Comparative Analysis of Centralized and Federated Intrusion Detection in IoT-Enabled Cyber-Physical Systems Under Data and Label-Skew

Cyber-Physical Systems (CPS) increasingly leverage Internet of Things (IoT) technologies to enable seamless communication and control across distributed devices. However, the decentralized and heterogeneous nature of IoT-enabled CPS increases their susceptibility to cyberattacks, including unauthorized access and probing attacks. Intrusion Detection Systems (IDS) in CPS commonly employ machine learning (ML) and deep learning (DL) models, typically trained in centralized learning (CL) or federated learning (FL) settings. Both approaches, however, face significant challenges due to the non-independent and identically distributed (non-IID) nature of IoT data, particularly under data and label skew conditions, which adversely affect model convergence and detection performance. While existing studies have primarily focused on data skew, the combined impact of data and label skew remains underexplored. Moreover, prior evaluations have relied on limited performance metrics, providing an incomplete understanding of learning behavior and system robustness. This study addresses these gaps through a comprehensive evaluation of CL and FL for IDS in IoT-enabled CPS under both IID and non-IID conditions, with an emphasis on data and label skew scenarios. Performance is assessed using an extended set of metrics, including accuracy, precision, recall, F1-score, training loss, test loss, and client-level fairness indicators such as F1-score variance and fairness gap (ΔF1-score) across clients. Experimental results show FL outperforms CL in IID settings with better accuracy and stability. In non-IID environments, FL is vulnerable, especially with label skew, leading to poor convergence, lower accuracy, and more client disparity, even with complex models. While FL handles data skew moderately, it struggles with label imbalance and client dropout. These findings highlight limitations of standard FL in heterogeneous IoT deployments and emphasize the need for fairness-aware, client-adaptive learning for robust intrusion detection in real-world CPS.