1
SwarmSense-DNN: A Trustworthy and Decentralized Neural Framework for Proactive Anomaly Defense in Consumer IoT
arXiv:2606.11803v1 [cs.CR] 10 Jun 2026
Jing Yang, Vijay Govindarajan, Saad Arif, Xu Xu*, Mohamed Kallel, Zaffar Ahmed Shaikh, Zhe Liu, Chunhong Yuan, Lip Yee Por*
Abstract—The rapid growth of consumer IoT devices has introduced unprecedented challenges in trustworthy anomaly detection against AI-enabled cyber threats, requiring real-time, privacy-preserving, and scalable defense mechanisms. Traditional centralized strategies face critical limitations, including communication bottlenecks, single points of failure, and privacy vulnerabilities when processing distributed consumer data. We propose SwarmSense-DNN, a novel decentralized neural framework employing swarm intelligence for secure, cooperative anomaly detection across distributed IoT environments. The framework integrates autonomous agents with deep neural networks to form a self-organizing defense system that detects evolving anomalies without centralized coordination. It utilizes hierarchical federated learning with graph neural networks and attention mechanisms to capture local and global anomaly behaviors while ensuring data privacy. Extensive experiments demonstrate SwarmSense-DNN’s superior performance: it achieves 95.44% average detection accuracy across five benchmark datasets while reducing communication overhead by 67%. The framework maintains robust resilience against adversarial threats through differential privacy safeguards and demonstrates strong fault tolerance under node failures and AI-enabled attacks. Index Terms—Swarm Intelligence, Decentralized Learning, Anomaly Detection, Federated Learning, Graph Neural Networks
This work was supported by the Deanship of Scientific Research, Vice Presidency for Graduate Studies and Scientific Research, King Faisal University, Saudi Arabia [Grant No. KFU253799]. Corresponding author: Lip Yee Por and Xu Xu Jing Yang and Por Lip Yee are with the Center of Research for Cyber Security and Network (CSNET), Faculty of Computer Science and Information Technology, Universiti Malaya, 50603 Kuala Lumpur, Malaysia (e-mail: [email protected]; [email protected]). Vijay Govindarajan is with the Distribution and Supply Technology, Expedia Group, Seattle, WA 98119, United States (e-mail: [email protected]). Saad Arif is with the Department of Mechanical Engineering, College of Engineering, King Faisal University, Al Ahsa, 31982, Saudi Arabia. (e-mail: [email protected]). Xu Xu is with the School of Computer Science and Engineering, Northeastern University, Shenyang 110004, China (e-mail: [email protected]). Mohamed Kallel is with the Department of Physics, College of Science, Northern Border University, Arar, Saudi Arabia. (e-mail: [email protected]). Zaffar Ahmed Shaikh is with Department of Computer Science and Information Technology, Benazir Bhutto Shaheed University Lyari, Karachi, 75660, Pakistan and with School of Engineering, École Polytechnique Fédérale de Lausanne, 1015, Lausanne, Switzerland ([email protected]). Zhe Liu is with College of Mathematics and Computer, Xinyu University, Xinyu 338004, China and with School of Computer Sciences, Universiti Sains Malaysia, Penang 11800, Malaysia ([email protected]). Chunhong Yuan is with Faculty of Control Systems and Robotics, National Research University for Information Technology, Mechanics and Optics (ITMO), St. Petersburg, 197101, Russia ([email protected]).
I. I NTRODUCTION The rapid growth of interconnected systems across smart homes, consumer devices, and industrial IoT [1]–[3] has reshaped trustworthy anomaly detection in distributed environments increasingly exposed to AI-enabled cyber threats [4]–[8]. Centralized detectors can work in controlled settings but face key limits in consumer networks where privacy, bandwidth, and real-time processing are essential [9]–[16]. These constraints are acute in consumer and critical infrastructure scenarios, where anomalies may signal AI-driven intrusions, device faults, or operational risks that demand immediate response [17], [18]. The spread of edge computing and ubiquitous IoT has therefore pushed a shift toward decentralized, on-device processing that supports localized detection and decision-making [19]–[22]. Yet many distributed methods still rely on simplified aggregation that fails to capture complex temporal dynamics and internode dependencies in heterogeneous systems [23]–[25]. The diversity of data sources, together with strict privacy rules and bandwidth limits, calls for trustworthy frameworks that maintain high accuracy and efficiency under edge constraints [26]–[28]. Swarm intelligence, inspired by the collective behavior of biological entities such as ant colonies and bee swarms, offers a promising foundation for building decentralized and adaptive defense mechanisms in distributed systems [29]–[32]. Unlike traditional distributed systems that rely on centralized coordination, swarm-based approaches enable autonomous agents to collaborate through local interactions, emerging complex global behaviors without explicit central control [33], [34]. This self-organizing coordination mechanism aligns naturally with the goals of trustworthy distributed anomaly detection systems, enabling nodes to make local defense decisions while contributing to a unified and system-wide threat perspective [35], [36]. Recent developments in federated learning have shown the feasibility of training models across decentralized datasets while preserving data privacy, which is an essential requirement for secure consumer applications [37]–[40]. However, many federated learning methods for anomaly detection still rely solely on model aggregation, overlooking the potential of swarm intelligence to enhance robustness, adaptability, and cyber threat detection accuracy [41]–[43]. The integration of swarm intelligence with deep neural networks presents an opportunity to develop scalable, adaptive, and trustworthy anomaly detection frameworks tailored for dynamic and
2
adversarial consumer IoT environments [44], [45]. FL to remove single points of failure and improve resilience, Modern consumer IoT faces challenges from privacy con- yet lacked adaptive coordination for evolving threats. Zhang straints, limited communication, and growing demands for et al. [50] introduced a spatially aware GNN that captures scalability and reliability. Centralized architectures cause single topology while keeping a centralized setup that limits scalability points of failure, bandwidth inefficiency, and privacy risks [46], and privacy. Syu et al. [44] studied privacy-aware energy grids, [47]. Conventional federated learning with simple aggregation clarifying privacy–accuracy trade-offs in critical infrastructure. fails to capture temporal and cross-node dependencies in heterogeneous networks. The key goal is to build a decentralized and trustworthy framework that achieves high detection B. Swarm Intelligence and Cooperative Systems Swarm intelligence is a powerful approach for optimization accuracy with privacy preservation and low communication cost, while adapting to dynamic environments, resisting AI- and coordination in distributed systems [29]. Wardhana et al. enabled adversaries, and tolerating node failures under resource surveyed core concepts and applications, outlining foundations for integrating machine learning. Xu et al. [51] introduced constraints [48], [49]. This work advances IoT security through SwarmSense- cooperative swarm learning with cyclic updates that cut DNN’s novel integration of swarm intelligence with federated communication while preserving effectiveness, though it was learning, enabling distributed anomaly detection without central- not aimed at anomaly detection. Pham et al. [33] showed how ized data aggregation, a departure from traditional centralized bio-inspired methods tackle large-scale, dynamic network chalsecurity models. SwarmSense-DNN introduces a decentralized lenges, offering insights for swarm-based anomaly detection. paradigm where consumer IoT devices collaboratively detect In robotics, Blais and Akhloufi [35] reviewed reinforcement anomalies through pheromone-inspired coordination and local learning for swarm coordination and demonstrated the value model training, eliminating the privacy risks inherent in central- of decentralized decision-making, which we adapt for anomaly ized architectures. This paper makes the following contributions detection in distributed systems. In clinical contexts, Wardhana toward secure and decentralized anomaly detection in consumer et al. [52] validated decentralized, privacy-preserving collaboration, directly informing our confidentiality mechanisms. IoT. 1) We propose SwarmSense DNN, a trustworthy decentralized framework that fuses swarm intelligence with C. Deep Learning Architectures for Anomaly Detection deep neural networks for collaborative, proactive anomaly Deep learning for anomaly detection has progressed rapidly. detection in consumer IoT [31]. Autonomous nodes learn Surveys by Huang et al. [53] and Kumari et al. [23] chart the and adapt collectively without relying on centralized evolution of neural architectures and explain how designs are coordination. tuned for different anomaly types and deployment contexts. 