Federated Learning With Explainable AI for Malicious Traffic Detection in IoT Networks

The rapid proliferation of Internet of Things (IoT) devices has intensified the need for scalable, privacy-preserving, and interpretable intrusion detection systems (IDS). In this work, we propose a novel framework that combines Federated Learning (FL) with Explainable Artificial Intelligence (XAI) to detect malicious traffic across distributed IoT networks without centralizing sensitive data. Our IDS model employs a lightweight deep neural network trained collaboratively using FedAvg. SHAP provides global and local attributions; LIME supplies instance-level attributions complementary to SHAP. Experiments conducted on three benchmark datasets: Edge-IIoT, CIC-IoT2023, and TII-SSRC-23, demonstrated that our approach achieves 99.3%, 99.5% and 99.0% accuracy in binary classification, respectively and 97.2%, 98.0% and 96.5% accuracy in multi-class scenarios, respectively, closely matching centralized models while preserving data locality and data privacy. Moreover, the integrated XAI methods enhance the model’s transparency by identifying key traffic features contributing to each alert. These results establish FL-XAI as a practical, interpretable, and privacy-respecting IDS for real-world IoT deployments.