# Evaluating Federated Learning for Intrusion Detection in Internet of Things: Review and Challenges

arXiv: https://arxiv.org/abs/2108.00974 · HTML: https://mlsanity.com/paper/2108.00974/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 31 of its 104 references that are in the map.
- First posted on arXiv 2 Aug 2021.

## Builds on (most cited first, 30 of 31)

- [Communication-Efficient Learning of Deep Networks from Decentralized Data](https://mlsanity.com/paper/1602.05629/) (2016)
- [Advances and Open Problems in Federated Learning](https://mlsanity.com/paper/1912.04977/) (2019)
- [Federated Optimization in Heterogeneous Networks](https://mlsanity.com/paper/1812.06127/) (2018)
- [Federated Learning: Challenges, Methods, and Future Directions](https://mlsanity.com/paper/1908.07873/) (2019)
- [On the Convergence of FedAvg on Non-IID Data](https://mlsanity.com/paper/1907.02189/) (2019)
- [Federated Learning with Non-IID Data](https://mlsanity.com/paper/1806.00582/) (2018)
- [Byzantine-Robust Distributed Learning: Towards Optimal Statistical Rates](https://mlsanity.com/paper/1803.01498/) (2018)
- [signSGD: Compressed Optimisation for Non-Convex Problems](https://mlsanity.com/paper/1802.04434/) (2018)
- [Federated Learning with Differential Privacy: Algorithms and Performance Analysis](https://mlsanity.com/paper/1911.00222/) (2019)
- [Robust and Communication-Efficient Federated Learning from Non-IID Data](https://mlsanity.com/paper/1903.02891/) (2019)
- [Adaptive Federated Learning in Resource Constrained Edge Computing Systems](https://mlsanity.com/paper/1804.05271/) (2018)
- [Federated Learning in Mobile Edge Networks: A Comprehensive Survey](https://mlsanity.com/paper/1909.11875/) (2019)
- [Client Selection for Federated Learning with Heterogeneous Resources in Mobile Edge](https://mlsanity.com/paper/1804.08333/) (2018)
- [Federated Learning for Internet of Things: A Comprehensive Survey](https://mlsanity.com/paper/2104.07914/) (2021)
- [Gate-Variants of Gated Recurrent Unit (GRU) Neural Networks](https://mlsanity.com/paper/1701.05923/) (2017)
- [One-Shot Federated Learning](https://mlsanity.com/paper/1902.11175/) (2019)
- [Towards the Development of Realistic Botnet Dataset in the Internet of Things for Network Forensic Analytics: Bot-IoT Dataset](https://mlsanity.com/paper/1811.00701/) (2018)
- [Reliable Federated Learning for Mobile Networks](https://mlsanity.com/paper/1910.06837/) (2019)
- [D"IoT: A Federated Self-learning Anomaly Detection System for IoT](https://mlsanity.com/paper/1804.07474/) (2018)
- [N-BaIoT: Network-based Detection of IoT Botnet Attacks Using Deep Autoencoders](https://mlsanity.com/paper/1805.03409/) (2018)
- [IBM Federated Learning: an Enterprise Framework White Paper V0.1](https://mlsanity.com/paper/2007.10987/) (2020)
- [Federated Learning for Malware Detection in IoT Devices](https://mlsanity.com/paper/2104.09994/) (2021)
- [Federated Learning for Resource-Constrained IoT Devices: Panoramas and State-of-the-art](https://mlsanity.com/paper/2002.10610/) (2020)
- [Budgeted Online Selection of Candidate IoT Clients to Participate in Federated Learning](https://mlsanity.com/paper/2011.09849/) (2020)
- [Federated Intrusion Detection for IoT with Heterogeneous Cohort Privacy](https://mlsanity.com/paper/2101.09878/) (2021)
- [On-device Federated Learning with Flower](https://mlsanity.com/paper/2104.03042/) (2021)
- [FLEAM: A Federated Learning Empowered Architecture to Mitigate DDoS in Industrial IoT](https://mlsanity.com/paper/2012.06150/) (2020)
- [LocKedge: Low-Complexity Cyberattack Detection in IoT Edge Computing](https://mlsanity.com/paper/2011.14194/) (2020)
- [Federated Mimic Learning for Privacy Preserving Intrusion Detection](https://mlsanity.com/paper/2012.06974/) (2020)
- [Differentially Private Federated Learning for Resource-Constrained Internet of Things](https://mlsanity.com/paper/2003.12705/) (2020)

