CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification Iason Ofeidis∗ , Nikos Papadis† , Randeep Bhatia† , Leandros Tassiulas∗ , TV Lakshman† ∗ Yale University, New Haven, CT, USA
arXiv:2605.06571v1 [cs.LG] 7 May 2026
† Nokia Bell Labs, Murray Hill, NJ, USA
Abstract—The rapid expansion of the Internet of Things (IoT) and Industrial IoT (IIoT) has created a massive, heterogeneous attack surface that challenges traditional network security mechanisms. While Federated Learning (FL) offers a privacypreserving alternative to centralized Intrusion Detection Systems (IDS), standard approaches struggle to generalize across diverse device behaviors and typically fail to utilize the vast amounts of unlabeled data present in realistic edge environments. To bridge these gaps, we propose CLAD, a holistic framework that seamlessly incorporates Clustered Federated Learning (CFL) with a novel Dual-Mode Micro-Architecture (DM2 A). This unified approach simultaneously tackles the two primary bottlenecks of IoT security: device heterogeneity and label scarcity. The DM2 A component features a shared encoder followed by two branches, enabling joint unsupervised anomaly detection and supervised attack classification; this allows the framework to harvest intelligence from both labeled and unlabeled clients. Concurrently, the clustering component dynamically groups devices with congruent traffic patterns, preventing global model divergence. By carefully combining these elements, CLAD ensures that no data is discarded and distinct operational patterns are preserved. Extensive evaluations demonstrate that this integrated approach significantly outperforms state-of-the-art baselines, achieving a 30% relative improvement in detection performance in scenarios with 80% unlabeled clients, with only half the communication cost. Index Terms—Federated Learning, Internet of Things, Clustered Federated Learning, Multi-task Learning, Semi-supervised Learning, Intrusion Detection, Heterogeneity, Anomaly Detection, Attack Classification, Personalization
I. I NTRODUCTION The integration of the IoT and IIoT has embedded intelligent connectivity into the fabric of critical infrastructure, smart cities, and autonomous systems [1]–[3]. As these networks expand, they create a vast and diverse attack surface, ranging from low-power environmental sensors to highperformance autonomous drones [4]. Securing these ecosystems is paramount; however, the sheer scale and heterogeneity of IoT devices make traditional defense mechanisms increasingly obsolete [5]. Traditionally, network security has relied on centralized Intrusion Detection Systems (IDS), where data from all edge devices is transmitted to a central server for analysis [6]. In the IoT context, this approach can be fundamentally flawed. Centralization creates significant bottlenecks in scalability
B. Naïve FL
A. Centralized
Global Anomaly Detection Model
Raw Network Traffic
- Sensitive Traffic Exposure - Scalability - High Bandwidth Cost
- Fails on Heterogeneous Traffic - Unlabeled Clients Do Not Contribute
C. Our Approach
Clustered FL
Dual-Mode Micro-Architecture
+ Label Agnostic + Specialized Models + Privacy Preserving
: Labeled : Unlabeled
Fig. 1: While centralized methods compromise privacy and standard FL fails to utilize unlabeled heterogeneous traffic, our proposed framework employs clustering and DM2 A to ensure specialized, label-agnostic network anomaly detection and attack classification.
and bandwidth [7], introduces substantial latency for realtime applications, and, perhaps most critically, violates strict privacy standards by exposing sensitive operational data to external servers [8]. Federated Learning (FL) has emerged as a solution to these centralized limitations, enabling devices to train collaborative models by sharing only weight updates rather than raw data [9]. While FL addresses the privacy and bandwidth issues, standard implementations underperform in IoT environments because they force a single global model to represent a highly heterogeneous population of devices [10], [11]. A traffic pattern that is benign for a high-throughput video camera may mimic a Denial-of-Service (DoS) attack for a constrained sensor. As illustrated in Figure 1, a naı̈ve global FL model struggles in distinguishing these contradictory patterns, often resulting in suboptimal model performance. To address this, Clustered Federated Learning (CFL) serves as a critical architectural evolution. CFL segments the network, dynamically grouping devices with similar behaviors to train specialized, high-accuracy models [12]–[14]. Unlike standard FL, which blindly aggregates updates from incongruent sources, CFL identifies communities of clients with congruent data distributions (e.g., separating “camera traffic” from “sensor traffic”). This separation is indispensable in complex IoT
ecosystems, as it ensures that the unique operational patterns of specific device groups are preserved rather than averaged out. By maintaining distinct models for distinct clusters, CFL resolves the conflicts inherent in global aggregation, leading to faster convergence and drastically improved performance. However, a distinct and often overlooked limitation in existing literature is the rigid adherence to single-task learning. Most FL frameworks (standard or clustered) target either supervised attack classification or unsupervised anomaly detection in isolation. This “one-or-the-other” approach is insufficient because it fails to account for the inherent differences in data availability across clients. In realistic IoT environments, obtaining high-quality labels is expensive and rare, leading to a scenario where a few clients possess labeled data while the majority operate with unlabeled traffic [15], [16]. Consequently, in existing supervised systems, unlabeled clients do not contribute to learning performance improvement, while purely unsupervised systems are blind to the specific attack intelligence offered by labeled ones. To achieve operational resilience, an IDS must be capable of utilizing all information available from participating devices. It must seamlessly integrate supervised and unsupervised learning streams, ensuring that no label, however scarce, is discarded, and no device, however unlabeled, is excluded from the collective defense. To bridge these gaps, we propose CLAD, a Clustered Labelagnostic federated learning framework for joint Anomaly Detection and attack classification that unifies Clustered FL with a Dual-Mode Micro-Architecture (DM 2 A). Our lightweight DM 2 A model features a shared encoder that branches into two tasks: unsupervised anomaly detection and supervised attack classification. This design allows us to decouple the dependency on labels. Clients with labeled data refine the network’s classification capabilities, while clients with only unlabeled data contribute to the underlying anomaly detection boundaries. This hybrid approach extends security coverage across the network. By enabling exchange of knowledge within clusters, a simple, unlabeled sensor can effectively benefit from the threat signatures learned by a sophisticated, labeled peer with a similar behavioral pattern. Critically, the framework is engineered for efficiency and robustness. It minimizes communication and computational overheads, ensuring viability on resource-constrained devices. The key contributions of this paper are summarized as follows: • A Unified Dual-Mode Framework: We propose CLAD, a lightweight joint learning framework capable of simultaneous Anomaly Detection and Attack Classification. The unique Dual-Mode Micro-Architecture allows resource-constrained IoT devices to perform both tasks efficiently within a single training pass. • Hybrid Label Utilization: We introduce and validate a strategy to leverage both labeled and unlabeled data, maximizing data utility and performance in label-scarce environments. • Personalization via Clustering: We demonstrate that grouping similar clients prevents global model confusion, significantly boosting learning performance.
