IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
1
F-ACVAE: A Federated Adaptive Conditional Variational Auto-Encoder for Privacy-Preserving Intrusion Detection in IoT Networks
arXiv:2607.04698v1 [cs.LG] 6 Jul 2026
Mohammad Ansarimehr , Somayeh Changiz , Ehsan Baghishani
Abstract—The rapid proliferation of Internet of things (IoT) devices has significantly expanded the cyber-attack surface, necessitating robust and privacy-preserving intrusion detection systems (IDS). However, centralized learning approaches often suffer from severe performance degradation due to high-dimensional traffic data, extreme class imbalance, and highly non-independent and identically distributed (non-IID) data across heterogeneous edge devices. To address these challenges, this paper proposes FACVAE, a federated adaptive conditional variational autoencoder framework that enables collaborative model training across distributed IoT devices without sharing raw data. F-ACVAE incorporates selective parameter aggregation, where local encoders remain private while globally shared components are synchronized to preserve discriminative latent structures. To further enhance stability under extreme non-IID settings and feature distribution shifts, we introduce a novel constrained momentum Gaussian aggregation (CMGA) strategy that combines update clamping with momentum-based smoothing to mitigate client drift. Extensive experiments on the N-BaIoT dataset demonstrate that F-ACVAE achieves an average accuracy and macro F1score of 99%, outperforming state-of-the-art baselines. Moreover, the selective aggregation mechanism reduces communication overhead by approximately 62%, making the framework particularly suitable for resource-constrained IoT environments. These results highlight the effectiveness of F-ACVAE in achieving high detection performance while ensuring privacy preservation and communication efficiency. Index Terms—Federated learning, Internet of things, intrusion detection system, variational autoencoder, privacy-preserving
I. I NTRODUCTION Internet of things (IoT) devices are now widespread in smart homes, industry, healthcare, and urban infrastructure. This rapid expansion has significantly increased the cyberattack surface for billions of resource-constrained devices, as evidenced by recent security benchmarks [1]. Large-scale botnet attacks, such as Mirai [2] and Bashlite [3], have demonstrated how millions of infected IoT devices can be orchestrated to launch massive distributed denial-of-service (DDoS) attacks. Traditional centralized intrusion detection systems (IDS) require the transmission of raw traffic data to a central server for analysis. However, this approach presents three critical challenges in IoT networks. First, the exposure of sensitive raw data raises severe privacy concerns, potentially violating international regulations such as the general data protection regulation (GDPR) [4] and the California consumer Corresponding Author: Ali Mousavi (e-mail: [email protected]). All authors are with Department of Computer Engineering, Ne. C., Islamic Azad University, Neyshabur, Iran (e-mail: [email protected], [email protected], [email protected], [email protected]).
and Ali Mousavi
privacy act (CCPA). Second, continuous data transmission imposes significant communication overhead on bandwidthlimited networks. Third, centralized models often demonstrate poor performance due to highly non-IID data distributions across devices and severe class imbalance in network traffic [5]. Among deep learning approaches for IoT intrusion detection, existing methods are generally divided into two main categories: traditional supervised machine learning models and autoencoder-based generative models. Supervised approaches primarily depend on classifiers trained on labeled traffic data. Early studies utilized classical algorithms such as random forest (RF), gradient boosting (XGBoost), and support vector machines (SVM). These models achieved high accuracy on benchmarks like CIC-IoT and N-BaIoT. Recent works have employed deep supervised architectures, such as CNN-LSTM hybrids and BiLSTM with attention mechanisms, as well as ensemble defenses enhanced by adversarial training. Such models effectively capture spatial and temporal patterns in network flows, consistently reporting accuracies exceeding 99% [6] and demonstrating strong robustness against known and adversarial attacks. However, these models require the centralized collection of raw labeled data across devices, which raises significant privacy concerns and causes substantial communication overhead in resource-constrained IoT environments. In contrast, autoencoder-based methods employ an unsupervised or semi-supervised paradigm, learning compact representations of normal traffic and detecting anomalies through high reconstruction errors. Initial efforts focused on vanilla and denoising autoencoders, while later advances incorporated variational autoencoders (VAEs) and sparse variants [7], as well as convolutional backbones to better model complex feature distributions [8]. Such generative models are particularly effective under severe class imbalance and do not require balanced attack labels. To overcome the limitations of both categories, the constrained twin variational autoencoder (CTVAE) has been proposed as an effective approach [5]. It utilizes class-conditioned Gaussian priors and employs a unique hermaphrodite regularization path, enforcing strong structural separation between benign and malicious latent representations. The CTVAE method effectively identifies complex attacks; however, its design remains centralized. This architecture requires all raw data from thousands of IoT devices to be sent to a single central server, which seriously violates
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
data privacy and security regulations, a concern particularly critical when devices handle sensitive information [4]. Furthermore, the continuous transmission of massive raw data in centralized intrusion detection frameworks imposes heavy communication overhead that often exceeds the capacity of resource-constrained IoT devices, motivating the adoption of federated learning paradigms [9]. To address these challenges, federated learning (FL) has emerged as an effective solution, enabling the collaborative training of a robust global model by sharing only model updates, such as weights, instead of private local data. Consequently, the privacy of each device is maintained, and bandwidth requirements are significantly reduced, making FL well-suited for distributed IoT networks. As a privacy-by-design paradigm, FL allows models to be trained across distributed devices without sharing raw data. Standard FL methods, including FedAvg and FedProx for nonIID data [10], along with their modern variants, are widely applied to IoT intrusion detection systems to preserve privacy while maintaining accuracy [11]. However, these algorithms face a major limitation: they suffer from significant accuracy degradation when data is highly non-IID, including extreme label skew and feature distribution shifts prevalent in realworld IoT deployments. In this paper, we propose F-ACVAE, a federated adaptive conditional variational autoencoder for privacy-preserving intrusion detection in highly heterogeneous IoT networks. F-ACVAE addresses the limitations of traditional federated learning on complex VAE models through selective knowledge sharing: local encoders remain strictly private on each device, while only essential shared components—the decoder and adaptive conditional modules—are aggregated. This selective aggregation substantially reduces communication overhead while preserving data privacy. To handle extreme non-IID data, including label skew and feature shifts, we introduce constrained momentum Gaussian aggregation (CMGA). CMGA employs momentum-based smoothing to stabilize global updates and enforce class-wise separation in the latent space, preventing overlap between normal and attack distributions and reducing false positives. By preserving a fixed global model structure and aggregating only informative weights, FACVAE minimizes communication cost without compromising detection performance. The primary contributions of this work are summarized as follows: • We propose F-ACVAE, a novel federated adaptive conditional variational autoencoder that enables privacypreserving intrusion detection in highly heterogeneous IoT environments. • We introduce CMGA, a constrained momentum-based aggregation strategy that stabilizes global updates and preserves class-wise latent space separability under extreme non-IID data distributions. • We develop a selective federation protocol that explicitly decouples private and shared knowledge: local encoders remain strictly private on edge devices, while only globally meaningful components (the decoder and adaptive conditional modules) are aggregated, resulting in strong privacy guarantees and approximately 62% reduction in
2
