{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,11,9]],"date-time":"2026-11-09T21:10:35Z","timestamp":1794258635356,"version":"4.9.0"},"reference-count":20,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,9,2]],"date-time":"2026-09-02T00:00:00Z","timestamp":1788307200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,9,2]],"date-time":"2026-09-02T00:00:00Z","timestamp":1788307200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"October University for Modern Sciences and Arts"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Sci Rep"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>\n                    The proliferation of Internet of Things (IoT) devices in smart home environments has dramatically expanded the attack surface for cyber threats, particularly botnet-driven Distributed Denial of Service (DDoS) attacks. Centralized Intrusion Detection Systems (IDS) are ill-suited to this domain because they violate user privacy, introduce single points of failure, and incur prohibitive communication overhead. Federated Learning (FL) offers a compelling privacy-preserving alternative, yet existing FL-based IDS solutions either deploy convolutional or recurrent models in isolation, lack human-interpretable outputs, or neglect real-world deployability constraints. This paper proposes\n                    <jats:italic>FedShield-IDS<\/jats:italic>\n                    , a novel federated intrusion detection framework that integrates a hybrid one-dimensional Convolutional Neural Network with Long Short-Term Memory units to simultaneously capture spatial traffic fingerprints and long-range temporal attack dynamics across IoT edge devices. Model interpretability is addressed through the integration of SHapley Additive exPlanations (SHAP), enabling administrators to receive human-readable justifications for every detected anomaly. The system is trained and evaluated on the large-scale CICIoT2023 dataset, comprising 712,311 flow records spanning eight attack families including DDoS, DoS, Mirai, Reconnaissance, Spoofing, Injection, and Malware. A multi-stage preprocessing pipeline combining infinite-value imputation, logarithmic feature scaling, Min-Max normalization, temporal windowing, and localized SMOTE oversampling is applied within each federated client to address non-IID data and extreme class imbalance. Federated Averaging aggregates encrypted model updates across seven virtual IoT client nodes over five communication rounds without exchanging raw traffic data, under a formal threat model characterizing the system\u2019s adversarial assumptions and data-confidentiality guarantees. Experimental results demonstrate a Mirai F1-score of 0.99, a DDoS precision of 0.97, and a global weighted F1-score of 0.76 across all eight classes. Comprehensive kernel-size, architecture, and preprocessing ablations confirm the necessity of each design choice, and independent cross-dataset evaluation on the Edge-IIoTset benchmark achieves 98.58% accuracy, demonstrating strong generalization beyond CICIoT2023. The framework achieves sub-500\u00a0ms threat mitigation, empirically confirmed via a mitigation-gate threshold sensitivity analysis, and generates SHAP-gated explanations for every alert, bridging the gap between high-accuracy detection and the transparency required for trustworthy smart-home security.\n                  <\/jats:p>","DOI":"10.1038\/s41598-026-67450-9","type":"journal-article","created":{"date-parts":[[2026,9,2]],"date-time":"2026-09-02T17:43:28Z","timestamp":1788371008000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Privacy-preserving intrusion detection in IoT smart homes using a federated hybrid 1D-CNN\u2013LSTM model with explainable AI"],"prefix":"10.1038","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-9375-0617","authenticated-orcid":false,"given":"Ghada","family":"Abdelhady","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Karim Wael","family":"Hussein","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Islam Anwar Ali","family":"Gad","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,9,2]]},"reference":[{"key":"67450_CR1","doi-asserted-by":"publisher","first-page":"186969","DOI":"10.1109\/ACCESS.2020.2977112","volume":"8","author":"K