In-network Attack Detection with Federated Deep Learning in IoT Networks: Real Implementation and Analysis

Devashish Chaudhary; Sutharshan Rajasegarar; Shiva Raj Pokhrel; Lei Pan; Ruby D

cs.LGMar 23, 2026

In-network Attack Detection with Federated Deep Learning in IoT Networks: Real Implementation and Analysis

Authors: Devashish Chaudhary, Sutharshan Rajasegarar, Shiva Raj Pokhrel, Lei Pan, Ruby D

Organizations: School of IT, Deakin University, Geelong, Australia · School of Computer Science and Engineering, Vellore Institute of Technology, Vellore, India

Abstract

The rapid expansion of the Internet of Things (IoT) and its integration with backbone networks have heightened the risk of security breaches. Traditional centralized approaches to anomaly detection, which require transferring large volumes of data to central servers, suffer from privacy, scalability, and latency limitations. This paper proposes a lightweight autoencoder-based anomaly detection framework designed for deployment on resource-constrained edge devices, enabling real-time detection while minimizing data transfer and preserving privacy. Federated learning is employed to train models collaboratively across distributed devices, where local training occurs on edge nodes and only model weights are aggregated at a central server. A real-world IoT testbed using Raspberry Pi sensor nodes was developed to collect normal and attack traffic data. The proposed federated anomaly detection system, implemented and evaluated on the testbed, demonstrates its effectiveness in accurately identifying network attacks. The communication overhead was reduced significantly while achieving comparable performance to the centralized method.

Figures & tables

Panel of Figure 1 — Fig. 1: (a) Raspberry Pi 3B+ with ZigBee (b) Network Topology (c) Redirection Attack.

Scenario I					Scenario II			Scenario III
Normal	E1 $\rightarrow$ R1	E2 $\rightarrow$ R1	E3 $\rightarrow$ R3	E4 $\rightarrow$ R2	R1 $\rightarrow$ C	R2 $\rightarrow$ C	R3 $\rightarrow$ R2	E1 $\rightarrow$ R1	E2 $\rightarrow$ R1	E3 $\rightarrow$ R3	E4 $\rightarrow$ R2	R1 $\rightarrow$ C	R2 $\rightarrow$ C	R3 $\rightarrow$ C
Attack	E1 $\rightarrow$ R2	E2 $\rightarrow$ R2	E3 $\rightarrow$ R1	E4 $\rightarrow$ R1	R1 $\rightarrow$ R2	R2 $\rightarrow$ R1	R3 $\rightarrow$ R1	E1 $\rightarrow$ A	E2 $\rightarrow$ A	E3 $\rightarrow$ A	E4 $\rightarrow$ A	R1 $\rightarrow$ A	R2 $\rightarrow$ A	R3 $\rightarrow$ A
	E1 $\rightarrow$ R3	E2 $\rightarrow$ R3	E3 $\rightarrow$ R2	E4 $\rightarrow$ R3	R1 $\rightarrow$ R3		R3 $\rightarrow$ C
	E1 $\rightarrow$ C	E2 $\rightarrow$ C	E3 $\rightarrow$ C	E4 $\rightarrow$ C

TABLE I: Attack scenarios: C – Coordinator, A – Attacker, Rx – Router, Ex – Edge/Leaf device.

Fig. 2: Reconstruction loss/error over time. A small loss is observed during the normal (attack-free) operation, and the loss becomes higher during the attack period (towards the middle).

Metric	k = 1	k = 2	k = 3	k = 4
Federated R1	0.0342	0.0429	0.0516	0.0603
Centralized R1	0.0014	0.0022	0.0031	0.0039
Federated R2	0.0351	0.0450	0.0550	0.0649
Centralized R2	0.0035	0.0058	0.0082	0.0105
Federated R3	0.0242	0.0264	0.0286	0.0308
Centralized R3	0.0005	0.0007	0.0009	0.0011

TABLE II: Federated and centralized thresholds

k	Acc.	Prec.	Rec.	F1	Acc.	Prec.	Rec.	F1	Acc.	Prec.	Rec.	F1
	R1				R2				R3
Federated method
k = 1	0.8458	0.4440	0.9583	0.6069	0.9333	0.7742	0.8054	0.7895	0.6526	0.1809	0.8810	0.3002
k = 2	0.9369	0.6766	0.9417	0.7875	0.9354	0.8222	0.7450	0.7817	0.8097	0.2908	0.8690	0.4358
k = 3	0.9669	0.8284	0.9250	0.8740	0.9292	0.8649	0.6443	0.7385	0.8127	0.2910	0.8452	0.4329
k = 4	0.9741	0.8926	0.9000	0.8963	0.9250	0.8738	0.6040	0.7143	0.8167	0.2941	0.8333	0.4348

TABLE III: Performance of federated and centralized models (R1, R2, and R3)

Panel of Figure 6 — Fig. 3: (a) F1-score for different devices using optimal $k$ values. (b) F1-score for each device for different values of $k\in\{1,2,3,4\}$ .

Explore similar work

Modeling Quantum Federated Autoencoder for Anomaly Detection in IoT Networks
Mar 23, 2026Devashish Chaudhary, Sutharshan Rajasegarar, Shiva Raj PokhrelAnomaly Detection Internet of Things
School of Information Technology, Deakin University, Geelong, Australia
CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification
May 7, 2026Iason Ofeidis, Nikos Papadis, Randeep Bhatia +2IoT Intrusion Detection Network Intrusion Detection
Yale University, New Haven, CT, USA · Nokia Bell Labs, Murray Hill, NJ, USA
An Efficient Unsupervised Federated Learning Approach for Anomaly Detection in Heterogeneous IoT Networks
Feb 27, 2026Mohsen Tajgardan, Atena Shiranzaei, Mahdi Rabbani +2Unsupervised Anomaly Detection Anomaly Detection
Faculty of Electrical and Computer Engineering, Qom University of Technology, Qom, Iran · Department of Computer Engineering, Faculty of Industry and Mining (Khash), Sistan and Baluchestan University, Zahedan, Iran · Canadian Institute for Cybersecurity, University of New Brunswick, NB, Canada +1

Mar 23, 2026J/K move · Enter open · S save

Modeling Quantum Federated Autoencoder for Anomaly Detection in IoT Networks

Devashish Chaudhary, Sutharshan Rajasegarar, Shiva Raj Pokhrel

School of Information Technology, Deakin University, Geelong, Australia

Anomaly Detection Internet of Things Federated Learning Quantum Machine Learning

Open paper AskPDF arXiv

We propose a Quantum Federated Autoencoder for Anomaly Detection, a framework that leverages quantum federated learning for efficient, secure, and distributed processing in IoT networks. By harnessing quantum autoencoders for high-dimensional feature representation and federated learning for decentralized model training, the approach transforms localized learning on edge devices without requiring transmission of raw data, thereby preserving privacy and minimizing communication overhead. The model leverages quantum advantage in pattern recognition to enhance detection sensitivity, particularly in complex and dynamic IoT network traffic. Experiments on a real-world IoT dataset show that the proposed method delivers anomaly detection accuracy and robustness comparable to centralized approaches, while ensuring data privacy.

Abstract

Explore similar work

Modeling Quantum Federated Autoencoder for Anomaly Detection in IoT Networks

CLAD: A Clustered Label-Agnostic Federated Learning Framework for Joint Anomaly Detection and Attack Classification

An Efficient Unsupervised Federated Learning Approach for Anomaly Detection in Heterogeneous IoT Networks