Privacy-Preserving Collaborative Detection of Novel DDoS Attacks in IoT Networks Using Federated Learning

In Internet of Things (IoT) deployments, Distributed Denial-of-Service (DDoS) attacks are increasing in complexity and remain elusive to detection and mitigation because they rely on the proliferation of distributed devices, heterogeneous traffic patterns, and unknown, or zero-day, attacks. Most federated learning IDSs face issues such as inefficient feature selection, unstable aggregation across non-IID client distributions, high communication overhead, and limited generalisation to new attacks. To overcome these challenges, this paper proposes an Improved Whale Optimisation-based Adaptive Federated Neural Network (IWO-AFNN) for collaborative, privacy-preserving intrusion detection in distributed IoT systems. The proposed framework introduces a novel multi-stage Improved Whale Optimisation Algorithm (IWOA)-based feature selection algorithm, Adaptive Federated Learning (AFL), and a CNN-LSTM hybrid architecture to enhance feature discrimination, federated convergence stability, communication efficiency, and the ability to detect zero-day attacks. In practical IoT environments, the proposed AFL mechanism can effectively address non-IID data distribution, heterogeneous client participation, and intermittent communication. At the same time, the CNN-LSTM model captures all spatial and temporal traffic characteristics, enabling accurate intrusion detection. The experimental results on the CICIoT2023, ToN_IoT, and C-DDoS benchmark datasets demonstrated the effectiveness of the proposed scheme, achieving up to 99.91% accuracy and around 91% effectiveness in detecting unknown attacks. Moreover, the proposed framework considerably enhances scalability, robustness, and real-time applicability in large-scale IoT intrusion detection scenarios, and reduces communication overhead to ensure stable federated convergence. The results obtained show that the proposed IWO-AFNN framework is an efficient, scalable, and robust solution for cybersecurity systems in next-generation distributed IoT systems.