An Adaptive Federated Learning with XGBoost Ensembles for Intrusion Detection in Heterogeneous IoT Networks

Enhanced Intrusion Detection in IoT Networks using Federated Learning

Existing Federated intrusion detection system (IDS) solutions unfittingly deploy homogeneous models across all devices regardless of resource constraints, lack real-time detection capabilities due to synchronous federated rounds, and fail to balance the trade-off between lightweight edge processing and deep analytical accuracy. This paper addresses these through intelligent workload distribution between edge and cloud layers. The system uses a dual-detection mechanism where lightweight Decision Tree (DT) models on IoT devices provide immediate threat classification with confidence scoring. High-confidence predictions enable instant response to attacks without waiting for the server, while uncertain cases are sent to a CNN-LSTM model for deep analysis. In the federated learning component, edge devices share only model corrections from server feedback rather than continuous parameter updates. The central server aggregates these learning experiences to refine a global model and redistributes the updates back to edge devices. This selective knowledge sharing reduces communication overhead while enabling continuous improvement of local models and ensuring privacy. The performance of the system was evaluated using the IoT-23 dataset. Our approach achieved an accuracy of 98.08% on edge detection and 95.27% in the overall asynchronous setup. These results show a success in implementing a real time, scalable, privacy-preserving, and adaptive IDS in large-scale IoT deployments.

FBID: Adaptive Personalized Federated Learning for Robust Out-of-Distribution Attack Detection in IoT Networks

Personalized Federated Learning (PFL) has emerged as a promising solution for intrusion detection in heterogeneous IoT environments, as it can improve local adaptation under highly Non-Independent and Identically Distributed (non-IID) data distributions. However, existing PFL methods often rely on client-side self-adjustment, which may lead to over-personalization and substantial degradation in out-of-distribution (OOD) attack detection. In this paper, we propose Federated Bandit Intrusion Detection (FBID), a novel adaptive PFL framework to address this limitation through server-side personalization control. In particular, FBID employs a contextual multi-armed bandit at the server to dynamically regulate each client's local training intensity according to its observed behavior and update quality. Moreover, FBID introduces a trust-based blending mechanism to derive client-specific interpolation coefficients between the global and local models, thereby preserving global attack-detection knowledge while still allowing beneficial local specialization. Through extensive experiments on the CICIoT2023 dataset under heterogeneous client distributions and OOD stress-test settings, we show that FBID improves individual client OOD Detection Rate (DR) by up to 7.66% and F1-Score (F1) by up to 5.08% (relative) over the strongest stable baseline, while also improving robustness to previously unseen attack classes.

RPPFL: Random Projection-Based Personalized Federated Learning for IoT Intrusion Detection

The rapid growth of the Internet of Things (IoT) in critical domains such as healthcare, smart cities, cybersecurity, and finance has led to the generation of large volumes of distributed data and increased susceptibility to cyberattacks. Although federated learning (FL)-based intrusion detection systems (IDS) have been introduced to support distributed learning and improve privacy, they still face several challenges, including performance limitations, high computation and communication overhead, and potential privacy attacks. To address these challenges, we propose a Random Projection-Based Personalized Federated Learning (RPPFL) framework for IoT intrusion detection. In the proposed framework, random projection, a lightweight one-way dimensionality reduction transformation, is applied at the IoT device level, which enhances privacy while lowering computational and communication costs. Furthermore, personalized federated learning at the fog layer reduces the computational burden on resource-constrained IoT devices and improves model robustness in environments where IoT data are non-independent and identically distributed (non-IID). We also introduce a conditional generative adversarial network (cGAN)-based privacy attack to evaluate the resilience of the proposed framework and demonstrate the effectiveness of our approach in preserving the privacy of IoT data. Experimental results on the RT-IoT 2022 and CIC-IoT 2023 datasets demonstrate that RPPFL provides high detection accuracy (above 95.0%) while preserving data privacy and reducing computation and communication overhead in dynamic IoT environments. The proposed framework is generalizable and applicable to a wide range of IoT intrusion detection scenarios.

Framework for Intrusion Detection in IoT Networks: A Lightweight Soft-Voting Ensemble of XGBoost and LightGBM with Explainable AI

The rapid propagation of Internet of Things (IoT) devices has significantly expanded the cyber-attack surface, particularly in essential infrastructure sectors such as energy, water, and healthcare. Machine learning (ML) based intrusion detection systems (IDS) offer a promising defense, but their real-world deployment is often hindered by data imbalance, lack of interpretability, and computational demands. In this paper, we introduce a lightweight ensemble approach, which integrates XGBoost and LightGBM using a soft-voting method. The system is evaluated on the IDSAI dataset after eliminating duplicates, resulting in 693,116 unique samples with a natural class imbalance. The preprocessing phase includes data cleansing and data scaling. The results indicate that the proposed ensemble achieves 99.95% accuracy, 99.95% F1-score, and a perfect AUC of 1.0 on a test set of 207,935 samples. Training completes in under 8 seconds on a standard CPU. The feature importance (gain) highlights delta_time; packet inter-arrival time, as the most significant feature, followed by source/destination ports. SHapley Additive exPlanations (SHAP) analysis provides local explanations, revealing that high inter-arrival times push predictions toward malicious—likely due to slow scanning or burst-and-pause attack patterns. All code and the trained model are publicly available to facilitate reproducibility1.

An enhanced federated learning-based multistage IDS for detecting zero-day and known threats in smart home ecosystem

Attention-based intrusion detection in MQTT-IoT network: a federated learning and deep reinforcement learning approach