Lightweight Federated Intrusion Detection for Campus IoT Networks on CICIoT2023

This dissertation studies whether a lightweight intrusion detection model can be trained collaboratively across the IoT gateways of an engineering campus without moving raw traffic to a central server. A typical Karnataka campus has separate network segments for hostels, laboratories, the library, CCTV and building management, each with cameras, smart plugs, access-control readers and sensors. Pooling all their traffic for training raises privacy, bandwidth and administrative concerns; federated learning (FL) lets each gateway train locally and share only model updates.

Using the public CICIoT2023 dataset from the Canadian Institute for Cybersecurity, I build a centralised baseline and a federated version (FedAvg) of two compact models — a multilayer perceptron and a 1D-CNN — and compare them under IID and non-IID partitions that mimic gateways seeing very different attack mixes. The evaluation reports macro-F1, per-class recall, communication rounds to reach a target F1, bytes transmitted, model size and inference latency on a Raspberry Pi 4, the kind of device that could sit at a gateway.

The implementation uses Python and PyTorch, with the Flower framework as an industry-standard extra for FL simulation. The work extends the Computer Networks & IoT Lab (22SCNL17) and applies the Research Methodology & IPR course (22RMI16) for experimental design, threats to validity and paper writing. All results are produced by the student's own runs; this bundle gives the protocol and empty results tables, not pre-filled numbers.

Abstract

IoT devices on campus networks are frequent targets of botnet recruitment, DDoS, reconnaissance and spoofing attacks. Machine-learning intrusion detection systems (IDS) perform well when trained on pooled traffic, but pooling is often impractical across departments that manage their own networks. This work evaluates federated learning for a lightweight IDS: each simulated campus gateway trains a small neural network on its local share of CICIoT2023, and a coordinator aggregates weights with FedAvg. I compare federated and centralised training under IID and label-skewed non-IID partitions at 2-class, 8-class and 34-class granularity, and measure detection quality, communication cost and edge inference latency.

Introduction

Federated learning, introduced as FedAvg by McMahan et al., keeps data on clients and exchanges only model parameters. For IoT security this is attractive: gateways already see local traffic, and the model can be small enough to run on a single-board computer. The difficulty is statistical heterogeneity — a hostel gateway may see mostly Mirai-style scans while a lab gateway sees brute-force attempts — which slows convergence and can hurt minority classes.

Literature Gap

• Many IDS studies report high accuracy on centralised splits of older datasets, where accuracy hides poor minority-class recall.
• Federated IDS papers often use IID splits or a single granularity, and seldom report communication cost or on-device latency together.
• Gap: a reproducible comparison of centralised vs FedAvg (with FedProx as an extension) on a recent large IoT dataset, under controlled non-IID skew, reporting macro-F1, per-class recall, rounds, bytes and Raspberry Pi latency for models under a fixed size budget.

Proposed Work

• Preprocessing pipeline with leakage-safe splits and class-balanced evaluation sets.
• Two compact models (MLP and 1D-CNN) under a parameter budget.
• FL simulation with 10 gateways, Dirichlet label skew (α ∈ {100, 1.0, 0.3, 0.1}) and partial participation.
• Edge benchmark of exported models on a Raspberry Pi 4.

Feasibility

The dataset is public; PyTorch and Flower are open-source; simulation runs on a single GPU or a CPU workstation; a Raspberry Pi 4 costs a few thousand rupees and is available in most college IoT labs.

Campus IoT networks are segmented across departments, and each segment's gateway sees a different mix of benign and malicious traffic. A centralised IDS requires copying traffic from every segment to one server, which conflicts with data-minimisation expectations under India's Digital Personal Data Protection Act, 2023, consumes backbone bandwidth, and crosses administrative boundaries. Federated learning avoids moving raw data, but its behaviour on realistic, heavily imbalanced and non-IID IoT attack data — particularly for rare attack classes — and its communication and edge-compute costs are not well characterised.

The problem addressed is: How close can a federated, lightweight IDS trained across simulated campus gateways come to a centralised model on CICIoT2023, in macro-F1 and per-class recall, as label skew increases — and at what communication cost and on-device latency?

In scope

• Offline experiments on the published CICIoT2023 CSV feature files; no live capture of campus traffic.
• Two compact neural models plus a random-forest reference; FedAvg and FedProx aggregation.
• Simulated 10-client federation on one machine; optional two-Pi real deployment for latency.
• Metrics: macro-F1, per-class recall, confusion matrices, rounds and bytes, model size, latency.

Out of scope

• Secure aggregation, differential privacy and defences against poisoned clients (discussed as future work).
• Payload inspection or deep-packet inspection.
• Production deployment on the actual campus network.

Research design: quantitative, controlled experimental study with repeated runs (5 seeds per configuration), following the experimental-design and reporting practices taught in 22RMI16.

Research questions

• RQ1: Under IID partitioning, how does FedAvg macro-F1 compare with the centralised model?
• RQ2: How do macro-F1 and minority-class recall degrade as Dirichlet α decreases?
• RQ3: How many rounds and megabytes does FL need to reach a target macro-F1?
• RQ4: Do the models meet an edge budget (target: < 1 MB, < 5 ms per flow batch on a Raspberry Pi 4)?

Evaluation protocol

• Split by capture file where possible, not by random rows, to reduce temporal leakage; fit scalers on training data only.
• Hold out one global balanced test set; every configuration is evaluated on it.
• Report mean ± standard deviation over 5 seeds; compare configurations with a paired Wilcoxon signed-rank test on seed-wise macro-F1.
• Targets (hypotheses, not results): FedAvg within 2 macro-F1 points of centralised at α = 100; the gap widening at α = 0.1; FedProx reducing that gap.