communication overhead. We demonstrate through extensive experiments on the NBaIoT dataset that F-ACVAE consistently achieves an average accuracy and macro F1-score of 99%, significantly outperforming state-of-the-art baselines. The remainder of this paper is organized as follows: Section II reviews the related literature on IoT security and federated learning. Section III provides the necessary technical background on the variational autoencoder and the Flower federated learning framework. Section IV details the proposed F-ACVAE framework and the CMGA strategy. Section V presents the experimental setup, while Section VI provides a comprehensive analysis of the results. Section VII discusses potential future research directions, and finally, Section VIII concludes the paper. •
II. R ELATED W ORK This section reviews the relevant literature by first analyzing centralized intrusion detection systems (IDS). These systems are categorized into traditional machine learning and autoencoder-based approaches. Furthermore, this section discusses the evolution and challenges of federated learning (FL), providing the necessary context for understanding privacypreserving IDS in heterogeneous Internet of things (IoT) settings. A. Traditional Machine Learning Approaches IoT intrusion detection systems (IDS) initially relied on signature-based methods [12], [13], which effectively identified known attack patterns; however, they failed against zeroday and polymorphic threats [14], as prevalent in modern IoT botnets such as Mirai and Bashlite [1], [15]. While anomaly-based methods were introduced to improve adaptability [16], they often produced high false-positive rates in dynamic environments. To address these limitations, machine learning (ML) and deep learning (DL) models have dominated recent literature [17]–[19], particularly for designing adaptive and intelligent intrusion detection systems [20] that can generalize to evolving threats in IoT environments [21]. Early IDS utilized classical ML algorithms, including random forest (RF) and support vector machines (SVM) [22], [23], as well as gradient boosting (XGBoost) methods [12], [24], which often relied on extensive manual feature engineering to achieve high accuracy on benchmark datasets such as CIC-IoT [25] and UNSW-NB15 [26]. Recent research has shifted significantly toward DL models [20], [27], [28] to overcome the limitations of manual feature engineering [1]. For instance, convolutional neural networks (CNNs) have been widely adopted to automatically extract spatial features from network traffic representations and packet headers [29]. More recently, graph-convolutional approaches have been proposed to capture complex topological relationships in vehicular IoT traffic [30], while other architectures utilize recurrent neural networks (RNNs) [31] and deep autoencoder-based models [28] for robust detection. Similarly, long short-term memory (LSTM) networks and their variants focus on capturing temporal dependencies in sequence-based data [29], [32],
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
[33]. Furthermore, hybrid deep architectures combine CNNs with BiLSTM or integrate attention mechanisms to exploit multi-dimensional correlations [19], [29], [34], with advanced frameworks reporting AUC scores above 99% on benchmark datasets. Despite their strong performance, these approaches share fundamental limitations, including the requirement for large volumes of labeled training data and a strong dependence on centralized data aggregation [12], [28]. This centralization introduces two critical issues: first, it leads to severe privacy violations, often conflicting with data protection regulations such as the general data protection regulation (GDPR) and the California consumer privacy act (CCPA); and second, it creates high communication overhead, making such models unsuitable for privacy-sensitive and resource-constrained IoT environments [35], [36]. These limitations have motivated a growing body of research on federated and other decentralized collaborative learning paradigms, which aim to reduce communication burden and keep data local while preserving model performance on distributed devices such as those in IoT systems [10], [35]. B. Generative Learning and Autoencoder-Based Approaches Unsupervised and semi-supervised autoencoders (AEs) have emerged as highly effective paradigms for IoT anomaly detection by learning compact latent representations of benign traffic and reconstructing normal patterns within a lowdimensional manifold [1], [37]. These models identify potential cyber-attacks by monitoring high reconstruction errors, which indicate deviations from the learned normal manifold of network behavior [1], [38], [39]. While initial research focused on deterministic architectures such as denoising and sparse AEs to handle noisy IoT data [40], the field has gradually and significantly shifted toward variational autoencoders (VAEs) [41]. VAEs introduce a probabilistic framework that regularizes the latent space toward a simple Gaussian prior, enabling more continuous and robust data representations [41]; however, multiple studies have shown that such regularization alone often fails to enforce clear discriminative separation between normal and anomalous traffic clusters [42], [43]. To address this, twin variational autoencoders (TVAEs) were introduced to capture distinct latent distributions for benign and malicious traffic separately, leading to the development of the constrained twin variational autoencoder (CTVAE) which currently holds the state-of-the-art position for the N-BaIoT dataset [5]. CTVAE achieves superior detection performance by leveraging class-conditioned Gaussian priors to model benign and malicious traffic separately, and by using the hermaphrodite component together with an additional constraint term to increase the separation between latent clusters, thus preserving discriminative structure under class imbalance [5]. Despite these algorithmic advances, existing CTVAE implementations rely exclusively on centralized training, which necessitates aggregating raw IoT traffic on a single server. This centralization exposes sensitive network metadata to significant privacy risks and may conflict with modern data protection regulations such as GDPR and CCPA, thereby motivating privacy preserving decentralized learning solutions [16], [35], [36].
3
C. Federated Learning and Decentralized Approaches The urgent need for data privacy and reduced network overhead has accelerated the adoption of federated learning (FL) [35], [44], which has quickly become the leading framework for privacy-preserving collaborative training. FL allows many edge devices to collaboratively train a highquality global model by sharing only model weight updates instead of raw data [35], with comprehensive surveys further detailing the underlying strategies, challenges, and future research directions of the field [44]. Recent studies investigate architectural patterns and design considerations critical for building robust FL systems [44]. Foundational works such as DIoT [45] and federated malware detection systems [46] have demonstrated that FedAvg and its variants can achieve accuracy comparable to centralized training on IoT malware and intrusion detection datasets. Subsequent research has expanded the scope of FL-based IDS by proposing communication- and resource-efficient frameworks such as FD-IDS, which integrate federated learning with knowledge distillation [47]. Personalized FL variants, including APFed and DFF-FL, have been introduced to better handle data heterogeneity, while knowledge-distillation-enhanced training in FD-IDS further improves model performance [11], [47], [48]. Further studies conducted large-scale emulations using CNNBiLSTM backbones to evaluate FL-based IDS performance [49]–[51]. Other works focused on enhancing intrusion detection in IoT networks through federated learning, including specialized applications such as the FELIDS framework for agricultural IoT [52]. In particular, some studies employed generative models, such as the federated variational autoencoder (FedVAE), to enhance data privacy [53]. Other works focused on improving security and robustness by integrating differential privacy [54], homomorphic encryption in some FL IDS designs [55], [56], or blockchain-secured updates, exemplified by BFLIDS [49]. Additionally, hybrid FL systems have been developed to enhance zero-day intrusion detection in decentralized IoT environments by combining GANs for class-balancing augmentation and implementing proactive detection pipelines [57]. Real-device experiments on Raspberry Pi clusters have validated the scalability and convergence of federated learning under non-IID conditions [47]. However, although FL preserves raw data privacy, its performance often declines significantly when faced with the data heterogeneity common in real-world IoT environments [10]. Specifically, the non-IID nature of network traffic, with extreme label skew, has been shown to compromise the convergence of the aggregated global model [35], while feature distribution shifts further degrade its generalization in federated learning [58]. To address this challenge, specialized federated learning strategies are required that can better cope with heterogeneous client distributions while preserving model integrity and discriminative structure in decentralized settings [59]. III. BACKGROUND This section describes the two fundamental components necessary for implementing the proposed framework: the variational autoencoder (VAE) and the Flower federated learning framework.
