A Privacy-Preserving Federated Learning Framework for Intrusion Detection in Healthcare IoT Environments

Abstract

Healthcare Internet of Things (HIoT) deployments generate sensitive patient telemetry data on resource-constrained edge devices, which are prime targets for network intrusions. Centralizing raw telemetry for training intrusion detection system (IDS) models violates patient privacy and contravenes data-protection regulations such as HIPAA and GDPR. This paper proposes PPFL-IDS, a Privacy-Preserving Federated Learning framework for intrusion detection in HIoT environments. PPFL-IDS combines federated model aggregation with differential privacy noise injection and secure aggregation protocols to train a lightweight gradient-boosted ensemble IDS without exposing local device data. A heterogeneity-aware client selection mechanism addresses the challenge of non-independent and identically distributed (non-IID) data inherent in multi-site HIoT deployments. Evaluated on the UNSW-NB15 and a synthetic HIoT dataset spanning five attack categories, PPFL-IDS achieves a weighted F1-score of 0.938 and a mean detection latency of 20.3 ms, outperforming FedAvg, FedProx, and SCAFFOLD baselines while satisfying an ε-differential privacy budget of 1.2. Results demonstrate that strong privacy guarantees and high detection accuracy can be achieved simultaneously in federated HIoT security architectures.