Federated Learning-based Anomaly Detection for IoT Security Attacks

Abstract

The rapid advancement of network technologies has heightened the risk of device and data breaches, particularly during data sharing and storage processes. To mitigate these threats, Machine Learning (ML) and Deep Learning (DL)-based Intrusion Detection Sys- tems (IDS) have shown great potential. However, traditional training approaches that require centralized data aggregation often pose significant privacy and confidentiality concerns. Federated Learning (FL) addresses this issue by enabling local model training on edge devices, eliminating the need to share raw data, and instead securely aggregating model updates in a decentralized fashion. In this study, we introduce a unified IDS leveraging a hybrid CNN-LSTM model within an FL framework, using the realistic TON-IoT dataset to reflect actual IoT environments. Experimental results demonstrate the effectiveness of the proposed model, achieving a classification accuracy of 90.84% for multiclass detection and 92.02% for binary classifica- tion in a centralized setting, while maintaining competitive performance in the federated environment with 87.6% accuracy for multiclass and 88.5% for binary classification. These findings highlight the potential of combining CNN and LSTM architectures within an FL setup to build intelligent, privacy-preserving, and secure IDS solutions for IoT ecosystems.