FEDERATED ANOMALY DETECTION FOR IDENTIFYING ZERO-DAY INTRUSIONS IN IOT NETWORKS

Abstract

The rapid expansion of Internet of Things (IoT) networks has increased the attack surface for cyber threats, particularly zero-day intrusions that remain undetected by traditional signature-based security systems. This paper presents a federated learning and anomaly detection framework for identifying zero-day intrusion patterns in distributed IoT environments without requiring raw data to be centralized. The proposed approach enables multiple IoT clients to collaboratively train an intrusion detection model while preserving data privacy and reducing communication overhead. An anomaly detection layer is integrated with the federated model to identify previously unseen attack behaviours by learning deviations from normal network traffic patterns. Experimental results demonstrate that the proposed framework improves detection accuracy, F1-score, and area under the ROC curve compared with centralized baseline and standalone anomaly detection models. The model also maintains stable performance across heterogeneous IoT clients, showing its suitability for real-world distributed network environments. The findings suggest that federated learning combined with anomaly detection can provide a scalable, privacy-preserving, and adaptive solution for zero-day intrusion detection in IoT networks.