International Journal of Science, Engineering and TechnologyAuthors: Research Scholar Sujata Pattnaik, Dr. Ridhika Sidhi
Abstract: Federated learning (FL) lets Internet of Things (IoT) devices, gateways and edge nodes train a shared intrusion detection model without moving raw traffic to a central server. In practice, however, IoT clients hold very different traffic: a smart home, a factory and a hospital differ in data volume, attack mix, resources and availability. Many federated intrusion detection studies evaluate under uniform random splits, which hides how the global model behaves under such heterogeneity. This paper proposes an evaluation protocol for federated intrusion detection that makes client heterogeneity an explicit, controlled variable. Label skew is generated with a Dirichlet distribution, quantity skew with a log-normal size model, and availability through participation and dropout rates. A simulation of the partitioning procedure shows that the concentration parameter α spans the full range from near-IID clients (mean Jensen–Shannon divergence ≈ 0.001 bits at α = 100) to clients dominated by one or two classes (≈ 0.39 bits and 1.7 effective classes at α = 0.1 with ten clients). The protocol pairs global macro-F1 with client-level measures—worst-client F1 and dispersion—and compares a centralised baseline, FedAvg and FedProx under identical splits, providing a reproducible basis for judging federated IDS under realistic IoT conditions.