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
A. Variational Autoencoder (VAE) Framework The VAE [41] is a fundamental probabilistic generative model that maps high-dimensional input data x ∈ Rdx into a compact latent representation z ∈ Rdz . Unlike standard autoencoders, the VAE introduces a probabilistic formulation by assuming a prior distribution over the latent variables, typically modeled as an isotropic Gaussian p(z) = N (0, I). As shown in Figure 1, a VAE consists of two main components: 1) Inference Network (Encoder): The encoder, parameterized by ϕ, approximates the true posterior p(z|x), which is not directly computable, with a variational distribution qϕ (z|x). It outputs the mean vector µ(x) and the logvariance vector log σ 2 (x) of a Gaussian distribution: qϕ (z|x) = N z | µ(x), diag(σ 2 (x)) . (1) To enable gradient-based optimization, the reparameterization trick is applied:
4
larger values of β impose stronger regularization on the latent space. In intrusion detection, increasing β enhances the regularization of the latent space, leading to more compact representations of normal traffic. Anomaly detection is subsequently performed by computing the reconstruction error of a test sample x, defined as: s(x) = ∥x − x̂∥22 ,
x, x̂ ∈ Rdx .
(6)
A test sample x is classified as an intrusion if its reconstruction error exceeds the threshold τ : s(x) > τ .
(7)
The training procedure of the VAE, based on stochastic gradient descent, is detailed in Algorithm 1. Algorithm 1 Stochastic Gradient Descent Training of VAE 1: Input: Training dataset X , learning rate η, mini-batch size
M , KL weight β z = µ(x) + σ(x) ⊙ ϵ,
ϵ ∼ N (0, I).
(2)
2) Generative Network (Decoder): The decoder, parameterized by θ, defines the conditional likelihood pθ (x|z) and reconstructs the input from the latent variable. The reconstructed output is sampled (or taken as the mean) from this distribution: x̂ ∼ pθ (x|z) or x̂ = Epθ (x|z) [x],
x̂ ∈ Rdx .
2: Output: Optimized encoder parameters ϕ and decoder
parameters θ 3: Initialize: ϕ and θ randomly 4: while not converged do 5: Sample a mini-batch {x(i) }M i=1 from X 6:
(µ(i) , log σ 2(i) ) ← qϕ (z | x(i) )
(3) 7: 8: 9: 10:
Mean
Compute mean and log-variance using encoder:
Sample noise: ϵ(i) ∼ N (0, I) for each i = 1, . . . , M Reparameterization: z (i) ← µ(i) + σ (i) ⊙ ϵ(i) Reconstruct using decoder: x̂(i) ← Epθ (x|z(i) ) [x] Compute reconstruction loss for the mini-batch: M
Variance
Input
Encoder
LRecon (ϕ, θ) = −
Sampled Lantent-Vector
Latent Distribution
Decoder
Reconstructed
Output
11:
Fig. 1: Standard architecture of VAE consisting of an encoder, a latent space with Gaussian prior, and a decoder. The VAE is trained by minimizing the negative Evidence Lower Bound (ELBO), which is formulated as the sum of a reconstruction term and a regularization term:
where
1 X (i) E | z (i) )] (i) [log pθ (x M i=1 qϕ (z|x )
Compute KL divergence loss for the mini-batch: M
LKL (ϕ) =
1 X DKL (qϕ (z | x(i) )∥p(z)) M i=1
LVAE = LRecon + LKL
(4)
12: Compute total loss: L(ϕ, θ) = LRecon (θ) + βLKL (ϕ) 13: Update encoder: ϕ ← ϕ − η∇ϕ L 14: Update decoder: θ ← θ − η∇θ L 15: end while
LRecon = −Eqϕ (z|x) [log pθ (x|z)] , LKL = β DKL qϕ (z|x) ∥ p(z) .
(5)
B. Flower Federated Learning Framework
The reconstruction loss encourages accurate data reconstruction, while the Kullback–Leibler (KL) divergence regularizes the latent space by enforcing similarity between the approximate posterior distribution qϕ (z|x) with the prior distribution p(z). The hyperparameter β regulates the trade-off between the KL divergence term and the reconstruction loss. When β = 1, the model reduces to the standard VAE formulation, whereas
The Flower (flwr) framework [60] serves as the primary engine for coordinating the F-ACVAE system, handling communication between the central server (S) and diverse IoT clients (C), as shown in Figure 2. Flower’s modularity facilitates the implementation of custom aggregation strategies, a capability critical for embedding our novel constrained momentum Gaussian aggregation (CMGA) strategy. The framework coordinates the federated process through discrete communication rounds (t) managed in three core steps.
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
1) Distribution Phase: The server selects a subset of clients t (St ) and transmits the global model parameters (θG ) and configuration settings (configt ): t Call(St ) = Fit(θG , configt ).
(8)
2) Local Training Phase: Each client k ∈ St trains the model on its private dataset Dk by minimizing the adaptive conditional VAE loss function LACVAE to obtain updated local parameters: θkt+1 ← arg min LACVAE (θk ; Dk ). θk
(10)
The base federated round in Flower is shown in Algorithm 2, while the CMGA-enhanced process is detailed in Algorithm 4. Algorithm 2 Flower-Based Federated Learning Server 0 , number of federated 1: Input: Initial global parameters θG
rounds T , aggregation strategy S, client datasets {Dk }K k=1 where K is the total number of clients T 2: Output: Final global model θG 0 3: Initialize: θG ← θG 4: for t = 1 to T do 5: Client Selection: S selects a subset of clients St t−1 6: Configuration: S sends current global model θG and configuration to each client k ∈ St 7: for each client k ∈ St in parallel do 8: Client Execution (k): t−1 9: (a) Compute ∆θk ← LocalTrain(θG , Dk ) 10: (b) Send (∆θk , nk ) back to server S 11: end for 12: Global Aggregation:
13:
t Evaluation: S evaluates the global model θG
14: end for T 15: Return θG
Client 1 Global Data Federated Training Round
Local Data Local Training Round Local Neural Network
Global Neural Network
Fig. 2: Flower federated learning architecture [60].
This flow enables F-ACVAE to replace standard FedAvg with our proposed CMGA aggregation logic, which is essential for preserving the conditioned latent structure under severe non-IID conditions and heterogeneous edge environments.
t θG ← S.aggregate fit({(∆θk , nk )}k∈St )
Client N
Server
(9)
Each client then returns the update difference ∆θk = t θkt+1 − θG and its local sample count nk to the server. Here, K denotes the total number of clients in the federated learning system, and each Dk represents the local dataset held by client k. 3) Custom Aggregation: The server invokes the CMGA strategy via the aggregate_fit function to compute the new global parameters: t+1 t θG = AggregateCMGA ({(∆θk , nk )}k∈St , θG ).
