Search papers, labs, and topics across Lattice.
This paper introduces Federated Bandit Intrusion Detection (FBID), an adaptive Personalized Federated Learning framework designed to enhance out-of-distribution attack detection in heterogeneous IoT networks. By implementing a contextual multi-armed bandit approach for server-side personalization control, FBID effectively mitigates the over-personalization issue prevalent in existing methods, allowing for improved local adaptation without sacrificing global knowledge. Experimental results on the CICIoT2023 dataset demonstrate that FBID significantly boosts individual client detection rates and F1-scores, while also increasing robustness against novel attack classes.
FBID achieves up to a 7.66% improvement in out-of-distribution detection rates by dynamically balancing local and global model training in IoT networks.
Personalized Federated Learning (PFL) has emerged as a promising solution for intrusion detection in heterogeneous IoT environments, as it can improve local adaptation under highly Non-Independent and Identically Distributed (non-IID) data distributions. However, existing PFL methods often rely on client-side self-adjustment, which may lead to over-personalization and substantial degradation in out-of-distribution (OOD) attack detection. In this paper, we propose Federated Bandit Intrusion Detection (FBID), a novel adaptive PFL framework to address this limitation through server-side personalization control. In particular, FBID employs a contextual multi-armed bandit at the server to dynamically regulate each client's local training intensity according to its observed behavior and update quality. Moreover, FBID introduces a trust-based blending mechanism to derive client-specific interpolation coefficients between the global and local models, thereby preserving global attack-detection knowledge while still allowing beneficial local specialization. Through extensive experiments on the CICIoT2023 dataset under heterogeneous client distributions and OOD stress-test settings, we show that FBID improves individual client OOD Detection Rate (DR) by up to 7.66% and F1-Score (F1) by up to 5.08% (relative) over the strongest stable baseline, while also improving robustness to previously unseen attack classes.
