A Comparative Analysis of Federated and Centralized Machine Learning for Intrusion Detection in IoT

The Internet of Things (IoT) plays a pivotal role in connecting diverse, resource-constrained, and communication-capable smart devices across various domains, including smart cities, e-health systems, and wireless communications. However, the inherent security vulnerabilities in many IoT devices pose significant threats to the overall IoT infrastructure. To mitigate these risks, traditional centralized learning (CL) approaches, which involve collecting and processing data in a central server, are increasingly employing machine learning (ML) and deep learning (DL) techniques for intrusion detection systems (IDS) in IoT environments. However, this approach has raised privacy, latency, and scalability concerns. Federated Learning (FL) offers a decentralized alternative, but its application in the context of IoT-based IDS has not been comprehensively explored. Several studies have compared these approaches, but they tend to focus on specific metrics such as convergence, and lack a comprehensive examination of their application in IoT-based IDS. The findings of this work demonstrate that FL consistently outperforms CL in terms of accuracy, achieving a remarkable 99% accuracy compared to CL's peak of 93%. Moreover, FL also exhibits less overfitting and more stable test loss. Furthermore, FL converges at a slower pace than CL, but it can achieve comparable training loss levels with the incorporation of additional training epochs or advanced optimization techniques. Overall, the study concludes that FL is a more accurate and robust choice for intrusion detection in the IoT context, with superior generalization capabilities compared to CL. However, it is essential to consider specific performance metrics like precision, recall, and F1-score when selecting the most suitable approach, as there are trade-offs to be considered based on task requirements.