Robustness and Efficiency: Our approach outperforms state-of-the-art baselines, while exhibiting high accuracy and low communication and computational overhead and maintaining high performance even with small local datasets and varying network scales. • Algorithm-Agnostic Flexibility: Our framework is modular and supports the integration of various CFL algorithms to adapt to different IoT environments. The rest of the paper is structured as follows. Section II reviews related work. Section III introduces our proposed model and framework. Section IV outlines the experimental setup and Section V presents the results. Finally, Section VI concludes the paper. •
II. R ELATED W ORK Centralized intrusion detection Most IDSs are designed under the strong assumption that data resides in a centralized repository. For instance, [17] simultaneously performs IoT device identification and anomaly detection using a feature extraction process and a centralized classifier. In a similar centralized fashion, [18] introduces an unsupervised learning approach based on autoencoders and Principal Component Analysis (PCA) to identify both known and unknown anomalies. FL for Anomaly Detection The assumption that the data can be centralized is often not realistic, as data/device owners might be reluctant to share raw data. DÏoT [19] is probably the first work that applied FL for anomaly detection. It relies on an external method for device type identification, and its goal is device-type-specific anomaly detection with no false alarms. This is achieved with a hierarchical architecture: model training and anomaly detection (inference) happens at “security gateways” (akin to edge servers), and federated averaging happens at the “IoT security service”, i.e. centrally. Unlike DÏoT, our approach does not rely on known or precomputed device types. Instead, it groups devices with similar behavior through clustering that happens intertwined with model training. Mothukuri et al. [20] performs regular FedAvg (i.e. the first FL algorithm as introduced by [9]) on Gated Recurrent Units (GRUs) and utilizes ensemble learning to achieve attack classification in a supervised setting. Jithish et al. [21] performs an experimental study to compare FedAvg’s performance when using different models (regression, autoencoders, classifiers) for anomaly detection in IoT and smart grids. Kelli et al. [22] creates an FL-based IDS that utilizes active learning to achieve personalization. FL for Attack Classification For certain application domains, detecting anomalies may not be enough, since different attacks require different mitigation approaches. Thus, attack type identification becomes necessary. Some works have looked at this problem from a supervised lens. For instance, LocKEdge [23] applies FL using a simple neural net to classify labeled DoS and other attack data. FedJam [24] similarly leverages a multimodal lightweight FL framework to classify wireless jamming attacks, while [25] uses a more elaborate architecture to perform supervised attack classification for
Software-Defined Networks (SDN)-based IIoT environments. A different approach by [26] utilizes FL in a semi-supervised setting: an autoencoder is trained using unlabeled data in a federated manner, and the server adds some layers to the model and trains it in a supervised and centralized manner on publicly available data. Clustered FL for Anomaly Detection Clustered FL has been employed by some works for anomaly detection purposes in an IoT setting. ClusterFLADS [14] performs regular federated averaging as per [9] for a few rounds. It then uses feature extraction on the local models via PCA, and the extracted feature vectors are clustered using k-means. From then on, multiple federated averaging algorithms are run in parallel, one per cluster. Wei et al. [27] introduces a one-shot clustering method that groups clients into clusters, and uses a committee of clients in order to assign scores to models and filter out outlier models before averaging. In [28], clients send their model parameters to the server, the server applies PCA on them and finds the best number of clusters by sweeping through a range of possible values. Then, each of the formed clusters performs FedAvg. Unlike the above one-shot clustering approaches, our approach performs simultaneous clustering and training, i.e. the clustering is refined at every round, resulting in higher clustering and model accuracy. Overall, our approach extends the existing literature by performing joint anomaly detection and attack classification thanks to our dual-mode architecture, and doing so in a personalized manner that is friendly to different clustered FL algorithms, while taking advantage of both labeled and unlabeled data. III. S YSTEM A RCHITECTURE We now introduce CLAD’s architectural components that allow it to leverage both labeled and unlabeled data to jointly perform the two tasks in a personalized fashion. We consider an environment with N devices belonging to K different groups (e.g. of the same device type or behavioral pattern). Each client i ∈ {1, . . . , N } has a private dataset Di consisting of potentially both benign and attack samples. The system consists of two primary components: a Dual-Mode MicroArchitecture (DM2 A) deployed on edge devices, and the employment of the CLoVE mechanism [29] on the server for clustered federated aggregation1 . A. Dual-Mode Micro-Architecture (DM 2 A) To reconcile the competing requirements of high-fidelity anomaly detection and attack classification while achieving resource efficiency, we propose the Dual-Mode MicroArchitecture (DM2 A), where micro denotes a compact, lightweight design tailored for constrained IoT devices. This 1 Note that we opt against using tree-based models (e.g. decision trees, random forests, gradient-boosted decision trees), as they face notable challenges in FL settings: significant communication overhead to determine optimal splits at each node and scaling difficulties as the number of clients/features increases [30]–[32]; complex aggregation as each client’s tree structure may vary based on its local data [30], [31], [33]; and sensitivity to data heterogeneity, resulting in uneven predictive performance across clients [31], [34].
Mode I: Anomaly Detection Input x ∈ Rd
Reconstruction Head Dψ
Shared Encoder Eϕ
α Selector
Latent z ∈ Rl (l ≪ d)
Classification Head Cθ
x̂
LM SE
Composite Loss Function αLCE + (1 − α)LM SE
ŷ
LCE
Labels y (if any) Mode II: Attack Identification
Fig. 2: The (DM 2 A).
proposed
Dual-Mode
Micro-Architecture
framework acts as a unified learning engine capable of toggling between unsupervised anomaly detection and supervised attack classification. The DM2 A design consolidates feature extraction and task execution into three integrated sub-modules: Shared Encoder (Eϕ ): Maps high-dimensional traffic features x ∈ Rd to a compressed latent representation z ∈ Rl (where l ≪ d) through the model weights ϕ. By sharing this backbone across modes, DM2 A eliminates redundant parameters and enforces a dual-constraint on the latent space: z must be simultaneously discriminative (separating classes) and generative (preserving structure). This is critical for our semi-supervised motivation: even without labels, the encoder captures meaningful traffic patterns via the reconstruction task, preventing the model from degrading when labeled data is scarce. Dual-Mode Operation: The latent vector z feeds into two parallel branches. This design serves two strategic purposes: (a) Operational Flexibility, allowing the device to adapt to label availability, and (b) Disentangled Loss Representation, which enables us to utilize the reconstruction loss specifically for clustering logic (see Sec. III-B) rather than naı̈vely relying on the composite loss. • Mode I: Anomaly Detection (Reconstruction Head Dψ ): A decoder mapping z back to the input space through the weights ψ, producing x̂ = Dψ (z). This mode enables unsupervised learning on unlabeled data, establishing a baseline of “normality” for anomaly detection. • Mode II: Attack Identification (Classification Head Cθ ): A dense layer mapping z through the weights θ to a probability distribution over known classes, ŷ = Cθ (z). This mode fine-tunes decision boundaries for specific threats using available labeled samples. Composite Loss Function: For each client i ∈ {1, . . . , N } and model Mj , j ∈ {1, . . . , K}, we minimize a composite objective Ltotal that balances the two operational modes: Ltotal = αLCE (y, ŷ) + (1 − α)LMSE (x, x̂)
(1)
We denote Li,j total = Ltotal (Di , Mj ), where LCE is the CrossEntropy loss and LMSE is the Mean-Squared Error loss, and α ∈ [0, 1] acts as the mode selector. This formulation
Client Pool
Legend
Cluster 1
Cluster 𝑗 ∈ {1, … , 𝐾} and Client 𝑖 ∈ {1, … , 𝑁} FP/BP: Forward/Backward Model Pass
…
/ : Active/Inactive module Server-side Computation
FP DM2 A1 𝐶𝜃
𝑖𝑛𝑝𝑢𝑡𝑖 Benign Samples
DM2 A2 𝐶𝜃
… DM2 AK 𝐶𝜃
Round 𝑹:
Client 1 Client 2
𝑖,1 ℒ ℳ𝒮ℰ 𝑖,2 ℒ ℳ𝒮ℰ
…
𝑖,K ℒ ℳ𝒮ℰ
Client-side Computation
Clustering (K-means) on loss vectors of all clients
