An Efficient Unsupervised Federated Learning Approach for Anomaly Detection in Heterogeneous IoT Networks

Mohsen Tajgardan; Atena Shiranzaei; Mahdi Rabbani; Reza Khoshkangini; Mahtab Jamali

cs.LGFeb 27, 2026

An Efficient Unsupervised Federated Learning Approach for Anomaly Detection in Heterogeneous IoT Networks

Authors: Mohsen Tajgardan, Atena Shiranzaei, Mahdi Rabbani, Reza Khoshkangini, Mahtab Jamali

Organizations: Faculty of Electrical and Computer Engineering, Qom University of Technology, Qom, Iran · Department of Computer Engineering, Faculty of Industry and Mining (Khash), Sistan and Baluchestan University, Zahedan, Iran · Canadian Institute for Cybersecurity, University of New Brunswick, NB, Canada · Sustainable Digitalisation Research Centre (SDRC), Department of Computer Science and Media Technology, Faculty of Technology and Society, Malmo University, Sweden

Abstract

Federated learning (FL) is an effective paradigm for distributed environments such as the Internet of Things (IoT), where data from diverse devices with varying functionalities remains localized while contributing to a shared global model. By eliminating the need to transmit raw data, FL inherently preserves privacy. However, the heterogeneous nature of IoT data, stemming from differences in device capabilities, data formats, and communication constraints, poses significant challenges to maintaining both global model performance and privacy. In the context of IoT-based anomaly detection, unsupervised FL offers a promising means to identify abnormal behavior without centralized data aggregation. Nevertheless, feature heterogeneity across devices complicates model training and optimization, hindering effective implementation. In this study we propose an efficient unsupervised FL framework that enhances anomaly detection by leveraging shared features from two distinct IoT datasets: one focused on anomaly detection and the other on device identification, while preserving dataset-specific features. To improve transparency and interpretability, we employ explainable AI techniques, such as SHAP, to identify key features influencing local model decisions. Experiments conducted on real-world IoT datasets demonstrate that the proposed method significantly outperforms conventional FL approaches in anomaly detection accuracy. This work underscores the potential of using shared features from complementary datasets to optimize unsupervised federated learning and achieve superior anomaly detection results in decentralized IoT environments.

Figures & tables

Datasets	No. Features	Class Name	No. Samples For All	No. Samples Train	No. Samples Test	No. Samples validation
CICIoT-DIAD 2024 [ 20 ]	78	Benign	297063	232904	6000	58226
(Anomaly Detection)		Attack	290346	227518	6000	56880
Heterogeneous Client
CICIOT Dataset 2023 [ 18 ]	46	Benign	919206	730577	6000	182645
(Anomaly Detection)		Attack	152686	117444	6000	29361
Heterogeneous Client

TABLE I : Details of the dataset.

No.	Feature Name	No.	Feature Name
1	total_length	26	max_et
2	L4_udp	27	med_et
3	L7_http	28	average_et
4	L7_https	29	skew_et
5	port_class_src	30	kurt_et
6	port_class_dst	31	var

TABLE II : Comparison of features across three datasets, features in blue represent common attributes.

Fig. 1 : The high-level life cycle of the proposed approach.

Fig. 2 : A general overview of the federated learning system

Fig. 3 : An external view of the federated learning framework.

Term	Definition
Client 1	CICIoT2022 Device Identification Dataset [ 3 ] .
Client 2	CICIoT2023 Attack Dataset [ 18 ] .
Client 3	CIC IoT-DIAD 2024 Device Identification & Attack Dataset [ 20 ] .
Homogeneous	A client with the same layer dimensions as the server.
Heterogeneous	A client with at least one layer dimension different from the server.
Round	One iteration of local training followed by global aggregation.

TABLE III : Key terminology used in this study.

Parameter	Value
Optimizer	Adam
Loss function	mean squared error (MSE)
Server Rounds	21
Client Train Epochs	2
Client Validations Epochs	2
Client Train Size	80%

TABLE IV : Configs used in our study.

Fig. 4 : An internal view of the clients and how different weights have been set.

Layer (type)	Output Shape	Param #
input_layer InputLayer)	(None, 45)	0
First (Dense)	(None, 105)	4,830
dense (Dense)	(None, 90)	9,540
dense_1 (Dense)	(None, 75)	6,825
dense_2 (Dense)	(None, 60)	4,560
bottleneck (Dense)	(None, 10)	610

TABLE V : Autoencoder Architecture Details for CICIOT2023 heterogeneous Client Anomaly Detection Dataset.

Fig. 5 : Federated aggregation over common layers across clients.

