Incremental Federated Learning for Intrusion Detection in IoT Networks under Evolving Threat Landscape

• URL: http://arxiv.org/abs/2603.10776v2
• Date: Thu, 12 Mar 2026 17:31:14 GMT
• Title: Incremental Federated Learning for Intrusion Detection in IoT Networks under Evolving Threat Landscape
• Abstract summary: This study provides a comprehensive performance analysis of incremental federated learning in enhancing the long term performance of non stationary IDS models in IoT networks.<n>Our results show that cumulative incremental learning and representative learning provide the most stable performance under drift.<n>The study aims to inform the development of more resilient IDS solutions considering the resource constraints in IoT devices.
• Score: 0.5161531917413708
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The expansion of Internet of Things (IoT) devices has increased the attack surface of networks, necessitating a robust and adaptive intrusion detection systems. Machine learning based systems have been considered promising in enhancing the detection performance. Federated learning settings enabled us to train models from network intrusion data collected from clients in a privacy preserving manner. However, the effectiveness of these systems can degrade over time due to concept drift, where patterns in data evolve as attackers develop new techniques. Realistic detection models should be non-stationary, so they can be continuously updated with new intrusion data while maintaining their detection capability for older data. As IoT environments are resource constrained, updates should consume minimal computational resources. This study provides a comprehensive performance analysis of incremental federated learning in enhancing the long term performance of non stationary IDS models in IoT networks. Specifically, we propose LSTM models within a federated learning setting to evaluate incremental learning approaches that utilize data and model-based measures against catastrophic learning under drift conditions. Using the CICIoMT2024 dataset, which includes various attack variants across five major categories, we conduct both binary and multiclass classification to provide a granular analysis of the intrusion detection task. Our results show that cumulative incremental learning and representative learning provide the most stable performance under drift, while retention-based methods offer a strong accuracy and latency trade off. The study offers new insights into the interplay between training strategy performance and latency in dynamic IoT environments, aiming to inform the development of more resilient IDS solutions considering the resource constraints in IoT devices.