## Built on by (most cited first, 16 of 16)

- [Anomaly Detection via Federated Learning](https://mlsanity.com/paper/2210.06614/) (2022)
- [FedRDF: A Robust and Dynamic Aggregation Function against Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2402.10082/) (2024)
- [Federated Deep Learning for Intrusion Detection in IoT Networks](https://mlsanity.com/paper/2306.02715/) (2023)
- [Decentralized Online Federated G-Network Learning for Lightweight Intrusion Detection](https://mlsanity.com/paper/2306.13029/) (2023)
- [Enhancing Trustworthiness in ML-Based Network Intrusion Detection with Uncertainty Quantification](https://mlsanity.com/paper/2310.10655/) (2023)
- [Federated Learning for Misbehaviour Detection with Variational Autoencoders and Gaussian Mixture Models](https://mlsanity.com/paper/2405.09903/) (2024)
- [Balancing Usability and Compliance in AI Smart Devices: A Privacy-by-Design Audit of Google Home, Alexa, and Siri](https://mlsanity.com/paper/2601.04403/) (2026)
- [A Novel Federated Learning-Based IDS for Enhancing UAVs Privacy and Security](https://mlsanity.com/paper/2312.04135/) (2023)
- [Detection and Prevention Against Poisoning Attacks in Federated Learning](https://mlsanity.com/paper/2210.14944/) (2022)
- [CADeSH: Collaborative Anomaly Detection for Smart Homes](https://mlsanity.com/paper/2303.01021/) (2023)
- [Enhancing IoT Security Against DDoS Attacks through Federated Learning](https://mlsanity.com/paper/2403.10968/) (2024)
- [StatAvg: Mitigating Data Heterogeneity in Federated Learning for Intrusion Detection Systems](https://mlsanity.com/paper/2405.13062/) (2024)
- [Addressing Data Quality Decompensation in Federated Learning via Dynamic Client Selection](https://mlsanity.com/paper/2505.21219/) (2025)
- [Sentinel: Dynamic Knowledge Distillation for Personalized Federated Intrusion Detection in Heterogeneous IoT Networks](https://mlsanity.com/paper/2510.23019/) (2025)
- [Toward Youth-Centered Privacy-by-Design in Smart Devices: A Systematic Review](https://mlsanity.com/paper/2601.11598/) (2026)
- [Federated Attack Campaign Detection via Contrastive Encoding of Threat Indicators in Gradient Updates](https://mlsanity.com/paper/2609.04815/) (2026)

## Abstract (arXiv)

The application of Machine Learning (ML) techniques to the well-known intrusion detection systems (IDS) is key to cope with increasingly sophisticated cybersecurity attacks through an effective and efficient detection process. In the context of the Internet of Things (IoT), most ML-enabled IDS approaches use centralized approaches where IoT devices share their data with data centers for further analysis. To mitigate privacy concerns associated with centralized approaches, in recent years the use of Federated Learning (FL) has attracted a significant interest in different sectors, including healthcare and transport systems. However, the development of FL-enabled IDS for IoT is in its infancy, and still requires research efforts from various areas, in order to identify the main challenges for the deployment in real-world scenarios. In this direction, our work evaluates a FL-enabled IDS approach based on a multiclass classifier considering different data distributions for the detection of different attacks in an IoT scenario. In particular, we use three different settings that are obtained by partitioning the recent ToNIoT dataset according to IoT devices' IP address and types of attack. Furthermore, we evaluate the impact of different aggregation functions according to such setting by using the recent IBMFL framework as FL implementation. Additionally, we identify a set of challenges and future directions based on the existing literature and the analysis of our evaluation results.