Adaptive Multi-Model Hierarchical Federated Learning for Robust IoT Intrusion Detection

The rapid growth of the Internet of Things (IoT) has introduced significant cybersecurity challenges in highly distributed, heterogeneous, and privacy-sensitive environments. Traditional centralized intrusion detection approaches and conventional federated learning (FL) frameworks, which rely on single-model aggregation, are often inadequate in the presence of extreme non-IID data and adversarial conditions. This study proposes an Adaptive Multi-Model Hierarchical Federated Learning (AMM-HFL) framework for robust IoT intrusion detection. The framework operates across client, edge, and cloud tiers and introduces a unified integration of similarity-aware clustering, multi-model aggregation, and dynamic client-side model selection. Unlike existing hierarchical FL approaches, AMM-HFL maintains multiple global models, enabling adaptive personalization and improved representation of heterogeneous data distributions. At the edge level, model updates are clustered to isolate anomalous contributions, while the cloud performs meta-aggregation to refine diverse model representations. Experimental evaluation on the IDSIoT2024 dataset demonstrates detection accuracy up to 96.83–97.54% under IID and 95.64–97.52% under non-IID conditions, while maintaining low computational and cryptographic overhead.