5
IV. P ROPOSED M ETHODOLOGY This section presents the federated adaptive conditional variational autoencoder (F-ACVAE), a framework designed for robust and privacy-preserving intrusion detection in decentralized IoT environments, as illustrated in Figure 2. Unlike centralized learning approaches, which often exhibit instability under severe non-IID data distributions, F-ACVAE enables collaborative intrusion detection across heterogeneous IoT devices through the following five fundamental components: 1) Adaptive conditional VAE: Learns discriminative latent representations by incorporating class-conditioned information into the variational autoencoder framework. 2) Constrained momentum Gaussian aggregation (CMGA): Stabilizes global model updates through selective parameter aggregation and momentum-based smoothing. 3) Local training strategy: Ensures client-side autonomy and confidentiality by keeping raw data strictly local during optimization. 4) Momentum-stabilized aggregation (MSA): Reduces model drift under non-IID settings by leveraging historical update information. 5) Hybrid latent feature classification: Integrates generative latent representations with ensemble-based discriminative classification. A. Adaptive Conditional VAE Architecture (ACVAE) Let xi ∈ Rdx denote an input feature vector and yi ∈ {1, . . . , C} its associated class label. The encoder network qϕ maps the input sample to a stochastic latent representation parameterized by a Gaussian posterior distribution: qϕ (z | x) = N z | µϕ (x), diag(σϕ2 (x)) (11) where µϕ (x) and σϕ (x) denote the encoder outputs. A latent variable is sampled using the reparameterization trick: z = µϕ (x) + σϕ (x) ⊙ ϵ,
ϵ ∼ N (0, I)
(12)
which enables end-to-end backpropagation through stochastic layers. To incorporate class-dependent information while maintaining computational efficiency, the proposed ACVAE introduces a learnable class embedding layer Cθ (·) that maps each label y to a low-dimensional embedding vector Cy ∈ RL . The
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
final conditioned latent representation is obtained via additive embedding injection: zcond = z + λc Cy
(13)
where λc > 0 is a class-conditioning scaling coefficient that controls the influence of label-specific information on the latent representation. Unlike a standard CVAE that conditions the inference network on y, ACVAE injects label information directly into the sampled latent code through additive embedding, yielding an equivalent conditional generative mapping pθ (x|z + λc Cy ). The embedding dimension L is chosen to match the latent dimensionality, ensuring compatibility for additive conditioning. This operation adaptively shifts latent representations associated with different classes, thereby enhancing separability between benign and malicious traffic patterns without introducing additional probabilistic constraints or complex architectural components. The conditioned latent vector zcond is subsequently passed to the decoder network pθ to reconstruct the input: x̂ = pθ (zcond ). (14) The complete adaptive conditional latent generation procedure is detailed in Algorithm 3. Algorithm 3 Adaptive Conditional Latent Generation 1: Input: Feature vector x, class label y 2: Output: Conditioned latent representation zcond 3: Initialize: Encoder qϕ , class embedding network
Cθ ,
scaling coefficient λc 4: Compute encoder parameters: (µ, σ) ← qϕ (x) 5: Sample noise: ϵ ∼ N (0, I) 6: Compute latent vector: z ← µ + ϵ ⊙ σ 7: Compute class embedding: Cy ← Cθ (y) 8: Condition latent vector: zcond ← z + λc × Cy 9: Return zcond
6
our implementation, α is set to 0.1, ensuring that the global model retains 90% of its previous structural knowledge while incrementally incorporating local updates. This smoothing mechanism significantly stabilizes convergence across heterogeneous IoT devices. Algorithm 4 Constrained Momentum Gaussian Aggregation 1: Input: Number of clients K, number of rounds T , local
epochs E, momentum coefficient α, learning rate η 2: Output: Global shared parameters θG (Mapper, Decoder,
Class-Specific Gaussian Priors) 0 3: Initialize: θG ← random initialization 4: for each round t = 1 to T do
5: 6:
for each client k ∈ K in parallel do t−1 Local Update: ∆θk ← Algorithm 5(Dk , θG , E, η)
Extract Shared Parameters: θkt ⊂ ∆θk Send to Server: θkt end for PK t 1 10: Global Aggregation: θ̄t ← K k=1 θk t−1 t + αθ̄t 11: Momentum Update: θG ← (1 − α)θG 12: end for T 13: Return θG 7: 8: 9:
This selective and momentum-enhanced aggregation significantly reduces communication overhead by approximately 62%, as the local encoders remain strictly on the client side, never being transmitted to the server. C. Local Training and Objective Function Each client k optimizes its local parameters θk by minimizing a multi-objective loss function. The total local loss, Llocal , combines reconstruction accuracy and latent space regularization: N
d
k X 1 X (xi,j − x̂i,j )2 + β DKL (qϕ (z|x)∥p(z)) Nk i=1 j=1 (16) where Nk is the number of local samples for client k, and d is the feature dimensionality. To ensure numerical precision, the Kullback-Leibler (KL) divergence term is analytically expanded as:
Llocal =
B. Constrained Momentum Gaussian Aggregation (CMGA) The core of the F-ACVAE framework is the CMGA strategy, which coordinates the synchronization of model parameters while preserving local discriminative structures. Unlike standard federated averaging (FedAvg), CMGA introduces a momentum term to stabilize the updates of the shared latent space and class-specific Gaussian priors. In each communication round t, the central server receives the locally updated mappers, decoders, and Gaussian priors from the participating clients. To mitigate the effects of extreme non-IID data and prevent latent space collapse, the t global parameters θG are updated using a momentum-based moving average: ! K 1 X t t−1 t θk (15) θG = (1 − α)θG + α K
M
DKL = −
1 X 2 2 1 + log(σm ) − µ2m − σm 2 m=1
(17)
where M denotes the dimensionality of the latent space. During optimization, each client applies stochastic gradient descent with the AdamW optimizer and enforces a strict gradient clipping threshold ζ = 0.5 to maintain numerical stability against noisy or outlier data packets. The complete procedure for local training, including the computation of Llocal and gradient updates, is summarized in Algorithm 5.
k=1
where α ∈ [0, 1] is the aggregation momentum coefficient, and θkt represents the subset of parameters (specifically the mapper, decoder, and class priors) uploaded by client k. In
D. Momentum-Stabilized Aggregation (MSA) To mitigate model drift caused by non-IID data, the server implements MSA. Upon receiving local updates ∆θkt , the
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
Algorithm 5 Local Client Optimization Procedure 1: Input: Local dataset Dk , Global weights θG , Epochs E 2: Output: Weight update ∆θk 3: Initialize: θk ← θG 4: for each epoch e = 1 to E do 5: for batch (x, y) ∈ Dk do 6: Compute conditioned latent vector:
This section describes the experimental setup of F-ACVAE on the N-BaIoT dataset, using nine device-specific non-IID subsets to simulate realistic botnet traffic conditions. We first outline the performance metrics, hyperparameter configurations, dataset characteristics, and implementation details.
Reconstruct input: x̂ ← pθ (zcond ) Compute local loss: Llocal ← MSE(x, x̂) + βDKL (µ, σ)
9:
A. Performance Metrics
Compute gradients: ∇θk ← clip(Gradients(Llocal ), −ζ, ζ)
Update weights: θk ← AdamW(θk , ∇θk ) end for 12: end for 13: Return ∆θk = θk − θG 10: 11:
server first filters potential outliers using an element-wise clamping function: 1 X t ∆θ̄agg = clamp(∆θkt , −τ , τ ) (18) |St | k∈St
where clamp(·) limits each parameter to the range [−τ , τ ]. The hyperparameters τ (clamping threshold) and γ (momentum coefficient) are set as shown in Table I. The global model is then updated using a momentum-based velocity V to smooth the convergence path: t V t = γ∆θ̄agg + (1 − γ)V t−1 ,
(19)
t+1 t θG = θG + η Vt
(20)
where η is the global learning rate. Algorithmically, MSA is implemented server-side within the Flower aggregation interface. Clamped, sample-weighted client updates are accumulated into the momentum buffer V and applied to the global model parameters at each communication round. E. Hybrid Latent Feature Classification The final detection phase employs a hybrid strategy where the global F-ACVAE acts as a feature extractor. Once federated training converges, the encoder maps raw traffic into the robust, low-dimensional latent space z. These features are then fed into a random forest (RF) ensemble: ŷ = argmaxc∈{1,··· ,C}
1 B
B X
I(Tb (z) = c)
modeling with discriminative ensemble learning. At inference time, the posterior mean of the encoder is used as a deterministic latent representation, which is subsequently classified using a RF ensemble via majority voting. V. E XPERIMENTAL S ETTINGS
zcond = Algorithm 3(x, y) 7: 8:
7
(21)
b=1
where B is the number of decision trees. This approach maximizes the detection performance by combining generative
We evaluate the proposed F-ACVAE against several stateof-the-art intrusion detection models under identical non-IID settings on the N-BaIoT dataset. The baselines include STA, CSAEC, MAE, and MVAE as representative autoencoderbased approaches, along with the centralized constrained twin variational autoencoder (CTVAE) [5], which serves as a leading generative model for semi-supervised anomaly detection in IoT environments. These benchmarks provide a comprehensive framework to evaluate F-ACVAE’s ability to handle data heterogeneity, severe class imbalance, and privacy concerns in decentralized frameworks. Performance is evaluated using the following standard metrics: TP + TN , (22) TP + TN + FP + FN where TP, TN, FP, and FN denote true positives, true negatives, false positives, and false negatives, respectively. Accuracy =
TP , (23) TP + FP where precision measures the proportion of correctly identified intrusions among all instances flagged as malicious. Precision =
TP , (24) TP + FN where recall indicates the fraction of actual malicious instances that are correctly detected. Recall =
C
Macro F1-score =
1 X Precisioni × Recalli 2× , C i=1 Precisioni + Recalli
(25)
where C is the number of classes. Being macro-averaged, this metric assigns equal importance to the benign class and all individual attack types, making it the primary evaluation measure in this study due to the extreme class imbalance observed in real-world IoT botnet traffic. B. Parameter Settings To configure the federated training process, we simulate a decentralized environment with K = 9 device-specific clients participating in T = 10 communication rounds. In each round, every client performs E = 5 local training epochs using a mini-batch size of B = 128.
