Exploring Federated Deep Learning for
Internet of Things Cyberattacks
Abderahmane Hamdouchi
Vanguard Center, Mohammed VI Polytechnic University
Benguerir, Morocco
Ali Idri
Data and Software Sciences Research Laboratory
ENSIAS, Mohammed V University, Rabat, Morocco
Faculty of Medical Sciences, Mohammed VI Polytechnic University
Benguerir, Morocco
Abstract
The Internet of Things (IoT) connects billions of devices that operate autonomously, increasing the risk of cyber threats, such as theft and manipulation of personal data. This has increased interest in utilizing deep learning (DL) methods to develop intrusion detection systems (IDS). In general, DL-based IDS rely on centralized approaches, which require IoT devices to transmit data to central servers for analysis. However, these centralized methods raise privacy concerns, prompting the adoption of federated learning (FL) as a promising alternative. This paper evaluates and compares various FL configurations using dense neural networks (DNNs) and convolutional neural networks (CNNs) as base models. The research explores three aggregation methods (FedAVG, FedPROX and FedSGD), three device counts (5, 15 and 30), two data setups (raw and balanced) and two feature selection methods (analysis of variance and chi-squared) with two feature thresholds (50% and 100%). The evaluation was conducted on the NF-ToN-IoT-v2 and NF-BoT-IoT-v2 datasets, using the Scott–Knott test and the Borda count method to analyze 144 FL configurations. The results indicate that FedAVG and FedPROX outperform other aggregation methods, with DNNs identified as the most effective base model for attack detection in FL environments. The top-performing models, using only 17 features, were DNN_R50_PROX_30 (accuracy of 97.80%) and CNN_R50_PROX_5 (accuracy of 99.87%) for NF-BoT-IoT-v2 and NF-ToN-IoT-v2, respectively.
Keywords: intrusion detection system; federated learning; deep learning; NetFlow; IoT; cybersecurity
Cite this publication as:
A. Hamdouchi and A. Idri, “Exploring Federated Deep Learning for Internet of Things Cyberattacks,” Complex Systems, 34(4), 2026 pp. 509–542.
https://doi.org/10.25088/ComplexSystems.34.4.509
