Federated Learning for Distributed IoT Security: A Privacy-Preserving Approach to Intrusion Detection

We introduce <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Hybrid Adaptive-Weight Aggregation</i> (HADA), a privacy-aware weighting rule that couples SHAP-based feature stability with per-device differential-privacy (DP) budgets, enabling robust federated intrusion detection across heterogeneous IoT networks. Leveraging the CIC-BCCC-NRC TabularIoTAttack-2024 <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">and</i> Edge-IIoTset datasets, our approach lets 100 simulated ARM-class edge devices train local IDS models and share only DP-protected updates with a central server, thereby reducing communication overhead and eliminating raw-data exposure. A non-IID convergence bound for HADA-FL is proved, and a privacy–utility study shows that tightening the DP budget from ϵ = 5 to 0.5 lowers accuracy by only 1.4 percentage points (pp). Across both datasets the federated IDS attains detection accuracies of 85–89 %—comparable to centralized training—while sustaining 66–73 % accuracy under strong adversarial conditions (FGSM, PGD-10, 10%label-flip), 14–22 pp higher than vanilla FedAvg. These results demonstrate that HADA-FL delivers a scalable, privacy-preserving and attack-resilient IDS solution suitable for large-scale IoT deployments.