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
The global F-ACVAE model adopts an encoder–decoder architecture with three hidden layers of sizes [128, 64, 32]. All networks employ the LeakyReLU activation function with a negative slope of 0.2. Model optimization is carried out using the AdamW optimizer with a learning rate of η = 2 × 10−4 and a weight decay coefficient of λw = 5 × 10−6 . The input feature dimension is fixed to dx = 115, corresponding to the N-BaIoT dataset, while the latent space dimensionality is set to dz = 10. To ensure stable variational inference and prevent posterior collapse under highly imbalanced non-IID data, the KL-divergence regularization weight is set to β = 0.3. The class-conditioning scale is fixed to λc = 1.0 to balance discriminative guidance and generative flexibility. For the proposed CMGA strategy, the aggregation momentum is set to α = 0.1, and the momentum coefficient is fixed at γ = 0.1 to smooth global updates across heterogeneous clients. Additionally, parameter updates are constrained using a clamping threshold of τ = 0.2 to mitigate abrupt shifts caused by severe label skew. All hyperparameter configurations are summarized in Table I.
8
TABLE II: Summary of the N-BaIoT dataset Property
Value
Number of IoT devices Total instances Number of features Benign instances Malicious instances Attack Families Distinct Attack Vectors Train / Test split
9 7,062,606 115 555,932 6,506,674 2 (Mirai, Gafgyt) 10 70% / 30% (Stratified)
TABLE III: Attack types in the N-BaIoT dataset Botnet Family
Attack Type
Description
Bashlite (Gafgyt)
Scan Junk TCP UDP UDPplain
Horizontal scanning for vulnerable devices Sending spam-like packets TCP flood to exhaust resources UDP flood to overwhelm the target Plain UDP flood without payload tricks
Mirai
Ack Scan Syn UDP UDPplain
ACK flood to consume bandwidth/resources Aggressive port scanning SYN flood (TCP handshake attack) Massive UDP flood saturating network Simple UDP flood with generic payloads
TABLE I: Hyperparameter configurations for F-ACVAE Parameter Total number of clients Federated rounds Local epochs Batch size Learning rate Optimizer Weight decay Input dimension Latent dimension KL-divergence weight Class-conditioning scale Aggregation momentum Momentum coefficient Clamping threshold Hidden layers Activation function
Symbol
Value
K T E B η – λw dx dz β λc α γ τ – –
9 10 5 128 2 × 10−4 AdamW 5 × 10−6 115 10 0.3 1.0 0.1 0.1 0.2 [128, 64, 32] LeakyReLU (0.2)
For fair comparison with the centralized CTVAE baseline [5], we employ a standard 70%/30% train-test split using stratified sampling to preserve class proportions within each subset. D. Implementation and Reproducibility F-ACVAE is implemented in PyTorch 2.1 and the Flower 1.8 federated learning library. To ensure reproducibility, the complete source code, detailed instructions, and pre-trained configurations are publicly available at: https://github.com/ mohamad-ansarimehr/F-ACVAE. Additionally, the repository is archived for long-term accessibility with DOI: https://doi. org/10.5281/zenodo.17919997. VI. R ESULTS AND A NALYSIS
C. Datasets F-ACVAE is evaluated on the N-BaIoT dataset [1]1 , which captures network traffic from nine commercial IoT devices infected by the Mirai and Bashlite (Gafgyt) botnets. Table II summarizes key dataset characteristics, including total instances, feature dimensionality, class distribution, and attack types. Table III details the attack vectors, which categorizes them by botnet family and provides a brief description of each attack mechanism. To simulate realistic non-IID conditions, we utilize nine device-specific subsets, as summarized in Table IV. These subsets exhibit data heterogeneity, including label skew and feature distribution shifts due to device-specific traffic patterns, effectively representing the challenges of decentralized IoT networks for both binary and multiclass classification tasks. 1 The N-BaIoT dataset is publicly available at https://archive.ics.uci.edu/ dataset/442/detection of iot botnet attacks n baiot.
