In-network Attack Detection with Federated Deep Learning in IoT Networks: Real Implementation and Analysis

2026-03-23

AI Summary

This work addresses the limitations of traditional centralized anomaly detection in Internet of Things (IoT) environments—namely, privacy leakage, poor scalability, and high latency—by proposing a lightweight autoencoder-based anomaly detection framework integrated with federated learning. The approach enables distributed model training directly on edge devices, where only model weights are uploaded to preserve data privacy and reduce communication overhead. The system is deployed and evaluated on a real-world Raspberry Pi-based IoT testbed, demonstrating effective detection of internal network attacks. Experimental results show that the proposed method accurately identifies network intrusions in realistic settings while significantly lowering communication costs and achieving detection performance comparable to centralized approaches.

Technology Category

• Machine Learning: Learning on the Edge & Model Compression
• Application Domains: Internet of Things, Sensor Networks & Smart Cities
• Data Mining & Knowledge Management: Anomaly/Outlier Detection

Application Category

• Systems and Infrastructure for Web, Mobile and WoT: Federated Web and WoT systems, including distributed, federated and edge-based data processing
• User Modeling, Personalization and Recommendation: Federated recommendation systems and personalization
• Responsible Web: Machine-in-the-loop, human agency and autonomy

Abstract

The rapid expansion of the Internet of Things (IoT) and its integration with backbone networks have heightened the risk of security breaches. Traditional centralized approaches to anomaly detection, which require transferring large volumes of data to central servers, suffer from privacy, scalability, and latency limitations. This paper proposes a lightweight autoencoder-based anomaly detection framework designed for deployment on resource-constrained edge devices, enabling real-time detection while minimizing data transfer and preserving privacy. Federated learning is employed to train models collaboratively across distributed devices, where local training occurs on edge nodes and only model weights are aggregated at a central server. A real-world IoT testbed using Raspberry Pi sensor nodes was developed to collect normal and attack traffic data. The proposed federated anomaly detection system, implemented and evaluated on the testbed, demonstrates its effectiveness in accurately identifying network attacks. The communication overhead was reduced significantly while achieving comparable performance to the centralized method.

Problem

• IoT security
• anomaly detection
• in-network attack
• privacy
• edge computing

Innovation

• Federated Learning
• Autoencoder
• Edge Computing
• Anomaly Detection
• IoT Security