2) We design a hierarchical architecture that integrates local Building on this foundation, Nazir et al. [54] introduce hybrid swarm clusters with lightweight coordination mechanisms CNN–LSTM models for IoT threat detection that capture to balance detection accuracy, scalability, and commuspatial–temporal patterns under resource constraints; Singh nication efficiency. The architecture employs adaptive et al. [55] boost accuracy with hybrid deep models augmented clustering and selective information exchange to reduce by optimization and ensemble techniques; and Chen et al. [56] overhead. integrate fuzzy clustering–based signature intrusion detection 3) We introduce differential privacy mechanisms tailored for with deep learning to demonstrate the benefits of combining swarm-based learning. These techniques protect individual traditional and modern methods. node data while enabling effective collaboration across distributed systems. 4) We implement self-healing strategies that autonomously D. Graph Neural Networks and Attention Mechanisms detect and recover from node failures or compromises. Graph neural networks are central to anomaly detection These mechanisms enhance system reliability, trustworthiin networked systems. Kim et al. [57] reviewed methods ness, and resilience in adversarial and dynamic conditions. and challenges, outlining foundations and limits. Zhou et al. [58] introduced grouped GNNs for multivariate time series, II. L ITERATURE R EVIEW capturing dependencies across sensors and groups. Tang et A. Distributed and Federated Anomaly Detection al. [59] rethought GNN architectures for anomaly detection, Federated learning is a leading approach for privacy- offering insights that guide our swarm-based coordination. preserving distributed ML, with broad uses in anomaly de- Dadhania et al. [60] applied GNNs to software-defined networks tection [26]. Mothukuri et al. [4] validated its feasibility for for high-speed anomaly detection, showing scalability in realIoT security, showing that accuracy can be maintained while time settings. Chen et al. [56] advanced transformer models protecting data, though simple parameter averaging struggles with improved attention for time series anomalies, capturing with complex, heterogeneous anomaly patterns. Recent work long-range temporal patterns. Liu et al. [61] used inter-variable tackles heterogeneity, communication, and decentralization. attention for multivariate anomalies, informing our attentionMan et al. [37] used adaptive aggregation in edge-assisted IoT driven swarm coordination. Kavadi et al. [62] combined to handle data quality variation and reduce latency but relied on temporal graph attention with transformer-augmented RNNs, centralized coordination. Li et al. [41] advanced decentralized highlighting the promise of hybrid attention architectures.
3
E. Edge Computing and IoT Applications Edge anomaly detection has been widely studied under tight latency, bandwidth, and energy limits. Liu et al. [19] outlined deployment principles for resource-constrained industrial IoT, while Rezaee et al. [63] showed the need for real-time distributed pipelines in edge video surveillance. Practical systems include IoT intrusion detection that balances accuracy with resources [64] and frameworks with dynamic node insertion and deletion for evolving streams and topologies [65]. Domain-specific designs such as multi-sensor detection in underground mining further illustrate edge-centric constraints and choices [66].
III. M ETHODOLOGY A. System Model and Assumptions 1) System Model We consider a distributed network comprising N autonomous nodes N = {n1 , n2 , . . . , nN } deployed across a heterogeneous environment. The network topology is modeled as a dynamic graph G (t) = (N , E (t), W (t)), where E (t) ⊆ N × N represents time-varying communication links and W (t) ∈ RN×N denotes the weighted adjacency matrix. The connectivity between nodes i and j at time t is defined as: ( exp(−di j /σc ) if di j ≤ rc Wi j (t) = (1) 0 otherwise
F. Ensemble Learning and Variational Methods
where di j is the distance between nodes, rc is the communicaEnsemble learning has shown strong potential for enhancing tion range, and σc controls the connectivity strength decay. anomaly detection robustness and accuracy. Sarhan et al. [67] Each node ni continuously observes local data streams developed deep ensembles for detecting network anomalies Xi (t) = [xi (t − T + 1), . . . , xi (t)] ∈ Rdi ×T over sliding time and cyber attacks, proving that combining multiple models windows of length T . The local feature vector at time t is improves detection performance over single approaches. Liu denoted as xi (t) ∈ Rdi , where di represents the dimensionality et al. [68] introduced selective parallel ensemble methods that of observations at node i. We assume that the data distribution optimize the balance between diversity and accuracy, offering at each node follows: design insights for distributed and scalable systems. Variational xi (t) ∼ Di (t) = (1 − λi )Dnormal + λi Danomaly (2) autoencoders have gained prominence in anomaly detection, with Nguyen et al. [69] providing a comprehensive comparison where λi ∈ [0, 1] represents the anomaly rate at node i, Dnormal that establishes benchmarks and architectural guidelines. Wang is the normal data distribution, and Danomaly represents the et al. [70] integrated LSTM-based autoencoders with attention anomalous distribution. to detect multidimensional temporal anomalies, highlighting the benefit of combining recurrent and attention mechanisms. Ji et al. [71] further demonstrated the scalability of VAE-based unsupervised models in large-scale energy storage systems, illustrating their adaptability to critical infrastructure and realworld deployment scenarios. G. Research Gap Analysis Although distributed anomaly detection has advanced, a key gap remains in integrating swarm intelligence with deep learning for autonomous cooperative systems. Existing methods rely on simple FL aggregation [4], [37], [72] or centralized neural models [50], [56], lacking adaptive coordination, privacy, efficiency, and resilience [73]. No work has yet combined swarm-based coordination [33], [51] with powerful neural architectures to build self-organizing, privacy-preserving anomaly detection adaptable to evolving threats [26], [48]. This gap motivates our SwarmSense-DNN framework. While recent federated approaches like Dong et al.’s FADngs [26] and Popoola et al.’s consumer IoT intrusion detection [38] achieve distributed learning, they maintain centralized coordination mechanisms. Xu et al.’s cooperative swarm learning [51] demonstrates bio-inspired coordination but lacks trust-based consensus, while Zhang et al.’s GNN approach [50] uses static network topologies rather than adaptive clustering. Current hierarchical methods like Li et al.’s decentralized FL [41] rely on simple parameter averaging instead of bio-inspired collective decision-making, leaving a fundamental gap in truly autonomous distributed systems that can self-organize without centralized control.
Fig. 1: SwarmSense-DNN system model. Figure 1 shows SwarmSense-DNN’s edge–cloud deployment for real-time, privacy-preserving anomaly detection. Robotic sensors gather data, edge nodes infer collaboratively, and cloud units synchronize without central control. Figure 2 illustrates pheromone updates where confidence-driven deposits and decay rate ρ ensure adaptive threat response.
