LIGHTWEIGHT FEDERATED LEARNING  FOR GATEWAY-LEVEL DDoS DETECTION  ON RESOURCE-CONSTRAINED IoT DEVICES

Le Ngoc Lanh; Chu Ba Thanh; Dao Thi Le Thuy

Le Ngoc Lanh Faculty of Information Technology, Hung Yen University of Technology and Education
Chu Ba Thanh Faculty of Information Technology, Hung Yen University of Technology and Education
Dao Thi Le Thuy Faculty of Information Technology, HaNoi University of Transport and Communications

Keywords: IoT security, DDoS detection, federated learning, edge computing, intrusion detection systems

Abstract

The rapid proliferation of Internet of Things (IoT) systems has significantly expanded the attack surface of modern networks, making distributed denial-of-service (DDoS) attacks a critical threat. Conventional intrusion detection systems are typically trained in a centralized manner, requiring raw traffic data collection from distributed gateways, which raises privacy concerns and incurs substantial communication overhead. To address these limitations, this paper proposes a lightweight federated learning (FL) framework for gateway-level DDoS detection in resource-constrained IoT environments. The framework is evaluated using three lightweight models, namely LRNet-Lite, MLPNet-Lite, and TabResNet
Lite, on the CICIoT2023 dataset deployed across a real cluster of ten Raspberry Pi 4 devices under both IID and non-IID data distributions. Experimental results show that the proposed FL framework achieves macro F1-scores of 91-92% under IID conditions and 88-89% under non-IID conditions, while maintaining inference latency below 5 ms per sample on edge devices. Furthermore, the results highlight the trade-off between model complexity and deployment cost in terms of computation, communication, and real-time performance. These findings demonstrate that lightweight federated learning provides an effective and privacy-preserving solution for practical DDoS detection at IoT gateways.

References

Gartner, “Forecast: Internet of Things - Endpoints and Associated Services, Worldwide, 2020-2025,”

Gartner Research, 2021.

A. Abualhassan, I. Rashid, F. Binbesh, and M. Imam, “DDoS Attack Detection in IoT: A Comparative

Resource and Performance Analysis of Deep Learning and Machine Learning Models,” IEEE Access,

doi: 10.1109/ACCESS.2025.3583855.

M. N. A. Ramadan, M. A. H. Ali, S. Y. Khoo, and M. Alkhedher, “Federated Learning and TinyML

on IoT Edge Devices: Challenges, Advances, and Future Directions,” ICT Express, vol. 11, no. 4, pp.

-768, 2025. doi: 10.1016/j.icte.2025.06.008.

A. Aljuhani, “Machine Learning Approaches for Combating Distributed Denial of Service Attacks

in Modern Networking Environments,” IEEE Access, vol. 9, pp. 42236-42259, 2021. doi: 10.1109/

ACCESS.2021.3062909.

A. Khraisat, A. Alazab, M. Alazab, A. Obeidat, S. Singh, and T. Jan, “Federated Learning for Intrusion

Detection in IoT Environments: A Privacy-Preserving Strategy,” Discover Internet of Things, vol. 5,

no. 72, 2025. doi: 10.1007/s43926-025-00169-7.

Y. Alhasawi and S. Alghamdi, “Federated Learning for Decentralized DDoS Attack Detection in IoT

Networks,” IEEE Access, vol. 12, pp. 42357-42372, 2024. doi: 10.1109/ACCESS.2024.3378727.

E. Dritsas and M. Trigka, “Federated Learning for IoT: A Survey of Techniques, Challenges, and Appli

cations,” Journal of Sensor and Actuator Networks, vol. 14, no. 9, 2025. doi: 10.3390/jsan14010009.

E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, “CICIoT2023: A

Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment,” Sensors, vol. 23,

no. 5941, 2023. doi: 10.3390/s23135941.

N. Albanbay, Y. Tursynbek, K. Graffi, R. Uskenbayeva, Z. Kalpeyeva, Z. Abilkaiyr, and Y. Ayapov,

“Federated Learning-Based Intrusion Detection in IoT Networks: Performance Evaluation and Data Scaling

Study,” Journal of Sensor and Actuator Networks, vol. 14, no. 78, 2025. doi: 10.3390/jsan14040078.

A. Almadhor, A. Altalbe, I. Bouazzi, A. Al Hejaili, and N. Kryvinska, “Strengthening Network DDoS

Attack Detection in Heterogeneous IoT Environment with Federated XAI Learning Approach,”

Scientific Reports, vol. 14, art. 24322, 2024. doi: 10.1038/s41598-024-76016-6.

B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-Efficient

Learning of Deep Networks from Decentralized Data,” in Proc. AISTATS, 2017, pp. 1273-1282.

T. Li, A. K. Sahu, A. Talwalkar, and V. Smith, “Federated Optimization in Heterogeneous Networks,”

in Proc. MLSys, 2020.

A. Khraisat, A. Alazab, S. Singh, T. Jan, and A. Gomez, “Survey on Federated Learning for Intrusion

Detection System: Concept, Architectures, Aggregation Strategies, Challenges, and Future Directions,”

ACM Computing Surveys, vol. 57, no. 1, art. 7, 2024. doi: 10.1145/3687124.

A. Belenguer, J. A. Pascual, J. Navaridas, et al., “A Review of Federated Learning Applications

in Intrusion Detection Systems,” Computer Networks, vol. 248, art. 111023, 2025. doi: 10.1016/j.

comnet.2024.111023.

H. Zhang, J. Ye, W. Huang, X. Liu, and J. Gu, “Survey of Federated Learning in Intrusion Detection,”

Journal of Parallel and Distributed Computing, vol. 195, art. 104976, 2025. doi: 10.1016/j.

jpdc.2024.104976.

H. U. Manzoor, A. Shabbir, A. Chen, D. Flynn, and A. Zoha, “A Survey of Security Strategies in

Federated Learning: Defending Models, Data, and Privacy,” Future Internet, vol. 16, no. 374, 2024.

doi: 10.3390/fi16100374.