Resilient Federated Ensemble Learning for IoT Intrusion Detection in Adversarial and Imbalanced Environments

Arvind Prasad^1,*, Ibrahim Aljubayri², Mohammad Zubair Khan^3,*, Abdulfattah Noorwali⁴
1 Department of Computer Engineering & Applications, GLA University, Mathura, India
2 Department of Computer Science and Information, Imam Mohammad Ibn Saud Islamic University (IMSIU), Riyadh, Saudi Arabia
3 Faculty of Computer and Information Systems, Islamic University of Madinah, Medina, Saudi Arabia
4 Electrical Engineering Department, Umm Al-Qura University, Makkah, Saudi Arabia
* Corresponding Author: Arvind Prasad. Email: email ; Mohammad Zubair Khan. Email: email
(This article belongs to the Special Issue: Emerging Technologies in Information Security: Modeling, Algorithms, and Applications)

Computer Modeling in Engineering & Sciences https://doi.org/10.32604/cmes.2026.082021

Received 11 March 2026; Accepted 18 May 2026; Published online 11 June 2026

Download PDF

Abstract

Intrusion detection in large-scale IoT deployments becomes particularly challenging during ongoing attack scenarios, where malicious traffic may temporarily dominate benign traffic. In such conditions, streaming network data exhibits severe class imbalance in favor of attack traffic, while device behavior remains heterogeneous, non-identically distributed (non-IID), and temporally evolving. Within federated learning environments, this imbalance can destabilize early aggregation rounds, dominant attack gradients bias the global model, distort decision boundaries, and degrade reliable discrimination of residual benign behavior. Since the server has no access to raw data, these effects can persist across communication rounds if not addressed at initialization. This article addresses the problem of distributed intrusion detection in streaming IoT networks under severe class imbalance and partial adversarial behavior. In ongoing attack scenarios, malicious traffic may dominate streaming observations, creating an inverted imbalance where benign behavior becomes underrepresented. To mitigate these issues, we propose a resilient federated ensemble framework with three key components: a similarity-guided balancing phase that selects a structurally diverse subset of majority-class samples to form a balanced initialization dataset, an incremental ensemble composed of Bernoulli Naïve Bayes, Passive–Aggressive, and SGD classifiers for pre-training over this data to produce a warm-start global model, and an accuracy-gating mechanism that accepts only performance-preserving local updates during online training. The proposed approach is evaluated on flow-level data from the CICIoT2023 benchmark that demonstrated stable client-wise convergence with high accuracy and consistent minority-class discrimination, even under skewed attack-dominant distributions. Under complete label-flipping poisoning, corrupted updates are systematically rejected, preventing global degradation. Ablation analysis confirms that removing structured initialization significantly increases early instability. The results indicate that balanced global conditioning and selective federation are critical for maintaining detection reliability in streaming IoT systems operating under sustained attack conditions.