This section presents the experimental results, highlighting the strong performance of F-ACVAE compared with stateof-the-art baselines. The proposed framework achieves an accuracy and macro F1-score of 99% while reducing communication overhead by approximately 62%. To understand why the proposed F-ACVAE is better, we analyze four key aspects: the advantages of decentralized design by using federated learning, the resulting performance improvements, enhanced privacy preservation, and communication efficiency powered by the custom Flower strategy (CMGA). A. Decentralization Advantages F-ACVAE benefits from the federated paradigm combined with CMGA in three ways: 1) Implicit regularization: Centralized training on the full dataset often overfits to noise and outliers. By averaging updates from heterogeneous client data (Algorithm 5),
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
9
TABLE IV: Device-specific subsets of the N-BaIoT dataset ID
Code
Device Model
Category
Protocols
Attack Families
Attack Ratio
Classes
Instances
IoT-01 IoT-02 IoT-03 IoT-04 IoT-05 IoT-06 IoT-07 IoT-08 IoT-09
DanG-6 PhiG-6 838G-6 EcoG-6 737G-6 EcoMG-11 838MG-11 737GUC-2 838GUC-2
Danmini Philips B120N/10 Provision PT-838TS Ecobee Provision PT-737E Ecobee Provision PT-838TS Provision PT-737E Provision PT-838TS
Doorbell Baby Monitor IP Camera Thermostat IP Camera Thermostat IP Camera IP Camera IP Camera
TCP/UDP TCP/UDP TCP/UDP TCP/UDP TCP/UDP TCP/UDP TCP/UDP UDP UDP
Gafgyt Gafgyt Gafgyt Gafgyt Gafgyt Mirai & Gafgyt Mirai & Gafgyt Gafgyt Gafgyt
88.5% 91.2% 85.0% 82.3% 86.1% 94.7% 93.2% 78.9% 79.5%
6 6 6 6 6 11 11 2 2
1,018,298 1,091,330 835,656 724,321 828,244 1,234,550 1,156,000 450,120 482,000
the federated approach produces more robust and generalizable latent representations. 2) Mitigation of latent space collapse: Centralized VAEs can suffer latent space collapse under highly imbalanced data. Momentum-stabilized aggregation (MSA; see Section IV-D) stabilizes the shared components, maintaining a well-structured latent space across clients. 3) Enhanced robustness to heterogeneity: The momentum mechanism in CMGA reduces sudden changes in global updates caused by severe label imbalance or feature distribution shifts, ensuring the shared decoder learns a stable reconstruction mapping. As shown in Figure 3, we analyze the convergence behavior of F-ACVAE on the IoT-01 subset of the highly non-IID NBaIoT dataset, which serves as a representative case for evaluating the framework’s performance. The model is trained over T = 10 federated communication rounds to examine stability and convergence under the selective aggregation mechanism implemented via CMGA (see Algorithm 4). Results show that F-ACVAE rapidly converges within a few communication rounds, achieving both accuracy and macro F1-score of 99% without oscillations or instability. These observations confirm that the proposed aggregation strategy effectively stabilizes global model updates across heterogeneous clients, even under extreme non-IID data distributions. 100 Accuracy Macro F1-score
Performance (%)
90
B. Performance Benefits Tables V and VI present the performance of F-ACVAE compared to state-of-the-art baselines across all nine devicespecific subsets of the N-BaIoT dataset. F-ACVAE achieves the highest accuracy and macro F1-score of 99% across all evaluated scenarios. Notably, F-ACVAE outperforms the centralized CTVAE [5] in most subsets, highlighting the advantages of the proposed federated training framework even when compared with advanced generative models. This performance gain is attributed to the selective parameter aggregation mechanism and the CMGA strategy, which effectively mitigate extreme non-IID challenges while preserving privacy. Overall, by maintaining a well-conditioned latent structure without raw data exchange, F-ACVAE emerges as a robust, efficient, and privacy-preserving solution for intrusion detection in highly heterogeneous IoT environments. TABLE V: Accuracy (%) comparison Dataset
STA
CSAEC
MAE
MVAE
CTVAE
F-ACVAE
IoT-01 IoT-02 IoT-03 IoT-04 IoT-05 IoT-06 IoT-07 IoT-08 IoT-09
67.2 75.2 70.9 61.3 65.6 85.0 85.8 97.6 95.3
92.0 94.2 92.8 90.6 92.1 92.3 96.5 90.0 80.2
92.1 94.1 93.4 90.9 92.2 78.1 94.2 95.5 94.8
67.2 74.2 70.5 60.0 65.7 62.8 76.8 88.5 90.1
93.0 95.0 93.9 91.8 93.1 94.5 96.6 100.0 98.9
99.7 99.1 98.1 99.3 97.9 98.9 99.6 98.7 99.5
Average
78.2
91.2
91.7
72.9
95.2
99.0
TABLE VI: Macro F1-score (%) comparison 80 70 60 50
1
2
3
4 5 6 7 8 Federated Rounds (T )
9
10
Fig. 3: Convergence of F-ACVAE on highly non-IID N-BaIoT data (IoT-01 subset, representative example). Both accuracy and macro F1-score exceed 99% within 10 federated rounds (T = 10).
Dataset
STA
CSAEC
MAE
MVAE
CTVAE
F-ACVAE
IoT-01 IoT-02 IoT-03 IoT-04 IoT-05 IoT-06 IoT-07 IoT-08 IoT-09
55.7 66.4 60.4 47.7 53.6 79.7 80.7 97.9 99.7
88.9 91.8 89.9 87.0 89.0 91.8 95.1 92.8 85.7
89.2 91.9 91.3 87.6 89.3 76.9 94.2 96.4 95.7
64.9 71.5 67.9 57.0 62.8 61.7 75.5 91.9 92.2
90.9 93.5 92.2 89.5 91.1 93.3 95.5 100.0 99.0
99.7 99.4 98.5 98.8 98.0 98.6 99.6 98.9 99.8
Average
70.9
90.2
90.3
71.7
93.9
99.0
C. Preserving Privacy F-ACVAE preserves privacy by keeping encoders local on each client and aggregating only the shared mapper and
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
decoder (Algorithm 3). As a result, raw data never leaves the device and latent representations remain local, providing strong protection against inversion and membership inference attacks.
D. Communication Efficiency F-ACVAE leverages CMGA (Algorithm 4) to transmit only a subset of model weights, while keeping the model structure (mapper, decoder, class-specific Gaussian priors) fixed, significantly reducing communication overhead. Let rsent denote the fraction of model weights sent in each round:
rsent =
Wsent ≈ 0.38 Wtotal
⇒
rreduced = 1 − rsent ≈ 0.62 (26)
In practice, only about 38% of the weights are transmitted per round, which reduces communication traffic by approximately 62%. Stable updates are maintained through the momentum-stabilized aggregation mechanism (MSA; see Section IV-D), making the framework suitable for resourceconstrained IoT gateways. VII. F UTURE W ORK The success of F-ACVAE demonstrates its ability to preserve discriminative latent structures under federated learning. This opens several directions for future research, including algorithmic optimization, enhanced security, and validation in real-world IoT deployments.
A. Algorithm and Architecture Enhancements Future work will focus on improving the CMGA strategy, including adaptive client selection based on data quality or gradient similarity to mitigate label skew. We also plan to explore privacy-preserving knowledge transfer from local encoders to the global model, for example through federated distillation, to enhance feature extraction without compromising privacy. Extending F-ACVAE to fully unsupervised settings will remove the need for attack labels, moving toward practical zero-shot anomaly detection. Finally, current assumptions such as a fixed number of clients may be relaxed to handle highly dynamic IoT networks, where adaptive tuning of proximal constraints is required to maintain convergence stability under client churn.
B. Security and Resilience Although F-ACVAE secures data privacy through federated learning, further work is needed to strengthen protection against federated threats. This includes robust defenses against model poisoning (Byzantine resilience) and inference attacks such as membership inference targeting the global model. Incorporating cryptographic techniques, such as secure multiparty computation (SMPC) and differential privacy, will be essential to ensure the integrity of the CMGA process.