Fig. 2: Pheromone mechanism flowchart. The pheromone decay rate ρ = 0.1 and trust smoothing factor β = 0.8 were selected via grid search on IoT-23 validation
4
data, balancing information persistence with system adaptability where µ i and σ i denote the local mean and standard deviation vectors, and ε is a small constant for numerical stability. In based on swarm intelligence principles [33]. Eq. (3) we set ε = 10−8 to avoid division by zero during 2) Assumptions The SwarmSense-DNN framework operates under the fol- normalization. This ε is distinct from the differential privacy budget εdp used elsewhere in this paper. lowing key assumptions: Temporal Convolutional Feature Extractor: A stack of Assumption 1 (Partial Connectivity): The network maintains partial connectivity such that |Ni (t)| ≥ kmin for all nodes 1D convolutional layers with residual connections processes i and time t, where Ni (t) = { j : Wi j (t) > 0} and kmin is the the normalized input: minimum connectivity requirement. (0) Hi = Xnorm (t) (4) i Assumption 2 (Bounded Byzantine Nodes): The number (l) (l−1) (l−1) Hi = ReLU(BatchNorm(Conv1D(Hi ))) + Hi (5) of malicious or compromised nodes is bounded: |B| ≤ ⌊N/3⌋, (L) temp where B represents the set of Byzantine nodes. Fi = GlobalMaxPool(Hi ) (6) Assumption 3 (Local Differentiability): The local loss temp ∈ functions Li (θθ i ) are twice continuously differentiable and where L is the number of convolutional layers and Fi d temp R represents the temporal features. satisfy the Lipschitz condition with constant L > 0. Multi-Head Self-Attention Module: The attention mechaAssumption 4 (Privacy Budget Availability): Each node nism captures long-range dependencies and patterns: has access to a privacy budget εi > 0 for differential privacy N mechanisms, with ∑i=1 εi = εtotal . MultiHead(Q, K, V) = Concat(head1 , . . . , headh )WO (7) B. Model Architecture 1) Hierarchical Architecture Overview SwarmSense-DNN employs a three-tier hierarchical architecture: (1) Local Node Layer for individual anomaly detection, (2) Swarm Cluster Layer for coordinated decisionmaking, and (3) Global Coordination Layer for inter-cluster communication. The architecture is illustrated in Figure 3. Cluster coordinators are dynamically elected based on scoring: avg Si = w1 · CPUi + w2 · degreei + w3 · Ri , with re-election every 10 rounds or upon failure. Global Coordinator
head j = Attention(QWQj , KWKj , VWVj ) QKT √ Attention(Q, K, V) = softmax V dk
temp
Fcontext = LayerNorm Fi i
∑ αi j (t)Fshared j
+
(10)
j∈Ni (t)
Swarm Cluster 1
temp
Swarm Cluster 2
αi j (t) = softmax n2
(9)
Multi-head attention operates only at the node level for temporal feature processing, while cluster coordination uses GAT-based attention for inter-node communication. Here h is the number of attention heads, WQj , WKj , WVj ∈ Rdtemp ×dk are learned projection matrices, and WO ∈ Rhdk ×dtemp . Swarm Context Integration Layer: This layer incorporates information from neighboring nodes through weighted aggregation: !
G
n1
(8)
n3
n4
C1
n5
n6
Fi
· Fshared j
!
p dtemp
(11)
where Fshared represents the shared feature representation from j node j. Anomaly Classification Head: A multi-layer perceptron with dropout produces the final anomaly scores:
C2
Swarm Cluster 3
context Hcls + b1 ) i = ReLU(W1 Fi
(12)
n9
cls Hcls i = Dropout(Hi , pdrop ) pi = sigmoid(W2 Hcls i + b2 )
(13)
n7
n8
C3
Fig. 3: SwarmSense-DNN Hierarchical Architecture: Individual nodes organize into adaptive swarm clusters with local coordinators that participate in global coordination. 2) Local Node Neural Network Architecture Each node ni maintains a specialized deep neural network Fi consisting of five primary components: Input Preprocessing Layer: The input data undergoes normalization and feature scaling: Xnorm (t) = i
Xi (t) − µ i σi +ε
(3)
(14)
where pi ∈ [0, 1] represents the anomaly probability at node i. 3) Swarm Intelligence Coordination Module The swarm coordination module implements bio-inspired algorithms for distributed decision-making: Pheromone Update Mechanism: Each node maintains pheromone concentrations for different anomaly types: (k)
(k)
(k)
τi (t + 1) = (1 − ρ)τi (t) + ∆τi (t) (15) ( (k) φ · confi (t) if anomaly type k detected (k) ∆τi (t) = 0 otherwise (16)
5
where ρ ∈ [0, 1] is the evaporation rate, φ > 0 is the (k) pheromone deposit factor, and confi (t) is the confidence score. Unlike FedAvg’s simple parameter averaging (θθ global = ∑ wi θ i ), SwarmSense-DNN employs trust-weighted consensus: Wconsensus = ∑ j∈Ni Ri, j (t) × θ j , where nodes selectively incori porate knowledge from trusted neighbors rather than blindly averaging all parameters. This trust-based approach provides superior robustness under heterogeneous data and adversarial conditions. 4) Graph Neural Network for Cluster Coordination Trust and Reputation System: Each node maintains trust scores for its neighbors: Ri, j (t + 1) = β Ri, j (t) + (1 − β )consistencyi, j (t) |pi (t) − p j (t)| consistencyi, j (t) = 1 − |pi (t)| + |p j (t)| + ε
(17) (18)
where β ∈ [0, 1] is the trust decay factor and consistencyi, j (t) measures the agreement between nodes i and j. Within each cluster, a Graph Attention Network (GAT) facilitates coordinated decision-making: ei j = LeakyReLU(aT [Whi ∥Wh j ]) exp(ei j ) αi j = ∑k∈Ni exp(eik ) !
(20)
h′i = σ
(21)
∑ αi j Wh j
Fig. 4: SwarmSense-DNN model architecture.
(19)
C. Algorithms of SwarmSense-DNN This section presents two core algorithms governing the operation of SwarmSense-DNN. Algorithm 1 Decentralized Swarm Coordination Protocol with Pheromone-Inspired Mechanism Input: Set of nodes N = {n1 , n2 , . . . , nk }; Neighborhood radius r; Initial model weights W0 ; Pheromone decay rate ρ; Minimum pheromone threshold τmin Output: Updated local models {Wi }ki=1 1: for each node ni ∈ N do 2: Discover neighbors: Ni ← {n j | dist(ni , n j ) ≤ r} 3: Initialize pheromone levels: τi j ← 1.0, ∀n j ∈ Ni 4: Compute local anomaly score Ai from node ni 5: Update pheromone based on anomaly intensity:
j∈Ni
τi j ← τi j + α · Ai
where hi represents the node embedding, W is a learned transformation matrix, a is the attention parameter vector, and ∥ denotes concatenation. 5) Privacy-Preserving Mechanisms Differential Privacy for Feature Sharing: Before sharing features, each node adds calibrated noise: temp
F̃shared = Fi i p σdp =
2 + N (0, σdp I)
(22)
2 log(1.25/δ ) · ∆ εi
(23)
where ∆ is the global sensitivity, εi is the privacy budget for node i, and δ is the failure probability. Privacy parameters are set to ε = 1.0 and δ = 10−5 for our experiments. Gaussian noise N (0, σ 2 ) is added element-wise to individual features p before aggregation, where σ = 2 ln(1.25/δ )·∆/ε with global sensitivity ∆ = 1.0 determined by L2-norm clipping of feature vectors. Secure Multi-Party Computation: For aggregating clusterlevel statistics, nodes employ additive secret sharing: si = vi +
∑
ri j
(24)
6: 7: 8:
Share local weights Wi and pheromones τi j with neighbors Ni Receive {W j } and {τ ji } from Ni Apply pheromone-weighted aggregation via swarm consensus: Winew ←
9: 10:
Update local model: Wi ← Winew Apply pheromone decay: τi j ← (1 − ρ) · τi j
11: if τi j < τmin then 12: τi j ← τmin 13: end if 14: end for 15: return {Wi }ki=1
// Prevent complete evaporation
D. Evaluation Metrics 1) Detection Performance Metrics Accuracy =
1 N T Pi + T Ni ∑ N i=1 T Pi + T Ni + FPi + FNi
(25)
1 N T Pi ∑ T Pi + FPi N i=1
(26)
1 N T Pi ∑ T Pi + FNi N i=1
(27)
2 × Precision × Recall Precision + Recall
(28)
Precision =
j∈Ci , j̸=i
where vi is the private value, ri j are random shares, and si is the shared secret. Figure 4 shows the SwarmSense-DNN architecture, combining convolutional feature extraction, trust evaluation, and adaptive clustering. Differential privacy and pheromone-based coordination enable secure, decentralized, and resilient anomaly detection.
