{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,2]],"date-time":"2026-04-02T15:52:51Z","timestamp":1775145171233,"version":"3.50.1"},"reference-count":42,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2025,7,23]],"date-time":"2025-07-23T00:00:00Z","timestamp":1753228800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Ministry of Higher Education of the Republic of Kazakhstan","award":["1090413702304 (Not exa\u0441tly)"],"award-info":[{"award-number":["1090413702304 (Not exa\u0441tly)"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JSAN"],"abstract":"<jats:p>This paper presents a large-scale empirical study aimed at identifying the optimal local deep learning model and data volume for deploying intrusion detection systems (IDS) on resource-constrained IoT devices using federated learning (FL). While previous studies on FL-based IDS for IoT have primarily focused on maximizing accuracy, they often overlook the computational limitations of IoT hardware and the feasibility of local model deployment. In this work, three deep learning architectures\u2014a deep neural network (DNN), a convolutional neural network (CNN), and a hybrid CNN+BiLSTM\u2014are trained using the CICIoT2023 dataset within a federated learning environment simulating up to 150 IoT devices. The study evaluates how detection accuracy, convergence speed, and inference costs (latency and model size) vary across different local data scales and model complexities. Results demonstrate that CNN achieves the best trade-off between detection performance and computational efficiency, reaching ~98% accuracy with low latency and a compact model footprint. The more complex CNN+BiLSTM architecture yields slightly higher accuracy (~99%) at a significantly greater computational cost. Deployment tests on Raspberry Pi 5 devices confirm that all three models can be effectively implemented on real-world IoT edge hardware. These findings offer practical guidance for researchers and practitioners in selecting scalable and lightweight IDS models suitable for real-world federated IoT deployments, supporting secure and efficient anomaly detection in urban IoT networks.<\/jats:p>","DOI":"10.3390\/jsan14040078","type":"journal-article","created":{"date-parts":[[2025,7,23]],"date-time":"2025-07-23T10:49:17Z","timestamp":1753267757000},"page":"78","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":23,"title":["Federated Learning-Based Intrusion Detection in IoT Networks: Performance Evaluation and Data Scaling Study"],"prefix":"10.3390","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3393-7380","authenticated-orcid":false,"given":"Nurtay","family":"Albanbay","sequence":"first","affiliation":[{"name":"Institute of Automation and Information Technologies, Satbayev University, Satbayev 22, Almaty 050013, Kazakhstan"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-9520-3030","authenticated-orcid":false,"given":"Yerlan","family":"Tursynbek","sequence":"additional","affiliation":[{"name":"Institute of Automation and Information Technologies, Satbayev University, Satbayev 22, Almaty 050013, Kazakhstan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1708-6835","authenticated-orcid":false,"given":"Kalman","family":"Graffi","sequence":"additional","affiliation":[{"name":"Department for Computer Science, Technical University of Applied Sciences Bingen, Berlinstr. 109, 55411 Bingen, Germany"}]},{"given":"Raissa","family":"Uskenbayeva","sequence":"additional","affiliation":[{"name":"Institute of Automation and Information Technologies, Satbayev University, Satbayev 22, Almaty 050013, Kazakhstan"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4970-3095","authenticated-orcid":false,"given":"Zhuldyz","family":"Kalpeyeva","sequence":"additional","affiliation":[{"name":"Institute of Automation and Information Technologies, Satbayev University, Satbayev 22, Almaty 050013, Kazakhstan"}]},{"given":"Zhastalap","family":"Abilkaiyr","sequence":"additional","affiliation":[{"name":"Institute of Automation and Information Technologies, Satbayev University, Satbayev 22, Almaty 050013, Kazakhstan"}]},{"given":"Yerlan","family":"Ayapov","sequence":"additional","affiliation":[{"name":"Institute of Automation and Information Technologies, Satbayev University, Satbayev 22, Almaty 050013, Kazakhstan"}]}],"member":"1968","published-online":{"date-parts":[[2025,7,23]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"335","DOI":"10.1016\/j.procs.2024.04.034","article-title":"A review of IoT security: Machine learning and deep learning perspective","volume":"235","author":"Dubey","year":"2024","journal-title":"Procedia Comput. Sci."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"100936","DOI":"10.1016\/j.iot.2023.100936","article-title":"Enhancing IoT network security through deep learning-powered intrusion detection system","volume":"24","author":"Bakhsh","year":"2023","journal-title":"Internet Things"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"101336","DOI":"10.1016\/j.iot.2024.101336","article-title":"A novel deep learning-based intrusion detection system for IoT DDoS security","volume":"28","author":"Hizal","year":"2024","journal-title":"Internet Things"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Delwar, T.S., Aras, U., Mukhopadhyay, S., Kumar, A., Kshirsagar, U., Lee, Y., Singh, M., and Ryu, J.