10
C. Scalability and Real-World Deployment Future evaluations should examine F-ACVAE in complex real-world scenarios, assessing scalability, latency, and energy efficiency on resource-constrained devices such as Raspberry Pi. Extending its application to broader IoT domains—including industrial IoT, smart health, and critical infrastructure—is critical. Additionally, evaluation with complex multimodal datasets will be essential to confirm the generalized effectiveness of the constrained latent space approach. VIII. C ONCLUSION In this paper, we introduced F-ACVAE, a robust federated learning framework designed to address the challenges of privacy preservation and data heterogeneity in IoT intrusion detection. By integrating adaptive conditional variational autoencoding with the proposed CMGA strategy, the framework effectively separates local feature extraction from global generative modeling. This architectural design, combined with momentum-based updates, effectively mitigates weight drift and prevents latent space collapse in non-IID scenarios. Our experimental evaluation on the N-BaIoT dataset demonstrates that F-ACVAE achieves accuracy and macro F1-score of 99%. Furthermore, the selective aggregation mechanism reduces communication overhead by approximately 62%, making it highly suitable for resource-constrained IoT devices. These results demonstrate that F-ACVAE achieves both high detection performance and strong privacy preservation, making it a robust solution for decentralized IoT security ecosystems. Future work will focus on advancing the CMGA strategy through adaptive client selection and privacy-preserving knowledge transfer. It will also enhance defenses against federated threats by employing techniques such as SMPC and differential privacy. Finally, we will evaluate the performance of F-ACVAE across diverse IoT domains and resourceconstrained hardware platforms. R EFERENCES [1] Y. Meidan, M. Bohadana, A. Shabtai, J. D. Guarnizo, M. Ochoa, N. O. Tippenhauer, et al., “N-BaIoT—Network-based detection of IoT botnet attacks using deep autoencoders,” IEEE Pervasive Computing, vol. 17, no. 3, pp. 12–22, 2018. [2] C. Kolias, G. Kambourakis, A. Stavrou, and J. Voas, “DDoS in the IoT: Mirai and other botnets,” IEEE Computer, vol. 50, no. 7, pp. 80–84, 2017. [3] M. Antonakakis, T. April, M. Bailey, M. Bernhard, E. Bursztein, J. Cochran, et al., “Understanding the Mirai botnet,” in Proceedings of the 26th USENIX Security Symposium, 2017, pp. 1093–1110. [4] V. Mothukuri, R. M. Parizi, S. Pouriyeh, A. Dehghantanha, and K.-K. R. Choo, “A survey on security and privacy of federated learning,” Future Generation Computer Systems, vol. 115, pp. 619–640, 2021. [5] P. V. Dinh, S. S. Kanhere, S. J. D. Prince, H. T. Nguyen, T. T. Nguyen, A. S. Rao, et al., “Constrained twin variational auto-encoder for intrusion detection in IoT systems,” IEEE Internet of Things Journal, vol. 11, no. 8, pp. 14789–14804, 2024. [6] A. Deshmukh, P. E. de la Rosa, R. V. Rodriguez, and S. Dasari, “Enhancing privacy in IoT-enabled digital infrastructure: Evaluating federated learning for intrusion and fraud detection,” Sensors, vol. 25, no. 10, Art. 3043, 2025. [7] N. U. Ain, M. A. Khan, A. Al-Dubai, S. Almotairi, A. Alshammari, K. Alshammari, et al., “Securing IoT networks against DDoS attacks: A hybrid deep learning approach,” Sensors, vol. 25, no. 5, Art. 1346, 2025.
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
[8] V. Padmavathi and R. Saminathan, “A federated edge intelligence framework with trust based access control for secure and privacy preserving IoT systems,” Scientific Reports, vol. 15, Art. 35832, 2025. [9] J. L. Hernández Ramos, R. M. Parizi, A. Dehghantanha, S. Pouriyeh, V. Mothukuri, K.-K. R. Choo, et al., “Intrusion Detection Based on Federated Learning: A Systematic Review,” ACM Computing Surveys, vol. 57, no. 12, pp. 1–65, 2025. [10] A. K. Sahu, S. K. Lai, T. Q. Nguyen, J. D. Smith, S. R. Li, et al., “Federated optimization in heterogeneous networks,” in Advances in Neural Information Processing Systems (NeurIPS), pp. 570–580, 2018. [11] J. Li, Y. Ma, J. Bai, C. Chen, T. Xu, and C. Ding, “A lightweight intrusion detection system with dynamic feature fusion federated learning for vehicular network security,” Sensors, vol. 25, no. 15, Art. 4622, 2025. [12] A. L. Buczak and E. Guven, “A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection,” IEEE Communications Surveys & Tutorials, vol. 18, no. 2, pp. 1153–1176, 2016. [13] S. Hajiheidari, K. Wakil, M. Badri, and N. J. Navimipour, “Intrusion detection systems in the Internet of Things: A comprehensive investigation,” Computer Networks, vol. 160, pp. 165–191, Sep. 2019. [14] R. Sommer and V. Paxson, “Outside the Closed World: On Using Machine Learning for Network Intrusion Detection,” IEEE Security & Privacy, vol. 8, no. 5, pp. 68–77, 2010. [15] R. Dhakal, W. Raza, V. Tummala, and L. N. Kandel, “Enhancing intrusion detection in IoT networks through federated learning,” IEEE Access, vol. 12, pp. 167168–167182, 2024 [16] A. Khraisat, I. Gondal, P. Vamplew, and J. Kamruzzaman, “Survey of intrusion detection systems: Techniques, datasets and challenges,” Cybersecurity, vol. 2, no. 1, pp. 1–22, Dec. 2019. [17] M. A. Al-Garadi, A. Mohamed, A. K. Al-Ali, X. Du, I. Ali, M. Guizani, et al., “A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1646--1685, 2020. [18] G. Abdelmoumin, D. B. Rawat, and A. Rahman, “On the performance of machine learning models for anomaly-based intelligent intrusion detection systems for the Internet of Things,” IEEE Internet of Things Journal, vol. 9, no. 6, pp. 4280–4290, Mar. 2022. [19] L. Yang, A. Moubayed, and A. Shami, “MTH-IDS: A multitiered hybrid intrusion detection system for Internet of Vehicles,” IEEE Internet Things Journal, vol. 9, no. 1, pp. 616–632, Jan. 2022. [20] F. Hussain, R. Hussain, S. A. Hassan, and E. Hossain, “Machine Learning in IoT Security: Current Solutions and Future Challenges,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 1686-1721, 2020. [21] Y. Xin, L. Kong, Z. Liu, Y. Chen, Y. Li, H. Zhu, et al., “Machine Learning and Deep Learning Methods for Cybersecurity,” IEEE Access, vol. 6, pp. 35365--35381, 2018. [22] M. A. M. Hasan, M. Nasser, B. Pal, and S. Ahmad, “Support vector machine and random forest modeling for intrusion detection system (IDS),” Journal of Intelligent Learning Systems and Applications, vol. 6, no. 1, pp. 45–52, Aug. 2014. [23] S. Liu, J. Wang, H. Li, Y. Zhang, P. Kumar, R. Chen, et al., “Machine Learning for Security in Vehicular Networks: A Comprehensive Survey,” IEEE Communications Surveys & Tutorials, vol. 24, no. 1, pp. 346–379, 2021. [24] B. S. Bhati, G. Chugh, F. Al-Turjman, and N. S. Bhati, “An improved ensemble based intrusion detection technique using XGBoost,” Transactions on Emerging Telecommunications Technologies, vol. 32, no. 6, p. e4076, Aug. 2021. [25] F. De Keersmaeker, Y. Cao, G. K. Ndonda, and R. Sadre, “A Survey of Public IoT Datasets for Network Security Research,” IEEE Communications Surveys & Tutorials, vol. 25, no. 3, pp. 1808--1840, 2023. [26] N. Moustafa and J. Slay, “UNSW-NB15: a comprehensive data set for network intrusion detection systems,” Military Communications and Information Systems Conference (MilCIS), pp. 1–6, 2015. [27] R. Abdulhammed, M. Faezipour, A. Abuzneid, and A. AbuMallouh, “Deep and machine learning approaches for anomaly-based intrusion detection of imbalanced network traffic,” IEEE Sensors Letters, vol. 3, no. 1, pp. 1–4, Jan. 2019. [28] N. Shone, T. N. Ngoc, V. D. Phai, and Q. Shi, “A deep learning approach to network intrusion detection,” IEEE Transactions on Emerging Topics in Computational Intelligence, vol. 2, no. 1, pp. 41–50, Feb. 2018. [29] S. I. Popoola, B. Adebisi, M. Hammoudeh, G. Gui, and H. Gacanin, “Hybrid deep learning for botnet attack detection in the Internet-ofThings networks,” IEEE Internet of Things Journal, vol. 8, no. 6, pp. 4944–4956, Mar. 2021. [30] X. Deng, J. Zhu, X. Pei, L. Zhang, Z. Ling, and K. Xue, “Flow topology-based graph convolutional network for intrusion detection in