∑ j∈Ni τ jiW j ∑ j∈Ni τ ji
Recall = F1-Score =
Z 1
AUC = 0
TPR(FPR−1 (x)) dx
(29)
6
Algorithm 2 Anomaly Detection with Attention-Guided Swarm GNN and Pheromone-Based Coordination
tions:
Input: Graph G = (V, E) with node features X; attention parameters α; model weights W ; pheromone matrix τ Output: Anomaly scores S and updated pheromone levels τ 1: Initialize GNN layers with attention heads 2: Initialize pheromone matrix: τi j ← 1.0, ∀(i, j) ∈ E 3: for l = 1 to L do 4: for each node vi ∈ V do 5: Compute pheromone-modulated attention weights: αi j ← τi j · softmax LeakyReLU(a⊤ [W Xi ∥W X j ])
AttackResistance = 1 −
6:
Aggregate messages:
Recovery Time: Time required to restore normal performance after disruption: Trecovery = min{t : Accuracy(t) ≥ 0.95 × Accuracynormal } (36) IV. R ESULTS A. Experimental Setup and Overall Detection Accuracy Results
! (l) hi ← σ
Accuracynormal − Accuracyattack (35) Accuracynormal
∑ αi j W X j
Table I consolidates all experimental settings.
j∈N (i)
TABLE I: Comprehensive Experimental Configuration Summary
7: end for 8: end for 9: for each node vi ∈ V do 10: Compute anomaly score: (L)
Si ← 1 − cos hi , µ
where µ is the expected behavior embedding 11: Update pheromone based on anomaly detection: 12: for each j ∈ N (i) do 13: τi j ← τi j + β · Si // Deposit pheromone on anomalous paths 14: end for 15: end for 16: Apply pheromone evaporation: τi j ← (1 − ρ) · τi j ,
Specification
Node Hardware Network Size Communication Storage
Hardware Setup Raspberry Pi 4 (8GB RAM, ARM Cortex-A72) 100 nodes distributed across testbed Software-defined networking infrastructure 64GB microSD per node
Primary Datasets Data Split Anomaly Rates Preprocessing
Datasets IoT-23, NSL-KDD, CICIDS2017, UNSW-NB15, Industrial IoT 70%/15%/15% (train/validation/test) 5.2%–23.1% (dataset-dependent) Z-score normalization, forward-fill imputation
Framework Optimizer Batch Size Epochs per Round Convergence
Training Configuration PyTorch 1.12 with CUDA 11.6 AdamW (lr = 0.001, weight decay = 0.01) 32 (adaptive) 50 <0.1% accuracy change over 5 rounds
Privacy Budgets Failure Probability Noise Mechanism Budget Allocation
Privacy Settings ε ∈ {10, 5, 1, 0.1} −5 δ = 10 Gaussian with sensitivity ∆ = 1.0 Fixed per-node: εi = ε/N
Pheromone Decay Trust Smoothing Attention Heads Cluster Size
Swarm Parameters ρ = 0.1 (grid search validated) β = 0.8 (grid search validated) 8 (node-level multi-head attention) 10–15 nodes per cluster
∀(i, j) ∈ E
17: return S = {Si }, τ
2) Communication Efficiency Metrics Communication Overhead: Total amount of data transmitted per time unit: CommOverhead =
Configuration Aspect
1 T N ∑ ∑ ∑ ∥si→ j (t)∥0 T t=1 i=1 j∈N (t)
(30)
i
Convergence Time: Number of communication rounds required to reach stable performance: Tconv = min {t : |Accuracy(t + k) − Accuracy(t)| < εconv ,
Statistical Testing Significance Level Confidence Intervals ∀k ≤ w} Baseline Implementation
(31) where w is the stability window and εconv is the convergence threshold. 3) Privacy Preservation Metrics Privacy Budget Utilization: Fraction of total privacy budget consumed: ∑N ε used PrivacyUtil = i=1 i (32) εtotal Information Leakage: Mutual information between shared data and private data: InfoLeakage =
1 N ) ∑ I(Xi ; F̃shared i N i=1
(33)
4) Resilience Metrics Fault Tolerance: Performance degradation under node failures: Accuracyfailed FaultTolerance = (34) Accuracynormal Attack Resistance: Performance under adversarial condi-
Evaluation Protocol n = 5 independent runs, paired t-tests p < 0.01 95% CI reported as mean ± std. error Re-implemented under identical conditions
Table II presents detection performance across all datasets. SwarmSense-DNN outperforms baselines, achieving an average 5.23% gain over the best competitor (Distributed GNN). Its precision (94.87%) ensures low false positives, recall (96.12%) confirms strong anomaly detection, and an AUC of 0.967 demonstrates robustness across thresholds. Figure 5 shows SwarmSense-DNN’s superior detection, achieving 95.44% accuracy, 94.87% precision, 96.12% recall, 95.49% F1, and 0.967 AUC, a 5.26% gain over the best baseline, with consistent reliability across scenarios. TABLE II: Detection Performance Comparison Across Datasets Method
Acc.
Prec.
Rec.
F1
AUC
Avg.
Centralized DL [53] FedAvg-AD [4] Distributed GNN [50] Edge-FL [37] Ensemble-Dist [67] SwarmSense-DNN
88.46% 85.46% 90.18% 87.38% 89.28% 95.44%
87.23% 84.89% 89.76% 86.92% 88.94% 94.87%
89.12% 86.34% 90.89% 88.15% 89.85% 96.12%
88.16% 85.60% 90.32% 87.53% 89.39% 95.49%
0.914 0.891 0.928 0.905 0.921 0.967
88.51% 85.64% 90.29% 87.51% 89.33% 95.52%
7
TABLE IV: Communication Efficiency Metrics Comparison Method
Overhead (MB/h)
Rounds
BW Reduction
Eff. Score
2160 1630 1775 1920 585
125 98 112 118 32
– 24.5% 17.8% 11.1% 72.9%
0.396 0.553 0.492 0.441 0.973
FedAvg-AD [4] Distributed GNN [50] Edge-FL [37] Ensemble-Dist [67] SwarmSense-DNN
Fig. 5: SwarmSense-DNN detection performance.