DM2 A1 𝐶𝜃
𝑖𝑛𝑝𝑢𝑡2
DM2 A1 𝐶𝜃
2,1 ℒ total
𝑖𝑛𝑝𝑢𝑡3
DM2 A2 𝐶𝜃
3,2 ℒ total
𝑖𝑛𝑝𝑢𝑡4
DM2 A2 𝐶𝜃
4,2 ℒ total
Cluster 2 Benign + Attack Samples
Client 3 Client 4
FedAvg
FedAvg Round 𝑹+𝟏
…
Cluster K
𝑖𝑛𝑝𝑢𝑡𝑁−1 Client 𝑁 − 1 Client 𝑁 𝑖𝑛𝑝𝑢𝑡𝑁
Loss Vector
Loss Vectors Computation
𝑖𝑛𝑝𝑢𝑡1
𝛕 epochs, FP + BP 1,1 ℒ total
Clustering & Matching
DM2 AK 𝐶𝜃
𝑁−1,K ℒ total
DM2 AK 𝐶𝜃
𝑁,K ℒ total
Model Training
FedAvg
Model Aggregation
Fig. 3: System Overview
provides architectural flexibility: in scenarios where labels are unavailable, α is set to 0, reducing the task to pure anomaly detection via reconstruction error. When labels are present, each client can set their own α value based on their label availability to allow both heads to update the shared encoder accordingly. B. Federated Training with Adapted CLoVE Standard FedAvg fails in heterogeneous IoT environments because averaging gradients from functionally distinct devices results in negative transfer. Consequently, we select to employ the CLoVE (Clustering of Loss Vector Embeddings) framework [29], due to its demonstrated efficacy over other CFL approaches. We adapt this framework to our anomaly detection and attack classification context with two domainspecific constraints: 1) Reconstruction-Only Fingerprinting: We utilize only the Reconstruction head (Dψ ) and freeze the Classifier head (Cθ ) (indicated by the snowflake symbol in Figure 3) during loss vector computation. This ensures clients are grouped based on traffic structure rather than label distribution. 2) Benign-Sample Filtering: We compute loss vectors using only the subset of benign samples (Dibenign ⊂ Di ). This prevents clustering skews caused by transient attacks. The complete training protocol can be seen in Figure 3 and proceeds as follows: 1. Initialization (t = 0). At the onset of training, the server initializes K global models {M1 , . . . , MK } with ran(0) dom weights wj , j ∈ {1, . . . , K}, representing the starting centroids for the K potential clusters, which correspond to the different device types. 2. Model Broadcast. At the start of every communication round t, the server broadcasts the current set of K models to all N participating clients. For the first round, the model weights are initialized randomly; for all subsequent rounds (t > 0),
these weights are the aggregated ones from the previous round, carrying the learned knowledge of their respective clusters. 3. Loss Vector Computation. Clients perform a single forward pass on all K received models to compute a loss vector vi ∈ RK . Adhering to our constraints, client i computes the jth component using strictly the reconstruction term on benign data: benign Li,j = L D , M (x) (2) MSE j i MSE As mentioned previously, the classifier head is frozen during this step to strictly isolate the feature extraction functionality. Each client sends its computed loss vector to the server. 4. Clustering & Matching. The server groups the collected vectors into K clusters using K-Means and performs a minimum-cost bipartite matching between the new clusters and the existing models (as in [29]). 5. Model Training. Each client i is assigned to the model Mj corresponding to their cluster. They then perform local training of Mj on the entire dataset Di for τ epochs using the full DM2 A architecture (i.e. updating both heads via Ltotal ). 6. Model Aggregation. The server aggregates updates solely within each cluster: X ni (t+1) (t) wj ← (3) wjt − η∇Li,j total wj nCj i∈Cj
where Cj is the set of clients assigned to model j at round t, ni is the number of data points of client i, nCj is the total number of data points of all clients assigned to model j at round t, and η is the learning rate. 7. Stabilization Phase. The process repeats until cluster assignments stabilize (i.e. client-to-cluster assignment do not change for 3 consecutive rounds). Once stable, the server ceases the loss vector computation and clustering & matching steps. The system transitions to efficient parallel instances of federated aggregation (FedAvg), where clients simply receive and train their assigned cluster model, thus drastically reducing communication overhead.
C. Deployment and Inference Post-training, the specialized cluster models are deployed to the edge devices. A critical feature of our DM2 A architecture is its adaptability to the annotation capabilities of the target environment. The inference logic branches based on whether the specific edge client operates in a labeled or unlabeled setting: 1) Scenario I: Labeled Environments: In deployment scenarios where the client possesses annotated data or requires specific categorization of threats, the system utilizes the Classifier Head (Cθ ). The input x is mapped to the latent space z = Eϕ (x), and the classifier outputs the specific class prediction: ŷ = argmax (Cθ (z))
(4)
This mode allows the device to leverage the available labels to identify specific attack types (e.g., Mirai, DoS). 2) Scenario II: Unlabeled Environments: In scenarios where the client lacks annotations (a common constraint in massive IoT fleets), the system relies purely on the Reconstruction Head (Dψ ) to perform anomaly detection. The input is passed from the Shared Encoder to the Reconstruction Head to generate a reconstructed input x̂ = Dψ (Eϕ (x)). The system calculates the MSE between the input and the output. If this error exceeds a calibrated threshold τi , the traffic is flagged as anomalous: ( Anomalous if LMSE (x, x̂) > τi Status(x) = (5) Normal otherwise Threshold Selection (τi ). For clients operating in this unlabeled mode, we employ a localized calibration strategy. Adhering to standard practices in reconstruction-based anomaly detection [18], [28], we derive the decision boundary strictly from the error distribution of normal traffic. Specifically, we set the threshold to the empirical maximum reconstruction benign error observed on the client’s benign validation Dval samples: τi = max (LMSE (x, x̂)) (6) benign x∈Dval
This establishes a conservative boundary where any live traffic yielding a reconstruction error higher than the worst-case normal sample is flagged as a potential threat. IV. E XPERIMENTAL S ETUP A. Datasets Selecting appropriate benchmarks for this study presented a particular challenge, as in order to best showcase the features and performance of CLAD, we needed network traffic datasets that satisfy strict criteria: a sufficient number of distinct device types, a diverse array of attack types, and adequate sample volume for both types to ensure robust training. Many standard intrusion detection datasets fail to satisfy these requirements concurrently, often lacking the granular device separation or the sufficient data density required for realistic FL. Consequently, we utilize two large-scale datasets that are
TABLE I: Detailed comparison of feature availability across datasets. Scope
Feature Type
CIC
Gotham
UNSW
Packet
Temporal (Timestamp, Jitter, IAT) Headers (TTL, Flags, Window)
✓ ✓
✓ ✓
– –
Flow
Volumetric Stats (Means, Vars) Aggregated Counts (Pkts, Bytes) App. Layer Content (DNS, TLS)
✓ ✓ ✓
– ✓ –
– ✓ –
Context
Directionality (Local/Internet)
–
–
✓
suitable for examining the different aspects of our proposed framework and the baselines, alongside a third dataset included for preliminary evaluation: CIC IoT-DIAD 2024 [17]: This dataset captures a realistic testbed of heterogeneous devices, featuring 33 distinct attacks grouped into seven major categories (e.g., DDoS, Recon, Webbased, Mirai). Gotham 2025 [35]: Built on the Gotham testbed, the dataset Gotham 2025 covers modern threats like CoAP Amplification and Remote Code Execution. Notably, its network traffic was collected separately for each IoT device. UNSW [36]: We include this dataset as a supplementary benchmark for our initial experiments. It is characterized by severe class imbalance (> 95% benign samples for most devices) and an inherently non-Independent and Identically Distributed (non-IID) nature, evidenced by minimal attack label overlap across device types. Due to the limited sample volume for the majority of attacks (< 40 samples per device type), it does not meet the density criteria for our primary federated learning experiments and is therefore used only for the initial set of experiments. B. Preprocessing Feature Engineering & Normalization. First, we removed leakage identifiers (e.g., IP and MAC addresses) from all datasets. Note that our method does not require device identity information. For CIC IoT-DIAD, we filtered certain columns with ambiguous names, values or labels, retaining 110 features and 6 “umbrella” attack categories. For Gotham, we adopt the authors’ official workflow to standardize protocols and group fine-grained labels, resulting in 68 features and 5 attack categories. For UNSW, we retained 138 features and utilized the data “as-is” without further feature selection. We applied Min-Max scaling to all numeric features on a per-device basis for all datasets. An overview of the dataset features can be seen in Table I. Filtering & Splitting. To ensure experimental validity, we filtered for devices containing samples for all target attack labels with sufficient volume (> 500 samples/label). For CIC IoTDIAD, this criterion yielded 10 devices (Amazon Echo Dot, Amazon Echo Show, Amazon Echo Studio, Amazon Smart Plug, Amcrest WiFi Camera, Arlo Base Station, Arlo Q Camera, Atomi Coffee Maker, Cocoon Smart Fan, Eufy HomeBase 2) covering 6 attacks (DoS, Mirai, Recon, Spoofing,