Fig. 6 : Overview of the clustering process on latent representation given by Auto-encoder.

Panel of Figure 13 — Fig. 8 : (a) Baseline autoencoder + K-means vs. (b) Proposed federated autoencoder + K-means; comparison of F1, Precision, Recall across CICIoT2022/2023/CICIoT-DIAD 2024

Fig. 10 : Confusion Matrix of dataset CICIoT2022(client 1) in round 3.

Fig. 11 : Confusion Matrix of dataset CICIoT2023(client 2) in round 8.

Fig. 12 : Confusion Matrix of dataset CICIoT2024(client 3) in round 12

Method	Datasets	Accuracy	F1-score	Round	Epoch
Autoencoder (baseline)	CICIoT 2024	0.8008	0.7952	-	50
Autoencoder (baseline)	CICIoT 2023	0.7918	0.7916	-	50
Autoencoder (baseline)	CICIoT 2022	0.1295	0.1163	-	50
	CICIoT 2024	0.9535	0.9574	12	2
Proposed Method	CICIoT 2023	0.7844	0.7857	8	2
	CICIoT 2022	0.30364	0.3064	3	2

TABLE VI : Evaluation results on CICIoT Datasets.

Fig. 13 : In the IoT 2022 dataset, showing the impact of different features on the target variable using SHAP

Fig. 14 : In the IoT 2023 dataset, analyzing the distribution of feature values using SHAP

Fig. 15 : In the IoT-DIAD 2024 dataset, analyzing the distribution of feature values using SHAP

Explore similar work

Robust Unsupervised Network Intrusion Detection via Federated Learning with Selective Aggregation under Anomalous Sample Contamination
Jul 28, 2026Shohei Kamiguchi, Takayuki NishioNetwork Intrusion Detection Unsupervised Anomaly Detection
School of Engineering, Institute of Science Tokyo, Tokyo 152-8550, Japan
In-network Attack Detection with Federated Deep Learning in IoT Networks: Real Implementation and Analysis
Mar 23, 2026Devashish Chaudhary, Sutharshan Rajasegarar, Shiva Raj Pokhrel +2IoT Intrusion Detection Network Intrusion Detection
School of IT, Deakin University, Geelong, Australia · School of Computer Science and Engineering, Vellore Institute of Technology, Vellore, India
CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification
May 7, 2026Iason Ofeidis, Nikos Papadis, Randeep Bhatia +2IoT Intrusion Detection Network Intrusion Detection
Yale University, New Haven, CT, USA · Nokia Bell Labs, Murray Hill, NJ, USA

Jul 28, 2026J/K move · Enter open · S save

Robust Unsupervised Network Intrusion Detection via Federated Learning with Selective Aggregation under Anomalous Sample Contamination

Shohei Kamiguchi, Takayuki Nishio

School of Engineering, Institute of Science Tokyo, Tokyo 152-8550, Japan

Network Intrusion Detection Unsupervised Anomaly Detection Federated Learning Anomaly Detection

Open paper AskPDF arXiv

Network intrusion detection systems (NIDS) have become essential for Internet of Things (IoT) environments, as malware targeting IoT devices continues to evolve in sophistication. Unsupervised learning approaches offer a promising direction by removing the dependency on labeled datasets. However, the common assumption that training data are entirely clean is often violated in practice, particularly when data samples are collected directly from deployed network devices, where anomalies are likely to be present in the training datasets. Such contamination degrades detection performance and highlights the need for robust unsupervised NIDS methods capable of operating effectively under contaminated unlabeled training data. To address this issue, we propose a robust training methodology for anomaly detection (AD) that remains effective even in the presence of unlabeled anomalies. Our method consists of two primary components. First, we exploit a known limitation of federated learning (FL), namely its tendency to underrepresent minority data. By leveraging this characteristic, we attenuate the influence of anomalous data originating from a small number of compromised clients. Second, we introduce a selective aggregation mechanism during model aggregation, which quantifies the "distance" between local client models and a global reference. Specifically, we employ the Expectation-Maximization (EM) algorithm to detect and exclude client groups whose model updates significantly diverge from the majority. This selective aggregation ensures that anomalous updates do not compromise the global model. Experiments conducted on multiple NIDS datasets demonstrate that our method outperforms existing approaches in environments contaminated with anomalous data. Furthermore, the proposed method maintains its detection performance even as the proportion of anomalies increases.

Abstract

Explore similar work

Robust Unsupervised Network Intrusion Detection via Federated Learning with Selective Aggregation under Anomalous Sample Contamination

In-network Attack Detection with Federated Deep Learning in IoT Networks: Real Implementation and Analysis

CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification