DT-FedLite: A Drift-Triggered Federated Lightweight Temporal Convolution–Attention Network with Warm-Start Hummingbird Search for Privacy-Preserving Threat Detection in Streaming IoT Wireless Networks
Article Sidebar
Main Article Content
Abstract
Threat detectors deployed across Internet of Things wireless networks face three coupled difficulties: traffic and attack behaviour change continuously, raw telemetry cannot be centralised without exposing device and user information, and gateways offer only a few megabytes of memory and milliseconds of compute per decision. This paper presents DT-FedLite, a federated framework that addresses the three difficulties jointly. Each edge gateway runs a lightweight temporal convolution–attention network that combines depthwise-separable dilated causal convolutions with linear-complexity temporal attention, totalling 38.6 thousand parameters and 41.3 kilobytes after 8-bit quantisation. A dual-signal drift monitor, coupling a Page–Hinkley test on delayed-label loss with an unsupervised embedding-shift statistic, replaces fixed-period federation by event-driven rounds that fire only when the population-weighted drift score crosses a threshold. Client updates are trained with differentially private stochastic gradient descent, quantised, securely aggregated, and weighted by drift severity. Hyper-parameters are re-tuned after each drift episode by a warm-start artificial hummingbird algorithm that seeds its population and visit table from an archive of previously elite configurations. On streaming replays of CICIoT2023, Edge-IIoTset and AWID3 with injected sudden, gradual and recurring drift, DT-FedLite attains macro-F1 scores of 96.21%, 97.48% and 95.36% at a window-level privacy budget of ε = 3.2, recovers from drift within 8.0 windows compared with 25.7 for periodic federation, reduces uplink traffic by 90.0%, re-tunes hyper-parameters with 69% fewer fitness evaluations than a cold-start search, and classifies a window in 0.58 milliseconds on a Raspberry Pi 4 gateway.
Article Details
Section
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
All articles published in VTIP-JMRR are made freely available under the Creative Commons Attribution 4.0 International License (CC BY 4.0). Under this license, others may freely share, distribute, and adapt the published work, provided appropriate credit is given to the original authors.
By signing the copyright form, the author(s) warrant and represent that:
✓ The manuscript is original and has not been published previously in any journal, conference, or book (in whole or in part).
✓ The manuscript is not currently under consideration for publication elsewhere.
✓ All authors have read and approved the final manuscript and have agreed to this copyright transfer.
✓ The manuscript does not infringe upon any existing copyright, trademark, patent, or other intellectual property right of any third party.
✓ All data, figures, and tables presented are accurate, authentic, and have not been fabricated or falsified.
✓ Proper permissions have been obtained for any third-party material (images, figures, tables, text) included in the manuscript.
✓ The work complies with all applicable ethical guidelines, including those related to human and animal research.
✓ All sources of funding and conflicts of interest have been disclosed in the manuscript.
How to Cite
References
[1] Ferrag, M. A., Maglaras, L., Moschoyiannis, S., & Janicke, H. (2020). Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study. Journal of Information Security and Applications, 50, 102419.
[2] Kolias, C., Kambourakis, G., Stavrou, A., & Gritzalis, S. (2016). Intrusion detection in 802.11 networks: Empirical evaluation of threats and a public dataset. IEEE Communications Surveys & Tutorials, 18(1), 184–208. https://doi.org/10.1109/COMST.2015.2402161
[3] Gama, J., Žliobaitė, I., Bifet, A., Pechenizkiy, M., & Bouchachia, A. (2014). A survey on concept drift adaptation. ACM Computing Surveys, 46(4), Article 44. https://doi.org/10.1145/2523813
[4] Lu, J., Liu, A., Dong, F., Gu, F., Gama, J., & Zhang, G. (2019). Learning under concept drift: A review. IEEE Transactions on Knowledge and Data Engineering, 31(12), 2346–2363. https://doi.org/10.1109/TKDE.2018.2876857
[5] McMahan, B., Moore, E., Ramage, D., Hampson, S., & Agüera y Arcas, B. (2017). Communication-efficient learning of deep networks from decentralized data. In Proceedings of the 20th International Conference on Artificial Intelligence and Statistics (AISTATS), PMLR 54 (pp. 1273–1282).
[6] Kairouz, P., McMahan, H. B., Avent, B., Bellet, A., Bennis, M., Bhagoji, A. N., et al. (2021). Advances and open problems in federated learning. Foundations and Trends in Machine Learning, 14(1–2), 1–210. https://doi.org/10.1561/2200000083
[7] Rahman, S. A., Tout, H., Talhi, C., & Mourad, A. (2020). Internet of Things intrusion detection: Centralized, on-device, or federated learning? IEEE Network, 34(6), 310–317.