B. Dataset-Specific Performance Analysis Table III shows that SwarmSense-DNN consistently outperforms baselines across all datasets, with the largest gain (6.5%) on UNSW-NB15 and the smallest gain (4.3%) on CICIDS2017. These results highlight the framework’s robustness. Figure 6 shows SwarmSense-DNN’s robustness, maintaining over 95% accuracy across IoT-23, NSL-KDD, CICIDS2017, UNSWNB15, and Industrial IoT, with improvements of 4.3–6.5% over baselines, confirming strong generalizability. TABLE III: Dataset-Specific Detection Performance Analysis Dataset
Swarm
Dist. GNN
Ensemble
FedAvg
Gain
IoT-23 NSL-KDD CICIDS2017 UNSW-NB15 Industrial IoT
94.7% 96.2% 97.1% 93.8% 95.4%
89.1% 91.2% 92.8% 87.3% 90.5%
88.4% 90.6% 91.9% 86.8% 89.7%
84.6% 86.8% 88.3% 82.4% 85.2%
+5.6% +5.0% +4.3% +6.5% +4.9%
Average
95.44%
90.18%
89.48%
85.46%
+5.26%
Fig. 6: Dataset-specific performance analysis with statistical validation
C. Communication Overhead Analysis All bandwidth measurements reported in this study are per-node averages, computed across the network to ensure reproducibility of efficiency comparisons. Table IV and Figure 7 highlight SwarmSense-DNN’s communication efficiency. It reduces bandwidth usage by 72.9% (585 MB/h vs. 2160 MB/h for FedAvg-AD) and achieves convergence in 32 rounds, 64.1% faster than the best baseline, confirming its suitability for resource-constrained environments.
Fig. 7: SwarmSense-DNN communication efficiency analysis.
D. Privacy-Accuracy Trade-off Analysis Table V shows that SwarmSense-DNN retains 93.2% accuracy at ε = 1, with reduced information leakage and stronger resistance to membership inference attacks. TABLE V: Privacy Preservation Performance Under Different Privacy Budgets Privacy Budget (ε)
Acc.
Prec.
Rec.
Leakage
Priv. Util.
Atk. Resist.
No Privacy ε = 10 ε =5 ε =1 ε = 0.1
96.2% 95.7% 94.9% 93.2% 89.8%
95.8% 95.2% 94.3% 92.5% 88.9%
96.6% 96.2% 95.5% 93.9% 90.7%
0.847 0.234 0.156 0.089 0.023
0% 18.3% 31.7% 68.9% 94.4%
32.1% 78.4% 85.2% 94.3% 97.8%
Fig. 8: SwarmSense-DNN privacy preservation analysis. Figure 8 shows SwarmSense-DNN’s privacy strength, maintaining 93.2% accuracy under ε = 1, achieving 94.3% attack resistance, and reducing leakage from 0.847 to 0.089, confirming its suitability for privacy-sensitive domains. E. Fault Tolerance and Recovery Analysis Table VI summarizes resilience. SwarmSense-DNN retains ≥ 87% performance with 40% node failures and achieves ≥ 88% self-healing. The resilience score Resilience = Performance Retention×Self Healing is high, indicating stable behavior 1+log(Recovery Time)
8
under stress. We simulate Byzantine failures: data poisoning with 10% false labels, model inversion via gradients, and coordinated attacks with 20% colluding nodes. Failures are randomly distributed across clusters to approximate worst-case conditions. TABLE VI: System Resilience Metrics Under Various Stress Conditions Stress Condition 10% Node Failures 25% Node Failures 40% Node Failures Data Poisoning (10%) Model Inversion Attack Byzantine Attack (20%) Network Partition
Retention
Recovery
Atk. Rate
Self-Heal
Resilience
97.1% 92.8% 87.9% 93.8% 95.1% 91.4% 89.6%
2.3 4.1 6.8 4.2 2.8 6.1 8.9
– – – 12.3% 8.7% 15.6% –
98.7% 94.2% 89.3% 96.1% 97.4% 92.8% 88.1%
0.954 0.891 0.823 0.876 0.912 0.847 0.794
Fig. 10: SwarmSense-DNN scalability analysis.
Results confirm suitability for large-scale deployments with predictable resource utilization and better efficiency than centralized systems. G. Industrial IoT Implementation Results Table VIII validates SwarmSense-DNN’s practical effectiveness, achieving a 92% anomaly detection rate with a 75% reduction in false positives. The 96% improvement in detection latency enabled proactive maintenance, preventing three critical equipment failures and saving approximately $47,000 in emergency repair costs during the evaluation period.
Fig. 9: SwarmSense-DNN system resilience evaluation. Figure 9 shows SwarmSense-DNN’s resilience, retaining 87.9% accuracy under 40% node failures, recovering in as little as 2.3 rounds, and sustaining self-healing above 88% across stress scenarios, confirming suitability for critical infrastructure.
TABLE VIII: Real-World Industrial IoT Deployment Results Metric
SwarmSense
Prev. System
Change
Impact
Anomalies Detected False Pos. Rate Detection Latency System Uptime Maint. Savings Energy Efficiency
23/25 (92%) 3.2% 4.7 min 99.7% – 18% less
18/25 (72%) 12.8% 2.1 hrs 97.3% – Baseline
+20% −75% −96% +2.4% $47,000 +18%
Early failure prevention Fewer maint. calls Faster response Improved uptime Prevented failures Lower cost
F. Large-Scale Performance Evaluation Table VII shows SwarmSense-DNN’s sub-linear scaling behavior, with the scalability index (normalized performance considering resource utilization) remaining above 0.79 even for 1000 nodes. The convergence time grows sublinearly (O(N 0.67 )), while memory usage increases modestly due to efficient swarm coordination protocols. TABLE VII: Scalability Performance Across Different Network Sizes Net. Size
Acc.
Conv. Time
Mem. (MB)
CPU (%)
Lat. (ms)
Scal. Index
100 nodes 250 nodes 500 nodes 750 nodes 1000 nodes
95.4% 95.1% 94.8% 94.5% 94.2%
32 rounds 41 rounds 52 rounds 61 rounds 68 rounds
148 167 189 203 215
23.7% 28.9% 34.2% 38.1% 41.6%
12.3 18.7 26.4 31.8 36.2
1.000 0.943 0.887 0.841 0.798
The $47,000 reflects avoided emergency repair costs versus a reactive baseline: three averted failures saved $52,000, minus $5,000 for SwarmSense-DNN deployment. Bandwidth and productivity gains are excluded, covering only the 30-day evaluation. Figure 10 shows SwarmSense-DNN scales efficiently, sustaining 94.2% accuracy with 1000 nodes, sub-linear convergence growth (O(N 0.67 )), and modest memory use (148–215 MB).
