Multi-Temporal Device Clustering for Federated Learning-Internet of Things Intrusion Detection Systems

Abstract

FL intrusion detection systems (IDSs) have emerged as a defense-in-depth layer for securing internet of things (IoT) networks by training detection models and classifying IoT traffic locally on distributed devices. However, developing effective federated learning (FL)-IoT IDSs remains significantly challenging due to key IoT characteristics, including their distributed nature, resource constraints, and data heterogeneity. Thus, improving detection performance and accelerating model convergence in FL-IoT IDSs while accounting for these IoT characteristics is essential. Moreover, existing FL-IoT IDSs lack mechanisms for preparing reliable pseudo-labeled IoT traffic for subsequent training rounds. To this end, we propose a multi-temporal device clustering FL-IoT IDS framework that partitions federated learning detection rounds (FLDRs) in time and clusters devices within each partition to enhance detection effectiveness without compromising IoT resources. We also establish the FLDR as an organizational framework to structure the periodic intrusion-detection processes in FL-IoT IDSs. The framework employs a post-processing (PP) module that applies confidence thresholding and outlier removal in unsupervised and hybrid supervised–unsupervised settings, enabling on-device filtering of pseudo-labeled traffic and reuse of retained pseudo-labeled traffic in the subsequent round. It also incorporates a data-driven clustering technique that anticipates non-independent and identically distributed (IID) behavior in upcoming FLDRs, thereby mitigating the impact of non-IID intrusion distributions. For evaluation, we implement dual-, triple-, and quadruple-temporal variants of the framework and assess different machine learning components. The PP module is benchmarked against supervised and no-PP baselines, while the data-driven clustering technique is compared with random and similarity-based clustering approaches. The data-driven quadruple-temporal clustering technique is also benchmarked against two existing FL-IoT IDS algorithms. We further assess resource consumption in terms of computational usage and communication overhead. Experiments on balanced and imbalanced intrusion scenarios derived from the Edge-IIoTset and MQTT-IoT-IDS datasets demonstrate that the proposed framework achieves superior detection accuracy, faster convergence, and fewer false positives and false negatives, thereby reducing unnecessary alarms and lowering the risk of undetected intrusions. The PP module proves effective for on-device pseudo-label filtering, with hybrid supervised–unsupervised methods achieving performance close to that of the supervised baseline, while the data-driven clustering technique consistently yields balanced and robust performance. Moreover, the proposed data-driven quadruple-temporal variant outperforms two existing FL-IoT IDS algorithms on imbalanced datasets. Importantly, the overall resource utilization remains comparable to that of the traditional FL-IoT IDS approach.