Federated Learning-Based Intrusion Detection across Distributed IoT Devices with Privacy Preservation

Abstract

The exponential growth of Internet of Things (IoT) devices has significantly increased the surface for cyberattacks, posing serious challenges to network security, data privacy, and real-time threat detection. Conventional intrusion detection systems (IDS) often rely on centralized data aggregation, which introduces risks related to data exposure, latency, and scalability in resource-constrained IoT environments. This research proposes a privacy-preserving Federated Learning-Based Intrusion Detection System (FL-IDS) designed to operate effectively across distributed IoT devices without the need to share raw data. The goal is to enable collaborative model training among heterogeneous nodes while preserving data locality and improving detection accuracy. The system was developed using lightweight deep learning models trained on local device-specific subsets of the TON_IoT dataset, with secure model aggregation achieved through the Federated Averaging (FedAvg) algorithm. Experimental evaluations demonstrate the superior performance of the proposed FL-IDS compared to centralized and traditional machine learning methods. The system achieved an accuracy of 96.8%, precision of 95.9%, and F1-score of 96.5% while maintaining a low communication overhead of 1.2 MB/round and training time of 14.5 seconds/round. The model also exhibited robust convergence under non-IID data and acceptable performance with ε-differential privacy (ε = 1.0) at 95.1% accuracy. These results confirm that the proposed FL-IDS effectively balances privacy, performance, and efficiency, making it a strong candidate for deployment in real-world applications such as smart homes, healthcare, and intelligent transportation systems. The approach sets the foundation for future work in adaptive federated learning and resilient IDS in decentralized environments