Related papers

• Robustness Analysis of Machine Learning Models for IoT Intrusion Detection Under Data Poisoning Attacks [0.0]
  This study evaluates the susceptibility of four widely used classifiers, Random Forest, Gradient Boosting Machine, Logistic Regression, and Deep Neural Network models, against multiple poisoning strategies.<n>Results show that while ensemble-based models exhibit comparatively stable performance, Logistic Regression and Deep Neural Networks suffer degradation of up to 40% under label manipulation and outlier-based attacks.<n>Findings highlight the need for adversarially robust training, continuous anomaly monitoring, and feature-level validation within operational Network Intrusion Detection Systems.
  arXiv  Detail & Related papers  (2026-04-15T21:36:44Z)
• Unknown Attack Detection in IoT Networks using Large Language Models: A Robust, Data-efficient Approach [5.0363184281919215]
  Existing machine learning approaches rely on large labeled datasets, payload inspection, or closed-set classification.<n>We propose SiamXBERT, a robust and data-efficient Siamese meta-learning framework empowered by a transformer-based language model for unknown attack detection.<n>We show that SiamXBERT consistently outperforms state-of-the-art baselines under both within-dataset and cross-dataset settings.
  arXiv  Detail & Related papers  (2026-02-12T17:15:39Z)
• Benchmarking Machine Learning Models for IoT Malware Detection under Data Scarcity and Drift [0.5735035463793007]
  Internet of Things (IoT) devices are prime targets for cyberattacks and malware applications.<n>Machine learning (ML) offers a promising approach to automated malware detection and classification.<n>This study investigates the effectiveness of four supervised learning models for malware detection and classification.
  arXiv  Detail & Related papers  (2026-01-26T17:59:33Z)
• Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework [60.72591149679355]
  The rapid expansion of low-altitude economy Internet of Things (LAE-IoT) networks has created unprecedented security challenges.<n>Traditional intrusion detection systems fail to tackle the unique characteristics of aerial IoT environments.<n>We introduce a large language model (LLM)-enabled agentic AI framework for enhancing intrusion detection in LAE-IoT networks.
  arXiv  Detail & Related papers  (2026-01-25T12:47:25Z)
• Adaptive Intrusion Detection System Leveraging Dynamic Neural Models with Adversarial Learning for 5G/6G Networks [2.062593640149623]
  This paper presents an advanced IDS framework that leverages adversarial training and dynamic neural networks in 5G/6G networks.<n>Unlike conventional models, which require costly retraining to update knowledge, the proposed framework integrates incremental learning algorithms, reducing the need for frequent retraining.
  arXiv  Detail & Related papers  (2025-12-11T13:40:37Z)
• Generative Model-Aided Continual Learning for CSI Feedback in FDD mMIMO-OFDM Systems [44.15961826013248]
  We propose a generative adversarial network (GAN)-based learning approach for CSI feedback.<n>By using a GAN generator as a memory unit, our method preserves knowledge from past environments and ensures consistently high performance.
  arXiv  Detail & Related papers  (2025-11-23T10:25:23Z)
• Adaptive Intrusion Detection for Evolving RPL IoT Attacks Using Incremental Learning [0.13999481573773068]
  We investigate incremental learning as a practical and adaptive strategy for intrusion detection in RPL-based networks.<n>Our analysis highlights that incremental learning restores detection performance on new attack classes and mitigates catastrophic forgetting of previously learned threats.
  arXiv  Detail & Related papers  (2025-11-14T16:35:48Z)
• FLARE: Feature-based Lightweight Aggregation for Robust Evaluation of IoT Intrusion Detection [0.0]
  Internet of Things (IoT) devices have expanded the attack surface, necessitating efficient intrusion detection systems (IDSs) for network protection.<n>This paper presents FLARE, a feature-based lightweight aggregation for robust evaluation of IoT intrusion detection.<n>We employ four supervised learning models and two deep learning models to classify attacks in IoT IDS.
  arXiv  Detail & Related papers  (2025-04-21T18:33:53Z)
• Learn while Unlearn: An Iterative Unlearning Framework for Generative Language Models [52.40798352740857]
  We introduce the Iterative Contrastive Unlearning (ICU) framework, which consists of three core components.<n>A Knowledge Unlearning Induction module targets specific knowledge for removal using an unlearning loss.<n>A Contrastive Learning Enhancement module preserves the model's expressive capabilities against the pure unlearning goal.<n>An Iterative Unlearning Refinement module dynamically adjusts the unlearning process through ongoing evaluation and updates.
  arXiv  Detail & Related papers  (2024-07-25T07:09:35Z)
• Diffusion-Based Neural Network Weights Generation [80.89706112736353]
  D2NWG is a diffusion-based neural network weights generation technique that efficiently produces high-performing weights for transfer learning. Our method extends generative hyper-representation learning to recast the latent diffusion paradigm for neural network weights generation. Our approach is scalable to large architectures such as large language models (LLMs), overcoming the limitations of current parameter generation techniques.
  arXiv  Detail & Related papers  (2024-02-28T08:34:23Z)
• Effective Intrusion Detection in Heterogeneous Internet-of-Things Networks via Ensemble Knowledge Distillation-based Federated Learning [52.6706505729803]
  We introduce Federated Learning (FL) to collaboratively train a decentralized shared model of Intrusion Detection Systems (IDS) FLEKD enables a more flexible aggregation method than conventional model fusion techniques. Experiment results show that the proposed approach outperforms local training and traditional FL in terms of both speed and performance.
  arXiv  Detail & Related papers  (2024-01-22T14:16:37Z)
• Visual Prompting Upgrades Neural Network Sparsification: A Data-Model Perspective [64.04617968947697]
  We introduce a novel data-model co-design perspective: to promote superior weight sparsity. Specifically, customized Visual Prompts are mounted to upgrade neural Network sparsification in our proposed VPNs framework.
  arXiv  Detail & Related papers  (2023-12-03T13:50:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.