A Personalized Federated Autoencoder Framework for IoT Anomaly Detection and Policy-Mediated Firewall Enforcement

Edge protection of heterogeneous Internet of Things (IoT) devices needs per-device behavior models, cross-site learning, and blocking that spares legitimate services. This systems study presents the Personalized Federated Autoencoder Framework (PFAF), deployed on a Raspberry Pi access point. PFAF passively aggregates traffic into 60 s windows and keeps a scaler, autoencoder, and threshold per MAC address, sharing only model weights and summary statistics for FedAvg, so raw traffic never leaves the access point. It flags deviations from each device’s learned traffic rather than classifying attacks, blocking only after whitelisting and consecutive-window confirmation. Across 652,413 windows from 10 devices (84.3% from one, 8 modeled), global initialization lowered first-epoch loss 2.2- to 40-fold, and per-device models reconstructed traffic 3.5 to 308 times more accurately than the global model. A low-rate TCP SYN flood was detected about 9 s and blocked about 69 s after its first packet, through RST replies absent from training. A dry-run replay traced most false blocking to persistent legitimate behavior changes, and a whitelist learned over a period including such a change cut would-block decisions from 88.0 to about two per day with traffic. PFAF achieves edge detection and blocking, with enforcement as a separate, dry-run-calibrated stage.