Web-Based, Brute-Force). Similarly, for Gotham, this resulted in 5 qualifying devices (domotic-monitor, building-monitor, combined-cycle, camera-street, camera-museum) covering 5 attacks (Network Scanning, Brute-Force, Infection, C&C Communication, DoS). For UNSW, we selected the 6 devices (out of 10) that contained at least 3 distinct attack types (TcpSynDevice, Ssdp, TcpSynReflection) to ensure sufficient diversity for validation (TP-Link smart plug, Samsung smartcam, Philips Hue bulb, WEMO Power Switch, WEMO Motion Sensor, Chromecast Ultra). Unless otherwise stated, we enforce a 50:50 Benign/Attack class balance, randomly sample 1000 records per client, assume IID and fully labeled data and apply a 50:50 train/test split. C. Data Partitioning To rigorously evaluate CLAD, we employ a controlled partitioning strategy designed to disentangle the complex sources of heterogeneity found in IoT networks. While the majority of existing works in federated anomaly detection utilize datasets in their raw, “as-is” state, such approaches mix different sources of variability, such as label distribution, data quantity, and feature skew, making it difficult to attribute performance gains to specific algorithmic features. In contrast, our approach aims to establish a stable and clean baseline that allows us to examine the specific impact of each experimental variable while holding other conditions constant. To achieve this, we strictly utilize the subset of “groundtruth” source devices identified in the preprocessing phase (10 for CIC IoT-DIAD, 5 for Gotham) that share an identical set of attack labels. From each source device, we generate 5 non-overlapping client datasets via random sampling, unless otherwise stated. By deriving all 5 clients for a single cluster from one physical source device, we guarantee intracluster homogeneity, ensuring that clients within a cluster are sampled from the exact same underlying distribution. Thus, we can systematically vary parameters such as the number of clients (N ), local class imbalance, or data volume, without the uncontrolled noise inherent in raw dataset partitioning. As mentioned above, this partitioning does not apply to UNSW, which is used ‘as-is’, given its inherent label imbalance and non-IID characteristics. D. Baselines To the best of our knowledge, there exists no framework that jointly performs anomaly detection (unsupervised) and attack classification (supervised) in either a federated or clustered federated learning setup. Given this absence of direct competitors, we benchmark CLAD against four established strategies that represent the distinct paradigms relevant to this domain, ranging from non-collaborative approaches to federated clustering methods: •
Local: This approach represents the extreme of fully personalized learning. Each client trains a model exclusively on its local data with no external communication.
FedAvg: We utilize the standard Federated Averaging algorithm [9], where a single global model is aggregated from all participating clients. • IFCA: The Iterative Federated Clustering Algorithm [13] is a prominent clustered FL approach that identifies client clusters by assigning each client to the model (and the corresponding cluster) for which it has the lowest loss across all models. To ensure a fair comparison with our framework, we declare stability when clusters do not change for 3 consecutive rounds. • CFL-AD: A CFL baseline for anomaly detection that clusters clients based on the similarity of their model weights [28]. Adhering to the same convergence strictness as with IFCA above, we evaluate two variations: – Standard (CFL-ADS): Uses the original unsupervised architecture, targeting only anomaly detection. – Enhanced (CFL-ADE): Replaces the local model with our proposed DM2 A architecture. This allows the baseline to perform joint anomaly detection and attack classification. •
E. Metrics We evaluate the efficacy of the proposed framework using a suite of both classification and anomaly detection metrics designed to capture robustness under class imbalance, an inherent characteristic of intrusion detection datasets where benign traffic typically dominates. • Classification Macro F1-Score (CLS F1): We report the Macro F1-Score for the multi-class classification task. It is calculated independently for each class and then averaged, ensuring that minority attack classes contribute equally to the score. • Classification Accuracy (CLS ACC): This measures the classification accuracy across all classes, encompassing the benign class and the specific attack classes corresponding to each dataset. • Anomaly Detection F1-Score (AD F1): We report the F1-Score specifically for the binary anomaly detection task. This metric evaluates the model’s ability to make the distinction between any type of attack traffic versus benign traffic. • Matthews Correlation Coefficient (MCC): We include the MCC metric for the classification task to provide a robust and balanced measure of quality, particularly given the disparity in class sizes. F. Implementation Details Model Architecture. To ensure a rigorous evaluation, we fix the neural network backbone across all baselines and our proposed framework, unless otherwise stated. We employ the lightweight DM2 A described in Section III-A. The Shared Encoder (Eϕ ) consists of an input layer matching the feature dimension (110 for CIC, 68 for Gotham, 138 for UNSW), followed by three fully connected hidden layers. For the CIC and UNSW datasets, these layers contain 96, 48 and 24 neurons, respectively; for Gotham, they contain 64, 32 and 16
TABLE II: Performance in balanced & IID settings.
0.9
0.8
0.8
0.7
0.7
CLS MCC(↑)
Local 0.826 ± 0.00 0.873 ± 0.00 0.952 ± 0.04 FedAvg 0.700 ± 0.00 0.783 ± 0.02 0.868 ± 0.03 IFCA 0.738 ± 0.05 0.806 ± 0.03 0.891 ± 0.03 CFL-ADS — — 0.749 ± 0.02 CFL-ADE 0.857 ± 0.01 0.901 ± 0.01 0.956 ± 0.02 Ours 0.875 ± 0.00 0.911 ± 0.00 0.970 ± 0.01
0.828 ± 0.01 0.707 ± 0.02 0.743 ± 0.05 — 0.868 ± 0.00 0.880 ± 0.01
Local 0.888 ± 0.02 0.953 ± 0.00 0.997 ± 0.00 FedAvg 0.856 ± 0.07 0.933 ± 0.02 0.996 ± 0.01 IFCA 0.854 ± 0.03 0.931 ± 0.01 0.997 ± 0.00 Gotham CFL-ADS — — 0.989 ± 0.02 CFL-ADE 0.904 ± 0.01 0.957 ± 0.00 0.998 ± 0.01 Ours 0.910 ± 0.01 0.962 ± 0.00 0.999 ± 0.00
0.936 ± 0.00 0.912 ± 0.02 0.909 ± 0.02 — 0.941 ± 0.01 0.948 ± 0.01
Fig. 4: Performance under balanced & IID scenario for CIC
Local 0.817 ± 0.00 0.850 ± 0.01 0.951 ± 0.01 FedAvg 0.673 ± 0.03 0.801 ± 0.00 0.929 ± 0.02 IFCA 0.751 ± 0.00 0.816 ± 0.01 0.936 ± 0.01 UNSW CFL-ADS — — 0.841 ± 0.03 CFL-ADE 0.811 ± 0.02 0.840 ± 0.00 0.946 ± 0.02 Ours 0.842 ± 0.01 0.870 ± 0.00 0.963 ± 0.01
0.781 ± 0.00 0.724 ± 0.02 0.735 ± 0.02 — 0.785 ± 0.01 0.798 ± 0.01
neurons. The Reconstruction Head (Dψ ) mirrors the encoder structure. The Classification Head (Cθ ) branches from the shared latent representation and comprises two fully connected layers. The first layer reduces the latent dimensionality by a factor of two (24 to 12 for CIC and UNSW, 16 to 8 for Gotham). The final output layer maps this intermediate representation to the target label space. We utilize GELU activation functions and apply Dropout (p = 0.2) after each hidden layer. We explicitly opt for these compact configurations to ensure deployability on resource-constrained devices; however, with sufficient computational capability, the model capacity can be increased to further improve performance. Hyperparameters. To ensure fairness, we standardized common hyperparameters across all baselines via grid search. We utilized the AdamW optimizer with learning rate η = 0.01 and a weight decay of 1e − 4. For the composite loss function, the balancing term was set to α = 0.8 based on a grid search over the interval [0,1]. The local batch size was set to 32, and clients performed τ = 5 local epochs per communication round. For the federated training process, we ran experiments for a maximum of R = 100 rounds. We utilized a full client participation rate to eliminate noise from random sampling and isolate convergence behaviors. We employ the standard model weight averaging for the federated aggregation stage. Evaluation metrics are calculated on each client’s test set after each round and averaged across all clients. All reported results are averaged over three random seeds. Experimental Environment. We implemented our framework and all baselines using the PyTorch library [37]. All experiments were conducted on a server equipped with a 32-core AMD Ryzen Threadripper PRO CPU, 504 GB of memory and 1.5 TB of storage. V. E VALUATION R ESULTS In this section, we present a comprehensive analysis of CLAD’s performance.
F1 Score
AD F1(↑)
CIC
CLS F1(↑) CLS ACC(↑)
Anomaly Detection
1.0
0.9
F1 Score
Dataset Baseline
Classification
1.0
0.6 0.5
0.6 0.5
0.4
0.4
0.3
0.3
0.2 0
20
40
60
80
Communication Rounds
100
0.2 0
Ours IFCA Centralized 20
CFL-ADS CFL-ADE 40
60
Local Training FedAvg 80
Communication Rounds
100
A. Balanced & IID Scenario We begin with an ideal scenario designed as a highly controlled environment. In this setup, every client is assigned exactly 1000 samples with a 50:50 Benign/Attack class balance, and all class labels are available to every client. The data is distributed in an IID manner, and each ground-truth cluster (device type) consists of exactly 5 clients. For reference, we also sketch the Centralized baseline where all local datasets are uploaded and trained on the server, i.e. with a method that disregards privacy constraints and corresponds to traditional anomaly detection methods. As shown in Fig. 4, our approach demonstrates rapid convergence, stabilizing near the centralized upper bound (dotted line) within fewer communication rounds compared to other baselines. Table II details the performance across the CIC, Gotham and UNSW datasets. Our method achieves the highest metrics across all settings, outperforming the closest clustered baseline enhanced with our model (CFL-ADE). Crucially, the results highlight the severity of negative transfer in heterogeneous environments: both standard FedAvg and IFCA frequently underperform Local (e.g., 0.700 vs 0.826 F1 on CIC), as averaging model weights from functionally distinct devices dilutes model specificity. By effectively clustering these distinct signatures, our framework eliminates this interference, surpassing local training performance by leveraging shared knowledge within valid peer groups. B. Label Imbalance Real-world IoT traffic is inherently skewed, often dominated by benign activity with only rare attack signatures. We simulate this by varying the percentage of benign samples from 20% to 95%, as detailed in the left half of Table III. While extreme sparsity of attack labels generally degrades model sensitivity across all baselines, our framework demonstrates robustness and mitigates the overfitting to the majority class that typically impacts standard supervised approaches. This robustness is most evident in the extreme 95% benign scenario. On the CIC dataset, while FedAvg sees its Classification F1 plummet to 0.540 due to the dilution of minority attack gradients, our approach maintains a significantly higher score of 0.714. While CFL-ADE shows consistent performance in less-extreme cases, in the 95% scenario it shows substantial performance degradation. Similarly, on Gotham, our method sustains near-perfect Anomaly Detection performance (0.999 F1) and leads classification (0.867 F1), outperforming Local
TABLE III: Performance under varying label imbalance ratios (percentage of benign samples) and Dirichlet non-IID severity (β). Smaller β indicates stronger heterogeneity. Label imbalance (benign %) Dataset Baseline
Dirichlet non-IID (β)
20% 50% 80% 95% β = 0.10 β = 0.25 β = 0.50 β = 1.00 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1
Local FedAvg IFCA CFL-ADS CFL-ADE Ours
0.841 0.706 0.749 — 0.879 0.888
0.973 0.919 0.933 0.835 0.984 0.985
0.825 0.700 0.737 — 0.857 0.875
0.952 0.867 0.891 0.749 0.956 0.970
0.771 0.631 0.696 — 0.816 0.845
0.896 0.794 0.823 0.701 0.906 0.930
0.630 0.540 0.560 — 0.643 0.714
0.784 0.678 0.696 0.544 0.769 0.828
0.436 0.506 0.595 — 0.776 0.720
0.856 0.786 0.850 0.753 0.901 0.882
0.670 0.671 0.746 — 0.831 0.810
0.923 0.841 0.885 0.754 0.945 0.932
0.715 0.664 0.754 — 0.804 0.825
0.931 0.847 0.904 0.755 0.929 0.938
0.784 0.686 0.770 — 0.857 0.864
0.947 0.859 0.911 0.750 0.951 0.966
Local FedAvg IFCA Gotham CFL-ADS CFL-ADE Ours
0.907 0.865 0.873 — 0.905 0.915
0.999 0.997 0.997 0.993 0.999 0.999
0.898 0.862 0.854 — 0.904 0.916
0.997 0.997 0.999 0.989 0.998 0.999
0.877 0.845 0.852 — 0.902 0.913
0.998 0.998 0.998 0.834 0.998 0.999
0.781 0.802 0.811 — 0.852 0.867
0.995 0.998 0.998 0.920 0.998 0.999
0.531 0.765 0.748 — 0.792 0.732
0.971 0.998 0.998 0.985 0.999 0.991
0.689 0.830 0.831 — 0.820 0.835
0.990 0.998 0.998 0.989 0.999 0.999
0.820 0.856 0.846 — 0.788 0.864
0.998 0.998 0.998 0.990 0.998 0.999
0.860 0.861 0.849 — 0.857 0.901
0.997 0.997 0.998 0.989 0.998 0.999
training (0.781 F1). These results confirm that our clustered aggregation preserves critical minority class signals that are otherwise lost in global averaging or isolated local training. C. Non-IID Scenario While the previous experiment addressed global class imbalance, this section evaluates performance under statistical heterogeneity across clients (non-IID). To model this label skew, we partition the dataset using a symmetric Dirichlet distribution with concentration parameter β ∈ {0.1, 0.25, 0.5, 1.0}. A lower β (e.g., 0.1) induces extreme heterogeneity where clients may hold samples from only a single class, whereas increasing β towards 1.0 leads to a more uniform partition. Table III (right) reveals that under the most severe heterogeneity (β = 0.1), our method remains highly competitive, ranking a close second to the CFL baseline enhanced by our model (CFL-ADE). This marginal gap can be attributed to the differences in the clustering strategies employed by the two frameworks (CLoVE and CFL-AD). On the CIC dataset, while standard Local training collapses to 0.436 F1, our approach maintains a robust 0.720 F1. Although the extreme fragmentation at β = 0.1 slightly limits the efficacy of our shared reconstruction objective compared to the top baseline, our method still significantly outperforms all remaining baselines, proving its resilience against client drift. Crucially, our framework demonstrates the fastest recovery rate as heterogeneity decreases. As soon as minimal class overlap emerges at β = 0.25, our method overtakes all competitors. In the Gotham dataset, we outperform all baselines at β = 0.25 with an F1 of 0.835, and extend this lead as the distribution stabilizes, reaching a dominant 0.901 F1 at β = 1.0. This trajectory confirms that while our method is robust in worstcase scenarios, it is uniquely capable of leveraging increasing data quality to maximize performance, unlike baselines that plateau earlier. D. Label Availability In practical IoT ecosystems, obtaining high-quality annotations is resource-intensive; consequently, networks often
Classification
1.0
Anomaly Detection
0.9 0.8
F1 Score
CIC
0.7 0.6 0.5 0.4
CFL-ADS Local-only
0.3
20%
40% 60% Unlabeled Clients %
80%
20%
FedAvg IFCA
40% 60% Unlabeled Clients %
CFL-ADE Ours
80%
Fig. 5: Impact of Unlabeled Client Ratios for CIC
