Federated Learning for Distributed IoT Security: A Privacy-Preserving Approach to Intrusion Detection

Billions of resource-constrained IoT devices now stream security-critical yet privacy-sensitive traffic across the Internet. To detect intrusions without exposing raw data, we propose a federated learning (FL) framework that trains collaboratively on the edge while preserving privacy. At its core is Hybrid Adaptive-Weight Aggregation (HADA), a new server-side rule that weights client updates by their SHAP-based feature stability and individual differential-privacy (DP) budgets. HADA down-weights noisy or low-privacy updates, speeding convergence and hardening the global model against poisoning. Evaluated on the CIC-BCCC-NRC TabularIoTAttack-2024 and Edge-IIoTset benchmarks with 100 simulated ARM-class devices, the proposed FL-IDS achieves 85–89 % detection accuracy—on par with centralized training—while reducing per-round uplink traffic by an order of magnitude. Under strong adversarial perturbations (FGSM, PGD-10, label-flip) it retains 66–73 % accuracy, outperforming vanilla FedAvg by up to 22 percentage points. A formal convergence theorem is proved for non-IID, DP-noisy updates, and the privacy–utility curve shows $\lt \!1.5$ pp accuracy loss at $\varepsilon = 1.0$ . These results demonstrate that HADA-FL delivers a scalable, privacy-preserving, and attack-resilient intrusion-detection system suitable for real-world heterogeneous IoT deployments.