An Adaptive Federated Learning with XGBoost Ensembles for Intrusion Detection in Heterogeneous IoT Networks

Abstract

: The rapid growth of the Internet of Things (IoT) devices has increased the attack area of modern networks, which makes effective intrusion detection systems (IDSs) essential to detect attacks that target IoT infrastructures. Federated learning is a promising approach for collaborative model training in the absence of centralized raw data. Conventional federated approaches rely on fixed client participation and static training configurations, which ensure symmetric treatment of clients despite heterogeneous local data distributions. This can limit convergence and degrade detection performance in non-IID conditions. This paper proposes an Adaptive Action-Based Federated Learning (AA-FL) framework for decentralized intrusion detection in heterogeneous IoT environments. The framework dynamically adjusts both participating clients and local training workload at each communication round using a Linear Upper Confidence Bound (LinUCB) contextual bandit controller. The proposed Adaptive-FL model is based on XGBoost boosters and uses quality-weighted server-side ensemble aggregation. At the same time, adaptation is guided by a multi-objective reward that balances classification performance, training latency, communication overhead, and computational cost. The framework is evaluated on CIC IoMT 2024 and RT-IoT2022 under realistic non-IID conditions using stratified 5-fold cross-validation and benchmarked against Static-FL, FedAvg-FL, and a centralized XGBoost upper bound. Experimental results demonstrate that Adaptive-FL outperforms all federated baselines across both datasets, achieving Macro-F1 scores of 98.27% on RT-IoT2022 and 94.21% on CIC IoMT 2024, with statistically significant improvements over Static-FL on both datasets. Adaptive-FL maintains superior classification stability while avoiding raw-data centralization. It remains within 0.67 and 0.35 percentage points of the centralized upper bounds on RT-IoT2022 and CIC IoMT 2024, respectively.