consist of a large pool of devices whose data completely lacks labels (unlabeled clients, i.e. only benign samples available) alongside a small set of clients with labeled data (labeled clients). However, efficient frameworks should be able to utilize any amount of label information provided, without completely disregarding it. To evaluate our framework’s utility in this semi-supervised regime, we vary the proportion of unlabeled participants from 20% to 80%. This setup tests the system’s ability to leverage a minority of supervised peers to guide the learning process for the unsupervised majority. Figure 5 illustrates the performance on the CIC dataset as label availability becomes scarcer. The results uncover a critical fragility in the baselines. Most notably, CFL-ADE, which consistently ranked as the strong runner-up in fully labeled scenarios, collapses in this semi-supervised regime. As the unlabeled ratio hits 80%, its Classification F1 drops to ≈ 0.45, falling behind even the naı̈ve FedAvg. This suggests that its clustering performance heavily depends on label supervision, breaking down when the majority of loss vectors lack classification signals. Similarly, Local training degrades substantially to below 0.30 F1, as isolated devices lack the ground truth necessary to form distinct decision boundaries. In contrast, our method exhibits robust capacity to bridge this gap. Even when 80% of the network is unlabeled, we sustain a Classification F1-Score of over 0.65 and an Anomaly Detection F1-Score exceeding 0.80, consistently outperforming all baselines. This versatility is intrinsic to our DM2 A architecture, which simultaneously optimizes supervised clas-
TABLE IV: Performance as a function of the number of samples per client and the total number of clients. Number of clients N (X/Y = Gotham/CIC)
Samples per client Dataset Baseline
250 500 1000 2000 10/20 25/50 50/100 100/200 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1 CLS F1 AD F1
Local FedAvg IFCA CFL-ADS CFL-ADE Ours
0.714 0.628 0.684 — 0.789 0.798
0.888 0.819 0.846 0.768 0.916 0.922
0.782 0.667 0.714 — 0.843 0.856
0.924 0.844 0.869 0.755 0.939 0.952
0.825 0.700 0.737 — 0.857 0.875
0.952 0.867 0.891 0.749 0.956 0.970
0.858 0.704 0.747 — 0.881 0.897
0.969 0.888 0.907 0.737 0.974 0.981
0.833 0.679 0.722 — 0.852 0.864
0.948 0.846 0.870 0.736 0.958 0.961
0.825 0.700 0.737 — 0.857 0.875
0.952 0.867 0.891 0.749 0.956 0.970
0.817 0.685 0.721 — 0.846 0.876
0.953 0.874 0.894 0.758 0.956 0.974
0.803 0.668 0.781 — 0.859 0.873
0.956 0.871 0.934 0.770 0.966 0.976
Local FedAvg IFCA Gotham CFL-ADS CFL-ADE Ours
0.849 0.864 0.857 — 0.877 0.883
0.998 0.997 0.998 0.967 0.998 0.999
0.879 0.862 0.866 — 0.899 0.908
0.997 0.996 0.997 0.981 0.998 0.999
0.887 0.855 0.854 — 0.904 0.910
0.996 0.997 0.997 0.989 0.998 0.999
0.904 0.834 0.846 — 0.899 0.918
0.997 0.998 0.999 0.995 0.998 0.999
0.907 0.863 0.865 — 0.911 0.920
0.998 0.998 0.999 0.986 0.998 0.999
0.887 0.855 0.854 — 0.904 0.910
0.996 0.997 0.999 0.989 0.998 0.999
0.872 0.839 0.848 — 0.893 0.902
0.996 0.996 0.999 0.985 0.998 0.999
0.870 0.822 0.852 — 0.891 0.892
0.998 0.999 0.998 0.993 0.999 0.999
CIC
sification and unsupervised reconstruction objectives. This design allows our method to accommodate all clients without making rigid assumptions about label availability: unlabeled clients contribute to feature representation via the unsupervised branch, while “inheriting” the classification boundaries established by their labeled peers.
that fluctuates only marginally around 0.873 even at the maximum scale of 200 clients. This consistency confirms that our collaborative mechanism effectively bridges the gap between scattered local datasets, ensuring reliable performance independently of the network size.
E. Scaling with samples
Evaluating the trade-off between model performance and communication overhead is critical for deploying federated systems in bandwidth-constrained edge environments. To this end, Table V details the performance achieved under challenging data distributions at fixed communication milestones of 13MB and 26MB transmitted per client. Despite all approaches sharing the lightweight model architecture defined in Section IV-F (33.8K parameters; ≈ 0.129MB at FP32 precision), a stark contrast in efficiency is evident: our method yields better results at the reduced 13MB budget than the best baselines achieve with a full 26MB budget. This is most pronounced in the Label Availability (80% Unlabeled) scenario, where our method secures a Classification F1 score of 0.609 at 13MB, surpassing the baseline’s 0.524 at 26MB. A similar pattern emerges in the Label Imbalance setting for Anomaly Detection, where our 13MB performance (0.784) already exceeds the baselines’ maximum capability (0.783). While our proposed framework delivers a strong average gain of +5.4% across all tasks, performance varies by scenario. As shown in Table V, the non-IID (β = 0.25) setting presents a trade-off, where our method experiences a slight regression compared to the best baseline (−2.6% in Classification). This indicates that while our approach is highly communication-efficient in unlabeled and unbalanced regimes, extremely heterogeneous distributions may require further tuning. Nevertheless, the aggregate results confirm that our method optimizes the communication budget more effectively than standard approaches, solving complex tasks with a fraction of the data transfer usually required. Figure 6 illustrates the training dynamics that drive these quantitative gains. In the Label Imbalance and Label Availability scenarios, our method exhibits rapid convergence, establishing a commanding lead within the first few megabytes
In real-world IoT deployments, devices often generate sparse traffic patterns due to infrequent user interactions or event-driven behavior [19]. Consequently, a robust collaborative system must be capable of converging to a highperforming model even when the local training data is severely limited. Table IV (left) presents the performance evolution as the number of samples per client increases from 250 to 2000. The results demonstrate that our approach maintains superior performance in extreme low-data regimes. At the lowest setting of 250 samples, our method achieves a Classification F1 score of 0.798 on CIC and 0.883 on Gotham, significantly outperforming the Local baseline (0.714 and 0.849, respectively). As the sample size scales to 2000, our method consistently retains the top position, reaching an F1 of 0.897 on CIC, confirming its ability to maximize utility from both scarce and abundant data sources. F. Scaling with clients Scalability is a critical requirement for IoT and IIoT networks, where the number of participating clients can vary significantly. Ideally, the learning performance should improve over time regardless of the number of clients. Table IV (right) analyzes the impact of increasing the fleet size, with client counts ranging from 20 to 200 for CIC and 10 to 100 for Gotham. The data reveals that our method exhibits remarkable stability compared to local training. As the number of clients increases (implying data is more fragmented across the network), the Local performance tends to degrade; for instance, on the CIC dataset, local Classification F1 drops from 0.833 (20 clients) to 0.803 (200 clients). In contrast, our approach mitigates this fragmentation, maintaining a high F1 score
G. Communication Efficiency
Scenario
Best Baseline
Task
Ours
Relative Gain
Classification
1.2
F1 Score (@20GFLOPs)
TABLE V: Communication Efficiency. Comparison between the best-performing baseline for each scenario and our method under reduced (13MB) and full (≈ 26MB) communication budgets (per client). Improvement denotes the relative gain over the best baseline at the respective budget.
