For IoT Intrusion Detection
Traditional centralized ML requires sharing raw IoT traffic data, violating privacy and compliance requirements. This work presents a fully automated federated learning pipeline where IoT devices train locally and share only model parameters.
The system requires zero expert configuration, reducing deployment from 8+ hours to under 1 hour.
The platform preserves privacy, supports extreme non-IID distributions, and maintains near-centralized performance for Mirai botnet detection, making it practical for healthcare-adjacent and security-sensitive environments where data confidentiality matters.
IoT deployments create extreme heterogeneity. Some devices see mostly attack traffic while others observe benign traffic. Standard federated learning often degrades under these conditions.
Clients with 100% single-class labels can break traditional local learning. This is a realistic edge case for IoT devices and was not handled by prior FL-IDS approaches.
Typical FL workflows require expert configuration for partitioning, tuning, orchestration, and evaluation, often taking more than eight hours for one deployment.
The N-BaIoT dataset is partitioned automatically with a Dirichlet distribution (α = 0.5) to simulate realistic non-IID behavior across clients.
Clients are configured automatically with balanced, skewed, and single-class distributions to stress-test the learning system.
A SAGA-based logistic regression model is trained locally, then aggregated through FedAvg weighted by sample counts.
The pipeline detects convergence automatically and stops early when 99.99% of final accuracy is reached, enabling single-round deployment.
| Client | Samples | Distribution | Status |
|---|---|---|---|
| Client 0 | 178,471 | 60% Benign / 40% Attack | Balanced |
| Client 1 | 178,471 | 5% Benign / 95% Attack | Skewed |
| Client 2 | 178,473 | 0% Benign / 100% Attack | Single-Class |
| Total | 535,415 | Non-IID (α = 0.5) | Automated |
Evaluated on 959,496 test samples
The automated convergence detector stops training after Round 1 when the threshold is met, supporting fast deployment on constrained infrastructure.
Only 108.75 KB are transferred for the federated process, compared with about 470 MB for centralized raw-data collection.
Mirai botnet traffic exhibits strong statistical signatures. Because of this, a lightweight SAGA logistic regression model with only 232 parameters achieves strong performance without complex deep learning.
Most notable result: Client 2 contains only attack labels, yet still reaches 99.91% accuracy because aggregation transfers benign-class information from the other clients.
The model size is only 1.81 KB, which makes the approach highly suitable for bandwidth-limited and embedded IoT settings.
The paper’s value is not only strong accuracy. It also removes repetitive manual FL setup steps, which is critical for real deployments and easier adoption by practitioners.