11
label-limited IoT networks,” IEEE Transactions on Network and Service Management, vol. 20, no. 1, pp. 684–696, Mar. 2023 [31] C. Yin, Y. Zhu, J. Fei, and X. He, “A deep learning approach for intrusion detection using recurrent neural networks,” IEEE Access, vol. 5, pp. 21954–21961, 2017. [32] I. Ullah and Q. H. Mahmoud, “Design and development of a deep learning-based model for anomaly detection in IoT networks,” IEEE Access, vol. 9, pp. 103906–103926, 2021. [33] A. Sherstinsky, “Fundamentals of recurrent neural network (RNN) and long short-term memory (LSTM) network,” IEEE Access, vol. 8, pp. 188506–188520, 2020. [34] L. Vu, Q. U. Nguyen, D. N. Nguyen, D. T. Hoang, and E. Dutkiewicz, “Deep transfer learning for IoT attack detection,” IEEE Access, vol. 8, pp. 107335–107344, 2020. [35] T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, “Federated learning: Challenges, methods, and future directions,” IEEE Signal Processing Magazine, vol. 37, no. 3, pp. 50–60, 2020. [36] C. Badii, P. Bellini, A. Difino, and P. Nesi, “Smart city IoT platform respecting GDPR privacy and security aspects,” IEEE Access, vol. 8, pp. 23601–23623, 2020 [37] M. A. Ferrag, L. Maglaras, S. Moschoyiannis, and A. Janicke, “Deep learning for cyber security intrusion detection: A survey,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 2131–2176, 2020. [38] M. Sakurada and T. Yairi, “Anomaly detection using autoencoders with nonlinear dimensionality reduction,” in Proceedings of the Machine Learning for Sensory Data Analysis (MLSDA), ACM, 2014, pp. 4–11. [39] R. Chalapathy and S. Chawla, “Deep learning for anomaly detection: A survey,” ACM Computing Surveys, vol. 52, no. 1, pp. 1–38, 2019. [40] S. Langarica and F. Núñez, “Contrastive blind denoising autoencoder for real time denoising of industrial IoT sensor data,” Engineering Applications of Artificial Intelligence, vol. 120, Art. no. 105838, 2023 [41] D. P. Kingma and M. Welling, “Auto-encoding variational bayes,” in Proceedings of the International Conference on Learning Representations (ICLR), 2014. [42] J. An and S. Cho, “Variational autoencoder based anomaly detection using reconstruction probability,” Special Lecture on IE, vol. 2, no. 1, pp. 1–18, 2015. [43] Z. Ding, Y. Li, and J. Zhang, “Anomaly detection based on variational auto-encoder,” Neural Computing and Applications, vol. 33, no. 14, pp. 1–14, 2021. [44] W. Y. B. Lim, J. Smith, A. K. Singh, M. Chen, L. Wang, P. Kumar, et al., “Federated learning in mobile edge networks: A comprehensive survey,” IEEE Communications Surveys & Tutorials, vol. 22, no. 3, pp. 2031–2063, 2020. [45] T. D. Nguyen, A. M. Tran, B. P. Nguyen, C. H. Le, D. T. Hoang, P. Q. Le, et al., “DIoT: A federated self-learning anomaly detection system for IoT,” in Proceedings of the IEEE International Conference on Distributed Computing Systems (ICDCS), 2019, pp. 756–767. [46] V. Rey, P. M. S. Sánchez, A. H. Celdrán, and G. Bovet, “Federated learning for malware detection in IoT devices,” Computer Networks, vol. 204, Feb. 2022. [47] H. Peng, C. Wu, and Y. Xiao, “FD-IDS: Federated learning with knowledge distillation for intrusion detection in non-IID IoT environments,” Sensors, vol. 25, no. 14, Art. 4309, 2025. [48] S. Almansour, K. Yadav, L. M. Alkwai, N. S. Alghamdi, W. Viriyasitavat, G. Dhiman, et al., “Adaptive personalized federated learning with lightweight depthwise convolutional bottleneck network for novel intrusion detection system in internet of vehicles,” Scientific Reports, vol. 15, no. 1, Art. no. 35604, Oct. 2025. [49] K. Begum, M. A. I. Mozumder, M.-I. Joo, H.-C. Kim, S. Lee, R. Park, et al., “BFLIDS: Blockchain-driven federated learning for intrusion detection in IoMT networks,” Sensors, vol. 24, no. 14, Art. no. 4591, Jul. 2024. [50] N. Albanbay, J. Chen, M. Singh, A. Sharma, K. Patel, L. Zhao, et al., “Federated learning-based intrusion detection in IoT networks: Performance evaluation and data scaling study,” Journal of Sensor and Actuator Networks, vol. 14, no. 4, Art. no. 78, Jul. 2025. [51] R. Baidar, S. Maric, and R. Abbas, “Hybrid Deep Learning-Federated Learning Powered Intrusion Detection System for IoT/5G Advanced Edge Computing Network,” arXiv:2509.15555, Sep. 2025 [52] O. Friha, M. A. Ferrag, L. Shu, L. Maglaras, and X. Wang, “FELIDS: Federated learning-based intrusion detection system for agricultural Internet of Things,” Journal of Parallel and Distributed Computing, vol. 165, pp. 17–31, 2022. [53] L. Cui, Y. Zhang, J. Li, H. Chen, P. Wang, X. Liu, et al., “FedVAE: Trajectory privacy preserving based on federated variational autoencoder,”
IEEE TRANSACTIONS ON NETWORK AND SERVICE MANAGEMENT, VOL. XX, NO. X, 2025
IEEE Transactions on Vehicular Technology, vol. 72, no. 4, pp. 5012– 5026, 2023. [54] P. R. Alcazar, J. Kim, A. Sharma, L. Wang, M. Zhao, D. Li, et al., “Federated learning for intrusion detection in industrial Internet of Things: A comprehensive benchmark,” IEEE Transactions on Industrial Informatics, vol. 19, no. 10, pp. 10455–10466, 2023. [55] J. Wang, K. Yang, and M. Li, “NIDS-FGPA: A federated learning network intrusion detection algorithm based on secure aggregation of gradient similarity models,” PLoS ONE, vol. 19, no. 10, Art. no. e0308639, Oct. 2024 [56] A. Vyas, P.-C. Lin, R.-H. Hwang, and M. Tripathi, “Privacy-preserving federated learning for intrusion detection in IoT environments: A survey,” IEEE Access, vol. 12, pp. 127018–127050, 2024 [57] A. Tabassum, A. Erbad, W. Lebda, A. Mohamed, and M. Guizani, “FEDGAN-IDS: Privacy-preserving IDS using GAN and federated learning,” Computer Communications, vol. 192, pp. 299–310, Aug. 2022 [58] H. Zhu, J. Xu, S. Liu, and Y. Jin, “Federated learning on non-IID data: A survey,” Neurocomputing, vol. 465, pp. 371–390, 2021. [59] F. Sattler, S. Wiedemann, K. Müller, and W. Samek, “Clustered federated learning: Model-agnostic distributed multi-task optimization under privacy constraints,” IEEE Transactions on Neural Networks and Learning Systems, vol. 31, no. 9, pp. 3446–3457, 2020. [60] D. J. Beutel, M. Chen, A. Kumar, S. Li, R. Zhang, T. Wang, et al., “Flower: A friendly federated learning framework,” IEEE Pervasive Computing, vol. 23, no. 1, pp. 45–54, 2024.
12