Fig. 11: Real-world industrial IoT deployment results. Figure 11 demonstrates SwarmSense-DNN’s 30-day industrial IoT deployment, achieving 92% detection accuracy, 96% lower latency, 75% fewer false positives, 18% higher energy efficiency, and USD 47K cost savings, confirming industrialgrade performance. H. Ablation Study Table IX presents the results. The ablation study confirms that each component contributes significantly to overall system performance, with swarm intelligence providing the largest
9
TABLE IX: Ablation Study Results Configuration
Acc. (%)
Overhead (MB/hr)
Conv. (rounds)
Privacy (%)
Contribution (%)
Impact Level
Full SwarmSense-DNN
96.2
585
32
93.2
–
Baseline
– Swarm Intelligence – Hierarchical Clustering – Attention Mechanism – Privacy Mechanisms – Self-Healing
91.8 93.4 94.1 96.5 94.7
Major Component Removal 1240 78 89.7 925 45 91.8 612 38 92.6 568 30 45.3 597 35 92.1
−4.4 −2.8 −2.1 +0.3 −1.5
Critical High Moderate Privacy Trade-off Moderate
– Dual-Pathway Encoder – Self-Evolution Mechanism – Trust-based Coordination – Pheromone Updates – Graph Attention (GAT) – Anomaly Feature Preprocessing – Communication Pruning
94.1 94.4 93.2 94.8 94.6 95.0 94.8
Individual Component Analysis 598 35 92.8 592 34 92.5 847 52 90.8 678 41 92.9 615 36 92.4 601 34 92.4 612 35 92.7
−2.1 −1.8 −3.0 −1.4 −1.6 −1.2 −1.4
Moderate Moderate High Low Moderate Low Low
Centralized Architecture Standard Federated No Swarm + No Clustering
92.3 89.7 88.5
Architecture Variants 2100 68 1580 89 1650 95
−3.9 −6.5 −7.7
Reference Reference Worst Case
78.5 85.2 84.1
Fig. 14: t-SNE visualization of learned feature representations on IoT-23 dataset.
96% latency reduction with minor CPU overhead. Future work will address lightweight coordination and quantum-resistant privacy [53], [56]. TABLE X: Comparative Analysis: SwarmSense-DNN vs. Stateof-the-Art Approaches Approach
Acc.
Comm. Eff.
Privacy
Fault Tol.
Scal.
Bio-Insp.
FedAvg-AD [4] Distributed GNN [50] Edge-FL [37] Ensemble-Dist [67] Swarm Learning [52] Coop. Learning [51] SwarmSense-DNN
85.46% 90.18% 87.38% 89.28% 88.90% 87.65% 95.44%
Low Medium Medium Low High High High
Medium Low Medium Low High Medium High
Low Medium Low Medium Medium Low High
Medium Low High Medium Medium High High
No No No No Yes Yes Yes
Fig. 12: Ablation results quantification. V. C ONCLUSION improvement in communication efficiency and convergence speed. Figure 12 shows that all modules enhance SwarmSense-DNN, with swarm intelligence contributing most (4.4% accuracy drop when removed). Clustering and attention offer moderate gains, while privacy maintains accuracy, confirming the design’s robustness.
This paper presented SwarmSense-DNN, a decentralized neural framework integrating swarm intelligence and federated learning for trustworthy IoT anomaly detection. Evaluation across five benchmarks demonstrated superior performance with 95.44% detection accuracy and 72.9% reduction in communication overhead while maintaining strong privacy guarantees and resilience under node failures. Despite promising results, the framework faces limitations, including hyperparameter sensitivity, degraded performance during network partitions (89.6% accuracy), and unsuitability for ultra-low-latency applications requiring sub-second response. Future work will enhance explainability through SHAP analysis and attention visualization to support safety-critical deployments where algorithmic transparency is essential. R EFERENCES
Fig. 13: Impact of swarm coordination on convergence performance. Figure 13 shows that swarm coordination achieves 2.4× faster convergence and 53% less communication overhead. Figure 14 illustrates tSNE features where attention enhances anomaly separability by reducing intra-class variance by 34% and increasing inter-class distance by 28%. I. Comparative Analysis Result Table X shows that SwarmSense-DNN outperforms existing methods in accuracy, efficiency, and scalability, achieving a
[1] Zheng Lin, Guanqiao Qu, Qiyuan Chen, Xianhao Chen, Zhe Chen, and Kaibin Huang. Pushing Large Language Models to the 6G Edge: Vision, Challenges, and Opportunities. IEEE Communication Magazine, 2025. [2] Guanqiao Qu, Qiyuan Chen, Wei Wei, Zheng Lin, Xianhao Chen, and Kaibin Huang. Mobile edge intelligence for large language models: A contemporary survey. IEEE Communications Surveys & Tutorials, 2025. [3] Zihan Fang, Zheng Lin, Senkang Hu, Yihang Tao, Yiqin Deng, Xianhao Chen, and Yuguang Fang. Dynamic uncertainty-aware multimodal fusion for outdoor health monitoring. arXiv preprint arXiv:2508.09085, 2025. [4] V. Mothukuri, P. Khare, R. M. Parizi, S. Pouriyeh, A. Dehghantanha, and G. Srivastava. Federated learning-based anomaly detection for iot security attacks. IEEE Internet of Things Journal, 9(4):2545–2554, 2022. [5] Zhuosen Bao, Xia Du, Zheng Lin, Jizhe Zhou, Zihan Fang, Jiening Wu, Yuxin Zhang, Zhe Chen, Chi-man Pun, Wei Ni, et al. Sider: Semantic identity decoupling for unrestricted face privacy. arXiv preprint arXiv:2602.04994, 2026.
10
[6] Hussah Nasser AlEisa, Fadwa Alrowais, Randa Allafi, Nabil Sharaf Almalki, Raji Faqih, Radwa Marzouk, Mrim M Alnfiai, Abdelwahed Motwakel, and Sara Saadeldeen Ibrahim. Transforming transportation: Safe and secure vehicular communication and anomaly detection with intelligent cyber–physical system and deep learning. IEEE Transactions on Consumer Electronics, 70(1):1736–1746, 2023. [7] J. Yang, V. Govindarajan, M. Y. H. Al-Shamri, H. Aldossary, A. Ksibi, Z. A. Shaikh, et al. Neuroagent-x: A self-evolving cognitive agent for securing consumer iot systems against ai-enabled anomalies and adversarial threats. IEEE Transactions on Consumer Electronics, 71(4):12226–12235, 2025. [8] Zongyuan Zhang, Tianyang Duan, Zheng Lin, Dong Huang, Zihan Fang, Zekai Sun, Ling Xiong, Hongbin Liang, Heming Cui, and Yong Cui. State-aware perturbation optimization for robust deep reinforcement learning. IEEE Trans. Mobile Comput., 2025. [9] Jing Yang et al. Llm-ae-mp: Web attack detection using a large language model with autoencoder and multilayer perceptron. Expert Systems with Applications, 274:126982, 2025. [10] J. Yang, M. Okmi, S. Prajapat, Z. Li, L. Y. Por, A. K. Das, J. J. P. C. Rodrigues, and X. Ji. Neurothyroid-pqc: A multivariate post-quantum and hash-based cryptographic framework for real-time numerical thyroid biomarker anomaly detection in iomt. IEEE Internet of Things Journal, 2026. [11] Zheng Lin, Wei Wei, Zhe Chen, Chan-Tong Lam, Xianhao Chen, Yue Gao, and Jun Luo. Hierarchical Split Federated Learning: Convergence Analysis and System Optimization. IEEE Trans. Mobile Comput., 2025. [12] Mingwei Hong, Zheng Lin, Zehang Lin, Lin Li, Miao Yang, Xia Du, Zihan Fang, Zhaolu Kang, Dianxin Luan, and Shunzhi Zhu. Conflictaware client selection for multi-server federated learning. arXiv preprint arXiv:2602.02458, 2026. [13] Zekai Sun, Xiuxian Guan, Zheng Lin, Yuhao Qing, Haoze Song, Zihan Fang, Zhe Chen, Fangming Liu, Heming Cui, Wei Ni, et al. Rrto: A high-performance transparent offloading system for model inference in mobile edge computing. arXiv preprint arXiv:2507.21739, 2025. [14] Zihan Fang, Zheng Lin, Zhe Chen, Xianhao Chen, Yue Gao, and Yuguang Fang. Automated Federated