Dataset-Centric Evaluation of Federated Intrusion Detection Models in IoT Networks

Overview

Dataset-Centric Evaluation of Federated Intrusion Detection Models in IoT Networks is a Scientific Reports study that systematically evaluates federated learning approaches for IoT intrusion detection across heterogeneous datasets. It highlights how dataset characteristics influence federated model performance and generalization.

Research Motivation

• Most prior evaluations use a single dataset, risking overfitting to specific traffic patterns.
• Federated learning allows collaborative IDS training without sharing raw traffic, preserving privacy.
• The study investigates how well federated IDS models generalize across diverse IoT datasets.

Datasets and Attack Profiles

• Multiple recent IoT and IIoT intrusion datasets are leveraged, each with distinct traffic profiles, attacks, and feature representations.
• Datasets are chosen to capture attack diversity and realistic IoT conditions.
• Label and feature harmonization is performed to enable multi-dataset federation.

Federated Learning Methodology

• Algorithms evaluated include FedAvg, FedProx, and FedNova.
• Model architectures include LSTM and Transformer networks.
• Clients are constructed to reflect non-IID scenarios typical of IoT deployments.

Evaluation Scenarios and Findings

• In-domain, out-of-domain, and multi-dataset federation scenarios are explored.
• Results show strong in-domain performance and highlight challenges for cross-dataset generalization.
• Attack diversity and dataset heterogeneity are shown to be critical factors.

Use Cases

• Privacy-preserving collaborative IDS across organizations or deployments.
• Assessing IDS robustness when deployed in new IoT environments.
• Guiding the design of future IoT security datasets tailored for federated learning.

Access and License

The methodology and results are published in Scientific Reports under open access. The evaluated datasets are publicly available from their respective sources and must be accessed under their own licenses.