1.0 0.8
+1.3% +5.0%
0.6
Anomaly Detection +0.8%
-11.1%
+85.4%
+10.4%
0.4
Balanced 95% Benign Non-IID 80% Unlabeled Average
Computational Efficiency - Label Imbalance (95% Benign)
0.868 0.966
+0.9% +0.3%
+1.3% +1.0%
Anomaly Detection
Label Imbalance (95% Benign)
CLS F1 AD F1
0.608 0.783
0.637 0.783
0.626 0.784
0.698 0.820
+3.0% +0.1%
+9.6% +4.7%
CLS F1 AD F1
0.811 0.934
0.831 0.945
0.741 0.894
0.809 0.931
−8.6% −4.3%
−2.6% −1.5%
Label Availability CLS F1 (80% Unlabeled) AD F1
0.468 0.788
0.524 0.788
0.609 0.809
0.656 0.834
+30.1% +2.7%
+25.2% +5.8%
+3.0%
+5.4%
Non-IID (β = 0.25)
Average
0.8
0.6 0.6 0.5
F1 Score
0.855 0.961
F1 Score
Balanced & IID
0.857 0.956
0.4 0.3
40
60
80
Total Computation (GFLOPs)
100
0
0.8
F1 Score
F1 Score
0.6
Classification
0.5 0.4 0.3
Local Only FedAvg IFCA
0.2 0
5
10
15
20
Total MB Transferred
25
0.0
30
0
5
10
15
20
Total MB Transferred
Ours CFL-ADE CFL-ADS 25
30
Communication Efficiency - Label Availability (80% Unlabeled) Classification
100
0.6
0.4 0.3
0.5 0.4
Local Only FedAvg IFCA
0.3 0.2 0.1 20
40
60
80
Total Computation (GFLOPs)
100
0
20
40
60
Ours CFL-ADE CFL-ADS 80
Total Computation (GFLOPs)
100
(b) Label Imbalance & Label Availability Scenarios
Fig. 7: Computational Impact for different scenarios.
Anomaly Detection
0.8
0.6 0.5
F1 Score
F1 Score
80
0.7
0
0.2
60
Anomaly Detection
0.1
0.4
40
Total Computation (GFLOPs)
0.8
0.2
0.6
20
Computational Efficiency - Label Availability (80% Unlabeled)
F1 Score
0.7
Ours CFL-ADE CFL-ADS
0.0 20
0.5
Anomaly Detection
Local Only FedAvg IFCA
0.2
0
F1 Score
Classification
0.4
0.2
0.6
Communication Efficiency - Label Imbalance (95% Benign)
Ours
Balanced 95% Benign Non-IID 80% Unlabeled Average
Classification 0.7
0.847 0.958
+10.1%
(a) Performance at limited computational budget (20GFLOPs total)
@13MB @26MB @13MB @26MB @13MB @26MB CLS F1 AD F1
+73.3%
Best Baseline
0.2 0.0
-6.2%
+4.5%
0.4 0.3 0.2
0.6 0.4
Local Only FedAvg IFCA
0.2
0.1 0
5
10
15
20
25
Total MB Transferred
30
0
5
10
15
20
Ours CFL-ADE CFL-ADS 25
Total MB Transferred
30
Fig. 6: Communication Efficiency for different scenarios.
of transfer. It is important to contextualize these trajectories against the Local benchmark (dashed for reference), which incurs a negligible cost of roughly 0.1 MB, corresponding to the initial model weights download. While baselines such as FedAvg and IFCA frequently struggle to meaningfully surpass this local performance level, effectively wasting bandwidth, our method justifies the communication overhead by overtaking the local benchmark almost immediately and maintaining a steep upward trajectory throughout the training process. H. Computational Impact Iterative clustering algorithms such as the one we employ are frequently viewed as computationally expensive, as they typically impose an additional burden on clients through the extra forward passes required for cluster assignment. Our results demonstrate that this overhead does not hinder training speed in practice, and that our framework utilizes computational resources significantly more effectively than standard approaches. Figure 7a compares performance at a restricted budget of 20 GFLOPs. Despite the theoretical overhead, our method achieves a substantial average improvement of +10.4% in Classification and +10.1% in Anomaly Detection over the
best-performing baseline. This gain is most dramatic in the Label Availability (80% Unlabeled) scenario, where we observe a massive relative improvement of +85.4% in Classification F1 score, proving that our targeted clustering accelerates feature learning far faster than the cost of the additional passes slows it down. Figure 7b further illustrates this “performance-per-FLOP” dominance. In the Label Imbalance and Label Availability scenarios, similar to the Communication Efficiency section, our method exhibits a steep vertical trajectory, minimizing the computational waste associated with slow convergence. A striking finding is observed in the unlabeled classification task: our approach achieves superior performance using only 20 GFLOPs than competing baselines achieve after consuming their entire 100 GFLOPs budget. While extremely heterogeneous environments (non-IID) introduce a slight computational trade-off due to the difficulty of clustering divergent data, the overall trend confirms that our method yields a higher return on computational investment, making it uniquely suitable for resource-constrained devices where every FLOP counts. VI. C ONCLUSION In this paper, we introduced CLAD, a novel framework that unifies CFL with DM 2 A to overcome device heterogeneity and label scarcity in IoT/IIoT security. Moving beyond the rigid “one-model-fits-all” paradigm of traditional FL, our label-agnostic framework seamlessly integrates supervised and unsupervised learning to ensure operational resilience; it utilizes every piece of available information so that no label is discarded and no device, regardless of its data availability, is excluded from the collective defense. Extensive evaluations
demonstrate that CLAD significantly outperforms state-ofthe-art baselines, particularly in label-scarce environments; notably, we achieved a 30% relative improvement in detection performance with 80% unlabeled clients, while reducing communication overhead by half. These results confirm that our hybrid architecture offers a scalable, data-efficient solution for robust network intrusion detection across complex IoT ecosystems. R EFERENCES [1] A. Al-Fuqaha, M. Guizani, M. Mohammadi, M. Aledhari, and M. Ayyash, “Internet of Things: A Survey on Enabling Technologies, Protocols, and Applications,” IEEE communications surveys & tutorials, vol. 17, no. 4, pp. 2347–2376, 2015. [2] Cisco, “Cisco Annual Internet Report (2018–2023) White Paper,” Cisco: San Jose, CA, USA, vol. 10, no. 1, pp. 1–35, 2020. [3] E. Sisinni, A. Saifullah, S. Han, U. Jennehag, and M. Gidlund, “Industrial Internet of Things: Challenges, Opportunities, and Directions,” IEEE Transactions on Industrial Informatics, vol. 14, no. 11, pp. 4724– 4734, 2018. [4] M. Antonakakis, T. April, M. Bailey, M. Bernhard, E. Bursztein, J. Cochran, Z. Durumeric, J. A. Halderman, L. Invernizzi, M. Kallitsis et al., “Understanding the Mirai Botnet,” in 26th USENIX security symposium (USENIX Security 17), 2017, pp. 1093–1110. [5] N. Neshenko, E. Bou-Harb, J. Crichigno, G. Kaddoum, and N. Ghani, “Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and a First Empirical Look on Internet-Scale IoT Exploitations,” IEEE Communications Surveys & Tutorials, vol. 21, no. 3, pp. 2702– 2733, 2019. [6] H.-J. Liao, C.-H. R. Lin, Y.-C. Lin, and K.-Y. Tung, “Intrusion detection system: A comprehensive review,” Journal of Network and Computer Applications, vol. 36, no. 1, pp. 16–24, 2013. [7] K. Bonawitz, H. Eichner, W. Grieskamp, D. Huba, A. Ingerman, V. Ivanov, C. Kiddon, J. Konečnỳ, S. Mazzocchi, B. McMahan et al., “Towards Federated Learning at Scale: System Design,” Proceedings of Machine Learning and Systems, vol. 1, pp. 374–388, 2019. [8] V. Mothukuri, R. M. Parizi, S. Pouriyeh, Y. Huang, A. Dehghantanha, and G. Srivastava, “A survey on security and privacy of federated learning,” Future Generation Computer Systems, vol. 115, pp. 619–640, 2021. [9] B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-Efficient Learning of Deep Networks from Decentralized Data,” in Proceedings of the 20th International Conference on Artificial Intelligence and Statistics, ser. Proceedings of Machine Learning Research, A. Singh and J. Zhu, Eds., vol. 54. PMLR, Apr. 2017, pp. 1273–1282. [10] Y. Zhao, M. Li, L. Lai, N. Suda, D. Civin, and V. Chandra, “Federated Learning with Non-IID Data,” arXiv preprint arXiv:1806.00582, 2018. [11] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, “Federated Learning: Challenges, Methods, and Future Directions,” IEEE Signal Processing Magazine, vol. 37, no. 3, pp. 50–60, 2020. [12] F. Sattler, K.-R. Müller, and W. Samek, “Clustered Federated Learning: Model-Agnostic Distributed Multitask Optimization Under Privacy Constraints,” IEEE Transactions on Neural Networks and Learning Systems, vol. 32, no. 8, pp. 3710–3722, 2020. [13] A. Ghosh, J. Chung, D. Yin, and K. Ramchandran, “An efficient framework for clustered federated learning,” Advances in Neural Information Processing Systems, vol. 33, pp. 19 586–19 597, 2020. [14] J. Fan, K. Wu, G. Tang, Y. Zhou, and S. Huang, “Taking Advantage of the Mistakes: Rethinking Clustered Federated Learning for IoT Anomaly Detection,” IEEE Transactions on Parallel and Distributed Systems, vol. 35, no. 6, pp. 862–876, Jun. 2024. [15] R. Yan, L. Qu, Q. Wei, S.-C. Huang, L. Shen, D. L. Rubin, L. Xing, and Y. Zhou, “Label-Efficient Self-Supervised Federated Learning for Tackling Data Heterogeneity in Medical Imaging,” IEEE Transactions on Medical Imaging, vol. 42, no. 7, pp. 1932–1943, 2023. [16] X. Yang, Z. Song, I. King, and Z. Xu, “A Survey on Deep SemiSupervised Learning,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 9, pp. 8934–8954, 2022.