[8] Campos, E. M., Saura, P. F., González-Vidal, A., Hernández-Ramos, J. L., Bernabé, J. B., Baldini, G., & Skarmeta, A. (2022). Evaluating federated learning for intrusion detection in Internet of Things: Review and challenges. Computer Networks, 203, 108661.
[9] Khodak, M., Tu, R., Li, T., Li, L., Balcan, M.-F., Smith, V., & Talwalkar, A. (2021). Federated hyperparameter tuning: Challenges, baselines, and connections to weight-sharing. In Advances in Neural Information Processing Systems 34 (NeurIPS 2021).
[10] Bai, S., Kolter, J. Z., & Koltun, V. (2018). An empirical evaluation of generic convolutional and recurrent networks for sequence modeling (arXiv:1803.01271). arXiv. https://arxiv.org/abs/1803.01271
[11] Howard, A. G., Zhu, M., Chen, B., Kalenichenko, D., Wang, W., Weyand, T., Andreetto, M., & Adam, H. (2017). MobileNets: Efficient convolutional neural networks for mobile vision applications (arXiv:1704.04861). arXiv. https://arxiv.org/abs/1704.04861
[12] Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016). Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (pp. 308–318). https://doi.org/10.1145/2976749.2978318
[13] Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017). Practical secure aggregation for privacy-preserving machine learning. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (pp. 1175–1191). https://doi.org/10.1145/3133956.3133982
[14] Zhao, W., Wang, L., & Mirjalili, S. (2022). Artificial hummingbird algorithm: A new bio-inspired optimizer with its engineering applications. Computer Methods in Applied Mechanics and Engineering, 388, 114194. https://doi.org/10.1016/j.cma.2021.114194
[15] Neto, E. C. P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., & Ghorbani, A. A. (2023). CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment. Sensors, 23(13), 5941. https://doi.org/10.3390/s23135941
[16] Ferrag, M. A., Friha, O., Hamouda, D., Maglaras, L., & Janicke, H. (2022). Edge-IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning. IEEE Access, 10, 40281–40306. https://doi.org/10.1109/ACCESS.2022.3165809
[17] Chatzoglou, E., Kambourakis, G., & Kolias, C. (2021). Empirical evaluation of attacks against IEEE 802.11 enterprise networks: The AWID3 dataset. IEEE Access, 9, 34188–34205.
[18] Moustafa, N. (2021). A new distributed architecture for evaluating AI-based security systems at the edge: Network TON_IoT datasets. Sustainable Cities and Society, 72, 102994. https://doi.org/10.1016/j.scs.2021.102994
[19] Lea, C., Flynn, M. D., Vidal, R., Reiter, A., & Hager, G. D. (2017). Temporal convolutional networks for action segmentation and detection. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 156–165).
[20] Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, Ł., & Polosukhin, I. (2017). Attention is all you need. In Advances in Neural Information Processing Systems 30 (NIPS 2017) (pp. 5998–6008).
[21] Katharopoulos, A., Vyas, A., Pappas, N., & Fleuret, F. (2020). Transformers are RNNs: Fast autoregressive transformers with linear attention. In Proceedings of the 37th International Conference on Machine Learning (ICML), PMLR 119 (pp. 5156–5165).
[22] Jacob, B., Kligys, S., Chen, B., Zhu, M., Tang, M., Howard, A., Adam, H., & Kalenichenko, D. (2018). Quantization and training of neural networks for efficient integer-arithmetic-only inference. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 2704–2713).
[23] Mirsky, Y., Doitshman, T., Elovici, Y., & Shabtai, A. (2018). Kitsune: An ensemble of autoencoders for online network intrusion detection. In Proceedings of the Network and Distributed System Security Symposium (NDSS 2018). Internet Society.
[24] Li, T., Sahu, A. K., Zaheer, M., Sanjabi, M., Talwalkar, A., & Smith, V. (2020). Federated optimization in heterogeneous networks. Proceedings of Machine Learning and Systems, 2, 429–450.
[25] Karimireddy, S. P., Kale, S., Mohri, M., Reddi, S., Stich, S., & Suresh, A. T. (2020). SCAFFOLD: Stochastic controlled averaging for federated learning. In Proceedings of the 37th International Conference on Machine Learning (ICML), PMLR 119 (pp. 5132–5143).
[26] Nguyen, T. D., Marchal, S., Miettinen, M., Fereidooni, H., Asokan, N., & Sadeghi, A.-R. (2019). DÏoT: A federated self-learning anomaly detection system for IoT. In Proceedings of the 39th IEEE International Conference on Distributed Computing Systems (ICDCS) (pp. 756–767).