Pipeline for Parameter-Efficient Fine-Tuning of Large Language Models. IEEE Trans. Mobile Comput., 2025. [15] Yuxin Zhang, Zheng Lin, Zhe Chen, Zihan Fang, Wenjun Zhu, Xianhao Chen, Jin Zhao, and Yue Gao. Satfed: A resource-efficient leo satelliteassisted heterogeneous federated learning framework. Engineering, 2024. [16] Zheng Lin, Yuxin Zhang, Zhe Chen, Zihan Fang, Xianhao Chen, Praneeth Vepakomma, Wei Ni, Jun Luo, and Yue Gao. HSplitLoRA: A Heterogeneous Split Parameter-Efficient Fine-Tuning Framework for Large Language Models. arXiv preprint arXiv:2505.02795, 2025. [17] Jiuzhen Zeng, Laurence T Yang, Chao Wang, Xianjun Deng, and Xiangli Yang. Tensor-based multi-scale correlation anomaly detection for aiot-enabled consumer applications. IEEE Transactions on Consumer Electronics, 2024. [18] J. Yang, K. Tian, H. Zhao, Z. Feng, S. Bourouis, S. Dhahbi, A. A. Khan, et al. Wastewater treatment monitoring: Fault detection in sensors using transductive learning and improved reinforcement learning. Expert Systems with Applications, 264:125805, 2025. [19] C. Liu, J. Yang, R. Chen, Y. Zhang, and J. Zeng. An edge computing based anomaly detection method in iot industrial sustainability. Applied Soft Computing, 128:109464, 2022. [20] Z. Dai, L. Y. Por, Y. L. Chen, J. Yang, C. S. Ku, R. Alizadehsani, and P. Pławiak. An intrusion detection model to detect zero-day attacks in unseen data using machine learning. PloS one, 19(9):e0308469, 2024. [21] J. Yang, J. Dai, B. Li, M. A. Khan, S. Alsenan, V. Govindarajan, Z. A. Shaikh, et al. Neurocare-scc: An ai-enhanced integrated sensing–communication–computing–control framework for cognitive health monitoring. IEEE Transactions on Consumer Electronics, 2026. [22] Zheng Lin, Guanqiao Qu, Wei Wei, Xianhao Chen, and Kin K Leung. Adaptsfl: Adaptive Split Federated Learning in Resource-Constrained Edge Networks. IEEE Trans. Netw., 2025. [23] P. Kumari, A. Singh, and R. Sharma. A comprehensive investigation of anomaly detection methods in deep learning and machine learning: 2019–2023. IET Information Security, 18(4):512–538, 2024. [24] J. Xu, J. Yang, Y. Huang, L. Y. Por, X. Chen, and C. Zhao. Dfgnet: A dual-pathway graph neural network via frequency decomposition for spatiotemporal forecasting. Expert Systems with Applications, 297:129518, 2026. [25] Zheng Lin, Ons Aouedi, Wei Ni, Symeon Chatzinotas, and Xianhao Chen. Gapsl: A gradient-aligned parallel split learning on heterogeneous data. arXiv preprint arXiv:2603.18540, 2026. [26] B. Dong, D. Chen, Y. Wu, S. Tang, and Y. Zhuang. Fadngs: Federated learning for anomaly detection with noisy global density estimation
and self-supervised ensemble distillation. IEEE Transactions on Neural Networks and Learning Systems, 36(2):2578–2592, 2025. [27] Huma Gupta, Sanjeev Sharma, and Sanjay Agrawal. Artificial intelligencebased anomalies detection scheme for identifying cyber threat on iotbased transport network. IEEE Transactions on Consumer Electronics, 70(1):1716–1724, 2023. [28] J. Yang, A. A. Khan, X. Yang, X. Xu, M. Abdel-Salam, D. Hu, C. Z. T. Xie, and L. Yee. Toward secure and standardized ai frameworks in metaverse-enabled cognitive digital twins for healthcare. IEEE Communications Standards Magazine, 2025. [29] A. Wardhana, B. F. Santos, and A. Reis. Swarm learning: A survey of concepts, applications, and trends. arXiv preprint, arXiv:2405.00556v2, 2025. [30] Shi Cheng, Honglin Jin, Hui Lu, and Yuhui Shi. A q-learning based brainstorming optimization algorithm for solving multimodal optimization problems. IEEE Transactions on Consumer Electronics, 2024. [31] J. Yang, V. Govindarajan, S. Arif, X. Xu, M. Kallel, Z. A. Shaikh, Z. Liu, C. Yuan, et al. Swarmsense-dnn: A trustworthy and decentralized neural framework for proactive anomaly defense in consumer iot. IEEE Transactions on Consumer Electronics, 2025. [32] Zheng Lin, Zhe Chen, Xianhao Chen, Wei Ni, and Yue Gao. HASFL: Heterogeneity-aware Split Federated Learning over Edge Computing Systems. IEEE Trans. Mobile Comput., 2026. [33] Q. V. Pham, S. Mirjalili, N. Kumar, M. Alazab, and W. J. Hwang. Swarm intelligence for next-generation networks: Recent advances and applications. Journal of Network and Computer Applications, 191:103141, 2021. [34] W. Ge, V. Govindarajan, J. Yang, M. Ayadi, Z. A. Shaikh, L. Li, L. Y. Por, N. Liu, et al. Optimized federated learning framework with regnetz and swin-transformer for multimodal pancreatic cancer detection. Scientific Reports, 2025. [35] M. A. Blais and M. Akhloufi. Reinforcement learning for swarm robotics: An overview of applications, algorithms and simulators. Cognitive Robotics, 3:226–256, 2023. [36] J. Yang, X. Xu, M. A. Khan, G. B. Brahim, J. Baili, L. Y. Por, and C. Li. Explainable deep reinforcement learning for anomaly detection in iot-enabled metaverse healthcare: Toward trustworthy cyber threat intelligence. Research, 2026. [37] D. Man, D. Yi, and M. Li. Intelligent intrusion detection based on federated learning for edge-assisted internet of things. Security and Communication Networks, 2021:9361348, 2021. [38] Segun I Popoola, Agbotiname Lucky Imoize, Mohammad Hammoudeh, Bamidele Adebisi, Olamide Jogunola, and Abiodun M Aibinu. Federated deep learning for intrusion detection in consumer-centric internet of things. IEEE Transactions on Consumer Electronics, 70(1):1610–1622, 2023. [39] A. A. Khan, X. Zhang, F. Hajjej, J. Yang, C. S. Ku, and L. Y. Por. Asmf: Ambient social media forensics chain of custody with an intelligent digital investigation process using federated learning. Heliyon, 10(1), 2024. [40] J. Yang, Y. Xia, M. A. Khan, S. Anakal, L. Y. Por, J. Baili, S. Wu, and Q. Yang. Enhancing privacy-preserved iris recognition in consumer electronics: A soft actor-critic and gan-based digital forensic framework with bayesian hyperparameter optimization. IEEE Transactions on Consumer Electronics, 2025. [41] Q. Li, Q. Luo, X. Nong, X. Chen, H. Zhang, and C. Wong. Decentralized federated learning for internet of things anomaly detection. In Proceedings of the 2022 ACM on Asia Conference on Computer and Communications Security, pages 532–546, 2022. [42] Md Fahim-Ul-Islam, Amitabha Chakrabarty, Md Golam Rabiul Alam, and Siti Sarah Maidin. A resource-efficient federated learning framework for intrusion detection in iomt networks. IEEE Transactions on Consumer Electronics, 2025. DOI: https://doi.org/10.1109/TCE.2025.3544885. [43] J. Yang, E. Rezvani, M. A. Khan, B. Heidari, H. M. Albarakati, S. Prajapat, et al. Qb-autoids: A blockchain-based decentralized autonomous cyberattack detection system for consumer electronics using hybrid double q-learning and bi-lstm. IEEE Transactions on Consumer Electronics, 2025. [44] J. H. Syu, G. Srivastava, M. Fojcik, R. Cupek, and J. C. W. Lin. Distributed learning mechanisms for anomaly detection in privacy-aware energy grid management systems. ACM Transactions on Sensor Networks, 19(4):1–27, 2023. [45] J. Yang, V. Govindarajan, L. Y. Por, Z. A. Shaikh, Q. Xin, P. Bhattacharya, et al. Ddos attack detection in consumer iot-based healthcare systems using improved off-policy proximal policy optimization and generative adversarial network. IEEE Transactions on Consumer Electronics, 2025.
