale IoT deployments.