Lightweight Federated Intrusion Detection System for Resource Constrained IoT Networks Using Edge-Assisted Learning

Abstract

The rapid growth of the Internet of Things (IoT) has expanded the attack surface, while many endpoints operate on microcontroller-class hardware with tight limits on CPU, memory and energy, making conventional intrusion detection systems (IDS) difficult to deploy. This work proposes and evaluates a lightweight federated intrusion detection system (LF-IDS) that enables accurate, privacy-preserving intrusion detection on resource-constrained IoT devices through edge-assisted learning. The architecture proposed will be an integration of a small 1D-CNN student on the IoT node and a more profound teacher on the edge. Pruning and 8-bit quantization of the student model are done in a structured manner to the original and result in 132 kB of the student model but with the same discriminative capacity. Gradient sparsification (top-10%) and hierarchical edge aggregation is a federated learning that has a proximal goal to train the IDS on non-IID Bot-IoT-like, NSL-KDD-like and TON_IoT-like datasets. The latency, communication cost and energy are tested on an emulated ARM Cortex-M4-based platform.LF-IDS obtained an accuracy of 98.3, 96.8 and 95.5 and macro F1-scores of up to 0.979 and a false positive of less than 3 percent in the three datasets. Latency on-device inference was 3.4 ms/flow and energy was 0.26 mJ/inference, which were both well within 256kB RAM. The compression and sparsification pipeline proposed in comparison with dense 32-bit federated updates decreased uplink communication per client per round, by up to 640 kB to 52 kB (91.9% reduction) without significantly affecting the accuracy.The findings indicate that co-designed lightweight models and edge-assisted federated learning can deliver high-quality intrusion detection while remaining compatible with the stringent resource budgets of large-scale IoT deployments.