Huang","year":"2020","unstructured":"Huang, K., Zhang, Q., Zhou, C., Xiong, N. & Qin, Y. A low-cost distributed denial-of-service attack architecture: Growth model and optimal design of attack strategy. IEEE Access 8, 186969\u2013186986. https:\/\/doi.org\/10.1109\/ACCESS.2020.2977112 (2020).","journal-title":"IEEE Access"},{"issue":"4","key":"67450_CR2","doi-asserted-by":"publisher","first-page":"78","DOI":"10.3390\/jsan14040078","volume":"14","author":"N Albanbay","year":"2025","unstructured":"Albanbay, N., Balci, M., Orman, M. A., Aksu, F. & Bostanci, Y. Federated learning-based intrusion detection in IoT networks: Performance evaluation and data scaling study. J. Sens. Actuator Netw. 14(4), 78. https:\/\/doi.org\/10.3390\/jsan14040078 (2025).","journal-title":"J. Sens. Actuator Netw."},{"issue":"9","key":"67450_CR3","doi-asserted-by":"crossref","first-page":"4221","DOI":"10.3390\/s23094221","volume":"23","author":"CH De Caldas Filho","year":"2023","unstructured":"De Caldas Filho, C. H. et al. Botnet detection and mitigation model for IoT networks using federated learning. Sensors 23(9), 4221 (2023).","journal-title":"Sensors"},{"key":"67450_CR4","unstructured":"McMahan, H. B., Moore, E., Ramage, D., Hampson, S. & Arcas, B. A. Y. Communication-efficient learning of deep networks from decentralized data, In Proc. 20th Int. Conf. Artificial Intelligence and Statistics (AISTATS), PMLR, pp.\u00a01273\u20131282 (2017)."},{"key":"67450_CR5","doi-asserted-by":"publisher","unstructured":"Blockchain-Enabled Cybersecurity and Data Privacy Solutions for Smart Cities, In Proc. 4th Int. Conf. Emerging Trends in Applied Sciences (ICETAS), (2024). https:\/\/doi.org\/10.1109\/ICETAS62372.2024.11120069","DOI":"10.1109\/ICETAS62372.2024.11120069"},{"key":"67450_CR6","doi-asserted-by":"publisher","unstructured":"Cybersecurity in Location-Based Services: Threats, Impacts, and Mitigation Strategies, In Proc. 4th Int. Conf. Emerging Trends in Applied Sciences (ICETAS), (2024). https:\/\/doi.org\/10.1109\/ICETAS62372.2024.11120213","DOI":"10.1109\/ICETAS62372.2024.11120213"},{"key":"67450_CR7","doi-asserted-by":"publisher","unstructured":"Zhang, J., Chen, M., Shen, S. & Fang, Z. Towards detection of zero-day botnet attack in IoT networks using federated learning, In Proc. IEEE Int. Conf. Communications (ICC), pp.\u00a01\u20137 (2023). https:\/\/doi.org\/10.1109\/ICC45041.2023.10279423","DOI":"10.1109\/ICC45041.2023.10279423"},{"key":"67450_CR8","doi-asserted-by":"crossref","unstructured":"Sun, S., Zhao, Y. & Qin, X. FedMADE: Robust federated learning for intrusion detection in IoT networks using a dynamic aggregation method, arXiv preprint https:\/\/arxiv.org\/abs\/2408.07152 , (2024).","DOI":"10.1007\/978-3-031-75764-8_15"},{"key":"67450_CR9","doi-asserted-by":"crossref","unstructured":"Nguyen, T. D., Marchal, S., Miettinen, M., Fereidooni, H., Asokan, N. & Sadeghi, A.-R. DIoT: A federated self-learning anomaly detection system for IoT, In Proc. IEEE 39th Int. Conf. Distributed Computing Systems (ICDCS), pp.\u00a0756\u2013767 (2019).","DOI":"10.1109\/ICDCS.2019.00080"},{"issue":"3","key":"67450_CR10","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","volume":"17","author":"Y Meidan","year":"2018","unstructured":"Meidan, Y. et al. N-BaIoT: Network-based detection of IoT botnet attacks using deep autoencoders. IEEE Pervasive Comput. 17(3), 12\u201322 (2018).","journal-title":"IEEE Pervasive Comput."},{"issue":"5","key":"67450_CR11","doi-asserted-by":"publisher","first-page":"215","DOI":"10.3390\/info12050215","volume":"12","author":"K Fotiadou","year":"2021","unstructured":"Fotiadou, K. et al. Network traffic anomaly detection via deep learning. Information 12(5), 215 (2021).","journal-title":"Information"},{"key":"67450_CR12","doi-asserted-by":"crossref","unstructured":"da Mata, R. Z. A., de Souza, L. C., Rodrigues, M. F. & Bittencourt, L. F. Hybrid architecture for intrusion prevention and detection in IoT networks, In Proc. Workshop on Communication Networks and Power Systems (WCNPS), pp.