Lightweight Cluster-Based Federated Learning for Intrusion Detection in Heterogeneous IoT Networks

TL;DR

This paper presents a lightweight, cluster-based federated learning framework for intrusion detection in heterogeneous IoT networks, significantly reducing training time and latency while maintaining high accuracy.

Contribution

It introduces a novel hierarchical architecture with device clustering and lightweight models to improve efficiency and scalability of federated intrusion detection in IoT.

Findings

Reduces training time by 2.47x compared to traditional FL.

Achieves 2.16x lower testing latency.

Maintains detection accuracy above 99%.

Abstract

The rise of heterogeneous Internet of Things (IoT) devices has raised security concerns due to their vulnerability to cyberattacks. Intrusion Detection Systems (IDS) are crucial in addressing these threats. Federated Learning (FL) offers a privacy-preserving solution, but IoT heterogeneity and limited computational resources cause increased latency and reduced performance. This paper introduces a novel approach Cluster-based federated intrusion detection with lightweight networks for heterogeneous IoT designed to address these limitations. The proposed framework utilizes a hierarchical IoT architecture that encompasses edge, fog, and cloud layers. Intrusion detection clients operate at the fog layer, leveraging federated learning to enhance data privacy and distributed processing efficiency. To enhance efficiency, the method employs the lightweight MobileNet model alongside a hybrid loss function that integrates Gumbel-SoftMax and SoftMax, optimizing resource consumption while maintaining high detection accuracy. A key feature of this approach is clustering IoT devices based on hardware similarities, enabling more efficient model training and aggregation tailored to each cluster's computational capacity. This strategy not only simplifies the complexity of managing heterogeneous data and devices but also improves scalability and overall system performance. To validate the effectiveness of the proposed method, extensive experiments were conducted using the ToN-IoT and CICDDoS2019 datasets. Results demonstrate that the proposed approach reduces end-to-end training time by 2.47x compared to traditional FL methods, achieves 2.16x lower testing latency, and maintains exceptionally high detection accuracy of 99.22% and 99.02% on the ToN-IoT and CICDDoS2019 datasets, respectively.