-Y. (2024). The intersection of machine learning and wireless sensor network security for cyber-attack detection: A detailed analysis. Sensors, 24.","DOI":"10.3390\/s24196377"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"3211","DOI":"10.1007\/s11831-020-09496-0","article-title":"A review on machine learning and deep learning perspectives of IDS for IoT: Recent updates, 783 security issues, and challenges","volume":"28","author":"Thakkar","year":"2021","journal-title":"Arch. Comput. Methods Eng."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"106775","DOI":"10.1016\/j.knosys.2021.106775","article-title":"A survey on federated learning","volume":"216","author":"Zhang","year":"2021","journal-title":"Knowl.-Based Syst."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"258","DOI":"10.1016\/j.iotcps.2024.01.003","article-title":"Multi-objective optimization algorithms for intrusion detection in IoT networks: A systematic review","volume":"4","author":"Sharma","year":"2024","journal-title":"Internet Things Cyber-Phys. Syst."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Ahmad, R., Wazirali, R., and Abu-Ain, T. (2022). Machine learning for wireless sensor networks security: An overview of challenges and issues. Sensors, 22.","DOI":"10.3390\/s22134730"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1125","DOI":"10.1109\/JIOT.2017.2683200","article-title":"A survey on internet of things: Architecture, enabling technologies, security and privacy, and applications","volume":"4","author":"Lin","year":"2017","journal-title":"IEEE Internet Things J."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"28","DOI":"10.55056\/jec.648","article-title":"A long short-term memory based approach for detecting cyber attacks in IoT using CIC-822 IoT2023 dataset","volume":"3","author":"Jony","year":"2024","journal-title":"J. Edge Comput."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"66290","DOI":"10.1109\/ACCESS.2025.3550392","article-title":"Leveraging AI for Intrusion Detection in IoT Ecosystems: A Comprehensive Study","volume":"13","author":"Sharma","year":"2025","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Aljabri, M., Alahmadi, A.A., Mohammad, R.M.A., Alhaidari, F., Aboulnour, M., Alomari, D.M., and Mirza, S. (2023). Machine learning-based detection for unauthorized access to IoT devices. J. Sens. Actuator Netw., 12.","DOI":"10.3390\/jsan12020027"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Haque, S., El-Moussa, F., Komninos, N., and Muttukrishnan, R. (2023). A systematic review of data-driven attack detection trends in IoT. Sensors, 23.","DOI":"10.3390\/s23167191"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"4745","DOI":"10.1109\/ACCESS.2023.3349287","article-title":"A survey of deep learning technologies for intrusion detection in Internet of Things","volume":"12","author":"Liao","year":"2024","journal-title":"IEEE Access"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Shukla, K.A., Ahamad, S., Rao, G.N., Al-Asadi, A.J., Gupta, A., and Kumbhkar, M. (2021, January 16\u201317). Artificial intelligence assisted IoT data intrusion detection. Proceedings of the 2021 4th International Conference on Computing and Communications Technologies (ICCCT), Chennai, India.","DOI":"10.1109\/ICCCT53315.2021.9711795"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"3206","DOI":"10.1109\/JIOT.2021.3134932","article-title":"Emergent deep learning for anomaly detection in Internet of Everything","volume":"10","author":"Djenouri","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref_17","first-page":"627","article-title":"Internet of Things cyber attacks detection using machine learning","volume":"10","author":"Alsamiri","year":"2019","journal-title":"Int. J. Adv. Comput. Sci. Appl."},{"key":"ref_18","first-page":"56","article-title":"Securing the Internet of Things: Evaluating machine learning algorithms for detecting IoT cyberattacks using CIC-IoT2023 dataset","volume":"16","author":"Jony","year":"2024","journal-title":"Int. J. Inf. Technol. Comput. Sci."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Okey, O.D., Rodriguez, D.Z., and Kleinschmidt, J.H. (2024, January 14\u201317). Enhancing IoT Intrusion Detection with Federated Learning-Based CNN-GRU and LSTM-GRU Ensembles. Proceedings of the 2024 19th International Symposium on Wireless Communication Systems (ISWCS), Rio de Janeiro, Brazil.","DOI":"10.1109\/ISWCS61526.2024.10639159"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Nguyen, T.D., Marchal, S., Miettinen, M., Fereidooni, H., Asokan, N., and Sadeghi, A.-R. (2019, January 7\u20139). D\u00cfoT: A Federated Self-learning Anomaly Detection System for IoT. Proceedings of the 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), Dallas, TX, USA.","DOI":"10.1109\/ICDCS.2019.00080"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"40281","DOI":"10.1109\/ACCESS.2022.3165809","article-title":"Edge-IIoTset: A new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning","volume":"10","author":"Ferrag","year":"2022","journal-title":"IEEE Access"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"108661","DOI":"10.1016\/j.comnet.2021.108661","article-title":"Evaluating federated learning for intrusion detection in internet of things: Review and challenges","volume":"203","author":"Campos","year":"2022","journal-title":"Comput. Netw."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"138537","DOI":"10.1109\/ACCESS.2021.3118642","article-title":"Federated deep learning for cyber security in the Internet of Things: Concepts, applications, and experimental analysis","volume":"9","author":"Ferrag","year":"2021","journal-title":"IEEE Access"},{"key":"ref_24","unstructured":"Bhagoji, A.N., Chakraborty, S., Mittal, P., and Calo, S. (2019, January 9\u201315). Analyzing federated learning through an adversarial lens. Proceedings of the International Conference on Machine Learning, Long Beach, CA, USA."