11
[46] A. A. Khan, J. Yang, A. A. Laghari, A. M. Baqasah, R. Alroobaea, C. S. Ku, and L. Y. Por. Baiot-ems: Consortium network for smallmedium enterprises management system with blockchain and augmented intelligence of things. Engineering Applications of Artificial Intelligence, 141:109838, 2025. [47] J. Yang, A. A. Khan, D. Kurnianingtyas, M. A. Rahman, S. Prajapat, and L. Yee. A blockchain-based interoperable framework for secure, seamless, and optimized healthcare data management in 6g-ready edge healthcare networks. IEEE Communications Standards Magazine, 2026. [48] Y. Liu, S. Ren, X. Wang, and M. Zhou. Decentralized anomaly detection in cooperative multi-agent reinforcement learning. In Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence, pages 145–153, 2023. [49] J. Yang, V. Govindarajan, M. A. Khan, Z. A. Shaikh, S. Alsenan, Y. Li, L. Y. Por, et al. Cardiotwin-xai: A consumer-centric digital twin framework for predictive risk stratification and personalized management of coronary artery disease in healthcare 5.0. IEEE Transactions on Consumer Electronics, 2026. [50] H. Zhang, Y. Zhou, H. Xu, X. Chen, and F. Liu. Graph neural network approach with spatial structure to anomaly detection of network data. Journal of Big Data, 12:105, 2025. [51] R. Xu, W. Jin, and A. N. Khan. Cooperative swarm learning for distributed cyclic edge intelligent computing. Internet of Things, 22:100679, 2023. [52] A. Wardhana, B. F. Santos, and A. Reis. Swarm learning for decentralized and confidential clinical machine learning. Nature, 594(7862):265–270, 2021. [53] S. Huang, J. Li, L. Chen, X. Wang, and Y. Zhang. Deep learning advancements in anomaly detection: A comprehensive survey. arXiv preprint, arXiv:2503.13195v1, 2025. [54] A. Nazir et al. A deep learning-based novel hybrid cnn-lstm architecture for efficient detection of threats in the iot ecosystem. Ain Shams Engineering Journal, 15:102777, 2024. [55] M. Singh, A. Kumar, and D. Patel. Enhanced anomaly network intrusion detection using an improved snow ablation optimizer with dimensionality reduction and hybrid deep learning model. Scientific Reports, 15(1):4036, 2025. [56] Z. Chen, L. Wang, and H. Liu. Signature-based intrusion detection using machine learning and deep learning approaches empowered with fuzzy clustering. Scientific Reports, 15(1):2101, 2025. [57] H. Kim, S. Lim, J. Park, and K. Lee. Graph anomaly detection with graph neural networks: Current status and challenges. arXiv preprint, arXiv:2209.14930, 2022. [58] J. Zhou, M. Liu, H. Wang, and X. Chen. Grouped graph neural networks for anomaly detection in time series. In IEEE Conference Publication, pages 1234–1240, 2024. [59] J. Tang, J. Li, Z. Gao, and J. Li. Rethinking graph neural networks for anomaly detection. In Proceedings of the 39th International Conference on Machine Learning, volume 162, pages 21076–21091, 2022. [60] A. Dadhania et al. Software defined network and graph neural networkbased anomaly detection scheme for high speed networks. Computer Science and Applications, 3:100079, 2025. [61] H. Liu, R. Jiang, and B. Zhou. An ensemble approach for unsupervised anomaly and cyber attack detection. Transactions on Engineering Computing and Technology, 2025. [62] D. P. Kavadi et al. Design of an integrated model with temporal graph attention and transformer-augmented rnns for enhanced anomaly detection. Scientific Reports, 15:2020, 2025. [63] K. Rezaee, S. M. Rezakhani, M. R. Khosravi, and M. K. Moghimi. Anomaly detection using edge computing in video surveillance system: Review. International Journal of Multimedia Information Retrieval, 11(2):189–205, 2022. [64] A. Mudgerikar, P. Sharma, and E. Bertino. Edge-based intrusion detection for iot devices. ACM Transactions on Management Information Systems, 11(2):1–23, 2020. [65] H. Xiang, W. Dou, and X. Zhang. Edge computing empowered anomaly detection framework with dynamic insertion and deletion schemes on data streams. World Wide Web, 25(3):1247–1275, 2022. [66] Y. Zhuang et al. Edge computing for data anomaly detection of multisensors in underground mining. Electronics, 10(3):302, 2021. [67] M. Sarhan, S. Layeghy, N. Moustafa, and M. Portmann. A deep learning ensemble for network anomaly and cyber-attack detection. Sensors, 20(16):4583, 2020. [68] S. Liu, C. Zhang, and H. Wang. Selective ensemble method for anomaly detection based on parallel learning. Scientific Reports, 14:5849, 2024. [69] H. H. Nguyen et al. Variational autoencoder for anomaly detection: A comparative study. arXiv preprint arXiv:2408.13561, 2024.
[70] M. Wang, X. Zhu, G. Zhou, Y. Ma, and L. Chen. Anomaly detection in multidimensional time series for water injection pump operations based on lstma-ae and mechanism constraints. Scientific Reports, 15:2020, 2025. [71] T. Ji et al. Variational autoencoder based anomaly detection in large-scale energy storage power stations. Energies, 18(11):2770, 2025. [72] Zheng Lin, Zhe Chen, Zihan Fang, Xianhao Chen, Xiong Wang, and Yue Gao. Fedsn: A federated learning framework over heterogeneous leo satellite networks. IEEE Transactions on Mobile Computing, 24(3):1293– 1307, 2024. [73] A. Jokic, M. Zivkovic, L. Jovanovic, M. Mravik, M. Sarac, V. Simic, and N. Bacanin. A convolutional neural network-enhanced attack detection framework with explainable artificial intelligence for internet of things-based metaverse security. Engineering Applications of Artificial Intelligence, 158:111358, 2025.