[17] M. Rabbani, J. Gui, F. Nejati, Z. Zhou, A. Kaniyamattam, M. Mirani, G. Piya, I. Opushnyev, R. Lu, and A. A. Ghorbani, “Device Identification and Anomaly Detection in IoT Environments,” IEEE Internet of Things Journal, vol. 12, no. 10, pp. 13 625–13 643, May 2025. [18] R. Bhatia, S. Benno, J. Esteban, T. V. Lakshman, and J. Grogan, “Unsupervised machine learning for network-centric anomaly detection in IoT,” in Proceedings of the 3rd ACM CoNEXT Workshop on Big DAta, Machine Learning and Artificial Intelligence for Data Communication Networks. Orlando FL USA: ACM, Dec. 2019, pp. 42–48. [19] T. D. Nguyen, S. Marchal, M. Miettinen, H. Fereidooni, N. Asokan, and A.-R. Sadeghi, “DÏoT: A Federated Self-learning Anomaly Detection System for IoT,” in 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), Jul. 2019, pp. 756–767, iSSN: 2575-8411. [20] V. Mothukuri, P. Khare, R. M. Parizi, S. Pouriyeh, A. Dehghantanha, and G. Srivastava, “Federated-Learning-Based Anomaly Detection for IoT Security Attacks,” IEEE Internet of Things Journal, vol. 9, no. 4, pp. 2545–2554, Feb. 2022. [21] J. Jithish, B. Alangot, N. Mahalingam, and K. S. Yeo, “Distributed Anomaly Detection in Smart Grids: A Federated Learning-Based Approach,” IEEE Access, vol. 11, pp. 7157–7179, 2023. [22] V. Kelli, V. Argyriou, T. Lagkas, G. Fragulis, E. Grigoriou, and P. Sarigiannidis, “IDS for Industrial Applications: A Federated Learning Approach with Active Personalization,” Sensors, vol. 21, no. 20, p. 6743, Jan. 2021. [23] T. T. Huong, T. P. Bac, D. M. Long, B. D. Thang, N. T. Binh, T. D. Luong, and T. K. Phuc, “LocKedge: Low-Complexity Cyberattack Detection in IoT Edge Computing,” IEEE Access, vol. 9, pp. 29 696– 29 710, 2021. [24] I. Panitsas, I. Ofeidis, and L. Tassiulas, “FedJam: Multimodal Federated Learning Framework for Jamming Detection,” in IEEE INFOCOM 2026 - IEEE Conference on Computer Communications, 2026. [25] A. Zainudin, R. Akter, D.-S. Kim, and J.-M. Lee, “Federated Learning Inspired Low-Complexity Intrusion Detection and Classification Technique for SDN-Based Industrial CPS,” IEEE Transactions on Network and Service Management, vol. 20, no. 3, pp. 2442–2459, Sep. 2023. [26] O. Aouedi, K. Piamrat, G. Muller, and K. Singh, “Federated Semisupervised Learning for Attack Detection in Industrial Internet of Things,” IEEE Transactions on Industrial Informatics, vol. 19, no. 1, pp. 286– 295, Jan. 2023. [27] Z. Wei, J. Wang, Z. Zhao, and K. Shi, “Toward data efficient anomaly detection in heterogeneous edge–cloud environments using clustered federated learning,” Future Generation Computer Systems, vol. 164, p. 107559, Mar. 2025. [28] X. Sáez-de Cámara, J. L. Flores, C. Arellano, A. Urbieta, and U. Zurutuza, “Clustered federated learning architecture for network anomaly detection in large scale heterogeneous IoT networks,” Computers & Security, vol. 131, p. 103299, 2023. [29] R. Bhatia, N. Papadis, M. Kodialam, T. V. Lakshman, and S. Chakrabarty, “CLoVE: Personalized Federated Learning through Clustering of Loss Vector Embeddings,” in Proceedings of the 43rd International Conference on Machine Learning (ICML). PMLR, 2026. [30] Z. Wang and K. Gai, “Decision Tree-Based Federated Learning: A Survey,” Blockchains, 2024. [31] P. A. E. Lim and C. Park, “A collaborative ensemble construction method for federated random forest,” Expert Syst. Appl., vol. 255, p. 124742, 2024. [32] B. Qian, Y. Xie, Y. Li, B. Ding, and J. Zhou, “Tree-based Models for Vertical Federated Learning: A Survey,” ACM Computing Surveys, vol. 57, pp. 1 – 30, 2025. [33] A. Argente-Garrido, C. Zuheros, M. V. Luzón, and F. Herrera, “An interpretable client decision tree aggregation process for federated learning,” Information Sciences, vol. 694, p. 121711, 2025. [34] C. Gao, X. Yang, and Y. Guo, “Balancing Interpretability and Performance: Optimizing Random Forest Algorithm Based on Point-to-Point Federated Learning,” Journal of Electrical Systems, 2024. [35] O. Belarbi, T. Spyridopoulos, E. Anthi, O. Rana, P. Carnelli, and A. Khan, “Gotham Dataset 2025: A Reproducible Large-Scale IoT Network Dataset for Intrusion Detection and Security Research,” arXiv preprint arXiv:2502.03134, 2025. [36] A. Hamza, H. H. Gharakheili, T. A. Benson, and V. Sivaraman, “Detecting Volumetric Attacks on loT Devices via SDN-Based Monitoring of MUD Activity,” in Proceedings of the 2019 ACM Symposium on SDN Research, 2019, pp. 36–48.
[37] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga et al., “Pytorch: An imperative style, high-performance deep learning library,” Advances in Neural Information Processing Systems, vol. 32, 2019.