FedStaP: Shared Feature Statistics and Prior-Calibrated Training for Non-IID Federated Intrusion Detection in IoT Networks

Abstract

Federated learning allows IoT gateways to train a shared intrusion detector without exporting traffic records, but gateways observe different attack classes and scale their flow features differently. Stateful optimisers such as SCAFFOLD correct the resulting client drift at the cost of per-client memory and twice the per-round upload, and personalised methods do not yield a single model that can be deployed at new gateways. This paper proposes FedStaP, a stateless federated method with a single model upload per round, which combines two corrections. Shared feature statistics standardise every client with pooled moments obtained from one exchange of per-feature sums. A prior-calibrated local loss offsets each client's logits by its own log-prior, so that the averaged model approximates a prior-free classifier. Server aggregation is unchanged from FedAvg. FedStaP and ten global-model baselines were implemented and evaluated in 738 training runs on CICIoT2023 and Edge-IIoTset. FedStaP attains the highest macro-F1 among the nine stateless methods at both label granularities on both datasets (56.47%, 63.01%, 75.56% and 86.60%). On grouped attack families it is statistically indistinguishable from SCAFFOLD (−1.20 percentage points, p = 0.32) while uploading half as much, and on fine-grained labels SCAFFOLD leads by 7.64 points. Neither correction improves macro-F1 in every setting on its own; their combination does. SCAFFOLD leads with 20 or fewer clients and strong skew, whereas FedStaP leads with 50 and 100 clients and under milder skew. Preprint, not peer reviewed. The complete research artefact — code, per-run results and the trained model of every run — is archived separately at https://doi.org/10.5281/zenodo.23005733.