Abstract

The Internet of Things (IoT) has increased the cyber-attack surface by bringing together a variety of different devices, sensors, and services in critical digital infrastructure. Federated learning (FL) is a solution that enables local devices to train together without sharing raw traffic data; thus, it can be used for intrusion detection without compromising privacy. Nevertheless, traditional FL aggregation techniques are still susceptible to non-IID client distributions, data imbalance, unreliable local updates, and poor representation learning approaches. This study introduces a novel method, called Trust-Aware Contrastive Federated Learning for IoT intrusion detection, TACMA Fed. The framework extends AMAFed and combines trust-aware client scoring, aggregation based on similarity of updates, supervised contrastive representation learning, adaptive focal–Dice loss, and rare-class-aware weighting into a lightweight 1D convolutional model. The ten simulated IoT clients and the non-IID Dirichlet partition are used in experiments with the ToN-IoT train_test_network dataset. TACMA Fed achieves an accuracy of 0.9957, an F1 score of 0.9937, an ROC-AUC of 0.9991, a PR-AUC of 0.9997, and a false-positive rate of 0.0087. Robustness analysis also shows stability parameters in the presence of Gaussian noise and feature masking, as well as varying levels of client heterogeneity. The outcomes of these experiments prove that, in the context of federated IDS (FIDS) for a heterogeneous IoT network, the integration of trust-aware aggregation with contrastive representation learning and imbalance-aware optimization can enhance performance.

IPC Classification

Keywords