Privacy-Preserving Intrusion Detection in Industrial IoT Using Federated Learning

Industrial Control Systems (ICS) are integral to critical infrastructures but are increasingly vulnerable to sophisticated cyber threats due to their integration into networked environments. Traditional Intrusion Detection Systems (IDS) often fall short of addressing the specialized requirements of ICS, such as unique protocols, strict operational constraints, and the need for data privacy. This paper proposes a Conditional Variational Autoencoder (CVAE)-based intrusion detection method (CVAE-ID) and its Federated Learning (FL)-based implementation (FLCVAE-ID). The CVAE-ID leverages unsupervised representation learning to effectively identify anomalous patterns in ICS network traffic, achieving notable performance metrics, including 97.56% accuracy and an AUC-ROC of 0.9495 on the WUSTL-IIOT-2018 dataset. The FLCVAE-ID extends this framework by incorporating FL, enabling collaborative model training across distributed ICS environments while preserving data privacy and maintaining comparable detection performance. While FLCVAE-ID introduces additional computational over-head due to federated architecture, it provides a scalable and privacy-preserving solution for anomaly detection in sensitive ICS environments. These results underscore the potential of CVAE and FL-based approaches to enhance ICS cybersecurity, balancing accuracy, privacy, and scalability.