Towards Explainable and Distributed Intrusion Detection in IoTs: A Federated Learning-Based Approach

The rapid advancement of IoT technologies has greatly enhanced daily life but has also introduced increased vulnerability to cyber attacks. In response to these growing security challenges, this study presents a high-performance and explainable Intrusion Detection System (IDS) based on the CICIoT 2023 dataset. The dataset was sampled at a 1 % rate and reclassified into seven major attack categories. After comprehensive preprocessing and feature selection using the SelectKBest method, class imbalance was addressed through SMOTE. The study also explores a privacy-preserving Federated Learning (FL) approach, where data was partitioned among three clients for local training. The aggregated global model, constructed without sharing raw data, achieved an accuracy of 93.28 % and a balanced accuracy of $\mathbf{4 4. 1 2 \%}$, demonstrating its viability in distributed environments. Among the evaluated models, LightGBM achieved the highest accuracy ($\mathbf{9 8. 8 8} \%$), followed by XGBoost, CatBoost, and Random Forest. A custom Deep Neural Network (DNN) also showed strong performance with $\mathbf{9 7. 8 9 \%}$ accuracy and a ROCAUC of 0.9914, particularly excelling in dominant classes. To improve transparency, SHAP and LIME explainability tools were integrated, confirming the system's strength in both predictive performance and interpretability.