\u00a01\u20137 (2021).","DOI":"10.1109\/WCNPS53648.2021.9626246"},{"issue":"1","key":"67450_CR13","doi-asserted-by":"publisher","first-page":"19","DOI":"10.3390\/jsan12020019","volume":"12","author":"RJ Alzahrani","year":"2023","unstructured":"Alzahrani, R. J. & Alzahrani, A. A novel multi-algorithm approach to identify network anomalies in the IoT using fog computing. J. Sens. Actuator Netw. 12(1), 19 (2023).","journal-title":"J. Sens. Actuator Netw."},{"issue":"10","key":"67450_CR14","doi-asserted-by":"publisher","first-page":"1210","DOI":"10.3390\/electronics8111210","volume":"8","author":"A Khraisat","year":"2019","unstructured":"Khraisat, A., Gondal, I., Vamplew, P., Kamruzzaman, J. & Alazab, A. A novel ensemble of hybrid intrusion detection system for detecting Internet of Things attacks. Electronics 8(10), 1210 (2019).","journal-title":"Electronics"},{"key":"67450_CR15","doi-asserted-by":"publisher","first-page":"106790","DOI":"10.1109\/ACCESS.2021.3101188","volume":"9","author":"G de Carvalho Bertoli Jr.","year":"2021","unstructured":"de Carvalho Bertoli, G., Pereira, L. A. Jr., Saotome, O. & dos Santos, A. L. An end-to-end framework for machine learning-based network intrusion detection system. IEEE Access. 9, 106790\u2013106805 (2021).","journal-title":"IEEE Access."},{"issue":"3","key":"67450_CR16","doi-asserted-by":"publisher","DOI":"10.1002\/ett.4150","volume":"32","author":"Z Ahmad","year":"2021","unstructured":"Ahmad, Z., Khan, A. S., Shiang, C. W., Abdullah, J. & Ahmad, F. Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Trans. Emerg. Telecommun. Technol. 32(3), e4150 (2021).","journal-title":"Trans. Emerg. Telecommun. Technol."},{"key":"67450_CR17","doi-asserted-by":"crossref","unstructured":"Azizjon, M., Jumabek, A. & Kim, W. 1D CNN based network intrusion detection with normalization on imbalanced data, In Proc. Int. Conf. Artificial Intelligence in Information and Communication (ICAIIC), pp.\u00a0218\u2013224 (2020).","DOI":"10.1109\/ICAIIC48513.2020.9064976"},{"key":"67450_CR18","doi-asserted-by":"publisher","first-page":"56","DOI":"10.1038\/s42256-019-0138-9","volume":"2","author":"SM Lundberg","year":"2020","unstructured":"Lundberg, S. M. & Lee, S.-I. From local explanations to global understanding with explainable AI for trees. Nature Mach. Intell. 2, 56\u201367 (2020).","journal-title":"Nature Mach. Intell."},{"issue":"14","key":"67450_CR19","doi-asserted-by":"publisher","first-page":"5941","DOI":"10.3390\/s23135941","volume":"23","author":"ECP Neto","year":"2023","unstructured":"Neto, E. C. P. et al. CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment. Sensors 23(14), 5941 (2023).","journal-title":"Sensors"},{"key":"67450_CR20","doi-asserted-by":"publisher","first-page":"321","DOI":"10.1613\/jair.953","volume":"16","author":"NV Chawla","year":"2002","unstructured":"Chawla, N. V., Bowyer, K. W., Hall, L. O. & Kegelmeyer, W. P. SMOTE: Synthetic minority over-sampling technique. J. Artif. Intell. Res. 16, 321\u2013357 (2002).","journal-title":"J. Artif. Intell. Res."}],"container-title":["Scientific Reports"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-67450-9","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-67450-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-67450-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,3]],"date-time":"2026-09-03T06:03:16Z","timestamp":1788415396000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.nature.com\/articles\/s41598-026-67450-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,2]]},"references-count":20,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["67450"],"URL":"https:\/\/doi.org\/10.1038\/s41598-026-67450-9","relation":{},"ISSN":["2045-2322"],"issn-type":[{"value":"2045-2322","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,2]]},"assertion":[{"value":"29 May 2026","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"14 August 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 September 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"The authors declare no conflict of interest.","order":1,"name":"Ethics","label":"Competing interest","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","label":"Ethical approval and consent to participate","group":{"name":"EthicsHeading","label":"Declarations"}}],"article-number":"27559"}}