An adaptive federated deep learning approach for efficient DDoS detection in IoT edge networks

Abstract

Abstract The rapid growth of the Internet of Things (IoT) has expanded the attack surface of modern networks, motivating the need for accurate detection of DDoS and botnet activity in resource-constrained settings. Centralised intrusion detection systems (IDS) face privacy, scalability, and heterogeneity challenges that limit their suitability for IoT. This study suggests a Federated Learning-based Intrusion Detection System (FL-IDS) for IoT edge networks in order to get around these restrictions. Each client trains a hybrid CNN-LSTM model locally, and a central server aggregates client updates with Federated Averaging (FedAvg). An adaptive global decision-threshold optimisation is used post-training to the pooled predictions of the global model on the held-out test partition in order to address class imbalance. The system is evaluated on the N-BaIoT benchmark together with preliminary validation on a recent public healthcare IoT dataset, with the nine N-BaIoT devices treated as independent federated clients during the primary federated evaluation. The global model achieves an accuracy of 0.9238, precision of 0.9265, recall of 0.9963, F1-score of 0.9601, ROC-AUC of 0.8133, and PR-AUC of 0.969 at the optimal operating point $$\tau = 0.15$$ . SHAP-based post-hoc analysis identifies the traffic features that most influence model decisions.