},{"key":"ref_25","first-page":"108917","article-title":"Federated learning for malware detection in IoT devices","volume":"209","author":"Rey","year":"2022","journal-title":"Comput. Netw."},{"key":"ref_26","first-page":"200462","article-title":"Computationally efficient deep federated learning with optimized feature selection for IoT botnet attack detection","volume":"25","author":"Danquah","year":"2024","journal-title":"Intell. Syst. Appl."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Savelyeva, D.D., and Tatarnikova, T.M. (2024, January 3\u20137). Hybrid System for Monitoring the Traffic Consumption of IoT Devices. Proceedings of the 2024 Wave Electronics and Its Application in Information and Telecommunication Systems (WECONF), St. Petersburg, Russia.","DOI":"10.1109\/WECONF61770.2024.10564594"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Sun, S., Sharma, P., Nwodo, K., Stavrou, A., and Wang, H. (2024). FedMADE: Robust Federated Learning for Intrusion Detection in IoT Networks Using a Dynamic Aggregation Method. International Conference on Information Security, Springer International Publishing.","DOI":"10.1007\/978-3-031-75764-8_15"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Alsaleh, S., Menai, M.E.B., and Al-Ahmadi, S. (2025). A Heterogeneity-Aware Semi-Decentralized Model for a Lightweight Intrusion Detection System for IoT Networks Based on Federated Learning and BiLSTM. Sensors, 25.","DOI":"10.3390\/s25041039"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Devine, M., Ardakani, S.P., Al-Khafajiy, M., and James, Y. (2025). Federated machine learning to enable intrusion detection systems in IoT networks. Electronics, 14.","DOI":"10.3390\/electronics14061176"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"103540","DOI":"10.1016\/j.adhoc.2024.103540","article-title":"A federated learning-based zero trust intrusion detection system for Internet of Things","volume":"162","author":"Javeed","year":"2024","journal-title":"Ad Hoc Netw."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Belenguer, A., Navaridas, J., and Pascual, J.A. (2022). A review of federated learning in intrusion detection systems for IoT. arXiv.","DOI":"10.2139\/ssrn.4261807"},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Rosay, A., Cheval, E., Carlier, F., and Leroux, P. (2022, January 9\u201311). Network intrusion detection: A comprehensive analysis of CIC-IDS2017. Proceedings of the 8th International Conference on Information Systems Security and Privacy, Online.","DOI":"10.5220\/0010774000003120"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-baiot\u2014Network-based detection of iot botnet attacks using deep autoencoders","volume":"17","author":"Meidan","year":"2018","journal-title":"IEEE Pervasive Comput."},{"key":"ref_36","unstructured":"Parmisano, A., Garcia, S., and Erquiaga, M.J. (2020). A Labeled Dataset with Malicious and Benign IoT Network Traffic, Stratosphere Laboratory."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Guerra-Manzanares, A., Medina-Galindo, J., Bahsi, H., and N\u00f5mm, S. (2020, January 25\u201327). MedBIoT: Generation of an IoT botnet dataset in a medium-sized IoT network. Proceedings of the 6th International Conference on Information Systems Security and Privacy ICISSP, Valletta, Malta.","DOI":"10.5220\/0009187802070218"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Vaccari, I., Chiola, G., Aiello, M., Mongelli, M., and Cambiaso, E. (2020). MQTTset, a new dataset for machine learning techniques on MQTT. Sensors, 20.","DOI":"10.3390\/s20226578"},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","article-title":"TON_IoT telemetry dataset: A new generation dataset of IoT and IIoT for data-driven intrusion detection systems","volume":"8","author":"Alsaedi","year":"2020","journal-title":"IEEE Access"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Neto, E.C.P., Dadkhah, S., Ferreira, R., Zohourian, A., Lu, R., and Ghorbani, A.A. (2023). CICIoT2023: A real-time dataset and 787 benchmark for large-scale attacks in IoT environment. Sensors, 23.","DOI":"10.20944\/preprints202305.0443.v1"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Biswas, K., Reza, A., Karri, M., Jha, D., Pan, H., Tomar, N., and Bagci, U. (March, January 28). Optimizing Neural Network Effectiveness via Non-monotonicity Refinement. Proceedings of the 2025 IEEE\/CVF Winter Conference on Applications of Computer Vision (WACV), Tucson, AZ, USA.","DOI":"10.1109\/WACV61041.2025.00422"},{"key":"ref_42","unstructured":"Powers David, M.W. (2020). Evaluation: From precision, recall and F-measure to ROC, informedness, markedness and correlation. arXiv."}],"container-title":["Journal of Sensor and Actuator Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2224-2708\/14\/4\/78\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:14:26Z","timestamp":1760033666000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2224-2708\/14\/4\/78"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,23]]},"references-count":42,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2025,8]]}},"alternative-id":["jsan14040078"],"URL":"https:\/\/doi.org\/10.3390\/jsan14040078","relation":{},"ISSN":["2224-2708"],"issn-type":[{"value":"2224-2708","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,7,23]]}}}