IOT Intrusion Detection System Based on Federated Deep Learning

Abstract

The Internet of Things (IoT) ecosystem generates vast streams of sensitive data, rendering it an attractive target for cyber-attackers seeking to exploit user privacy. Traditional intrusion detection approaches rely on centrally aggregated datasets, which poses significant privacy and communication overhead concerns. In this work,we introduce a federated learning (FL)-based intrusion detection framework that employs a hybrid CNN-LSTM-GRU model on each IoT edge device. Raw traffic remains on the device; only model weight updates are exchanged with a central FL server and aggregated via FedAvg, preserving data privacy and reducing bandwidth usage. We evaluate our method on the Edge-IIoTset dataset under both binary and multiclass classification tasks. For binary intrusion detection (Normal vs. Attack), our FL approach achieves 97.5 % accuracy under IID data partitions and 95.8 % under non-IID partitions, compared to 98.2 % from a centralized baseline. For multiclass detection across 16 traffic categories, FL attains 90.4 % accuracy in IID scenarios and 88.7 % under non-IID, closely matching the 91.0 % centralized performance while upholding user data confidentiality. These results demonstrate that a federated, hybrid deep-learning solution can approach centralized detection performance without centralizing raw IoT data, offering a practical balance between security, privacy, and communication efficiency in real-world IoT deployments.