[27] Mothukuri, V., Khare, P., Parizi, R. M., Pouriyeh, S., Dehghantanha, A., & Srivastava, G. (2022). Federated-learning-based anomaly detection for IoT security attacks. IEEE Internet of Things Journal, 9(4), 2545–2554.
[28] Gama, J., Medas, P., Castillo, G., & Rodrigues, P. (2004). Learning with drift detection. In Advances in Artificial Intelligence – SBIA 2004 (Lecture Notes in Computer Science, Vol. 3171, pp. 286–295). Springer.
[29] Page, E. S. (1954). Continuous inspection schemes. Biometrika, 41(1/2), 100–115.
[30] Bifet, A., & Gavaldà, R. (2007). Learning from time-changing data with adaptive windowing. In Proceedings of the 2007 SIAM International Conference on Data Mining (pp. 443–448).
[31] Canonaco, G., Bergamasco, A., Mongelluzzo, A., & Roveri, M. (2021). Adaptive federated learning in presence of concept drift. In Proceedings of the International Joint Conference on Neural Networks (IJCNN) (pp. 1–7). IEEE.
[32] Jothimurugesan, E., Hsieh, K., Wang, J., Joshi, G., & Gibbons, P. B. (2023). Federated learning under distributed concept drift. In Proceedings of the 26th International Conference on Artificial Intelligence and Statistics (AISTATS), PMLR 206.
[33] Kennedy, J., & Eberhart, R. (1995). Particle swarm optimization. In Proceedings of ICNN'95 – International Conference on Neural Networks (Vol. 4, pp. 1942–1948). IEEE.
[34] Mirjalili, S., Mirjalili, S. M., & Lewis, A. (2014). Grey wolf optimizer. Advances in Engineering Software, 69, 46–61. https://doi.org/10.1016/j.advengsoft.2013.12.007
[35] Mirjalili, S., & Lewis, A. (2016). The whale optimization algorithm. Advances in Engineering Software, 95, 51–67. https://doi.org/10.1016/j.advengsoft.2016.01.008
[36] Bergstra, J., Bardenet, R., Bengio, Y., & Kégl, B. (2011). Algorithms for hyper-parameter optimization. In Advances in Neural Information Processing Systems 24 (NIPS 2011) (pp. 2546–2554).
[37] Feurer, M., Springenberg, J. T., & Hutter, F. (2015). Initializing Bayesian hyperparameter optimization via meta-learning. In Proceedings of the AAAI Conference on Artificial Intelligence, 29(1) (pp. 1128–1135).
[38] Wolpert, D. H., & Macready, W. G. (1997). No free lunch theorems for optimization. IEEE Transactions on Evolutionary Computation, 1(1), 67–82.
[39] Hsu, T.-M. H., Qi, H., & Brown, M. (2019). Measuring the effects of non-identical data distribution for federated visual classification (arXiv:1909.06335). arXiv. https://arxiv.org/abs/1909.06335
[40] Lin, T.-Y., Goyal, P., Girshick, R., He, K., & Dollár, P. (2017). Focal loss for dense object detection. In Proceedings of the IEEE International Conference on Computer Vision (ICCV) (pp. 2980–2988).
[41] Cui, Y., Jia, M., Lin, T.-Y., Song, Y., & Belongie, S. (2019). Class-balanced loss based on effective number of samples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (pp. 9268–9277).
[42] Mironov, I. (2017). Rényi differential privacy. In Proceedings of the IEEE 30th Computer Security Foundations Symposium (CSF) (pp. 263–275).
[43] Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017). Membership inference attacks against machine learning models. In Proceedings of the 2017 IEEE Symposium on Security and Privacy (SP) (pp. 3–18).
[44] Chow, T., Raza, U., Mavromatis, I., & Khan, A. (2023). FLARE: Detection and mitigation of concept drift for federated learning based IoT deployments (arXiv:2305.08504). arXiv. https://arxiv.org/abs/2305.08504
[45] Rehman, M. U., Bahsi, H., & Kalakoti, R. (2026). Incremental federated learning for intrusion detection in IoT networks under evolving threat landscape (arXiv:2603.10776). arXiv. https://arxiv.org/abs/2603.10776
[46] Papernot, N., & Steinke, T. (2022). Hyperparameter tuning with Rényi differential privacy. In Proceedings of the International Conference on Learning Representations (ICLR 2022). https://arxiv.org/abs/2110.03620
[47] Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3–4), 211–407. https://doi.org/10.1561/0400000042